Skip to content

Commit a3b5769

Browse files
markshannonmarkshannon
committed
Python: Weak file permissions query.
1 parent aba73f4 commit a3b5769

File tree

8 files changed

+95
-0
lines changed

8 files changed

+95
-0
lines changed

‎change-notes/1.20/analysis-python.md‎

Lines changed: 1 addition & 0 deletions
Original file line numberDiff line numberDiff line change
@@ -10,6 +10,7 @@
1010
| **Query** | **Tags** | **Purpose** |
1111
|-----------------------------|-----------|--------------------------------------------------------------------|
1212
| Default version of SSL/TLS may be insecure (`py/insecure-default-protocol`) | security, external/cwe/cwe-327 | Finds instances where an insecure default protocol may be used. Results are shown on LGTM by default. |
13+
| Overly permissive file permissions (`py/overly-permissive-file`) | security, external/cwe/cwe-732 | Finds instances where a file is created with overly permissive permissions. Results are not shown on LGTM by default. |
1314
| Use of insecure SSL/TLS version (`py/insecure-protocol`) | security, external/cwe/cwe-327 | Finds instances where a known insecure protocol has been specified. Results are shown on LGTM by default. |
1415

1516
## Changes to existing queries

‎python/ql/src/Security/CWE-732/WeakFilePermissions.qhelp‎

Lines changed: 26 additions & 0 deletions
Original file line numberDiff line numberDiff line change
@@ -0,0 +1,26 @@
1+
<!DOCTYPE qhelp PUBLIC "-//Semmle//qhelp//EN" "qhelp.dtd">
2+
<qhelp>
3+
4+
<overview>
5+
<p>
6+
When creating a file POSIX systems allow permissions to be specified
7+
for owner, group and others separately. Permissions should be kept as
8+
strict as possible, preventing access to the files contents by other users.
9+
</p>
10+
11+
</overview>
12+
13+
<recommendation>
14+
<p>
15+
Restrict the file permissions of files to prevent any but the owner being able to read or write to that file
16+
</p>
17+
</recommendation>
18+
19+
<references>
20+
<li>
21+
Wikipedia:
22+
<a href="https://en.wikipedia.org/wiki/File_system_permissions">File system permissions</a>.
23+
</li>
24+
</references>
25+
26+
</qhelp>

‎python/ql/src/Security/CWE-732/WeakFilePermissions.ql‎

Lines changed: 42 additions & 0 deletions
Original file line numberDiff line numberDiff line change
@@ -0,0 +1,42 @@
1+
/**
2+
* @name Overly permissive file permissions
3+
* @description Allowing files to be readable or writable by users other than the owner may allow sensitive information to be accessed.
4+
* @kind problem
5+
* @id py/overly-permissive-file
6+
* @problem.severity warning
7+
* @sub-severity high
8+
* @precision medium
9+
* @tags external/cwe/cwe-732
10+
* security
11+
*/
12+
import python
13+
14+
bindingset[p]
15+
int world_permission(int p) {
16+
result = p % 8
17+
}
18+
19+
bindingset[p]
20+
int group_permission(int p) {
21+
result = (p/8) % 8
22+
}
23+
24+
bindingset[p]
25+
string access(int p) {
26+
p%4 >= 2 and result = "writable" or
27+
p%4 < 2 and p != 0 and result = "readable"
28+
}
29+
30+
bindingset[p]
31+
string permissive_permission(int p) {
32+
result = "world " + access(world_permission(p))
33+
or
34+
world_permission(p) = 0 and result = "group " + access(group_permission(p))
35+
}
36+
37+
from FunctionObject chmod, CallNode call, NumericObject num, string permission
38+
where
39+
any(ModuleObject os | os.getName() = "os").getAttribute("chmod") = chmod and
40+
chmod.getACall() = call and call.getArg(1).refersTo(num) and
41+
permission = permissive_permission(num.intValue())
42+
select call, "Overly permissive mask in chmod sets file to " + permission + "."

‎python/ql/test/query-tests/Security/CWE-732/WeakFilePermissions.expected‎

Lines changed: 6 additions & 0 deletions
Original file line numberDiff line numberDiff line change
@@ -0,0 +1,6 @@
1+
| test.py:7:1:7:19 | ControlFlowNode for Attribute() | Overly permissive mask in chmod sets file to world writable. |
2+
| test.py:8:1:8:20 | ControlFlowNode for Attribute() | Overly permissive mask in chmod sets file to world writable. |
3+
| test.py:9:1:9:21 | ControlFlowNode for Attribute() | Overly permissive mask in chmod sets file to world writable. |
4+
| test.py:11:1:11:21 | ControlFlowNode for Attribute() | Overly permissive mask in chmod sets file to group readable. |
5+
| test.py:13:1:13:28 | ControlFlowNode for Attribute() | Overly permissive mask in chmod sets file to group writable. |
6+
| test.py:14:1:14:19 | ControlFlowNode for Attribute() | Overly permissive mask in chmod sets file to group writable. |

‎python/ql/test/query-tests/Security/CWE-732/WeakFilePermissions.qlref‎

Lines changed: 1 addition & 0 deletions
Original file line numberDiff line numberDiff line change
@@ -0,0 +1 @@
1+
Security/CWE-732/WeakFilePermissions.ql

‎python/ql/test/query-tests/Security/CWE-732/options‎

Lines changed: 2 additions & 0 deletions
Original file line numberDiff line numberDiff line change
@@ -0,0 +1,2 @@
1+
semmle-extractor-options: --max-import-depth=2 -p ../lib
2+
optimize: true

‎python/ql/test/query-tests/Security/CWE-732/test.py‎

Lines changed: 14 additions & 0 deletions
Original file line numberDiff line numberDiff line change
@@ -0,0 +1,14 @@
1+
import os
2+
import stat
3+
4+
file = 'semmle/important_secrets'
5+
6+
7+
os.chmod(file, 0o7) # BAD
8+
os.chmod(file, 0o77) # BAD
9+
os.chmod(file, 0o777) # BAD
10+
os.chmod(file, 0o600) # GOOD
11+
os.chmod(file, 0o550) # BAD
12+
os.chmod(file, stat.S_IRWXU) # GOOD
13+
os.chmod(file, stat.S_IWGRP) # BAD
14+
os.chmod(file, 400) # BAD -- Decimal format.

‎python/ql/test/query-tests/Security/lib/os/__init__.py‎

Lines changed: 3 additions & 0 deletions
Original file line numberDiff line numberDiff line change
@@ -3,3 +3,6 @@ def system(cmd, *args, **kwargs):
33

44
def popen(cmd, *args, **kwargs):
55
return None
6+
7+
def chmod(path, mode):
8+
pass

0 commit comments

Comments
 (0)