@@ -15,56 +15,50 @@ import python
1515import semmle.python.security.Paths
1616
1717predicate safe_method ( string name ) {
18- name = "count" or name = "index" or name = "copy" or name = "get" or name = "has_key" or
19- name = "items" or name = "keys" or name = "values" or name = "iteritems" or name = "iterkeys" or name = "itervalues"
18+ name = "count" or
19+ name = "index" or
20+ name = "copy" or
21+ name = "get" or
22+ name = "has_key" or
23+ name = "items" or
24+ name = "keys" or
25+ name = "values" or
26+ name = "iteritems" or
27+ name = "iterkeys" or
28+ name = "itervalues"
2029}
2130
2231/** Gets the truthiness (non emptyness) of the default of `p` if that value is mutable */
2332private boolean mutableDefaultValue ( Parameter p ) {
24- exists ( Dict d |
25- p .getDefault ( ) = d |
33+ exists ( Dict d | p .getDefault ( ) = d |
2634 exists ( d .getAKey ( ) ) and result = true
2735 or
2836 not exists ( d .getAKey ( ) ) and result = false
2937 )
3038 or
31- exists ( List l |
32- p .getDefault ( ) = l |
39+ exists ( List l | p .getDefault ( ) = l |
3340 exists ( l .getAnElt ( ) ) and result = true
3441 or
3542 not exists ( l .getAnElt ( ) ) and result = false
3643 )
3744}
3845
39-
4046class NonEmptyMutableValue extends TaintKind {
41- NonEmptyMutableValue ( ) {
42- this = "non-empty mutable value"
43- }
47+ NonEmptyMutableValue ( ) { this = "non-empty mutable value" }
4448}
4549
4650class EmptyMutableValue extends TaintKind {
47- EmptyMutableValue ( ) {
48- this = "empty mutable value"
49- }
50-
51- override boolean booleanValue ( ) {
52- result = false
53- }
51+ EmptyMutableValue ( ) { this = "empty mutable value" }
5452
53+ override boolean booleanValue ( ) { result = false }
5554}
5655
5756class MutableDefaultValue extends TaintSource {
58-
5957 boolean nonEmpty ;
6058
61- MutableDefaultValue ( ) {
62- nonEmpty = mutableDefaultValue ( this .( NameNode ) .getNode ( ) )
63- }
59+ MutableDefaultValue ( ) { nonEmpty = mutableDefaultValue ( this .( NameNode ) .getNode ( ) ) }
6460
65- override string toString ( ) {
66- result = "mutable default value"
67- }
61+ override string toString ( ) { result = "mutable default value" }
6862
6963 override predicate isSourceOf ( TaintKind kind ) {
7064 nonEmpty = false and kind instanceof EmptyMutableValue
@@ -82,8 +76,7 @@ class Mutation extends TaintSink {
8276 Mutation ( ) {
8377 exists ( AugAssign a | a .getTarget ( ) .getAFlowNode ( ) = this )
8478 or
85- exists ( Call c , Attribute a |
86- c .getFunc ( ) = a |
79+ exists ( Call c , Attribute a | c .getFunc ( ) = a |
8780 a .getObject ( ) .getAFlowNode ( ) = this and
8881 not safe_method ( a .getName ( ) ) and
8982 this .( ControlFlowNode ) .pointsTo ( ) .getClass ( ) = mutable_class ( )
@@ -99,4 +92,5 @@ class Mutation extends TaintSink {
9992
10093from TaintedPathSource src , TaintedPathSink sink
10194where src .flowsTo ( sink )
102- select sink .getSink ( ) , src , sink , "$@ flows to here and is mutated." , src .getSource ( ) , "Default value"
95+ select sink .getSink ( ) , src , sink , "$@ flows to here and is mutated." , src .getSource ( ) ,
96+ "Default value"
0 commit comments