Skip to content

Commit 0ce8e91

Browse files
committed
Python: Remove code that adds taint to unrelated ControlFlowNode
The problem with the deleted code is that it would add flow to what might be an unrelated ControlFlowNode, which is illustrated in the query below (that gives results on flask) from ControlFlowNode arg, CallNode call, CallNode other_call where call.getNode().getAKeyword().getValue() = arg.getNode() and not call.getAnArg() = arg and other_call.getAnArg() = arg and not other_call = call select call, arg, other_call
1 parent cac5d00 commit 0ce8e91

File tree

1 file changed

+0
-3
lines changed
  • python/ql/src/semmle/python/security/strings

1 file changed

+0
-3
lines changed

python/ql/src/semmle/python/security/strings/Basic.qll

Lines changed: 0 additions & 3 deletions
Original file line numberDiff line numberDiff line change
@@ -73,9 +73,6 @@ private predicate str_format(ControlFlowNode fromnode, CallNode tonode) {
7373
tonode.getFunction().(AttrNode).getName() = "format" and
7474
(
7575
tonode.getAnArg() = fromnode
76-
or
77-
// TODO: if this case is not covered by tonode.getAnArg(), we should change it so it is :\
78-
tonode.getNode().getAKeyword().getValue() = fromnode.getNode()
7976
)
8077
}
8178

0 commit comments

Comments
 (0)