Fix FlaskMail's getTo

jorgectf · jorgectf · commit 3f43e6ef548e · 2022-03-08T18:45:53.000+01:00
diff --git a/python/ql/src/experimental/semmle/python/libraries/FlaskMail.qll b/python/ql/src/experimental/semmle/python/libraries/FlaskMail.qll
@@ -74,7 +74,7 @@ private module FlaskMail {
     override DataFlow::Node getTo() {
       result = this.getFlaskMailArgument(1, "recipients")
       or
-      result = flaskMessageInstance().getMember("add_recipient").getACall().getArg(0)
+      result = this.getMessage().getAMethodCall("add_recipient").getACall().getArg(0)
     }
 
     override DataFlow::Node getFrom() { result = this.getFlaskMailArgument(5, "sender") }

Original file line number	Diff line number	Diff line change
`@@ -74,7 +74,7 @@ private module FlaskMail {`
`74`	`74`	`override DataFlow::Node getTo() {`
`75`	`75`	`result = this.getFlaskMailArgument(1, "recipients")`
`76`	`76`	`or`
`77`		`- result = flaskMessageInstance().getMember("add_recipient").getACall().getArg(0)`
	`77`	`+ result = this.getMessage().getAMethodCall("add_recipient").getACall().getArg(0)`
`78`	`78`	`}`
`79`	`79`
`80`	`80`	`override DataFlow::Node getFrom() { result = this.getFlaskMailArgument(5, "sender") }`