Python: Fix some problems in TaintKind useage#3591
Conversation
If I wanted to use my own TaintKind and not have any interaction with `UntrustedStringKind` that wouldn't be possible today since these standard http libraries import it directly. (also, I wouldn't get any sources of my custom TaintKind from turbogears or bottle). I changed them to use the same pattern of `ExternalStringKind` as everything else does.
This QL
```codeql
import python
import semmle.python.dataflow.TaintTracking
import semmle.python.security.strings.Untrusted
from CollectionKind ck
where
ck.(DictKind).getMember() instanceof StringKind
or
ck.getMember().(DictKind).getMember() instanceof StringKind
select ck, ck.getAQlClass(), ck.getMember().getAQlClass()
```
generates these 6 results.
```
1 {externally controlled string} ExternalStringDictKind UntrustedStringKind
2 {externally controlled string} StringDictKind UntrustedStringKind
3 [{externally controlled string}] SequenceKind ExternalStringDictKind
4 [{externally controlled string}] SequenceKind StringDictKind
5 {{externally controlled string}} DictKind ExternalStringDictKind
6 {{externally controlled string}} DictKind StringDictKind
```
StringDictKind was only used in *one* place in our library code. As illustrated
above, it pollutes our set of TaintKinds. Effectively, every time we make a
flow-step for dictionaries with tainted strings as values, we do it TWICE --
once for ExternalStringDictKind, and once for StringDictKind... that is just a
waste.
|
Uhhhh, I actually forgot to highlight a quite important detail 😬 Any I'll make an update in the change-notes, but don't know if we need more than that? |
|
It seems to me that commit 1 is unrelated to commits 2 and 3? The former is standardising some web libraries while the latter are cleaning up our taint tracking labels. Small as they are, I would probably have expected them to inhabit separate PRs. In commit 1, before and after look alpha-equivalent to me, but I will take your word for it that UntrustedStringKind is more likely to cause conflicts than ExternalStringKind. |
|
Would queries just fail silently without some error? |
Yes, I am sometimes lazy and group things together that are related but could be split into multiple PRs.
If using codeql/python/ql/src/semmle/python/security/injection/Xml.qll Lines 49 to 51 in 453de6b
If by "fail" you mean "not produce any results", then yes |
Co-authored-by: Taus <tausbn@gmail.com>
|
@yoff did you see my response above? 😊 |
|
Yes, so it seems to me that the importance of switching from |
|
Thanks for the out-of-band explanation, happy to merge now. |
3 participants
See details in commit messages.