Python: Add Requests response model

tausbn · RasmusWL · commit 1d4b4ee740e2 · 2023-12-08T11:27:50.000+01:00
This required making some of the relevant bits public, but they are marked as internal anyway.
diff --git a/python/ql/lib/semmle/python/frameworks/Requests.qll b/python/ql/lib/semmle/python/frameworks/Requests.qll
@@ -12,6 +12,7 @@ private import semmle.python.ApiGraphs
 private import semmle.python.dataflow.new.TaintTracking
 private import semmle.python.frameworks.internal.InstanceTaintStepsHelper
 private import semmle.python.frameworks.Stdlib
+private import semmle.python.frameworks.data.ModelsAsData
 
 /**
  * INTERNAL: Do not use.
@@ -22,7 +23,7 @@ private import semmle.python.frameworks.Stdlib
  * - https://pypi.org/project/requests/
  * - https://requests.readthedocs.io/en/latest/
  */
-private module Requests {
+module Requests {
   /**
    * An outgoing HTTP request, from the `requests` library.
    *
@@ -91,10 +92,12 @@ private module Requests {
    */
   module Response {
     /** Gets a reference to the `requests.models.Response` class. */
-    private API::Node classRef() {
+    API::Node classRef() {
       result = API::moduleImport("requests").getMember("models").getMember("Response")
       or
       result = API::moduleImport("requests").getMember("Response")
+      or
+      result = ModelOutput::getATypeNode("requests.models.Response~Subclass").getASubclass*()
     }
 
     /**
diff --git a/python/ql/src/meta/ClassHierarchy/Find.ql b/python/ql/src/meta/ClassHierarchy/Find.ql
@@ -13,6 +13,7 @@ private import semmle.python.frameworks.FastApi
 private import semmle.python.frameworks.Django
 private import semmle.python.frameworks.Tornado
 private import semmle.python.frameworks.Stdlib
+private import semmle.python.frameworks.Requests
 import semmle.python.frameworks.data.internal.ApiGraphModelsExtensions as Extensions
 
 class FlaskViewClasses extends FindSubclassesSpec {
@@ -214,6 +215,12 @@ class FlaskResponse extends FindSubclassesSpec {
   override API::Node getAlreadyModeledClass() { result = Flask::Response::classRef() }
 }
 
+class RequestsResponse extends FindSubclassesSpec {
+  RequestsResponse() { this = "requests.models.Response~Subclass" }
+
+  override API::Node getAlreadyModeledClass() { result = Requests::Response::classRef() }
+}
+
 bindingset[fullyQualified]
 predicate fullyQualifiedToYamlFormat(string fullyQualified, string type2, string path) {
   exists(int firstDot | firstDot = fullyQualified.indexOf(".", 0, 0) |
