diff --git a/python/ql/lib/semmle/python/frameworks/Pydantic.qll b/python/ql/lib/semmle/python/frameworks/Pydantic.qll index b495ef0b93e..c3d76835b42 100644 --- a/python/ql/lib/semmle/python/frameworks/Pydantic.qll +++ b/python/ql/lib/semmle/python/frameworks/Pydantic.qll @@ -11,6 +11,7 @@ private import semmle.python.dataflow.new.DataFlow private import semmle.python.dataflow.new.TaintTracking private import semmle.python.Concepts private import semmle.python.ApiGraphs +private import semmle.python.frameworks.data.ModelsAsData /** * INTERNAL: Do not use. @@ -31,6 +32,8 @@ module Pydantic { /** Gets a reference to a `pydantic.BaseModel` subclass (a pydantic model). */ API::Node subclassRef() { result = API::moduleImport("pydantic").getMember("BaseModel").getASubclass+() + or + result = ModelOutput::getATypeNode("pydantic.BaseModel~Subclass").getASubclass*() } /** diff --git a/python/ql/src/meta/ClassHierarchy/Find.ql b/python/ql/src/meta/ClassHierarchy/Find.ql index df378bdee51..9cebc36f6d0 100644 --- a/python/ql/src/meta/ClassHierarchy/Find.ql +++ b/python/ql/src/meta/ClassHierarchy/Find.ql @@ -27,6 +27,7 @@ private import semmle.python.frameworks.RestFramework private import semmle.python.frameworks.SqlAlchemy private import semmle.python.frameworks.Tornado private import semmle.python.frameworks.Urllib3 +private import semmle.python.frameworks.Pydantic import semmle.python.frameworks.data.internal.ApiGraphModelsExtensions as Extensions class FlaskViewClasses extends FindSubclassesSpec { @@ -410,6 +411,12 @@ class StdlibLogger extends FindSubclassesSpec { override API::Node getAlreadyModeledClass() { result = Stdlib::Logger::subclassRef() } } +class PydanticBaseModel extends FindSubclassesSpec { + PydanticBaseModel() { this = "pydantic.BaseModel~Subclass" } + + override API::Node getAlreadyModeledClass() { result = Pydantic::BaseModel::subclassRef() } +} + bindingset[fullyQualified] predicate fullyQualifiedToYamlFormat(string fullyQualified, string type2, string path) { exists(int firstDot | firstDot = fullyQualified.indexOf(".", 0, 0) |