Skip to content

Python: fix 3 queries to use sources for the active threat model #22822

New issue

Have a question about this project? Sign up for a free GitHub account to open an issue and contact its maintainers and the community.

Sign up for GitHub

By clicking “Sign up for GitHub”, you agree to our terms of service and privacy statement. We’ll occasionally send you account related emails.

Already on GitHub? Sign in to your account

Open
owen-mc wants to merge 3 commits into
base: main
Choose a base branch
from
+106 −109
Open

Python: fix 3 queries to use sources for the active threat model #22822

Show file tree
Hide file tree
Changes from all commits
Commits
Show all changes
3 commits
Select commit Hold shift + click to select a range
55705d4
Use instanceof for threat model sources
owen-mc Oct 14, 2026
9b363ee
Make queries use ActiveThreatModelSource, not RemoteFlowSource
owen-mc Oct 14, 2026
ce648b3
Add change note
owen-mc Oct 14, 2026
File filter

Filter by extension

Filter by extension
Conversations
Failed to load comments.
Loading
Jump to
Jump to file
Failed to load files.
Loading
Diff view
Diff view
4 changes: 4 additions & 0 deletions python/ql/lib/change-notes/2026-10-14-active-threat-model-sources.md
View file
Open in desktop
Original file line number Diff line number Diff line change
@@ -0,0 +1,4 @@
---
category: minorAnalysis
---
* Updated the `py/xxe`, `py/xml-bomb`, and `py/nosql-injection` queries to respect the configured threat model when selecting untrusted data sources. The default behavior remains unchanged and uses remote flow sources. As a side effect, these queries now correctly include sources modeled using data extensions.
7 changes: 3 additions & 4 deletions python/ql/lib/semmle/python/security/dataflow/CodeInjectionCustomizations.qll
View file
Open in desktop
Original file line number Diff line number Diff line change
Expand Up @@ -37,10 +37,9 @@ module CodeInjection {
*/
deprecated class RemoteFlowSourceAsSource = ActiveThreatModelSourceAsSource;

/**
* An active threat-model source, considered as a flow source.
*/
private class ActiveThreatModelSourceAsSource extends Source, ActiveThreatModelSource { }
/** An active threat-model source, considered as a flow source. */
private class ActiveThreatModelSourceAsSource extends Source instanceof ActiveThreatModelSource {
}

/**
* A code execution, considered as a flow sink.
Expand Down
7 changes: 3 additions & 4 deletions python/ql/lib/semmle/python/security/dataflow/CommandInjectionCustomizations.qll
View file
Open in desktop
Original file line number Diff line number Diff line change
Expand Up @@ -37,10 +37,9 @@ module CommandInjection {
*/
deprecated class RemoteFlowSourceAsSource = ActiveThreatModelSourceAsSource;

/**
* An active threat-model source, considered as a flow source.
*/
private class ActiveThreatModelSourceAsSource extends Source, ActiveThreatModelSource { }
/** An active threat-model source, considered as a flow source. */
private class ActiveThreatModelSourceAsSource extends Source instanceof ActiveThreatModelSource {
}

/**
* A command execution, considered as a flow sink.
Expand Down
7 changes: 3 additions & 4 deletions python/ql/lib/semmle/python/security/dataflow/CookieInjectionCustomizations.qll
View file
Open in desktop
Original file line number Diff line number Diff line change
Expand Up @@ -35,10 +35,9 @@ module CookieInjection {
*/
deprecated class RemoteFlowSourceAsSource = ActiveThreatModelSourceAsSource;

/**
* An active threat-model source, considered as a flow source.
*/
private class ActiveThreatModelSourceAsSource extends Source, ActiveThreatModelSource { }
/** An active threat-model source, considered as a flow source. */
private class ActiveThreatModelSourceAsSource extends Source instanceof ActiveThreatModelSource {
}

/**
* A write to a cookie, considered as a sink.
Expand Down
7 changes: 3 additions & 4 deletions python/ql/lib/semmle/python/security/dataflow/HttpHeaderInjectionCustomizations.qll
View file
Open in desktop
Original file line number Diff line number Diff line change
Expand Up @@ -36,10 +36,9 @@ module HttpHeaderInjection {
*/
deprecated class RemoteFlowSourceAsSource = ActiveThreatModelSourceAsSource;

/**
* An active threat-model source, considered as a flow source.
*/
private class ActiveThreatModelSourceAsSource extends Source, ActiveThreatModelSource { }
/** An active threat-model source, considered as a flow source. */
private class ActiveThreatModelSourceAsSource extends Source instanceof ActiveThreatModelSource {
}

/**
* A HTTP header write, considered as a flow sink.
Expand Down
7 changes: 3 additions & 4 deletions python/ql/lib/semmle/python/security/dataflow/LdapInjectionCustomizations.qll
View file
Open in desktop
Original file line number Diff line number Diff line change
Expand Up @@ -46,10 +46,9 @@ module LdapInjection {
*/
deprecated class RemoteFlowSourceAsSource = ActiveThreatModelSourceAsSource;

/**
* An active threat-model source, considered as a flow source.
*/
private class ActiveThreatModelSourceAsSource extends Source, ActiveThreatModelSource { }
/** An active threat-model source, considered as a flow source. */
private class ActiveThreatModelSourceAsSource extends Source instanceof ActiveThreatModelSource {
}

/**
* A logging operation, considered as a flow sink.
Expand Down
7 changes: 3 additions & 4 deletions python/ql/lib/semmle/python/security/dataflow/LogInjectionCustomizations.qll
View file
Open in desktop
Original file line number Diff line number Diff line change
Expand Up @@ -37,10 +37,9 @@ module LogInjection {
*/
deprecated class RemoteFlowSourceAsSource = ActiveThreatModelSourceAsSource;

/**
* An active threat-model source, considered as a flow source.
*/
private class ActiveThreatModelSourceAsSource extends Source, ActiveThreatModelSource { }
/** An active threat-model source, considered as a flow source. */
private class ActiveThreatModelSourceAsSource extends Source instanceof ActiveThreatModelSource {
}

/**
* A logging operation, considered as a flow sink.
Expand Down
11 changes: 8 additions & 3 deletions python/ql/lib/semmle/python/security/dataflow/NoSqlInjectionCustomizations.qll
View file
Open in desktop
Original file line number Diff line number Diff line change
Expand Up @@ -6,7 +6,6 @@

import python
import semmle.python.dataflow.new.DataFlow
import semmle.python.dataflow.new.RemoteFlowSources
import semmle.python.Concepts

/**
Expand Down Expand Up @@ -63,8 +62,14 @@ module NoSqlInjection {
abstract DataFlow::Node getOutput();
}

/** A remote flow source considered a source of user controlled strings. */
class RemoteFlowSourceAsStringSource extends RemoteFlowSource, StringSource { }
/**
* DEPRECATED: Use `ActiveThreatModelSource` from Concepts instead!
*/
deprecated class RemoteFlowSourceAsStringSource = ActiveThreatModelSourceAsStringSource;

/** An active threat-model source considered a source of user controlled strings. */
private class ActiveThreatModelSourceAsStringSource extends StringSource instanceof ActiveThreatModelSource
{ }

/** A NoSQL query that is vulnerable to user controlled strings. */
class NoSqlExecutionAsStringSink extends StringSink {
Expand Down
7 changes: 3 additions & 4 deletions python/ql/lib/semmle/python/security/dataflow/PamAuthorizationCustomizations.qll
View file
Open in desktop
Original file line number Diff line number Diff line change
Expand Up @@ -44,10 +44,9 @@ module PamAuthorizationCustomizations {
*/
deprecated class RemoteFlowSourceAsSource = ActiveThreatModelSourceAsSource;

/**
* An active threat-model source, considered as a flow source.
*/
private class ActiveThreatModelSourceAsSource extends Source, ActiveThreatModelSource { }
/** An active threat-model source, considered as a flow source. */
private class ActiveThreatModelSourceAsSource extends Source instanceof ActiveThreatModelSource {
}

/**
* A vulnerable `pam_authenticate` call considered as a flow sink.
Expand Down
7 changes: 3 additions & 4 deletions python/ql/lib/semmle/python/security/dataflow/PathInjectionCustomizations.qll
View file
Open in desktop
Original file line number Diff line number Diff line change
Expand Up @@ -47,10 +47,9 @@ module PathInjection {
*/
deprecated class RemoteFlowSourceAsSource = ActiveThreatModelSourceAsSource;

/**
* An active threat-model source, considered as a flow source.
*/
private class ActiveThreatModelSourceAsSource extends Source, ActiveThreatModelSource { }
/** An active threat-model source, considered as a flow source. */
private class ActiveThreatModelSourceAsSource extends Source instanceof ActiveThreatModelSource {
}

/**
* A file system access, considered as a flow sink.
Expand Down
7 changes: 3 additions & 4 deletions python/ql/lib/semmle/python/security/dataflow/PolynomialReDoSCustomizations.qll
View file
Open in desktop
Original file line number Diff line number Diff line change
Expand Up @@ -56,10 +56,9 @@ module PolynomialReDoS {
*/
deprecated class RemoteFlowSourceAsSource = ActiveThreatModelSourceAsSource;

/**
* An active threat-model source, considered as a flow source.
*/
private class ActiveThreatModelSourceAsSource extends Source, ActiveThreatModelSource { }
/** An active threat-model source, considered as a flow source. */
private class ActiveThreatModelSourceAsSource extends Source instanceof ActiveThreatModelSource {
}

/**
* A regex execution, considered as a flow sink.
Expand Down
7 changes: 3 additions & 4 deletions python/ql/lib/semmle/python/security/dataflow/ReflectedXSSCustomizations.qll
View file
Open in desktop
Original file line number Diff line number Diff line change
Expand Up @@ -37,10 +37,9 @@ module ReflectedXss {
*/
deprecated class RemoteFlowSourceAsSource = ActiveThreatModelSourceAsSource;

/**
* An active threat-model source, considered as a flow source.
*/
private class ActiveThreatModelSourceAsSource extends Source, ActiveThreatModelSource { }
/** An active threat-model source, considered as a flow source. */
private class ActiveThreatModelSourceAsSource extends Source instanceof ActiveThreatModelSource {
}

/**
* A data flow sink for "reflected cross-site scripting" vulnerabilities.
Expand Down
7 changes: 3 additions & 4 deletions python/ql/lib/semmle/python/security/dataflow/RegexInjectionCustomizations.qll
View file
Open in desktop
Original file line number Diff line number Diff line change
Expand Up @@ -44,10 +44,9 @@ module RegexInjection {
*/
deprecated class RemoteFlowSourceAsSource = ActiveThreatModelSourceAsSource;

/**
* An active threat-model source, considered as a flow source.
*/
private class ActiveThreatModelSourceAsSource extends Source, ActiveThreatModelSource { }
/** An active threat-model source, considered as a flow source. */
private class ActiveThreatModelSourceAsSource extends Source instanceof ActiveThreatModelSource {
}

/**
* A regex escaping, considered as a sanitizer.
Expand Down
7 changes: 3 additions & 4 deletions python/ql/lib/semmle/python/security/dataflow/ServerSideRequestForgeryCustomizations.qll
View file
Open in desktop
Original file line number Diff line number Diff line change
Expand Up @@ -50,10 +50,9 @@ module ServerSideRequestForgery {
*/
deprecated class RemoteFlowSourceAsSource = ActiveThreatModelSourceAsSource;

/**
* An active threat-model source, considered as a flow source.
*/
private class ActiveThreatModelSourceAsSource extends Source, ActiveThreatModelSource { }
/** An active threat-model source, considered as a flow source. */
private class ActiveThreatModelSourceAsSource extends Source instanceof ActiveThreatModelSource {
}

/** The URL of an HTTP request, considered as a sink. */
class HttpRequestUrlAsSink extends Sink {
Expand Down
7 changes: 3 additions & 4 deletions python/ql/lib/semmle/python/security/dataflow/SqlInjectionCustomizations.qll
View file
Open in desktop
Original file line number Diff line number Diff line change
Expand Up @@ -36,10 +36,9 @@ module SqlInjection {
*/
deprecated class RemoteFlowSourceAsSource = ActiveThreatModelSourceAsSource;

/**
* An active threat-model source, considered as a flow source.
*/
private class ActiveThreatModelSourceAsSource extends Source, ActiveThreatModelSource { }
/** An active threat-model source, considered as a flow source. */
private class ActiveThreatModelSourceAsSource extends Source instanceof ActiveThreatModelSource {
}

/**
* A SQL statement of a SQL construction, considered as a flow sink.
Expand Down
7 changes: 3 additions & 4 deletions python/ql/lib/semmle/python/security/dataflow/TemplateInjectionCustomizations.qll
View file
Open in desktop
Original file line number Diff line number Diff line change
Expand Up @@ -31,10 +31,9 @@ module TemplateInjection {
*/
abstract class Sanitizer extends DataFlow::Node { }

/**
* An active threat-model source, considered as a flow source.
*/
private class ActiveThreatModelSourceAsSource extends Source, ActiveThreatModelSource { }
/** An active threat-model source, considered as a flow source. */
private class ActiveThreatModelSourceAsSource extends Source instanceof ActiveThreatModelSource {
}

/**
* A SQL statement of a SQL construction, considered as a flow sink.
Expand Down
7 changes: 3 additions & 4 deletions python/ql/lib/semmle/python/security/dataflow/UnsafeDeserializationCustomizations.qll
View file
Open in desktop
Original file line number Diff line number Diff line change
Expand Up @@ -37,10 +37,9 @@ module UnsafeDeserialization {
*/
deprecated class RemoteFlowSourceAsSource = ActiveThreatModelSourceAsSource;

/**
* An active threat-model source, considered as a flow source.
*/
private class ActiveThreatModelSourceAsSource extends Source, ActiveThreatModelSource { }
/** An active threat-model source, considered as a flow source. */
private class ActiveThreatModelSourceAsSource extends Source instanceof ActiveThreatModelSource {
}

/**
* An insecure decoding, considered as a flow sink.
Expand Down
7 changes: 3 additions & 4 deletions python/ql/lib/semmle/python/security/dataflow/UrlRedirectCustomizations.qll
View file
Open in desktop
Original file line number Diff line number Diff line change
Expand Up @@ -82,10 +82,9 @@ module UrlRedirect {
*/
deprecated class RemoteFlowSourceAsSource = ActiveThreatModelSourceAsSource;

/**
* An active threat-model source, considered as a flow source.
*/
private class ActiveThreatModelSourceAsSource extends Source, ActiveThreatModelSource { }
/** An active threat-model source, considered as a flow source. */
private class ActiveThreatModelSourceAsSource extends Source instanceof ActiveThreatModelSource {
}

/**
* A HTTP redirect response, considered as a flow sink.
Expand Down
11 changes: 8 additions & 3 deletions python/ql/lib/semmle/python/security/dataflow/XmlBombCustomizations.qll
View file
Open in desktop
Original file line number Diff line number Diff line change
Expand Up @@ -7,7 +7,6 @@
private import python
private import semmle.python.dataflow.new.DataFlow
private import semmle.python.Concepts
private import semmle.python.dataflow.new.RemoteFlowSources

/**
* Provides default sources, sinks and sanitizers for detecting "XML bomb"
Expand All @@ -29,8 +28,14 @@ module XmlBomb {
*/
abstract class Sanitizer extends DataFlow::Node { }

/** A source of remote user input, considered as a flow source for XML bomb vulnerabilities. */
class RemoteFlowSourceAsSource extends Source instanceof RemoteFlowSource { }
/**
* DEPRECATED: Use `ActiveThreatModelSource` from Concepts instead!
*/
deprecated class RemoteFlowSourceAsSource = ActiveThreatModelSourceAsSource;

/** An active threat-model source, considered as a flow source. */
private class ActiveThreatModelSourceAsSource extends Source instanceof ActiveThreatModelSource {
}

/**
* A call to an XML parser that is vulnerable to XML bombs.
Expand Down
7 changes: 3 additions & 4 deletions python/ql/lib/semmle/python/security/dataflow/XpathInjectionCustomizations.qll
View file
Open in desktop
Original file line number Diff line number Diff line change
Expand Up @@ -34,10 +34,9 @@ module XpathInjection {
*/
deprecated class RemoteFlowSourceAsSource = ActiveThreatModelSourceAsSource;

/**
* An active threat-model source, considered as a flow source.
*/
private class ActiveThreatModelSourceAsSource extends Source, ActiveThreatModelSource { }
/** An active threat-model source, considered as a flow source. */
private class ActiveThreatModelSourceAsSource extends Source instanceof ActiveThreatModelSource {
}

/**
* A construction of an XPath expression, considered as a sink.
Expand Down
11 changes: 8 additions & 3 deletions python/ql/lib/semmle/python/security/dataflow/XxeCustomizations.qll
View file
Open in desktop
Original file line number Diff line number Diff line change
Expand Up @@ -7,7 +7,6 @@
private import python
private import semmle.python.dataflow.new.DataFlow
private import semmle.python.Concepts
private import semmle.python.dataflow.new.RemoteFlowSources

/**
* Provides default sources, sinks and sanitizers for detecting "XML External Entity (XXE)"
Expand All @@ -29,8 +28,14 @@ module Xxe {
*/
abstract class Sanitizer extends DataFlow::Node { }

/** A source of remote user input, considered as a flow source for XXE vulnerabilities. */
class RemoteFlowSourceAsSource extends Source instanceof RemoteFlowSource { }
/**
* DEPRECATED: Use `ActiveThreatModelSource` from Concepts instead!
*/
deprecated class RemoteFlowSourceAsSource = ActiveThreatModelSourceAsSource;

/** An active threat-model source, considered as a flow source. */
private class ActiveThreatModelSourceAsSource extends Source instanceof ActiveThreatModelSource {

@owen-mc owen-mc Oct 14, 2026

Copy link
Copy Markdown
Contributor Author

Choose a reason for hiding this comment

The reason will be displayed to describe this comment to others. Learn more.

I don't think we need to do this. If it had been written correctly in the first place we wouldn't have bothered testing it.

}

/**
* A call to an XML parser that is vulnerable to XXE.
Expand Down
6 changes: 3 additions & 3 deletions python/ql/src/Security/CWE-020-ExternalAPIs/ExternalAPIs.qll
View file
Open in desktop
Original file line number Diff line number Diff line change
Expand Up @@ -6,7 +6,7 @@
private import python
import semmle.python.dataflow.new.DataFlow
private import semmle.python.dataflow.new.TaintTracking
private import semmle.python.dataflow.new.RemoteFlowSources
private import semmle.python.Concepts
private import semmle.python.ApiGraphs
private import semmle.python.dataflow.new.internal.DataFlowPrivate as DataFlowPrivate
private import semmle.python.dataflow.new.internal.TaintTrackingPrivate as TaintTrackingPrivate
Expand Down Expand Up @@ -168,7 +168,7 @@ class ExternalApiDataNode extends DataFlow::Node {
}

private module UntrustedDataToExternalApiConfig implements DataFlow::ConfigSig {
predicate isSource(DataFlow::Node source) { source instanceof RemoteFlowSource }
predicate isSource(DataFlow::Node source) { source instanceof ActiveThreatModelSource }

predicate isSink(DataFlow::Node sink) { sink instanceof ExternalApiDataNode }

Expand All @@ -177,7 +177,7 @@ private module UntrustedDataToExternalApiConfig implements DataFlow::ConfigSig {
}
}

/** Global taint-tracking from `RemoteFlowSource`s to `ExternalApiDataNode`s. */
/** Global taint-tracking from active threat-model sources to `ExternalApiDataNode`s. */
module UntrustedDataToExternalApiFlow = TaintTracking::Global<UntrustedDataToExternalApiConfig>;

/** A node representing untrusted data being passed to an external API. */
Expand Down
7 changes: 3 additions & 4 deletions python/ql/src/experimental/Security/CWE-091/XsltInjectionCustomizations.qll
View file
Open in desktop
Original file line number Diff line number Diff line change
Expand Up @@ -37,10 +37,9 @@ module XsltInjection {
*/
deprecated class RemoteFlowSourceAsSource = ActiveThreatModelSourceAsSource;

/**
* An active threat-model source, considered as a flow source.
*/
private class ActiveThreatModelSourceAsSource extends Source, ActiveThreatModelSource { }
/** An active threat-model source, considered as a flow source. */
private class ActiveThreatModelSourceAsSource extends Source instanceof ActiveThreatModelSource {
}

/**
* An XSLT construction, considered as a flow sink.
Expand Down
3 changes: 1 addition & 2 deletions python/ql/src/experimental/Security/CWE-176/UnicodeBypassValidationQuery.qll
View file
Open in desktop
Original file line number Diff line number Diff line change
Expand Up @@ -9,7 +9,6 @@ import semmle.python.Concepts
import semmle.python.dataflow.new.internal.DataFlowPublic
import semmle.python.dataflow.new.TaintTracking
import semmle.python.dataflow.new.internal.TaintTrackingPrivate
import semmle.python.dataflow.new.RemoteFlowSources
import UnicodeBypassValidationCustomizations::UnicodeBypassValidation

abstract private class ValidationState extends string {
Expand Down Expand Up @@ -37,7 +36,7 @@ private module UnicodeBypassValidationConfig implements DataFlow::StateConfigSig
class FlowState = ValidationState;

predicate isSource(DataFlow::Node source, FlowState state) {
source instanceof RemoteFlowSource and state instanceof PreValidation
source instanceof ActiveThreatModelSource and state instanceof PreValidation
}

predicate isAdditionalFlowStep(
Expand Down
3 changes: 2 additions & 1 deletion python/ql/src/experimental/Security/CWE-346/CorsBypass.ql
View file
Open in desktop
Original file line number Diff line number Diff line change
Expand Up @@ -10,6 +10,7 @@

import python
import semmle.python.ApiGraphs
import semmle.python.Concepts
import semmle.python.dataflow.new.TaintTracking
import semmle.python.Flow
import semmle.python.dataflow.new.RemoteFlowSources
Expand Down Expand Up @@ -62,7 +63,7 @@ class CherryPyRequest extends RemoteFlowSource::Range {
}

module CorsBypassConfig implements DataFlow::ConfigSig {
predicate isSource(DataFlow::Node node) { node instanceof RemoteFlowSource }
predicate isSource(DataFlow::Node node) { node instanceof ActiveThreatModelSource }

predicate isSink(DataFlow::Node node) {
exists(StringStartswithCall s |
Expand Down
Loading
Loading