Python: Model keyword arguments to dill.loads

Author: RasmusWL

python/ql/lib/semmle/python/frameworks/Dill.qll

@@ -24,7 +24,7 @@ private module Dill {
 
     override predicate mayExecuteInput() { any() }
 
-    override DataFlow::Node getAnInput() { result = this.getArg(0) }
+    override DataFlow::Node getAnInput() { result in [this.getArg(0), this.getArgByName("str")] }
 
     override DataFlow::Node getOutput() { result = this }
 

python/ql/test/library-tests/frameworks/dill/Decoding.py

@@ -3,4 +3,4 @@
 dill.load(file_)  # $ MISSING: decodeInput=file_ decodeOutput=dill.loads(..) decodeFormat=dill decodeMayExecuteInput
 dill.load(file=file_)  # $ MISSING: decodeInput=file_ decodeOutput=dill.loads(..) decodeFormat=dill decodeMayExecuteInput
 dill.loads(payload)  # $ decodeInput=payload decodeOutput=dill.loads(..) decodeFormat=dill decodeMayExecuteInput
-dill.loads(str=payload)  # $ decodeOutput=dill.loads(..) decodeFormat=dill decodeMayExecuteInput MISSING: decodeInput=payload
+dill.loads(str=payload)  # $ decodeInput=payload decodeOutput=dill.loads(..) decodeFormat=dill decodeMayExecuteInput