hohn/codeql
1
0
Fork 0
mirror of https://github.com/github/codeql.git synced 2025-12-20 10:46:30 +01:00
Code Issues Packages Projects Releases Wiki Activity

Python: Model new alias method on django QuerySets

Browse Source
This commit is contained in:
Rasmus Wriedt Larsen
2021-04-09 14:23:05 +02:00
parent 1ed11b297b
commit 2302c8d5fa
2 changed files with 30 additions and 3 deletions
Download Patch File Download Diff File Expand all files Collapse all files

28
python/ql/src/semmle/python/frameworks/Django.qll
View File

@@ -366,7 +366,7 @@ private module PrivateDjango {
"none", "all", "filter", "exclude", "complex_filter", "union", "intersection",
"difference", "select_for_update", "select_related", "prefetch_related", "order_by",
"distinct", "reverse", "defer", "only", "using", "annotate", "extra", "raw",
"datetimes", "dates", "values", "values_list"
"datetimes", "dates", "values", "values_list", "alias"
] and
result = [manager(), querySet()].getMember(name)
}
@@ -386,7 +386,8 @@ private module PrivateDjango {
/** Provides models for the `django.db.models.expressions.RawSQL` class. */
module RawSQL {
/**
* Gets a reference to the `django.db.models.expressions.RawSQL` class.
* Gets an instance of the `django.db.models.expressions.RawSQL` class,
* that was initiated with the SQL represented by `sql`.
*/
API::Node classRef() {
result = expressions().getMember("RawSQL")
@@ -406,7 +407,10 @@ private module PrivateDjango {
exists(DataFlow::TypeTracker t2 | result = instance(t2, sql).track(t2, t))
}
/** Gets an instance of the `django.db.models.expressions.RawSQL` class. */
/**
* Gets an instance of the `django.db.models.expressions.RawSQL` class,
* that was initiated with the SQL represented by `sql`.
*/
DataFlow::Node instance(ControlFlowNode sql) {
instance(DataFlow::TypeTracker::end(), sql).flowsTo(result)
}
@@ -435,6 +439,24 @@ private module PrivateDjango {
override DataFlow::Node getSql() { result.asCfgNode() = sql }
}
/**
* A call to the `alias` function on a model using a `RawSQL` argument.
*
* See https://docs.djangoproject.com/en/3.2/ref/models/querysets/#alias
*/
private class ObjectsAlias extends SqlExecution::Range, DataFlow::CallCfgNode {
ControlFlowNode sql;
ObjectsAlias() {
this = django::db::models::querySetReturningMethod("alias").getACall() and
django::db::models::expressions::RawSQL::instance(sql) in [
this.getArg(_), this.getArgByName(_)
]
}
override DataFlow::Node getSql() { result.asCfgNode() = sql }
}
/**
* A call to the `raw` function on a model.
*