hohn/codeql
1
0
Fork 0
mirror of https://github.com/github/codeql.git synced 2026-04-28 18:25:24 +02:00
Code Issues Packages Projects Releases Wiki Activity

Add tests

Browse Source
This commit is contained in:
Joe Farebrother
2025-11-24 11:03:16 +00:00
parent ba06990290
commit a83c70f99d
5 changed files with 45 additions and 2 deletions
Download Patch File Download Diff File Expand all files Collapse all files

1
python/ql/lib/semmle/python/Frameworks.qll
View File

@@ -78,6 +78,7 @@ private import semmle.python.frameworks.Sanic
private import semmle.python.frameworks.ServerLess
private import semmle.python.frameworks.Setuptools
private import semmle.python.frameworks.Simplejson
private import semmle.python.frameworks.Socketio
private import semmle.python.frameworks.SqlAlchemy
private import semmle.python.frameworks.Starlette
private import semmle.python.frameworks.Stdlib

15
python/ql/lib/semmle/python/frameworks/Socketio.qll
View File

@@ -6,6 +6,7 @@
private import python
private import semmle.python.dataflow.new.DataFlow
private import semmle.python.dataflow.new.TaintTracking
private import semmle.python.dataflow.new.RemoteFlowSources
private import semmle.python.Concepts
private import semmle.python.ApiGraphs
private import semmle.python.frameworks.internal.PoorMansFunctionResolution
@@ -31,7 +32,9 @@ module SocketIO {
serverEventAnnotation().getAValueReachableFromSource().asExpr() = this.getADecorator()
}
override Parameter getARoutedParameter() { result = this.getAnArg() }
override Parameter getARoutedParameter() {
result = this.getAnArg() and not result = this.getArg(0)
}
override string getFramework() { result = "socketio" }
}
@@ -52,8 +55,16 @@ module SocketIO {
private class CallbackHandler extends Http::Server::RequestHandler::Range {
CallbackHandler() { any(CallbackArgument ca) = poorMansFunctionTracker(this) }
override Parameter getARoutedParameter() { result = this.getAnArg() }
override Parameter getARoutedParameter() {
result = this.getAnArg() and not result = this.getArg(0)
}
override string getFramework() { result = "socketio" }
}
private class SocketIOCall extends RemoteFlowSource::Range {
SocketIOCall() { this = server().getMember("call").getACall() }
override string getSourceType() { result = "socketio call" }
}
}