Python: Autoformat TurboGears library

This commit is contained in:
Rasmus Wriedt Larsen
2019-11-27 14:19:51 +01:00
parent 9ef270fc92
commit b526421072
3 changed files with 7 additions and 39 deletions

View File

@@ -1,21 +1,17 @@
import python
import semmle.python.security.strings.Untrusted
import TurboGears
private class ValidatedMethodParameter extends Parameter {
ValidatedMethodParameter() {
exists(string name, TurboGearsControllerMethod method |
method.getArgByName(name) = this and
method.getValidationDict().getItem(_).(KeyValuePair).getKey().(StrConst).getText() = name
)
}
}
class UnvalidatedControllerMethodParameter extends TaintSource {
UnvalidatedControllerMethodParameter() {
exists(Parameter p |
any(TurboGearsControllerMethod m | not m.getName() = "onerror").getAnArg() = p and
@@ -25,9 +21,5 @@ class UnvalidatedControllerMethodParameter extends TaintSource {
)
}
override predicate isSourceOf(TaintKind kind) {
kind instanceof UntrustedStringKind
}
override predicate isSourceOf(TaintKind kind) { kind instanceof UntrustedStringKind }
}

View File

@@ -1,14 +1,10 @@
import python
import semmle.python.security.TaintTracking
import semmle.python.security.strings.Basic
import semmle.python.web.Http
import TurboGears
class ControllerMethodReturnValue extends HttpResponseTaintSink {
ControllerMethodReturnValue() {
exists(TurboGearsControllerMethod m |
m.getAReturnValueFlowNode() = this and
@@ -16,14 +12,10 @@ class ControllerMethodReturnValue extends HttpResponseTaintSink {
)
}
override predicate sinks(TaintKind kind) {
kind instanceof StringKind
}
override predicate sinks(TaintKind kind) { kind instanceof StringKind }
}
class ControllerMethodTemplatedReturnValue extends HttpResponseTaintSink {
ControllerMethodTemplatedReturnValue() {
exists(TurboGearsControllerMethod m |
m.getAReturnValueFlowNode() = this and
@@ -31,8 +23,5 @@ class ControllerMethodTemplatedReturnValue extends HttpResponseTaintSink {
)
}
override predicate sinks(TaintKind kind) {
kind instanceof StringDictKind
}
override predicate sinks(TaintKind kind) { kind instanceof StringDictKind }
}

View File

@@ -1,19 +1,11 @@
import python
import semmle.python.security.TaintTracking
private ClassValue theTurboGearsControllerClass() {
result = Value::named("tg.TGController")
}
ClassValue aTurboGearsControllerClass() {
result.getABaseType+() = theTurboGearsControllerClass()
}
private ClassValue theTurboGearsControllerClass() { result = Value::named("tg.TGController") }
ClassValue aTurboGearsControllerClass() { result.getABaseType+() = theTurboGearsControllerClass() }
class TurboGearsControllerMethod extends Function {
ControlFlowNode decorator;
TurboGearsControllerMethod() {
@@ -27,13 +19,9 @@ class TurboGearsControllerMethod extends Function {
)
}
private ControlFlowNode templateName() {
result = decorator.(CallNode).getArg(0)
}
private ControlFlowNode templateName() { result = decorator.(CallNode).getArg(0) }
predicate isTemplated() {
exists(templateName())
}
predicate isTemplated() { exists(templateName()) }
Dict getValidationDict() {
exists(Call call, Value dict |
@@ -42,5 +30,4 @@ class TurboGearsControllerMethod extends Function {
call.getArg(0).pointsTo(dict, result)
)
}
}