Skip to content

Commit 8d4f944

Browse files
yoffyoff
committed
python: remove explicit steps
copy, pop, get, popitem
1 parent 05f3934 commit 8d4f944

File tree

30 files changed

+73
-615
lines changed

30 files changed

+73
-615
lines changed

‎python/ql/lib/semmle/python/dataflow/new/internal/TaintTrackingPrivate.qll

Lines changed: 2 additions & 7 deletions
Original file line numberDiff line numberDiff line change
@@ -190,14 +190,9 @@ predicate containerStep(DataFlow::Node nodeFrom, DataFlow::Node nodeTo) {
190190
call.getArg(0) = nodeFrom
191191
)
192192
or
193-
// methods
193+
// dict methods
194194
exists(DataFlow::MethodCallNode call, string methodName | call = nodeTo |
195-
methodName in [
196-
// general
197-
"copy", "pop",
198-
// dict
199-
"values", "items", "get", "popitem"
200-
] and
195+
methodName in ["values", "items"] and
201196
call.calls(nodeFrom, methodName)
202197
)
203198
or

‎python/ql/test/experimental/dataflow/tainttracking/defaultAdditionalTaintStep-py3/test_collections.py

Lines changed: 1 addition & 1 deletion
Original file line numberDiff line numberDiff line change
@@ -13,7 +13,7 @@ def test_access():
1313
tainted_list = TAINTED_LIST
1414

1515
ensure_tainted(
16-
tainted_list.copy(), # $ tainted
16+
tainted_list.copy(), # $ MISSING: tainted
1717
)
1818

1919
for ((x, y, *z), a, b) in tainted_list:

‎python/ql/test/experimental/dataflow/tainttracking/defaultAdditionalTaintStep/test_collections.py

Lines changed: 2 additions & 2 deletions
Original file line numberDiff line numberDiff line change
@@ -103,9 +103,9 @@ def test_dict_access(x):
103103

104104
ensure_tainted(
105105
tainted_dict["name"], # $ tainted
106-
tainted_dict.get("name"), # $ tainted
106+
tainted_dict.get("name"), # $ MISSING: tainted
107107
tainted_dict[x], # $ tainted
108-
tainted_dict.copy(), # $ tainted
108+
tainted_dict.copy(), # $ MISSING: tainted
109109
)
110110

111111
for v in tainted_dict.values():

‎python/ql/test/library-tests/frameworks/aiohttp/taint_test.py

Lines changed: 2 additions & 2 deletions
Original file line numberDiff line numberDiff line change
@@ -23,7 +23,7 @@ async def test_taint(request: web.Request): # $ requestHandler
2323
# dict-like for captured parts of the URL
2424
request.match_info, # $ tainted
2525
request.match_info["key"], # $ tainted
26-
request.match_info.get("key"), # $ tainted
26+
request.match_info.get("key"), # $ MISSING: tainted
2727

2828
# multidict.MultiDictProxy[str] (see `multidict` framework tests)
2929
request.query, # $ tainted
@@ -38,7 +38,7 @@ async def test_taint(request: web.Request): # $ requestHandler
3838
# dict-like (readonly)
3939
request.cookies, # $ tainted
4040
request.cookies["key"], # $ tainted
41-
request.cookies.get("key"), # $ tainted
41+
request.cookies.get("key"), # $ MISSING: tainted
4242
request.cookies.keys(), # $ MISSING: tainted
4343
request.cookies.values(), # $ tainted
4444
request.cookies.items(), # $ tainted

‎python/ql/test/library-tests/frameworks/django-v2-v3/taint_forms.py

Lines changed: 2 additions & 2 deletions
Original file line numberDiff line numberDiff line change
@@ -32,13 +32,13 @@ def clean(self):
3232
ensure_tainted(
3333
cleaned_data, # $ tainted
3434
cleaned_data["key"], # $ tainted
35-
cleaned_data.get("key"), # $ tainted
35+
cleaned_data.get("key"), # $ MISSING: tainted
3636
)
3737

3838
ensure_tainted(
3939
self.cleaned_data, # $ tainted
4040
self.cleaned_data["key"], # $ tainted
41-
self.cleaned_data.get("key"), # $ tainted
41+
self.cleaned_data.get("key"), # $ MISSING: tainted
4242
)
4343

4444
def clean_foo(self):

‎python/ql/test/library-tests/frameworks/django-v2-v3/taint_test.py

Lines changed: 9 additions & 9 deletions
Original file line numberDiff line numberDiff line change
@@ -31,17 +31,17 @@ def test_taint(request: HttpRequest, foo, bar, baz=None): # $requestHandler rou
3131
# Dict[str, str]
3232
request.content_params, # $ tainted
3333
request.content_params["key"], # $ tainted
34-
request.content_params.get("key"), # $ tainted
34+
request.content_params.get("key"), # $ MISSING: tainted
3535

3636
# django.http.QueryDict
3737
# see https://docs.djangoproject.com/en/3.0/ref/request-response/#querydict-objects
3838
request.GET, # $ tainted
3939
request.GET["key"], # $ tainted
40-
request.GET.get("key"), # $ tainted
40+
request.GET.get("key"), # $ MISSING: tainted
4141
request.GET.getlist("key"), # $ tainted
4242
request.GET.getlist("key")[0], # $ tainted
43-
request.GET.pop("key"), # $ tainted
44-
request.GET.pop("key")[0], # $ tainted
43+
request.GET.pop("key"), # $ MISSING: tainted
44+
request.GET.pop("key")[0], # $ MISSING: tainted
4545
# key
4646
request.GET.popitem()[0], # $ tainted
4747
# values
@@ -59,7 +59,7 @@ def test_taint(request: HttpRequest, foo, bar, baz=None): # $requestHandler rou
5959
# Dict[str, str]
6060
request.COOKIES, # $ tainted
6161
request.COOKIES["key"], # $ tainted
62-
request.COOKIES.get("key"), # $ tainted
62+
request.COOKIES.get("key"), # $ MISSING: tainted
6363

6464
# MultiValueDict[str, UploadedFile]
6565
request.FILES, # $ tainted
@@ -73,20 +73,20 @@ def test_taint(request: HttpRequest, foo, bar, baz=None): # $requestHandler rou
7373
request.FILES["key"].file.read(), # $ tainted
7474
request.FILES["key"].read(), # $ tainted
7575

76-
request.FILES.get("key"), # $ tainted
77-
request.FILES.get("key").name, # $ tainted
76+
request.FILES.get("key"), # $ MISSING: tainted
77+
request.FILES.get("key").name, # $ MISSING:tainted
7878
request.FILES.getlist("key"), # $ tainted
7979
request.FILES.getlist("key")[0], # $ tainted
8080
request.FILES.getlist("key")[0].name, # $ tainted
8181
request.FILES.dict(), # $ tainted
8282
request.FILES.dict()["key"], # $ tainted
8383
request.FILES.dict()["key"].name, # $ tainted
84-
request.FILES.dict().get("key").name, # $ tainted
84+
request.FILES.dict().get("key").name, # $ MISSING: tainted
8585

8686
# Dict[str, Any]
8787
request.META, # $ tainted
8888
request.META["HTTP_USER_AGENT"], # $ tainted
89-
request.META.get("HTTP_USER_AGENT"), # $ tainted
89+
request.META.get("HTTP_USER_AGENT"), # $ MISSING: tainted
9090

9191
# HttpHeaders (case insensitive dict-like)
9292
request.headers, # $ tainted

‎python/ql/test/library-tests/frameworks/flask/taint_test.py

Lines changed: 10 additions & 10 deletions
Original file line numberDiff line numberDiff line change
@@ -12,7 +12,7 @@ def test_taint(name = "World!", number="0", foo="foo"): # $requestHandler route
1212
ensure_tainted(
1313

1414
request.environ, # $ tainted
15-
request.environ.get('HTTP_AUTHORIZATION'), # $ tainted
15+
request.environ.get('HTTP_AUTHORIZATION'), # $ MISSING: tainted
1616

1717
request.path, # $ tainted
1818
request.full_path, # $ tainted
@@ -38,7 +38,7 @@ def test_taint(name = "World!", number="0", foo="foo"): # $requestHandler route
3838
# By default werkzeug.datastructures.ImmutableMultiDict -- although can be changed :\
3939
request.args, # $ tainted
4040
request.args['key'], # $ tainted
41-
request.args.get('key'), # $ tainted
41+
request.args.get('key'), # $ MISSING: tainted
4242
request.args.getlist('key'), # $ tainted
4343

4444
# werkzeug.datastructures.Authorization (a dict, with some properties)
@@ -81,17 +81,17 @@ def test_taint(name = "World!", number="0", foo="foo"): # $requestHandler route
8181
request.files['key'].stream, # $ tainted
8282
request.files['key'].read(), # $ tainted
8383
request.files['key'].stream.read(), # $ tainted
84-
request.files.get('key'), # $ tainted
85-
request.files.get('key').filename, # $ tainted
86-
request.files.get('key').stream, # $ tainted
84+
request.files.get('key'), # $ MISSING: tainted
85+
request.files.get('key').filename, # $ MISSING: tainted
86+
request.files.get('key').stream, # $ MISSING: tainted
8787
request.files.getlist('key'), # $ tainted
8888
request.files.getlist('key')[0].filename, # $ tainted
8989
request.files.getlist('key')[0].stream, # $ tainted
9090

9191
# By default werkzeug.datastructures.ImmutableMultiDict -- although can be changed :\
9292
request.form, # $ tainted
9393
request.form['key'], # $ tainted
94-
request.form.get('key'), # $ tainted
94+
request.form.get('key'), # $ MISSING: tainted
9595
request.form.getlist('key'), # $ tainted
9696

9797
request.get_data(), # $ tainted
@@ -104,7 +104,7 @@ def test_taint(name = "World!", number="0", foo="foo"): # $requestHandler route
104104
# which has same interface as werkzeug.datastructures.Headers
105105
request.headers, # $ tainted
106106
request.headers['key'], # $ tainted
107-
request.headers.get('key'), # $ tainted
107+
request.headers.get('key'), # $ MISSING: tainted
108108
request.headers.get_all('key'), # $ tainted
109109
request.headers.getlist('key'), # $ tainted
110110
# popitem returns `(key, value)`
@@ -149,13 +149,13 @@ def test_taint(name = "World!", number="0", foo="foo"): # $requestHandler route
149149
# werkzeug.datastructures.CombinedMultiDict, which is basically just a werkzeug.datastructures.MultiDict
150150
request.values, # $ tainted
151151
request.values['key'], # $ tainted
152-
request.values.get('key'), # $ tainted
152+
request.values.get('key'), # $ MISSING: tainted
153153
request.values.getlist('key'), # $ tainted
154154

155155
# dict
156156
request.view_args, # $ tainted
157157
request.view_args['key'], # $ tainted
158-
request.view_args.get('key'), # $ tainted
158+
request.view_args.get('key'), # $ MISSING: tainted
159159
)
160160

161161
ensure_not_tainted(
@@ -204,7 +204,7 @@ def test_taint(name = "World!", number="0", foo="foo"): # $requestHandler route
204204
b.getlist('key'), # $ tainted
205205
gl('key'), # $ tainted
206206

207-
files.get('key').filename, # $ tainted
207+
files.get('key').filename, # $ MISSING: tainted
208208
)
209209

210210
# aliasing tests

‎python/ql/test/library-tests/frameworks/multidict/taint_test.py

Lines changed: 4 additions & 4 deletions
Original file line numberDiff line numberDiff line change
@@ -9,13 +9,13 @@
99

1010
mdp, # $ tainted
1111
mdp["key"], # $ tainted
12-
mdp.get("key"), # $ tainted
12+
mdp.get("key"), # $ MISSING: tainted
1313
mdp.getone("key"), # $ tainted
1414
mdp.getall("key"), # $ tainted
1515
mdp.keys(), # $ MISSING: tainted
1616
mdp.values(), # $ tainted
1717
mdp.items(), # $ tainted
18-
mdp.copy(), # $ tainted
18+
mdp.copy(), # $ MISSING: tainted
1919
list(mdp), # $ tainted
2020
iter(mdp), # $ tainted
2121
)
@@ -29,13 +29,13 @@
2929

3030
ci_mdp, # $ tainted
3131
ci_mdp["key"], # $ tainted
32-
ci_mdp.get("key"), # $ tainted
32+
ci_mdp.get("key"), # $ MISSING: tainted
3333
ci_mdp.getone("key"), # $ tainted
3434
ci_mdp.getall("key"), # $ tainted
3535
ci_mdp.keys(), # $ MISSING: tainted
3636
ci_mdp.values(), # $ tainted
3737
ci_mdp.items(), # $ tainted
38-
ci_mdp.copy(), # $ tainted
38+
ci_mdp.copy(), # $ MISSING: tainted
3939
list(ci_mdp), # $ tainted
4040
iter(ci_mdp), # $ tainted
4141
)

‎python/ql/test/library-tests/frameworks/requests/taint_test.py

Lines changed: 3 additions & 3 deletions
Original file line numberDiff line numberDiff line change
@@ -30,15 +30,15 @@ def test_taint(): # $ requestHandler
3030

3131
resp.links, # $ tainted
3232
resp.links['key'], # $ tainted
33-
resp.links.get('key'), # $ tainted
33+
resp.links.get('key'), # $ MISSING: tainted
3434

3535
resp.cookies, # $ tainted
3636
resp.cookies['key'], # $ tainted
37-
resp.cookies.get('key'), # $ tainted
37+
resp.cookies.get('key'), # $ MISSING: tainted
3838

3939
resp.headers, # $ tainted
4040
resp.headers['key'], # $ tainted
41-
resp.headers.get('key'), # $ tainted
41+
resp.headers.get('key'), # $ MISSING: tainted
4242
)
4343

4444
for content_chunk in resp.iter_content():

‎python/ql/test/library-tests/frameworks/rest_framework/taint_test.py

Lines changed: 3 additions & 3 deletions
Original file line numberDiff line numberDiff line change
@@ -31,11 +31,11 @@ def test_taint(request: Request, routed_param): # $ requestHandler routedParamet
3131
# alias for .GET
3232
request.query_params, # $ tainted
3333
request.query_params["key"], # $ tainted
34-
request.query_params.get("key"), # $ tainted
34+
request.query_params.get("key"), # $ MISSING: tainted
3535
request.query_params.getlist("key"), # $ tainted
3636
request.query_params.getlist("key")[0], # $ tainted
37-
request.query_params.pop("key"), # $ tainted
38-
request.query_params.pop("key")[0], # $ tainted
37+
request.query_params.pop("key"), # $ MISSING: tainted
38+
request.query_params.pop("key")[0], # $ MISSING: tainted
3939

4040
# see more detailed tests of `request.user` below
4141
request.user, # $ tainted

0 commit comments

Comments
 (0)