hohn/codeql
1
0
Fork 0
mirror of https://github.com/github/codeql.git synced 2025-12-20 10:46:30 +01:00
Code Issues Packages Projects Releases Wiki Activity

Python: Fix false negative

Browse Source
This commit is contained in:
Rasmus Lerchedahl Petersen
2020-10-21 14:16:35 +02:00
parent 03c62fd267
commit 4571b3188c
2 changed files with 22 additions and 6 deletions
Download Patch File Download Diff File Expand all files Collapse all files

24
python/ql/src/experimental/semmle/python/frameworks/Django.qll
View File

@@ -275,6 +275,22 @@ private module Django {
* Gets a reference to the `django.db.models.expressions.RawSQL` class.
*/
DataFlow::Node classRef() { result = classRef(DataFlow::TypeTracker::end()) }
/** Gets an instance of the `django.db.models.expressions.RawSQL` class. */
private DataFlow::Node classInstance(DataFlow::TypeTracker t, ControlFlowNode sql) {
t.start() and
exists(CallNode c | result.asCfgNode() = c |
c.getFunction() = classRef().asCfgNode() and
c.getArg(0) = sql
)
or
exists(DataFlow::TypeTracker t2 | result = classInstance(t2, sql).track(t2, t))
}
/** Gets an instance of the `django.db.models.expressions.RawSQL` class. */
DataFlow::Node classInstance(ControlFlowNode sql) {
result = classInstance(DataFlow::TypeTracker::end(), sql)
}
}
}
}
@@ -305,15 +321,15 @@ private module Django {
*/
private class ObjectsAnnotate extends SqlExecution::Range, DataFlow::CfgNode {
override CallNode node;
CallNode raw;
ControlFlowNode sql;
ObjectsAnnotate() {
node.getFunction() = django::db::models::objects_attr("annotate").asCfgNode() and
raw in [node.getArg(_), node.getArgByName(_)] and
raw.getFunction() = django::db::models::expressions::RawSQL::classRef().asCfgNode()
django::db::models::expressions::RawSQL::classInstance(sql).asCfgNode() in [node.getArg(_),
node.getArgByName(_)]
}
override DataFlow::Node getSql() { result.asCfgNode() = raw.getArg(0) }
override DataFlow::Node getSql() { result.asCfgNode() = sql }
}
/**