Skip to content

Commit 6755bb3

Browse files
committed
Python: do not add read steps for collections
1 parent 9cb83fc commit 6755bb3

File tree

1 file changed

+0
-13
lines changed

1 file changed

+0
-13
lines changed

python/ql/lib/semmle/python/dataflow/new/internal/TaintTrackingPrivate.qll

Lines changed: 0 additions & 13 deletions
Original file line numberDiff line numberDiff line change
@@ -202,19 +202,6 @@ predicate containerStep(DataFlow::Node nodeFrom, DataFlow::Node nodeTo) {
202202
obj = nodeTo.(DataFlow::PostUpdateNode).getPreUpdateNode() and
203203
call.getArg(0) = nodeFrom
204204
)
205-
or
206-
// Although flow through collections is modeled precisely using stores/reads, we still
207-
// allow flow out of a _tainted_ collection. This is needed in order to support taint-
208-
// tracking configurations where the source is a collection.
209-
exists(DataFlow::Content c | DataFlowPrivate::readStep(nodeFrom, c, nodeTo) |
210-
// c instanceof DataFlow::ListElementContent
211-
// or
212-
// c instanceof DataFlow::SetElementContent
213-
// or
214-
c instanceof DataFlow::DictionaryElementContent
215-
// or
216-
// c instanceof DataFlow::DictionaryElementAnyContent
217-
)
218205
}
219206

220207
/**

0 commit comments

Comments
 (0)