Skip to content

Commit c479a77

Browse files
committed
Python: Refactor ExternalFileObject to use field
Instead of string matching. This brings it in line with what CollectionKind, SequenceKind, and DictKind does.
1 parent da32926 commit c479a77

File tree

1 file changed

+4
-2
lines changed

1 file changed

+4
-2
lines changed

python/ql/src/semmle/python/security/strings/External.qll

Lines changed: 4 additions & 2 deletions
Original file line numberDiff line numberDiff line change
@@ -183,10 +183,12 @@ private predicate urlparse(ControlFlowNode fromnode, CallNode tonode) {
183183

184184
/** A kind of "taint", representing an open file-like object from an external source. */
185185
class ExternalFileObject extends TaintKind {
186-
ExternalFileObject() { this = "file[" + any(ExternalStringKind key) + "]" }
186+
ExternalStringKind valueKind;
187+
188+
ExternalFileObject() { this = "file[" + valueKind + "]" }
187189

188190
/** Gets the taint kind for the contents of this file */
189-
TaintKind getValue() { this = "file[" + result + "]" }
191+
TaintKind getValue() { result = valueKind }
190192

191193
override TaintKind getTaintOfMethodResult(string name) {
192194
name = "read" and result = this.getValue()

0 commit comments

Comments
 (0)