Thanks to visit codestin.com
Credit goes to github.com

Skip to content

Commit 04f14f1

Browse files
taus-semmletaus-semmle
authored
Merge pull request #2040 from RasmusWL/python-modernise-cherrypy
Python: Modernise cherrypy library
2 parents fc4a583 + bc8e4d2 commit 04f14f1

4 files changed

Lines changed: 20 additions & 66 deletions

File tree

‎python/ql/src/semmle/python/web/cherrypy/General.qll‎

Lines changed: 6 additions & 18 deletions
Original file line numberDiff line numberDiff line change
@@ -2,31 +2,24 @@ import python
22
import semmle.python.web.Http
33

44
module CherryPy {
5-
6-
FunctionObject expose() {
7-
result = ModuleObject::named("cherrypy").attr("expose")
8-
}
9-
5+
FunctionValue expose() { result = Value::named("cherrypy.expose") }
106
}
117

128
class CherryPyExposedFunction extends Function {
13-
149
CherryPyExposedFunction() {
15-
this.getADecorator().refersTo(CherryPy::expose())
10+
this.getADecorator().pointsTo(CherryPy::expose())
1611
or
17-
this.getADecorator().(Call).getFunc().refersTo(CherryPy::expose())
12+
this.getADecorator().(Call).getFunc().pointsTo(CherryPy::expose())
1813
}
19-
2014
}
2115

2216
class CherryPyRoute extends CallNode {
23-
2417
CherryPyRoute() {
2518
/* cherrypy.quickstart(root, script_name, config) */
26-
ModuleObject::named("cherrypy").attr("quickstart").(FunctionObject).getACall() = this
19+
Value::named("cherrypy.quickstart").(FunctionValue).getACall() = this
2720
or
2821
/* cherrypy.tree.mount(root, script_name, config) */
29-
this.getFunction().(AttrNode).getObject("mount").refersTo(ModuleObject::named("cherrypy").attr("tree"))
22+
this.getFunction().(AttrNode).getObject("mount").pointsTo(Value::named("cherrypy.tree"))
3023
}
3124

3225
ClassObject getAppClass() {
@@ -36,9 +29,7 @@ class CherryPyRoute extends CallNode {
3629
}
3730

3831
string getPath() {
39-
exists(StringObject path |
40-
result = path.getText()
41-
|
32+
exists(StringObject path | result = path.getText() |
4233
this.getArg(1).refersTo(path)
4334
or
4435
this.getArgByName("script_name").refersTo(path)
@@ -50,7 +41,4 @@ class CherryPyRoute extends CallNode {
5041
or
5142
this.getArgByName("config").refersTo(_, result, _)
5243
}
53-
5444
}
55-
56-

‎python/ql/src/semmle/python/web/cherrypy/Request.qll‎

Lines changed: 12 additions & 35 deletions
Original file line numberDiff line numberDiff line change
@@ -1,16 +1,12 @@
11
import python
2-
32
import semmle.python.security.TaintTracking
43
import semmle.python.security.strings.Basic
54
import semmle.python.web.Http
65
import semmle.python.web.cherrypy.General
76

87
/** The cherrypy.request local-proxy object */
98
class CherryPyRequest extends TaintKind {
10-
11-
CherryPyRequest() {
12-
this = "cherrypy.request"
13-
}
9+
CherryPyRequest() { this = "cherrypy.request" }
1410

1511
override TaintKind getTaintOfAttribute(string name) {
1612
name = "params" and result instanceof ExternalStringDictKind
@@ -19,20 +15,17 @@ class CherryPyRequest extends TaintKind {
1915
}
2016

2117
override TaintKind getTaintOfMethodResult(string name) {
22-
(
23-
name = "getHeader" or
24-
name = "getCookie" or
25-
name = "getUser" or
26-
name = "getPassword"
27-
) and
28-
result instanceof ExternalStringKind
18+
(
19+
name = "getHeader" or
20+
name = "getCookie" or
21+
name = "getUser" or
22+
name = "getPassword"
23+
) and
24+
result instanceof ExternalStringKind
2925
}
30-
3126
}
3227

33-
3428
class CherryPyExposedFunctionParameter extends TaintSource {
35-
3629
CherryPyExposedFunctionParameter() {
3730
exists(Parameter p |
3831
p = any(CherryPyExposedFunction f).getAnArg() and
@@ -41,29 +34,13 @@ class CherryPyExposedFunctionParameter extends TaintSource {
4134
)
4235
}
4336

44-
override string toString() {
45-
result = "CherryPy handler function parameter"
46-
}
47-
48-
override predicate isSourceOf(TaintKind kind) {
49-
kind instanceof ExternalStringKind
50-
}
37+
override string toString() { result = "CherryPy handler function parameter" }
5138

39+
override predicate isSourceOf(TaintKind kind) { kind instanceof ExternalStringKind }
5240
}
5341

5442
class CherryPyRequestSource extends TaintSource {
43+
CherryPyRequestSource() { this.(ControlFlowNode).pointsTo(Value::named("cherrypy.request")) }
5544

56-
CherryPyRequestSource() {
57-
this.(ControlFlowNode).refersTo(ModuleObject::named("cherrypy").attr("request"))
58-
}
59-
60-
override predicate isSourceOf(TaintKind kind) {
61-
kind instanceof CherryPyRequest
62-
}
63-
45+
override predicate isSourceOf(TaintKind kind) { kind instanceof CherryPyRequest }
6446
}
65-
66-
67-
68-
69-

‎python/ql/src/semmle/python/web/cherrypy/Response.qll‎

Lines changed: 2 additions & 12 deletions
Original file line numberDiff line numberDiff line change
@@ -1,28 +1,18 @@
11
import python
2-
32
import semmle.python.security.TaintTracking
43
import semmle.python.security.strings.Untrusted
54
import semmle.python.web.Http
65
import semmle.python.web.cherrypy.General
76

8-
9-
107
class CherryPyExposedFunctionResult extends HttpResponseTaintSink {
11-
128
CherryPyExposedFunctionResult() {
139
exists(Return ret |
1410
ret.getScope() instanceof CherryPyExposedFunction and
1511
ret.getValue().getAFlowNode() = this
1612
)
1713
}
1814

19-
override predicate sinks(TaintKind kind) {
20-
kind instanceof StringKind
21-
}
22-
23-
override string toString() {
24-
result = "cherrypy handler function result"
25-
}
15+
override predicate sinks(TaintKind kind) { kind instanceof StringKind }
2616

17+
override string toString() { result = "cherrypy handler function result" }
2718
}
28-

‎python/ql/test/library-tests/web/cherrypy/Sources.expected‎

Lines changed: 0 additions & 1 deletion
Original file line numberDiff line numberDiff line change
@@ -1,4 +1,3 @@
11
| ../../../query-tests/Security/lib/cherrypy/__init__.py:10 | _ThreadLocalProxy() | cherrypy.request |
2-
| ../../../query-tests/Security/lib/cherrypy/__init__.py:10 | request | cherrypy.request |
32
| test.py:10 | arg | externally controlled string |
43
| test.py:16 | arg | externally controlled string |

0 commit comments

Comments
 (0)