securesauce / precli

Precaution CLI - command line static application security testing tool
https://precli.readthedocs.io/
Other
14 stars 3 forks source link

Don't do a resolve on the left hand side of an assignment #516

Closed ericwb closed 2 months ago

ericwb commented 2 months ago

An assignment is assigning a value to an identifier. Resolving the identifier can lead to issues when putting into the symbol name as the identifer is expected to be a name. This is what occurred when trying to add dicts to the parser's resolve(). The same would probably occur for tuple and any other non-string identifier value that it would get resolved to.

The visit_comparison_operator is still resolving left_hand, but in its case, its not put into the symbol table. It's also needed to compare left and right for things like timing attack rule that checks whether the left and right are the same type.