mirror of
https://github.com/github/codeql.git
synced 2026-04-26 01:05:15 +02:00
Add StreamlitConnection model
Co-authored-by: yoff <lerchedahl@gmail.com>
This commit is contained in:
@@ -44,4 +44,14 @@ module Streamlit {
|
||||
|
||||
override DataFlow::Node getSql() { result in [this.getArg(0), this.getArgByName("sql")] }
|
||||
}
|
||||
private class StreamlitConnection extends SqlAlchemy::Connection::InstanceSource {
|
||||
StreamlitConnection() {
|
||||
this =
|
||||
API::moduleImport("streamlit")
|
||||
.getMember("connection")
|
||||
.getReturn()
|
||||
.getMember("connect")
|
||||
.getACall()
|
||||
}
|
||||
}
|
||||
}
|
||||
|
||||
@@ -10,3 +10,8 @@ conn = st.connection("postgresql", type="sql")
|
||||
|
||||
# SQL injection sink
|
||||
q = conn.query("some sql") # $ getSql="some sql"
|
||||
|
||||
# SQLAlchemy connection
|
||||
c = conn.connect()
|
||||
|
||||
c.execute("other sql") # $ getSql="other sql"
|
||||
|
||||
Reference in New Issue
Block a user