hohn/codeql
1
0
Fork 0
mirror of https://github.com/github/codeql.git synced 2025-12-20 10:46:30 +01:00
Code Issues Packages Projects Releases Wiki Activity

Python: Refactor RouteSetup with default impl for getUrlPattern

Browse Source 
Having multiple copies of the StrConst data-flow tracking code means that if we
need to update this to be more sophisticated, we could easily forget to do it
somewhere :|

Until we have a proper `.getAPossibleStringValue` helper, this refactoring
should be nice :)
This commit is contained in:
Rasmus Wriedt Larsen
2020-10-15 19:48:08 +02:00
parent 44683f2959
commit 8803fb2778
3 changed files with 13 additions and 27 deletions
Download Patch File Download Diff File Expand all files Collapse all files

10
python/ql/src/experimental/semmle/python/Concepts.qll
View File

@@ -163,8 +163,16 @@ module HTTP {
* extend `RouteSetup` instead.
*/
abstract class Range extends DataFlow::Node {
/** Gets the argument used to set the URL pattern. */
abstract DataFlow::Node getUrlPatternArg();
/** Gets the URL pattern for this route, if it can be statically determined. */
abstract string getUrlPattern();
string getUrlPattern() {
exists(StrConst str |
DataFlow::localFlow(DataFlow::exprNode(str), this.getUrlPatternArg()) and
result = str.getText()
)
}
/** Gets a function that will handle incoming requests for this route, if any. */
abstract Function getARouteHandler();

20
python/ql/src/experimental/semmle/python/frameworks/Django.qll
View File

@@ -170,14 +170,8 @@ private module Django {
DjangoUrlsPathCall() { node.getFunction() = django::urls::path().asCfgNode() }
override string getUrlPattern() {
exists(StrConst str, ControlFlowNode urlPatternArg |
urlPatternArg = [node.getArg(0), node.getArgByName("route")]
|
DataFlow::localFlow(DataFlow::exprNode(str),
any(DataFlow::Node n | n.asCfgNode() = urlPatternArg)) and
result = str.getText()
)
override DataFlow::Node getUrlPatternArg() {
result.asCfgNode() = [node.getArg(0), node.getArgByName("route")]
}
override Function getARouteHandler() {
@@ -200,14 +194,8 @@ private module Django {
DjangoUrlsRePathCall() { node.getFunction() = django::urls::re_path().asCfgNode() }
override string getUrlPattern() {
exists(StrConst str, ControlFlowNode urlPatternArg |
urlPatternArg = [node.getArg(0), node.getArgByName("route")]
|
DataFlow::localFlow(DataFlow::exprNode(str),
any(DataFlow::Node n | n.asCfgNode() = urlPatternArg)) and
result = str.getText()
)
override DataFlow::Node getUrlPatternArg() {
result.asCfgNode() = [node.getArg(0), node.getArgByName("route")]
}
override Function getARouteHandler() {

10
python/ql/src/experimental/semmle/python/frameworks/Flask.qll
View File

@@ -131,16 +131,6 @@ private module Flask {
)
)
}
/** Gets the argument used to pass in the URL pattern. */
abstract DataFlow::Node getUrlPatternArg();
override string getUrlPattern() {
exists(StrConst str |
DataFlow::localFlow(DataFlow::exprNode(str), this.getUrlPatternArg()) and
result = str.getText()
)
}
}
/**