Skip to content

Commit db86a18

Browse files
RasmusWLRasmusWL
committed
Python: Autoformat
1 parent 0125aea commit db86a18

17 files changed

+279
-297
lines changed

‎python/ql/lib/semmle/python/security/dataflow/CleartextLoggingQuery.qll

Lines changed: 13 additions & 15 deletions
Original file line numberDiff line numberDiff line change
@@ -13,23 +13,21 @@ private import semmle.python.Concepts
1313
private import semmle.python.dataflow.new.RemoteFlowSources
1414
private import semmle.python.dataflow.new.BarrierGuards
1515
private import semmle.python.dataflow.new.SensitiveDataSources
16+
import CleartextLoggingCustomizations::CleartextLogging
1617

18+
/**
19+
* A taint-tracking configuration for detecting "Clear-text logging of sensitive information".
20+
*/
21+
class Configuration extends TaintTracking::Configuration {
22+
Configuration() { this = "CleartextLogging" }
1723

18-
import CleartextLoggingCustomizations::CleartextLogging
19-
20-
/**
21-
* A taint-tracking configuration for detecting "Clear-text logging of sensitive information".
22-
*/
23-
class Configuration extends TaintTracking::Configuration {
24-
Configuration() { this = "CleartextLogging" }
25-
26-
override predicate isSource(DataFlow::Node source) { source instanceof Source }
24+
override predicate isSource(DataFlow::Node source) { source instanceof Source }
2725

28-
override predicate isSink(DataFlow::Node sink) { sink instanceof Sink }
26+
override predicate isSink(DataFlow::Node sink) { sink instanceof Sink }
2927

30-
override predicate isSanitizer(DataFlow::Node node) {
31-
super.isSanitizer(node)
32-
or
33-
node instanceof Sanitizer
34-
}
28+
override predicate isSanitizer(DataFlow::Node node) {
29+
super.isSanitizer(node)
30+
or
31+
node instanceof Sanitizer
3532
}
33+
}

‎python/ql/lib/semmle/python/security/dataflow/CleartextStorageQuery.qll

Lines changed: 13 additions & 14 deletions
Original file line numberDiff line numberDiff line change
@@ -13,22 +13,21 @@ private import semmle.python.Concepts
1313
private import semmle.python.dataflow.new.RemoteFlowSources
1414
private import semmle.python.dataflow.new.BarrierGuards
1515
private import semmle.python.dataflow.new.SensitiveDataSources
16+
import CleartextStorageCustomizations::CleartextStorage
1617

17-
import CleartextStorageCustomizations::CleartextStorage
18-
19-
/**
20-
* A taint-tracking configuration for detecting "Clear-text storage of sensitive information".
21-
*/
22-
class Configuration extends TaintTracking::Configuration {
23-
Configuration() { this = "CleartextStorage" }
18+
/**
19+
* A taint-tracking configuration for detecting "Clear-text storage of sensitive information".
20+
*/
21+
class Configuration extends TaintTracking::Configuration {
22+
Configuration() { this = "CleartextStorage" }
2423

25-
override predicate isSource(DataFlow::Node source) { source instanceof Source }
24+
override predicate isSource(DataFlow::Node source) { source instanceof Source }
2625

27-
override predicate isSink(DataFlow::Node sink) { sink instanceof Sink }
26+
override predicate isSink(DataFlow::Node sink) { sink instanceof Sink }
2827

29-
override predicate isSanitizer(DataFlow::Node node) {
30-
super.isSanitizer(node)
31-
or
32-
node instanceof Sanitizer
33-
}
28+
override predicate isSanitizer(DataFlow::Node node) {
29+
super.isSanitizer(node)
30+
or
31+
node instanceof Sanitizer
3432
}
33+
}

‎python/ql/lib/semmle/python/security/dataflow/CodeInjectionQuery.qll

Lines changed: 12 additions & 13 deletions
Original file line numberDiff line numberDiff line change
@@ -9,22 +9,21 @@
99
private import python
1010
import semmle.python.dataflow.new.DataFlow
1111
import semmle.python.dataflow.new.TaintTracking
12+
import CodeInjectionCustomizations::CodeInjection
1213

13-
import CodeInjectionCustomizations::CodeInjection
14-
15-
/**
16-
* A taint-tracking configuration for detecting "code injection" vulnerabilities.
17-
*/
18-
class Configuration extends TaintTracking::Configuration {
19-
Configuration() { this = "CodeInjection" }
14+
/**
15+
* A taint-tracking configuration for detecting "code injection" vulnerabilities.
16+
*/
17+
class Configuration extends TaintTracking::Configuration {
18+
Configuration() { this = "CodeInjection" }
2019

21-
override predicate isSource(DataFlow::Node source) { source instanceof Source }
20+
override predicate isSource(DataFlow::Node source) { source instanceof Source }
2221

23-
override predicate isSink(DataFlow::Node sink) { sink instanceof Sink }
22+
override predicate isSink(DataFlow::Node sink) { sink instanceof Sink }
2423

25-
override predicate isSanitizer(DataFlow::Node node) { node instanceof Sanitizer }
24+
override predicate isSanitizer(DataFlow::Node node) { node instanceof Sanitizer }
2625

27-
override predicate isSanitizerGuard(DataFlow::BarrierGuard guard) {
28-
guard instanceof SanitizerGuard
29-
}
26+
override predicate isSanitizerGuard(DataFlow::BarrierGuard guard) {
27+
guard instanceof SanitizerGuard
3028
}
29+
}

‎python/ql/lib/semmle/python/security/dataflow/CommandInjectionQuery.qll

Lines changed: 12 additions & 13 deletions
Original file line numberDiff line numberDiff line change
@@ -9,22 +9,21 @@
99
private import python
1010
import semmle.python.dataflow.new.DataFlow
1111
import semmle.python.dataflow.new.TaintTracking
12+
import CommandInjectionCustomizations::CommandInjection
1213

13-
import CommandInjectionCustomizations::CommandInjection
14-
15-
/**
16-
* A taint-tracking configuration for detecting "command injection" vulnerabilities.
17-
*/
18-
class Configuration extends TaintTracking::Configuration {
19-
Configuration() { this = "CommandInjection" }
14+
/**
15+
* A taint-tracking configuration for detecting "command injection" vulnerabilities.
16+
*/
17+
class Configuration extends TaintTracking::Configuration {
18+
Configuration() { this = "CommandInjection" }
2019

21-
override predicate isSource(DataFlow::Node source) { source instanceof Source }
20+
override predicate isSource(DataFlow::Node source) { source instanceof Source }
2221

23-
override predicate isSink(DataFlow::Node sink) { sink instanceof Sink }
22+
override predicate isSink(DataFlow::Node sink) { sink instanceof Sink }
2423

25-
override predicate isSanitizer(DataFlow::Node node) { node instanceof Sanitizer }
24+
override predicate isSanitizer(DataFlow::Node node) { node instanceof Sanitizer }
2625

27-
override predicate isSanitizerGuard(DataFlow::BarrierGuard guard) {
28-
guard instanceof SanitizerGuard
29-
}
26+
override predicate isSanitizerGuard(DataFlow::BarrierGuard guard) {
27+
guard instanceof SanitizerGuard
3028
}
29+
}

‎python/ql/lib/semmle/python/security/dataflow/LdapInjectionQuery.qll

Lines changed: 25 additions & 26 deletions
Original file line numberDiff line numberDiff line change
@@ -11,41 +11,40 @@ import semmle.python.Concepts
1111
import semmle.python.dataflow.new.DataFlow
1212
import semmle.python.dataflow.new.TaintTracking
1313
import semmle.python.dataflow.new.RemoteFlowSources
14+
import LdapInjectionCustomizations::LdapInjection
1415

15-
import LdapInjectionCustomizations::LdapInjection
16-
17-
/**
18-
* A taint-tracking configuration for detecting LDAP injection vulnerabilities
19-
* via the distinguished name (DN) parameter of an LDAP search.
20-
*/
21-
class DnConfiguration extends TaintTracking::Configuration {
22-
DnConfiguration() { this = "LdapDnInjection" }
16+
/**
17+
* A taint-tracking configuration for detecting LDAP injection vulnerabilities
18+
* via the distinguished name (DN) parameter of an LDAP search.
19+
*/
20+
class DnConfiguration extends TaintTracking::Configuration {
21+
DnConfiguration() { this = "LdapDnInjection" }
2322

24-
override predicate isSource(DataFlow::Node source) { source instanceof Source }
23+
override predicate isSource(DataFlow::Node source) { source instanceof Source }
2524

26-
override predicate isSink(DataFlow::Node sink) { sink instanceof DnSink }
25+
override predicate isSink(DataFlow::Node sink) { sink instanceof DnSink }
2726

28-
override predicate isSanitizer(DataFlow::Node node) { node instanceof DnSanitizer }
27+
override predicate isSanitizer(DataFlow::Node node) { node instanceof DnSanitizer }
2928

30-
override predicate isSanitizerGuard(DataFlow::BarrierGuard guard) {
31-
guard instanceof DnSanitizerGuard
32-
}
29+
override predicate isSanitizerGuard(DataFlow::BarrierGuard guard) {
30+
guard instanceof DnSanitizerGuard
3331
}
32+
}
3433

35-
/**
36-
* A taint-tracking configuration for detecting LDAP injection vulnerabilities
37-
* via the filter parameter of an LDAP search.
38-
*/
39-
class FilterConfiguration extends TaintTracking::Configuration {
40-
FilterConfiguration() { this = "LdapFilterInjection" }
34+
/**
35+
* A taint-tracking configuration for detecting LDAP injection vulnerabilities
36+
* via the filter parameter of an LDAP search.
37+
*/
38+
class FilterConfiguration extends TaintTracking::Configuration {
39+
FilterConfiguration() { this = "LdapFilterInjection" }
4140

42-
override predicate isSource(DataFlow::Node source) { source instanceof Source }
41+
override predicate isSource(DataFlow::Node source) { source instanceof Source }
4342

44-
override predicate isSink(DataFlow::Node sink) { sink instanceof FilterSink }
43+
override predicate isSink(DataFlow::Node sink) { sink instanceof FilterSink }
4544

46-
override predicate isSanitizer(DataFlow::Node node) { node instanceof FilterSanitizer }
45+
override predicate isSanitizer(DataFlow::Node node) { node instanceof FilterSanitizer }
4746

48-
override predicate isSanitizerGuard(DataFlow::BarrierGuard guard) {
49-
guard instanceof FilterSanitizerGuard
50-
}
47+
override predicate isSanitizerGuard(DataFlow::BarrierGuard guard) {
48+
guard instanceof FilterSanitizerGuard
5149
}
50+
}

‎python/ql/lib/semmle/python/security/dataflow/LogInjectionQuery.qll

Lines changed: 12 additions & 13 deletions
Original file line numberDiff line numberDiff line change
@@ -9,22 +9,21 @@
99
import python
1010
import semmle.python.dataflow.new.DataFlow
1111
import semmle.python.dataflow.new.TaintTracking
12+
import LogInjectionCustomizations::LogInjection
1213

13-
import LogInjectionCustomizations::LogInjection
14-
15-
/**
16-
* A taint-tracking configuration for tracking untrusted user input used in log entries.
17-
*/
18-
class Configuration extends TaintTracking::Configuration {
19-
Configuration() { this = "LogInjection" }
14+
/**
15+
* A taint-tracking configuration for tracking untrusted user input used in log entries.
16+
*/
17+
class Configuration extends TaintTracking::Configuration {
18+
Configuration() { this = "LogInjection" }
2019

21-
override predicate isSource(DataFlow::Node source) { source instanceof Source }
20+
override predicate isSource(DataFlow::Node source) { source instanceof Source }
2221

23-
override predicate isSink(DataFlow::Node sink) { sink instanceof Sink }
22+
override predicate isSink(DataFlow::Node sink) { sink instanceof Sink }
2423

25-
override predicate isSanitizer(DataFlow::Node node) { node instanceof Sanitizer }
24+
override predicate isSanitizer(DataFlow::Node node) { node instanceof Sanitizer }
2625

27-
override predicate isSanitizerGuard(DataFlow::BarrierGuard guard) {
28-
guard instanceof SanitizerGuard
29-
}
26+
override predicate isSanitizerGuard(DataFlow::BarrierGuard guard) {
27+
guard instanceof SanitizerGuard
3028
}
29+
}

‎python/ql/lib/semmle/python/security/dataflow/PathInjection.qll

Lines changed: 0 additions & 1 deletion
Original file line numberDiff line numberDiff line change
@@ -18,7 +18,6 @@ module PathInjection {
1818
import PathInjectionQuery // ignore-query-import
1919
}
2020

21-
2221
// ---------------------------------------------------------------------------
2322
// Old, deprecated code
2423
// ---------------------------------------------------------------------------

‎python/ql/lib/semmle/python/security/dataflow/PathInjectionQuery.qll

Lines changed: 53 additions & 54 deletions
Original file line numberDiff line numberDiff line change
@@ -10,68 +10,67 @@ private import python
1010
private import semmle.python.Concepts
1111
import semmle.python.dataflow.new.DataFlow
1212
import semmle.python.dataflow.new.TaintTracking
13+
import PathInjectionCustomizations::PathInjection
1314

14-
import PathInjectionCustomizations::PathInjection
15-
16-
/**
17-
* A taint-tracking configuration for detecting "path injection" vulnerabilities.
18-
*
19-
* This configuration uses two flow states, `NotNormalized` and `NormalizedUnchecked`,
20-
* to track the requirement that a file path must be first normalized and then checked
21-
* before it is safe to use.
22-
*
23-
* At sources, paths are assumed not normalized. At normalization points, they change
24-
* state to `NormalizedUnchecked` after which they can be made safe by an appropriate
25-
* check of the prefix.
26-
*
27-
* Such checks are ineffective in the `NotNormalized` state.
28-
*/
29-
class Configuration extends TaintTracking::Configuration {
30-
Configuration() { this = "PathInjection" }
31-
32-
override predicate isSource(DataFlow::Node source, DataFlow::FlowState state) {
33-
source instanceof Source and state instanceof NotNormalized
34-
}
35-
36-
override predicate isSink(DataFlow::Node sink, DataFlow::FlowState state) {
37-
sink instanceof Sink and
38-
(
39-
state instanceof NotNormalized or
40-
state instanceof NormalizedUnchecked
41-
)
42-
}
15+
/**
16+
* A taint-tracking configuration for detecting "path injection" vulnerabilities.
17+
*
18+
* This configuration uses two flow states, `NotNormalized` and `NormalizedUnchecked`,
19+
* to track the requirement that a file path must be first normalized and then checked
20+
* before it is safe to use.
21+
*
22+
* At sources, paths are assumed not normalized. At normalization points, they change
23+
* state to `NormalizedUnchecked` after which they can be made safe by an appropriate
24+
* check of the prefix.
25+
*
26+
* Such checks are ineffective in the `NotNormalized` state.
27+
*/
28+
class Configuration extends TaintTracking::Configuration {
29+
Configuration() { this = "PathInjection" }
4330

44-
override predicate isSanitizer(DataFlow::Node node) { node instanceof Sanitizer }
31+
override predicate isSource(DataFlow::Node source, DataFlow::FlowState state) {
32+
source instanceof Source and state instanceof NotNormalized
33+
}
4534

46-
override predicate isSanitizer(DataFlow::Node node, DataFlow::FlowState state) {
47-
// Block `NotNormalized` paths here, since they change state to `NormalizedUnchecked`
48-
node instanceof Path::PathNormalization and
49-
state instanceof NotNormalized
50-
or
51-
node = any(Path::SafeAccessCheck c).getAGuardedNode() and
35+
override predicate isSink(DataFlow::Node sink, DataFlow::FlowState state) {
36+
sink instanceof Sink and
37+
(
38+
state instanceof NotNormalized or
5239
state instanceof NormalizedUnchecked
53-
}
40+
)
41+
}
5442

55-
override predicate isSanitizerGuard(DataFlow::BarrierGuard guard) {
56-
guard instanceof SanitizerGuard
57-
}
43+
override predicate isSanitizer(DataFlow::Node node) { node instanceof Sanitizer }
5844

59-
override predicate isAdditionalTaintStep(
60-
DataFlow::Node nodeFrom, DataFlow::FlowState stateFrom, DataFlow::Node nodeTo,
61-
DataFlow::FlowState stateTo
62-
) {
63-
nodeFrom = nodeTo.(Path::PathNormalization).getPathArg() and
64-
stateFrom instanceof NotNormalized and
65-
stateTo instanceof NormalizedUnchecked
66-
}
45+
override predicate isSanitizer(DataFlow::Node node, DataFlow::FlowState state) {
46+
// Block `NotNormalized` paths here, since they change state to `NormalizedUnchecked`
47+
node instanceof Path::PathNormalization and
48+
state instanceof NotNormalized
49+
or
50+
node = any(Path::SafeAccessCheck c).getAGuardedNode() and
51+
state instanceof NormalizedUnchecked
6752
}
6853

69-
/** A state signifying that the file path has not been normalized. */
70-
class NotNormalized extends DataFlow::FlowState {
71-
NotNormalized() { this = "NotNormalized" }
54+
override predicate isSanitizerGuard(DataFlow::BarrierGuard guard) {
55+
guard instanceof SanitizerGuard
7256
}
7357

74-
/** A state signifying that the file path has been normalized, but not checked. */
75-
class NormalizedUnchecked extends DataFlow::FlowState {
76-
NormalizedUnchecked() { this = "NormalizedUnchecked" }
58+
override predicate isAdditionalTaintStep(
59+
DataFlow::Node nodeFrom, DataFlow::FlowState stateFrom, DataFlow::Node nodeTo,
60+
DataFlow::FlowState stateTo
61+
) {
62+
nodeFrom = nodeTo.(Path::PathNormalization).getPathArg() and
63+
stateFrom instanceof NotNormalized and
64+
stateTo instanceof NormalizedUnchecked
7765
}
66+
}
67+
68+
/** A state signifying that the file path has not been normalized. */
69+
class NotNormalized extends DataFlow::FlowState {
70+
NotNormalized() { this = "NotNormalized" }
71+
}
72+
73+
/** A state signifying that the file path has been normalized, but not checked. */
74+
class NormalizedUnchecked extends DataFlow::FlowState {
75+
NormalizedUnchecked() { this = "NormalizedUnchecked" }
76+
}

0 commit comments

Comments
 (0)