fix(python): regard pair children as data sources (#1611)

Bearer · May 27, 2024 · 9947948 · 9947948
1 parent 14e0918
commit 9947948
Show file tree

Hide file tree

Showing 5 changed files with 61 additions and 1 deletion.
diff --git a/internal/languages/python/.snapshots/TestPair--pair.yml b/internal/languages/python/.snapshots/TestPair--pair.yml
@@ -0,0 +1,30 @@
+high:
+    - rule:
+        cwe_ids:
+            - "42"
+        id: pair_test
+        title: Test detection filter dictionary pair statements
+        description: Test detection filter dictionary pair statements
+        documentation_url: ""
+      line_number: 4
+      full_filename: pair.py
+      filename: pair.py
+      source:
+        location:
+            start: 4
+            end: 4
+            column:
+                start: 1
+                end: 46
+      sink:
+        location:
+            start: 4
+            end: 4
+            column:
+                start: 1
+                end: 46
+        content: ""
+      parent_line_number: 4
+      fingerprint: ccf6bc0c73d9320075b1353d72b65703_0
+      old_fingerprint: ccf6bc0c73d9320075b1353d72b65703_0
+
diff --git a/internal/languages/python/analyzer/analyzer.go b/internal/languages/python/analyzer/analyzer.go
@@ -37,7 +37,7 @@ func (analyzer *analyzer) Analyze(node *sitter.Node, visitChildren func() error)
 		return analyzer.analyzeSubscript(node, visitChildren)
 	case "call":
 		return analyzer.analyzeCall(node, visitChildren)
-	case "argument_list", "expression_statement", "list", "tuple", "unary_operator", "binary_operator":
+	case "pair", "argument_list", "expression_statement", "list", "tuple", "unary_operator", "binary_operator":
 		return analyzer.analyzeGenericOperation(node, visitChildren)
 	case "parenthesized_expression", "interpolation":
 		return analyzer.analyzeGenericConstruct(node, visitChildren)

diff --git a/internal/languages/python/python_test.go b/internal/languages/python/python_test.go
@@ -22,6 +22,9 @@ var importRule []byte
 //go:embed testdata/subscript_rule.yml
 var subscriptRule []byte
 
+//go:embed testdata/pair_rule.yml
+var pairRule []byte
+
 func TestDatatypes(t *testing.T) {
 	testhelper.GetRunner(t, datatypesRule, "python").RunTest(t, "./testdata/datatypes", ".snapshots/")
 }
@@ -41,3 +44,7 @@ func TestImport(t *testing.T) {
 func TestSubscript(t *testing.T) {
 	testhelper.GetRunner(t, subscriptRule, "python").RunTest(t, "./testdata/subscript", ".snapshots/")
 }
+
+func TestPair(t *testing.T) {
+	testhelper.GetRunner(t, pairRule, "python").RunTest(t, "./testdata/pair", ".snapshots/")
+}
diff --git a/internal/languages/python/testdata/pair/pair.py b/internal/languages/python/testdata/pair/pair.py
@@ -0,0 +1,4 @@
+user_input = input("Enter username: ")
+
+# collection is some mongodo collection
+collection.find_one({"username": user_input})
diff --git a/internal/languages/python/testdata/pair_rule.yml b/internal/languages/python/testdata/pair_rule.yml
@@ -0,0 +1,19 @@
+languages:
+  - python
+patterns:
+  - pattern: collection.find_one($<...>$<USER_INPUT>$<...>)
+    filters:
+      - variable: USER_INPUT
+        detection: pair_test_user_input
+        scope: result
+auxiliary:
+  - id: pair_test_user_input
+    patterns:
+      - input()
+severity: high
+metadata:
+  description: Test detection filter dictionary pair statements
+  remediation_message: Test detection filter dictionary pair statements
+  cwe_id:
+    - 42
+  id: pair_test