Skip to content

Conversation

yoff
Copy link
Contributor

@yoff yoff commented Jan 31, 2024

Recall that for

foo.f(data = d)

we can find d as moduleImport("foo").getMember("f").getKeywordParameter("data"). We will call this API path D.

We were already able to find value in

 d = {"key": value}
foo.f(d)

and

d["key"] = value
foo.f(d)

via D.getSubscript("key").

But we could not find 'value' in

 d = [value]
foo.f(d)

and

d[0] = value
foo.f(d)

at all. We can now find these via D.getIntSubscript(0).

Inspired by https://github.slack.com/archives/CPGHLR8DD/p1706707895922829

@yoff yoff added the Awaiting evaluation Do not merge yet, this PR is waiting for an evaluation to finish label Jan 31, 2024

predicate entryPoint(
DataFlow::Node argument, string parameterName, string functionName, DataFlow::Node outNode,
string alreadyModelled

Check warning

Code scanning / CodeQL

Misspelling

This variable name contains the non-US spelling 'modelled', which should instead be 'modeled'.

from
EntryPointsByQuery e, DataFlow::Node argument, string parameter, string functionName,
DataFlow::Node outNode, string alreadyModelled

Check warning

Code scanning / CodeQL

Misspelling

This variable name contains the non-US spelling 'modelled', which should instead be 'modeled'.
Sign up for free to join this conversation on GitHub. Already have an account? Sign in to comment
Labels
Awaiting evaluation Do not merge yet, this PR is waiting for an evaluation to finish Python
Projects
None yet
Development

Successfully merging this pull request may close these issues.

1 participant