René's URL Explorer Experiment

Title: Python: Remove imprecise container steps #2 by owen-mc · Pull Request #21888 · github/codeql · GitHub

Open Graph Title: Python: Remove imprecise container steps #2 by owen-mc · Pull Request #21888 · github/codeql

X Title: Python: Remove imprecise container steps #2 by owen-mc · Pull Request #21888 · github/codeql

Description: Supersedes #17493. We used to have taint steps from any element of a collection to the entire collection (see here). These are very imprecise, leading to false positives (e.g. seen #17008 (comment) and #16976). They are also at odds with how other languages treat collections, see github/codeql-python-team#728 about this. We wish to keep the semantics, that if a collection is tainted, then all elements are considered tainted. Therefor we now try to not taint collections, if we have precise information about which elements are tainted. For a list, if an element is tainted, we do not know which one, so any read is potentially reading tainted information. There is not much difference between the list having content and the list being tainted. But for a dictionary, if an entry is tainted and we know which one, only reads of the appropriate key is reading tainted information. All other reads should ideally be considered safe (they used to not be). If we do not know that other keys are safe, e.g. if the collection came from an untrusted source, we can taint the collection itself, and all reads will be considered dangerous. So for collections with precise content, there is a big difference between having content and the collection being tainted. Thus we wish to remove these imprecise taint steps for tuples and dictionaries, where we track content precisely (we keep them for lists and sets, where content is imprecise anyway). Changes In this PR we do the following: remove tupleStoreStep and dictStoreStep from containerStep These are imprecise compared to the content being precise. add implicit reads to recover taint at sinks add implicit read steps for decoders to supplement the AdditionalTaintStep that now only covers when the full container is tainted. Status: Potential confusions: A comprehension is no longer tainted even if it has tainted elements. See the taint test for Tornado for an example. Dict.items is no longer tainted for a tainted dict (but Dict.values are). We could choose to change this. Improvements: Fixed FP in test_unpacking Fixed FP in CleartextLogging Nicer paths in NoSqlInjection test Closes #17493.

Open Graph Description: Supersedes #17493. We used to have taint steps from any element of a collection to the entire collection (see here). These are very imprecise, leading to false positives (e.g. seen #17008 (comment)...

X Description: Supersedes #17493. We used to have taint steps from any element of a collection to the entire collection (see here). These are very imprecise, leading to false positives (e.g. seen #17008 (comment)...

Opengraph URL: https://github.com/github/codeql/pull/21888

X: @github

direct link

Domain: github.com

Links:

Viewport: width=device-width