René's URL Explorer Experiment

{"@context":"https://schema.org","@type":"QAPage","mainEntity":{"@type":"Question","name":"Python: Unexpected flow from RemoteFlowSource","text":"\u003cp dir=\"auto\"\u003eI'm working with a fairly easy flow, where the \u003ccode class=\"notranslate\"\u003esource\u003c/code\u003e is \u003ccode class=\"notranslate\"\u003eRemoteFlowSource\u003c/code\u003e and the sinks are both \u003ccode class=\"notranslate\"\u003eunsafe_dn\u003c/code\u003e and \u003ccode class=\"notranslate\"\u003eunsafe_filter\u003c/code\u003e.\u003c/p\u003e\n\u003cdiv class=\"highlight highlight-source-python notranslate position-relative overflow-auto\" dir=\"auto\" data-snippet-clipboard-copy-content=\"@app.route(\u0026quot;/normal\u0026quot;)\ndef normal():\n    unsafe_dn = \u0026quot;dc=%s\u0026quot; % request.args['dc']\n    unsafe_filter = \u0026quot;(user=%s)\u0026quot; % request.args['username']\n\n    srv = ldap3.Server('ldap://127.0.0.1', port=1337)\n    conn = ldap3.Connection(srv, user=unsafe_dn, auto_bind=True)\n    conn.search(unsafe_dn, unsafe_filter, attributes=[\n                \u0026quot;testAttr1\u0026quot;, \u0026quot;testAttr2\u0026quot;])\"\u003e\u003cpre class=\"notranslate\"\u003e\u003cspan class=\"pl-en\"\u003e@\u003cspan class=\"pl-s1\"\u003eapp\u003c/span\u003e.\u003cspan class=\"pl-c1\"\u003eroute\u003c/span\u003e(\u003cspan class=\"pl-s\"\u003e\"/normal\"\u003c/span\u003e)\u003c/span\u003e\n\u003cspan class=\"pl-k\"\u003edef\u003c/span\u003e \u003cspan class=\"pl-en\"\u003enormal\u003c/span\u003e():\n    \u003cspan class=\"pl-s1\"\u003eunsafe_dn\u003c/span\u003e \u003cspan class=\"pl-c1\"\u003e=\u003c/span\u003e \u003cspan class=\"pl-s\"\u003e\"dc=%s\"\u003c/span\u003e \u003cspan class=\"pl-c1\"\u003e%\u003c/span\u003e \u003cspan class=\"pl-s1\"\u003erequest\u003c/span\u003e.\u003cspan class=\"pl-c1\"\u003eargs\u003c/span\u003e[\u003cspan class=\"pl-s\"\u003e'dc'\u003c/span\u003e]\n    \u003cspan class=\"pl-s1\"\u003eunsafe_filter\u003c/span\u003e \u003cspan class=\"pl-c1\"\u003e=\u003c/span\u003e \u003cspan class=\"pl-s\"\u003e\"(user=%s)\"\u003c/span\u003e \u003cspan class=\"pl-c1\"\u003e%\u003c/span\u003e \u003cspan class=\"pl-s1\"\u003erequest\u003c/span\u003e.\u003cspan class=\"pl-c1\"\u003eargs\u003c/span\u003e[\u003cspan class=\"pl-s\"\u003e'username'\u003c/span\u003e]\n\n    \u003cspan class=\"pl-s1\"\u003esrv\u003c/span\u003e \u003cspan class=\"pl-c1\"\u003e=\u003c/span\u003e \u003cspan class=\"pl-s1\"\u003eldap3\u003c/span\u003e.\u003cspan class=\"pl-c1\"\u003eServer\u003c/span\u003e(\u003cspan class=\"pl-s\"\u003e'ldap://127.0.0.1'\u003c/span\u003e, \u003cspan class=\"pl-s1\"\u003eport\u003c/span\u003e\u003cspan class=\"pl-c1\"\u003e=\u003c/span\u003e\u003cspan class=\"pl-c1\"\u003e1337\u003c/span\u003e)\n    \u003cspan class=\"pl-s1\"\u003econn\u003c/span\u003e \u003cspan class=\"pl-c1\"\u003e=\u003c/span\u003e \u003cspan class=\"pl-s1\"\u003eldap3\u003c/span\u003e.\u003cspan class=\"pl-c1\"\u003eConnection\u003c/span\u003e(\u003cspan class=\"pl-s1\"\u003esrv\u003c/span\u003e, \u003cspan class=\"pl-s1\"\u003euser\u003c/span\u003e\u003cspan class=\"pl-c1\"\u003e=\u003c/span\u003e\u003cspan class=\"pl-s1\"\u003eunsafe_dn\u003c/span\u003e, \u003cspan class=\"pl-s1\"\u003eauto_bind\u003c/span\u003e\u003cspan class=\"pl-c1\"\u003e=\u003c/span\u003e\u003cspan class=\"pl-c1\"\u003eTrue\u003c/span\u003e)\n    \u003cspan class=\"pl-s1\"\u003econn\u003c/span\u003e.\u003cspan class=\"pl-c1\"\u003esearch\u003c/span\u003e(\u003cspan class=\"pl-s1\"\u003eunsafe_dn\u003c/span\u003e, \u003cspan class=\"pl-s1\"\u003eunsafe_filter\u003c/span\u003e, \u003cspan class=\"pl-s1\"\u003eattributes\u003c/span\u003e\u003cspan class=\"pl-c1\"\u003e=\u003c/span\u003e[\n                \u003cspan class=\"pl-s\"\u003e\"testAttr1\"\u003c/span\u003e, \u003cspan class=\"pl-s\"\u003e\"testAttr2\"\u003c/span\u003e])\u003c/pre\u003e\u003c/div\u003e\n\u003cp dir=\"auto\"\u003eThe thing is that, I get three different flows. The first one is the intended one (\u003ccode class=\"notranslate\"\u003erequest\u003c/code\u003e(l.3) -\u0026gt; \u003ccode class=\"notranslate\"\u003erequest.args\u003c/code\u003e(l3) -\u0026gt; \u003ccode class=\"notranslate\"\u003erequest.args['dc']\u003c/code\u003e(l.3) -\u0026gt; \u003ccode class=\"notranslate\"\u003eunsafe_dn\u003c/code\u003e), but the other ones are related to \u003ccode class=\"notranslate\"\u003eunsafe_filter\u003c/code\u003e and make some strange jumps (\u003ccode class=\"notranslate\"\u003erequest\u003c/code\u003e(l.9) directly jumps to \u003ccode class=\"notranslate\"\u003erequest.args\u003c/code\u003e(l.10) \u0026amp; \u003ccode class=\"notranslate\"\u003erequest\u003c/code\u003e(l.9) -\u0026gt;\u003ccode class=\"notranslate\"\u003erequest\u003c/code\u003e(l.10)).\u003c/p\u003e\n\u003cp dir=\"auto\"\u003e\u003ca target=\"_blank\" rel=\"noopener noreferrer nofollow\" href=\"https://user-images.githubusercontent.com/46056498/113349610-9e680180-9338-11eb-967e-955dcab99e6b.png\"\u003e\u003cimg src=\"https://user-images.githubusercontent.com/46056498/113349610-9e680180-9338-11eb-967e-955dcab99e6b.png\" alt=\"image\" style=\"max-width: 100%;\"\u003e\u003c/a\u003e\u003c/p\u003e\n\u003cp dir=\"auto\"\u003eI guess \u003ca href=\"https://github.com/github/codeql/pull/5443#discussion_r605207553\" data-hovercard-type=\"pull_request\" data-hovercard-url=\"/github/codeql/pull/5443/hovercard\"\u003ethis comment\u003c/a\u003e is also related to this issue.\u003cbr\u003e\nComplete unit tests and query: \u003ca class=\"issue-link js-issue-link\" data-error-text=\"Failed to load title\" data-id=\"835026063\" data-permission-text=\"Title is private\" data-url=\"https://github.com/github/codeql/issues/5443\" data-hovercard-type=\"pull_request\" data-hovercard-url=\"/github/codeql/pull/5443/hovercard\" href=\"https://github.com/github/codeql/pull/5443\"\u003e#5443\u003c/a\u003e\u003c/p\u003e\n\u003cp dir=\"auto\"\u003eThanks in advance for your time! :D\u003c/p\u003e","upvoteCount":1,"answerCount":1,"acceptedAnswer":{"@type":"Answer","text":"\u003cp dir=\"auto\"\u003eI think that \u003ccode class=\"notranslate\"\u003erequest\u003c/code\u003e (l.9) -\u0026gt; \u003ccode class=\"notranslate\"\u003erequest\u003c/code\u003e (l.10) (in the third path explanation) is use-use flow. That is, the reference to \u003ccode class=\"notranslate\"\u003erequest\u003c/code\u003e on line 10 is \"the next use\" of that variable after the reference on line 9. Use-use flow is normally compressed out of the path explanations, but it may be shown here because we force is to show all subscript reads. However, it seems to also give you the version where it is compressed away in the second path explanation.\u003c/p\u003e","upvoteCount":1,"url":"https://github.com/github/codeql/discussions/5589#discussioncomment-573179"}}}