Python: make sure unsafe deserialization query is using correct sources and that pickle is included in sinks.

Author: markshannon

python/ql/src/Security/CWE-502/UnsafeDeserialization.ql

@@ -28,7 +28,7 @@ class UnsafeDeserializationConfiguration  extends TaintTracking::Configuration {
 
     UnsafeDeserializationConfiguration() { this = "Unsafe deserialization configuration" }
 
-    override predicate isSource(TaintTracking::Source source) { source.isSourceOf(any(UntrustedStringKind u)) }
+    override predicate isSource(TaintTracking::Source source) { source instanceof HttpRequestTaintSource }
 
     override predicate isSink(TaintTracking::Sink sink) { sink instanceof DeserializationSink }
 

python/ql/src/semmle/python/security/injection/Pickle.qll

@@ -25,7 +25,7 @@ private FunctionObject pickleLoads() {
 }
 
 /** `pickle.loads(untrusted)` vulnerability. */
-class UnpicklingNode extends TaintSink {
+class UnpicklingNode extends DeserializationSink {
 
     override string toString() { result = "unpickling untrusted data" }