github / github/codeql

Missing taint flow

Aberta
#19,153 4 comentários 0 reações 0 responsáveis Ver no GitHub
Python question
Linguagem predominante
CodeQL
Estrelas
10.1k
Forks
2.1k
Merge médio
2d 15h
PRs com merge (30d)
141

Descrição

**Description of the false positive**

**Code samples or links to source code**

**URL to the alert on GitHub code scanning (optional)**

I use the following query analysis code:
```

import python
import semmle.python.dataflow.new.DataFlow
import semmle.python.dataflow.new.TaintTracking
import semmle.python.dataflow.new.RemoteFlowSources
import semmle.python.Concepts
import semmle.python.ApiGraphs
module BackwardDataFlowConfiguration implements DataFlow::ConfigSig {
predicate isSource(DataFlow::Node source) {
source instanceof DataFlow::ExprNode
and source.asExpr() instanceof Name
and source.getLocation().getFile().getRelativePath() = "lollms/server/endpoints/lollms_personalities_infos.py"
and exists(Name n |
n = source.asExpr() and n.getId() = "category")

and source.getLocation().getStartLine() = 330

}

predicate isSink(DataFlow::Node sink) {
sink instanceof DataFlow::Node
}
}

module BackwardDataFlow = TaintTracking::Global;

from DataFlow::Node begin, DataFlow::Node end
where BackwardDataFlow::flow(begin, end)
select
begin,
"$@,$@"
,
begin.getLocation(),
"begin location"
,
end.getLocation(),
"end location"

```
this is the results:
![Image](https://github.com/user-attachments/assets/fc7ece80-4026-47e4-9bf7-3859ed222560)
Starting from the `category` variable I specified, I tried to find all the nodes that it could potentially flow to. However, I only ended up with six results, which are marked in the figure above. Apparently, the `package_full_path` in the row where the sixth point is located is also a node that category could flow to, but the results don't reflect this. Why is that? Thank you for your answer!

Guia de contribuição

Abrir o guia de contribuição

Direção de pesquisa

Start with the supplied CodeQL query and the source location lollms/server/endpoints/lollms_personalities_infos.py at line 330. Reproduce the flow results for category, then inspect the location containing package_full_path and compare it with the reported nodes. Done means explaining, or identifying the needed correction for, why that location is absent from the results.

Escrita pelo modelo de indexação a partir do texto da issue.

Avaliação

Domínio
security
Tipo de issue
Bug
Dificuldade
4/5
Tempo estimado
3-5 dias
Status de atividade
Estagnada
Clareza
Precisa de esclarecimento
Facilidade para iniciantes
25/100

Receba novas issues na sua caixa de entrada

Um resumo curto de issues do GitHub para quem está começando.