Python: Add Server-side Request Forgery sinks #8275
Conversation
There was a problem hiding this comment.
Thanks for this contribution 👍
Please do the same rewrites I have suggested for python/ql/lib/semmle/python/frameworks/Aiohttp.qll to the other files as well.
Also please add tests to highlight the cases we can now handle, like in https://github.com/github/codeql/blob/main/python/ql/test/library-tests/frameworks/requests/test.py
| DataFlow::Node getUrlArg() { | ||
| result = this.getArgByName("url") | ||
| or | ||
| not methodName = "request" and | ||
| result = this.getArg(0) | ||
| or | ||
| methodName = "request" and | ||
| result = this.getArg(1) | ||
| } | ||
|
|
||
| override DataFlow::Node getAUrlPart() { result = this.getUrlArg() } |
There was a problem hiding this comment.
I don't see any reason to have this separate predicate, can we just do
| DataFlow::Node getUrlArg() { | |
| result = this.getArgByName("url") | |
| or | |
| not methodName = "request" and | |
| result = this.getArg(0) | |
| or | |
| methodName = "request" and | |
| result = this.getArg(1) | |
| } | |
| override DataFlow::Node getAUrlPart() { result = this.getUrlArg() } | |
| override DataFlow::Node getAUrlPart() { | |
| result = this.getArgByName("url") | |
| or | |
| not methodName = "request" and | |
| result = this.getArg(0) | |
| or | |
| methodName = "request" and | |
| result = this.getArg(1) | |
| } |
There was a problem hiding this comment.
Also please add tests to highlight the cases we can now handle, like in https://github.com/github/codeql/blob/main/python/ql/test/library-tests/frameworks/requests/test.py
Please review whether the test file is correct, thank you!
There was a problem hiding this comment.
They looked great, but there was a failure for httpx. Next time you should run the tests in all directories before submitting 😉
|
Thanks for the updates @haby0. Since you did not target |
@RasmusWL 👍 |
|
Performance looks good 👍 |
Thanks. |
Add some sinks in the CodeQL-Python SSRF model. Modeled Python libraries are:
Aiohttp,Httpx,Libtaxii,Urllib,Urllib2,Urllib3.There may be inappropriate modeling, please point out the project maintainer so that I can improve it.