Adds InvalidRegex TaintConfiguration Error type #743
Closed
Conversation
This file contains bidirectional Unicode text that may be interpreted or compiled differently than what appears below. To review, open the file in an editor that reveals hidden Unicode characters.
Learn more about bidirectional Unicode characters
|
Footnotes:
|
|
Hey @abishekvashok, I'm sorry, this PR slipped by me and I just noticed. Let me forward it to the Pysa team for you. |
|
@connernilsen thank you. There's also #739 and #741 if you don't mind 😁 Also do take your time :) |
arthaud
approved these changes
Jul 19, 2023
Comment on lines
916
to
935
| let json_string_member_with_location ~path key value = | ||
| json_exception_to_error ~path ~section:key (fun () -> | ||
| let node = JsonAst.Json.Util.member_exn key value in | ||
| let value = JsonAst.Json.Util.to_string_exn node in | ||
| let location = JsonAst.Json.Util.to_location_exn node in | ||
| Result.return (value, location)) | ||
| in |
There was a problem hiding this comment.
looks like #741 also adds this, so we will need to be careful when merging this.
EDIT: Just noticed this was already mentioned above..
|
@arthaud has imported this pull request. If you are a Meta employee, you can view this diff on Phabricator. |
Adds new error type that can handle Re2 compilation failed exceptions. Previously, when a regex compilation failed, the exception wasn't caught and the program terminated abnormally. Catch the exception, and throw a custom TaintConfiguration Error to expose the underlying reason why the compilation failed and exit in a more user-friendly fashion. Signed-off-by: Abishek V Ashok <abishekvashok@gmail.com>
abishekvashok
force-pushed
the
malformed-regexz
branch
from
8299374
to
f2703e3
Compare
|
@arthaud rebased on top of main :) You may want to re-import. |
Sign up for free
to join this conversation on GitHub.
Already have an account?
Sign in to comment
Add this suggestion to a batch that can be applied as a single commit.
This suggestion is invalid because no changes were made to the code.
Suggestions cannot be applied while the pull request is closed.
Suggestions cannot be applied while viewing a subset of changes.
Only one suggestion per line can be applied in a batch.
Add this suggestion to a batch that can be applied as a single commit.
Applying suggestions on deleted lines is not supported.
You must change the existing code in this line in order to create a valid suggestion.
Outdated suggestions cannot be applied.
This suggestion has been applied or marked resolved.
Suggestions cannot be applied from pending reviews.
Suggestions cannot be applied on multi-line comments.
Suggestions cannot be applied while the pull request is queued to merge.
Suggestion cannot be applied right now. Please check back later.
Pre-submission checklist
pip install -r requirements-dev.txt && pre-commit installpre-commit runSummary
Adds new error type that can handle Re2 compilation failed exceptions. Previously, when a regex compilation failed, the exception wasn't caught and the program terminated abnormally.
Catch the exception, and throw a custom TaintConfiguration Error to expose the underlying reason why the compilation failed and exit in a more user-friendly fashion.
Test Plan
{ "sources": [ { "name": "CustomUserControlled", "comment": "use to annotate user input" } ], "implicit_sources": { "literal_strings": [ { "regexp": "\\d{1Z,3}(\\.\\d{1,3}+", "kind": "CustomUserControlled", "description": "String that looks like an IP address." } ] }, "sinks": [ { "name": "CodeExecution", "comment": "use to annotate execution of python code" } ], "features": [], "rules": [ { "name": "Possible RCE:", "code": 5001, "sources": [ "CustomUserControlled" ], "sinks": [ "CodeExecution" ], "message_format": "User specified data may reach a code execution sink" } ] }Before:
After:
Fixes part of: MLH-Fellowship#82
Signed-off-by: Abishek V Ashok abishekvashok@gmail.com
make test