Python: django.http.response.JsonResponse

Rasmus Lerchedahl Petersen · Rasmus Lerchedahl Petersen · commit 52be896666e7 · 2020-10-30T01:05:36.000+01:00
It s possible this class is not relevant to XSS
diff --git a/python/ql/src/experimental/semmle/python/frameworks/Django.qll b/python/ql/src/experimental/semmle/python/frameworks/Django.qll
@@ -499,7 +499,7 @@ private module Django {
        * WARNING: Only holds for a few predefined attributes.
        */
       private DataFlow::Node http_attr(DataFlow::TypeTracker t, string attr_name) {
-        attr_name in ["request", "HttpRequest", "response", "HttpResponse"] and
+        attr_name in ["request", "HttpRequest", "response", "HttpResponse", "JsonResponse"] and
         (
           t.start() and
           result = DataFlow::importNode("django.http" + "." + attr_name)
@@ -641,7 +641,7 @@ private module Django {
          * WARNING: Only holds for a few predefined attributes.
          */
         private DataFlow::Node response_attr(DataFlow::TypeTracker t, string attr_name) {
-          attr_name in ["HttpResponse"] and
+          attr_name in ["HttpResponse", "JsonResponse"] and
           (
             t.start() and
             result = DataFlow::importNode("django.http.response" + "." + attr_name)
@@ -739,6 +739,71 @@ private module Django {
           /** Gets a reference to an instance of `django.http.response.HttpResponse`. */
           DataFlow::Node instance() { result = instance(DataFlow::TypeTracker::end()) }
         }
+
+        // ---------------------------------------------------------------------------
+        // HttpResponse subclasses
+        // ---------------------------------------------------------------------------
+        /**
+         * Provides models for the `django.http.response.JsonResponse` class
+         *
+         * See https://docs.djangoproject.com/en/3.1/ref/request-response/#jsonresponse-objects.
+         */
+        module JsonResponse {
+          /** Gets a reference to the `django.http.response.JsonResponse` class. */
+          private DataFlow::Node classRef(DataFlow::TypeTracker t) {
+            t.start() and
+            result = response_attr("JsonResponse")
+            or
+            // TODO: remove/expand this part of the template as needed
+            // Handle `http.JsonResponse` alias
+            t.start() and
+            result = http_attr("JsonResponse")
+            or
+            exists(DataFlow::TypeTracker t2 | result = classRef(t2).track(t2, t))
+          }
+
+          /** Gets a reference to the `django.http.response.JsonResponse` class. */
+          DataFlow::Node classRef() { result = classRef(DataFlow::TypeTracker::end()) }
+
+          /**
+           * A source of an instance of `django.http.response.JsonResponse`.
+           *
+           * This can include instantiation of the class, return value from function
+           * calls, or a special parameter that will be set when functions are call by external
+           * library.
+           *
+           * Use `JsonResponse::instance()` predicate to get references to instances of `django.http.response.JsonResponse`.
+           */
+          abstract class InstanceSource extends HTTP::Server::HttpResponse::Range, DataFlow::Node {
+          }
+
+          /** A direct instantiation of `django.http.response.JsonResponse`. */
+          private class ClassInstantiation extends InstanceSource, DataFlow::CfgNode {
+            override CallNode node;
+
+            ClassInstantiation() { node.getFunction() = classRef().asCfgNode() }
+
+            override DataFlow::Node getBody() {
+              result.asCfgNode() in [node.getArg(0), node.getArgByName("content")]
+            }
+
+            // How to support the `headers` argument here?
+            override DataFlow::Node getMimetypeOrContentTypeArg() { none() }
+
+            override string getMimetypeDefault() { result = "application/json" }
+          }
+
+          /** Gets a reference to an instance of `django.http.response.JsonResponse`. */
+          private DataFlow::Node instance(DataFlow::TypeTracker t) {
+            t.start() and
+            result instanceof InstanceSource
+            or
+            exists(DataFlow::TypeTracker t2 | result = instance(t2).track(t2, t))
+          }
+
+          /** Gets a reference to an instance of `django.http.response.JsonResponse`. */
+          DataFlow::Node instance() { result = instance(DataFlow::TypeTracker::end()) }
+        }
       }
     }
   }
diff --git a/python/ql/test/experimental/library-tests/frameworks/django-v1/response_test.py b/python/ql/test/experimental/library-tests/frameworks/django-v1/response_test.py
@@ -4,7 +4,7 @@
 # FP reported in https://github.com/github/codeql-python-team/issues/38
 def safe__json_response(request):
     # implicitly sets Content-Type to "application/json"
-    return JsonResponse({"foo": request.GET.get("foo")})  # $f-:HttpResponse $f-:mimetype=application/json $f-:responseBody={"foo": request.GET.get("foo")}
+    return JsonResponse({"foo": request.GET.get("foo")})  # $HttpResponse $mimetype=application/json $responseBody=Dict
 
 # Not an XSS sink, since the Content-Type is not "text/html"
 def safe__manual_json_response(request):
