Skip to content

Commit 86333e3

Browse files
RasmusWLRasmusWL
committed
Python: Remove duplicate results from azure blob query
1 parent 32d52c0 commit 86333e3

File tree

2 files changed

+21
-20
lines changed

2 files changed

+21
-20
lines changed

‎python/ql/src/experimental/Security/CWE-327/Azure/UnsafeUsageOfClientSideEncryptionVersion.ql

Lines changed: 21 additions & 11 deletions
Original file line numberDiff line numberDiff line change
@@ -15,14 +15,16 @@ import python
1515
import semmle.python.dataflow.new.DataFlow
1616
import semmle.python.ApiGraphs
1717

18-
API::Node getBlobServiceClient() {
18+
API::Node getBlobServiceClient(boolean isSource) {
19+
isSource = true and
1920
result =
2021
API::moduleImport("azure")
2122
.getMember("storage")
2223
.getMember("blob")
2324
.getMember("BlobServiceClient")
2425
.getReturn()
2526
or
27+
isSource = true and
2628
result =
2729
API::moduleImport("azure")
2830
.getMember("storage")
@@ -33,21 +35,24 @@ API::Node getBlobServiceClient() {
3335
}
3436

3537
API::CallNode getTransitionToContainerClient() {
36-
result = getBlobServiceClient().getMember("get_container_client").getACall()
38+
result = getBlobServiceClient(_).getMember("get_container_client").getACall()
3739
or
38-
result = getBlobClient().getMember("_get_container_client").getACall()
40+
result = getBlobClient(_).getMember("_get_container_client").getACall()
3941
}
4042

41-
API::Node getContainerClient() {
43+
API::Node getContainerClient(boolean isSource) {
44+
isSource = false and
4245
result = getTransitionToContainerClient().getReturn()
4346
or
47+
isSource = true and
4448
result =
4549
API::moduleImport("azure")
4650
.getMember("storage")
4751
.getMember("blob")
4852
.getMember("ContainerClient")
4953
.getReturn()
5054
or
55+
isSource = true and
5156
result =
5257
API::moduleImport("azure")
5358
.getMember("storage")
@@ -58,19 +63,22 @@ API::Node getContainerClient() {
5863
}
5964

6065
API::CallNode getTransitionToBlobClient() {
61-
result = [getBlobServiceClient(), getContainerClient()].getMember("get_blob_client").getACall()
66+
result = [getBlobServiceClient(_), getContainerClient(_)].getMember("get_blob_client").getACall()
6267
}
6368

64-
API::Node getBlobClient() {
69+
API::Node getBlobClient(boolean isSource) {
70+
isSource = false and
6571
result = getTransitionToBlobClient().getReturn()
6672
or
73+
isSource = true and
6774
result =
6875
API::moduleImport("azure")
6976
.getMember("storage")
7077
.getMember("blob")
7178
.getMember("BlobClient")
7279
.getReturn()
7380
or
81+
isSource = true and
7482
result =
7583
API::moduleImport("azure")
7684
.getMember("storage")
@@ -80,7 +88,9 @@ API::Node getBlobClient() {
8088
.getReturn()
8189
}
8290

83-
API::Node anyClient() { result in [getBlobServiceClient(), getContainerClient(), getBlobClient()] }
91+
API::Node anyClient(boolean isSource) {
92+
result in [getBlobServiceClient(isSource), getContainerClient(isSource), getBlobClient(isSource)]
93+
}
8494

8595
newtype TAzureFlowState =
8696
MkUsesV1Encryption() or
@@ -91,13 +101,13 @@ module AzureBlobClientConfig implements DataFlow::StateConfigSig {
91101

92102
predicate isSource(DataFlow::Node node, FlowState state) {
93103
state = MkUsesNoEncryption() and
94-
node = anyClient().asSource()
104+
node = anyClient(true).asSource()
95105
}
96106

97107
predicate isBarrier(DataFlow::Node node, FlowState state) {
98108
exists(state) and
99109
exists(DataFlow::AttrWrite attr |
100-
node = anyClient().getAValueReachableFromSource() and
110+
node = anyClient(_).getAValueReachableFromSource() and
101111
attr.accesses(node, "encryption_version") and
102112
attr.getValue().asExpr().(StrConst).getText() in ["'2.0'", "2.0"]
103113
)
@@ -118,15 +128,15 @@ module AzureBlobClientConfig implements DataFlow::StateConfigSig {
118128
state1 = MkUsesNoEncryption() and
119129
state2 = MkUsesV1Encryption() and
120130
exists(DataFlow::AttrWrite attr |
121-
node1 = anyClient().getAValueReachableFromSource() and
131+
node1 = anyClient(_).getAValueReachableFromSource() and
122132
attr.accesses(node1, ["key_encryption_key", "key_resolver_function"])
123133
)
124134
}
125135

126136
predicate isSink(DataFlow::Node node, FlowState state) {
127137
state = MkUsesV1Encryption() and
128138
exists(DataFlow::MethodCallNode call |
129-
call = getBlobClient().getMember("upload_blob").getACall() and
139+
call = getBlobClient(_).getMember("upload_blob").getACall() and
130140
node = call.getObject()
131141
)
132142
}

‎python/ql/test/experimental/query-tests/Security/CWE-327-UnsafeUsageOfClientSideEncryptionVersion/UnsafeUsageOfClientSideEncryptionVersion.expected

Lines changed: 0 additions & 9 deletions
Original file line numberDiff line numberDiff line change
@@ -5,7 +5,6 @@ edges
55
| test.py:3:1:3:3 | GSSA Variable BSC | test.py:0:0:0:0 | ModuleVariableNode for test.BSC |
66
| test.py:3:7:3:51 | ControlFlowNode for Attribute() | test.py:3:1:3:3 | GSSA Variable BSC |
77
| test.py:7:19:7:21 | ControlFlowNode for BSC | test.py:8:5:8:15 | ControlFlowNode for blob_client |
8-
| test.py:7:19:7:42 | ControlFlowNode for Attribute() | test.py:8:5:8:15 | ControlFlowNode for blob_client |
98
| test.py:8:5:8:15 | ControlFlowNode for blob_client | test.py:9:5:9:15 | ControlFlowNode for blob_client |
109
| test.py:9:5:9:15 | ControlFlowNode for blob_client | test.py:9:5:9:15 | ControlFlowNode for blob_client |
1110
| test.py:9:5:9:15 | ControlFlowNode for blob_client | test.py:11:9:11:19 | ControlFlowNode for blob_client |
@@ -18,12 +17,10 @@ edges
1817
| test.py:27:5:27:20 | ControlFlowNode for container_client | test.py:27:5:27:20 | ControlFlowNode for container_client |
1918
| test.py:27:5:27:20 | ControlFlowNode for container_client | test.py:31:9:31:19 | ControlFlowNode for blob_client |
2019
| test.py:35:19:35:21 | ControlFlowNode for BSC | test.py:36:5:36:15 | ControlFlowNode for blob_client |
21-
| test.py:35:19:35:42 | ControlFlowNode for Attribute() | test.py:36:5:36:15 | ControlFlowNode for blob_client |
2220
| test.py:36:5:36:15 | ControlFlowNode for blob_client | test.py:37:5:37:15 | ControlFlowNode for blob_client |
2321
| test.py:37:5:37:15 | ControlFlowNode for blob_client | test.py:37:5:37:15 | ControlFlowNode for blob_client |
2422
| test.py:37:5:37:15 | ControlFlowNode for blob_client | test.py:43:9:43:19 | ControlFlowNode for blob_client |
2523
| test.py:66:19:66:21 | ControlFlowNode for BSC | test.py:67:5:67:15 | ControlFlowNode for blob_client |
26-
| test.py:66:19:66:42 | ControlFlowNode for Attribute() | test.py:67:5:67:15 | ControlFlowNode for blob_client |
2724
| test.py:67:5:67:15 | ControlFlowNode for blob_client | test.py:68:5:68:15 | ControlFlowNode for blob_client |
2825
| test.py:68:5:68:15 | ControlFlowNode for blob_client | test.py:68:5:68:15 | ControlFlowNode for blob_client |
2926
| test.py:68:5:68:15 | ControlFlowNode for blob_client | test.py:69:12:69:22 | ControlFlowNode for blob_client |
@@ -34,7 +31,6 @@ nodes
3431
| test.py:3:1:3:3 | GSSA Variable BSC | semmle.label | GSSA Variable BSC |
3532
| test.py:3:7:3:51 | ControlFlowNode for Attribute() | semmle.label | ControlFlowNode for Attribute() |
3633
| test.py:7:19:7:21 | ControlFlowNode for BSC | semmle.label | ControlFlowNode for BSC |
37-
| test.py:7:19:7:42 | ControlFlowNode for Attribute() | semmle.label | ControlFlowNode for Attribute() |
3834
| test.py:8:5:8:15 | ControlFlowNode for blob_client | semmle.label | ControlFlowNode for blob_client |
3935
| test.py:9:5:9:15 | ControlFlowNode for blob_client | semmle.label | ControlFlowNode for blob_client |
4036
| test.py:9:5:9:15 | ControlFlowNode for blob_client | semmle.label | ControlFlowNode for blob_client |
@@ -50,13 +46,11 @@ nodes
5046
| test.py:27:5:27:20 | ControlFlowNode for container_client | semmle.label | ControlFlowNode for container_client |
5147
| test.py:31:9:31:19 | ControlFlowNode for blob_client | semmle.label | ControlFlowNode for blob_client |
5248
| test.py:35:19:35:21 | ControlFlowNode for BSC | semmle.label | ControlFlowNode for BSC |
53-
| test.py:35:19:35:42 | ControlFlowNode for Attribute() | semmle.label | ControlFlowNode for Attribute() |
5449
| test.py:36:5:36:15 | ControlFlowNode for blob_client | semmle.label | ControlFlowNode for blob_client |
5550
| test.py:37:5:37:15 | ControlFlowNode for blob_client | semmle.label | ControlFlowNode for blob_client |
5651
| test.py:37:5:37:15 | ControlFlowNode for blob_client | semmle.label | ControlFlowNode for blob_client |
5752
| test.py:43:9:43:19 | ControlFlowNode for blob_client | semmle.label | ControlFlowNode for blob_client |
5853
| test.py:66:19:66:21 | ControlFlowNode for BSC | semmle.label | ControlFlowNode for BSC |
59-
| test.py:66:19:66:42 | ControlFlowNode for Attribute() | semmle.label | ControlFlowNode for Attribute() |
6054
| test.py:67:5:67:15 | ControlFlowNode for blob_client | semmle.label | ControlFlowNode for blob_client |
6155
| test.py:68:5:68:15 | ControlFlowNode for blob_client | semmle.label | ControlFlowNode for blob_client |
6256
| test.py:68:5:68:15 | ControlFlowNode for blob_client | semmle.label | ControlFlowNode for blob_client |
@@ -66,10 +60,7 @@ nodes
6660
subpaths
6761
#select
6862
| test.py:11:9:11:19 | ControlFlowNode for blob_client | test.py:3:7:3:51 | ControlFlowNode for Attribute() | test.py:11:9:11:19 | ControlFlowNode for blob_client | Unsafe usage of v1 version of Azure Storage client-side encryption |
69-
| test.py:11:9:11:19 | ControlFlowNode for blob_client | test.py:7:19:7:42 | ControlFlowNode for Attribute() | test.py:11:9:11:19 | ControlFlowNode for blob_client | Unsafe usage of v1 version of Azure Storage client-side encryption |
7063
| test.py:21:9:21:19 | ControlFlowNode for blob_client | test.py:15:27:15:71 | ControlFlowNode for Attribute() | test.py:21:9:21:19 | ControlFlowNode for blob_client | Unsafe usage of v1 version of Azure Storage client-side encryption |
7164
| test.py:31:9:31:19 | ControlFlowNode for blob_client | test.py:25:24:25:66 | ControlFlowNode for Attribute() | test.py:31:9:31:19 | ControlFlowNode for blob_client | Unsafe usage of v1 version of Azure Storage client-side encryption |
7265
| test.py:43:9:43:19 | ControlFlowNode for blob_client | test.py:3:7:3:51 | ControlFlowNode for Attribute() | test.py:43:9:43:19 | ControlFlowNode for blob_client | Unsafe usage of v1 version of Azure Storage client-side encryption |
73-
| test.py:43:9:43:19 | ControlFlowNode for blob_client | test.py:35:19:35:42 | ControlFlowNode for Attribute() | test.py:43:9:43:19 | ControlFlowNode for blob_client | Unsafe usage of v1 version of Azure Storage client-side encryption |
7466
| test.py:75:9:75:10 | ControlFlowNode for bc | test.py:3:7:3:51 | ControlFlowNode for Attribute() | test.py:75:9:75:10 | ControlFlowNode for bc | Unsafe usage of v1 version of Azure Storage client-side encryption |
75-
| test.py:75:9:75:10 | ControlFlowNode for bc | test.py:66:19:66:42 | ControlFlowNode for Attribute() | test.py:75:9:75:10 | ControlFlowNode for bc | Unsafe usage of v1 version of Azure Storage client-side encryption |

0 commit comments

Comments
 (0)