github · porcupineyhairs · porcupineyhairs · porcupineyhairs · Oct 29, 2021 · porcupineyhairs
diff --git a/python/ql/lib/semmle/python/security/dataflow/PathInjectionCustomizations.qll b/python/ql/lib/semmle/python/security/dataflow/PathInjectionCustomizations.qll
+   */
+  private class OsPathAbsoluteCallAsSanitizer extends Sanitizer {
+    OsPathAbsoluteCallAsSanitizer() {
+      this = API::moduleImport("os").getMember("path").getMember("abspath").getACall().getArg(_)
diff --git a/python/ql/test/query-tests/Security/CWE-022-PathInjection/path_injection.py b/python/ql/test/query-tests/Security/CWE-022-PathInjection/path_injection.py
+def camera_img_acquire(filename):
+    filename = request.args.get('filename', '')
+    image_path = os.path.join(STATIC_DIR, filename)
+    if not os.path.exists(image_path): # OK as exposure of ctime of a particular file does not pose a security thread
	/**
	* A call to `os.path.abspath`.
	* See https://docs.python.org/3/library/os.path.html#os.path.abspath
	*/
	private class OsPathAbspathCall extends Path::PathNormalization::Range, DataFlow::CallCfgNode {
	OsPathAbspathCall() { this = os::path().getMember("abspath").getACall() }

	DataFlow::Node getPathArg() { result in [this.getArg(0), this.getArgByName("path")] }
	}
	/**
	* A call to the `startswith` method on a string.
	* See https://docs.python.org/3.9/library/stdtypes.html#str.startswith
	*/
	private class StartswithCall extends Path::SafeAccessCheck::Range {
	StartswithCall() { this.(CallNode).getFunction().(AttrNode).getName() = "startswith" }

	override predicate checks(ControlFlowNode node, boolean branch) {
	node = this.(CallNode).getFunction().(AttrNode).getObject() and
	branch = true
	}
	}