Python: Modernise TurboGears library

This commit is contained in:
Rasmus Wriedt Larsen
2019-11-27 14:19:04 +01:00
parent a2827e9503
commit 9ef270fc92

View File

@@ -2,13 +2,13 @@ import python
import semmle.python.security.TaintTracking
private ClassObject theTurboGearsControllerClass() {
result = ModuleObject::named("tg").attr("TGController")
private ClassValue theTurboGearsControllerClass() {
result = Value::named("tg.TGController")
}
ClassObject aTurboGearsControllerClass() {
result.getASuperType() = theTurboGearsControllerClass()
ClassValue aTurboGearsControllerClass() {
result.getABaseType+() = theTurboGearsControllerClass()
}
@@ -17,13 +17,13 @@ class TurboGearsControllerMethod extends Function {
ControlFlowNode decorator;
TurboGearsControllerMethod() {
aTurboGearsControllerClass().getPyClass() = this.getScope() and
aTurboGearsControllerClass().getScope() = this.getScope() and
decorator = this.getADecorator().getAFlowNode() and
/* Is decorated with @expose() or @expose(path) */
(
decorator.(CallNode).getFunction().(NameNode).getId() = "expose"
or
decorator.refersTo(_, ModuleObject::named("tg").attr("expose"), _)
decorator.pointsTo().getClass() = Value::named("tg.expose")
)
}
@@ -35,21 +35,12 @@ class TurboGearsControllerMethod extends Function {
exists(templateName())
}
string getTemplateName() {
exists(StringObject str |
templateName().refersTo(str) and
result = str.getText()
)
}
Dict getValidationDict() {
exists(Call call, Object dict |
exists(Call call, Value dict |
call = this.getADecorator() and
call.getFunc().(Name).getId() = "validate" and
call.getArg(0).refersTo(dict) and
result = dict.getOrigin()
call.getArg(0).pointsTo(dict, result)
)
}
}