From 4153a83a4f0fe6fb7097dd6fae8eddf4a85f3499 Mon Sep 17 00:00:00 2001 From: Anders Schack-Mulligen Date: Wed, 16 Oct 2024 16:14:51 +0200 Subject: [PATCH] Python: Add workaround. --- .../python/dataflow/new/internal/TaintTrackingPrivate.qll | 7 ++++++- 1 file changed, 6 insertions(+), 1 deletion(-) diff --git a/python/ql/lib/semmle/python/dataflow/new/internal/TaintTrackingPrivate.qll b/python/ql/lib/semmle/python/dataflow/new/internal/TaintTrackingPrivate.qll index cc59bc679338..62f5a76309b4 100644 --- a/python/ql/lib/semmle/python/dataflow/new/internal/TaintTrackingPrivate.qll +++ b/python/ql/lib/semmle/python/dataflow/new/internal/TaintTrackingPrivate.qll @@ -233,7 +233,12 @@ private module SpeculativeTaintFlow { predicate speculativeTaintStep(DataFlow::Node src, DataFlow::Node sink) { exists(DataFlowDispatch::DataFlowCall call, DataFlowDispatch::ArgumentPosition argpos | // TODO: exclude neutrals and anything that has QL modeling. - not exists(DataFlowDispatch::viableCallable(call)) and + not exists(DataFlowDispatch::DataFlowCall call0 | + // Workaround for the fact that python currently associates several + // DataFlowCalls with a single call. + src.(DataFlowPublic::ArgumentNode).argumentOf(call0, _) and + exists(DataFlowDispatch::viableCallable(call0)) + ) and call instanceof DataFlowDispatch::PotentialLibraryCall and src.(DataFlowPublic::ArgumentNode).argumentOf(call, argpos) |