Commit 1f90dca
Lines changed: 19 additions & 10 deletions
| Original file line number | Diff line number | Diff line change | |
|---|---|---|---|
@@ -24,24 +24,33 @@ DataFlow::CallCfgNode outgoingRequestCall(string verb) { | |||
| 24 | 24 | result = API::moduleImport("requests").getMember(verb).getACall() | |
| 25 | 25 | } | |
| 26 | 26 | ||
| 27 | - /** Gets a reference to a falsey value (excluding None), with origin `origin`. */ | ||
| 28 | - private DataFlow::TypeTrackingNode falseyNotNone(DataFlow::TypeTracker t, DataFlow::Node origin) { | ||
| 27 | + /** Gets the "verfiy" argument to a outgoingRequestCall. */ | ||
| 28 | + DataFlow::Node verifyArg(DataFlow::CallCfgNode call) { | ||
| 29 | + call = outgoingRequestCall(_) and | ||
| 30 | + result = call.getArgByName("verify") | ||
| 31 | + } | ||
| 32 | + | ||
| 33 | + /** Gets a back-reference to the verify argument `arg`. */ | ||
| 34 | + private DataFlow::TypeTrackingNode verifyArgBacktracker( | ||
| 35 | + DataFlow::TypeBackTracker t, DataFlow::Node arg | ||
| 36 | + ) { | ||
| 29 | 37 | t.start() and | |
| 30 | - result.asExpr().(ImmutableLiteral).booleanValue() = false and | ||
| 31 | - not result.asExpr() instanceof None and | ||
| 32 | - origin = result | ||
| 38 | + arg = verifyArg(_) and | ||
| 39 | + result = arg.getALocalSource() | ||
| 33 | 40 | or | |
| 34 | - exists(DataFlow::TypeTracker t2 | result = falseyNotNone(t2, origin).track(t2, t)) | ||
| 41 | + exists(DataFlow::TypeBackTracker t2 | result = verifyArgBacktracker(t2, arg).backtrack(t2, t)) | ||
| 35 | 42 | } | |
| 36 | 43 | ||
| 37 | - /** Gets a reference to a falsey value (excluding None), with origin `origin`. */ | ||
| 38 | - DataFlow::Node falseyNotNone(DataFlow::Node origin) { | ||
| 39 | - falseyNotNone(DataFlow::TypeTracker::end(), origin).flowsTo(result) | ||
| 44 | + /** Gets a back-reference to the verify argument `arg`. */ | ||
| 45 | + DataFlow::LocalSourceNode verifyArgBacktracker(DataFlow::Node arg) { | ||
| 46 | + result = verifyArgBacktracker(DataFlow::TypeBackTracker::end(), arg) | ||
| 40 | 47 | } | |
| 41 | 48 | ||
| 42 | 49 | from DataFlow::CallCfgNode call, DataFlow::Node falseyOrigin, string verb | |
| 43 | 50 | where | |
| 44 | 51 | call = outgoingRequestCall(verb) and | |
| 52 | + falseyOrigin = verifyArgBacktracker(verifyArg(call)) and | ||
| 45 | 53 | // requests treats `None` as the default and all other "falsey" values as `False`. | |
| 46 | - call.getArgByName("verify") = falseyNotNone(falseyOrigin) | ||
| 54 | + falseyOrigin.asExpr().(ImmutableLiteral).booleanValue() = false and | ||
| 55 | + not falseyOrigin.asExpr() instanceof None | ||
| 47 | 56 | select call, "Call to requests." + verb + " with verify=$@", falseyOrigin, "False" | |
0 commit comments