mirror of
https://github.com/github/codeql.git
synced 2026-04-29 02:35:15 +02:00
Python: Modernise tornado library
This commit is contained in:
@@ -3,26 +3,25 @@ import python
|
||||
import semmle.python.security.TaintTracking
|
||||
import semmle.python.web.Http
|
||||
|
||||
private ClassObject theTornadoRequestHandlerClass() {
|
||||
result = ModuleObject::named("tornado.web").attr("RequestHandler")
|
||||
private ClassValue theTornadoRequestHandlerClass() {
|
||||
result = Value::named("tornado.web.RequestHandler")
|
||||
}
|
||||
|
||||
ClassObject aTornadoRequestHandlerClass() {
|
||||
result.getASuperType() = theTornadoRequestHandlerClass()
|
||||
ClassValue aTornadoRequestHandlerClass() {
|
||||
result.getABaseType+() = theTornadoRequestHandlerClass()
|
||||
}
|
||||
|
||||
/** Holds if `node` is likely to refer to an instance of a tornado
|
||||
/** Holds if `node` is likely to refer to an instance of a tornado
|
||||
* `RequestHandler` class.
|
||||
*/
|
||||
|
||||
predicate isTornadoRequestHandlerInstance(ControlFlowNode node) {
|
||||
node.refersTo(_, aTornadoRequestHandlerClass(), _)
|
||||
node.pointsTo().getClass() = aTornadoRequestHandlerClass()
|
||||
or
|
||||
/* In some cases, the points-to analysis won't capture all instances we care
|
||||
* about. For these, we use the following syntactic check. First, that
|
||||
* `node` appears inside a method of a subclass of
|
||||
* about. For these, we use the following syntactic check. First, that
|
||||
* `node` appears inside a method of a subclass of
|
||||
* `tornado.web.RequestHandler`:*/
|
||||
node.getScope().getEnclosingScope().(Class).getClassObject() = aTornadoRequestHandlerClass() and
|
||||
node.getScope().getEnclosingScope() = aTornadoRequestHandlerClass().getScope() and
|
||||
/* Secondly, that `node` refers to the `self` argument: */
|
||||
node.isLoad() and node.(NameNode).isSelf()
|
||||
}
|
||||
|
||||
Reference in New Issue
Block a user