Skip to content

Commit e2a3d91

Browse files
markshannonmarkshannon
committed
Python taint-tracking: If taint has no class allow it flow through both branches of isinstance test.
1 parent b226cb6 commit e2a3d91

8 files changed

Lines changed: 34 additions & 0 deletions

File tree

‎python/ql/src/semmle/python/security/TaintTracking.qll‎

Lines changed: 2 additions & 0 deletions
Original file line numberDiff line numberDiff line change
@@ -1267,6 +1267,8 @@ library module TaintFlowImplementation {
12671267
Filters::isinstance(test.getTest(), c, var.getSourceVariable().getAUse())
12681268
and c.refersTo(cls)
12691269
|
1270+
test.getSense() = true and not exists(kind.getClass())
1271+
or
12701272
test.getSense() = true and kind.getClass().getAnImproperSuperType() = cls
12711273
or
12721274
test.getSense() = false and not kind.getClass().getAnImproperSuperType() = cls

‎python/ql/test/library-tests/taint/general/TestDefn.expected‎

Lines changed: 7 additions & 0 deletions
Original file line numberDiff line numberDiff line change
@@ -182,3 +182,10 @@
182182
| test.py:186 | ArgumentRefinement(t_3) | test.py:178 | Taint simple.test | SOURCE |
183183
| test.py:189 | FALSEY | test.py:189 | Taint falsey | FALSEY |
184184
| test.py:191 | Pi(t_0) [true] | test.py:189 | Taint falsey | FALSEY |
185+
| test.py:194 | phi(t_3, t_5) | test.py:195 | Taint simple.test | SOURCE |
186+
| test.py:195 | SOURCE | test.py:195 | Taint simple.test | SOURCE |
187+
| test.py:196 | ArgumentRefinement(t_0) | test.py:195 | Taint simple.test | SOURCE |
188+
| test.py:197 | ArgumentRefinement(t_2) | test.py:195 | Taint simple.test | SOURCE |
189+
| test.py:197 | Pi(t_1) [true] | test.py:195 | Taint simple.test | SOURCE |
190+
| test.py:199 | ArgumentRefinement(t_4) | test.py:195 | Taint simple.test | SOURCE |
191+
| test.py:199 | Pi(t_1) [false] | test.py:195 | Taint simple.test | SOURCE |

‎python/ql/test/library-tests/taint/general/TestNode.expected‎

Lines changed: 4 additions & 0 deletions
Original file line numberDiff line numberDiff line change
@@ -222,6 +222,10 @@
222222
| Taint simple.test | test.py:180 | t | |
223223
| Taint simple.test | test.py:183 | t | |
224224
| Taint simple.test | test.py:186 | t | |
225+
| Taint simple.test | test.py:195 | SOURCE | |
226+
| Taint simple.test | test.py:196 | t | |
227+
| Taint simple.test | test.py:197 | t | |
228+
| Taint simple.test | test.py:199 | t | |
225229
| Taint {simple.test} | test.py:169 | Dict | |
226230
| Taint {simple.test} | test.py:171 | d | |
227231
| Taint {simple.test} | test.py:173 | y | |

‎python/ql/test/library-tests/taint/general/TestSink.expected‎

Lines changed: 2 additions & 0 deletions
Original file line numberDiff line numberDiff line change
@@ -34,3 +34,5 @@
3434
| simple.test | test.py:169 | 173 | Subscript | simple.test |
3535
| simple.test | test.py:178 | 180 | t | simple.test |
3636
| simple.test | test.py:178 | 186 | t | simple.test |
37+
| simple.test | test.py:195 | 197 | t | simple.test |
38+
| simple.test | test.py:195 | 199 | t | simple.test |

‎python/ql/test/library-tests/taint/general/TestSource.expected‎

Lines changed: 1 addition & 0 deletions
Original file line numberDiff line numberDiff line change
@@ -42,3 +42,4 @@
4242
| test.py:169 | SOURCE | simple.test |
4343
| test.py:178 | SOURCE | simple.test |
4444
| test.py:189 | FALSEY | falsey |
45+
| test.py:195 | SOURCE | simple.test |

‎python/ql/test/library-tests/taint/general/TestStep.expected‎

Lines changed: 3 additions & 0 deletions
Original file line numberDiff line numberDiff line change
@@ -178,6 +178,9 @@
178178
| Taint simple.test | test.py:178 | SOURCE | | --> | Taint simple.test | test.py:180 | t | |
179179
| Taint simple.test | test.py:178 | SOURCE | | --> | Taint simple.test | test.py:183 | t | |
180180
| Taint simple.test | test.py:178 | SOURCE | | --> | Taint simple.test | test.py:186 | t | |
181+
| Taint simple.test | test.py:195 | SOURCE | | --> | Taint simple.test | test.py:196 | t | |
182+
| Taint simple.test | test.py:195 | SOURCE | | --> | Taint simple.test | test.py:197 | t | |
183+
| Taint simple.test | test.py:195 | SOURCE | | --> | Taint simple.test | test.py:199 | t | |
181184
| Taint {simple.test} | test.py:169 | Dict | | --> | Taint {simple.test} | test.py:171 | d | |
182185
| Taint {simple.test} | test.py:169 | Dict | | --> | Taint {simple.test} | test.py:175 | d | |
183186
| Taint {simple.test} | test.py:171 | d | | --> | Taint {simple.test} | test.py:173 | y | |

‎python/ql/test/library-tests/taint/general/TestVar.expected‎

Lines changed: 7 additions & 0 deletions
Original file line numberDiff line numberDiff line change
@@ -184,3 +184,10 @@
184184
| test.py:186 | t_4 | test.py:178 | Taint simple.test | SOURCE |
185185
| test.py:189 | t_0 | test.py:189 | Taint falsey | FALSEY |
186186
| test.py:191 | t_1 | test.py:189 | Taint falsey | FALSEY |
187+
| test.py:194 | t_6 | test.py:195 | Taint simple.test | SOURCE |
188+
| test.py:195 | t_0 | test.py:195 | Taint simple.test | SOURCE |
189+
| test.py:196 | t_1 | test.py:195 | Taint simple.test | SOURCE |
190+
| test.py:197 | t_2 | test.py:195 | Taint simple.test | SOURCE |
191+
| test.py:197 | t_3 | test.py:195 | Taint simple.test | SOURCE |
192+
| test.py:199 | t_4 | test.py:195 | Taint simple.test | SOURCE |
193+
| test.py:199 | t_5 | test.py:195 | Taint simple.test | SOURCE |

‎python/ql/test/library-tests/taint/general/test.py‎

Lines changed: 8 additions & 0 deletions
Original file line numberDiff line numberDiff line change
@@ -190,3 +190,11 @@ def test_early_exit():
190190
if not t:
191191
return
192192
t
193+
194+
def flow_through_type_test_if_no_class():
195+
t = SOURCE
196+
if isinstance(t, str):
197+
SINK(t)
198+
else:
199+
SINK(t)
200+

0 commit comments

Comments
 (0)