hohn/codeql
1
0
Fork 0
mirror of https://github.com/github/codeql.git synced 2025-12-24 04:36:35 +01:00
Code Issues Packages Projects Releases Wiki Activity

Add python cx_oracle, phoenixdb, pyodbc models

Browse Source
This commit is contained in:
Sylwia Budzynska
2022-10-11 15:29:57 +02:00
parent 7bcd247128
commit e41d79e37d
6 changed files with 19 additions and 0 deletions
Download Patch File Download Diff File Expand all files Collapse all files

3
python/ql/lib/semmle/python/Frameworks.qll
View File

@@ -12,6 +12,7 @@ private import semmle.python.frameworks.Asyncpg
private import semmle.python.frameworks.ClickhouseDriver
private import semmle.python.frameworks.Cryptodome
private import semmle.python.frameworks.Cryptography
private import semmle.python.frameworks.Cx_Oracle
private import semmle.python.frameworks.data.ModelsAsData
private import semmle.python.frameworks.Dill
private import semmle.python.frameworks.Django
@@ -34,10 +35,12 @@ private import semmle.python.frameworks.Multidict
private import semmle.python.frameworks.Mysql
private import semmle.python.frameworks.MySQLdb
private import semmle.python.frameworks.Peewee
private import semmle.python.frameworks.Phoenixdb
private import semmle.python.frameworks.Psycopg2
private import semmle.python.frameworks.Pycurl
private import semmle.python.frameworks.Pydantic
private import semmle.python.frameworks.PyMySQL
private import semmle.python.frameworks.Pyodbc
private import semmle.python.frameworks.Requests
private import semmle.python.frameworks.RestFramework
private import semmle.python.frameworks.Rsa

4
python/ql/lib/semmle/python/frameworks/Pyodbc.qll
View File

@@ -3,7 +3,11 @@
*
* See
* - https://github.com/mkleehammer/pyodbc/wiki
<<<<<<< HEAD
* - https://pypi.org/project/pyodbc/
=======
* - https://pypi.org/project/pyodbc/
>>>>>>> 5352eb77cc (Add python cx_oracle, phoenixdb, pyodbc models)
*/
private import python

4
python/ql/src/change-notes/2022-10-12-cx_oracle-phoenixdb-pyodbc-modeling.md Normal file
View File

@@ -0,0 +1,4 @@
---
category: minorAnalysis
---
* Added model of `cx_Oracle`, `phonenixdb` and `pyodbc` PyPI packages as a SQL interface following PEP249, resulting in additional sinks for `py/sql-injection`.

0
python/ql/test/library-tests/frameworks/cx_Oracle/ConceptsTest.expected Normal file
View File

2
python/ql/test/library-tests/frameworks/cx_Oracle/ConceptsTest.ql Normal file
View File

@@ -0,0 +1,2 @@
import python
import experimental.meta.ConceptsTest

6
python/ql/test/library-tests/frameworks/cx_Oracle/pep249.py Normal file
View File

@@ -0,0 +1,6 @@
import cx_Oracle
connection = cx_Oracle.connect(user="hr", password="pwd",
dsn="dbhost.example.com/orclpdb1")
cursor = connection.cursor()
cursor.execute("some sql") # $ getSql="some sql"