Python: XML RPC Dotted Names

[dilanbhalla]

This query warns against enabling the allow_dotted_names option when registering an instance of SimpleXMLRPCServer, as this allows intruders to access your module’s global variables and may execute arbitrary code on your machine. This should only be used within a secure, closed network.

[yoff]

This seems to not have been touched in a long time. By the referenced documentation, this might still be relevant, though. I guess this query is mostly to guard against user who did not read the very explicit warning in the documentation, but I can see how that can easily happen when copying examples or working with existing code, so this is probably a fine query at least for experimental. If we want it, it should be updated to modern standards; I made a suggestion to that effect.

[yoff]

A modern way to write this would be

Suggested change

	import python
	from CallNode call, ControlFlowNode allow_dotted_names, Attribute a
	where
	a.getLocation().getStartLine() = call.getLocation().getStartLine() and
	a.getName() = "register_instance" and
	not call.getLocation().getFile().inStdlib() and
	(
	allow_dotted_names = call.getArgByName("allow_dotted_names") or
	allow_dotted_names = call.getArg(1)
	) and
	allow_dotted_names.getNode().toString() = "True"
	select a,
	"Enabling the allow_dotted_names option allows intruders to access your module’s global variables and may allow intruders to execute arbitrary code on your machine."
	import python
	import semmle.python.ApiGraphs
	from API::CallNode call, DataFlow::Node allow_dotted_names
	where
	call =
	API::moduleImport("xmlrpc")
	.getMember("server")
	.getMember("SimpleXMLRPCServer")
	.getReturn()
	.getMember("register_instance")
	.getACall() and
	allow_dotted_names = call.getParameter(1, "allow_dotted_names").getAValueReachingSink() and
	allow_dotted_names.asExpr() instanceof True
	select allow_dotted_names,
	"Enabling the allow_dotted_names option allows intruders to access your module’s global variables and may allow intruders to execute arbitrary code on your machine."