hohn/codeql
1
0
Fork 0
mirror of https://github.com/github/codeql.git synced 2025-12-22 11:46:32 +01:00
Code Issues Packages Projects Releases Wiki Activity

Python: Add support for .executescript

Browse Source
This commit is contained in:
Rasmus Wriedt Larsen
2023-03-22 15:08:53 +01:00
parent eb43fa2644
commit 2b4ebf7377
2 changed files with 6 additions and 5 deletions
Download Patch File Download Diff File Expand all files Collapse all files

7
python/ql/lib/semmle/python/frameworks/PEP249.qll
View File

@@ -49,11 +49,12 @@ module PEP249 {
}
private string getSqlKwargName() {
result in ["sql", "statement", "operation", "query", "query_string"]
result in ["sql", "statement", "operation", "query", "query_string", "sql_script"]
}
/**
* A call to `execute` or `executemany` method on a database cursor or a connection.
* A call to an execute method on a database cursor or a connection, such as `execute`
* or `executemany`.
*
* See
* - https://peps.python.org/pep-0249/#execute
@@ -67,7 +68,7 @@ module PEP249 {
exists(API::Node start |
start instanceof DatabaseCursor or start instanceof DatabaseConnection
|
this = start.getMember(["execute", "executemany"]).getACall()
this = start.getMember(["execute", "executemany", "executescript"]).getACall()
)
}

4
python/ql/test/library-tests/frameworks/stdlib/pep249.py
View File

@@ -6,8 +6,8 @@ db.execute("some sql", (42,)) # $ getSql="some sql"
cursor = db.cursor()
cursor.execute("some sql", (42,)) # $ getSql="some sql"
cursor.executescript("sql") # $ MISSING: getSql="sql"
cursor.executescript(sql_script="sql") # $ MISSING: getSql="sql"
cursor.executescript("sql") # $ getSql="sql"
cursor.executescript(sql_script="sql") # $ getSql="sql"
import sqlite3.dbapi2
conn = sqlite3.dbapi2.connect()