Skip to content

Commit 870389a

Browse files
committed
Revert "Python: Re-introduce syntactic handling of str/bytes/unicode"
This reverts commit c4987e9. Hoping that our new handling of builtins would solve this problem... but it did not :|
1 parent af13064 commit 870389a

File tree

2 files changed

+3
-5
lines changed

2 files changed

+3
-5
lines changed

python/ql/src/semmle/python/dataflow/new/internal/TaintTrackingPrivate.qll

Lines changed: 1 addition & 5 deletions
Original file line numberDiff line numberDiff line change
@@ -77,11 +77,7 @@ predicate subscriptStep(DataFlow::CfgNode nodeFrom, DataFlow::CfgNode nodeTo) {
7777
predicate stringManipulation(DataFlow::CfgNode nodeFrom, DataFlow::CfgNode nodeTo) {
7878
// transforming something tainted into a string will make the string tainted
7979
exists(DataFlow::CallCfgNode call | call = nodeTo |
80-
(
81-
call = API::builtin(["str", "bytes", "unicode"]).getACall()
82-
or
83-
call.getFunction().asCfgNode().(NameNode).getId() in ["str", "bytes", "unicode"]
84-
) and
80+
call = API::builtin(["str", "bytes", "unicode"]).getACall() and
8581
nodeFrom in [call.getArg(0), call.getArgByName("object")]
8682
)
8783
or
Original file line numberDiff line numberDiff line change
@@ -1,3 +1,5 @@
11
argumentToEnsureNotTaintedNotMarkedAsSpurious
22
untaintedArgumentToEnsureTaintedNotMarkedAsMissing
3+
| test_string.py:35:9:35:19 | test_string.py:35 | ERROR, you should add `# $ MISSING: tainted` annotation | unicode(..) |
34
failures
5+
| test_string.py:35:22:35:32 | Comment # $ tainted | Missing result:tainted= |

0 commit comments

Comments
 (0)