Skip to content

Conversation

bcaller
Copy link
Collaborator

@bcaller bcaller commented Oct 31, 2018

This changes the schema of the trigger file.

Previously there were too many options and it was confusing. My fault,
sorry.

This meant that db.execute(query, **TAINT) was marked as a
vulnerability whereas db.execute(text=query, **TAINT) wasn't.

Neither are vulnerabilities, so this gave a FALSE POSITIVE.

Now we have arg_dict which is a dictionary of keyword to argument
position.

E.g. for def f(a, b, *, c) we can specify the arg_dict as:

{"a": 0, "b": 1, "c": null}

if we want them all to propagate or not propagate depending on the
unlisted_args_propagate value.

This way, we can more easily define db.execute as:

            "execute(": {
                "unlisted_args_propagate": false,
                "arg_dict": {
                    "text": 0
                }
            },

This changes the schema of the trigger file.

Previously there were too many options and it was confusing. My fault,
sorry.

This meant that `db.execute(query, **TAINT)` was marked as a
vulnerability whereas `db.execute(text=query, **TAINT)` wasn't.

Neither are vulnerabilities, so this gave a FALSE POSITIVE.

Now we have `arg_dict` which is a dictionary of keyword to argument
position.

E.g. for `def f(a, b, *, c)` we can specify the arg_dict as:

```
{"a": 0, "b": 1, "c": null}
```

if we want them all to propagate or not propagate depending on the
`unlisted_args_propagate` value.

This way, we can more easily define db.execute as:

```
            "execute(": {
                "unlisted_args_propagate": false,
                "arg_dict": {
                    "text": 0
                }
            },
```
@KevinHock KevinHock self-requested a review October 31, 2018 18:19
Copy link
Collaborator

@KevinHock KevinHock left a comment

Choose a reason for hiding this comment

The reason will be displayed to describe this comment to others. Learn more.

LGTM, simplified indeed 👍

@bcaller bcaller merged commit 33dedd4 into python-security:master Nov 1, 2018
Sign up for free to join this conversation on GitHub. Already have an account? Sign in to comment

Labels

None yet

Projects

None yet

Development

Successfully merging this pull request may close these issues.

2 participants