René's URL Explorer Experiment

{"@context":"https://schema.org","@type":"DiscussionForumPosting","headline":"Python: taint is lost through list.extend, list.insert and += , but not list.append","articleBody":"### Summary\n\nCodeQL's Python taint tracking propagates through `list.append`, but not through `list.extend`, `list.insert`, or `+=` on a list. A security query therefore reports a flow written one way and stays silent on the same flow written another way, where the two differ only in which list-mutation method is used.\n\nI'm reporting the **asymmetry** rather than the incompleteness: `append` is clearly modelled, so the other three look like a gap in the same model rather than a deliberate boundary.\n\n### Reproducer\n\nEach snippet is the same flow — a request parameter reaching `subprocess.call(..., shell=True)` — differing only in how the value passes through a list.\n\n```python\n# reported\ndef handler():\n    user = request.args.get(\"cmd\")\n    acc = [user]\n    subprocess.call(acc[0], shell=True)\n\n# reported\ndef handler():\n    user = request.args.get(\"cmd\")\n    acc = []\n    acc.append(user)\n    subprocess.call(acc[0], shell=True)\n\n# NOT reported\ndef handler():\n    user = request.args.get(\"cmd\")\n    acc = []\n    acc.extend([user])\n    subprocess.call(acc[0], shell=True)\n\n# NOT reported\ndef handler():\n    user = request.args.get(\"cmd\")\n    acc = []\n    acc.insert(0, user)\n    subprocess.call(acc[0], shell=True)\n\n# NOT reported\ndef handler():\n    user = request.args.get(\"cmd\")\n    acc = []\n    acc += [user]\n    subprocess.call(acc[0], shell=True)\n```\n\n### Results\n\n`codeql database analyze \u003cdb> codeql/python-queries:Security/CWE-078/CommandInjection.ql`\n\n| construct | reported |\n|---|---|\n| `acc = [user]` | yes |\n| `acc.append(user)` | yes |\n| `acc.extend([user])` | **no** |\n| `acc.extend(other)` where `other = [user]` | **no** |\n| `acc.extend([user])` then `for x in acc:` | **no** |\n| `acc.insert(0, user)` | **no** |\n| `acc += [user]` | **no** |\n\n### Environment\n\n- CodeQL CLI **2.26.2** (bundle `codeql-bundle-osx64`), macOS arm64\n- query: shipped `Security/CWE-078/CommandInjection.ql`, unmodified\n- the same asymmetry appears with `Security/CWE-022/PathInjection.ql` and `Security/CWE-089/SqlInjection.ql`\n\n### Controls\n\n- `acc = [user]` and `acc.append(user)` **are** reported, so the query, source and sink all work on these files.\n- A variant where the value comes from a local constant instead of `request.args` is **not** reported, so the rule is source-dependent rather than firing on shape.\n- All files were present in the database source archive, so the silences are misses rather than unanalysed files.\n\n### Note\n\n`append` in Go is tracked as #14116. This is the Python analogue for the other three mutation forms.\n","author":{"url":"https://github.com/espressolee","@type":"Person","name":"espressolee"},"datePublished":"2026-08-10T01:47:23Z","url":"https://github.com/github/codeql/issues/22305"}