diff --git a/python/ql/lib/semmle/python/frameworks/Stdlib.qll b/python/ql/lib/semmle/python/frameworks/Stdlib.qll index b674d10daf91..eb8622bb5f54 100644 --- a/python/ql/lib/semmle/python/frameworks/Stdlib.qll +++ b/python/ql/lib/semmle/python/frameworks/Stdlib.qll @@ -3121,8 +3121,13 @@ module StdlibPrivate { override predicate propagatesFlow(string input, string output, boolean preservesValue) { input in ["Argument[0]", "Argument[pattern:]"] and - output = "ReturnValue.Attribute[pattern]" and - preservesValue = true + ( + output = "ReturnValue.Attribute[pattern]" and + preservesValue = true + or + output = "ReturnValue" and + preservesValue = false + ) } } diff --git a/python/ql/lib/semmle/python/frameworks/Stdlib/StdLib.model.yml b/python/ql/lib/semmle/python/frameworks/Stdlib/StdLib.model.yml new file mode 100644 index 000000000000..e3cc9cd61c87 --- /dev/null +++ b/python/ql/lib/semmle/python/frameworks/Stdlib/StdLib.model.yml @@ -0,0 +1,44 @@ +extensions: + - addsTo: + pack: codeql/python-all + extensible: sourceModel + data: [] + + - addsTo: + pack: codeql/python-all + extensible: sinkModel + data: [] + + - addsTo: + pack: codeql/python-all + extensible: summaryModel + data: + # See https://docs.python.org/3/library/urllib.parse.html#urllib.parse.quote + - ["urllib", "Member[parse].Member[quote]", "Argument[0,string:]", "ReturnValue", "taint"] + # See https://docs.python.org/3/library/urllib.parse.html#urllib.parse.quote_plus + - ["urllib", "Member[parse].Member[quote_plus]", "Argument[0,string:]", "ReturnValue", "taint"] + # See https://epydoc.sourceforge.net/stdlib/urllib-module.html + - ["urllib", "Member[parse].Member[splitquery]", "Argument[0,url:]", "ReturnValue.TupleElement[0,1]", "taint"] + # See https://docs.python.org/3/library/urllib.parse.html#urllib.parse.unquote + - ["urllib", "Member[parse].Member[unquote]", "Argument[0,string:]", "ReturnValue", "taint"] + # See https://docs.python.org/3/library/urllib.parse.html#urllib.parse.unquote_plus + - ["urllib", "Member[parse].Member[unquote_plus]", "Argument[0,string:]", "ReturnValue", "taint"] + # We could consider a more precise source than the first argument, namely tuple or dict content. + # See https://docs.python.org/3/library/urllib.parse.html#urllib.parse.urlencode + - ["urllib", "Member[parse].Member[urlencode]", "Argument[0,query:]", "ReturnValue", "taint"] + # See https://docs.python.org/3/library/urllib.parse.html#urllib.parse.urljoin + - ["urllib", "Member[parse].Member[urljoin]", "Argument[0,base:,1,url:]", "ReturnValue", "taint"] + - addsTo: + pack: codeql/python-all + extensible: neutralModel + data: [] + + - addsTo: + pack: codeql/python-all + extensible: typeModel + data: [] + + - addsTo: + pack: codeql/python-all + extensible: typeVariableModel + data: []