Skip to content
New issue

Have a question about this project? Sign up for a free GitHub account to open an issue and contact its maintainers and the community.

By clicking “Sign up for GitHub”, you agree to our terms of service and privacy statement. We’ll occasionally send you account related emails.

Already on GitHub? Sign in to your account

Missed sink in loop in called function #964

Open
draftyfrog opened this issue Feb 1, 2025 · 0 comments
Open

Missed sink in loop in called function #964

draftyfrog opened this issue Feb 1, 2025 · 0 comments

Comments

@draftyfrog
Copy link

Pysa Bug

Pre-submission checklist
[x] I've checked the list of common issues and mine does not appear

Bug description
Please consider the following program source code

class MyClass:
    def my_function(self):
        self.function1("", "", self.source()) # NOT reported by pysa
        self.sink(self.source()) # Correctly reported by pysa

    def function1(self, arg1: str, arg2: str, arg3: str):
        for i in range(10):  
            arg0 = arg1 
            self.sink(arg3) # NOT reported by pysa
            arg1 = arg2
            arg2 = self.function2(arg1)  

    def function2(self, arg0: str):
        return arg0

    def source(self):
        return "Secret"

    def sink(self, param: str):
        pass

The call to sink in function1 is not detected by pysa, and all the statements around it seem to be responsible. If we for example remove one of the unnecessary assignments, replace the call to function2 with just another assignment or move all the statements out of the loop, pysa correctly reports the taint leak.

In my sources_sinks.pysa I declare source and sink as taint sources and sinks respectively (this config works as we can see with the detected leak in my_function):

def test.MyClass.source() -> TaintSource[TestSource]: ...
def test.MyClass.sink(param: TaintSink[TestSink]): ...

I call pysa via pyre analyze --save-results-to ./results/ --infer-self-tito and I'm using version 0.9.23

Sign up for free to join this conversation on GitHub. Already have an account? Sign in to comment
Labels
None yet
Projects
None yet
Development

No branches or pull requests

1 participant