Python: Model FastAPI requests

Co-authored-by: Joe Farebrother <joefarebrother@github.com>

python/ql/lib/semmle/python/frameworks/Starlette.qll

@@ -245,4 +245,60 @@ module Starlette {
 
     override DataFlow::Node getAPathArgument() { result = this.getParameter(0, "path").asSink() }
   }
+
+  /**
+   * Provides models for the `starlette.requests.Request` class
+   *
+   * See https://www.starlette.io/requests/.
+   */
+  module Request {
+    /** Gets a reference to the `starlette.requests.Request` class. */
+    API::Node classRef() {
+      result = API::moduleImport("starlette").getMember("requests").getMember("Request")
+      or
+      result = API::moduleImport("fastapi").getMember("Request")
+    }
+
+    /**
+     * A source of instances of `starlette.requests.Request`, extend this class to model new instances.
+     *
+     * This can include instantiations of the class, return values from function
+     * calls, or a special parameter that will be set when functions are called by an external
+     * library.
+     *
+     * Use the predicate `Request::instance()` to get references to instances of `starlette.requests.Request`.
+     */
+    abstract class InstanceSource extends DataFlow::LocalSourceNode { }
+
+    /** A direct instantiation of `starlette.requests.Request`. */
+    private class ClassInstantiation extends InstanceSource {
+      ClassInstantiation() { this = classRef().getAnInstance().asSource() }
+    }
+
+    /** Gets a reference to an instance of `starlette.requests.Request`. */
+    private DataFlow::TypeTrackingNode instance(DataFlow::TypeTracker t) {
+      t.start() and
+      result instanceof InstanceSource
+      or
+      exists(DataFlow::TypeTracker t2 | result = instance(t2).track(t2, t))
+    }
+
+    /** Gets a reference to an instance of `starlette.requests.Request`. */
+    DataFlow::Node instance() { instance(DataFlow::TypeTracker::end()).flowsTo(result) }
+
+    /**
+     * Taint propagation for `starlette.requests.Request`.
+     */
+    private class InstanceTaintSteps extends InstanceTaintStepsHelper {
+      InstanceTaintSteps() { this = "starlette.requests.Request" }
+
+      override DataFlow::Node getInstance() { result = instance() }
+
+      override string getAttributeName() { result in ["cookies"] }
+
+      override string getMethodName() { none() }
+
+      override string getAsyncMethodName() { result in ["body", "json", "form", "stream"] }
+    }
+  }
 }