Skip to content

Commit 6b28575

Browse files
Fix taint tracking query
1 parent f52e3dc commit 6b28575

File tree

1 file changed

+10
-3
lines changed

1 file changed

+10
-3
lines changed

docs/codeql/codeql-language-guides/analyzing-data-flow-in-python.rst

Lines changed: 10 additions & 3 deletions
Original file line numberDiff line numberDiff line change
@@ -303,6 +303,11 @@ This query shows a data flow configuration that uses all network input as data s
303303

304304
.. code-block:: ql
305305
306+
/**
307+
* @kind path-problem
308+
* @problem.severity warning
309+
* @id filesystemacess
310+
*/
306311
import python
307312
import semmle.python.dataflow.new.DataFlow
308313
import semmle.python.dataflow.new.TaintTracking
@@ -319,11 +324,13 @@ This query shows a data flow configuration that uses all network input as data s
319324
}
320325
}
321326
327+
import RemoteToFileFlow::PathGraph
328+
322329
module RemoteToFileFlow = TaintTracking::Global<RemoteToFileConfiguration>;
323330
324-
from DataFlow::Node input, DataFlow::Node fileAccess
325-
where RemoteToFileFlow::flow(input, fileAccess)
326-
select fileAccess, "This file access uses data from $@.",
331+
from RemoteToFileFlow::PathNode input, RemoteToFileFlow::PathNode fileAccess
332+
where RemoteToFileFlow::flowPath(input, fileAccess)
333+
select fileAccess.getNode(), input, fileAccess, "This file access uses data from $@.",
327334
input, "user-controllable input."
328335
329336
This data flow configuration tracks data flow from environment variables to opening files:

0 commit comments

Comments
 (0)