codeql/python/ql/src/Security/CWE-611/Xxe.ql at codeql-cli/v2.19.2 · github/codeql · GitHub

23 lines (21 loc) · 710 Bytes

/**

* @name XML external entity expansion

* @description Parsing user input as an XML document with external

* entity expansion is vulnerable to XXE attacks.

* @kind path-problem

* @problem.severity error

* @security-severity 9.1

* @precision high

* @id py/xxe

* @tags security

* external/cwe/cwe-611

* external/cwe/cwe-827

import python

import semmle.python.security.dataflow.XxeQuery

import XxeFlow::PathGraph

from XxeFlow::PathNode source, XxeFlow::PathNode sink

where XxeFlow::flowPath(source, sink)

select sink.getNode(), source, sink,

"XML parsing depends on a $@ without guarding against external entity expansion.",

source.getNode(), "user-provided value"

Expand file tree