mirror of
https://github.com/github/codeql.git
synced 2026-02-11 12:41:06 +01:00
@@ -31,7 +31,7 @@ module Aioch {
|
||||
}
|
||||
|
||||
/**
|
||||
* A call to any of the the execute methods on a `aioch.Client`, which are just async
|
||||
* A call to any of the execute methods on a `aioch.Client`, which are just async
|
||||
* versions of the methods in the `clickhouse-driver` PyPI package.
|
||||
*
|
||||
* See
|
||||
|
||||
@@ -45,7 +45,7 @@ module AiohttpWebModel {
|
||||
}
|
||||
|
||||
/** Gets a reference to an `aiohttp.web.UrlDispatcher` instance. */
|
||||
API::Node urlDispathcerInstance() {
|
||||
API::Node urlDispatcherInstance() {
|
||||
result = API::moduleImport("aiohttp").getMember("web").getMember("UrlDispatcher").getReturn()
|
||||
or
|
||||
result = applicationInstance().getMember("router")
|
||||
@@ -170,7 +170,7 @@ module AiohttpWebModel {
|
||||
funcName = "route" and
|
||||
routeArgsStart = 1
|
||||
|
|
||||
this = urlDispathcerInstance().getMember("add_" + funcName).getACall()
|
||||
this = urlDispatcherInstance().getMember("add_" + funcName).getACall()
|
||||
or
|
||||
this = API::moduleImport("aiohttp").getMember("web").getMember(funcName).getACall()
|
||||
)
|
||||
|
||||
@@ -98,10 +98,10 @@ private module Aiopg {
|
||||
* See https://aiopg.readthedocs.io/en/stable/sa.html#aiopg.sa.SAConnection.execute
|
||||
*/
|
||||
class AwaitedSAConnectionExecuteCall extends SqlExecution::Range {
|
||||
SAConnectionExecuteCall excute;
|
||||
SAConnectionExecuteCall execute;
|
||||
|
||||
AwaitedSAConnectionExecuteCall() { this = excute.getReturn().getAwaited().asSource() }
|
||||
AwaitedSAConnectionExecuteCall() { this = execute.getReturn().getAwaited().asSource() }
|
||||
|
||||
override DataFlow::Node getSql() { result = excute.getSql() }
|
||||
override DataFlow::Node getSql() { result = execute.getSql() }
|
||||
}
|
||||
}
|
||||
|
||||
@@ -50,7 +50,7 @@ module ClickhouseDriver {
|
||||
string getExecuteMethodName() { result in ["execute_with_progress", "execute", "execute_iter"] }
|
||||
|
||||
/**
|
||||
* A call to any of the the execute methods on a `clickhouse_driver.Client` method
|
||||
* A call to any of the execute methods on a `clickhouse_driver.Client` method
|
||||
*
|
||||
* See
|
||||
* - https://clickhouse-driver.readthedocs.io/en/latest/api.html#clickhouse_driver.Client.execute
|
||||
|
||||
@@ -14,7 +14,7 @@ private import semmle.python.ApiGraphs
|
||||
*/
|
||||
private module CryptographyModel {
|
||||
/**
|
||||
* Provides helper predicates for the eliptic curve cryptography parts in
|
||||
* Provides helper predicates for the elliptic curve cryptography parts in
|
||||
* `cryptography.hazmat.primitives.asymmetric.ec`.
|
||||
*/
|
||||
module Ecc {
|
||||
|
||||
@@ -65,7 +65,7 @@ module Pydantic {
|
||||
* NOTE: We currently overapproximate, and treat all attributes as containing
|
||||
* another pydantic model. For the code below, we _could_ limit this to `main_foo`
|
||||
* and members of `other_foos`. IF THIS IS CHANGED, YOU MUST CHANGE THE ADDITIONAL
|
||||
* TAINT STEPS BELOW, SUCH THAT SIMPLE ACCESS OF SOMETHIGN LIKE `str` IS STILL
|
||||
* TAINT STEPS BELOW, SUCH THAT SIMPLE ACCESS OF SOMETHING LIKE `str` IS STILL
|
||||
* TAINTED.
|
||||
*
|
||||
*
|
||||
|
||||
@@ -113,7 +113,7 @@ private module Requests {
|
||||
ClassInstantiation() { this = classRef().getACall() }
|
||||
}
|
||||
|
||||
/** Return value from making a reuqest. */
|
||||
/** Return value from making a request. */
|
||||
private class RequestReturnValue extends InstanceSource, DataFlow::Node {
|
||||
RequestReturnValue() { this = any(OutgoingRequestCall c) }
|
||||
}
|
||||
|
||||
@@ -2403,7 +2403,7 @@ private module StdlibPrivate {
|
||||
|
||||
/**
|
||||
* Gets a name of a constructor for a `pathlib.Path` object.
|
||||
* We include the pure paths, as they can be "exported" (say with `as_posix`) and then used to acces the underlying file system.
|
||||
* We include the pure paths, as they can be "exported" (say with `as_posix`) and then used to access the underlying file system.
|
||||
*/
|
||||
private string pathlibPathConstructor() {
|
||||
result in ["Path", "PurePath", "PurePosixPath", "PureWindowsPath", "PosixPath", "WindowsPath"]
|
||||
@@ -2510,11 +2510,11 @@ private module StdlibPrivate {
|
||||
/** A file system access from a `pathlib.Path` method call. */
|
||||
private class PathlibFileAccess extends FileSystemAccess::Range, DataFlow::CallCfgNode {
|
||||
DataFlow::AttrRead fileAccess;
|
||||
string attrbuteName;
|
||||
string attributeName;
|
||||
|
||||
PathlibFileAccess() {
|
||||
attrbuteName = fileAccess.getAttributeName() and
|
||||
attrbuteName in [
|
||||
attributeName = fileAccess.getAttributeName() and
|
||||
attributeName in [
|
||||
"stat", "chmod", "exists", "expanduser", "glob", "group", "is_dir", "is_file", "is_mount",
|
||||
"is_symlink", "is_socket", "is_fifo", "is_block_device", "is_char_device", "iter_dir",
|
||||
"lchmod", "lstat", "mkdir", "open", "owner", "read_bytes", "read_text", "readlink",
|
||||
@@ -2530,14 +2530,14 @@ private module StdlibPrivate {
|
||||
|
||||
/** A file system write from a `pathlib.Path` method call. */
|
||||
private class PathlibFileWrites extends PathlibFileAccess, FileSystemWriteAccess::Range {
|
||||
PathlibFileWrites() { attrbuteName in ["write_bytes", "write_text"] }
|
||||
PathlibFileWrites() { attributeName in ["write_bytes", "write_text"] }
|
||||
|
||||
override DataFlow::Node getADataNode() { result in [this.getArg(0), this.getArgByName("data")] }
|
||||
}
|
||||
|
||||
/** A call to the `open` method on a `pathlib.Path` instance. */
|
||||
private class PathLibOpenCall extends PathlibFileAccess, Stdlib::FileLikeObject::InstanceSource {
|
||||
PathLibOpenCall() { attrbuteName = "open" }
|
||||
PathLibOpenCall() { attributeName = "open" }
|
||||
}
|
||||
|
||||
/**
|
||||
@@ -2549,7 +2549,7 @@ private module StdlibPrivate {
|
||||
* - https://docs.python.org/3/library/pathlib.html#pathlib.Path.symlink_to
|
||||
*/
|
||||
private class PathLibLinkToCall extends PathlibFileAccess, API::CallNode {
|
||||
PathLibLinkToCall() { attrbuteName in ["link_to", "hardlink_to", "symlink_to"] }
|
||||
PathLibLinkToCall() { attributeName in ["link_to", "hardlink_to", "symlink_to"] }
|
||||
|
||||
override DataFlow::Node getAPathArgument() {
|
||||
result = super.getAPathArgument()
|
||||
@@ -2566,7 +2566,7 @@ private module StdlibPrivate {
|
||||
* - https://docs.python.org/3/library/pathlib.html#pathlib.Path.rename
|
||||
*/
|
||||
private class PathLibReplaceCall extends PathlibFileAccess, API::CallNode {
|
||||
PathLibReplaceCall() { attrbuteName in ["replace", "rename"] }
|
||||
PathLibReplaceCall() { attributeName in ["replace", "rename"] }
|
||||
|
||||
override DataFlow::Node getAPathArgument() {
|
||||
result = super.getAPathArgument()
|
||||
@@ -2581,7 +2581,7 @@ private module StdlibPrivate {
|
||||
* See https://docs.python.org/3/library/pathlib.html#pathlib.Path.samefile
|
||||
*/
|
||||
private class PathLibSameFileCall extends PathlibFileAccess, API::CallNode {
|
||||
PathLibSameFileCall() { attrbuteName = "samefile" }
|
||||
PathLibSameFileCall() { attributeName = "samefile" }
|
||||
|
||||
override DataFlow::Node getAPathArgument() {
|
||||
result = super.getAPathArgument()
|
||||
@@ -2720,7 +2720,7 @@ private module StdlibPrivate {
|
||||
|
||||
/**
|
||||
* A hashing operation from the `hashlib` package using one of the predefined classes
|
||||
* (such as `hashlib.md5`), by calling its' `update` mehtod.
|
||||
* (such as `hashlib.md5`), by calling its' `update` method.
|
||||
*/
|
||||
class HashlibHashClassUpdateCall extends HashlibGenericHashOperation {
|
||||
HashlibHashClassUpdateCall() { this = hashClass.getReturn().getMember("update").getACall() }
|
||||
|
||||
@@ -10,7 +10,7 @@ private import semmle.python.Concepts
|
||||
private import semmle.python.ApiGraphs
|
||||
|
||||
/**
|
||||
* Provides models for the the `urllib2` module, part of
|
||||
* Provides models for the `urllib2` module, part of
|
||||
* the Python 2 standard library.
|
||||
*
|
||||
* See https://docs.python.org/2/library/urllib2.html
|
||||
|
||||
@@ -68,9 +68,9 @@ private module NotExposed {
|
||||
// modeling. See https://github.com/github/codeql/pull/5632 for more discussion.
|
||||
//
|
||||
//
|
||||
bindingset[fullyQaulified]
|
||||
string fullyQualifiedToApiGraphPath(string fullyQaulified) {
|
||||
result = "moduleImport(\"" + fullyQaulified.replaceAll(".", "\").getMember(\"") + "\")"
|
||||
bindingset[fullyQualified]
|
||||
string fullyQualifiedToApiGraphPath(string fullyQualified) {
|
||||
result = "moduleImport(\"" + fullyQualified.replaceAll(".", "\").getMember(\"") + "\")"
|
||||
}
|
||||
|
||||
/** DEPRECATED: Alias for fullyQualifiedToApiGraphPath */
|
||||
|
||||
Reference in New Issue
Block a user