Merge pull request #775 from taus-semmle/python-dill-pickle-support

Python: dill pickle support.

Author: markshannon

change-notes/1.20/analysis-python.md

@@ -23,4 +23,4 @@
 
  ## Changes to QL libraries
 
- * *Series of bullet points*
+ * Added support for the `dill` pickle library.

python/ql/src/semmle/python/security/injection/Pickle.qll

@@ -15,6 +15,8 @@ private ModuleObject pickleModule() {
     result.getName() = "pickle"
     or
     result.getName() = "cPickle"
+    or
+    result.getName() = "dill"
 }
 
 private FunctionObject pickleLoads() {

python/ql/test/query-tests/Security/CWE-502/UnsafeDeserialization.expected

@@ -3,10 +3,12 @@ edges
 | test.py:11:15:11:41 | externally controlled string | test.py:12:18:12:24 | externally controlled string |
 | test.py:11:15:11:41 | externally controlled string | test.py:13:15:13:21 | externally controlled string |
 | test.py:11:15:11:41 | externally controlled string | test.py:14:19:14:25 | externally controlled string |
+| test.py:11:15:11:41 | externally controlled string | test.py:16:16:16:22 | externally controlled string |
 | test.py:13:15:13:21 | externally controlled string | ../lib/yaml.py:1:10:1:10 | externally controlled string |
 parents
 | ../lib/yaml.py:1:10:1:10 | externally controlled string | test.py:13:15:13:21 | externally controlled string |
 #select
 | test.py:12:18:12:24 | unpickling untrusted data | test.py:11:15:11:26 | dict of externally controlled string | test.py:12:18:12:24 | externally controlled string | Deserializing of $@. | test.py:11:15:11:26 | flask.request.args | untrusted input |
 | test.py:13:15:13:21 | yaml.load vulnerability | test.py:11:15:11:26 | dict of externally controlled string | test.py:13:15:13:21 | externally controlled string | Deserializing of $@. | test.py:11:15:11:26 | flask.request.args | untrusted input |
 | test.py:14:19:14:25 | unmarshaling vulnerability | test.py:11:15:11:26 | dict of externally controlled string | test.py:14:19:14:25 | externally controlled string | Deserializing of $@. | test.py:11:15:11:26 | flask.request.args | untrusted input |
+| test.py:16:16:16:22 | unpickling untrusted data | test.py:11:15:11:26 | dict of externally controlled string | test.py:16:16:16:22 | externally controlled string | Deserializing of $@. | test.py:11:15:11:26 | flask.request.args | untrusted input |

python/ql/test/query-tests/Security/CWE-502/test.py

@@ -12,5 +12,7 @@ def hello():
     pickle.loads(payload)
     yaml.load(payload)
     marshal.loads(payload)
+    import dill
+    dill.loads(payload)
 
 

python/ql/test/query-tests/Security/lib/dill.py

@@ -0,0 +1,2 @@
+def loads(*args, **kwargs):
+    return None