Skip to content

Commit be87eb5

Browse files
joefarebrotherjoefarebrother
committed
Add cookie models to each framework
1 parent a73d675 commit be87eb5

7 files changed

Lines changed: 225 additions & 2 deletions

File tree

‎python/ql/lib/semmle/python/frameworks/Aiohttp.qll‎

Lines changed: 45 additions & 0 deletions
Original file line numberDiff line numberDiff line change
@@ -664,6 +664,51 @@ module AiohttpWebModel {
664664
override DataFlow::Node getNameArg() { result in [this.getArg(0), this.getArgByName("name")] }
665665

666666
override DataFlow::Node getValueArg() { result in [this.getArg(1), this.getArgByName("value")] }
667+
668+
override predicate hasSecureFlag(boolean b) {
669+
super.hasSecureFlag(b)
670+
or
671+
exists(DataFlow::Node arg, BooleanLiteral bool | arg = this.getArgByName("secure") |
672+
DataFlow::localFlow(DataFlow::exprNode(bool), arg) and
673+
b = bool.booleanValue()
674+
)
675+
or
676+
not exists(this.getArgByName("secure")) and
677+
b = false
678+
}
679+
680+
override predicate hasHttpOnlyFlag(boolean b) {
681+
super.hasHttpOnlyFlag(b)
682+
or
683+
exists(DataFlow::Node arg, BooleanLiteral bool | arg = this.getArgByName("httponly") |
684+
DataFlow::localFlow(DataFlow::exprNode(bool), arg) and
685+
b = bool.booleanValue()
686+
)
687+
or
688+
not exists(this.getArgByName("httponly")) and
689+
b = false
690+
}
691+
692+
override predicate hasSameSiteAttribute(Http::Server::CookieWrite::SameSiteValue v) {
693+
super.hasSameSiteAttribute(v)
694+
or
695+
exists(DataFlow::Node arg, StringLiteral str | arg = this.getArgByName("samesite") |
696+
DataFlow::localFlow(DataFlow::exprNode(str), arg) and
697+
(
698+
str.getText().toLowerCase() = "strict" and
699+
v instanceof Http::Server::CookieWrite::SameSiteStrict
700+
or
701+
str.getText().toLowerCase() = "lax" and
702+
v instanceof Http::Server::CookieWrite::SameSiteLax
703+
or
704+
str.getText().toLowerCase() = "none" and
705+
v instanceof Http::Server::CookieWrite::SameSiteNone
706+
)
707+
)
708+
or
709+
not exists(this.getArgByName("samesite")) and
710+
v instanceof Http::Server::CookieWrite::SameSiteLax // Lax is the default
711+
}
667712
}
668713

669714
/**

‎python/ql/lib/semmle/python/frameworks/Django.qll‎

Lines changed: 1 addition & 1 deletion
Original file line numberDiff line numberDiff line change
@@ -2220,7 +2220,7 @@ module PrivateDjango {
22202220
str.getText().toLowerCase() = "strict" and
22212221
v instanceof Http::Server::CookieWrite::SameSiteStrict
22222222
or
2223-
str.getText().toLowerCase() = "strict" and
2223+
str.getText().toLowerCase() = "lax" and
22242224
v instanceof Http::Server::CookieWrite::SameSiteLax
22252225
or
22262226
str.getText().toLowerCase() = "none" and

‎python/ql/lib/semmle/python/frameworks/FastApi.qll‎

Lines changed: 45 additions & 0 deletions
Original file line numberDiff line numberDiff line change
@@ -358,6 +358,51 @@ module FastApi {
358358
override DataFlow::Node getValueArg() {
359359
result in [this.getArg(1), this.getArgByName("value")]
360360
}
361+
362+
override predicate hasSecureFlag(boolean b) {
363+
super.hasSecureFlag(b)
364+
or
365+
exists(DataFlow::Node arg, BooleanLiteral bool | arg = this.getArgByName("secure") |
366+
DataFlow::localFlow(DataFlow::exprNode(bool), arg) and
367+
b = bool.booleanValue()
368+
)
369+
or
370+
not exists(this.getArgByName("secure")) and
371+
b = false
372+
}
373+
374+
override predicate hasHttpOnlyFlag(boolean b) {
375+
super.hasHttpOnlyFlag(b)
376+
or
377+
exists(DataFlow::Node arg, BooleanLiteral bool | arg = this.getArgByName("httponly") |
378+
DataFlow::localFlow(DataFlow::exprNode(bool), arg) and
379+
b = bool.booleanValue()
380+
)
381+
or
382+
not exists(this.getArgByName("httponly")) and
383+
b = false
384+
}
385+
386+
override predicate hasSameSiteAttribute(Http::Server::CookieWrite::SameSiteValue v) {
387+
super.hasSameSiteAttribute(v)
388+
or
389+
exists(DataFlow::Node arg, StringLiteral str | arg = this.getArgByName("samesite") |
390+
DataFlow::localFlow(DataFlow::exprNode(str), arg) and
391+
(
392+
str.getText().toLowerCase() = "strict" and
393+
v instanceof Http::Server::CookieWrite::SameSiteStrict
394+
or
395+
str.getText().toLowerCase() = "lax" and
396+
v instanceof Http::Server::CookieWrite::SameSiteLax
397+
or
398+
str.getText().toLowerCase() = "none" and
399+
v instanceof Http::Server::CookieWrite::SameSiteNone
400+
)
401+
)
402+
or
403+
not exists(this.getArgByName("samesite")) and
404+
v instanceof Http::Server::CookieWrite::SameSiteLax // Lax is the default
405+
}
361406
}
362407

363408
/**

‎python/ql/lib/semmle/python/frameworks/Flask.qll‎

Lines changed: 1 addition & 1 deletion
Original file line numberDiff line numberDiff line change
@@ -627,7 +627,7 @@ module Flask {
627627
str.getText().toLowerCase() = "strict" and
628628
v instanceof Http::Server::CookieWrite::SameSiteStrict
629629
or
630-
str.getText().toLowerCase() = "strict" and
630+
str.getText().toLowerCase() = "lax" and
631631
v instanceof Http::Server::CookieWrite::SameSiteLax
632632
or
633633
str.getText().toLowerCase() = "none" and

‎python/ql/lib/semmle/python/frameworks/Pyramid.qll‎

Lines changed: 45 additions & 0 deletions
Original file line numberDiff line numberDiff line change
@@ -265,6 +265,51 @@ module Pyramid {
265265
override DataFlow::Node getValueArg() {
266266
result = [this.getArg(1), this.getArgByName("value")]
267267
}
268+
269+
override predicate hasSecureFlag(boolean b) {
270+
super.hasSecureFlag(b)
271+
or
272+
exists(DataFlow::Node arg, BooleanLiteral bool | arg = this.getArgByName("secure") |
273+
DataFlow::localFlow(DataFlow::exprNode(bool), arg) and
274+
b = bool.booleanValue()
275+
)
276+
or
277+
not exists(this.getArgByName("secure")) and
278+
b = false
279+
}
280+
281+
override predicate hasHttpOnlyFlag(boolean b) {
282+
super.hasHttpOnlyFlag(b)
283+
or
284+
exists(DataFlow::Node arg, BooleanLiteral bool | arg = this.getArgByName("httponly") |
285+
DataFlow::localFlow(DataFlow::exprNode(bool), arg) and
286+
b = bool.booleanValue()
287+
)
288+
or
289+
not exists(this.getArgByName("httponly")) and
290+
b = false
291+
}
292+
293+
override predicate hasSameSiteAttribute(Http::Server::CookieWrite::SameSiteValue v) {
294+
super.hasSameSiteAttribute(v)
295+
or
296+
exists(DataFlow::Node arg, StringLiteral str | arg = this.getArgByName("samesite") |
297+
DataFlow::localFlow(DataFlow::exprNode(str), arg) and
298+
(
299+
str.getText().toLowerCase() = "strict" and
300+
v instanceof Http::Server::CookieWrite::SameSiteStrict
301+
or
302+
str.getText().toLowerCase() = "lax" and
303+
v instanceof Http::Server::CookieWrite::SameSiteLax
304+
or
305+
str.getText().toLowerCase() = "none" and
306+
v instanceof Http::Server::CookieWrite::SameSiteNone
307+
)
308+
)
309+
or
310+
not exists(this.getArgByName("samesite")) and
311+
v instanceof Http::Server::CookieWrite::SameSiteLax // Lax is the default
312+
}
268313
}
269314
}
270315

‎python/ql/lib/semmle/python/frameworks/Tornado.qll‎

Lines changed: 45 additions & 0 deletions
Original file line numberDiff line numberDiff line change
@@ -604,5 +604,50 @@ module Tornado {
604604
override DataFlow::Node getNameArg() { result in [this.getArg(0), this.getArgByName("name")] }
605605

606606
override DataFlow::Node getValueArg() { result in [this.getArg(1), this.getArgByName("value")] }
607+
608+
override predicate hasSecureFlag(boolean b) {
609+
super.hasSecureFlag(b)
610+
or
611+
exists(DataFlow::Node arg, BooleanLiteral bool | arg = this.getArgByName("secure") |
612+
DataFlow::localFlow(DataFlow::exprNode(bool), arg) and
613+
b = bool.booleanValue()
614+
)
615+
or
616+
not exists(this.getArgByName("secure")) and
617+
b = false
618+
}
619+
620+
override predicate hasHttpOnlyFlag(boolean b) {
621+
super.hasHttpOnlyFlag(b)
622+
or
623+
exists(DataFlow::Node arg, BooleanLiteral bool | arg = this.getArgByName("httponly") |
624+
DataFlow::localFlow(DataFlow::exprNode(bool), arg) and
625+
b = bool.booleanValue()
626+
)
627+
or
628+
not exists(this.getArgByName("httponly")) and
629+
b = false
630+
}
631+
632+
override predicate hasSameSiteAttribute(Http::Server::CookieWrite::SameSiteValue v) {
633+
super.hasSameSiteAttribute(v)
634+
or
635+
exists(DataFlow::Node arg, StringLiteral str | arg = this.getArgByName("samesite") |
636+
DataFlow::localFlow(DataFlow::exprNode(str), arg) and
637+
(
638+
str.getText().toLowerCase() = "strict" and
639+
v instanceof Http::Server::CookieWrite::SameSiteStrict
640+
or
641+
str.getText().toLowerCase() = "lax" and
642+
v instanceof Http::Server::CookieWrite::SameSiteLax
643+
or
644+
str.getText().toLowerCase() = "none" and
645+
v instanceof Http::Server::CookieWrite::SameSiteNone
646+
)
647+
)
648+
or
649+
not exists(this.getArgByName("samesite")) and
650+
v instanceof Http::Server::CookieWrite::SameSiteLax // Lax is the default
651+
}
607652
}
608653
}

‎python/ql/lib/semmle/python/frameworks/Twisted.qll‎

Lines changed: 43 additions & 0 deletions
Original file line numberDiff line numberDiff line change
@@ -245,6 +245,49 @@ private module Twisted {
245245
override DataFlow::Node getNameArg() { result in [this.getArg(0), this.getArgByName("k")] }
246246

247247
override DataFlow::Node getValueArg() { result in [this.getArg(1), this.getArgByName("v")] }
248+
249+
override predicate hasSecureFlag(boolean b) {
250+
super.hasSecureFlag(b)
251+
or
252+
exists(DataFlow::Node arg, BooleanLiteral bool | arg = this.getArgByName("secure") |
253+
DataFlow::localFlow(DataFlow::exprNode(bool), arg) and
254+
b = bool.booleanValue()
255+
)
256+
or
257+
not exists(this.getArgByName("secure")) and
258+
b = false
259+
}
260+
261+
override predicate hasHttpOnlyFlag(boolean b) {
262+
super.hasHttpOnlyFlag(b)
263+
or
264+
exists(DataFlow::Node arg, BooleanLiteral bool | arg = this.getArgByName("httponly") |
265+
DataFlow::localFlow(DataFlow::exprNode(bool), arg) and
266+
b = bool.booleanValue()
267+
)
268+
or
269+
not exists(this.getArgByName("httponly")) and
270+
b = false
271+
}
272+
273+
override predicate hasSameSiteAttribute(Http::Server::CookieWrite::SameSiteValue v) {
274+
super.hasSameSiteAttribute(v)
275+
or
276+
exists(DataFlow::Node arg, StringLiteral str | arg = this.getArgByName("samesite") |
277+
DataFlow::localFlow(DataFlow::exprNode(str), arg) and
278+
(
279+
str.getText().toLowerCase() = "strict" and
280+
v instanceof Http::Server::CookieWrite::SameSiteStrict
281+
or
282+
str.getText().toLowerCase() = "lax" and
283+
v instanceof Http::Server::CookieWrite::SameSiteLax
284+
// sting "none" is not accepted
285+
)
286+
)
287+
or
288+
not exists(this.getArgByName("samesite")) and
289+
v instanceof Http::Server::CookieWrite::SameSiteLax // Lax is the default
290+
}
248291
}
249292

250293
/**

0 commit comments

Comments
 (0)