Python: Modernise tornado library

This commit is contained in:
Rasmus Wriedt Larsen
2019-10-01 16:04:54 +02:00
parent 3e3833927b
commit 2bb933fef0
7 changed files with 21 additions and 12 deletions

View File

@@ -3,26 +3,25 @@ import python
import semmle.python.security.TaintTracking
import semmle.python.web.Http
private ClassObject theTornadoRequestHandlerClass() {
result = ModuleObject::named("tornado.web").attr("RequestHandler")
private ClassValue theTornadoRequestHandlerClass() {
result = Value::named("tornado.web.RequestHandler")
}
ClassObject aTornadoRequestHandlerClass() {
result.getASuperType() = theTornadoRequestHandlerClass()
ClassValue aTornadoRequestHandlerClass() {
result.getABaseType+() = theTornadoRequestHandlerClass()
}
/** Holds if `node` is likely to refer to an instance of a tornado
/** Holds if `node` is likely to refer to an instance of a tornado
* `RequestHandler` class.
*/
predicate isTornadoRequestHandlerInstance(ControlFlowNode node) {
node.refersTo(_, aTornadoRequestHandlerClass(), _)
node.pointsTo().getClass() = aTornadoRequestHandlerClass()
or
/* In some cases, the points-to analysis won't capture all instances we care
* about. For these, we use the following syntactic check. First, that
* `node` appears inside a method of a subclass of
* about. For these, we use the following syntactic check. First, that
* `node` appears inside a method of a subclass of
* `tornado.web.RequestHandler`:*/
node.getScope().getEnclosingScope().(Class).getClassObject() = aTornadoRequestHandlerClass() and
node.getScope().getEnclosingScope() = aTornadoRequestHandlerClass().getScope() and
/* Secondly, that `node` refers to the `self` argument: */
node.isLoad() and node.(NameNode).isSelf()
}