-
Notifications
You must be signed in to change notification settings - Fork 1.6k
New issue
Have a question about this project? Sign up for a free GitHub account to open an issue and contact its maintainers and the community.
By clicking “Sign up for GitHub”, you agree to our terms of service and privacy statement. We’ll occasionally send you account related emails.
Already on GitHub? Sign in to your account
Python Taint Flow: False negative when taint originates in default value of function argument #2749
Comments
What happens if you put In general, function calls do not preserve taint, unless we can figure out (by an examination of the function) that taint is preserved all the way through. The function If you know that a function should preserve taint, you can always tell the taint analysis this explicitly by adding an |
@tausbn, is there a way for me to rebuild the database after modifying the code? I'm using a database from lgtm.com right now. Happy to follow the docs if you can give me a link. As an attempt to test your theory within the constraints of not regenerating the database, I modified the above code to make the first argument of
I tested the source and sink definitions seperately like this, and confirmed they returned the expected
and
When querying for the flow from |
For creating databases, you can use the CodeQL CLI. See here for information on how to set it up, as well as the licensing terms that apply. I just tried out a small test case, and I think you're right that we are not handling taint flow from default arguments correctly. In the short term, this may be possible to fix by defining additional taint flow steps (as I mentioned above). I'm working on a fix for the libraries themselves, but this change will likely take a few weeks before it goes live on LGTM.com. |
I'm trying to catch CVE-2019-19775 with CodeQL. The flow is from the
REQ
function called to create the default argument value, to the redirect function call:This is the code I've been using (yes I know I'm reinventing the wheel, but I wanted to make the example self contained and do some sanity checking):
I can't seem to catch the flow when running on the Zulip database from lgtm.com. As best I can tell, I think taint flow through the defaulted parameter might not be being tracked properly. If I run the above code, but swap
generate_thumbnail_url
forREQ
, it works and I am able to catch the flow fromgenerate_thumbnail_url
->redirect
The text was updated successfully, but these errors were encountered: