@@ -36,7 +36,7 @@ In this example, we'll show how to add the following argument, passed to **sudo*
3636
3737.. code-block :: python
3838
39- from fabric.api import sudo
39+ from fabric.operations import sudo
4040 sudo(cmd) # <-- add 'cmd' as a taint sink
4141
4242 Note that this sink is already recognized by the CodeQL Python analysis, but for this example, you could use the following data extension:
@@ -48,16 +48,16 @@ Note that this sink is already recognized by the CodeQL Python analysis, but for
4848 pack : codeql/python-all
4949 extensible : sinkModel
5050 data :
51- - ["fabric", "Member[api ].Member[sudo].Argument[0]", "command-injection"]
51+ - ["fabric", "Member[operations ].Member[sudo].Argument[0]", "command-injection"]
5252
5353
5454 - Since we're adding a new sink, we add a tuple to the **sinkModel ** extensible predicate.
5555- The first column, **"fabric" **, identifies a set of values from which to begin the search for the sink.
5656 The string **"fabric" ** means we start at the places where the codebase imports the package **fabric **.
5757- The second column is an access path that is evaluated from left to right, starting at the values that were identified by the first column.
5858
59- - **Member[api ] ** selects accesses to the **api ** package .
60- - **Member[sudo] ** selects accesses to the **sudo ** function in the **api ** package .
59+ - **Member[operations ] ** selects accesses to the **operations ** module .
60+ - **Member[sudo] ** selects accesses to the **sudo ** function in the **operations ** module .
6161 - **Argument[0] ** selects the first argument to calls to that function.
6262
6363- **command-injection ** indicates that this is considered a sink for the command injection query.
0 commit comments