hohn/codeql
1
0
Fork 0
mirror of https://github.com/github/codeql.git synced 2025-12-21 19:26:31 +01:00
Code Issues Packages Projects Releases Wiki Activity

Python: rename concept

Browse Source 
`NoSqlQuery` -> `NoSqlExecution`
This commit is contained in:
Rasmus Lerchedahl Petersen
2023-09-20 15:49:35 +02:00
parent 4ec8b3f02f
commit 12dab88ec7
3 changed files with 13 additions and 13 deletions
Download Patch File Download Diff File Expand all files Collapse all files

4
python/ql/lib/semmle/python/Concepts.qll
View File

@@ -379,7 +379,7 @@ module SqlExecution {
}
/** Provides a class for modeling NoSql execution APIs. */
module NoSqlQuery {
module NoSqlExecution {
/**
* A data-flow node that executes NoSQL queries.
*
@@ -404,7 +404,7 @@ module NoSqlQuery {
* Extend this class to refine existing API models. If you want to model new APIs,
* extend `NoSQLQuery::Range` instead.
*/
class NoSqlQuery extends DataFlow::Node instanceof NoSqlQuery::Range {
class NoSqlExecution extends DataFlow::Node instanceof NoSqlExecution::Range {
/** Gets the argument that specifies the NoSql query to be executed. */
DataFlow::Node getQuery() { result = super.getQuery() }

10
python/ql/lib/semmle/python/frameworks/NoSQL.qll
View File

@@ -110,7 +110,7 @@ private module NoSql {
*
* `mongo.db.user.find({'name': safe_search})` would be a collection method call.
*/
private class MongoCollectionCall extends DataFlow::CallCfgNode, NoSqlQuery::Range {
private class MongoCollectionCall extends DataFlow::CallCfgNode, NoSqlExecution::Range {
MongoCollectionCall() {
this = mongoCollection().getMember(mongoCollectionMethodName()).getACall()
}
@@ -122,7 +122,7 @@ private module NoSql {
override predicate vulnerableToStrings() { none() }
}
private class MongoCollectionAggregation extends API::CallNode, NoSqlQuery::Range {
private class MongoCollectionAggregation extends API::CallNode, NoSqlExecution::Range {
MongoCollectionAggregation() { this = mongoCollection().getMember("aggregate").getACall() }
override DataFlow::Node getQuery() { result = this.getParameter(0).getASubscript().asSink() }
@@ -132,7 +132,7 @@ private module NoSql {
override predicate vulnerableToStrings() { none() }
}
private class MongoMapReduce extends API::CallNode, NoSqlQuery::Range {
private class MongoMapReduce extends API::CallNode, NoSqlExecution::Range {
MongoMapReduce() { this = mongoCollection().getMember("map_reduce").getACall() }
override DataFlow::Node getQuery() { result in [this.getArg(0), this.getArg(1)] }
@@ -142,7 +142,7 @@ private module NoSql {
override predicate vulnerableToStrings() { any() }
}
private class MongoMapReduceQuery extends API::CallNode, NoSqlQuery::Range {
private class MongoMapReduceQuery extends API::CallNode, NoSqlExecution::Range {
MongoMapReduceQuery() { this = mongoCollection().getMember("map_reduce").getACall() }
override DataFlow::Node getQuery() { result in [this.getArgByName("query")] }
@@ -248,7 +248,7 @@ private module NoSql {
*
* `Movie.objects(__raw__=json_search)` would be the result.
*/
private class MongoEngineObjectsCall extends DataFlow::CallCfgNode, NoSqlQuery::Range {
private class MongoEngineObjectsCall extends DataFlow::CallCfgNode, NoSqlExecution::Range {
MongoEngineObjectsCall() {
this =
[mongoEngine(), flask_MongoEngine()]

12
python/ql/lib/semmle/python/security/dataflow/NoSQLInjectionCustomizations.qll
View File

@@ -60,17 +60,17 @@ module NoSqlInjection {
class RemoteFlowSourceAsStringSource extends RemoteFlowSource, StringSource { }
/** A NoSQL query that is vulnerable to user controlled strings. */
class NoSqlQueryAsStringSink extends StringSink {
NoSqlQueryAsStringSink() {
exists(NoSqlQuery noSqlQuery | this = noSqlQuery.getQuery() |
noSqlQuery.vulnerableToStrings()
class NoSqlExecutionAsStringSink extends StringSink {
NoSqlExecutionAsStringSink() {
exists(NoSqlExecution noSqlExecution | this = noSqlExecution.getQuery() |
noSqlExecution.vulnerableToStrings()
)
}
}
/** A NoSQL query that is vulnerable to user controlled dictionaries. */
class NoSqlQueryAsDictSink extends DictSink {
NoSqlQueryAsDictSink() { this = any(NoSqlQuery noSqlQuery).getQuery() }
class NoSqlExecutionAsDictSink extends DictSink {
NoSqlExecutionAsDictSink() { this = any(NoSqlExecution noSqlExecution).getQuery() }
}
/** A JSON decoding converts a string to a dictionary. */