René's URL Explorer Experiment

{"@context":"https://schema.org","@type":"DiscussionForumPosting","headline":"False positive: Mistaking Username as password if they are set in the same tuple","articleBody":"**Description of the false positive**\r\n\r\nSometimes when a variable either stores a tuple containing a password and a username and then the username is logged into a file directly after the tuple is split, codeql assumes the username variable is a password, thus reporting Clear-text storage of sensitive information\r\n\r\n**Code samples or links to source code**\r\n\r\n```text\r\nStep 1 ControlFlowNode for Subscript\r\nSource\r\n[DataBase.py:845](https://github.com/DefinetlyNotAI/Test-generator/blob/813d517b26e7c3a25b0781d187d5ce3b42cad172/DataBase.py#L845-L845)\r\n\r\n        api = config[\"api\"]\r\n        username = config[\"username\"]\r\n        password = config[\"password\"]\r\n        exclusion_titles = config[\"exclusion_titles\"]\r\n        return api, username, password, exclusion_titles\r\n    except Exception as e:\r\nStep 2 ControlFlowNode for password\r\n[DataBase.py:845](https://github.com/DefinetlyNotAI/Test-generator/blob/813d517b26e7c3a25b0781d187d5ce3b42cad172/DataBase.py#L845-L845)\r\n\r\n        api = config[\"api\"]\r\n        username = config[\"username\"]\r\n        password = config[\"password\"]\r\n        exclusion_titles = config[\"exclusion_titles\"]\r\n        return api, username, password, exclusion_titles\r\n    except Exception as e:\r\nStep 3 ControlFlowNode for Tuple\r\n[DataBase.py:847](https://github.com/DefinetlyNotAI/Test-generator/blob/813d517b26e7c3a25b0781d187d5ce3b42cad172/DataBase.py#L847-L847)\r\n        username = config[\"username\"]\r\n        password = config[\"password\"]\r\n        exclusion_titles = config[\"exclusion_titles\"]\r\n        return api, username, password, exclusion_titles\r\n    except Exception as e:\r\n        return f\"ERROR {e} \u0026\u0026 520\"\r\n\r\nStep 4 ControlFlowNode for read_api()\r\n[DataBase.py:966](https://github.com/DefinetlyNotAI/Test-generator/blob/813d517b26e7c3a25b0781d187d5ce3b42cad172/DataBase.py#L966-L966)\r\n            - str: If the API is invalid, returns a formatted error message.\r\n            \"\"\"\r\n            # Initialize the UserManager and API values\r\n            temp = read_api()\r\n            if isinstance(temp, str):\r\n                if check_ERROR(temp):\r\n                    return temp\r\nStep 5 ControlFlowNode for temp\r\n[DataBase.py:966](https://github.com/DefinetlyNotAI/Test-generator/blob/813d517b26e7c3a25b0781d187d5ce3b42cad172/DataBase.py#L966-L966)\r\n            - str: If the API is invalid, returns a formatted error message.\r\n            \"\"\"\r\n            # Initialize the UserManager and API values\r\n            temp = read_api()\r\n            if isinstance(temp, str):\r\n                if check_ERROR(temp):\r\n                    return temp\r\nStep 6 ControlFlowNode for username\r\n[DataBase.py:971](https://github.com/DefinetlyNotAI/Test-generator/blob/813d517b26e7c3a25b0781d187d5ce3b42cad172/DataBase.py#L971-L971)\r\n                if check_ERROR(temp):\r\n                    return temp\r\n            else:\r\n                api, username, password, exclusion_titles = temp\r\n\r\n            if api == \"REC\":\r\n                log.info(\r\nStep 7 ControlFlowNode for Fstring\r\n[DataBase.py:975](https://github.com/DefinetlyNotAI/Test-generator/blob/813d517b26e7c3a25b0781d187d5ce3b42cad172/DataBase.py#L975-L975)\r\n\r\n            if api == \"REC\":\r\n                log.info(\r\n                    f\"A request has been made to generate an exam by the user {username}\"\r\n                )\r\n                if um.verify_password(username, password):\r\n                    DATA = exam_generator(username)\r\nStep 8 ControlFlowNode for message\r\n[DataBase.py:504](https://github.com/DefinetlyNotAI/Test-generator/blob/813d517b26e7c3a25b0781d187d5ce3b42cad172/DataBase.py#L504-L504)\r\n\r\n        return time\r\n\r\n    def info(self, message):\r\n        \"\"\"\r\n        Writes an informational message to the log file.\r\nStep 9 ControlFlowNode for Fstring\r\n\r\n[DataBase.py:515](https://github.com/DefinetlyNotAI/Test-generator/blob/813d517b26e7c3a25b0781d187d5ce3b42cad172/DataBase.py#L515-L515)\r\n            None\r\n        \"\"\"\r\n        with open(self.filename, \"a\") as f:\r\n            f.write(f\"INFO: {message} at {self.timestamp()}\\n\")\r\nThis expression stores  as clear text.\r\n\r\n    def error(self, message):\r\n        \"\"\"\r\n```\r\n\r\n**URL to the alert on GitHub code scanning (optional)**\r\n\r\nhttps://github.com/DefinetlyNotAI/Test-generator/security/code-scanning/50","author":{"url":"https://github.com/DefinetlyNotAI","@type":"Person","name":"DefinetlyNotAI"},"datePublished":"2024-07-14T15:46:55.000Z","interactionStatistic":{"@type":"InteractionCounter","interactionType":"https://schema.org/CommentAction","userInteractionCount":1},"url":"https://github.com/16976/codeql/issues/16976"}