Python: Add taint-sinks meta query #11480
Conversation
| DataFlow::Node relevantTaintSink(string kind) { | ||
| not result.getLocation().getFile() instanceof IgnoredFile and | ||
| ( | ||
| kind = "CleartextLogging" and result instanceof CleartextLogging::Sink |
There was a problem hiding this comment.
FYI: in JS I deliberately omitted logging-related sinks in this query, because it ends up dominating the number of sinks.
There was a problem hiding this comment.
I see two use-cases for this query:
- manually running it on a DB to see what interesting sinks have been found
- checking differences in sinks found from changes in a PR
For (1) it sounds very reasonable to exclude things that are not super interesting, like the cleartext-logging stuff, but for (2), which is the aim of this work, I would like to keep them.
Do you agree?
There was a problem hiding this comment.
Yes, sounds very reasonable.
| or | ||
| kind = "Xxe" and result instanceof Xxe::Sink |
There was a problem hiding this comment.
I wonder if there is a way of writing this that is easier to maintain. Something like
kind.(TaintTracking::Configuration).isSink(result)(horribly abusing that Configurations are still strings).
There was a problem hiding this comment.
I guess we could write it this way, but I personally prefer the current approach -- especially since it will also work once configurations are no longer strings.
No description provided.