Pysa Bug Pre-submission checklist [x] I've ch

This is a simple mistake. my_source()</cod

I did find this commit that maybe breaks SQLAlchemy 1.4? <a class="commit-link" data-h

Unable to get SQLAlchemy sinks to work about pyre-check HOT 4 CLOSED

cyounkins commented on May 27, 2024

Unable to get SQLAlchemy sinks to work

from pyre-check.

Comments (4)

arthaud commented on May 27, 2024 1

This is a simple mistake.

my_source() returns a source with kind Test.
engine.execute() has a sink with kind SQL.
There is a rule from source Test to sink Test: https://github.com/cyounkins/pysa-testing/blob/63395fc6b3ba826b1ebb9dec1c55abcadf4c7622/stubs/taint.config#L184-L192
but there is no rule for source Test to sink SQL. There is only one for UserControlled to SQL: https://github.com/cyounkins/pysa-testing/blob/63395fc6b3ba826b1ebb9dec1c55abcadf4c7622/stubs/taint.config#L197-L205
If I change that rule to also accept Test as a source, it does find the flows:

[
  {
    "line": 20,
    "column": 28,
    "stop_line": 20,
    "stop_column": 33,
    "path": "vuln.py",
    "code": 5005,
    "name": "SQL injection.",
    "description": "SQL injection. [5005]: Data from [Test] source(s) may reach [SQL] sink(s)",
    "define": "vuln.vulnerable_func"
  },
  {
    "line": 20,
    "column": 28,
    "stop_line": 20,
    "stop_column": 33,
    "path": "vuln.py",
    "code": 5005,
    "name": "SQL injection.",
    "description": "SQL injection. [5005]: Data from [Test] source(s) may reach [SQL] sink(s)",
    "define": "vuln.vulnerable_func"
  },
  {
    "line": 23,
    "column": 12,
    "stop_line": 23,
    "stop_column": 17,
    "path": "vuln.py",
    "code": 5002,
    "name": "Test flow",
    "description": "Test flow [5002]: Data from [Test] source(s) may reach [Test] sink(s)",
    "define": "vuln.vulnerable_func"
  }
]

from pyre-check.

cyounkins commented on May 27, 2024

I did find this commit that maybe breaks SQLAlchemy 1.4? c93e0a1

from pyre-check.

arthaud commented on May 27, 2024

Hi, thanks for reaching out.
I am able to reproduce, I will need more time to look into this.

from pyre-check.

cyounkins commented on May 27, 2024

Ahh thank you! I apologize for the waste of time.

from pyre-check.

Recommend Projects