Commits on Aug 17, 2018

1. Taint propagates from methods of tainted objects …

   Previously
   
   `x = TAINT.lower()` would be tainted (due to special handling for
   assignment_call_nodes)
   
   but
   
   `x = str(TAINT.lower())` wouldn't be tainted.
   
   To fix this, `TAINT` is added to the RHS variables of
   `TAINT.lower()`.
   
   This will mean that e.g. `request` will be a RHS variable of
   `request.get()`, but I think that will be OK.
   
   In the test which changed, the additional line is because resp has
   become tainted.
   
   However, this still leaves the following false negatives to fix another
   day:
   
   `assert_vulnerable('result = str("%s" % str(TAINT.lower()))')  # FAILS`
   `assert_vulnerable('result = str("%s" % TAINT.lower().upper())') # FAILS`

   

   bcaller authored and Ben Caller committed Aug 17, 2018
   Configuration menu

   • View commit details
   • Copy full SHA for 8811343
   • Browse repository at this point

   Copy the full SHA

   8811343 View commit details

   Browse the repository at this point in the history