Python: Diff-informed queries: phase 3 (non-trivial locations) #20079
Conversation
…urce (TODO: add source with true positive)
| @@ -0,0 +1 @@ | |||
| experimental/Security/CWE-208/TimingAttackAgainstHash/TimingAttackAgainstHash.ql | |||
Check warning
Code scanning / CodeQL
Query test without inline test expectations Warning test
There was a problem hiding this comment.
- Thank you for fixing the select statements in the queries. They looked wrong before as
.getResultType()is a string and not something that has a meaningful location. - The DCA run doesn't run the changed queries (
nightly.qlsdoesn't contain the experimental queries). Consider runningsecurity-experimentalinstead. This suite containspy/possible-timing-attack-against-hashbut it doesn't containpy/timing-attack-against-hash(as this query doesn't have theexperimentaltag - which looks like a mistake though). - IMO your don't need to add a new test case for the query as these are purely experimental queries and since the query in question (
py/timing-attack-against-hash) is not even in the experimental suite. If you are interested in playing around with making a proper test, then as you write in the description, one way of emulatingremoteuser input could be by using MaD. I am not familiar with MaD for Python, but maybe inspiration can be drawn from here (where kind needs to beremoteinstead) - making anext.ymlfile next to the test can make someremotesources that only has the test as scope.
|
Started a |
Might not be a mistake actually, as the produced alerts are a subset of the alerts produced by |
|
10s slowdown on py/possible-timing-attack-against-hash on cpython, but given that we don't see a similar slowdown on other dbs or on py/timing-attack-against-hash (same kind of change), it could be a fluke. |
This PR enables diff-informed mode on queries that select a location other than dataflow source or sink. This entails adding a non-trivial location override that returns the locations that are actually selected.
Prior work includes PRs like #19663, #19759, and #19817. This PR uses the same patch script as those PRs to find candidate queries to convert to diff-enabled. This is the final step in mass-enabling diff-informed queries on all the languages.
Commit-by-commit reviewing is recommended.
Potentially tricky cases: