move RegExpInterpretation into Concepts.qll

This commit is contained in:
erik-krogh
2023-03-24 12:22:19 +01:00
parent 2fad406b5c
commit a7f733ab8c
5 changed files with 23 additions and 15 deletions

View File

@@ -421,6 +421,26 @@ module RegexExecution {
}
}
/**
* A node that is not a regular expression literal, but is used in places that
* may interpret it as one. Instances of this class are typically strings that
* flow to method calls like `re.compile`.
*
* Extend this class to refine existing API models. If you want to model new APIs,
* extend `RegExpInterpretation::Range` instead.
*/
class RegExpInterpretation extends DataFlow::Node instanceof RegExpInterpretation::Range { }
/** Provides a class for modeling regular expression interpretations. */
module RegExpInterpretation {
/**
* A node that is not a regular expression literal, but is used in places that
* may interpret it as one. Instances of this class are typically strings that
* flow to method calls like `re.compile`.
*/
abstract class Range extends DataFlow::Node { }
}
/** Provides classes for modeling XML-related APIs. */
module XML {
/**

View File

@@ -3015,13 +3015,11 @@ private module StdlibPrivate {
override string getKind() { result = Escaping::getRegexKind() }
}
private import semmle.python.regex as Regex
/**
* A node interpreted as a regular expression.
* Speficically nodes where string values are interpreted as regular expressions.
*/
class StdLibRegExpInterpretation extends Regex::RegExpInterpretation::Range {
private class StdLibRegExpInterpretation extends RegExpInterpretation::Range {
StdLibRegExpInterpretation() {
this =
API::moduleImport("re").getMember("compile").getACall().getParameter(0, "pattern").asSink()

View File

@@ -15,16 +15,6 @@ RegExpTerm getTermForExecution(Concepts::RegexExecution exec) {
)
}
/** Provides a class for modeling regular expression interpretations. */
module RegExpInterpretation {
/**
* A node that is not a regular expression literal, but is used in places that
* may interpret it as one. Instances of this class are typically strings that
* flow to method calls like `re.compile`.
*/
abstract class Range extends DataFlow::Node { }
}
/** A StrConst used as a regular expression */
deprecated class RegexString extends Regex {
RegexString() { this = RegExpTracking::regExpSource(_).asExpr() }

View File

@@ -24,7 +24,7 @@ private module FindRegexMode {
sink = call.(Concepts::RegexExecution).getRegex()
or
call.getArg(_) = sink and
sink instanceof RegExpInterpretation::Range
sink instanceof Concepts::RegExpInterpretation::Range
|
exists(DataFlow::CallCfgNode callNode |
call = callNode and

View File

@@ -23,7 +23,7 @@ private import semmle.python.regex as Regex
DataFlow::Node regSink() {
result = any(Concepts::RegexExecution exec).getRegex()
or
result instanceof Regex::RegExpInterpretation::Range
result instanceof Concepts::RegExpInterpretation
}
/**