Fix conflicting

python/ql/src/experimental/semmle/python/Concepts.qll

@@ -14,6 +14,36 @@ private import semmle.python.dataflow.new.RemoteFlowSources
 private import semmle.python.dataflow.new.TaintTracking
 private import experimental.semmle.python.Frameworks
 
+/** Provides classes for modeling log related APIs. */
+module LogOutput {
+  /**
+   * A data flow node for log output.
+   *
+   * Extend this class to model new APIs. If you want to refine existing API models,
+   * extend `LogOutput` instead.
+   */
+  abstract class Range extends DataFlow::Node {
+    /**
+     * Get the parameter value of the log output function.
+     */
+    abstract DataFlow::Node getAnInput();
+  }
+}
+
+/**
+ * A data flow node for log output.
+ *
+ * Extend this class to refine existing API models. If you want to model new APIs,
+ * extend `LogOutput::Range` instead.
+ */
+class LogOutput extends DataFlow::Node {
+  LogOutput::Range range;
+
+  LogOutput() { this = range }
+
+  DataFlow::Node getAnInput() { result = range.getAnInput() }
+}
+
 /** Provides classes for modeling Regular Expression-related APIs. */
 module RegexExecution {
   /**

python/ql/src/experimental/semmle/python/Frameworks.qll

@@ -1,7 +1,7 @@
 /**
  * Helper file that imports all framework modeling.
  */
-
 private import experimental.semmle.python.frameworks.Stdlib
 private import experimental.semmle.python.frameworks.LDAP
 private import experimental.semmle.python.frameworks.NoSQL
+private import experimental.semmle.python.frameworks.Log

python/ql/src/experimental/semmle/python/frameworks/Log.qll

@@ -0,0 +1,92 @@
+/**
+ * Provides classes modeling security-relevant aspects of the log libraries.
+ */
+
+private import python
+private import semmle.python.dataflow.new.DataFlow
+private import semmle.python.dataflow.new.TaintTracking
+private import semmle.python.dataflow.new.RemoteFlowSources
+private import experimental.semmle.python.Concepts
+private import semmle.python.frameworks.Flask
+private import semmle.python.ApiGraphs
+
+/**
+ * Provides models for Python's log-related libraries.
+ */
+private module log {
+  /**
+   * Log output method list.
+   *
+   * See https://docs.python.org/3/library/logging.html#logger-objects
+   */
+  private class LogOutputMethods extends string {
+    LogOutputMethods() { this in ["info", "error", "warn", "warning", "debug", "critical"] }
+  }
+
+  /**
+   * The class used to find the log output method of the `logging` module.
+   *
+   * See `LogOutputMethods`
+   */
+  private class LoggingCall extends DataFlow::CallCfgNode, LogOutput::Range {
+    LoggingCall() {
+      this = API::moduleImport("logging").getMember(any(LogOutputMethods m)).getACall()
+    }
+
+    override DataFlow::Node getAnInput() { result = this.getArg(_) }
+  }
+
+  /**
+   * The class used to find log output methods related to the `logging.getLogger` instance.
+   *
+   * See `LogOutputMethods`
+   */
+  private class LoggerCall extends DataFlow::CallCfgNode, LogOutput::Range {
+    LoggerCall() {
+      this =
+        API::moduleImport("logging")
+            .getMember("getLogger")
+            .getReturn()
+            .getMember(any(LogOutputMethods m))
+            .getACall()
+    }
+
+    override DataFlow::Node getAnInput() { result = this.getArg(_) }
+  }
+
+  /**
+   * The class used to find the relevant log output method of the `flask.Flask.logger` instance (flask application).
+   *
+   * See `LogOutputMethods`
+   */
+  private class FlaskLoggingCall extends DataFlow::CallCfgNode, LogOutput::Range {
+    FlaskLoggingCall() {
+      this =
+        Flask::FlaskApp::instance()
+            .getMember("logger")
+            .getMember(any(LogOutputMethods m))
+            .getACall()
+    }
+
+    override DataFlow::Node getAnInput() { result = this.getArg(_) }
+  }
+
+  /**
+   * The class used to find the relevant log output method of the `django.utils.log.request_logger` instance (django application).
+   *
+   * See `LogOutputMethods`
+   */
+  private class DjangoLoggingCall extends DataFlow::CallCfgNode, LogOutput::Range {
+    DjangoLoggingCall() {
+      this =
+        API::moduleImport("django")
+            .getMember("utils")
+            .getMember("log")
+            .getMember("request_logger")
+            .getMember(any(LogOutputMethods m))
+            .getACall()
+    }
+
+    override DataFlow::Node getAnInput() { result = this.getArg(_) }
+  }
+}

python/ql/src/experimental/semmle/python/security/injection/LogInjection.qll

@@ -0,0 +1,24 @@
+import python
+import semmle.python.Concepts
+import experimental.semmle.python.Concepts
+import semmle.python.dataflow.new.DataFlow
+import semmle.python.dataflow.new.TaintTracking
+import semmle.python.dataflow.new.RemoteFlowSources
+
+/**
+ * A taint-tracking configuration for tracking untrusted user input used in log entries.
+ */
+class LogInjectionFlowConfig extends TaintTracking::Configuration {
+  LogInjectionFlowConfig() { this = "LogInjectionFlowConfig" }
+
+  override predicate isSource(DataFlow::Node source) { source instanceof RemoteFlowSource }
+
+  override predicate isSink(DataFlow::Node sink) { sink = any(LogOutput logoutput).getAnInput() }
+
+  override predicate isSanitizer(DataFlow::Node node) {
+    exists(CallNode call |
+      node.asCfgNode() = call.getFunction().(AttrNode).getObject("replace") and
+      call.getArg(0).getNode().(StrConst).getText() in ["\r\n", "\n"]
+    )
+  }
+}