-
Notifications
You must be signed in to change notification settings - Fork 250
Chained function calls separated into multiple assignments #171
New issue
Have a question about this project? Sign up for a free GitHub account to open an issue and contact its maintainers and the community.
By clicking “Sign up for GitHub”, you agree to our terms of service and privacy statement. We’ll occasionally send you account related emails.
Already on GitHub? Sign in to your account
Conversation
Take the example from examples/vulnerable_code/sql/sqli.py:
`result = session.query(User).filter("username={}".format(TAINT))`
The `filter` function is marked as a sink. However, previously this did
not get marked as a vulnerability.
The call label used to be `session.query`, ignoring the filter function.
Now, when the file is read, it is transformed into 2 lines:
```
__chain_tmp_1 = session.query(User)
result = __chain_tmp_1.filter("username={}".format(TAINT))
```
And the vulnerability is found.
We don't find everything here: just ordinary assignments and return
statements. We can't just transform all Call nodes here since Call nodes
can appear in many different scenarios e.g. comprehensions, bare
function calls.
8c95773 to
2e91ce7
Compare
There was a problem hiding this comment.
Choose a reason for hiding this comment
The reason will be displayed to describe this comment to others. Learn more.
LGTM, sorry it took a few days to review, just moved :)
There was a problem hiding this comment.
Choose a reason for hiding this comment
The reason will be displayed to describe this comment to others. Learn more.
Love how you did
node.value
node.value.func
node.value.func.value
in that order, it's super clean.
There was a problem hiding this comment.
Choose a reason for hiding this comment
The reason will be displayed to describe this comment to others. Learn more.
Indentation nit: This is awesomely smart but more indentation may make it clearer
outer_call = self.generic_visit( type(node)( value=ast.Call( func=ast.Attribute( value=ast.Name(id=temp_var_id, ctx=ast.Load()), attr=call_node.func.attr, ctx=ast.Load(), ), args=call_node.args, keywords=call_node.keywords, ), **{field: value for field, value in ast.iter_fields(node) if field != 'value'} # e.g. targets ) )
Nit: w/r/t generic_visit, since it isn't defined in this class, maybe inheriting from ast.NodeTransformer in both classes would be clearer.
There was a problem hiding this comment.
Choose a reason for hiding this comment
The reason will be displayed to describe this comment to others. Learn more.
Great use of join :D
Uh oh!
There was an error while loading. Please reload this page.
Take the example from examples/vulnerable_code/sql/sqli.py:
The
filterfunction is marked as a sink. However, previously this did not get marked as a vulnerability. The call label used to besession.query, ignoring the filter function.Now, when the file is read, it is transformed into 2 lines:
before converting to a CFG. The vulnerability is now found.
We don't find everything here: just ordinary assignments and return statements. We can't just transform all Call nodes here since Call nodes can appear in many different scenarios e.g. comprehensions, bare function calls. Because of this, it may be worth thinking about how to do this via the CFG everywhere function calls are chained.