Skip to content

Commit fa3e16a

Browse files
RasmusWLRasmusWL
committed
Python: Refactor taint-sinks meta queries
1 parent dc90411 commit fa3e16a

File tree

3 files changed

+84
-151
lines changed

3 files changed

+84
-151
lines changed

‎python/ql/src/meta/alerts/InterestingTaintSinks.ql‎

Lines changed: 3 additions & 73 deletions
Original file line numberDiff line numberDiff line change
@@ -10,78 +10,8 @@
1010

1111
private import python
1212
private import semmle.python.dataflow.new.DataFlow
13-
private import meta.MetaMetrics
14-
import semmle.python.security.dataflow.CleartextLoggingCustomizations
15-
import semmle.python.security.dataflow.CleartextStorageCustomizations
16-
import semmle.python.security.dataflow.CodeInjectionCustomizations
17-
import semmle.python.security.dataflow.CommandInjectionCustomizations
18-
import semmle.python.security.dataflow.LdapInjectionCustomizations
19-
import semmle.python.security.dataflow.LogInjectionCustomizations
20-
import semmle.python.security.dataflow.PathInjectionCustomizations
21-
import semmle.python.security.dataflow.PolynomialReDoSCustomizations
22-
import semmle.python.security.dataflow.ReflectedXSSCustomizations
23-
import semmle.python.security.dataflow.RegexInjectionCustomizations
24-
import semmle.python.security.dataflow.ServerSideRequestForgeryCustomizations
25-
import semmle.python.security.dataflow.SqlInjectionCustomizations
26-
import semmle.python.security.dataflow.StackTraceExposureCustomizations
27-
import semmle.python.security.dataflow.TarSlipCustomizations
28-
import semmle.python.security.dataflow.UnsafeDeserializationCustomizations
29-
import semmle.python.security.dataflow.UrlRedirectCustomizations
30-
import semmle.python.security.dataflow.WeakSensitiveDataHashingCustomizations
31-
import semmle.python.security.dataflow.XmlBombCustomizations
32-
import semmle.python.security.dataflow.XpathInjectionCustomizations
33-
import semmle.python.security.dataflow.XxeCustomizations
34-
35-
/**
36-
* Gets a node corresponding to a taint sink of the specified `kind`. Excludes sinks that are too
37-
* noisy (at the time of writing this was the various logging-related taint sinks).
38-
*/
39-
DataFlow::Node relevantTaintSink(string kind) {
40-
not result.getLocation().getFile() instanceof IgnoredFile and
41-
(
42-
kind = "CleartextStorage" and result instanceof CleartextStorage::Sink
43-
or
44-
kind = "CodeInjection" and result instanceof CodeInjection::Sink
45-
or
46-
kind = "CommandInjection" and result instanceof CommandInjection::Sink
47-
or
48-
kind = "LdapInjection (DN)" and result instanceof LdapInjection::DnSink
49-
or
50-
kind = "LdapInjection (Filter)" and result instanceof LdapInjection::FilterSink
51-
or
52-
kind = "PathInjection" and result instanceof PathInjection::Sink
53-
or
54-
kind = "PolynomialReDoS" and result instanceof PolynomialReDoS::Sink
55-
or
56-
kind = "ReflectedXss" and result instanceof ReflectedXss::Sink
57-
or
58-
kind = "RegexInjection" and result instanceof RegexInjection::Sink
59-
or
60-
kind = "ServerSideRequestForgery" and result instanceof ServerSideRequestForgery::Sink
61-
or
62-
kind = "SqlInjection" and result instanceof SqlInjection::Sink
63-
or
64-
kind = "StackTraceExposure" and result instanceof StackTraceExposure::Sink
65-
or
66-
kind = "TarSlip" and result instanceof TarSlip::Sink
67-
or
68-
kind = "UnsafeDeserialization" and result instanceof UnsafeDeserialization::Sink
69-
or
70-
kind = "UrlRedirect" and result instanceof UrlRedirect::Sink
71-
or
72-
kind = "WeakSensitiveDataHashing (NormalHashFunction)" and
73-
result instanceof NormalHashFunction::Sink
74-
or
75-
kind = "WeakSensitiveDataHashing (ComputationallyExpensiveHashFunction)" and
76-
result instanceof ComputationallyExpensiveHashFunction::Sink
77-
or
78-
kind = "XmlBomb" and result instanceof XmlBomb::Sink
79-
or
80-
kind = "XpathInjection" and result instanceof XpathInjection::Sink
81-
or
82-
kind = "Xxe" and result instanceof Xxe::Sink
83-
)
84-
}
13+
private import Sinks
8514

8615
from string kind
87-
select relevantTaintSink(kind), kind + " sink"
16+
where not kind in ["CleartextLogging", "LogInjection"]
17+
select taintSink(kind), kind + " sink"

‎python/ql/src/meta/alerts/Sinks.qll‎

Lines changed: 79 additions & 0 deletions
Original file line numberDiff line numberDiff line change
@@ -0,0 +1,79 @@
1+
private import python
2+
private import semmle.python.dataflow.new.DataFlow
3+
private import meta.MetaMetrics
4+
import semmle.python.security.dataflow.CleartextLoggingCustomizations
5+
import semmle.python.security.dataflow.CleartextStorageCustomizations
6+
import semmle.python.security.dataflow.CodeInjectionCustomizations
7+
import semmle.python.security.dataflow.CommandInjectionCustomizations
8+
import semmle.python.security.dataflow.LdapInjectionCustomizations
9+
import semmle.python.security.dataflow.LogInjectionCustomizations
10+
import semmle.python.security.dataflow.NoSqlInjectionCustomizations
11+
import semmle.python.security.dataflow.PathInjectionCustomizations
12+
import semmle.python.security.dataflow.PolynomialReDoSCustomizations
13+
import semmle.python.security.dataflow.ReflectedXSSCustomizations
14+
import semmle.python.security.dataflow.RegexInjectionCustomizations
15+
import semmle.python.security.dataflow.ServerSideRequestForgeryCustomizations
16+
import semmle.python.security.dataflow.SqlInjectionCustomizations
17+
import semmle.python.security.dataflow.StackTraceExposureCustomizations
18+
import semmle.python.security.dataflow.TarSlipCustomizations
19+
import semmle.python.security.dataflow.UnsafeDeserializationCustomizations
20+
import semmle.python.security.dataflow.UrlRedirectCustomizations
21+
import semmle.python.security.dataflow.WeakSensitiveDataHashingCustomizations
22+
import semmle.python.security.dataflow.XmlBombCustomizations
23+
import semmle.python.security.dataflow.XpathInjectionCustomizations
24+
import semmle.python.security.dataflow.XxeCustomizations
25+
26+
DataFlow::Node taintSink(string kind) {
27+
not result.getLocation().getFile() instanceof IgnoredFile and
28+
(
29+
kind = "CleartextLogging" and result instanceof CleartextLogging::Sink
30+
or
31+
kind = "CleartextStorage" and result instanceof CleartextStorage::Sink
32+
or
33+
kind = "CodeInjection" and result instanceof CodeInjection::Sink
34+
or
35+
kind = "CommandInjection" and result instanceof CommandInjection::Sink
36+
or
37+
kind = "LdapInjection (DN)" and result instanceof LdapInjection::DnSink
38+
or
39+
kind = "LdapInjection (Filter)" and result instanceof LdapInjection::FilterSink
40+
or
41+
kind = "LogInjection" and result instanceof LogInjection::Sink
42+
or
43+
kind = "PathInjection" and result instanceof PathInjection::Sink
44+
or
45+
kind = "PolynomialReDoS" and result instanceof PolynomialReDoS::Sink
46+
or
47+
kind = "ReflectedXss" and result instanceof ReflectedXss::Sink
48+
or
49+
kind = "RegexInjection" and result instanceof RegexInjection::Sink
50+
or
51+
kind = "NoSqlInjection (string sink)" and result instanceof NoSqlInjection::StringSink
52+
or
53+
kind = "NoSqlInjection (dict sink)" and result instanceof NoSqlInjection::DictSink
54+
or
55+
kind = "ServerSideRequestForgery" and result instanceof ServerSideRequestForgery::Sink
56+
or
57+
kind = "SqlInjection" and result instanceof SqlInjection::Sink
58+
or
59+
kind = "StackTraceExposure" and result instanceof StackTraceExposure::Sink
60+
or
61+
kind = "TarSlip" and result instanceof TarSlip::Sink
62+
or
63+
kind = "UnsafeDeserialization" and result instanceof UnsafeDeserialization::Sink
64+
or
65+
kind = "UrlRedirect" and result instanceof UrlRedirect::Sink
66+
or
67+
kind = "WeakSensitiveDataHashing (NormalHashFunction)" and
68+
result instanceof NormalHashFunction::Sink
69+
or
70+
kind = "WeakSensitiveDataHashing (ComputationallyExpensiveHashFunction)" and
71+
result instanceof ComputationallyExpensiveHashFunction::Sink
72+
or
73+
kind = "XmlBomb" and result instanceof XmlBomb::Sink
74+
or
75+
kind = "XpathInjection" and result instanceof XpathInjection::Sink
76+
or
77+
kind = "Xxe" and result instanceof Xxe::Sink
78+
)
79+
}

‎python/ql/src/meta/alerts/TaintSinks.ql‎

Lines changed: 2 additions & 78 deletions
Original file line numberDiff line numberDiff line change
@@ -10,83 +10,7 @@
1010

1111
private import python
1212
private import semmle.python.dataflow.new.DataFlow
13-
private import meta.MetaMetrics
14-
import semmle.python.security.dataflow.CleartextLoggingCustomizations
15-
import semmle.python.security.dataflow.CleartextStorageCustomizations
16-
import semmle.python.security.dataflow.CodeInjectionCustomizations
17-
import semmle.python.security.dataflow.CommandInjectionCustomizations
18-
import semmle.python.security.dataflow.LdapInjectionCustomizations
19-
import semmle.python.security.dataflow.LogInjectionCustomizations
20-
import semmle.python.security.dataflow.NoSqlInjectionCustomizations
21-
import semmle.python.security.dataflow.PathInjectionCustomizations
22-
import semmle.python.security.dataflow.PolynomialReDoSCustomizations
23-
import semmle.python.security.dataflow.ReflectedXSSCustomizations
24-
import semmle.python.security.dataflow.RegexInjectionCustomizations
25-
import semmle.python.security.dataflow.ServerSideRequestForgeryCustomizations
26-
import semmle.python.security.dataflow.SqlInjectionCustomizations
27-
import semmle.python.security.dataflow.StackTraceExposureCustomizations
28-
import semmle.python.security.dataflow.TarSlipCustomizations
29-
import semmle.python.security.dataflow.UnsafeDeserializationCustomizations
30-
import semmle.python.security.dataflow.UrlRedirectCustomizations
31-
import semmle.python.security.dataflow.WeakSensitiveDataHashingCustomizations
32-
import semmle.python.security.dataflow.XmlBombCustomizations
33-
import semmle.python.security.dataflow.XpathInjectionCustomizations
34-
import semmle.python.security.dataflow.XxeCustomizations
35-
36-
DataFlow::Node relevantTaintSink(string kind) {
37-
not result.getLocation().getFile() instanceof IgnoredFile and
38-
(
39-
kind = "CleartextLogging" and result instanceof CleartextLogging::Sink
40-
or
41-
kind = "CleartextStorage" and result instanceof CleartextStorage::Sink
42-
or
43-
kind = "CodeInjection" and result instanceof CodeInjection::Sink
44-
or
45-
kind = "CommandInjection" and result instanceof CommandInjection::Sink
46-
or
47-
kind = "LdapInjection (DN)" and result instanceof LdapInjection::DnSink
48-
or
49-
kind = "LdapInjection (Filter)" and result instanceof LdapInjection::FilterSink
50-
or
51-
kind = "LogInjection" and result instanceof LogInjection::Sink
52-
or
53-
kind = "PathInjection" and result instanceof PathInjection::Sink
54-
or
55-
kind = "PolynomialReDoS" and result instanceof PolynomialReDoS::Sink
56-
or
57-
kind = "ReflectedXss" and result instanceof ReflectedXss::Sink
58-
or
59-
kind = "RegexInjection" and result instanceof RegexInjection::Sink
60-
or
61-
kind = "NoSqlInjection (string sink)" and result instanceof NoSqlInjection::StringSink
62-
or
63-
kind = "NoSqlInjection (dict sink)" and result instanceof NoSqlInjection::DictSink
64-
or
65-
kind = "ServerSideRequestForgery" and result instanceof ServerSideRequestForgery::Sink
66-
or
67-
kind = "SqlInjection" and result instanceof SqlInjection::Sink
68-
or
69-
kind = "StackTraceExposure" and result instanceof StackTraceExposure::Sink
70-
or
71-
kind = "TarSlip" and result instanceof TarSlip::Sink
72-
or
73-
kind = "UnsafeDeserialization" and result instanceof UnsafeDeserialization::Sink
74-
or
75-
kind = "UrlRedirect" and result instanceof UrlRedirect::Sink
76-
or
77-
kind = "WeakSensitiveDataHashing (NormalHashFunction)" and
78-
result instanceof NormalHashFunction::Sink
79-
or
80-
kind = "WeakSensitiveDataHashing (ComputationallyExpensiveHashFunction)" and
81-
result instanceof ComputationallyExpensiveHashFunction::Sink
82-
or
83-
kind = "XmlBomb" and result instanceof XmlBomb::Sink
84-
or
85-
kind = "XpathInjection" and result instanceof XpathInjection::Sink
86-
or
87-
kind = "Xxe" and result instanceof Xxe::Sink
88-
)
89-
}
13+
private import Sinks
9014

9115
from string kind
92-
select relevantTaintSink(kind), kind + " sink"
16+
select taintSink(kind), kind + " sink"

0 commit comments

Comments
 (0)