hohn/codeql
1
0
Fork 0
mirror of https://github.com/github/codeql.git synced 2026-04-28 18:25:24 +02:00
Code Issues Packages Projects Releases Wiki Activity

Python: Model taint of self.request on django view class

Browse Source
This commit is contained in:
Rasmus Wriedt Larsen
2021-02-10 17:46:05 +01:00
parent 9ca738d921
commit c57a4df819
3 changed files with 70 additions and 6 deletions
Download Patch File Download Diff File Expand all files Collapse all files

1
python/change-notes/2021-12-21-django-improvements.md
View File

@@ -1,3 +1,4 @@
lgtm,codescanning
* Improved modeling of `django` to recognize request handlers functions that are decorated (for example with `django.views.decorators.http.require_GET`). This leads to more sources of remote user input (`RemoteFlowSource`), since we correctly identify the first parameter as being passed a django request.
* Improved modeling of django View classes. We now consider any class using in a routing setup with `<class>.as_view()` as django view class. This leads to more sources of remote user input (`RemoteFlowSource`), since we correctly identify the first parameter as being passed a django request.
* Improved modeling of `django`, so for View classes we now model `self.request`, `self.args`, and `self.kwargs` as sources of remote user input (`RemoteFlowSource`).