Apply suggestions from code review

Co-authored-by: Rasmus Wriedt Larsen <rasmuswriedtlarsen@gmail.com>
This commit is contained in:
porcupineyhairs
2020-07-23 19:37:40 +05:30
committed by GitHub
parent a97f942a17
commit 8e85dc755a
8 changed files with 16 additions and 21 deletions

View File

@@ -17,7 +17,7 @@ ClassValue theCheetahTemplateClass() { result = Value::named("Cheetah.Template.T
* contents = 'Hello World!'
* t3 = Template3("sink")
*
* This should also detect cases of the following type :
* This will also detect cases of the following type :
*
* from Cheetah.Template import Template
* t3 = Template("sink")

View File

@@ -17,7 +17,7 @@ Value theJinja2FromStringValue() { result = Value::named("jinja2.from_string") }
* template = Template(`sink`)
*/
class Jinja2TemplateSink extends SSTISink {
override string toString() { result = "argument to Jinja2.template()" }
override string toString() { result = "argument to jinja2.Template()" }
Jinja2TemplateSink() {
exists(CallNode call |
@@ -30,13 +30,13 @@ class Jinja2TemplateSink extends SSTISink {
}
/**
* Sink representing the `jinja2.Template` class instantiation argument.
* Sink representing the `jinja2.from_string` function call argument.
*
* from jinja2 import Template
* template = Template(`sink`)
* from jinja2 import from_string
* template = from_string(`sink`)
*/
class Jinja2FromStringSink extends SSTISink {
override string toString() { result = "argument to Jinja2.from_string()" }
override string toString() { result = "argument to jinja2.from_string()" }
Jinja2FromStringSink() {
exists(CallNode call |

View File

@@ -2,6 +2,6 @@ import semmle.python.dataflow.TaintTracking
/**
* A generic taint sink that is vulnerable to template inclusions.
* The `temp` in `Jinja2.Template(temp)` and similar.
* The `temp` in `jinja2.Template(temp)` and similar.
*/
abstract class SSTISink extends TaintSink { }