hohn/codeql
1
0
Fork 0
mirror of https://github.com/github/codeql.git synced 2025-12-20 10:46:30 +01:00
Code Issues Packages Projects Releases Wiki Activity

Python: Modernise remaining web libraries.

Browse Source
This commit is contained in:
Taus Brock-Nannestad
2020-01-22 15:27:29 +01:00
parent 007b0795ec
commit 0924a973de
3 changed files with 19 additions and 14 deletions
Download Patch File Download Diff File Expand all files Collapse all files

5
python/ql/src/semmle/python/objects/ObjectAPI.qll
View File

@@ -643,6 +643,11 @@ module ClassValue {
result = TBuiltinClassObject(Builtin::special("bool"))
}
/** Get the `ClassValue` for the `dict` class. */
ClassValue dict() {
result = TBuiltinClassObject(Builtin::special("dict"))
}
/** Get the `ClassValue` for the class of Python functions. */
ClassValue function() {
result = TBuiltinClassObject(Builtin::special("FunctionType"))

10
python/ql/src/semmle/python/web/Http.qll
View File

@@ -19,17 +19,17 @@ class WsgiEnvironment extends TaintKind {
result = this and Implementation::copyCall(fromnode, tonode)
or
result = this and
tonode.(CallNode).getFunction().refersTo(theDictType()) and
tonode.(CallNode).getFunction().pointsTo(ClassValue::dict()) and
tonode.(CallNode).getArg(0) = fromnode
or
exists(StringObject key, string text |
exists(Value key, string text |
tonode.(CallNode).getFunction().(AttrNode).getObject("get") = fromnode and
tonode.(CallNode).getArg(0).refersTo(key)
tonode.(CallNode).getArg(0).pointsTo(key)
or
tonode.(SubscriptNode).getValue() = fromnode and tonode.isLoad() and
tonode.(SubscriptNode).getIndex().refersTo(key)
tonode.(SubscriptNode).getIndex().pointsTo(key)
|
text = key.getText() and result instanceof ExternalStringKind and
key = Value::forString(text) and result instanceof ExternalStringKind and
(
text = "QUERY_STRING" or
text = "PATH_INFO" or

18
python/ql/src/semmle/python/web/cherrypy/General.qll
View File

@@ -22,23 +22,23 @@ class CherryPyRoute extends CallNode {
this.getFunction().(AttrNode).getObject("mount").pointsTo(Value::named("cherrypy.tree"))
}
ClassObject getAppClass() {
this.getArg(0).refersTo(_, result, _)
ClassValue getAppClass() {
this.getArg(0).pointsTo().getClass() = result
or
this.getArgByName("root").refersTo(_, result, _)
this.getArgByName("root").pointsTo().getClass() = result
}
string getPath() {
exists(StringObject path | result = path.getText() |
this.getArg(1).refersTo(path)
exists(Value path | path = Value::forString(result) |
this.getArg(1).pointsTo(path)
or
this.getArgByName("script_name").refersTo(path)
this.getArgByName("script_name").pointsTo(path)
)
}
Object getConfig() {
this.getArg(2).refersTo(_, result, _)
ClassValue getConfig() {
this.getArg(2).pointsTo().getClass() = result
or
this.getArgByName("config").refersTo(_, result, _)
this.getArgByName("config").pointsTo().getClass() = result
}
}