/**
* @name SQL injection from user input
* @description Untrusted data flows to SQL query
* @kind path-problem
* @id custom/sql-injection
* @security-severity 9.0
* @precision high
* @tags security
*/
import python
import semmle.python.dataflow.new.TaintTracking
module SqlInjectionConfig implements DataFlow::ConfigSig {
predicate isSource(DataFlow::Node source) {
source.asExpr().(Call).getTarget().getName() = "input"
}
predicate isSink(DataFlow::Node sink) {
sink.asExpr().(Call).getTarget().getName() = "execute"
}
}
module SqlInjectionFlow = TaintTracking::Global<SqlInjectionConfig>;
import SqlInjectionFlow::PathGraph
from SqlInjectionFlow::PathNode source, SqlInjectionFlow::PathNode sink
where SqlInjectionFlow::flowPath(source, sink)
select sink.getNode(), source, sink, "Untrusted input flows to SQL query"
