TarSlip vulnerability improvements

[Sim4n6]

Hi,

• add two new sources, as such:

tarfile.TarFile()
MKtarfile.Tarfile.open()

• add one more new source, which is the use of a context manager for auto-closing, as such:

contextlib.closing(XXXX)

• add a new sink for the method _extract_member()
• distinguish two cases for the method extractall()
• combine the use of the previous sources with the sinks.

In the folder /examples/, you would find the bad samples named as: TarSlip_xxx.py and the relatively good samples as NoHIT_TarSlip_xxx.py. Plus to that, a little bash script script.sh that is supposed to execute the good and the bad samples using the malicious tarball archive_malign.tar.

Thank you

[yoff]

Good start. It would be nice if the examples were turned into query tests.

At the moment, you are making changes in the shipped query, so we will require fairly high quality before merging. Alternatively, you copy the whole query to experimental, and it could basically be merged as is.

I have given some pointers to things to improve. Further to that would be the comments referring to relevant APIs so other developers can convince themselves that the model is reasonable.

[yoff]

The extra source added here is better handled by an additional taint step. Then paths will start at the open call rather than at the closing call, and, if the two a separated in the code, we would find the data flow to connect them.

[Sim4n6]

Good start. It would be nice if the examples were turned into query tests.

I did not get this one "query tests", please.

At the moment, you are making changes in the shipped query, so we will require fairly high quality before merging. Alternatively, you copy the whole query to experimental, and it could basically be merged as is.

I have given some pointers to things to improve. Further to that would be the comments referring to relevant APIs so other developers can convince themselves that the model is reasonable.

Ok, I will close this PR, take into consideration the previously suggested changes and make a new PR with a separate query within this folder as /CWE-022bis/.

[yoff]

That is fine, but it would also be fine to do it in this PR..