We read every piece of feedback, and take your input very seriously.
To see all available qualifiers, see our documentation.
1 parent b194524 commit 2f68b54Copy full SHA for 2f68b54
python/ql/src/experimental/Security/CWE-022bis/UnsafeUnpack.ql
@@ -35,6 +35,9 @@ class UnsafeUnpackingConfig extends TaintTracking::Configuration {
35
args.flowsTo(o) and
36
source.(AttrRead).accesses(o, any(string s))
37
)
38
+ or
39
+ // A source catching a S3 filename download
40
+ exists(API::Node s3 | source = s3.getMember("download_file").getACall().getArg(2))
41
}
42
43
override predicate isSink(DataFlow::Node sink) {
0 commit comments