hohn/codeql
1
0
Fork 0
mirror of https://github.com/github/codeql.git synced 2025-12-22 11:46:32 +01:00
Code Issues Packages Projects Releases Wiki Activity

Python: Add support for .executescript

Browse Source
This commit is contained in:
Rasmus Wriedt Larsen
2023-03-22 15:08:53 +01:00
parent eb43fa2644
commit 2b4ebf7377
2 changed files with 6 additions and 5 deletions
Download Patch File Download Diff File Expand all files Collapse all files

7
python/ql/lib/semmle/python/frameworks/PEP249.qll
View File

@@ -49,11 +49,12 @@ module PEP249 {
} }
private string getSqlKwargName() { private string getSqlKwargName() {
result in ["sql", "statement", "operation", "query", "query_string"] result in ["sql", "statement", "operation", "query", "query_string", "sql_script"]
} }
/** /**
* A call to `execute` or `executemany` method on a database cursor or a connection. * A call to an execute method on a database cursor or a connection, such as `execute`
* or `executemany`.
* *
* See * See
* - https://peps.python.org/pep-0249/#execute * - https://peps.python.org/pep-0249/#execute
@@ -67,7 +68,7 @@ module PEP249 {
exists(API::Node start | exists(API::Node start |
start instanceof DatabaseCursor or start instanceof DatabaseConnection start instanceof DatabaseCursor or start instanceof DatabaseConnection
| |
this = start.getMember(["execute", "executemany"]).getACall() this = start.getMember(["execute", "executemany", "executescript"]).getACall()
) )
} }

4
python/ql/test/library-tests/frameworks/stdlib/pep249.py
View File

@@ -6,8 +6,8 @@ db.execute("some sql", (42,)) # $ getSql="some sql"
cursor = db.cursor() cursor = db.cursor()
cursor.execute("some sql", (42,)) # $ getSql="some sql" cursor.execute("some sql", (42,)) # $ getSql="some sql"
cursor.executescript("sql") # $ MISSING: getSql="sql" cursor.executescript("sql") # $ getSql="sql"
cursor.executescript(sql_script="sql") # $ MISSING: getSql="sql" cursor.executescript(sql_script="sql") # $ getSql="sql"
import sqlite3.dbapi2 import sqlite3.dbapi2
conn = sqlite3.dbapi2.connect() conn = sqlite3.dbapi2.connect()