Skip to content

Commit 0125aea

Browse files
RasmusWLRasmusWL
committed
Python: Re-introduce old dataflow configs .qll files
and move all the old deprecated aliases to that file. We now have a situation where all queries should work as they did before, and we just have these new Query.qll files that contain the implementation. (deprecation comes later)
1 parent 1bf8fa6 commit 0125aea

25 files changed

Lines changed: 544 additions & 176 deletions

‎python/ql/lib/semmle/python/security/dataflow/CleartextLogging.qll‎

Lines changed: 22 additions & 0 deletions
Original file line numberDiff line numberDiff line change
@@ -0,0 +1,22 @@
1+
/**
2+
* Provides a taint-tracking configuration for "Clear-text logging of sensitive information".
3+
*
4+
* Note, for performance reasons: only import this file if
5+
* `CleartextLogging::Configuration` is needed, otherwise
6+
* `CleartextLoggingCustomizations` should be imported instead.
7+
*/
8+
9+
private import python
10+
private import semmle.python.dataflow.new.DataFlow
11+
private import semmle.python.dataflow.new.TaintTracking
12+
private import semmle.python.Concepts
13+
private import semmle.python.dataflow.new.RemoteFlowSources
14+
private import semmle.python.dataflow.new.BarrierGuards
15+
private import semmle.python.dataflow.new.SensitiveDataSources
16+
17+
/**
18+
* Provides a taint-tracking configuration for detecting "Clear-text logging of sensitive information".
19+
*/
20+
module CleartextLogging {
21+
import CleartextLoggingQuery // ignore-query-import
22+
}

‎python/ql/lib/semmle/python/security/dataflow/CleartextStorage.qll‎

Lines changed: 22 additions & 0 deletions
Original file line numberDiff line numberDiff line change
@@ -0,0 +1,22 @@
1+
/**
2+
* Provides a taint-tracking configuration for "Clear-text storage of sensitive information".
3+
*
4+
* Note, for performance reasons: only import this file if
5+
* `CleartextStorage::Configuration` is needed, otherwise
6+
* `CleartextStorageCustomizations` should be imported instead.
7+
*/
8+
9+
private import python
10+
private import semmle.python.dataflow.new.DataFlow
11+
private import semmle.python.dataflow.new.TaintTracking
12+
private import semmle.python.Concepts
13+
private import semmle.python.dataflow.new.RemoteFlowSources
14+
private import semmle.python.dataflow.new.BarrierGuards
15+
private import semmle.python.dataflow.new.SensitiveDataSources
16+
17+
/**
18+
* Provides a taint-tracking configuration for detecting "Clear-text storage of sensitive information".
19+
*/
20+
module CleartextStorage {
21+
import CleartextStorageQuery // ignore-query-import
22+
}

‎python/ql/lib/semmle/python/security/dataflow/CodeInjection.qll‎

Lines changed: 25 additions & 0 deletions
Original file line numberDiff line numberDiff line change
@@ -0,0 +1,25 @@
1+
/**
2+
* Provides a taint-tracking configuration for detecting "code injection" vulnerabilities.
3+
*
4+
* Note, for performance reasons: only import this file if
5+
* `CodeInjection::Configuration` is needed, otherwise
6+
* `CodeInjectionCustomizations` should be imported instead.
7+
*/
8+
9+
private import python
10+
import semmle.python.dataflow.new.DataFlow
11+
import semmle.python.dataflow.new.TaintTracking
12+
13+
/**
14+
* Provides a taint-tracking configuration for detecting "code injection" vulnerabilities.
15+
*/
16+
module CodeInjection {
17+
import CodeInjectionQuery // ignore-query-import
18+
}
19+
20+
/**
21+
* DEPRECATED: Don't extend this class for customization, since this will lead to bad
22+
* performance, instead use the new `CodeInjectionCustomizations.qll` file, and extend
23+
* its' classes.
24+
*/
25+
deprecated class CodeInjectionConfiguration = CodeInjection::Configuration;

‎python/ql/lib/semmle/python/security/dataflow/CodeInjectionQuery.qll‎

Lines changed: 0 additions & 7 deletions
Original file line numberDiff line numberDiff line change
@@ -28,10 +28,3 @@ import semmle.python.dataflow.new.TaintTracking
2828
guard instanceof SanitizerGuard
2929
}
3030
}
31-
32-
/**
33-
* DEPRECATED: Don't extend this class for customization, since this will lead to bad
34-
* performance, instead use the new `CodeInjectionCustomizations.qll` file, and extend
35-
* its' classes.
36-
*/
37-
deprecated class CodeInjectionConfiguration = CodeInjection::Configuration;

‎python/ql/lib/semmle/python/security/dataflow/CommandInjection.qll‎

Lines changed: 25 additions & 0 deletions
Original file line numberDiff line numberDiff line change
@@ -0,0 +1,25 @@
1+
/**
2+
* Provides a taint-tracking configuration for detecting "command injection" vulnerabilities.
3+
*
4+
* Note, for performance reasons: only import this file if
5+
* `CommandInjection::Configuration` is needed, otherwise
6+
* `CommandInjectionCustomizations` should be imported instead.
7+
*/
8+
9+
private import python
10+
import semmle.python.dataflow.new.DataFlow
11+
import semmle.python.dataflow.new.TaintTracking
12+
13+
/**
14+
* Provides a taint-tracking configuration for detecting "command injection" vulnerabilities.
15+
*/
16+
module CommandInjection {
17+
import CommandInjectionQuery // ignore-query-import
18+
}
19+
20+
/**
21+
* DEPRECATED: Don't extend this class for customization, since this will lead to bad
22+
* performance, instead use the new `CommandInjectionCustomizations.qll` file, and extend
23+
* its' classes.
24+
*/
25+
deprecated class CommandInjectionConfiguration = CommandInjection::Configuration;

‎python/ql/lib/semmle/python/security/dataflow/CommandInjectionQuery.qll‎

Lines changed: 0 additions & 7 deletions
Original file line numberDiff line numberDiff line change
@@ -28,10 +28,3 @@ import semmle.python.dataflow.new.TaintTracking
2828
guard instanceof SanitizerGuard
2929
}
3030
}
31-
32-
/**
33-
* DEPRECATED: Don't extend this class for customization, since this will lead to bad
34-
* performance, instead use the new `CommandInjectionCustomizations.qll` file, and extend
35-
* its' classes.
36-
*/
37-
deprecated class CommandInjectionConfiguration = CommandInjection::Configuration;

‎python/ql/lib/semmle/python/security/dataflow/LdapInjection.qll‎

Lines changed: 24 additions & 0 deletions
Original file line numberDiff line numberDiff line change
@@ -0,0 +1,24 @@
1+
/**
2+
* Provides taint-tracking configurations for detecting LDAP injection vulnerabilities
3+
*
4+
* Note, for performance reasons: only import this file if
5+
* `LdapInjection::Configuration` is needed, otherwise
6+
* `LdapInjectionCustomizations` should be imported instead.
7+
*/
8+
9+
import python
10+
import semmle.python.Concepts
11+
import semmle.python.dataflow.new.DataFlow
12+
import semmle.python.dataflow.new.TaintTracking
13+
import semmle.python.dataflow.new.RemoteFlowSources
14+
15+
/**
16+
* Provides aint-tracking configurations for detecting LDAP injection vulnerabilities.class
17+
*
18+
* Two configurations are provided. One is for detecting LDAP injection
19+
* via the distinguished name (DN). The other is for detecting LDAP injection
20+
* via the filter. These require different escapings.
21+
*/
22+
module LdapInjection {
23+
import LdapInjectionQuery // ignore-query-import
24+
}

‎python/ql/lib/semmle/python/security/dataflow/LogInjection.qll‎

Lines changed: 18 additions & 0 deletions
Original file line numberDiff line numberDiff line change
@@ -0,0 +1,18 @@
1+
/**
2+
* Provides a taint-tracking configuration for tracking untrusted user input used in log entries.
3+
*
4+
* Note, for performance reasons: only import this file if
5+
* `LogInjection::Configuration` is needed, otherwise
6+
* `LogInjectionCustomizations` should be imported instead.
7+
*/
8+
9+
import python
10+
import semmle.python.dataflow.new.DataFlow
11+
import semmle.python.dataflow.new.TaintTracking
12+
13+
/**
14+
* Provides a taint-tracking configuration for tracking untrusted user input used in log entries.
15+
*/
16+
module LogInjection {
17+
import LogInjectionQuery // ignore-query-import
18+
}

‎python/ql/lib/semmle/python/security/dataflow/PathInjection.qll‎

Lines changed: 140 additions & 0 deletions
Original file line numberDiff line numberDiff line change
@@ -0,0 +1,140 @@
1+
/**
2+
* Provides taint-tracking configurations for detecting "path injection" vulnerabilities.
3+
*
4+
* Note, for performance reasons: only import this file if
5+
* `PathInjection::Configuration` is needed, otherwise
6+
* `PathInjectionCustomizations` should be imported instead.
7+
*/
8+
9+
private import python
10+
private import semmle.python.Concepts
11+
import semmle.python.dataflow.new.DataFlow
12+
import semmle.python.dataflow.new.TaintTracking
13+
14+
/**
15+
* Provides a taint-tracking configuration for detecting "path injection" vulnerabilities.
16+
*/
17+
module PathInjection {
18+
import PathInjectionQuery // ignore-query-import
19+
}
20+
21+
22+
// ---------------------------------------------------------------------------
23+
// Old, deprecated code
24+
// ---------------------------------------------------------------------------
25+
private import semmle.python.dataflow.new.DataFlow2
26+
private import semmle.python.dataflow.new.TaintTracking2
27+
private import ChainedConfigs12
28+
import PathInjectionCustomizations::PathInjection
29+
30+
// ---------------------------------------------------------------------------
31+
// Case 1. The path is never normalized.
32+
// ---------------------------------------------------------------------------
33+
/**
34+
* DEPRECATED: Use `PathInjection::Configuration` instead
35+
*
36+
* Configuration to find paths from sources to sinks that contain no normalization.
37+
*/
38+
deprecated class PathNotNormalizedConfiguration extends TaintTracking::Configuration {
39+
PathNotNormalizedConfiguration() { this = "PathNotNormalizedConfiguration" }
40+
41+
override predicate isSource(DataFlow::Node source) { source instanceof Source }
42+
43+
override predicate isSink(DataFlow::Node sink) { sink instanceof Sink }
44+
45+
override predicate isSanitizer(DataFlow::Node node) {
46+
node instanceof Sanitizer
47+
or
48+
node instanceof Path::PathNormalization
49+
}
50+
51+
override predicate isSanitizerGuard(DataFlow::BarrierGuard guard) {
52+
guard instanceof SanitizerGuard
53+
}
54+
}
55+
56+
/**
57+
* DEPRECATED: Use `PathInjection::Configuration` instead
58+
*
59+
* Holds if there is a path injection from source to sink, where the (python) path is
60+
* not normalized.
61+
*/
62+
deprecated predicate pathNotNormalized(CustomPathNode source, CustomPathNode sink) {
63+
any(PathNotNormalizedConfiguration config).hasFlowPath(source.asNode1(), sink.asNode1())
64+
}
65+
66+
// ---------------------------------------------------------------------------
67+
// Case 2. The path is normalized at least once, but never checked afterwards.
68+
// ---------------------------------------------------------------------------
69+
/**
70+
* DEPRECATED: Use `PathInjection::Configuration` instead
71+
*
72+
* Configuration to find paths from sources to normalizations that contain no prior normalizations.
73+
*/
74+
deprecated class FirstNormalizationConfiguration extends TaintTracking::Configuration {
75+
FirstNormalizationConfiguration() { this = "FirstNormalizationConfiguration" }
76+
77+
override predicate isSource(DataFlow::Node source) { source instanceof Source }
78+
79+
override predicate isSink(DataFlow::Node sink) { sink instanceof Path::PathNormalization }
80+
81+
override predicate isSanitizer(DataFlow::Node node) { node instanceof Sanitizer }
82+
83+
override predicate isSanitizerOut(DataFlow::Node node) { node instanceof Path::PathNormalization }
84+
85+
override predicate isSanitizerGuard(DataFlow::BarrierGuard guard) {
86+
guard instanceof SanitizerGuard
87+
}
88+
}
89+
90+
/**
91+
* DEPRECATED: Use `PathInjection::Configuration` instead
92+
*
93+
* Configuration to find paths from normalizations to sinks that do not go through a check.
94+
*/
95+
deprecated class NormalizedPathNotCheckedConfiguration extends TaintTracking2::Configuration {
96+
NormalizedPathNotCheckedConfiguration() { this = "NormalizedPathNotCheckedConfiguration" }
97+
98+
override predicate isSource(DataFlow::Node source) { source instanceof Path::PathNormalization }
99+
100+
override predicate isSink(DataFlow::Node sink) { sink instanceof Sink }
101+
102+
override predicate isSanitizer(DataFlow::Node node) { node instanceof Sanitizer }
103+
104+
override predicate isSanitizerGuard(DataFlow::BarrierGuard guard) {
105+
guard instanceof Path::SafeAccessCheck
106+
or
107+
guard instanceof SanitizerGuard
108+
}
109+
}
110+
111+
/**
112+
* DEPRECATED: Use `PathInjection::Configuration` instead
113+
*
114+
* Holds if there is a path injection from source to sink, where the (python) path is
115+
* normalized at least once, but never checked afterwards.
116+
*/
117+
deprecated predicate pathNotCheckedAfterNormalization(CustomPathNode source, CustomPathNode sink) {
118+
exists(
119+
FirstNormalizationConfiguration config, DataFlow::PathNode mid1, DataFlow2::PathNode mid2,
120+
NormalizedPathNotCheckedConfiguration config2
121+
|
122+
config.hasFlowPath(source.asNode1(), mid1) and
123+
config2.hasFlowPath(mid2, sink.asNode2()) and
124+
mid1.getNode().asCfgNode() = mid2.getNode().asCfgNode()
125+
)
126+
}
127+
128+
// ---------------------------------------------------------------------------
129+
// Query: Either case 1 or case 2.
130+
// ---------------------------------------------------------------------------
131+
/**
132+
* DEPRECATED: Use `PathInjection::Configuration` instead
133+
*
134+
* Holds if there is a path injection from source to sink
135+
*/
136+
deprecated predicate pathInjection(CustomPathNode source, CustomPathNode sink) {
137+
pathNotNormalized(source, sink)
138+
or
139+
pathNotCheckedAfterNormalization(source, sink)
140+
}

0 commit comments

Comments
 (0)