Python: Taint of string method reference isn't handled

Author: RasmusWL

python/ql/test/library-tests/taint/strings/TestStep.expected

@@ -62,6 +62,10 @@
 | Taint externally controlled string | test.py:66 | test.py:66:22:66:35 | TAINTED_STRING |  |  -->  | Taint externally controlled string | test.py:68 | test.py:68:29:68:42 | tainted_string |  |
 | Taint externally controlled string | test.py:67 | test.py:67:29:67:42 | tainted_string |  |  -->  | Taint [externally controlled string] | test.py:67 | test.py:67:20:67:43 | urlsplit() |  |
 | Taint externally controlled string | test.py:68 | test.py:68:29:68:42 | tainted_string |  |  -->  | Taint [externally controlled string] | test.py:68 | test.py:68:20:68:43 | urlparse() |  |
+| Taint externally controlled string | test.py:72 | test.py:72:22:72:35 | TAINTED_STRING |  |  -->  | Taint externally controlled string | test.py:74 | test.py:74:9:74:22 | tainted_string |  |
+| Taint externally controlled string | test.py:72 | test.py:72:22:72:35 | TAINTED_STRING |  |  -->  | Taint externally controlled string | test.py:76 | test.py:76:12:76:25 | tainted_string |  |
+| Taint externally controlled string | test.py:74 | test.py:74:9:74:22 | tainted_string |  |  -->  | Taint externally controlled string | test.py:74 | test.py:74:9:74:30 | Attribute() |  |
+| Taint externally controlled string | test.py:74 | test.py:74:9:74:30 | Attribute() |  |  -->  | Taint externally controlled string | test.py:79 | test.py:79:10:79:10 | a |  |
 | Taint json[externally controlled string] | test.py:6 | test.py:6:20:6:45 | Attribute() |  |  -->  | Taint json[externally controlled string] | test.py:7 | test.py:7:9:7:20 | tainted_json |  |
 | Taint json[externally controlled string] | test.py:7 | test.py:7:9:7:20 | tainted_json |  |  -->  | Taint externally controlled string | test.py:7 | test.py:7:9:7:25 | Subscript |  |
 | Taint json[externally controlled string] | test.py:7 | test.py:7:9:7:20 | tainted_json |  |  -->  | Taint json[externally controlled string] | test.py:7 | test.py:7:9:7:25 | Subscript |  |

python/ql/test/library-tests/taint/strings/TestTaint.expected

@@ -22,3 +22,5 @@
 | test.py:58 | test_untrusted | res | externally controlled string |
 | test.py:69 | test_urlsplit_urlparse | urlparse_res | [externally controlled string] |
 | test.py:69 | test_urlsplit_urlparse | urlsplit_res | [externally controlled string] |
+| test.py:79 | test_method_reference | a | externally controlled string |
+| test.py:79 | test_method_reference | b | NO TAINT |

python/ql/test/library-tests/taint/strings/test.py

@@ -67,3 +67,13 @@ def test_urlsplit_urlparse():
     urlsplit_res = urlsplit(tainted_string)
     urlparse_res = urlparse(tainted_string)
     test(urlsplit_res, urlparse_res)
+
+def test_method_reference():
+    tainted_string = TAINTED_STRING
+
+    a = tainted_string.title()
+
+    func = tainted_string.title
+    b = func()
+
+    test(a, b) # TODO: `b` not tainted