Python: FastAPI: Add support for APIRouter

python/ql/lib/semmle/python/frameworks/FastApi.qll

@@ -23,6 +23,18 @@ private module FastApi {
     API::Node instance() { result = API::moduleImport("fastapi").getMember("FastAPI").getReturn() }
   }
 
+  /**
+   * Provides models for the `fastapi.APIRouter` class
+   *
+   * See https://fastapi.tiangolo.com/tutorial/bigger-applications/.
+   */
+  module APIRouter {
+    /** Gets a reference to an instance of `fastapi.APIRouter`. */
+    API::Node instance() {
+      result = API::moduleImport("fastapi").getMember("APIRouter").getReturn()
+    }
+  }
+
   // ---------------------------------------------------------------------------
   // routing modeling
   // ---------------------------------------------------------------------------
@@ -39,6 +51,8 @@ private module FastApi {
         routeAddingMethod = "api_route"
       |
         this = App::instance().getMember(routeAddingMethod).getACall()
+        or
+        this = APIRouter::instance().getMember(routeAddingMethod).getACall()
       )
     }
 

python/ql/test/library-tests/frameworks/fastapi/basic.py

@@ -60,7 +60,6 @@ async def get_baz(baz_id: int): # $ requestHandler routedParameter=baz_id
 # see https://fastapi.tiangolo.com/tutorial/path-params/
 
 # More stuff that we should support:
-# - https://fastapi.tiangolo.com/tutorial/bigger-applications/
 # - https://fastapi.tiangolo.com/advanced/response-cookies/
 # - https://fastapi.tiangolo.com/tutorial/dependencies/
 # - Extra taint-steps for files

python/ql/test/library-tests/frameworks/fastapi/router.py

@@ -0,0 +1,33 @@
+# like blueprints in Flask
+# see https://fastapi.tiangolo.com/tutorial/bigger-applications/
+
+from fastapi import APIRouter, FastAPI
+
+
+inner_router = APIRouter()
+
+@inner_router.get("/foo") # $ routeSetup="/foo"
+async def root(): # $ requestHandler
+    return {"msg": "inner_router /foo"} # $ HttpResponse
+
+outer_router = APIRouter()
+outer_router.include_router(inner_router, prefix="/inner")
+
+
+items_router = APIRouter(
+    prefix="/items",
+    tags=["items"],
+)
+
+
+@items_router.get("/") # $ routeSetup="/"
+async def items(): # $ requestHandler
+    return {"msg": "items_router /"} # $ HttpResponse
+
+
+app = FastAPI()
+
+app.include_router(outer_router, prefix="/outer")
+app.include_router(items_router)
+
+# see basic.py for instructions for how to run this code.