hohn/codeql
1
0
Fork 0
mirror of https://github.com/github/codeql.git synced 2026-05-04 21:25:44 +02:00
Code Issues Packages Projects Releases Wiki Activity

Merge pull request #8601 from zbazztian/recognize-flask-named-body-param

Browse Source 
Python: Flask: Identify body contents passed via named response parameter in invocations of Response constructor
This commit is contained in:
Rasmus Wriedt Larsen
2022-04-01 14:19:28 +02:00
committed by GitHub
parent 29a5bdb601 504e7e4a55
commit ba011fb13f
3 changed files with 17 additions and 5 deletions
Download Patch File Download Diff File Expand all files Collapse all files

4
python/ql/lib/change-notes/2022-03-30-flask-recognize-body-param.md Normal file
View File

@@ -0,0 +1,4 @@
---
category: minorAnalysis
---
* Improved modeling of Flask `Response` objects, so passing a response body with the keyword argument `response` is now recognized.

4
python/ql/lib/semmle/python/frameworks/Flask.qll
View File

@@ -122,7 +122,9 @@ module Flask {
private class ClassInstantiation extends InstanceSource, DataFlow::CallCfgNode {
ClassInstantiation() { this = classRef().getACall() }
override DataFlow::Node getBody() { result = this.getArg(0) }
override DataFlow::Node getBody() {
result in [this.getArg(0), this.getArgByName("response")]
}
override string getMimetypeDefault() { result = "text/html" }