coretrace-python-analyzer/plugins/models/python_stdlib/python_stdlib.py at 6976a28cf5ca475ddb5708ded30853707ea9575e · CoreTrace/coretrace-python-analyzer · GitHub

1
2
3
4
5
6
7
8
9
10
11
12
13
14
15
16
17
18
19
20
21
22
23
24
25
26
27
28
29
30
31
32
33
34
35
36
37
38
39
40
41
42
43
44
45
46
47
48
49
50
51
52
"""Security models for the Python standard library (architecture §16)."""

from __future__ import annotations

from typing import ClassVar

from coretrace_python.plugins import ModelPlugin
from coretrace_python.semantic.symbols import SymbolId
from coretrace_python.taint import Model, Sanitizer, Sink, Source, TaintKind, Validator


def _sym(path: str) -> SymbolId:
    return SymbolId(f"python.{path}")


class PythonStdlibModels(ModelPlugin):
    name: ClassVar[str] = "python-stdlib-models"
    models: ClassVar[tuple[Model, ...]] = (
        Source(_sym("builtins.input"), "stdin"),
        Source(_sym("sys.stdin"), "stdin"),
        Source(_sym("sys.argv"), "argv"),
        Source(_sym("os.environ"), "environment"),
        Source(_sym("subprocess.run.stdout"), "process-output"),
        Source(_sym("subprocess.check_output"), "process-output"),
        Source(_sym("subprocess.getoutput"), "process-output"),
        Source(_sym("subprocess.Popen.communicate"), "process-output"),
        Sink(_sym("os.system"), TaintKind.COMMAND),
        Sink(_sym("os.popen"), TaintKind.COMMAND),
        Sink(_sym("subprocess.run"), TaintKind.COMMAND),
        Sink(_sym("subprocess.call"), TaintKind.COMMAND),
        Sink(_sym("subprocess.check_call"), TaintKind.COMMAND),
        Sink(_sym("subprocess.check_output"), TaintKind.COMMAND),
        Sink(_sym("subprocess.Popen"), TaintKind.COMMAND),
        Sink(_sym("builtins.eval"), TaintKind.CODE),
        Sink(_sym("builtins.exec"), TaintKind.CODE),
        Sink(_sym("builtins.open"), TaintKind.PATH),
        Sink(_sym("os.remove"), TaintKind.PATH),
        Sink(_sym("os.unlink"), TaintKind.PATH),
        Sink(_sym("os.rmdir"), TaintKind.PATH),
        Sink(_sym("shutil.rmtree"), TaintKind.PATH),
        Sink(_sym("urllib.request.urlopen"), TaintKind.SSRF),
        *(
            Sink(_sym(f"sqlite3.connect{cursor}.{method}"), TaintKind.SQL)
            for cursor in ("", ".cursor")
            for method in ("execute", "executemany", "executescript")
        ),
        Sanitizer(_sym("shlex.quote"), TaintKind.COMMAND),
        Sanitizer(_sym("html.escape"), TaintKind.HTML),
        Sanitizer(_sym("os.path.basename"), TaintKind.PATH),
        Validator(_sym("re.fullmatch"), argument=1),
        Validator(_sym("re.compile.fullmatch")),
    )