From 1269a98d2beb4f2968d6b3ebbfecbfcb70e415dc Mon Sep 17 00:00:00 2001
From: Taus <tausbn@github.com>
Date: Tue, 10 Oct 2023 14:33:08 +0000
Subject: [PATCH] Python: Add Tornado models

---
 .../ql/lib/semmle/python/frameworks/Tornado.qll | 13 +++++++++++--
 python/ql/src/meta/ClassHierarchy/Find.ql       | 17 +++++++++++++++++
 2 files changed, 28 insertions(+), 2 deletions(-)

diff --git a/python/ql/lib/semmle/python/frameworks/Tornado.qll b/python/ql/lib/semmle/python/frameworks/Tornado.qll
index 1fce2b5f308..1bd40603296 100644
--- a/python/ql/lib/semmle/python/frameworks/Tornado.qll
+++ b/python/ql/lib/semmle/python/frameworks/Tornado.qll
@@ -218,7 +218,11 @@ module Tornado {
        */
       module Application {
         /** Gets a reference to the `tornado.web.Application` class. */
-        API::Node classRef() { result = web().getMember("Application") }
+        API::Node classRef() {
+          result = web().getMember("Application")
+          or
+          result = ModelOutput::getATypeNode("tornado.web.Application~Subclass").getASubclass*()
+        }
 
         /**
          * A source of instances of `tornado.web.Application`, extend this class to model new instances.
@@ -275,7 +279,12 @@ module Tornado {
        */
       module HttpServerRequest {
         /** Gets a reference to the `tornado.httputil.HttpServerRequest` class. */
-        API::Node classRef() { result = httputil().getMember("HttpServerRequest") }
+        API::Node classRef() {
+          result = httputil().getMember("HttpServerRequest")
+          or
+          result =
+            ModelOutput::getATypeNode("tornado.httputil.HttpServerRequest~Subclass").getASubclass*()
+        }
 
         /**
          * A source of instances of `tornado.httputil.HttpServerRequest`, extend this class to model new instances.
diff --git a/python/ql/src/meta/ClassHierarchy/Find.ql b/python/ql/src/meta/ClassHierarchy/Find.ql
index 7646cf74bc3..d6eace97b05 100644
--- a/python/ql/src/meta/ClassHierarchy/Find.ql
+++ b/python/ql/src/meta/ClassHierarchy/Find.ql
@@ -25,6 +25,7 @@ private import semmle.python.frameworks.Multidict
 private import semmle.python.frameworks.Pycurl
 private import semmle.python.frameworks.RestFramework
 private import semmle.python.frameworks.SqlAlchemy
+private import semmle.python.frameworks.Tornado
 import semmle.python.frameworks.data.internal.ApiGraphModelsExtensions as Extensions
 
 class FlaskViewClasses extends FindSubclassesSpec {
@@ -380,6 +381,22 @@ class StringIO extends FindSubclassesSpec {
   override API::Node getAlreadyModeledClass() { result = StdlibPrivate::StringIO::classRef() }
 }
 
+class TornadoApplication extends FindSubclassesSpec {
+  TornadoApplication() { this = "tornado.web.Application~Subclass" }
+
+  override API::Node getAlreadyModeledClass() {
+    result = Tornado::TornadoModule::Web::Application::classRef()
+  }
+}
+
+class TornadoRequest extends FindSubclassesSpec {
+  TornadoRequest() { this = "tornado.httputil.HttpServerRequest~Subclass" }
+
+  override API::Node getAlreadyModeledClass() {
+    result = Tornado::TornadoModule::HttpUtil::HttpServerRequest::classRef()
+  }
+}
+
 bindingset[fullyQualified]
 predicate fullyQualifiedToYamlFormat(string fullyQualified, string type2, string path) {
   exists(int firstDot | firstDot = fullyQualified.indexOf(".", 0, 0) |