Merge pull request #6330 from porcupineyhairs/pyPathTraversal

Python : Add Flask sinks for path injection query

Author: RasmusWL

python/ql/lib/semmle/python/frameworks/Flask.qll

@@ -519,4 +519,32 @@ module Flask {
 
     override DataFlow::Node getValueArg() { none() }
   }
+
+  /**
+   * A call to `flask.send_from_directory`.
+   *
+   * See https://flask.palletsprojects.com/en/1.1.x/api/#flask.send_from_directory
+   */
+  class FlaskSendFromDirectory extends FileSystemAccess::Range, DataFlow::CallCfgNode {
+    FlaskSendFromDirectory() {
+      this = API::moduleImport("flask").getMember("send_from_directory").getACall()
+    }
+
+    override DataFlow::Node getAPathArgument() {
+      result in [this.getArg(_), this.getArgByName(["directory", "filename"])]
+    }
+  }
+
+  /**
+   * A call to `flask.send_file`.
+   *
+   * See https://flask.palletsprojects.com/en/1.1.x/api/#flask.send_file
+   */
+  class FlaskSendFile extends FileSystemAccess::Range, DataFlow::CallCfgNode {
+    FlaskSendFile() { this = API::moduleImport("flask").getMember("send_file").getACall() }
+
+    override DataFlow::Node getAPathArgument() {
+      result in [this.getArg(0), this.getArgByName("filename_or_fp")]
+    }
+  }
 }

python/ql/test/library-tests/frameworks/flask/save_uploaded_file.py

@@ -1,6 +1,17 @@
-from flask import Flask, request
+from flask import Flask, request, send_from_directory, send_file
 app = Flask(__name__)
 
 @app.route("/save-uploaded-file")  # $routeSetup="/save-uploaded-file"
 def test_taint():  # $requestHandler
     request.files['key'].save("path") # $ getAPathArgument="path"
+
+
+@app.route("/path-injection")  # $routeSetup="/path-injection"
+def test_path():  # $requestHandler
+
+    send_from_directory("filepath","file")  # $ getAPathArgument="filepath" getAPathArgument="file"
+    send_file("file")  # $ getAPathArgument="file"
+
+    send_from_directory(directory="filepath","file") # $ getAPathArgument="filepath" getAPathArgument="file"
+    send_from_directory(filename="filepath","file") # $ getAPathArgument="filepath" getAPathArgument="file"
+    send_file(filename_or_fp="file")  # $ getAPathArgument="file"