Python: Fix handling of turbogears' 'expose' decorator.

markshannon · markshannon · commit 2995b023fa34 · 2019-02-26T16:40:21.000Z
diff --git a/python/ql/src/semmle/python/web/turbogears/TurboGears.qll b/python/ql/src/semmle/python/web/turbogears/TurboGears.qll
@@ -19,14 +19,10 @@ class TurboGearsControllerMethod extends Function {
     TurboGearsControllerMethod() {
         aTurboGearsControllerClass().getPyClass() = this.getScope() and
         decorator = this.getADecorator().getAFlowNode() and
-        /* Is decorated with @expose or @expose(path) */
+        /* Is decorated with @expose() or @expose(path) */
         (
-            decorator.(NameNode).getId() = "expose"
-            or
             decorator.(CallNode).getFunction().(NameNode).getId() = "expose"
             or
-            decorator.refersTo(ModuleObject::named("tg").getAttribute("expose"))
-            or
             decorator.refersTo(_, ModuleObject::named("tg").getAttribute("expose"), _)
         )
     }

Original file line number	Diff line number	Diff line change
`@@ -19,14 +19,10 @@ class TurboGearsControllerMethod extends Function {`
`19`	`19`	`TurboGearsControllerMethod() {`
`20`	`20`	`aTurboGearsControllerClass().getPyClass() = this.getScope() and`
`21`	`21`	`decorator = this.getADecorator().getAFlowNode() and`
`22`		`- /* Is decorated with @expose or @expose(path) */`
	`22`	`+ /* Is decorated with @expose() or @expose(path) */`
`23`	`23`	`(`
`24`		`- decorator.(NameNode).getId() = "expose"`
`25`		`- or`
`26`	`24`	`decorator.(CallNode).getFunction().(NameNode).getId() = "expose"`
`27`	`25`	`or`
`28`		`- decorator.refersTo(ModuleObject::named("tg").getAttribute("expose"))`
`29`		`- or`
`30`	`26`	`decorator.refersTo(_, ModuleObject::named("tg").getAttribute("expose"), _)`
`31`	`27`	`)`
`32`	`28`	`}`