Skip to content

Commit 3a669a8

Browse files
asgerfasgerf
committed
Python: getAValueReachingRhs -> getAValueReachingSink
1 parent b096f9e commit 3a669a8

File tree

11 files changed

+31
-29
lines changed

11 files changed

+31
-29
lines changed

‎python/ql/lib/semmle/python/ApiGraphs.qll‎

Lines changed: 1 addition & 1 deletion
Original file line numberDiff line numberDiff line change
@@ -134,7 +134,7 @@ module API {
134134
* Gets a data-flow node that may interprocedurally flow to the right-hand side of a definition
135135
* of the API component represented by this node.
136136
*/
137-
DataFlow::Node getAValueReachingRhs() { result = Impl::trackDefNode(this.asSink()) }
137+
DataFlow::Node getAValueReachingSink() { result = Impl::trackDefNode(this.asSink()) }
138138

139139
/**
140140
* Gets an immediate use of the API component represented by this node.

‎python/ql/lib/semmle/python/frameworks/Aiohttp.qll‎

Lines changed: 2 additions & 2 deletions
Original file line numberDiff line numberDiff line change
@@ -685,8 +685,8 @@ private module AiohttpClientModel {
685685
DataFlow::Node disablingNode, DataFlow::Node argumentOrigin
686686
) {
687687
exists(API::Node param | param = this.getKeywordParameter(["ssl", "verify_ssl"]) |
688-
disablingNode = param.getARhs() and
689-
argumentOrigin = param.getAValueReachingRhs() and
688+
disablingNode = param.asSink() and
689+
argumentOrigin = param.getAValueReachingSink() and
690690
// aiohttp.client treats `None` as the default and all other "falsey" values as `False`.
691691
argumentOrigin.asExpr().(ImmutableLiteral).booleanValue() = false and
692692
not argumentOrigin.asExpr() instanceof None

‎python/ql/lib/semmle/python/frameworks/Httpx.qll‎

Lines changed: 4 additions & 4 deletions
Original file line numberDiff line numberDiff line change
@@ -44,8 +44,8 @@ private module HttpxModel {
4444
override predicate disablesCertificateValidation(
4545
DataFlow::Node disablingNode, DataFlow::Node argumentOrigin
4646
) {
47-
disablingNode = this.getKeywordParameter("verify").getARhs() and
48-
argumentOrigin = this.getKeywordParameter("verify").getAValueReachingRhs() and
47+
disablingNode = this.getKeywordParameter("verify").asSink() and
48+
argumentOrigin = this.getKeywordParameter("verify").getAValueReachingSink() and
4949
// unlike `requests`, httpx treats `None` as turning off verify (and not as the default)
5050
argumentOrigin.asExpr().(ImmutableLiteral).booleanValue() = false
5151
// TODO: Handling of insecure SSLContext passed to verify argument
@@ -89,8 +89,8 @@ private module HttpxModel {
8989
constructor = classRef().getACall() and
9090
this = constructor.getReturn().getMember(methodName).getACall()
9191
|
92-
disablingNode = constructor.getKeywordParameter("verify").getARhs() and
93-
argumentOrigin = constructor.getKeywordParameter("verify").getAValueReachingRhs() and
92+
disablingNode = constructor.getKeywordParameter("verify").asSink() and
93+
argumentOrigin = constructor.getKeywordParameter("verify").getAValueReachingSink() and
9494
// unlike `requests`, httpx treats `None` as turning off verify (and not as the default)
9595
argumentOrigin.asExpr().(ImmutableLiteral).booleanValue() = false
9696
// TODO: Handling of insecure SSLContext passed to verify argument

‎python/ql/lib/semmle/python/frameworks/Lxml.qll‎

Lines changed: 9 additions & 8 deletions
Original file line numberDiff line numberDiff line change
@@ -141,17 +141,18 @@ private module Lxml {
141141
// resolve_entities has default True
142142
not exists(this.getArgByName("resolve_entities"))
143143
or
144-
this.getKeywordParameter("resolve_entities").getAValueReachingRhs().asExpr() = any(True t)
144+
this.getKeywordParameter("resolve_entities").getAValueReachingSink().asExpr() =
145+
any(True t)
145146
)
146147
or
147148
kind.isXmlBomb() and
148-
this.getKeywordParameter("huge_tree").getAValueReachingRhs().asExpr() = any(True t) and
149-
not this.getKeywordParameter("resolve_entities").getAValueReachingRhs().asExpr() =
149+
this.getKeywordParameter("huge_tree").getAValueReachingSink().asExpr() = any(True t) and
150+
not this.getKeywordParameter("resolve_entities").getAValueReachingSink().asExpr() =
150151
any(False t)
151152
or
152153
kind.isDtdRetrieval() and
153-
this.getKeywordParameter("load_dtd").getAValueReachingRhs().asExpr() = any(True t) and
154-
this.getKeywordParameter("no_network").getAValueReachingRhs().asExpr() = any(False t)
154+
this.getKeywordParameter("load_dtd").getAValueReachingSink().asExpr() = any(True t) and
155+
this.getKeywordParameter("no_network").getAValueReachingSink().asExpr() = any(False t)
155156
}
156157
}
157158

@@ -318,11 +319,11 @@ private module Lxml {
318319
kind.isXxe()
319320
or
320321
kind.isXmlBomb() and
321-
this.getKeywordParameter("huge_tree").getAValueReachingRhs().asExpr() = any(True t)
322+
this.getKeywordParameter("huge_tree").getAValueReachingSink().asExpr() = any(True t)
322323
or
323324
kind.isDtdRetrieval() and
324-
this.getKeywordParameter("load_dtd").getAValueReachingRhs().asExpr() = any(True t) and
325-
this.getKeywordParameter("no_network").getAValueReachingRhs().asExpr() = any(False t)
325+
this.getKeywordParameter("load_dtd").getAValueReachingSink().asExpr() = any(True t) and
326+
this.getKeywordParameter("no_network").getAValueReachingSink().asExpr() = any(False t)
326327
}
327328

328329
override predicate mayExecuteInput() { none() }

‎python/ql/lib/semmle/python/frameworks/Requests.qll‎

Lines changed: 1 addition & 1 deletion
Original file line numberDiff line numberDiff line change
@@ -62,7 +62,7 @@ private module Requests {
6262
DataFlow::Node disablingNode, DataFlow::Node argumentOrigin
6363
) {
6464
disablingNode = this.getKeywordParameter("verify").asSink() and
65-
argumentOrigin = this.getKeywordParameter("verify").getAValueReachingRhs() and
65+
argumentOrigin = this.getKeywordParameter("verify").getAValueReachingSink() and
6666
// requests treats `None` as the default and all other "falsey" values as `False`.
6767
argumentOrigin.asExpr().(ImmutableLiteral).booleanValue() = false and
6868
not argumentOrigin.asExpr() instanceof None

‎python/ql/lib/semmle/python/frameworks/Stdlib.qll‎

Lines changed: 3 additions & 3 deletions
Original file line numberDiff line numberDiff line change
@@ -2657,7 +2657,7 @@ private module StdlibPrivate {
26572657
/** Gets a call to `hashlib.new` with `algorithmName` as the first argument. */
26582658
private API::CallNode hashlibNewCall(string algorithmName) {
26592659
algorithmName =
2660-
result.getParameter(0, "name").getAValueReachingRhs().asExpr().(StrConst).getText() and
2660+
result.getParameter(0, "name").getAValueReachingSink().asExpr().(StrConst).getText() and
26612661
result = API::moduleImport("hashlib").getMember("new").getACall()
26622662
}
26632663

@@ -3443,7 +3443,7 @@ private module StdlibPrivate {
34433443
.getMember("handler")
34443444
.getMember("feature_external_ges")
34453445
.getAValueReachableFromSource() and
3446-
call.getStateArg().getAValueReachingRhs().asExpr().(BooleanLiteral).booleanValue() = true and
3446+
call.getStateArg().getAValueReachingSink().asExpr().(BooleanLiteral).booleanValue() = true and
34473447
result = call.getObject()
34483448
)
34493449
or
@@ -3459,7 +3459,7 @@ private module StdlibPrivate {
34593459
.getMember("handler")
34603460
.getMember("feature_external_ges")
34613461
.getAValueReachableFromSource() and
3462-
call.getStateArg().getAValueReachingRhs().asExpr().(BooleanLiteral).booleanValue() = false
3462+
call.getStateArg().getAValueReachingSink().asExpr().(BooleanLiteral).booleanValue() = false
34633463
)
34643464
}
34653465

‎python/ql/lib/semmle/python/frameworks/Urllib3.qll‎

Lines changed: 5 additions & 4 deletions
Original file line numberDiff line numberDiff line change
@@ -71,14 +71,15 @@ private module Urllib3 {
7171
|
7272
// cert_reqs
7373
// see https://urllib3.readthedocs.io/en/stable/user-guide.html?highlight=cert_reqs#certificate-verification
74-
disablingNode = constructor.getKeywordParameter("cert_reqs").getARhs() and
75-
argumentOrigin = constructor.getKeywordParameter("cert_reqs").getAValueReachingRhs() and
74+
disablingNode = constructor.getKeywordParameter("cert_reqs").asSink() and
75+
argumentOrigin = constructor.getKeywordParameter("cert_reqs").getAValueReachingSink() and
7676
argumentOrigin.asExpr().(StrConst).getText() = "CERT_NONE"
7777
or
7878
// assert_hostname
7979
// see https://urllib3.readthedocs.io/en/stable/reference/urllib3.connectionpool.html?highlight=assert_hostname#urllib3.HTTPSConnectionPool
80-
disablingNode = constructor.getKeywordParameter("assert_hostname").getARhs() and
81-
argumentOrigin = constructor.getKeywordParameter("assert_hostname").getAValueReachingRhs() and
80+
disablingNode = constructor.getKeywordParameter("assert_hostname").asSink() and
81+
argumentOrigin =
82+
constructor.getKeywordParameter("assert_hostname").getAValueReachingSink() and
8283
argumentOrigin.asExpr().(BooleanLiteral).booleanValue() = false
8384
)
8485
}

‎python/ql/lib/semmle/python/frameworks/Xmltodict.qll‎

Lines changed: 1 addition & 1 deletion
Original file line numberDiff line numberDiff line change
@@ -29,7 +29,7 @@ private module Xmltodict {
2929

3030
override predicate vulnerableTo(XML::XmlParsingVulnerabilityKind kind) {
3131
kind.isXmlBomb() and
32-
this.getKeywordParameter("disable_entities").getAValueReachingRhs().asExpr() = any(False f)
32+
this.getKeywordParameter("disable_entities").getAValueReachingSink().asExpr() = any(False f)
3333
}
3434

3535
override predicate mayExecuteInput() { none() }

‎python/ql/src/Security/CWE-079/Jinja2WithoutEscaping.ql‎

Lines changed: 1 addition & 1 deletion
Original file line numberDiff line numberDiff line change
@@ -42,7 +42,7 @@ where
4242
not exists(call.getArgByName("autoescape"))
4343
or
4444
call.getKeywordParameter("autoescape")
45-
.getAValueReachingRhs()
45+
.getAValueReachingSink()
4646
.asExpr()
4747
.(ImmutableLiteral)
4848
.booleanValue() = false

‎python/ql/src/Security/CWE-285/PamAuthorization.ql‎

Lines changed: 2 additions & 2 deletions
Original file line numberDiff line numberDiff line change
@@ -18,9 +18,9 @@ import semmle.python.dataflow.new.TaintTracking
1818
API::Node libPam() {
1919
exists(API::CallNode findLibCall, API::CallNode cdllCall |
2020
findLibCall = API::moduleImport("ctypes").getMember("util").getMember("find_library").getACall() and
21-
findLibCall.getParameter(0).getAValueReachingRhs().asExpr().(StrConst).getText() = "pam" and
21+
findLibCall.getParameter(0).getAValueReachingSink().asExpr().(StrConst).getText() = "pam" and
2222
cdllCall = API::moduleImport("ctypes").getMember("CDLL").getACall() and
23-
cdllCall.getParameter(0).getAValueReachingRhs() = findLibCall
23+
cdllCall.getParameter(0).getAValueReachingSink() = findLibCall
2424
|
2525
result = cdllCall.getReturn()
2626
)

0 commit comments

Comments
 (0)