hohn/codeql
1
0
Fork 0
mirror of https://github.com/github/codeql.git synced 2026-05-02 04:05:14 +02:00
Code Issues Packages Projects Releases Wiki Activity

Attempt to restructuring ReMethods and RegexExecution's modules

Browse Source
This commit is contained in:
jorgectf
2021-03-19 01:51:59 +01:00
parent 6d5a0f2f84
commit caaf5436c6
2 changed files with 31 additions and 1 deletions
Download Patch File Download Diff File Expand all files Collapse all files

2
python/ql/src/semmle/python/Concepts.qll
View File

@@ -654,7 +654,7 @@ class CompiledRegex extends DataFlow::Node {
}
class RegexExecution extends DataFlow::Node {
RegexExecution() { this instanceof DirectRegex or this instanceof CompiledRegex }
RegexExecution() { this instanceof DirectRegex or this instanceof CompiledRegex } // How should this be cross-imported with Stdlib?
}
class RegexEscape extends DataFlow::Node {

30
python/ql/src/semmle/python/frameworks/Stdlib.qll
View File

@@ -864,6 +864,36 @@ private module Stdlib {
class Sqlite3 extends PEP249ModuleApiNode {
Sqlite3() { this = API::moduleImport("sqlite3") }
}
// ---------------------------------------------------------------------------
// re
// ---------------------------------------------------------------------------
/** List of re methods. */
private class ReMethods extends string {
ReMethods() { this in ["match", "fullmatch", "search", "split", "findall", "finditer"] }
}
/** re.ReMethod(pattern, string) */
private class DirectRegex extends DataFlow::Node {
DirectRegex() {
exists(ReMethods reMethod, DataFlow::CallCfgNode reCall |
reCall = API::moduleImport("re").getMember(reMethod).getACall() and
this = reCall.getArg(0)
)
}
}
/** re.compile(pattern).ReMethod */
class CompiledRegex extends DataFlow::Node {
CompiledRegex() {
exists(DataFlow::CallCfgNode patternCall, DataFlow::AttrRead reMethod |
patternCall = API::moduleImport("re").getMember("compile").getACall() and
patternCall = reMethod.getObject().getALocalSource() and
reMethod.getAttributeName() instanceof ReMethods and
this = patternCall.getArg(0)
)
}
}
}
// ---------------------------------------------------------------------------