mirror of
https://github.com/github/codeql.git
synced 2025-12-18 01:33:15 +01:00
Python: Autoformat TurboGears library
This commit is contained in:
@@ -1,21 +1,17 @@
|
||||
import python
|
||||
import semmle.python.security.strings.Untrusted
|
||||
|
||||
import TurboGears
|
||||
|
||||
private class ValidatedMethodParameter extends Parameter {
|
||||
|
||||
ValidatedMethodParameter() {
|
||||
exists(string name, TurboGearsControllerMethod method |
|
||||
method.getArgByName(name) = this and
|
||||
method.getValidationDict().getItem(_).(KeyValuePair).getKey().(StrConst).getText() = name
|
||||
)
|
||||
}
|
||||
|
||||
}
|
||||
|
||||
class UnvalidatedControllerMethodParameter extends TaintSource {
|
||||
|
||||
UnvalidatedControllerMethodParameter() {
|
||||
exists(Parameter p |
|
||||
any(TurboGearsControllerMethod m | not m.getName() = "onerror").getAnArg() = p and
|
||||
@@ -25,9 +21,5 @@ class UnvalidatedControllerMethodParameter extends TaintSource {
|
||||
)
|
||||
}
|
||||
|
||||
override predicate isSourceOf(TaintKind kind) {
|
||||
kind instanceof UntrustedStringKind
|
||||
}
|
||||
|
||||
override predicate isSourceOf(TaintKind kind) { kind instanceof UntrustedStringKind }
|
||||
}
|
||||
|
||||
|
||||
@@ -1,14 +1,10 @@
|
||||
import python
|
||||
|
||||
import semmle.python.security.TaintTracking
|
||||
import semmle.python.security.strings.Basic
|
||||
import semmle.python.web.Http
|
||||
import TurboGears
|
||||
|
||||
|
||||
|
||||
class ControllerMethodReturnValue extends HttpResponseTaintSink {
|
||||
|
||||
ControllerMethodReturnValue() {
|
||||
exists(TurboGearsControllerMethod m |
|
||||
m.getAReturnValueFlowNode() = this and
|
||||
@@ -16,14 +12,10 @@ class ControllerMethodReturnValue extends HttpResponseTaintSink {
|
||||
)
|
||||
}
|
||||
|
||||
override predicate sinks(TaintKind kind) {
|
||||
kind instanceof StringKind
|
||||
}
|
||||
|
||||
override predicate sinks(TaintKind kind) { kind instanceof StringKind }
|
||||
}
|
||||
|
||||
class ControllerMethodTemplatedReturnValue extends HttpResponseTaintSink {
|
||||
|
||||
ControllerMethodTemplatedReturnValue() {
|
||||
exists(TurboGearsControllerMethod m |
|
||||
m.getAReturnValueFlowNode() = this and
|
||||
@@ -31,8 +23,5 @@ class ControllerMethodTemplatedReturnValue extends HttpResponseTaintSink {
|
||||
)
|
||||
}
|
||||
|
||||
override predicate sinks(TaintKind kind) {
|
||||
kind instanceof StringDictKind
|
||||
}
|
||||
|
||||
override predicate sinks(TaintKind kind) { kind instanceof StringDictKind }
|
||||
}
|
||||
|
||||
@@ -1,19 +1,11 @@
|
||||
import python
|
||||
|
||||
import semmle.python.security.TaintTracking
|
||||
|
||||
private ClassValue theTurboGearsControllerClass() {
|
||||
result = Value::named("tg.TGController")
|
||||
}
|
||||
|
||||
|
||||
ClassValue aTurboGearsControllerClass() {
|
||||
result.getABaseType+() = theTurboGearsControllerClass()
|
||||
}
|
||||
private ClassValue theTurboGearsControllerClass() { result = Value::named("tg.TGController") }
|
||||
|
||||
ClassValue aTurboGearsControllerClass() { result.getABaseType+() = theTurboGearsControllerClass() }
|
||||
|
||||
class TurboGearsControllerMethod extends Function {
|
||||
|
||||
ControlFlowNode decorator;
|
||||
|
||||
TurboGearsControllerMethod() {
|
||||
@@ -27,13 +19,9 @@ class TurboGearsControllerMethod extends Function {
|
||||
)
|
||||
}
|
||||
|
||||
private ControlFlowNode templateName() {
|
||||
result = decorator.(CallNode).getArg(0)
|
||||
}
|
||||
private ControlFlowNode templateName() { result = decorator.(CallNode).getArg(0) }
|
||||
|
||||
predicate isTemplated() {
|
||||
exists(templateName())
|
||||
}
|
||||
predicate isTemplated() { exists(templateName()) }
|
||||
|
||||
Dict getValidationDict() {
|
||||
exists(Call call, Value dict |
|
||||
@@ -42,5 +30,4 @@ class TurboGearsControllerMethod extends Function {
|
||||
call.getArg(0).pointsTo(dict, result)
|
||||
)
|
||||
}
|
||||
|
||||
}
|
||||
|
||||
Reference in New Issue
Block a user