hohn/codeql
1
0
Fork 0
mirror of https://github.com/github/codeql.git synced 2025-12-21 11:16:30 +01:00
Code Issues Packages Projects Releases Wiki Activity

Python: Add Django RawSQL and HttpRequest models

Browse Source
This commit is contained in:
Taus
2023-10-10 14:07:28 +00:00
committed by Rasmus Wriedt Larsen
parent ff9482f81b
commit a81f8ea54d
2 changed files with 24 additions and 1 deletions
Download Patch File Download Diff File Expand all files Collapse all files

9
python/ql/lib/semmle/python/frameworks/Django.qll
View File

@@ -838,6 +838,10 @@ module PrivateDjango {
or
// Commonly used alias
result = models().getMember("RawSQL")
or
result =
ModelOutput::getATypeNode("django.db.models.expressions.RawSQL~Subclass")
.getASubclass*()
}
/**
@@ -1172,6 +1176,9 @@ module PrivateDjango {
or
// handle django.http.HttpRequest alias
result = http().getMember("HttpRequest")
or
result =
ModelOutput::getATypeNode("django.http.request.HttpRequest~Subclass").getASubclass*()
}
/**
@@ -1475,7 +1482,7 @@ module PrivateDjango {
API::Node classRef() {
result = baseClassRef().getASubclass*() or
result =
ModelOutput::getATypeNode("Django.http.response.HttpResponsePermanentRedirect~Subclass")
ModelOutput::getATypeNode("django.http.response.HttpResponsePermanentRedirect~Subclass")
.getASubclass*()
}

16
python/ql/src/meta/ClassHierarchy/Find.ql
View File

@@ -259,6 +259,22 @@ class FabricConnection extends FindSubclassesSpec {
}
}
class DjangoRawSql extends FindSubclassesSpec {
DjangoRawSql() { this = "django.db.models.expressions.RawSQL~Subclass" }
override API::Node getAlreadyModeledClass() {
result = PrivateDjango::DjangoImpl::DB::Models::Expressions::RawSql::classRef()
}
}
class DjangoHttpRequest extends FindSubclassesSpec {
DjangoHttpRequest() { this = "django.http.request.HttpRequest~Subclass" }
override API::Node getAlreadyModeledClass() {
result = PrivateDjango::DjangoImpl::DjangoHttp::Request::HttpRequest::classRef()
}
}
bindingset[fullyQualified]
predicate fullyQualifiedToYamlFormat(string fullyQualified, string type2, string path) {
exists(int firstDot | firstDot = fullyQualified.indexOf(".", 0, 0) |