hohn/codeql
1
0
Fork 0
mirror of https://github.com/github/codeql.git synced 2026-04-28 10:15:14 +02:00
Code Issues Packages Projects Releases Wiki Activity

Add checks for EmbeddedDocument classes

Browse Source 
Mongoengine supports EmbeddedDocument documents. We should check for this in our query.
This commit is contained in:
thank_you
2021-05-09 19:42:40 -04:00
parent 07c3e22428
commit 0238e51c10
1 changed files with 5 additions and 5 deletions
Download Patch File Download Diff File Expand all files Collapse all files

10
python/ql/src/experimental/semmle/python/frameworks/NoSQL.qll
View File

@@ -96,7 +96,7 @@ private module NoSQL {
MongoEngineObjectsCall() {
this =
API::moduleImport("mongoengine")
.getMember("Document")
.getMember(["Document", "EmbeddedDocument"])
.getASubclass()
.getMember("objects")
.getACall()
@@ -111,7 +111,7 @@ private module NoSQL {
API::moduleImport("flask_mongoengine")
.getMember("MongoEngine")
.getReturn()
.getMember("Document")
.getMember(["Document", "EmbeddedDocument"])
.getASubclass()
.getMember("objects")
.getACall()
@@ -125,13 +125,13 @@ private module NoSQL {
}
/**
* A MongoEngine.Document subclass which represents a single MongoDB table.
* A MongoEngine.Document or MongoEngine.EmbeddedDocument subclass which represents a MongoDB document.
*/
private class FlaskMongoEngineDocumentClass extends ClassValue {
FlaskMongoEngineDocumentClass() {
this.getASuperType().getName() = "Document" and
this.getASuperType().getName() in ["Document", "EmbeddedDocument"] and
exists(AttrNode documentClass |
documentClass.getName() = "Document" and
documentClass.getName() in ["Document", "EmbeddedDocument"] and
documentClass.getObject() = flaskMongoEngineInstance().asCfgNode() and
// This is super hacky. It checks to see if the class is a subclass of a flaskMongoEngineInstance.Document
this.getASuperType()