Python taint-tracking: Support iterables of taint.

Author: markshannon

python/ql/src/semmle/python/security/TaintTracking.qll

@@ -159,6 +159,12 @@ abstract class TaintKind extends string {
 
     string repr() { result = this }
 
+    /** Gets the taint resulting from iterating over this kind of taint.
+     * For example iterating over a text file produces lines. So iterating
+     * over a tainted file would result in tainted strings
+     */
+    TaintKind getTaintForIteration() { none() }
+
 }
 
 /** Taint kinds representing collections of other taint kind.
@@ -212,6 +218,10 @@ class SequenceKind extends CollectionKind {
         result = "sequence of " + itemKind
     }
 
+    override TaintKind getTaintForIteration() {
+        result = itemKind
+    }
+
 }
 
 
@@ -863,6 +873,8 @@ library module TaintFlowImplementation {
         or
         call_taint_step(fromnode, totaint, tocontext, tonode)
         or
+        iteration_step(fromnode, totaint, tocontext, tonode)
+        or
         exists(DataFlowNode fromnodenode |
             fromnodenode = fromnode.getNode() and
             (
@@ -1067,6 +1079,13 @@ library module TaintFlowImplementation {
         )
     }
 
+    /** Holds if `v` is defined by a `for` statement, the definition being `defn` */
+    cached predicate iteration_step(TaintedNode fromnode, TrackedValue totaint, CallContext tocontext, ControlFlowNode iter) {
+        exists(ForNode for | for.iterates(iter, fromnode.getNode())) and
+        totaint = TTrackedTaint(fromnode.getTaintKind().getTaintForIteration()) and
+        tocontext = fromnode.getContext()
+    }
+
     predicate self_init_end_transfer(EssaVariable self, CallContext callee, CallNode call, CallContext caller) {
         exists(ClassValue cls, Function init |
             call.getFunction().pointsTo(cls) and
@@ -1161,6 +1180,9 @@ library module TaintFlowImplementation {
         tainted_with(def, context, origin)
         or
         tainted_exception_capture(def, context, origin)
+        or
+        tainted_iteration(def, context, origin)
+
     }
 
     predicate tainted_scope_entry(ScopeEntryDefinition def, CallContext context, TaintedNode origin) {
@@ -1363,6 +1385,12 @@ library module TaintFlowImplementation {
         context = fromnode.getContext()
     }
 
+    pragma [noinline]
+    private predicate tainted_iteration(IterationDefinition def, CallContext context, TaintedNode fromnode) {
+        def.getDefiningNode() = fromnode.getNode() and
+        context = fromnode.getContext()
+    }
+
     /* A call that returns a copy (or similar) of the argument */
     predicate copyCall(ControlFlowNode fromnode, CallNode tonode) {
         tonode.getFunction().(AttrNode).getObject("copy") = fromnode

python/ql/test/library-tests/taint/general/TaintLib.qll

@@ -362,7 +362,29 @@ class FalseySource  extends TaintSource {
 
 }
 
+class TaintIterable extends TaintKind {
 
+    TaintIterable() {
+        this = "iterable.simple"
+    }
+
+    override TaintKind getTaintForIteration() {
+        result instanceof SimpleTest
+    }
+
+}
+
+class TaintIterableSource extends TaintSource {
+
+    TaintIterableSource() {
+        this.(NameNode).getId() = "ITERABLE_SOURCE"
+    }
+
+    override predicate isSourceOf(TaintKind kind) {
+        kind instanceof TaintIterable
+    }
+
+}
 
 
 

python/ql/test/library-tests/taint/general/TestDefn.expected

@@ -180,3 +180,6 @@
 | test.py:197 | Pi(t_0) [true] | test.py:195 | Taint simple.test | SOURCE |
 | test.py:199 | ArgumentRefinement(t_3) | test.py:195 | Taint simple.test | SOURCE |
 | test.py:199 | Pi(t_0) [false] | test.py:195 | Taint simple.test | SOURCE |
+| test.py:202 | ITERABLE_SOURCE | test.py:202 | Taint iterable.simple | ITERABLE_SOURCE |
+| test.py:203 | IterationDefinition | test.py:203 | Taint simple.test | i |
+| test.py:203 | phi(i_0, i_2) | test.py:203 | Taint simple.test | i |

python/ql/test/library-tests/taint/general/TestNode.expected

@@ -96,6 +96,8 @@
 | Taint explicit.carrier | carrier.py:35 | x |  |
 | Taint falsey | test.py:189 | FALSEY |  |
 | Taint falsey | test.py:190 | t |  |
+| Taint iterable.simple | test.py:202 | ITERABLE_SOURCE |  |
+| Taint iterable.simple | test.py:203 | t |  |
 | Taint paper | rockpaperscissors.py:6 | arg | rockpaperscissors.py:32 |
 | Taint paper | rockpaperscissors.py:9 | arg | rockpaperscissors.py:26 |
 | Taint paper | rockpaperscissors.py:25 | Attribute() |  |
@@ -226,6 +228,9 @@
 | Taint simple.test | test.py:196 | t |  |
 | Taint simple.test | test.py:197 | t |  |
 | Taint simple.test | test.py:199 | t |  |
+| Taint simple.test | test.py:203 | i |  |
+| Taint simple.test | test.py:204 | i |  |
+| Taint simple.test | test.py:205 | i |  |
 | Taint {simple.test} | test.py:169 | Dict |  |
 | Taint {simple.test} | test.py:171 | d |  |
 | Taint {simple.test} | test.py:173 | y |  |

python/ql/test/library-tests/taint/general/TestSource.expected

@@ -43,3 +43,4 @@
 | test.py:178 | SOURCE | simple.test |
 | test.py:189 | FALSEY | falsey |
 | test.py:195 | SOURCE | simple.test |
+| test.py:202 | ITERABLE_SOURCE | iterable.simple |

python/ql/test/library-tests/taint/general/TestStep.expected

@@ -83,6 +83,8 @@
 | Taint explicit.carrier | carrier.py:34 | Attribute |  |  -->  | Taint explicit.carrier | carrier.py:35 | x |  |
 | Taint explicit.carrier | carrier.py:35 | x |  |  -->  | Taint simple.test | carrier.py:35 | Attribute() |  |
 | Taint falsey | test.py:189 | FALSEY |  |  -->  | Taint falsey | test.py:190 | t |  |
+| Taint iterable.simple | test.py:202 | ITERABLE_SOURCE |  |  -->  | Taint iterable.simple | test.py:203 | t |  |
+| Taint iterable.simple | test.py:203 | t |  |  -->  | Taint simple.test | test.py:203 | i |  |
 | Taint paper | rockpaperscissors.py:25 | Attribute() |  |  -->  | Taint paper | rockpaperscissors.py:26 | y |  |
 | Taint paper | rockpaperscissors.py:26 | y |  |  -->  | Taint paper | rockpaperscissors.py:9 | arg | rockpaperscissors.py:26 |
 | Taint paper | rockpaperscissors.py:30 | Attribute() |  |  -->  | Taint paper | rockpaperscissors.py:32 | y |  |
@@ -181,6 +183,8 @@
 | Taint simple.test | test.py:195 | SOURCE |  |  -->  | Taint simple.test | test.py:196 | t |  |
 | Taint simple.test | test.py:195 | SOURCE |  |  -->  | Taint simple.test | test.py:197 | t |  |
 | Taint simple.test | test.py:195 | SOURCE |  |  -->  | Taint simple.test | test.py:199 | t |  |
+| Taint simple.test | test.py:203 | i |  |  -->  | Taint simple.test | test.py:204 | i |  |
+| Taint simple.test | test.py:203 | i |  |  -->  | Taint simple.test | test.py:205 | i |  |
 | Taint {simple.test} | test.py:169 | Dict |  |  -->  | Taint {simple.test} | test.py:171 | d |  |
 | Taint {simple.test} | test.py:169 | Dict |  |  -->  | Taint {simple.test} | test.py:175 | d |  |
 | Taint {simple.test} | test.py:171 | d |  |  -->  | Taint {simple.test} | test.py:173 | y |  |

python/ql/test/library-tests/taint/general/TestVar.expected

@@ -182,3 +182,6 @@
 | test.py:197 | t_2 | test.py:195 | Taint simple.test | SOURCE |
 | test.py:199 | t_3 | test.py:195 | Taint simple.test | SOURCE |
 | test.py:199 | t_4 | test.py:195 | Taint simple.test | SOURCE |
+| test.py:202 | t_0 | test.py:202 | Taint iterable.simple | ITERABLE_SOURCE |
+| test.py:203 | i_1 | test.py:203 | Taint simple.test | i |
+| test.py:203 | i_2 | test.py:203 | Taint simple.test | i |

python/ql/test/library-tests/taint/general/test.py

@@ -198,3 +198,9 @@ def flow_through_type_test_if_no_class():
     else:
         SINK(t)
 
+def flow_in_iteration():
+    t = ITERABLE_SOURCE
+    for i in t:
+        i
+    return i
+