Skip to content

Python: Arbitrary file read and delete#7293

Closed
haby0 wants to merge 1 commit into
github:mainfrom
haby0:Python/ArbitraryFileReadAndDelete
Closed

Python: Arbitrary file read and delete#7293
haby0 wants to merge 1 commit into
github:mainfrom
haby0:Python/ArbitraryFileReadAndDelete

Conversation

@haby0
Copy link
Copy Markdown
Contributor

@haby0 haby0 commented Dec 2, 2021

From: #6977

A taint analysis was done on arbitrary file reading. Related frameworks were modeled, such as FastAPI, Flask view, etc.
In the Python path injection, some of the sinks where arbitrary files and folders are deleted are missing. I modeled this in this PR.

@haby0 haby0 requested a review from a team as a code owner December 2, 2021 11:00
@haby0 haby0 changed the title Arbitrary file read and delete Python: Arbitrary file read and delete Dec 2, 2021
Copy link
Copy Markdown
Member

@RasmusWL RasmusWL left a comment

Choose a reason for hiding this comment

The reason will be displayed to describe this comment to others. Learn more.

Thanks for this PR.

I think there is too much overlap with our path injection query, so as such, I do not want to accept this new query.

I do understand that knowing the user-controlled file is returned or deleted, has a higher signal-to-noise ratio than simply knowing there is path-injection; it's an interesting idea, but for now doesn't fit easily within how we do things (and we will need to think a bit more on how to properly incorporate this).

It seems there are a few additions to path injection sinks (like that flask.send_file is just an alias of flask.helpers.send_file), and a few improvements to our modeling of HTTP libraries. If you split these improvements into separate PRs, I'd be happy to look at including this 👍

@haby0
Copy link
Copy Markdown
Contributor Author

haby0 commented Jan 7, 2022

Thanks for this PR.

I think there is too much overlap with our path injection query, so as such, I do not want to accept this new query.

I do understand that knowing the user-controlled file is returned or deleted, has a higher signal-to-noise ratio than simply knowing there is path-injection; it's an interesting idea, but for now doesn't fit easily within how we do things (and we will need to think a bit more on how to properly incorporate this).

It seems there are a few additions to path injection sinks (like that flask.send_file is just an alias of flask.helpers.send_file), and a few improvements to our modeling of HTTP libraries. If you split these improvements into separate PRs, I'd be happy to look at including this 👍

Thanks for the reply. I am closed now.

@haby0 haby0 closed this Jan 7, 2022
Sign up for free to join this conversation on GitHub. Already have an account? Sign in to comment

Projects

None yet

Development

Successfully merging this pull request may close these issues.

2 participants