mirror of
https://github.com/github/codeql.git
synced 2025-12-20 10:46:30 +01:00
Python: Expose HTTP verbs in HTTP concept
Let's discuss whether doing it this way is reasonable, since I'm not 100% sure whether this fits into "concepts" or not.
This commit is contained in:
@@ -295,6 +295,8 @@ module SqlExecution {
|
||||
|
||||
/** Provides classes for modeling HTTP-related APIs. */
|
||||
module HTTP {
|
||||
import semmle.python.web.HttpConstants
|
||||
|
||||
/** Provides classes for modeling HTTP servers. */
|
||||
module Server {
|
||||
/**
|
||||
|
||||
@@ -1680,8 +1680,7 @@ private module Django {
|
||||
// TODO: This doesn't handle attribute assignment. Should be OK, but analysis is not as complete as with
|
||||
// points-to and `.lookup`, which would handle `post = my_post_handler` inside class def
|
||||
result = this.getAMethod() and
|
||||
// TODO: Add HTTP verbs
|
||||
result.getName() in ["post", "get"]
|
||||
result.getName() = HTTP::httpVerbLower()
|
||||
}
|
||||
|
||||
/** Gets a reference to this class. */
|
||||
|
||||
@@ -1,4 +1,4 @@
|
||||
/** Gets an http verb */
|
||||
/** Gets an HTTP verb */
|
||||
string httpVerb() {
|
||||
result = "GET" or
|
||||
result = "POST" or
|
||||
@@ -9,5 +9,5 @@ string httpVerb() {
|
||||
result = "HEAD"
|
||||
}
|
||||
|
||||
/** Gets an http verb, in lower case */
|
||||
/** Gets an HTTP verb, in lower case */
|
||||
string httpVerbLower() { result = httpVerb().toLowerCase() }
|
||||
|
||||
Reference in New Issue
Block a user