Skip to content

Commit a8fc100

Browse files
aschackmullaschackmull
committed
Python: Add alert provenance plumbing.
1 parent f202661 commit a8fc100

13 files changed

Lines changed: 142 additions & 75 deletions

File tree

‎python/ql/lib/semmle/python/dataflow/new/FlowSummary.qll‎

Lines changed: 14 additions & 1 deletion
Original file line numberDiff line numberDiff line change
@@ -31,8 +31,21 @@ abstract class SummarizedCallable extends LibraryCallable, Impl::Public::Summari
3131
* DEPRECATED: Use `propagatesFlow` instead.
3232
*/
3333
deprecated predicate propagatesFlowExt(string input, string output, boolean preservesValue) {
34-
this.propagatesFlow(input, output, preservesValue)
34+
this.propagatesFlow(input, output, preservesValue, _)
3535
}
36+
37+
override predicate propagatesFlow(
38+
string input, string output, boolean preservesValue, string model
39+
) {
40+
this.propagatesFlow(input, output, preservesValue) and model = this
41+
}
42+
43+
/**
44+
* Holds if data may flow from `input` to `output` through this callable.
45+
*
46+
* `preservesValue` indicates whether this is a value-preserving step or a taint-step.
47+
*/
48+
predicate propagatesFlow(string input, string output, boolean preservesValue) { none() }
3649
}
3750

3851
deprecated class RequiredSummaryComponentStack = Impl::Private::RequiredSummaryComponentStack;

‎python/ql/lib/semmle/python/dataflow/new/internal/DataFlowPrivate.qll‎

Lines changed: 15 additions & 6 deletions
Original file line numberDiff line numberDiff line change
@@ -3,6 +3,7 @@ private import DataFlowPublic
33
private import semmle.python.essa.SsaCompute
44
private import semmle.python.dataflow.new.internal.ImportResolution
55
private import FlowSummaryImpl as FlowSummaryImpl
6+
private import semmle.python.frameworks.data.ModelsAsData
67
// Since we allow extra data-flow steps from modeled frameworks, we import these
78
// up-front, to ensure these are included. This provides a more seamless experience from
89
// a user point of view, since they don't need to know they need to import a specific
@@ -471,12 +472,12 @@ import StepRelationTransformations
471472
*
472473
* It includes flow steps from flow summaries.
473474
*/
474-
predicate simpleLocalFlowStep(Node nodeFrom, Node nodeTo) {
475-
simpleLocalFlowStepForTypetracking(nodeFrom, nodeTo)
475+
predicate simpleLocalFlowStep(Node nodeFrom, Node nodeTo, string model) {
476+
simpleLocalFlowStepForTypetracking(nodeFrom, nodeTo) and model = ""
476477
or
477-
summaryLocalStep(nodeFrom, nodeTo)
478+
summaryLocalStep(nodeFrom, nodeTo, model)
478479
or
479-
variableCaptureLocalFlowStep(nodeFrom, nodeTo)
480+
variableCaptureLocalFlowStep(nodeFrom, nodeTo) and model = ""
480481
}
481482

482483
/**
@@ -490,9 +491,9 @@ predicate simpleLocalFlowStepForTypetracking(Node nodeFrom, Node nodeTo) {
490491
LocalFlow::localFlowStep(nodeFrom, nodeTo)
491492
}
492493

493-
private predicate summaryLocalStep(Node nodeFrom, Node nodeTo) {
494+
private predicate summaryLocalStep(Node nodeFrom, Node nodeTo, string model) {
494495
FlowSummaryImpl::Private::Steps::summaryLocalStep(nodeFrom.(FlowSummaryNode).getSummaryNode(),
495-
nodeTo.(FlowSummaryNode).getSummaryNode(), true)
496+
nodeTo.(FlowSummaryNode).getSummaryNode(), true, model)
496497
}
497498

498499
predicate variableCaptureLocalFlowStep(Node nodeFrom, Node nodeTo) {
@@ -1078,6 +1079,14 @@ predicate lambdaCall(DataFlowCall call, LambdaCallKind kind, Node receiver) {
10781079
/** Extra data-flow steps needed for lambda flow analysis. */
10791080
predicate additionalLambdaFlowStep(Node nodeFrom, Node nodeTo, boolean preservesValue) { none() }
10801081

1082+
predicate knownSourceModel(Node source, string model) {
1083+
source = ModelOutput::getASourceNode(_, model).asSource()
1084+
}
1085+
1086+
predicate knownSinkModel(Node sink, string model) {
1087+
sink = ModelOutput::getASinkNode(_, model).asSink()
1088+
}
1089+
10811090
/**
10821091
* Holds if flow is allowed to pass from parameter `p` and back to itself as a
10831092
* side-effect, resulting in a summary from `p` to itself.

‎python/ql/lib/semmle/python/dataflow/new/internal/DataFlowPublic.qll‎

Lines changed: 3 additions & 1 deletion
Original file line numberDiff line numberDiff line change
@@ -642,7 +642,9 @@ newtype TContent =
642642
or
643643
//
644644
// 2) summaries in data-extension files
645-
exists(string input, string output | ModelOutput::relevantSummaryModel(_, _, input, output, _) |
645+
exists(string input, string output |
646+
ModelOutput::relevantSummaryModel(_, _, input, output, _, _)
647+
|
646648
attr = [input, output].regexpFind("(?<=(^|\\.)Attribute\\[)[^\\]]+(?=\\])", _, _).trim()
647649
)
648650
} or

‎python/ql/lib/semmle/python/dataflow/new/internal/DataFlowUtil.qll‎

Lines changed: 1 addition & 1 deletion
Original file line numberDiff line numberDiff line change
@@ -12,7 +12,7 @@ private import FlowSummaryImpl as FlowSummaryImpl
1212
* (intra-procedural) step.
1313
*/
1414
predicate localFlowStep(Node nodeFrom, Node nodeTo) {
15-
simpleLocalFlowStep(nodeFrom, nodeTo)
15+
simpleLocalFlowStep(nodeFrom, nodeTo, _)
1616
or
1717
// Simple flow through library code is included in the exposed local
1818
// step relation, even though flow is technically inter-procedural.

‎python/ql/lib/semmle/python/dataflow/new/internal/LocalSources.qll‎

Lines changed: 1 addition & 1 deletion
Original file line numberDiff line numberDiff line change
@@ -242,7 +242,7 @@ private module Cached {
242242
*/
243243
pragma[nomagic]
244244
private predicate localSourceFlowStep(Node nodeFrom, Node nodeTo) {
245-
simpleLocalFlowStep(nodeFrom, nodeTo) and
245+
simpleLocalFlowStep(nodeFrom, nodeTo, _) and
246246
not nodeTo = any(ModuleVariableNode v).getARead()
247247
}
248248

‎python/ql/lib/semmle/python/dataflow/new/internal/TaintTrackingPrivate.qll‎

Lines changed: 29 additions & 24 deletions
Original file line numberDiff line numberDiff line change
@@ -24,10 +24,11 @@ private module Cached {
2424
* global taint flow configurations.
2525
*/
2626
cached
27-
predicate defaultAdditionalTaintStep(DataFlow::Node nodeFrom, DataFlow::Node nodeTo) {
28-
localAdditionalTaintStep(nodeFrom, nodeTo)
27+
predicate defaultAdditionalTaintStep(DataFlow::Node nodeFrom, DataFlow::Node nodeTo, string model) {
28+
localAdditionalTaintStep(nodeFrom, nodeTo, model)
2929
or
30-
any(AdditionalTaintStep a).step(nodeFrom, nodeTo)
30+
any(AdditionalTaintStep a).step(nodeFrom, nodeTo) and
31+
model = "AdditionalTaintStep"
3132
}
3233

3334
/**
@@ -36,30 +37,34 @@ private module Cached {
3637
* different objects.
3738
*/
3839
cached
39-
predicate localAdditionalTaintStep(DataFlow::Node nodeFrom, DataFlow::Node nodeTo) {
40-
concatStep(nodeFrom, nodeTo)
41-
or
42-
subscriptStep(nodeFrom, nodeTo)
43-
or
44-
stringManipulation(nodeFrom, nodeTo)
45-
or
46-
containerStep(nodeFrom, nodeTo)
47-
or
48-
copyStep(nodeFrom, nodeTo)
49-
or
50-
DataFlowPrivate::forReadStep(nodeFrom, _, nodeTo)
51-
or
52-
DataFlowPrivate::iterableUnpackingReadStep(nodeFrom, _, nodeTo)
53-
or
54-
DataFlowPrivate::iterableUnpackingStoreStep(nodeFrom, _, nodeTo)
55-
or
56-
awaitStep(nodeFrom, nodeTo)
57-
or
58-
asyncWithStep(nodeFrom, nodeTo)
40+
predicate localAdditionalTaintStep(DataFlow::Node nodeFrom, DataFlow::Node nodeTo, string model) {
41+
(
42+
concatStep(nodeFrom, nodeTo)
43+
or
44+
subscriptStep(nodeFrom, nodeTo)
45+
or
46+
stringManipulation(nodeFrom, nodeTo)
47+
or
48+
containerStep(nodeFrom, nodeTo)
49+
or
50+
copyStep(nodeFrom, nodeTo)
51+
or
52+
DataFlowPrivate::forReadStep(nodeFrom, _, nodeTo)
53+
or
54+
DataFlowPrivate::iterableUnpackingReadStep(nodeFrom, _, nodeTo)
55+
or
56+
DataFlowPrivate::iterableUnpackingStoreStep(nodeFrom, _, nodeTo)
57+
or
58+
awaitStep(nodeFrom, nodeTo)
59+
or
60+
asyncWithStep(nodeFrom, nodeTo)
61+
) and
62+
model = ""
5963
or
6064
FlowSummaryImpl::Private::Steps::summaryLocalStep(nodeFrom
6165
.(DataFlowPrivate::FlowSummaryNode)
62-
.getSummaryNode(), nodeTo.(DataFlowPrivate::FlowSummaryNode).getSummaryNode(), false)
66+
.getSummaryNode(), nodeTo.(DataFlowPrivate::FlowSummaryNode).getSummaryNode(), false,
67+
model)
6368
}
6469
}
6570

‎python/ql/lib/semmle/python/dataflow/new/internal/TaintTrackingPublic.qll‎

Lines changed: 1 addition & 1 deletion
Original file line numberDiff line numberDiff line change
@@ -34,7 +34,7 @@ predicate localTaintStep(DataFlow::Node nodeFrom, DataFlow::Node nodeTo) {
3434
// Ordinary data flow
3535
DataFlow::localFlowStep(nodeFrom, nodeTo)
3636
or
37-
localAdditionalTaintStep(nodeFrom, nodeTo)
37+
localAdditionalTaintStep(nodeFrom, nodeTo, _)
3838
}
3939

4040
/**

‎python/ql/lib/semmle/python/dataflow/new/internal/TypeTrackingImpl.qll‎

Lines changed: 9 additions & 1 deletion
Original file line numberDiff line numberDiff line change
@@ -24,7 +24,15 @@ private module SummaryTypeTrackerInput implements SummaryTypeTracker::Input {
2424
ContentFilter getFilterFromWithContentStep(Content content) { none() }
2525

2626
// Callables
27-
class SummarizedCallable = FlowSummaryImpl::Private::SummarizedCallableImpl;
27+
class SummarizedCallable instanceof FlowSummaryImpl::Private::SummarizedCallableImpl {
28+
string toString() { result = super.toString() }
29+
30+
predicate propagatesFlow(
31+
SummaryComponentStack input, SummaryComponentStack output, boolean preservesValue
32+
) {
33+
super.propagatesFlow(input, output, preservesValue, _)
34+
}
35+
}
2836

2937
// Summaries and their stacks
3038
class SummaryComponent = FlowSummaryImpl::Private::SummaryComponent;

‎python/ql/lib/semmle/python/frameworks/data/ModelsAsData.qll‎

Lines changed: 5 additions & 3 deletions
Original file line numberDiff line numberDiff line change
@@ -33,7 +33,7 @@ private class SummarizedCallableFromModel extends SummarizedCallable {
3333
string path;
3434

3535
SummarizedCallableFromModel() {
36-
ModelOutput::relevantSummaryModel(type, path, _, _, _) and
36+
ModelOutput::relevantSummaryModel(type, path, _, _, _, _) and
3737
this = type + ";" + path
3838
}
3939

@@ -46,8 +46,10 @@ private class SummarizedCallableFromModel extends SummarizedCallable {
4646
)
4747
}
4848

49-
override predicate propagatesFlow(string input, string output, boolean preservesValue) {
50-
exists(string kind | ModelOutput::relevantSummaryModel(type, path, input, output, kind) |
49+
override predicate propagatesFlow(
50+
string input, string output, boolean preservesValue, string model
51+
) {
52+
exists(string kind | ModelOutput::relevantSummaryModel(type, path, input, output, kind, model) |
5153
kind = "value" and
5254
preservesValue = true
5355
or

0 commit comments

Comments
 (0)