Repository navigation
Python: fix 3 queries to use sources for the active threat model - #22822
Merged
Merged
Conversation
Co-authored-by: Copilot <223556219+Copilot@users.noreply.github.com>
This means that these query will respect the threat model that is being used, rather than just using remote flow sources every time. The default threat model is "remote".
Contributor
There was a problem hiding this comment.
🟡 Changes recommended
The three primary query fixes lack regression coverage for data-extension sources and enabled/disabled threat-model selection.
1 open finding
What changed in this PR
Updates Python security queries to use active threat-model sources, addressing the data-extension coverage gap highlighted by #22750.
Changes:
- Migrates XXE, XML-bomb, NoSQL, and several additional queries to active threat-model sources.
- Standardizes source adapters using
extends … instanceof. - Adds a change note for the three production query fixes.
| File | Description |
|---|---|
| python/ql/src/Security/CWE-020-ExternalAPIs/ExternalAPIs.qll | Updates external-API source selection. |
| python/ql/src/experimental/semmle/python/security/TimingAttack.qll | Updates both timing-attack configurations. |
| python/ql/src/experimental/semmle/python/security/RemoteCommandExecution.qll | Updates command-execution sources. |
| python/ql/src/experimental/semmle/python/security/LdapInsecureAuth.qll | Updates untrusted-input sources. |
| python/ql/src/experimental/semmle/python/security/injection/CsvInjection.qll | Updates CSV-injection sources. |
| python/ql/src/experimental/semmle/python/security/DecompressionBomb.qll | Updates general bomb sources. |
| python/ql/src/experimental/semmle/python/security/dataflow/PromptInjectionCustomizations.qll | Standardizes source adapter. |
| python/ql/src/experimental/semmle/python/security/dataflow/EmailXss.qll | Updates email-XSS sources. |
| python/ql/src/experimental/Security/UnsafeUnpackQuery.qll | Updates untrusted archive sources. |
| python/ql/src/experimental/Security/CWE-770/UnicodeDoS.ql | Updates Unicode-DoS sources. |
| python/ql/src/experimental/Security/CWE-346/CorsBypass.ql | Updates CORS-bypass sources. |
| python/ql/src/experimental/Security/CWE-176/UnicodeBypassValidationQuery.qll | Updates pre-validation sources. |
| python/ql/src/experimental/Security/CWE-091/XsltInjectionCustomizations.qll | Standardizes source adapter. |
| python/ql/lib/semmle/python/security/dataflow/XxeCustomizations.qll | Migrates XXE sources; retains deprecated alias. |
| python/ql/lib/semmle/python/security/dataflow/XpathInjectionCustomizations.qll | Standardizes source adapter. |
| python/ql/lib/semmle/python/security/dataflow/XmlBombCustomizations.qll | Migrates XML-bomb sources; retains deprecated alias. |
| python/ql/lib/semmle/python/security/dataflow/UrlRedirectCustomizations.qll | Standardizes source adapter. |
| python/ql/lib/semmle/python/security/dataflow/UnsafeDeserializationCustomizations.qll | Standardizes source adapter. |
| python/ql/lib/semmle/python/security/dataflow/TemplateInjectionCustomizations.qll | Standardizes source adapter. |
| python/ql/lib/semmle/python/security/dataflow/SqlInjectionCustomizations.qll | Standardizes source adapter. |
| python/ql/lib/semmle/python/security/dataflow/ServerSideRequestForgeryCustomizations.qll | Standardizes source adapter. |
| python/ql/lib/semmle/python/security/dataflow/RegexInjectionCustomizations.qll | Standardizes source adapter. |
| python/ql/lib/semmle/python/security/dataflow/ReflectedXSSCustomizations.qll | Standardizes source adapter. |
| python/ql/lib/semmle/python/security/dataflow/PolynomialReDoSCustomizations.qll | Standardizes source adapter. |
| python/ql/lib/semmle/python/security/dataflow/PathInjectionCustomizations.qll | Standardizes source adapter. |
| python/ql/lib/semmle/python/security/dataflow/PamAuthorizationCustomizations.qll | Standardizes source adapter. |
| python/ql/lib/semmle/python/security/dataflow/NoSqlInjectionCustomizations.qll | Migrates string sources; retains deprecated alias. |
| python/ql/lib/semmle/python/security/dataflow/LogInjectionCustomizations.qll | Standardizes source adapter. |
| python/ql/lib/semmle/python/security/dataflow/LdapInjectionCustomizations.qll | Standardizes source adapter. |
| python/ql/lib/semmle/python/security/dataflow/HttpHeaderInjectionCustomizations.qll | Standardizes source adapter. |
| python/ql/lib/semmle/python/security/dataflow/CookieInjectionCustomizations.qll | Standardizes source adapter. |
| python/ql/lib/semmle/python/security/dataflow/CommandInjectionCustomizations.qll | Standardizes source adapter. |
| python/ql/lib/semmle/python/security/dataflow/CodeInjectionCustomizations.qll | Standardizes source adapter. |
| python/ql/lib/change-notes/2026-10-14-active-threat-model-sources.md | Documents production query changes. |
🧠 Review effort: Balanced
💡 Add a code-review agent skill or configure MCP servers for context-aware, tailored reviews. Learn more in the docs.
| deprecated class RemoteFlowSourceAsSource = ActiveThreatModelSourceAsSource; | ||
|
|
||
| /** An active threat-model source, considered as a flow source. */ | ||
| private class ActiveThreatModelSourceAsSource extends Source instanceof ActiveThreatModelSource { |
Contributor
Author
There was a problem hiding this comment.
I don't think we need to do this. If it had been written correctly in the first place we wouldn't have bothered testing it.
Contributor
|
Thanks for reviewing @aschackmull , I didn't get around to this yesterday. Looks like the PR was a good cleanup. |
Alex-Hofer
added a commit
to Alex-Hofer/mcp-vulnbench
that referenced
this pull request
Oct 15, 2026
github/codeql#22822 makes py/xxe, py/xml-bomb and py/nosql-injection see data-extension sources; the upstream proposals now use the opt-in ai threat model (github/codeql#22810) for handler input. The packs in this repository stay as measured.
This file contains hidden or bidirectional Unicode text that may be interpreted or compiled differently than what appears below. To review, open the file in an editor that reveals hidden Unicode characters.
Learn more about bidirectional Unicode characters
Sign up for free
to join this conversation on GitHub.
Already have an account?
Sign in to comment
Add this suggestion to a batch that can be applied as a single commit.This suggestion is invalid because no changes were made to the code.Suggestions cannot be applied while the pull request is closed.Suggestions cannot be applied while viewing a subset of changes.Only one suggestion per line can be applied in a batch.Add this suggestion to a batch that can be applied as a single commit.Applying suggestions on deleted lines is not supported.You must change the existing code in this line in order to create a valid suggestion.Outdated suggestions cannot be applied.This suggestion has been applied or marked resolved.Suggestions cannot be applied from pending reviews.Suggestions cannot be applied on multi-line comments.Suggestions cannot be applied while the pull request is queued to merge.Suggestion cannot be applied right now. Please check back later.
Updated the
py/xxe,py/xml-bomb, andpy/nosql-injectionqueries to respect the configured threat model when selecting untrusted data sources. The default behavior remains unchanged and uses remote flow sources. As a side effect, these queries now correctly include sources modeled using data extensions.This was prompted by #22750.