Skip to content

Commit 2df09f6

Browse files
joefarebrotherjoefarebrother
committed
Change flag predicates to boolean parameters rather than boolean results
1 parent 6f7b2a2 commit 2df09f6

File tree

6 files changed

+45
-45
lines changed

6 files changed

+45
-45
lines changed

‎python/ql/lib/semmle/python/Concepts.qll‎

Lines changed: 12 additions & 12 deletions
Original file line numberDiff line numberDiff line change
@@ -1205,19 +1205,19 @@ module Http {
12051205
DataFlow::Node getValueArg() { result = super.getValueArg() }
12061206

12071207
/**
1208-
* Gets the value of the `Secure` flag of the cookie, if known.
1208+
* Holds if the `Secure` flag of the cookie is known to have a value of `b`.
12091209
*/
1210-
boolean getSecureFlag() { result = super.getSecureFlag() }
1210+
predicate hasSecureFlag(boolean b) { super.hasSecureFlag(b) }
12111211

12121212
/**
1213-
* Gets the value of the `HttpOnly` flag of the cookie, if known
1213+
* Holds if the `HttpOnly` flag of the cookie is known to have a value of `b`.
12141214
*/
1215-
boolean getHttpOnlyFlag() { result = super.getHttpOnlyFlag() }
1215+
predicate hasHttpOnlyFlag(boolean b) { super.hasHttpOnlyFlag(b) }
12161216

12171217
/**
1218-
* Gets the value of the `SameSite` flag of the cookie, if known.
1218+
* Holds if the `SameSite` flag of the cookie is known to have a value of `b`.
12191219
*/
1220-
boolean getSameSiteFlag() { result = super.getSameSiteFlag() }
1220+
predicate hasSameSiteFlag(boolean b) { super.hasSameSiteFlag(b) }
12211221
}
12221222

12231223
/** Provides a class for modeling new cookie writes on HTTP responses. */
@@ -1248,19 +1248,19 @@ module Http {
12481248
abstract DataFlow::Node getValueArg();
12491249

12501250
/**
1251-
* Gets the value of the `Secure` flag of the cookie, if known.
1251+
* Holds if the `Secure` flag of the cookie is known to have a value of `b`.
12521252
*/
1253-
boolean getSecureFlag() { none() }
1253+
predicate hasSecureFlag(boolean b) { none() }
12541254

12551255
/**
1256-
* Gets the value of the `HttpOnly` flag of the cookie, if known
1256+
* Holds if the `HttpOnly` flag of the cookie is known to have a value of `b`.
12571257
*/
1258-
boolean getHttpOnlyFlag() { none() }
1258+
predicate hasHttpOnlyFlag(boolean b) { none() }
12591259

12601260
/**
1261-
* Gets the value of the `SameSite` flag of the cookie, if known.
1261+
* Holds if the `SameSite` flag of the cookie is known to have a value of `b`.
12621262
*/
1263-
boolean getSameSiteFlag() { none() }
1263+
predicate hasSameSiteFlag(boolean b) { none() }
12641264
}
12651265
}
12661266

‎python/ql/src/experimental/Security/CWE-614/InsecureCookie.ql‎

Lines changed: 3 additions & 3 deletions
Original file line numberDiff line numberDiff line change
@@ -21,12 +21,12 @@ import experimental.semmle.python.CookieHeader
2121

2222
from Http::Server::CookieWrite cookie, string alert
2323
where
24-
cookie.getSecureFlag() = false and
24+
cookie.hasSecureFlag(false) and
2525
alert = "secure"
2626
or
27-
cookie.getHttpOnlyFlag() = false and
27+
cookie.hasHttpOnlyFlag(false) and
2828
alert = "httponly"
2929
or
30-
cookie.getSameSiteFlag() = false and
30+
cookie.hasSameSiteFlag(false) and
3131
alert = "samesite"
3232
select cookie, "Cookie is added without the '" + alert + "' flag properly set."

‎python/ql/src/experimental/semmle/python/CookieHeader.qll‎

Lines changed: 9 additions & 9 deletions
Original file line numberDiff line numberDiff line change
@@ -38,40 +38,40 @@ class CookieHeader extends Http::Server::CookieWrite::Range instanceof Http::Ser
3838
)
3939
}
4040

41-
override boolean getSecureFlag() {
41+
override predicate hasSecureFlag(boolean b) {
4242
if
4343
exists(StringLiteral str |
4444
str.getText().regexpMatch(".*; *Secure;.*") and
4545
DataFlow::exprNode(str)
4646
.(DataFlow::LocalSourceNode)
4747
.flowsTo(this.(Http::Server::ResponseHeaderWrite).getValueArg())
4848
)
49-
then result = true
50-
else result = false
49+
then b = true
50+
else b = false
5151
}
5252

53-
override boolean getHttpOnlyFlag() {
53+
override predicate hasHttpOnlyFlag(boolean b) {
5454
if
5555
exists(StringLiteral str |
5656
str.getText().regexpMatch(".*; *HttpOnly;.*") and
5757
DataFlow::exprNode(str)
5858
.(DataFlow::LocalSourceNode)
5959
.flowsTo(this.(Http::Server::ResponseHeaderWrite).getValueArg())
6060
)
61-
then result = true
62-
else result = false
61+
then b = true
62+
else b = false
6363
}
6464

65-
override boolean getSameSiteFlag() {
65+
override predicate hasSameSiteFlag(boolean b) {
6666
if
6767
exists(StringLiteral str |
6868
str.getText().regexpMatch(".*; *SameSite=(Strict|Lax);.*") and
6969
DataFlow::exprNode(str)
7070
.(DataFlow::LocalSourceNode)
7171
.flowsTo(this.(Http::Server::ResponseHeaderWrite).getValueArg())
7272
)
73-
then result = true
74-
else result = false
73+
then b = true
74+
else b = false
7575
}
7676

7777
override DataFlow::Node getNameArg() {

‎python/ql/src/experimental/semmle/python/frameworks/Django.qll‎

Lines changed: 9 additions & 9 deletions
Original file line numberDiff line numberDiff line change
@@ -123,34 +123,34 @@ private module ExperimentalPrivateDjango {
123123
result in [this.getArg(1), this.getArgByName("value")]
124124
}
125125

126-
override boolean getSecureFlag() {
126+
override predicate hasSecureFlag(boolean b) {
127127
if
128128
DataFlow::exprNode(any(True t))
129129
.(DataFlow::LocalSourceNode)
130130
.flowsTo(this.(DataFlow::CallCfgNode).getArgByName("secure"))
131-
then result = true
132-
else result = false
131+
then b = true
132+
else b = false
133133
}
134134

135-
override boolean getHttpOnlyFlag() {
135+
override predicate hasHttpOnlyFlag(boolean b) {
136136
if
137137
DataFlow::exprNode(any(True t))
138138
.(DataFlow::LocalSourceNode)
139139
.flowsTo(this.(DataFlow::CallCfgNode).getArgByName("httponly"))
140-
then result = true
141-
else result = false
140+
then b = true
141+
else b = false
142142
}
143143

144-
override boolean getSameSiteFlag() {
144+
override predicate hasSameSiteFlag(boolean b) {
145145
if
146146
exists(StringLiteral str |
147147
str.getText() in ["Strict", "Lax"] and
148148
DataFlow::exprNode(str)
149149
.(DataFlow::LocalSourceNode)
150150
.flowsTo(this.(DataFlow::CallCfgNode).getArgByName("samesite"))
151151
)
152-
then result = true
153-
else result = false
152+
then b = true
153+
else b = false
154154
}
155155

156156
override DataFlow::Node getHeaderArg() { none() }

‎python/ql/src/experimental/semmle/python/frameworks/Flask.qll‎

Lines changed: 9 additions & 9 deletions
Original file line numberDiff line numberDiff line change
@@ -38,34 +38,34 @@ module ExperimentalFlask {
3838

3939
override DataFlow::Node getValueArg() { result = this.getValueArg() }
4040

41-
override boolean getSecureFlag() {
41+
override predicate hasSecureFlag(boolean b) {
4242
if
4343
DataFlow::exprNode(any(True t))
4444
.(DataFlow::LocalSourceNode)
4545
.flowsTo(this.(DataFlow::CallCfgNode).getArgByName("secure"))
46-
then result = true
47-
else result = false
46+
then b = true
47+
else b = false
4848
}
4949

50-
override boolean getHttpOnlyFlag() {
50+
override predicate hasHttpOnlyFlag(boolean b) {
5151
if
5252
DataFlow::exprNode(any(True t))
5353
.(DataFlow::LocalSourceNode)
5454
.flowsTo(this.(DataFlow::CallCfgNode).getArgByName("httponly"))
55-
then result = true
56-
else result = false
55+
then b = true
56+
else b = false
5757
}
5858

59-
override boolean getSameSiteFlag() {
59+
override predicate hasSameSiteFlag(boolean b) {
6060
if
6161
exists(StringLiteral str |
6262
str.getText() in ["Strict", "Lax"] and
6363
DataFlow::exprNode(str)
6464
.(DataFlow::LocalSourceNode)
6565
.flowsTo(this.(DataFlow::CallCfgNode).getArgByName("samesite"))
6666
)
67-
then result = true
68-
else result = false
67+
then b = true
68+
else b = false
6969
}
7070

7171
override DataFlow::Node getHeaderArg() { none() }

‎python/ql/src/experimental/semmle/python/security/injection/CookieInjection.qll‎

Lines changed: 3 additions & 3 deletions
Original file line numberDiff line numberDiff line change
@@ -12,13 +12,13 @@ class CookieSink extends DataFlow::Node {
1212
exists(Http::Server::CookieWrite cookie |
1313
this in [cookie.getNameArg(), cookie.getValueArg(), cookie.getHeaderArg()] and
1414
(
15-
cookie.getSecureFlag() = false and
15+
cookie.hasSecureFlag(false) and
1616
flag = "secure"
1717
or
18-
cookie.getHttpOnlyFlag() = false and
18+
cookie.hasHttpOnlyFlag(false) and
1919
flag = "httponly"
2020
or
21-
cookie.getSameSiteFlag() = false and
21+
cookie.hasSameSiteFlag(false) and
2222
flag = "samesite"
2323
)
2424
)

0 commit comments

Comments
 (0)