diff --git a/rules/python/django/path_using_user_input.yml b/rules/python/django/path_using_user_input.yml index 566f4e8b..61170167 100644 --- a/rules/python/django/path_using_user_input.yml +++ b/rules/python/django/path_using_user_input.yml @@ -1,34 +1,45 @@ imports: - python_shared_common_user_input + - python_shared_lang_import4 patterns: - - pattern: FileSystemStorage($<...>$$<...>) + - pattern: $($<...>$$<...>) filters: - variable: USER_INPUT detection: python_shared_common_user_input scope: result + - variable: FILE_SYSTEM_STORAGE + detection: python_shared_lang_import4 + scope: cursor + filters: + - variable: MODULE1 + values: [django] + - variable: MODULE2 + values: [core] + - variable: MODULE3 + values: [files] + - variable: MODULE4 + values: [storage] + - variable: NAME + values: [FileSystemStorage] - pattern: $.save($, $<...>) filters: - variable: DEFAULT_STORAGE - detection: python_django_path_using_user_input_default_storage + detection: python_shared_lang_import4 scope: cursor + filters: + - variable: MODULE1 + values: [django] + - variable: MODULE2 + values: [core] + - variable: MODULE3 + values: [files] + - variable: MODULE4 + values: [storage] + - variable: NAME + values: [default_storage] - variable: USER_INPUT detection: python_shared_common_user_input scope: result -auxiliary: - - id: python_django_path_using_user_input_default_storage - patterns: - - pattern: $ - filters: - - variable: DEFAULT_STORAGE - regex: \A(django\.core\.files\.storage\.)?default_storage\z - - pattern: from $ import $default_storage - filters: - - variable: STORAGE - regex: \A(django\.core\.files\.)?storage\z - - pattern: from $ import default_storage as $$<_> - filters: - - variable: STORAGE - regex: \A(django\.core\.files\.)?storage\z languages: - python severity: high diff --git a/rules/python/lang/path_using_user_input.yml b/rules/python/lang/path_using_user_input.yml index 13d5d748..aa2f9063 100644 --- a/rules/python/lang/path_using_user_input.yml +++ b/rules/python/lang/path_using_user_input.yml @@ -1,20 +1,27 @@ imports: - python_shared_common_user_input + - python_shared_lang_import1 patterns: - pattern: open($$<...>) filters: - variable: USER_INPUT detection: python_shared_common_user_input scope: result - - pattern: fileinput.$($<...>files=$$<...>) + - pattern: $($<...>files=$$<...>) filters: + - variable: FILEINPUT + detection: python_shared_lang_import1 + scope: cursor + filters: + - variable: MODULE1 + values: [fileinput] + - variable: NAME + values: + - input + - FileInput - variable: USER_INPUT detection: python_shared_common_user_input scope: result - - variable: METHOD - values: - - input - - FileInput - pattern: io.$($$<...>) filters: - variable: USER_INPUT @@ -158,7 +165,7 @@ metadata: ```python BASE_DIRECTORY = '/path/to/safe/directory' my_path = os.path.abspath(os.path.join(BASE_DIRECTORY, user_input)) - + if my_path.startswith(BASE_DIRECTORY): open(my_path) ``` diff --git a/tests/python/django/path_using_user_input/testdata/main.py b/tests/python/django/path_using_user_input/testdata/main.py index ebe1412f..0251d6a0 100644 --- a/tests/python/django/path_using_user_input/testdata/main.py +++ b/tests/python/django/path_using_user_input/testdata/main.py @@ -1,5 +1,7 @@ +from django.core.files.storage import FileSystemStorage as FSS + # bearer:expected python_django_path_using_user_input -fs = FileSystemStorage(form.cleaned_data["storage_path"]) +fs = FSS(form.cleaned_data["storage_path"]) request_file = request.FILES['document'] file = fs.save(request_file) diff --git a/tests/python/lang/path_using_user_input/testdata/main.py b/tests/python/lang/path_using_user_input/testdata/main.py index 9182b276..09935d97 100644 --- a/tests/python/lang/path_using_user_input/testdata/main.py +++ b/tests/python/lang/path_using_user_input/testdata/main.py @@ -3,12 +3,13 @@ os.mkdir(user_upload_path) print("What file would you like to read?") -filepath = input() +filepath = input() # bearer:expected python_lang_path_using_user_input open(filepath) +import fileinput as fi # bearer:expected python_lang_path_using_user_input -with fileinput.input(files=(filepath), encoding="utf-8") as f: +with fi.input(files=(filepath), encoding="utf-8") as f: for line in f: process(line)