Update query

Author: haby0

python/ql/src/experimental/Security/CWE-348/ClientSuppliedIpUsedInSecurityCheck.ql

@@ -13,6 +13,7 @@
 import python
 import semmle.python.dataflow.new.DataFlow
 import semmle.python.dataflow.new.TaintTracking
+import semmle.python.ApiGraphs
 import ClientSuppliedIpUsedInSecurityCheckLib
 import DataFlow::PathGraph
 
@@ -30,6 +31,14 @@ class ClientSuppliedIpUsedInSecurityCheckConfig extends TaintTracking::Configura
     sink instanceof ClientSuppliedIpUsedInSecurityCheckSink
   }
 
+  override predicate isAdditionalTaintStep(DataFlow::Node pred, DataFlow::Node succ) {
+    exists(DataFlow::CallCfgNode ccn |
+      ccn = API::moduleImport("netaddr").getMember("IPAddress").getACall() and
+      ccn.getArg(0) = pred and
+      ccn = succ
+    )
+  }
+
   override predicate isSanitizer(DataFlow::Node node) {
     exists(Subscript ss |
       not ss.getIndex().(IntegerLiteral).getText() = "0" and

python/ql/src/experimental/Security/CWE-348/ClientSuppliedIpUsedInSecurityCheckLib.qll

@@ -123,14 +123,10 @@ private class CompareSink extends ClientSuppliedIpUsedInSecurityCheckSink {
       (
         compare.getLeft() = this.asExpr()
         or
-        compare.getComparator(0) = this.asExpr()
+        compare.getComparator(0) = this.asExpr() and
+        not compare.getLeft().(StrConst).getText() in ["%", ","]
       )
     )
-    or
-    exists(Call call |
-      call.getFunc().(Attribute).getName() = "add" and
-      call.getArg(0) = this.asExpr()
-    )
   }
 }