Python: Support %-style formatting for MarkupSafe

python/ql/src/semmle/python/frameworks/MarkupSafe.qll

@@ -71,6 +71,16 @@ private module MarkupSafeModel {
       StringFormat() { this.calls(instance(), "format") }
     }
 
+    /** A %-style string format with `markupsafe.Markup` as the format string. */
+    class PercentStringFormat extends Markup::InstanceSource, DataFlow::CfgNode {
+      override BinaryExprNode node;
+
+      PercentStringFormat() {
+        node.getOp() instanceof Mod and
+        instance().asCfgNode() = node.getLeft()
+      }
+    }
+
     /** Taint propagation for `markupsafe.Markup`. */
     class AddtionalTaintSteps extends TaintTracking::AdditionalTaintStep {
       override predicate step(DataFlow::Node nodeFrom, DataFlow::Node nodeTo) {
@@ -127,4 +137,15 @@ private module MarkupSafeModel {
 
     override DataFlow::Node getOutput() { result = this }
   }
+
+  /** A escape from %-style string format with `markupsafe.Markup` as the format string. */
+  private class MarkupEscapeFromPercentStringFormat extends MarkupSafeEscape,
+    Markup::PercentStringFormat {
+    override DataFlow::Node getAnInput() {
+      result.asCfgNode() = node.getRight() and
+      not result = Markup::instance()
+    }
+
+    override DataFlow::Node getOutput() { result = this }
+  }
 }