Repository navigation
Conversation
yoff
left a comment
yoff
left a comment
There was a problem hiding this comment.
Good start. It would be nice if the examples were turned into query tests.
At the moment, you are making changes in the shipped query, so we will require fairly high quality before merging. Alternatively, you copy the whole query to experimental, and it could basically be merged as is.
I have given some pointers to things to improve. Further to that would be the comments referring to relevant APIs so other developers can convince themselves that the model is reasonable.
| class AllTarfileOpens extends API::CallNode { | ||
| AllTarfileOpens() { | ||
| exists(TarfileOpens tfo | this = tfo.getACall()) | ||
| or | ||
| exists(API::Node closing, Node arg, TarfileOpens tfo | | ||
| closing = API::moduleImport("contextlib").getMember("closing") and | ||
| this = closing.getACall() and | ||
| arg = this.getArg(0) and | ||
| arg = tfo.getACall() | ||
| ) | ||
| } | ||
| } |
There was a problem hiding this comment.
The extra source added here is better handled by an additional taint step. Then paths will start at the open call rather than at the closing call, and, if the two a separated in the code, we would find the data flow to connect them.
…tions.qll Use of the predicate. Co-authored-by: yoff <lerchedahl@gmail.com>
…tions.qll adjust to the use of the predicate. Co-authored-by: yoff <lerchedahl@gmail.com>
…tions.qll adjust to the use of the predicate. Co-authored-by: yoff <lerchedahl@gmail.com>
I did not get this one "query tests", please.
Ok, I will close this PR, take into consideration the previously suggested changes and make a new PR with a separate query within this folder as |
|
That is fine, but it would also be fine to do it in this PR.. |
2 participants
Hi,
_extract_member()extractall()In the folder
/examples/, you would find the bad samples named as:TarSlip_xxx.pyand the relatively good samples asNoHIT_TarSlip_xxx.py. Plus to that, a little bash scriptscript.shthat is supposed to execute the good and the bad samples using the malicious tarballarchive_malign.tar.Thank you