René's URL Explorer Experiment

Title: Python: Add taint flow through list.extend and list.insert by Copilot · Pull Request #22310 · github/codeql · GitHub

Open Graph Title: Python: Add taint flow through list.extend and list.insert by Copilot · Pull Request #22310 · github/codeql

X Title: Python: Add taint flow through list.extend and list.insert by Copilot · Pull Request #22310 · github/codeql

Description: CodeQL's Python taint tracking propagated through list.append but not through list.extend, list.insert, or +=, causing security queries (e.g. CommandInjection.ql) to silently miss flows that differ only in which list-mutation idiom is used. acc = [] acc.extend([user]) # not reported acc.insert(0, user) # not reported subprocess.call(acc[0], shell=True) Flow summaries Added ListExtend flow summary in python/ql/lib/semmle/python/frameworks/Stdlib.qll: propagates element content from the argument's ListElement/SetElement/AnyTupleElement into the receiver's ListElement, plus a blunt taint fallback — same shape as the existing ListAppend/ListSummary/SetSummary models. Added ListInsert flow summary: propagates the inserted value into the receiver's ListElement, plus a blunt taint fallback. Tests test_collections.py: list_extend() now asserts tainted (previously MISSING); added list_extend_iteration() and list_insert() covering the new summaries. test_builtins.py: added precise flow-label tests for list.extend and list.insert. Known remaining gap: += acc += [user] still isn't tracked. It desugars to Python's + operator, handled by the shared concatStep, which is a global additional taint step — the shared dataflow library deliberately withholds "implicit content read" privileges from such global steps (only sinks and locally-defined config steps get them), so a list value flowing through + isn't unwrapped to see its tainted content. Fixing this properly needs new content-aware store/read steps for binary + in the core dataflow library, a materially larger change than a library flow summary. This is left as a documented MISSING test case (list_iadd()), consistent with the pre-existing, similarly-unaddressed dict | merge gap in the same test file. Fixes #22305

Open Graph Description: CodeQL's Python taint tracking propagated through list.append but not through list.extend, list.insert, or +=, causing security queries (e.g. CommandInjection.ql) to silently miss flows that di...

X Description: CodeQL's Python taint tracking propagated through list.append but not through list.extend, list.insert, or +=, causing security queries (e.g. CommandInjection.ql) to silently miss flows tha...

Opengraph URL: https://github.com/github/codeql/pull/22310

X: @github

direct link

Domain: github.com

Links:

Viewport: width=device-width