Rasmus Wriedt Larsen 91f269ed7b Python: Remove unused django sinks ...

This would find instances of `thing = MyThing.objects.get(field=userinput)`, and
what seems to be a query that wants to match on `thing = MyThing();
thing.field=userinput`. Both are not vulnerable to user-input, due to the
build-in escaping by django.

The DjangoModelFieldWrite actually matches on `MyThing.field=userinput` and not
`thing.field=userinput`. I suspect this to be a mistake.

Matching on `thing.field=userinput`, would require this CodeQL:

attr.getObject(_).pointsTo().getClass() = model

2019-10-29 13:58:07 +01:00

..

config/suites/lgtm

Drop: ImportAdditionalLibraries.ql

2019-06-28 15:53:07 +02:00

ql

Python: Remove unused django sinks

2019-10-29 13:58:07 +01:00

upgrades/62a30d37a729670a8cc3c67b4dad81f1983865f8

Python: Add 'special operation' pseudo-expression type, for use in semantic stubs file. No use of it as yet.

2019-02-08 11:31:34 +00:00