CodeQL第一弹-数据库创建与查询

1
java.sql.Statement.executeQuery(String sql)
2
java.sql.Statement.execute(String sql)

1
mysqli_query()
2
PDO::query()

1
if (StringUtils.isNumeric(input)) { ... }

1
/**
2
 * @kind path-problem
3
 * @name CVE-2025-54802 (narrowed): pyLoad CNL addcrypted arbitrary file write
4
 * @description Tainted HTTP input in cnl_blueprint.addcrypted flowing into open(..., ...) filename (arbitrary file write).
5
 * @id python/cve-2025-54802/narrow
6
 * @severity high
7
 * @precision high
8
 * @tags security, taint, path-traversal, file-write
9
 */
10
import python
11
import semmle.python.dataflow.new.DataFlow
12
import semmle.python.dataflow.new.TaintTracking
13
import semmle.python.dataflow.new.RemoteFlowSources
14

15
/** ---------- Helpers ---------- */
16
predicate calleeIsGlobalName(DataFlow::CallCfgNode call, string nm) {
17
  call.getFunction().asCfgNode().getNode() instanceof Name and
18
  call.getFunction().asCfgNode().getNode().(Name).getId() = nm
19
}
20

21
/** limit to cnl_blueprint.py */
22
predicate inCnlBlueprint(DataFlow::Node n) {
23
  n.getLocation().getFile().getBaseName() = "cnl_blueprint.py"
24
}
25

26
/** limit to function addcrypted */
27
predicate inAddcrypted(DataFlow::Node n) {
28
  n.getEnclosingCallable().getScope().getName() = "addcrypted"
29
}
30

31
/** ---------- Config ---------- */
32
module CnlWriteConfig implements DataFlow::ConfigSig {
33
  /**
34
   * Sources: 仅追踪该文件/函数内的远程输入（Flask request.*）等
35
   */
36
  predicate isSource(DataFlow::Node source) {
37
    source instanceof RemoteFlowSource and
38
    inCnlBlueprint(source) and
39
    inAddcrypted(source)
40
  }
41

42
  /**
43
   * Sinks:
44
   *  - 情形 A: open(<tainted path>, ...) 的第 0 个参数（原先的 sink）
45
   *  - 情形 B: receiver of .write(...)（例如 fp.write(...)） —— 需要 isAdditionalFlowStep 将 open 的 filename taint 传播到 open 返回值/with-item
46
   */
47
  predicate isSink(DataFlow::Node sink) {
48
    (
49
      // A: open(...) 的第 0 参数
50
      exists(DataFlow::CallCfgNode call |
51
        calleeIsGlobalName(call, "open") and
52
        sink = call.getArg(0) and
53
        inCnlBlueprint(sink) and
54
        inAddcrypted(sink)
55
      )
56
    )
57
    or
58
    (
59
      // B: 成员调用 .write(...) 的 receiver 作为 sink
60
      // 这里用 CallCfgNode 来匹配成员调用（call.getFunction().asCfgNode().getNode() 为 Attribute）
61
      exists(DataFlow::CallCfgNode call |
62
        call.getFunction() instanceof DataFlow::AttrRead and
63
        // Attribute 节点的属性名为 "write"
64
        call.getFunction().(DataFlow::AttrRead).getAttributeName() = "write" and
65
        // 将 Attribute 的 qualifier（receiver）作为 sink 节点
66
        sink = call.getFunction().(DataFlow::AttrRead).getObject() and
67
        inCnlBlueprint(sink) and inAddcrypted(sink)
68
      )
69
    )
70
  }
71

72
  /**
73
   * isAdditionalFlowStep:
74
   * 把 open(...) 的 filename 参数传播到 open() 的调用表达式/返回值（call 节点），
75
   * 并处理 with-item 的情形（wi），以便 open 返回值在后续绑定到变量（如 fp）时能继承 taint。
76
   *
77
   * src 和 dst 都是 DataFlow::Node（可以是 CallCfgNode / WithItem /其它表达式节点）
78
   */
79
  predicate isAdditionalFlowStep(DataFlow::Node src, DataFlow::Node dst) {
80
    (
81
      // 情形 1: 普通 open(...) 调用：把 arg(0) -> call（call 表示调用表达式/返回值）
82
      exists(DataFlow::CallCfgNode call |
83
        calleeIsGlobalName(call, "open") and
84
        src = call.getArg(0) and
85
        dst = call and
86
        inCnlBlueprint(src) and inAddcrypted(src) and
87
        inCnlBlueprint(dst) and inAddcrypted(dst)
88
      )
89
    )
90
  }
91

92
  /**
93
   * 不设置净化器（为了命中未修补版本）
94
   */
95
  predicate isSanitizer(DataFlow::Node node) {
96
    none()
97
  }
98
}
99

100
module Flow = TaintTracking::Global<CnlWriteConfig>;
101
import Flow::PathGraph
102

103
from Flow::PathNode src, Flow::PathNode sink
104
where Flow::flowPath(src, sink)
105
select sink.getNode(), src, sink,
106
  "Untrusted data in cnl_blueprint.addcrypted flows into file write (open). Potential path traversal → arbitrary file write.",
107
  src, "source", sink, "sink"

1
isSource
2
isSink
3
isSanitizer
4
isAdditionalFlowStep

1
python-database/
2
├── db-python/           # Python 特定的数据库文件
3
├── log/                 # 提取日志
4
├── src. zip              # 源代码副本
5
└── codeql-database.yml  # 数据库元数据

1
代码 -> AST -> TRAP 文件 -> 关系数据库 -> CodeQL 查询

1
cpp-database/
2
├── db-cpp/
3
│   ├── default/
4
│   │   ├── functions.rel      # 函数定义
5
│   │   ├── classes. rel        # 类和结构体
6
│   │   ├── variables.rel      # 变量
7
│   │   ├── pointers.rel       # 指针关系
8
│   │   ├── calls.rel          # 函数调用
9
│   │   ├── macros.rel          # 宏定义
10
│   │   └── templates.rel       # 模板实例化
11
├── log/
12
│   ├── build-tracer.log       # 构建追踪日志
13
│   └── database-create.log
14
├── src.zip
15
└── codeql-database. yml

1
{
2
  "version": "2.1.0",
3
  "$schema": "https://json.schemastore.org/sarif-2.1.0.json",
4
  "runs": [
5
    {
6
      "tool": {
7
        "driver": {
8
          "name": "CodeQL",
9
          "informationUri": "https://codeql.github.com",
10
          "rules": [
11
            {
12
              "id": "js/incomplete-sanitization",
13
              "shortDescription": { "text": "Incomplete input sanitization" },
14
              "helpUri": "https://codeql.github.com/docs/..."
15
            }
16
          ]
17
        }
18
      },
19
      "results": [
20
        {
21
          "ruleId": "js/incomplete-sanitization",
22
          "message": { "text": "Unsanitized user input flows into a SQL query." },
23
          "locations": [
24
            {
25
              "physicalLocation": {
26
                "artifactLocation": { "uri": "src/db/query.js" },
27
                "region": { "startLine": 42 }
28
              }
29
            }
30
          ],
31
          "level": "error"
32
        }
33
      ]
34
    }
35
  ]
36
}

1
{
2
  "dataFlowPath": [
3
    {
4
      "threadFlows": [
5
        {
6
          "steps": [
7
            {
8
              "stepNumber": 1,
9
              "location": {
10
                "file": "backend/app.py",
11
                "startLine": 587,
12
                "startColumn": 12,
13
                "endColumn": 24,
14
                "description": "ControlFlowNode for Attribute",
15
                "nodeType": "Source"
16
              }
17
            },
18
            {
19
              "stepNumber": 2,
20
              "location": {
21
                "file": "backend/app.py",
22
                "startLine": 587,
23
                "startColumn": 5,
24
                "endColumn": 9,
25
                "description": "ControlFlowNode for data",
26
                "nodeType": "Intermediate"
27
              }
28
            },
29
            {
30
              "stepNumber": 3,
31
              "location": {
32
                "file": "backend/app.py",
33
                "startLine": 593,
34
                "startColumn": 22,
35
                "endColumn": 26,
36
                "description": "ControlFlowNode for data",
37
                "nodeType": "Intermediate"
38
              }
39
            },
40
            {
41
              "stepNumber": 4,
42
              "location": {
43
                "file": "backend/app.py",
44
                "startLine": 593,
45
                "startColumn": 22,
46
                "endColumn": 54,
47
                "description": "ControlFlowNode for Attribute()",
48
                "nodeType": "Intermediate"
49
              }
50
            },
51
            {
52
              "stepNumber": 5,
53
              "location": {
54
                "file": "backend/app.py",
55
                "startLine": 593,
56
                "startColumn": 5,
57
                "endColumn": 19,
58
                "description": "ControlFlowNode for experiment_dir",
59
                "nodeType": "Intermediate"
60
              }
61
            },
62
            {
63
              "stepNumber": 6,
64
              "location": {
65
                "file": "backend/app.py",
66
                "startLine": 632,
67
                "startColumn": 13,
68
                "endColumn": 31,
69
                "description": "ControlFlowNode for abs_experiment_dir",
70
                "nodeType": "Intermediate"
71
              }
72
            },
73
            {
74
              "stepNumber": 7,
75
              "location": {
76
                "file": "backend/app.py",
77
                "startLine": 639,
78
                "startColumn": 13,
79
                "endColumn": 28,
80
                "description": "ControlFlowNode for experiment_file",
81
                "nodeType": "Intermediate"
82
              }
83
            },
84
            {
85
              "stepNumber": 8,
86
              "location": {
87
                "file": "backend/app.py",
88
                "startLine": 640,
89
                "startColumn": 35,
90
                "endColumn": 50,
91
                "description": "ControlFlowNode for experiment_file",
92
                "nodeType": "Sink"
93
              }
94
            }
95
          ]
96
        }
97
      ]
98
    }
99
  ]
100
}

1
packs/
2
  my-security-pack/
3
    codeql-pack.yml                # pack 声明（必须）
4
    codeql-pack.lock.yml           # lock 文件（可选但推荐提交）
5
    queries/
6
      javascript/
7
        sql-injection.ql
8
        crypto-check.ql
9
    ql/                            # 可选：自定义 QL 库源码
10
      mylib/
11
        MyHelpers.qll
12
    lib/                           # 可选：用来打包的 JS/TS 辅助文件（若有）
13
    tests/
14
      test-suite.qls
15
    docs/
16
      README.md

1
---
2
library: false
3
warnOnImplicitThis: false
4
name: getting-started/codeql-extra-queries-python
5
version: 1.0.0
6
dependencies:
7
  codeql/python-all: ^4.0.17

1
---
2
lockVersion: 1.0.0
3
dependencies:
4
  codeql/concepts:
5
    version: 0.0.7
6
  codeql/controlflow:
7
    version: 2.0.17
8
  codeql/dataflow:
9
    version: 2.0.17
10
  codeql/mad:
11
    version: 1.0.33
12
  codeql/python-all:
13
    version: 4.0.17
14
  codeql/regex:
15
    version: 1.0.33
16
  codeql/ssa:
17
    version: 2.0.9
18
  codeql/threat-models:
19
    version: 1.0.33
20
  codeql/tutorial:
21
    version: 1.0.33
22
  codeql/typetracking:
23
    version: 2.0.17
24
  codeql/util:
25
    version: 2.0.20
26
  codeql/xml:
27
    version: 1.0.33
28
  codeql/yaml:
29
    version: 1.0.33
30
compiled: false