Update python/ql/src/experimental/Security/CWE-348/ClientSuppliedIpUsedInSecurityCheck.ql

haby0 · yoff · web-flow · commit 538bf7c3219a · 2021-10-07T19:44:25.000+08:00
Co-authored-by: yoff &lt;lerchedahl@gmail.com&gt;
diff --git a/python/ql/src/experimental/Security/CWE-348/ClientSuppliedIpUsedInSecurityCheck.ql b/python/ql/src/experimental/Security/CWE-348/ClientSuppliedIpUsedInSecurityCheck.ql
@@ -38,7 +38,9 @@ class ClientSuppliedIpUsedInSecurityCheckConfig extends TaintTracking::Configura
   }
 
   override predicate isSanitizer(DataFlow::Node node) {
+    // `client_supplied_ip.split(",")[n]` for `n` > 0
     exists(Subscript ss |
+      not ss.getIndex().(IntegerLiteral).getText() = "0" and
       ss.getObject().(Call).getFunc().(Attribute).getName() = "split" and
       ss.getObject().(Call).getAnArg().(StrConst).getText() = "," and
       ss = node.asExpr()

Original file line number	Diff line number	Diff line change
`@@ -38,7 +38,9 @@ class ClientSuppliedIpUsedInSecurityCheckConfig extends TaintTracking::Configura`
`38`	`38`	`}`
`39`	`39`
`40`	`40`	`override predicate isSanitizer(DataFlow::Node node) {`
	`41`	+ // `client_supplied_ip.split(",")[n]` for `n` > 0
`41`	`42`	`exists(Subscript ss \|`
	`43`	`+ not ss.getIndex().(IntegerLiteral).getText() = "0" and`
`42`	`44`	`ss.getObject().(Call).getFunc().(Attribute).getName() = "split" and`
`43`	`45`	`ss.getObject().(Call).getAnArg().(StrConst).getText() = "," and`
`44`	`46`	`ss = node.asExpr()`