Pysa detection capabilities #959
Comments
|
Hi,
How would it "detect" the variable? By its name? Then, no, in the general case, Pysa is not able to detect if a variable name is used. If, instead, you want to detect if an attribute is used, then you can model a specific class attribute as a source or sink.
No, unfortunately, Pysa can only find flows from sources to sinks. If you just want to know if a function is called from anywhere, you could use the call graph generated by Pysa (see option
Yes, you can mark the return value of a function as a sink using return sinks. Unfortunately, it looks like this isn't documented, but this is supported. See this test:
You could try this: make
Pysa can only find flows from sources to sinks. For instance, using
I don't see an easy way for Pysa to detect whether a variable is NOT compared with a specific string. However, I'm wondering if this vulnerability can be modeled differently as a source to sink problem.
Pysa cannot detect a "not" flow. I think the correct way to model this is to make
I would make |
|
Thank you very much @arthaud for your very useful answer, as usual, and sorry for the delay. For CVE-2016-9243 we tried to made different combinations (parameters and return values) of For CVE-2017-2809, we correctly detected the vulnerability, by annotating For CVE-2014-7143, we correctly detected the vulnerability, by annotating For CVE-2012-2417, we tried to detect the vulnerability by annotating In short, we could not detect any vulnerability we wanted, it has to follow the source-to-sink pattern, and even in that case some flows are not detected. Don't hesitate if you have any idea regarding CVE-2016-9243 and CVE-2012-2417. Sources and sinks for CVE-2016-9243: Logs for CVE-2016-9243: Sources and sinks for CVE-2012-2417: Logs for CVE-2012-2417: |
Sign up for free
to join this conversation on GitHub.
Already have an account?
Sign in to comment
Pysa Bug
Pre-submission checklist
[✓] I've checked the list of common issues and mine does not appear
Bug description
Apologies, this is not exactly a bug, more a set of questions to better understand Pysa capabilities, don't hesitate to redirect us if necessary.
We are trying to use Pysa to detect vulnerabilities in several Python projects.
According to the tutorial and the documentation, Pysa is able to detect when there is a data flow from a source to a sink (which, eventually, was not caught by a sanitizer) and to report a location in the path between the source and the sink as the vulnerability location.
But is it possible to do more with Pysa, by defining dedicated rules?
For instance:
Reproduction steps
None
Expected behavior
For CVE-2016-9243, is it possible to detect in src/cryptography/hazmat/primitives/kdf/hkdf.py that the variable
self._algorithm.digest_sizewas divided by 8? For instance, by detecting the presence of the character8at Line 94?For CVE-2017-2809, is it possible to detect in ansible_vault/api.py that
yaml.loadwas called instead ofyaml.safe_loadat Line 18?For CVE-2016-9909, is it possible to detect in html5lib/serializer/htmlserializer.py that the variable
self.quote_attr_valueswas not compared with the value"legacy", as in the fix at Line 255?For CVE-2014-7143, is it possible to detect in twisted/web/client.py
that the "source"
_trustRootshould be present when the "sink"optionsForClientTLSis called (i.e., there is a vulnerability ifoptionsForClientTLSis called without_trustRoot)?Similarly, for CVE-2012-2417, is it possible to detect in lib/Crypto/PublicKey/ElGamal.py that the "source"
getPrimeshould be reached before the "sink".isPrime(i.e., there is a vulnerability ifgetPrimeis called but not.isPrime)?Logs
None
Additional context
None
The text was updated successfully, but these errors were encountered: