github / github/codeql

Missing taint flow

Abierto
#19,153 4 comentarios 0 reacciones 0 asignados Ver en GitHub
Python question
Lenguaje dominante
CodeQL
Estrellas
10.1k
Forks
2.1k
Merge medio
2 d 15 h
PR fusionados (30 d)
141

Descripción

**Description of the false positive**

**Code samples or links to source code**

**URL to the alert on GitHub code scanning (optional)**

I use the following query analysis code:
```

import python
import semmle.python.dataflow.new.DataFlow
import semmle.python.dataflow.new.TaintTracking
import semmle.python.dataflow.new.RemoteFlowSources
import semmle.python.Concepts
import semmle.python.ApiGraphs
module BackwardDataFlowConfiguration implements DataFlow::ConfigSig {
predicate isSource(DataFlow::Node source) {
source instanceof DataFlow::ExprNode
and source.asExpr() instanceof Name
and source.getLocation().getFile().getRelativePath() = "lollms/server/endpoints/lollms_personalities_infos.py"
and exists(Name n |
n = source.asExpr() and n.getId() = "category")

and source.getLocation().getStartLine() = 330

}

predicate isSink(DataFlow::Node sink) {
sink instanceof DataFlow::Node
}
}

module BackwardDataFlow = TaintTracking::Global;

from DataFlow::Node begin, DataFlow::Node end
where BackwardDataFlow::flow(begin, end)
select
begin,
"$@,$@"
,
begin.getLocation(),
"begin location"
,
end.getLocation(),
"end location"

```
this is the results:
![Image](https://github.com/user-attachments/assets/fc7ece80-4026-47e4-9bf7-3859ed222560)
Starting from the `category` variable I specified, I tried to find all the nodes that it could potentially flow to. However, I only ended up with six results, which are marked in the figure above. Apparently, the `package_full_path` in the row where the sixth point is located is also a node that category could flow to, but the results don't reflect this. Why is that? Thank you for your answer!

Guía de contribución

Abrir la guía de contribución

Evaluación

Este issue todavía no se ha evaluado.

Recibe los nuevos issues en tu correo

Un resumen breve de issues de GitHub para principiantes.