Commit 25a7fcf
Lines changed: 8 additions & 1 deletion
| Original file line number | Diff line number | Diff line change | |
|---|---|---|---|
@@ -55,7 +55,7 @@ class AllTarfileOpens extends API::CallNode { | |||
| 55 | 55 | class Configuration extends TaintTracking::Configuration { | |
| 56 | 56 | Configuration() { this = "TarSlip" } | |
| 57 | 57 | ||
| 58 | - override predicate isSource(DataFlow::Node source) { source instanceof AllTarfileOpens } | ||
| 58 | + override predicate isSource(DataFlow::Node source) { source = tarfileOpen().getACall() } | ||
| 59 | 59 | ||
| 60 | 60 | override predicate isSink(DataFlow::Node sink) { | |
| 61 | 61 | // A sink capturing method calls to `extractall` without `members` argument. | |
@@ -99,6 +99,13 @@ class Configuration extends TaintTracking::Configuration { | |||
| 99 | 99 | nodeFrom = call.getObject() and | |
| 100 | 100 | nodeTo = call | |
| 101 | 101 | ) | |
| 102 | + or | ||
| 103 | + exists(DataFlow::CallCfgNode closing | | ||
| 104 | + closing = API::moduleImport("contextlib").getMember("closing").getACall() and | ||
| 105 | + nodeFrom = closing.getArg(0) and | ||
| 106 | + nodeFrom = tarfileOpen().getACall() and | ||
| 107 | + nodeTo = closing | ||
| 108 | + ) | ||
| 102 | 109 | } | |
| 103 | 110 | } | |
| 104 | 111 | ||
0 commit comments