github / github/codeql

Missing taint flow

未關閉
#19,153 4 則留言 0 個 reaction 已指派 0 人 在 GitHub 檢視
Python question
主要語言
CodeQL
星號
10.1k
分支
2.1k
平均合併
2 天 15 小時
30 天內合併 PR
141

描述

**Description of the false positive**

**Code samples or links to source code**

**URL to the alert on GitHub code scanning (optional)**

I use the following query analysis code:
```

import python
import semmle.python.dataflow.new.DataFlow
import semmle.python.dataflow.new.TaintTracking
import semmle.python.dataflow.new.RemoteFlowSources
import semmle.python.Concepts
import semmle.python.ApiGraphs
module BackwardDataFlowConfiguration implements DataFlow::ConfigSig {
predicate isSource(DataFlow::Node source) {
source instanceof DataFlow::ExprNode
and source.asExpr() instanceof Name
and source.getLocation().getFile().getRelativePath() = "lollms/server/endpoints/lollms_personalities_infos.py"
and exists(Name n |
n = source.asExpr() and n.getId() = "category")

and source.getLocation().getStartLine() = 330

}

predicate isSink(DataFlow::Node sink) {
sink instanceof DataFlow::Node
}
}

module BackwardDataFlow = TaintTracking::Global;

from DataFlow::Node begin, DataFlow::Node end
where BackwardDataFlow::flow(begin, end)
select
begin,
"$@,$@"
,
begin.getLocation(),
"begin location"
,
end.getLocation(),
"end location"

```
this is the results:
![Image](https://github.com/user-attachments/assets/fc7ece80-4026-47e4-9bf7-3859ed222560)
Starting from the `category` variable I specified, I tried to find all the nodes that it could potentially flow to. However, I only ended up with six results, which are marked in the figure above. Apparently, the `package_full_path` in the row where the sixth point is located is also a node that category could flow to, but the results don't reflect this. Why is that? Thank you for your answer!

貢獻指南

開啟貢獻指南

評估

這個 Issue 還沒有評估資料。

把新 issue 寄到你的電子郵件信箱

精選適合新手參與的 GitHub issue 摘要。