mirror of
https://github.com/github/codeql.git
synced 2026-05-05 21:55:19 +02:00
Python: client request: getUrl => getAUrlPart
I think `getUrl` is a bit too misleading, since from the name, I would
only ever expect ONE result for one request being made.
`getAUrlPart` captures that there could be multiple results, and that
they might not constitute a whole URl.
Which is the same naming I used when I tried to model this a long time ago
a80860cdc6/python/ql/lib/semmle/python/web/Http.qll (L102-L111)
This commit is contained in:
@@ -829,7 +829,7 @@ module HTTP {
|
||||
* Gets a node that contributes to the URL of the request.
|
||||
* Depending on the framework, a request may have multiple nodes which contribute to the URL.
|
||||
*/
|
||||
DataFlow::Node getUrl() { result = super.getUrl() }
|
||||
DataFlow::Node getAUrlPart() { result = super.getAUrlPart() }
|
||||
|
||||
/** Gets a string that identifies the framework used for this request. */
|
||||
string getFramework() { result = super.getFramework() }
|
||||
@@ -864,7 +864,7 @@ module HTTP {
|
||||
* Gets a node that contributes to the URL of the request.
|
||||
* Depending on the framework, a request may have multiple nodes which contribute to the URL.
|
||||
*/
|
||||
abstract DataFlow::Node getUrl();
|
||||
abstract DataFlow::Node getAUrlPart();
|
||||
|
||||
/** Gets a string that identifies the framework used for this request. */
|
||||
abstract string getFramework();
|
||||
@@ -888,7 +888,7 @@ module HTTP {
|
||||
private class HttpClientRequestAdditionalTaintStep extends TaintTracking::AdditionalTaintStep {
|
||||
override predicate step(DataFlow::Node nodeFrom, DataFlow::Node nodeTo) {
|
||||
exists(Request req |
|
||||
nodeFrom = req.getUrl() and
|
||||
nodeFrom = req.getAUrlPart() and
|
||||
nodeTo = req.getResponse()
|
||||
)
|
||||
}
|
||||
|
||||
@@ -43,7 +43,7 @@ private module Requests {
|
||||
)
|
||||
}
|
||||
|
||||
override DataFlow::Node getUrl() {
|
||||
override DataFlow::Node getAUrlPart() {
|
||||
result = this.getArgByName("url")
|
||||
or
|
||||
not methodName = "request" and
|
||||
|
||||
@@ -2179,7 +2179,7 @@ private module StdlibPrivate {
|
||||
this.getObject().getALocalSource()
|
||||
}
|
||||
|
||||
override DataFlow::Node getUrl() {
|
||||
override DataFlow::Node getAUrlPart() {
|
||||
result in [this.getArg(1), this.getArgByName("url")]
|
||||
or
|
||||
this.getObject() = instance(result)
|
||||
|
||||
Reference in New Issue
Block a user