diff --git a/python/ql/lib/semmle/python/frameworks/RestFramework.qll b/python/ql/lib/semmle/python/frameworks/RestFramework.qll index 49eb3cbe7e6..4e327491ca6 100644 --- a/python/ql/lib/semmle/python/frameworks/RestFramework.qll +++ b/python/ql/lib/semmle/python/frameworks/RestFramework.qll @@ -194,6 +194,9 @@ private module RestFramework { exists(RestFrameworkApiViewClass vc | this.getParameter() = vc.getARequestHandler().(PrivateDjango::DjangoRouteHandler).getRequestParam() + or + // retrieve(self, request, **kwargs) + this.getParameter() = vc.getARequestHandler().(PrivateDjango::DjangoRouteHandler).getKwarg() ) or // annotated with @api_view decorator