Python: Start modelling the standard library using MaD #15905
Conversation
- empty models for now - `summaryModel` of `codeql/python-all` will be added to shortly.
- `quote` together with `re.compile` recover regex injection alerts on haiwen/seahub - `quote_plus` recovers the URL redirection alert on DemocracyClub/EveryElection - `unquote` recovers path injection alerts on `cloudera/hue` - it was tedious finding justifications for the rest..
yoff
force-pushed
the
python/stdlib-start-modeling-using-mad
branch
from
bf4f2cb to
e02e4e8
Compare
There is already a model there so we add to that one. We did observe that this existing model was blocked by the external MaD model. This is concerning and needs to be cleared up.
…-start-modeling-using-mad
sounds fine 👍 |
There was a problem hiding this comment.
Can you highlight why you put the models where you did? that is, why not put them under python/ql/lib/semmle/python/frameworks/?
Also, did you consider whether quote/qoute_plus should be sanitizers for any queries? (I can't think of any myself 🤔)
otherwise LGTM
python/ql/lib/ext/StdLib.model.yml
Outdated
| - ["urllib", "Member[parse].Member[splitquery]", "Argument[0,url:]", "ReturnValue.TupleElement[0]", "taint"] | ||
| - ["urllib", "Member[parse].Member[splitquery]", "Argument[0,url:]", "ReturnValue.TupleElement[1]", "taint"] |
There was a problem hiding this comment.
Would be nice if you could do "ReturnValue.TupleElement[0,1]"
There was a problem hiding this comment.
Hm, maybe we already can. I should add a test... :-)
I followed C# (which has the same structure as Java and Go) but that was just because I did not realize that we already have a natural place for it...I will move it :-)
Yes, but I did not immediately see any. We have |
|
Sorry for the ping, that's my fault 😬 |
RasmusWL
force-pushed
the
python/stdlib-start-modeling-using-mad
branch
from
8def4cc to
b14c55b
Compare
github-actions
bot
removed
C#
JS
C++
documentation
Java
Go
Ruby
QL-for-QL
Swift
Kotlin
DataFlow Library
ATM
labels
…-start-modeling-using-mad
yoff
merged commit 2357a49
into
github:yoff-python-stop-extracting-std-lib
I am thinking to add a collective change note at the end mentioning "several standard library functions" or some such. Let me know if you want incremental change notes instead..