Skip to content

[Python] Taint Analysis for a particular scenario involving StringIO #20085

Answered by smowton
rikaardhosein asked this question in Q&A
Discussion options

You must be logged in to vote

You're very close!

exists(DataFlow::MethodCallNode m |
      m.getMethodName() = "write" and
      m.getObject() = pred
      and pred.asExpr().(Attribute).getObject() = succ.asExpr()
    )
    or

(the middle disjunct) is unnecessary and can be removed.

The top disjunct needs changing to use DataFlow::PostUpdateNode, which represents a side-effect on a function parameter (including self, as here):

    exists(DataFlow::MethodCallNode m |
      m.getMethodName() = "write" and
      m.getObject() = succ.(DataFlow::PostUpdateNode).getPreUpdateNode() and
      pred = m.getArg(0)
    )

You must also use TaintTracking because of the string-concatenation step at test_global + "" + source_code (…

Replies: 1 comment 1 reply

Comment options

You must be logged in to vote
1 reply
@rikaardhosein
Comment options

Answer selected by rikaardhosein
Sign up for free to join this conversation on GitHub. Already have an account? Sign in to comment
Category
Q&A
Labels
2 participants
pFad - Phonifier reborn

Pfad - The Proxy pFad of © 2024 Garber Painting. All rights reserved.

Note: This service is not intended for secure transactions such as banking, social media, email, or purchasing. Use at your own risk. We assume no liability whatsoever for broken pages.


Alternative Proxies:

Alternative Proxy

pFad Proxy

pFad v3 Proxy

pFad v4 Proxy