Commit e1801f3
File tree
- python/ql
- lib/semmle/python/frameworks
- test/library-tests/frameworks/stdlib
| Original file line number | Diff line number | Diff line change | |
|---|---|---|---|
@@ -12,5 +12,13 @@ extensions: | |||
| 12 | 12 | - ['sys', 'Member[argv]', 'commandargs'] | |
| 13 | 13 | - ['sys', 'Member[orig_argv]', 'commandargs'] | |
| 14 | 14 | ||
| 15 | - # TODO: argparse | ||
| 15 | + # if no argument is given, the default is to use sys.argv[1:] | ||
| 16 | + - ['argparse.ArgumentParser', 'Member[parse_args,parse_known_args].WithArity[0].ReturnValue', 'commandargs'] | ||
| 17 | + - addsTo: | ||
| 18 | + pack: codeql/python-all | ||
| 19 | + extensible: summaryModel | ||
| 20 | + data: | ||
| 21 | + - ['argparse.ArgumentParser', 'Member[parse_args,parse_known_args]', 'Argument[0,args:]', 'ReturnValue', 'taint'] | ||
| 22 | + # note: taint of attribute lookups is handled in QL | ||
| 23 | + | ||
| 16 | 24 | # TODO: input / read from stdin | |
| Original file line number | Diff line number | Diff line change | |
|---|---|---|---|
@@ -4989,6 +4989,26 @@ module StdlibPrivate { | |||
| 4989 | 4989 | ||
| 4990 | 4990 | override string getKind() { result = Escaping::getHtmlKind() } | |
| 4991 | 4991 | } | |
| 4992 | + | ||
| 4993 | + // --------------------------------------------------------------------------- | ||
| 4994 | + // argparse | ||
| 4995 | + // --------------------------------------------------------------------------- | ||
| 4996 | + /** | ||
| 4997 | + * if result of `parse_args` is tainted (because it uses command-line arguments), | ||
| 4998 | + * then the parsed values accesssed on any attribute lookup is also tainted. | ||
| 4999 | + */ | ||
| 5000 | + private class ArgumentParserAnyAttributeStep extends TaintTracking::AdditionalTaintStep { | ||
| 5001 | + override predicate step(DataFlow::Node nodeFrom, DataFlow::Node nodeTo) { | ||
| 5002 | + nodeFrom = | ||
| 5003 | + API::moduleImport("argparse") | ||
| 5004 | + .getMember("ArgumentParser") | ||
| 5005 | + .getReturn() | ||
| 5006 | + .getMember("parse_args") | ||
| 5007 | + .getReturn() | ||
| 5008 | + .getAValueReachableFromSource() and | ||
| 5009 | + nodeTo.(DataFlow::AttrRead).getObject() = nodeFrom | ||
| 5010 | + } | ||
| 5011 | + } | ||
| 4992 | 5012 | } | |
| 4993 | 5013 | ||
| 4994 | 5014 | // --------------------------------------------------------------------------- | |
Lines changed: 4 additions & 4 deletions
| Original file line number | Diff line number | Diff line change | |
|---|---|---|---|
@@ -30,14 +30,14 @@ | |||
| 30 | 30 | parser = argparse.ArgumentParser() | |
| 31 | 31 | parser.add_argument("foo") | |
| 32 | 32 | ||
| 33 | - args = parser.parse_args() # $ MISSING: threatModelSource[commandargs]=parser.parse_args() | ||
| 34 | - ensure_tainted(args.foo) # $ MISSING: tainted | ||
| 33 | + args = parser.parse_args() # $ threatModelSource[commandargs]=parser.parse_args() | ||
| 34 | + ensure_tainted(args.foo) # $ tainted | ||
| 35 | 35 | ||
| 36 | 36 | explicit_argv_parsing = parser.parse_args(sys.argv) # $ threatModelSource[commandargs]=sys.argv | |
| 37 | - ensure_tainted(explicit_argv_parsing.foo) # $ MISSING: tainted | ||
| 37 | + ensure_tainted(explicit_argv_parsing.foo) # $ tainted | ||
| 38 | 38 | ||
| 39 | 39 | fake_args = parser.parse_args(["<foo>"]) | |
| 40 | - ensure_not_tainted(fake_args.foo) | ||
| 40 | + ensure_not_tainted(fake_args.foo) # $ SPURIOUS: tainted | ||
| 41 | 41 | ||
| 42 | 42 | ######################################## | |
| 43 | 43 | # reading input from stdin | |
0 commit comments