Skip to content

Commit 8d3170b

Browse files
committed
Python: Fix bad join in crypto models
1 parent 32d0790 commit 8d3170b

File tree

1 file changed

+14
-1
lines changed

1 file changed

+14
-1
lines changed

python/ql/src/semmle/python/frameworks/Cryptography.qll

Lines changed: 14 additions & 1 deletion
Original file line numberDiff line numberDiff line change
@@ -432,11 +432,24 @@ private module CryptographyModel {
432432
curveClassWithKeySize(keySize).asCfgNode() and
433433
origin = result
434434
or
435+
// Due to bad performance when using normal setup with we have inlined that code and forced a join
435436
exists(DataFlow::TypeTracker t2 |
436-
result = curveClassInstanceWithKeySize(t2, keySize, origin).track(t2, t)
437+
exists(DataFlow::StepSummary summary |
438+
curveClassInstanceWithKeySize_first_join(t2, keySize, origin, result, summary) and
439+
t = t2.append(summary)
440+
)
437441
)
438442
}
439443

444+
pragma[nomagic]
445+
private predicate curveClassInstanceWithKeySize_first_join(
446+
DataFlow::TypeTracker t2, int keySize, DataFlow::Node origin, DataFlow::Node res,
447+
DataFlow::StepSummary summary
448+
) {
449+
DataFlow::StepSummary::step(curveClassInstanceWithKeySize(t2, keySize, origin), res,
450+
summary)
451+
}
452+
440453
/** Gets a reference to a predefined curve class instance with a specific key size (in bits), as well as the origin of the class. */
441454
DataFlow::Node curveClassInstanceWithKeySize(int keySize, DataFlow::Node origin) {
442455
result = curveClassInstanceWithKeySize(DataFlow::TypeTracker::end(), keySize, origin)

0 commit comments

Comments
 (0)