Skip to content
New issue

Have a question about this project? Sign up for a free GitHub account to open an issue and contact its maintainers and the community.

By clicking “Sign up for GitHub”, you agree to our terms of service and privacy statement. We’ll occasionally send you account related emails.

Already on GitHub? Sign in to your account

Simplify trigger file for sink argument propagation #182

Merged
merged 1 commit into from
Nov 1, 2018

Conversation

bcaller
Copy link
Collaborator

@bcaller bcaller commented Oct 31, 2018

This changes the schema of the trigger file.

Previously there were too many options and it was confusing. My fault,
sorry.

This meant that db.execute(query, **TAINT) was marked as a
vulnerability whereas db.execute(text=query, **TAINT) wasn't.

Neither are vulnerabilities, so this gave a FALSE POSITIVE.

Now we have arg_dict which is a dictionary of keyword to argument
position.

E.g. for def f(a, b, *, c) we can specify the arg_dict as:

{"a": 0, "b": 1, "c": null}

if we want them all to propagate or not propagate depending on the
unlisted_args_propagate value.

This way, we can more easily define db.execute as:

            "execute(": {
                "unlisted_args_propagate": false,
                "arg_dict": {
                    "text": 0
                }
            },

This changes the schema of the trigger file.

Previously there were too many options and it was confusing. My fault,
sorry.

This meant that `db.execute(query, **TAINT)` was marked as a
vulnerability whereas `db.execute(text=query, **TAINT)` wasn't.

Neither are vulnerabilities, so this gave a FALSE POSITIVE.

Now we have `arg_dict` which is a dictionary of keyword to argument
position.

E.g. for `def f(a, b, *, c)` we can specify the arg_dict as:

```
{"a": 0, "b": 1, "c": null}
```

if we want them all to propagate or not propagate depending on the
`unlisted_args_propagate` value.

This way, we can more easily define db.execute as:

```
            "execute(": {
                "unlisted_args_propagate": false,
                "arg_dict": {
                    "text": 0
                }
            },
```
@KevinHock KevinHock self-requested a review October 31, 2018 18:19
Copy link
Collaborator

@KevinHock KevinHock left a comment

Choose a reason for hiding this comment

The reason will be displayed to describe this comment to others. Learn more.

LGTM, simplified indeed 👍

@bcaller bcaller merged commit 33dedd4 into python-security:master Nov 1, 2018
Sign up for free to join this conversation on GitHub. Already have an account? Sign in to comment
Labels
None yet
Projects
None yet
Development

Successfully merging this pull request may close these issues.

2 participants