github / github/codeql

[python] The tuple (*) argument of a call cannot step to function parameter for the CommandInjectionCustomizations flow

Open
#19,900 7 comments 0 reactions 0 assignees View on GitHub
question
Dominant language
CodeQL
Stars
10.1k
Forks
2.1k
Avg merge
2d 15h
Merged PRs (30d)
141

Description

In Python, when passing the typle (*) argument to function parameters, the taint propagation chain breaks. As shown in the following code snippet, this issue occurs. Are there plans to support this scenario? How do i resolve this issue?
```python
from django.contrib.auth.decorators import login_required
from django.conf.urls import url
import os

def build_cmd(cmd: str):
cmd = cmd + "; touch aa"
print(cmd)
return cmd

@login_required
def GetOperateLog(request):
cmd = request.POST.get('cmd', None)
args = []
args.append(cmd)
cmd3 = build_cmd(*args)
os.system(cmd3)

urlpatterns = [
url(r'^GetOperateLog', GetOperateLog, name='GetOperateLog'),
]
```
This is the taint propagation flow.
Image

Contributor guide

Open the contributing guide

Assessment

This issue has not been assessed yet.

Get new issues in your inbox

A short digest of beginner-friendly GitHub issues.