Python: Move BarrierGuards to own file

RasmusWL · RasmusWL · commit cc9a7fe4fe47 · 2020-11-27T12:09:57.000+01:00
diff --git a/python/ql/src/semmle/python/dataflow/new/BarrierGuards.qll b/python/ql/src/semmle/python/dataflow/new/BarrierGuards.qll
@@ -0,0 +1,46 @@
+/** Provides commonly used BarrierGuards. */
+
+private import python
+private import semmle.python.dataflow.new.DataFlow
+
+/** A validation of unknown node by comparing with a constant string value. */
+class StringConstCompare extends DataFlow::BarrierGuard, CompareNode {
+  ControlFlowNode checked_node;
+  boolean safe_branch;
+
+  StringConstCompare() {
+    exists(StrConst str_const, Cmpop op |
+      op = any(Eq eq) and safe_branch = true
+      or
+      op = any(NotEq ne) and safe_branch = false
+    |
+      this.operands(str_const.getAFlowNode(), op, checked_node)
+      or
+      this.operands(checked_node, op, str_const.getAFlowNode())
+    )
+    or
+    exists(ControlFlowNode str_const_iterable, Cmpop op |
+      op = any(In in_) and safe_branch = true
+      or
+      op = any(NotIn ni) and safe_branch = false
+    |
+      this.operands(checked_node, op, str_const_iterable) and
+      (
+        str_const_iterable instanceof SequenceNode
+        or
+        str_const_iterable instanceof SetNode
+      ) and
+      forall(ControlFlowNode elem |
+        elem = str_const_iterable.(SequenceNode).getAnElement()
+        or
+        elem = str_const_iterable.(SetNode).getAnElement()
+      |
+        elem.getNode() instanceof StrConst
+      )
+    )
+  }
+
+  override predicate checks(ControlFlowNode node, boolean branch) {
+    node = checked_node and branch = safe_branch
+  }
+}
diff --git a/python/ql/src/semmle/python/dataflow/new/internal/DataFlowPublic.qll b/python/ql/src/semmle/python/dataflow/new/internal/DataFlowPublic.qll
@@ -355,51 +355,6 @@ class BarrierGuard extends GuardNode {
   }
 }
 
-/** Provides commonly used BarrierGuards */
-module BarrierGuard {
-  /** A validation of unknown node by comparing with a constant string value. */
-  class StringConstCompare extends BarrierGuard, CompareNode {
-    ControlFlowNode checked_node;
-    boolean safe_branch;
-
-    StringConstCompare() {
-      exists(StrConst str_const, Cmpop op |
-        op = any(Eq eq) and safe_branch = true
-        or
-        op = any(NotEq ne) and safe_branch = false
-      |
-        this.operands(str_const.getAFlowNode(), op, checked_node)
-        or
-        this.operands(checked_node, op, str_const.getAFlowNode())
-      )
-      or
-      exists(ControlFlowNode str_const_iterable, Cmpop op |
-        op = any(In in_) and safe_branch = true
-        or
-        op = any(NotIn ni) and safe_branch = false
-      |
-        this.operands(checked_node, op, str_const_iterable) and
-        (
-          str_const_iterable instanceof SequenceNode
-          or
-          str_const_iterable instanceof SetNode
-        ) and
-        forall(ControlFlowNode elem |
-          elem = str_const_iterable.(SequenceNode).getAnElement()
-          or
-          elem = str_const_iterable.(SetNode).getAnElement()
-        |
-          elem.getNode() instanceof StrConst
-        )
-      )
-    }
-
-    override predicate checks(ControlFlowNode node, boolean branch) {
-      node = checked_node and branch = safe_branch
-    }
-  }
-}
-
 /**
  * Algebraic datatype for tracking data content associated with values.
  * Content can be collection elements or object attributes.
diff --git a/python/ql/src/semmle/python/security/dataflow/CodeInjection.qll b/python/ql/src/semmle/python/security/dataflow/CodeInjection.qll
@@ -8,6 +8,7 @@ import semmle.python.dataflow.new.DataFlow
 import semmle.python.dataflow.new.TaintTracking
 import semmle.python.Concepts
 import semmle.python.dataflow.new.RemoteFlowSources
+import semmle.python.dataflow.new.BarrierGuards
 
 /**
  * A taint-tracking configuration for detecting code injection vulnerabilities.
@@ -20,6 +21,6 @@ class CodeInjectionConfiguration extends TaintTracking::Configuration {
   override predicate isSink(DataFlow::Node sink) { sink = any(CodeExecution e).getCode() }
 
   override predicate isSanitizerGuard(DataFlow::BarrierGuard guard) {
-    guard instanceof DataFlow::BarrierGuard::StringConstCompare
+    guard instanceof StringConstCompare
   }
 }
diff --git a/python/ql/src/semmle/python/security/dataflow/CommandInjection.qll b/python/ql/src/semmle/python/security/dataflow/CommandInjection.qll
@@ -8,6 +8,7 @@ import semmle.python.dataflow.new.DataFlow
 import semmle.python.dataflow.new.TaintTracking
 import semmle.python.Concepts
 import semmle.python.dataflow.new.RemoteFlowSources
+import semmle.python.dataflow.new.BarrierGuards
 
 /**
  * A taint-tracking configuration for detecting command injection vulnerabilities.
@@ -50,6 +51,6 @@ class CommandInjectionConfiguration extends TaintTracking::Configuration {
   }
 
   override predicate isSanitizerGuard(DataFlow::BarrierGuard guard) {
-    guard instanceof DataFlow::BarrierGuard::StringConstCompare
+    guard instanceof StringConstCompare
   }
 }
diff --git a/python/ql/src/semmle/python/security/dataflow/PathInjection.qll b/python/ql/src/semmle/python/security/dataflow/PathInjection.qll
@@ -31,6 +31,7 @@ import semmle.python.dataflow.new.TaintTracking2
 import semmle.python.Concepts
 import semmle.python.dataflow.new.RemoteFlowSources
 import ChainedConfigs12
+import semmle.python.dataflow.new.BarrierGuards
 
 // ---------------------------------------------------------------------------
 // Case 1. The path is never normalized.
@@ -48,7 +49,7 @@ class PathNotNormalizedConfiguration extends TaintTracking::Configuration {
   override predicate isSanitizer(DataFlow::Node node) { node instanceof Path::PathNormalization }
 
   override predicate isSanitizerGuard(DataFlow::BarrierGuard guard) {
-    guard instanceof DataFlow::BarrierGuard::StringConstCompare
+    guard instanceof StringConstCompare
   }
 }
 
@@ -74,7 +75,7 @@ class FirstNormalizationConfiguration extends TaintTracking::Configuration {
   override predicate isSanitizerOut(DataFlow::Node node) { node instanceof Path::PathNormalization }
 
   override predicate isSanitizerGuard(DataFlow::BarrierGuard guard) {
-    guard instanceof DataFlow::BarrierGuard::StringConstCompare
+    guard instanceof StringConstCompare
   }
 }
 
@@ -91,7 +92,7 @@ class NormalizedPathNotCheckedConfiguration extends TaintTracking2::Configuratio
   override predicate isSanitizerGuard(DataFlow::BarrierGuard guard) {
     guard instanceof Path::SafeAccessCheck
     or
-    guard instanceof DataFlow::BarrierGuard::StringConstCompare
+    guard instanceof StringConstCompare
   }
 }
 
diff --git a/python/ql/src/semmle/python/security/dataflow/ReflectedXSS.qll b/python/ql/src/semmle/python/security/dataflow/ReflectedXSS.qll
@@ -8,6 +8,7 @@ import semmle.python.dataflow.new.DataFlow
 import semmle.python.dataflow.new.TaintTracking
 import semmle.python.Concepts
 import semmle.python.dataflow.new.RemoteFlowSources
+import semmle.python.dataflow.new.BarrierGuards
 
 /**
  * A taint-tracking configuration for detecting reflected server-side cross-site
@@ -26,6 +27,6 @@ class ReflectedXssConfiguration extends TaintTracking::Configuration {
   }
 
   override predicate isSanitizerGuard(DataFlow::BarrierGuard guard) {
-    guard instanceof DataFlow::BarrierGuard::StringConstCompare
+    guard instanceof StringConstCompare
   }
 }
diff --git a/python/ql/src/semmle/python/security/dataflow/SqlInjection.qll b/python/ql/src/semmle/python/security/dataflow/SqlInjection.qll
@@ -8,6 +8,7 @@ import semmle.python.dataflow.new.DataFlow
 import semmle.python.dataflow.new.TaintTracking
 import semmle.python.Concepts
 import semmle.python.dataflow.new.RemoteFlowSources
+import semmle.python.dataflow.new.BarrierGuards
 
 /**
  * A taint-tracking configuration for detecting SQL injection vulnerabilities.
@@ -20,6 +21,6 @@ class SQLInjectionConfiguration extends TaintTracking::Configuration {
   override predicate isSink(DataFlow::Node sink) { sink = any(SqlExecution e).getSql() }
 
   override predicate isSanitizerGuard(DataFlow::BarrierGuard guard) {
-    guard instanceof DataFlow::BarrierGuard::StringConstCompare
+    guard instanceof StringConstCompare
   }
 }
diff --git a/python/ql/src/semmle/python/security/dataflow/UnsafeDeserialization.qll b/python/ql/src/semmle/python/security/dataflow/UnsafeDeserialization.qll
@@ -8,6 +8,7 @@ import semmle.python.dataflow.new.DataFlow
 import semmle.python.dataflow.new.TaintTracking
 import semmle.python.Concepts
 import semmle.python.dataflow.new.RemoteFlowSources
+import semmle.python.dataflow.new.BarrierGuards
 
 /**
  * A taint-tracking configuration for detecting arbitrary code execution
@@ -26,6 +27,6 @@ class UnsafeDeserializationConfiguration extends TaintTracking::Configuration {
   }
 
   override predicate isSanitizerGuard(DataFlow::BarrierGuard guard) {
-    guard instanceof DataFlow::BarrierGuard::StringConstCompare
+    guard instanceof StringConstCompare
   }
 }
diff --git a/python/ql/test/experimental/dataflow/tainttracking/commonSanitizer/TestTaint.ql b/python/ql/test/experimental/dataflow/tainttracking/commonSanitizer/TestTaint.ql
@@ -1,7 +1,8 @@
 import experimental.dataflow.tainttracking.TestTaintLib
+import semmle.python.dataflow.new.BarrierGuards
 
 class CustomSanitizerOverrides extends TestTaintTrackingConfiguration {
   override predicate isSanitizerGuard(DataFlow::BarrierGuard guard) {
-    guard instanceof DataFlow::BarrierGuard::StringConstCompare
+    guard instanceof StringConstCompare
   }
 }

Original file line number	Diff line number	Diff line change
`@@ -8,6 +8,7 @@ import semmle.python.dataflow.new.DataFlow`
`8`	`8`	`import semmle.python.dataflow.new.TaintTracking`
`9`	`9`	`import semmle.python.Concepts`
`10`	`10`	`import semmle.python.dataflow.new.RemoteFlowSources`
	`11`	`+import semmle.python.dataflow.new.BarrierGuards`
`11`	`12`
`12`	`13`	`/**`
`13`	`14`	`* A taint-tracking configuration for detecting code injection vulnerabilities.`
`@@ -20,6 +21,6 @@ class CodeInjectionConfiguration extends TaintTracking::Configuration {`
`20`	`21`	`override predicate isSink(DataFlow::Node sink) { sink = any(CodeExecution e).getCode() }`
`21`	`22`
`22`	`23`	`override predicate isSanitizerGuard(DataFlow::BarrierGuard guard) {`
`23`		`- guard instanceof DataFlow::BarrierGuard::StringConstCompare`
	`24`	`+ guard instanceof StringConstCompare`
`24`	`25`	`}`
`25`	`26`	`}`
Original file line number	Diff line number	Diff line change
`@@ -31,6 +31,7 @@ import semmle.python.dataflow.new.TaintTracking2`
`31`	`31`	`import semmle.python.Concepts`
`32`	`32`	`import semmle.python.dataflow.new.RemoteFlowSources`
`33`	`33`	`import ChainedConfigs12`
	`34`	`+import semmle.python.dataflow.new.BarrierGuards`
`34`	`35`
`35`	`36`	`// ---------------------------------------------------------------------------`
`36`	`37`	`// Case 1. The path is never normalized.`
`@@ -48,7 +49,7 @@ class PathNotNormalizedConfiguration extends TaintTracking::Configuration {`
`48`	`49`	`override predicate isSanitizer(DataFlow::Node node) { node instanceof Path::PathNormalization }`
`49`	`50`
`50`	`51`	`override predicate isSanitizerGuard(DataFlow::BarrierGuard guard) {`
`51`		`- guard instanceof DataFlow::BarrierGuard::StringConstCompare`
	`52`	`+ guard instanceof StringConstCompare`
`52`	`53`	`}`
`53`	`54`	`}`
`54`	`55`
`@@ -74,7 +75,7 @@ class FirstNormalizationConfiguration extends TaintTracking::Configuration {`
`74`	`75`	`override predicate isSanitizerOut(DataFlow::Node node) { node instanceof Path::PathNormalization }`
`75`	`76`
`76`	`77`	`override predicate isSanitizerGuard(DataFlow::BarrierGuard guard) {`
`77`		`- guard instanceof DataFlow::BarrierGuard::StringConstCompare`
	`78`	`+ guard instanceof StringConstCompare`
`78`	`79`	`}`
`79`	`80`	`}`
`80`	`81`
`@@ -91,7 +92,7 @@ class NormalizedPathNotCheckedConfiguration extends TaintTracking2::Configuratio`
`91`	`92`	`override predicate isSanitizerGuard(DataFlow::BarrierGuard guard) {`
`92`	`93`	`guard instanceof Path::SafeAccessCheck`
`93`	`94`	`or`
`94`		`- guard instanceof DataFlow::BarrierGuard::StringConstCompare`
	`95`	`+ guard instanceof StringConstCompare`
`95`	`96`	`}`
`96`	`97`	`}`
`97`	`98`
Original file line number	Diff line number	Diff line change
`@@ -1,7 +1,8 @@`
`1`	`1`	`import experimental.dataflow.tainttracking.TestTaintLib`
	`2`	`+import semmle.python.dataflow.new.BarrierGuards`
`2`	`3`
`3`	`4`	`class CustomSanitizerOverrides extends TestTaintTrackingConfiguration {`
`4`	`5`	`override predicate isSanitizerGuard(DataFlow::BarrierGuard guard) {`
`5`		`- guard instanceof DataFlow::BarrierGuard::StringConstCompare`
	`6`	`+ guard instanceof StringConstCompare`
`6`	`7`	`}`
`7`	`8`	`}`