Skip to content

Python: Model CookieWrites from HeaderWrites #16696

New issue

Have a question about this project? Sign up for a free GitHub account to open an issue and contact its maintainers and the community.

Sign up for GitHub

By clicking “Sign up for GitHub”, you agree to our terms of service and privacy statement. We’ll occasionally send you account related emails.

Already on GitHub? Sign in to your account

Merged
merged 12 commits into from
Jul 11, 2024
Merged

Python: Model CookieWrites from HeaderWrites #16696

Changes from 1 commit
Commits
Show all changes
12 commits
Select commit Hold shift + click to select a range
b71ba7c
Move Header Write derrived concepts to Concepts
joefarebrother May 28, 2024
d11f58f
Add cookie header write concept from experimental.
joefarebrother May 28, 2024
6b8080a
Update concept tests for header writes
joefarebrother Jun 6, 2024
a0201e9
Update tests for new cookie write from headers
joefarebrother Jun 6, 2024
7704801
Change fastapi raw cookie header models to header write models
joefarebrother Jun 21, 2024
5ced5c0
Add django header writes
joefarebrother Jun 21, 2024
79c0ed6
Add additional fastapi mheader write models
joefarebrother Jun 21, 2024
c404f00
Add additional header write models for aiohttp and tornado + added qldoc
joefarebrother Jun 24, 2024
d0f735a
Update tests for restframework
joefarebrother Jun 24, 2024
0901b3d
Add change note
joefarebrother Jun 24, 2024
6538d22
Fix tornado model of httheaders.add.
joefarebrother Jun 26, 2024
b81d41b
Add django header write models for direct subscript write
joefarebrother Jul 1, 2024
File filter

Filter by extension

Filter by extension
Conversations
Failed to load comments.
Loading
Jump to
Jump to file
Failed to load files.
Loading
Diff view
Diff view
23 changes: 23 additions & 0 deletions python/ql/lib/semmle/python/Concepts.qll
View file
Open in desktop
Original file line number Diff line number Diff line change
Expand Up @@ -1234,6 +1234,29 @@ module Http {
}
}

/** A write to a `Set-Cookie` header that sets a cookie directly. */
private class CookieHeaderWrite extends CookieWrite::Range instanceof Http::Server::ResponseHeaderWrite
{
CookieHeaderWrite() {
exists(StringLiteral str |
str.getText() = "Set-Cookie" and
Copy link
Member

Choose a reason for hiding this comment

The reason will be displayed to describe this comment to others. Learn more.

should this be case sensitive? I see this was fixed later

DataFlow::exprNode(str)
.(DataFlow::LocalSourceNode)
.flowsTo(this.(Http::Server::ResponseHeaderWrite).getNameArg())
)
}

override DataFlow::Node getNameArg() {
result = this.(Http::Server::ResponseHeaderWrite).getValueArg()
}
Copy link
Member

Choose a reason for hiding this comment

The reason will be displayed to describe this comment to others. Learn more.

When getHeaderArg is implemented, I would expect both name+value to be none(). I see this was fixed later.


override DataFlow::Node getHeaderArg() {
result = this.(Http::Server::ResponseHeaderWrite).getValueArg()
}

override DataFlow::Node getValueArg() { none() }
}

/**
* A data-flow node that enables or disables Cross-site request forgery protection
* in a global manner.
Expand Down