Add new state: Unicode compatibility normalization

未关闭
#19,706 2 条评论 0 个 reaction 已指派 0 人 在 GitHub 查看

还没有人认领这个 Issue。

评估

难度
4/5
预计耗时
3-5 天
新手友好度
35/100
Issue 类型
功能
描述清晰度
基本清楚
活跃度
停滞
技术栈
python
领域
security

调研方向

从 python/ql/lib/semmle/python/security/dataflow/PathInjectionQuery.qll 开始，尤其查看第 20-28 行，并将现有的路径规范化状态和安全检查状态与报告中的 Unicode 兼容规范化状态进行比较。使用 issue 中的图表跟踪所需的顺序；当查询在相关位置对兼容规范化进行建模且不遗漏任何情况时，即表示完成。

由索引模型根据 Issue 内容生成。

描述

Hey ,

I noticed that you are considering only two states:

  1. One regarding the path normalization if it is done or not before the safe check
  2. Second concerns the safe check.

as shown next:

https://github.com/github/codeql/blob/c1c0a705b9f14c0f577a9ae56a9d699e8b6e67d6/python/ql/lib/semmle/python/security/dataflow/PathInjectionQuery.qll#L20-L28

However, there is a third state that is a required one: Unicode normalized. If ever a Unicode normalization is performed with a compatibility algorithm (NFKC or NFKD), the query would miss some cases precisely those ones where the Unicode normalization is not performed before the path normalization and the safe check. I draw a little chart to depict my saying:

Image

The previous chart shows that when you consider a potential Unicode compatibility normalization, it is a required step before path normalization and safe check. If ever placed between the first two steps or after the last one, that would yield a vulnerable case that got missed due to the fact that the Unicode normalization may reintroduce unexpected special characters such as .. and /.

Regards
@Sim4n6

主要语言
CodeQL
星标
10.1k
派生
2.1k
平均合并
2 天 10 小时
30 天内合并 PR
134

贡献指南

打开贡献指南

从这里开始

  1. 先读完整个 Issue，再读项目的贡献指南。
  2. 在 Issue 下留言说明你要接手 —— 这能避免两个人做同样的事。
  3. Fork 仓库，在一个分支上完成修改。
  4. 提交 Pull Request，并在描述里引用这个 Issue 编号。

github/codeql 的其他 Issue

查看 github/codeql 的全部 Issue

相似的 Issue

更多 Security Issue

把新 issue 发到你的邮箱

精选适合新手参与的 GitHub issue 摘要。