Skip to content

Python: Add support for extraction filters - #14918

Merged
tausbn merged 4 commits into
mainfrom
tausbn/python-support-tarslip-extraction-filters
Nov 30, 2023
Merged

Python: Add support for extraction filters#14918
tausbn merged 4 commits into
mainfrom
tausbn/python-support-tarslip-extraction-filters

Conversation

@tausbn

@tausbn tausbn commented Nov 27, 2023

Copy link
Copy Markdown
Contributor

Adds support for extraction filters as defined in https://peps.python.org/pep-0706/ and implemented in Python 3.12.

By my reading, setting the filter to 'data' or 'tar' is probably safe, whereas 'fully_trusted' or the default (which is the same as None) is not.

For now, I have just added this modelling to the tarslip query. We could also share it with the modelling of shutil.unpack_archive (which has also gained a filter argument), but it was unclear to me where we should put this modelling in that case. Perhaps the best solution would be to merge the experimental py/tarslip-extended query into the existing query (in which case the current location is perhaps not too bad).

Adds support for extraction filters as defined in
https://peps.python.org/pep-0706/
and implemented in Python 3.12.

By my reading, setting the filter to `'data'` or `'tar'` is probably
safe, whereas `'fully_trusted'` or the default (which is the same as
`None`) is not.

For now, I have just added this modelling to the tarslip query. We could
also share it with the modelling of `shutil.unpack_archive` (which has also
gained a `filter` argument), but it was unclear to me where we should put
this modelling in that case. Perhaps the best solution would be to merge
the experimental `py/tarslip-extended` query into the existing query (in
which case the current location is perhaps not too bad).
@tausbn
tausbn marked this pull request as ready for review November 27, 2023 14:39
@tausbn
tausbn requested a review from a team as a code owner November 27, 2023 14:39

@RasmusWL RasmusWL left a comment

Copy link
Copy Markdown
Member

Choose a reason for hiding this comment

The reason will be displayed to describe this comment to others. Learn more.

I agree with your reading that we should treat both 'data' and 'tar' as safe, at least for the tar-slip query 👍

I think we can rewrite the core bits of the code to really use the expressive powers of API graphs 😊

Comment thread python/ql/lib/semmle/python/security/dataflow/TarSlipCustomizations.qll Outdated
This will probably break the tests in the short run. I'll fix the remaining issues in a follow-up commit.

Co-authored-by: Rasmus Wriedt Larsen <rasmuswl@github.com>
@tausbn
tausbn requested a review from RasmusWL November 28, 2023 22:35
@tausbn
tausbn merged commit 4ef1fe4 into main Nov 30, 2023
@tausbn
tausbn deleted the tausbn/python-support-tarslip-extraction-filters branch November 30, 2023 21:55
Sign up for free to join this conversation on GitHub. Already have an account? Sign in to comment

Projects

None yet

Development

Successfully merging this pull request may close these issues.

3 participants