forked from github/codeql
-
Notifications
You must be signed in to change notification settings - Fork 0
Expand file tree
/
Copy pathCatchingBaseException.ql
More file actions
30 lines (26 loc) · 834 Bytes
/
CatchingBaseException.ql
File metadata and controls
30 lines (26 loc) · 834 Bytes
1
2
3
4
5
6
7
8
9
10
11
12
13
14
15
16
17
18
19
20
21
22
23
24
25
26
27
28
29
30
/**
* @name Except block handles 'BaseException'
* @description Handling 'BaseException' means that system exits and keyboard interrupts may be mis-handled.
* @kind problem
* @tags quality
* reliability
* error-handling
* external/cwe/cwe-396
* @problem.severity recommendation
* @sub-severity high
* @precision very-high
* @id py/catch-base-exception
*/
import python
import semmle.python.ApiGraphs
predicate doesnt_reraise(ExceptStmt ex) { ex.getAFlowNode().getBasicBlock().reachesExit() }
predicate catches_base_exception(ExceptStmt ex) {
ex.getType() = API::builtin("BaseException").getAValueReachableFromSource().asExpr()
or
not exists(ex.getType())
}
from ExceptStmt ex
where
catches_base_exception(ex) and
doesnt_reraise(ex)
select ex, "Except block directly handles BaseException."