hohn/codeql
1
0
Fork 0
mirror of https://github.com/github/codeql.git synced 2026-04-30 11:15:13 +02:00
Code Issues Packages Projects Releases Wiki Activity

Python: Model response_class attribute of Flask class

Browse Source
This commit is contained in:
Rasmus Wriedt Larsen
2020-10-22 14:40:09 +02:00
parent 082e35c2c7
commit 44ba3469db
2 changed files with 20 additions and 5 deletions
Download Patch File Download Diff File Expand all files Collapse all files

17
python/ql/src/experimental/semmle/python/frameworks/Flask.qll
View File

@@ -171,6 +171,21 @@ private module FlaskModel {
// completely disallowed in QL. I added an underscore to move thing forwards for
// now :(
DataFlow::Node make_response_() { result = instance_attr("make_response") }
/** Gets a reference to the `response_class` attribute on the `flask.Flask` class or an instance. */
private DataFlow::Node response_class(DataFlow::TypeTracker t) {
t.startInAttr("response_class") and
result in [classRef(), instance()]
or
exists(DataFlow::TypeTracker t2 | result = response_class(t2).track(t2, t))
}
/**
* Gets a reference to the `response_class` attribute on the `flask.Flask` class or an instance.
*
* See https://flask.palletsprojects.com/en/1.1.x/api/#flask.Flask.response_class
*/
DataFlow::Node response_class() { result = response_class(DataFlow::TypeTracker::end()) }
}
}
@@ -183,7 +198,7 @@ private module FlaskModel {
/** Gets a reference to the `flask.Response` class. */
private DataFlow::Node classRef(DataFlow::TypeTracker t) {
t.start() and
result = flask_attr("Response")
result in [flask_attr("Response"), flask::Flask::response_class()]
or
exists(DataFlow::TypeTracker t2 | result = classRef(t2).track(t2, t))
}