hohn/codeql
1
0
Fork 0
mirror of https://github.com/github/codeql.git synced 2026-04-30 19:26:02 +02:00
Code Issues Packages Projects Releases Wiki Activity

Python: Model django.conf.urls.url (v 1.x)

Browse Source
This commit is contained in:
Rasmus Wriedt Larsen
2020-10-23 14:26:37 +02:00
parent be166d9c02
commit b3e53f8d0a
5 changed files with 124 additions and 50 deletions
Download Patch File Download Diff File Expand all files Collapse all files

132
python/ql/src/experimental/semmle/python/frameworks/Django.qll
View File

@@ -34,7 +34,7 @@ private module Django {
* WARNING: Only holds for a few predefined attributes.
*/
private DataFlow::Node django_attr(DataFlow::TypeTracker t, string attr_name) {
attr_name in ["db", "urls", "http"] and
attr_name in ["db", "urls", "http", "conf"] and
(
t.start() and
result = DataFlow::importNode("django" + "." + attr_name)
@@ -437,6 +437,55 @@ private module Django {
DataFlow::Node re_path() { result = urls_attr("re_path") }
}
// -------------------------------------------------------------------------
// django.conf
// -------------------------------------------------------------------------
/** Gets a reference to the `django.conf` module. */
DataFlow::Node conf() { result = django_attr("conf") }
/** Provides models for the `django.conf` module */
module conf {
// -------------------------------------------------------------------------
// django.conf.urls
// -------------------------------------------------------------------------
/** Gets a reference to the `django.conf.urls` module. */
private DataFlow::Node urls(DataFlow::TypeTracker t) {
t.start() and
result = DataFlow::importNode("django.conf.urls")
or
t.startInAttr("urls") and
result = conf()
or
exists(DataFlow::TypeTracker t2 | result = urls(t2).track(t2, t))
}
// NOTE: had to rename due to shadowing rules in QL
/** Gets a reference to the `django.conf.urls` module. */
DataFlow::Node conf_urls() { result = urls(DataFlow::TypeTracker::end()) }
// NOTE: had to rename due to shadowing rules in QL
/** Provides models for the `django.conf.urls` module */
module conf_urls {
/** Gets a reference to the `django.conf.urls.url` function. */
private DataFlow::Node url(DataFlow::TypeTracker t) {
t.start() and
result = DataFlow::importNode("django.conf.urls.url")
or
t.startInAttr("url") and
result = conf_urls()
or
exists(DataFlow::TypeTracker t2 | result = url(t2).track(t2, t))
}
/**
* Gets a reference to the `django.conf.urls.url` function.
*
* See https://docs.djangoproject.com/en/1.11/ref/urls/#django.conf.urls.url
*/
DataFlow::Node url() { result = url(DataFlow::TypeTracker::end()) }
}
}
// -------------------------------------------------------------------------
// django.http
// -------------------------------------------------------------------------
@@ -684,20 +733,48 @@ private module Django {
}
}
/** A Django route setup that uses a Regex to specify route (and routed parameters). */
abstract private class DjangoRegexRouteSetup extends DjangoRouteSetup {
override Parameter getARoutedParameter() {
// If we don't know the URL pattern, we simply mark all parameters as a routed
// parameter. This should give us more RemoteFlowSources but could also lead to
// more FPs. If this turns out to be the wrong tradeoff, we can always change our mind.
exists(DjangoRouteHandler routeHandler | routeHandler = this.getARouteHandler() |
not exists(this.getUrlPattern()) and
result in [routeHandler.getArg(_), routeHandler.getArgByName(_)] and
not result = any(int i | i <= routeHandler.getRequestParamIndex() | routeHandler.getArg(i))
)
or
exists(DjangoRouteHandler routeHandler, DjangoRouteRegex regex |
routeHandler = this.getARouteHandler() and
regex.getRouteSetup() = this
|
// either using named capture groups (passed as keyword arguments) or using
// unnamed capture groups (passed as positional arguments)
not exists(regex.getGroupName(_, _)) and
// first group will have group number 1
result =
routeHandler.getArg(routeHandler.getRequestParamIndex() + regex.getGroupNumber(_, _))
or
result = routeHandler.getArgByName(regex.getGroupName(_, _))
)
}
}
/**
* A regex that is used in a call to `django.urls.re_path`.
* A regex that is used to set up a route.
*
* Needs this subclass to be considered a RegexString.
*/
private class DjangoUrlsRePathRegex extends RegexString {
DjangoUrlsRePathCall rePathCall;
private class DjangoRouteRegex extends RegexString {
DjangoRegexRouteSetup rePathCall;
DjangoUrlsRePathRegex() {
DjangoRouteRegex() {
this instanceof StrConst and
DataFlow::localFlow(DataFlow::exprNode(this), rePathCall.getUrlPatternArg())
}
DjangoUrlsRePathCall getRePathCall() { result = rePathCall }
DjangoRegexRouteSetup getRouteSetup() { result = rePathCall }
}
/**
@@ -705,7 +782,7 @@ private module Django {
*
* See https://docs.djangoproject.com/en/3.0/ref/urls/#re_path
*/
private class DjangoUrlsRePathCall extends DjangoRouteSetup {
private class DjangoUrlsRePathCall extends DjangoRegexRouteSetup {
override CallNode node;
DjangoUrlsRePathCall() { node.getFunction() = django::urls::re_path().asCfgNode() }
@@ -720,29 +797,26 @@ private module Django {
djangoRouteHandlerFunctionTracker(result) = viewArg
)
}
}
override Parameter getARoutedParameter() {
// If we don't know the URL pattern, we simply mark all parameters as a routed
// parameter. This should give us more RemoteFlowSources but could also lead to
// more FPs. If this turns out to be the wrong tradeoff, we can always change our mind.
exists(DjangoRouteHandler routeHandler | routeHandler = this.getARouteHandler() |
not exists(this.getUrlPattern()) and
result in [routeHandler.getArg(_), routeHandler.getArgByName(_)] and
not result = any(int i | i <= routeHandler.getRequestParamIndex() | routeHandler.getArg(i))
)
or
exists(DjangoRouteHandler routeHandler, DjangoUrlsRePathRegex regex |
routeHandler = this.getARouteHandler() and
regex.getRePathCall() = this
|
// either using named capture groups (passed as keyword arguments) or using
// unnamed capture groups (passed as positional arguments)
not exists(regex.getGroupName(_, _)) and
// first group will have group number 1
result =
routeHandler.getArg(routeHandler.getRequestParamIndex() + regex.getGroupNumber(_, _))
or
result = routeHandler.getArgByName(regex.getGroupName(_, _))
/**
* A call to `django.conf.urls.url`.
*
* See https://docs.djangoproject.com/en/1.11/ref/urls/#django.conf.urls.url
*/
private class DjangoConfUrlsUrlCall extends DjangoRegexRouteSetup {
override CallNode node;
DjangoConfUrlsUrlCall() { node.getFunction() = django::conf::conf_urls::url().asCfgNode() }
override DataFlow::Node getUrlPatternArg() {
result.asCfgNode() = [node.getArg(0), node.getArgByName("regex")]
}
override DjangoRouteHandler getARouteHandler() {
exists(DataFlow::Node viewArg |
viewArg.asCfgNode() in [node.getArg(1), node.getArgByName("view")] and
djangoRouteHandlerFunctionTracker(result) = viewArg
)
}
}

34
python/ql/test/experimental/library-tests/frameworks/django-v1/routing_test.py
View File

@@ -4,19 +4,19 @@ from django.http.response import HttpResponse
from django.views.generic import View
def url_match_xss(request, foo, bar, no_taint=None): # $f-:routeHandler $f-:routedParameter=foo $f-:routedParameter=bar
def url_match_xss(request, foo, bar, no_taint=None): # $routeHandler $routedParameter=foo $routedParameter=bar
return HttpResponse('url_match_xss: {} {}'.format(foo, bar))
def get_params_xss(request): # $f-:routeHandler
def get_params_xss(request): # $routeHandler
return HttpResponse(request.GET.get("untrusted"))
def post_params_xss(request): # $f-:routeHandler
def post_params_xss(request): # $routeHandler
return HttpResponse(request.POST.get("untrusted"))
def http_resp_write(request): # $f-:routeHandler
def http_resp_write(request): # $routeHandler
rsp = HttpResponse()
rsp.write(request.GET.get("untrusted"))
return rsp
@@ -36,44 +36,44 @@ class ClassView(View, Foo):
return HttpResponse('ClassView get: {}'.format(untrusted))
def show_articles(request, page_number=1): # $f-:routeHandler $f-:routedParameter=page_number
def show_articles(request, page_number=1): # $routeHandler $routedParameter=page_number
page_number = int(page_number)
return HttpResponse('articles page: {}'.format(page_number))
def xxs_positional_arg(request, arg0, arg1, no_taint=None): # $f-:routeHandler $f-:routedParameter=arg0 $f-:routedParameter=arg1
def xxs_positional_arg(request, arg0, arg1, no_taint=None): # $routeHandler $routedParameter=arg0 $routedParameter=arg1
return HttpResponse('xxs_positional_arg: {} {}'.format(arg0, arg1))
urlpatterns = [
url(r"^url_match/(?P<foo>[^/]+)/(?P<bar>[^/]+)", url_match_xss), # $f-:routeSetup="^url_match/(?P<foo>[^/]+)/(?P<bar>[^/]+)"
url(r"^get_params", get_params_xss), # $f-:routeSetup="^get_params"
url(r"^post_params", post_params_xss), # $f-:routeSetup="^post_params"
url(r"^http_resp_write", http_resp_write), # $f-:routeSetup="^http_resp_write"
url(r"^class_view/(?P<untrusted>.+)", ClassView.as_view()), # $f-:routeSetup="^class_view/(?P<untrusted>.+)"
url(r"^url_match/(?P<foo>[^/]+)/(?P<bar>[^/]+)", url_match_xss), # $routeSetup="^url_match/(?P<foo>[^/]+)/(?P<bar>[^/]+)"
url(r"^get_params", get_params_xss), # $routeSetup="^get_params"
url(r"^post_params", post_params_xss), # $routeSetup="^post_params"
url(r"^http_resp_write", http_resp_write), # $routeSetup="^http_resp_write"
url(r"^class_view/(?P<untrusted>.+)", ClassView.as_view()), # $routeSetup="^class_view/(?P<untrusted>.+)"
# one pattern to support `articles/page-<n>` and ensuring that articles/ goes to page-1
url(r"articles/^(?:page-(?P<page_number>\d+)/)?", show_articles), # $f-:routeSetup="articles/^(?:page-(?P<page_number>\d+)/)?"
url(r"articles/^(?:page-(?P<page_number>\d+)/)?", show_articles), # $routeSetup="articles/^(?:page-(?P<page_number>\d+)/)?"
# passing as positional argument is not the recommended way of doing things, but it is certainly
# possible
url(r"^([^/]+)/(?:foo|bar)/([^/]+)", xxs_positional_arg, name='xxs_positional_arg'), # $f-:routeSetup="^([^/]+)/(?:foo|bar)/([^/]+)"
url(r"^([^/]+)/(?:foo|bar)/([^/]+)", xxs_positional_arg, name='xxs_positional_arg'), # $routeSetup="^([^/]+)/(?:foo|bar)/([^/]+)"
]
################################################################################
# Using patterns() for routing
def show_user(request, username): # $f-:routeHandler $f-:routedParameter=username
def show_user(request, username): # $routeHandler $routedParameter=username
return HttpResponse('show_user {}'.format(username))
urlpatterns = patterns(url(r"^users/(?P<username>[^/]+)", show_user)) # $f-:routeSetup="^users/(?P<username>[^/]+)"
urlpatterns = patterns(url(r"^users/(?P<username>[^/]+)", show_user)) # $routeSetup="^users/(?P<username>[^/]+)"
################################################################################
# Show we understand the keyword arguments to django.conf.urls.url
def kw_args(request): # $f-:routeHandler
def kw_args(request): # $routeHandler
return HttpResponse('kw_args')
urlpatterns = [
url(view=kw_args, regex=r"^kw_args") # $f-:routeSetup="^kw_args"
url(view=kw_args, regex=r"^kw_args") # $routeSetup="^kw_args"
]

4
python/ql/test/experimental/library-tests/frameworks/django-v2-v3/routing_test.py
View File

@@ -101,9 +101,9 @@ urlpatterns = [
# This version 1.x way of defining urls is deprecated in Django 3.1, but still works
from django.conf.urls import url
def deprecated(request): # $f-:routeHandler
def deprecated(request): # $routeHandler
return HttpResponse('deprecated')
urlpatterns = [
url(r"^deprecated/", deprecated), # $f-:routeSetup="^deprecated/"
url(r"^deprecated/", deprecated), # $routeSetup="^deprecated/"
]

2
python/ql/test/experimental/library-tests/frameworks/django-v2-v3/testapp/urls.py
View File

@@ -11,5 +11,5 @@ urlpatterns = [
# inline expectation tests (which thinks the `$` would mark the beginning of a new
# line)
re_path(r"^ba[rz]/", views.bar_baz), # $routeSetup="^ba[rz]/"
url(r"^deprecated/", views.deprecated), # $f-routeSetup="^deprecated/"
url(r"^deprecated/", views.deprecated), # $routeSetup="^deprecated/"
]

2
python/ql/test/experimental/library-tests/frameworks/django-v2-v3/testapp/views.py
View File

@@ -6,5 +6,5 @@ def foo(request: HttpRequest): # $routeHandler
def bar_baz(request: HttpRequest): # $routeHandler
return HttpResponse("bar_baz")
def deprecated(request: HttpRequest): # $f-:routeHandler
def deprecated(request: HttpRequest): # $routeHandler
return HttpResponse("deprecated")