GeezerVisonThe World Wide Web, restored to 800 pixels of glory. |
| Home|About|Gaming cabinet|Archives|How it works|Starter sites |
GeezerVison is showing github.com — codeql/python/ql/src/Security/CWE-022/PathInjection.ql at main · github/codeql Expand file tree/ Copy pathPathInjection.qlMore file actions 26 lines (24 loc) · 836 Bytes / Copy pathPathInjection.qlFile metadata and controls26 lines (24 loc) · 836 Bytes 1 2 3 4 5 6 7 8 9 10 11 12 13 14 15 16 17 18 19 20 21 22 23 24 25 26 /** * @name Uncontrolled data used in path expression * @description Accessing paths influenced by users can allow an attacker to access unexpected resources. * @kind path-problem * @problem.severity error * @security-severity 7.5 * @sub-severity high * @precision high * @id py/path-injection * @tags correctness * security * external/cwe/cwe-022 * external/cwe/cwe-023 * external/cwe/cwe-036 * external/cwe/cwe-073 * external/cwe/cwe-099 */ import python import semmle.python.security.dataflow.PathInjectionQuery import PathInjectionFlow::PathGraph from PathInjectionFlow::PathNode source, PathInjectionFlow::PathNode sink where PathInjectionFlow::flowPath(source, sink) select sink.getNode(), source, sink, "This path depends on a $@.", source.getNode(), "user-provided value" |
| You are visitor 01402520 — GeezerVison does not store the pages you look up. Best viewed with Netscape Navigator 4.7 or Internet Explorer 6 at 800×600. No cookies required. |