Python: Modernise bottle library

RasmusWL · RasmusWL · commit 12c49031e8d4 · 2019-09-26T15:03:47.000+02:00
diff --git a/python/ql/src/semmle/python/web/bottle/General.qll b/python/ql/src/semmle/python/web/bottle/General.qll
@@ -3,12 +3,12 @@ import semmle.python.web.Http
 import semmle.python.types.Extensions
 
 /** The bottle module */
-ModuleObject theBottleModule() {
-    result = ModuleObject::named("bottle")
+ModuleValue theBottleModule() {
+    result = Module::named("bottle")
 }
 
 /** The bottle.Bottle class */
-ClassObject theBottleClass() {
+ClassValue theBottleClass() {
     result = theBottleModule().attr("Bottle")
 }
 
@@ -17,8 +17,8 @@ ClassObject theBottleClass() {
  */
 predicate bottle_route(CallNode route_call, ControlFlowNode route, Function func) {
     exists(CallNode decorator_call, string name |
-        route_call.getFunction().(AttrNode).getObject(name).refersTo(_, theBottleClass(), _) or
-        route_call.getFunction().refersTo(theBottleModule().attr(name))
+        route_call.getFunction().(AttrNode).getObject(name).pointsTo().getClass() = theBottleClass() or
+        route_call.getFunction().pointsTo(theBottleModule().attr(name))
         |
         (name = "route" or name = httpVerbLower()) and
         decorator_call.getFunction() = route_call and
diff --git a/python/ql/src/semmle/python/web/bottle/Redirect.qll b/python/ql/src/semmle/python/web/bottle/Redirect.qll
@@ -8,7 +8,7 @@ import semmle.python.security.TaintTracking
 import semmle.python.security.strings.Basic
 import semmle.python.web.bottle.General
 
-FunctionObject bottle_redirect() {
+FunctionValue bottle_redirect() {
     result = theBottleModule().attr("redirect")
 }
 
diff --git a/python/ql/src/semmle/python/web/bottle/Request.qll b/python/ql/src/semmle/python/web/bottle/Request.qll
@@ -6,7 +6,7 @@ import semmle.python.security.strings.Untrusted
 import semmle.python.web.Http
 import semmle.python.web.bottle.General
 
-private Object theBottleRequestObject() {
+private Value theBottleRequestObject() {
     result = theBottleModule().attr("request")
 }
 
@@ -32,7 +32,7 @@ class BottleRequestKind extends TaintKind {
 private class RequestSource extends TaintSource {
 
     RequestSource() {
-        this.(ControlFlowNode).refersTo(theBottleRequestObject())
+        this.(ControlFlowNode).pointsTo(theBottleRequestObject())
     }
 
     override predicate isSourceOf(TaintKind kind) {
diff --git a/python/ql/src/semmle/python/web/bottle/Response.qll b/python/ql/src/semmle/python/web/bottle/Response.qll
@@ -18,7 +18,7 @@ class BottleResponse extends TaintKind {
 
 }
 
-private Object theBottleResponseObject() {
+private Value theBottleResponseObject() {
     result = theBottleModule().attr("response")
 }
 
@@ -27,7 +27,7 @@ class BottleResponseBodyAssignment extends HttpResponseTaintSink {
     BottleResponseBodyAssignment() {
         exists(DefinitionNode lhs |
             lhs.getValue() = this and
-            lhs.(AttrNode).getObject("body").refersTo(theBottleResponseObject())
+            lhs.(AttrNode).getObject("body").pointsTo(theBottleResponseObject())
         )
     }
 
diff --git a/python/ql/test/library-tests/web/bottle/Sources.expected b/python/ql/test/library-tests/web/bottle/Sources.expected
@@ -1,7 +1,5 @@
 | ../../../query-tests/Security/lib/bottle.py:64 | LocalRequest() | bottle.request |
-| ../../../query-tests/Security/lib/bottle.py:64 | request | bottle.request |
 | test.py:3 | ImportMember | bottle.request |
-| test.py:3 | request | bottle.request |
 | test.py:8 | name | externally controlled string |
 | test.py:12 | name | externally controlled string |
 | test.py:18 | request | bottle.request |
diff --git a/python/ql/test/library-tests/web/bottle/Taint.expected b/python/ql/test/library-tests/web/bottle/Taint.expected
@@ -1,8 +1,6 @@
 | ../../../query-tests/Security/lib/bottle.py:64 | LocalRequest() | bottle.request |
-| ../../../query-tests/Security/lib/bottle.py:64 | request | bottle.request |
 | ../../../query-tests/Security/lib/bottle.py:68 | url | externally controlled string |
 | test.py:3 | ImportMember | bottle.request |
-| test.py:3 | request | bottle.request |
 | test.py:8 | name | externally controlled string |
 | test.py:9 | BinaryExpr | externally controlled string |
 | test.py:9 | name | externally controlled string |
diff --git a/python/ql/test/query-tests/Security/lib/bottle.py b/python/ql/test/query-tests/Security/lib/bottle.py
@@ -67,4 +67,3 @@ class LocalResponse(LocalProxy):
 
 def redirect(url, code=None):
     pass
-

Original file line number	Diff line number	Diff line change
`@@ -8,7 +8,7 @@ import semmle.python.security.TaintTracking`
`8`	`8`	`import semmle.python.security.strings.Basic`
`9`	`9`	`import semmle.python.web.bottle.General`
`10`	`10`
`11`		`-FunctionObject bottle_redirect() {`
	`11`	`+FunctionValue bottle_redirect() {`
`12`	`12`	`result = theBottleModule().attr("redirect")`
`13`	`13`	`}`
`14`	`14`
Original file line number	Diff line number	Diff line change
`@@ -6,7 +6,7 @@ import semmle.python.security.strings.Untrusted`
`6`	`6`	`import semmle.python.web.Http`
`7`	`7`	`import semmle.python.web.bottle.General`
`8`	`8`
`9`		`-private Object theBottleRequestObject() {`
	`9`	`+private Value theBottleRequestObject() {`
`10`	`10`	`result = theBottleModule().attr("request")`
`11`	`11`	`}`
`12`	`12`
`@@ -32,7 +32,7 @@ class BottleRequestKind extends TaintKind {`
`32`	`32`	`private class RequestSource extends TaintSource {`
`33`	`33`
`34`	`34`	`RequestSource() {`
`35`		`- this.(ControlFlowNode).refersTo(theBottleRequestObject())`
	`35`	`+ this.(ControlFlowNode).pointsTo(theBottleRequestObject())`
`36`	`36`	`}`
`37`	`37`
`38`	`38`	`override predicate isSourceOf(TaintKind kind) {`
Original file line number	Diff line number	Diff line change
`@@ -18,7 +18,7 @@ class BottleResponse extends TaintKind {`
`18`	`18`
`19`	`19`	`}`
`20`	`20`
`21`		`-private Object theBottleResponseObject() {`
	`21`	`+private Value theBottleResponseObject() {`
`22`	`22`	`result = theBottleModule().attr("response")`
`23`	`23`	`}`
`24`	`24`
`@@ -27,7 +27,7 @@ class BottleResponseBodyAssignment extends HttpResponseTaintSink {`
`27`	`27`	`BottleResponseBodyAssignment() {`
`28`	`28`	`exists(DefinitionNode lhs \|`
`29`	`29`	`lhs.getValue() = this and`
`30`		`- lhs.(AttrNode).getObject("body").refersTo(theBottleResponseObject())`
	`30`	`+ lhs.(AttrNode).getObject("body").pointsTo(theBottleResponseObject())`
`31`	`31`	`)`
`32`	`32`	`}`
`33`	`33`
Original file line number	Diff line number	Diff line change
`@@ -67,4 +67,3 @@ class LocalResponse(LocalProxy):`
`67`	`67`
`68`	`68`	`def redirect(url, code=None):`
`69`	`69`	`pass`
`70`		`-`