Skip to content

Literals are not tainted #5

@bramvdbogaerde

Description

@bramvdbogaerde

Example program:

x = random()
tainted = x.__taint__()
if tainted:
     Taint().sink("foo")
else:
     pass

Expected: Taint().sink("foo") to generate a report that there is a flow from the tainted variable to the sink.

Actual: nothing reported

The following does, strangely enough, work:

class A:
     pass
x = random()
tainted = x.__taint__()
if tainted:
     Taint().sink(A())
else:
     pass

and so does:

x = random()
tainted = x.__taint__()
if tainted:
     m = "foo"
     Taint().sink(m)
else:
     pass

Metadata

Metadata

Labels

bugSomething isn't working

Type

No type

Projects

No projects

Milestone

No milestone

Relationships

None yet

Development

No branches or pull requests

Issue actions