Python: Expose HTTP verbs in HTTP concept

RasmusWL · RasmusWL · commit 608ce5039971 · 2020-12-04T14:04:56.000+01:00
Let's discuss whether doing it this way is reasonable, since I'm not 100% sure
whether this fits into "concepts" or not.
diff --git a/python/ql/src/semmle/python/Concepts.qll b/python/ql/src/semmle/python/Concepts.qll
@@ -295,6 +295,8 @@ module SqlExecution {
 
 /** Provides classes for modeling HTTP-related APIs. */
 module HTTP {
+  import semmle.python.web.HttpConstants
+
   /** Provides classes for modeling HTTP servers. */
   module Server {
     /**
diff --git a/python/ql/src/semmle/python/frameworks/Django.qll b/python/ql/src/semmle/python/frameworks/Django.qll
@@ -1680,8 +1680,7 @@ private module Django {
       // TODO: This doesn't handle attribute assignment. Should be OK, but analysis is not as complete as with
       // points-to and `.lookup`, which would handle `post = my_post_handler` inside class def
       result = this.getAMethod() and
-      // TODO: Add HTTP verbs
-      result.getName() in ["post", "get"]
+      result.getName() = HTTP::httpVerbLower()
     }
 
     /** Gets a reference to this class. */
diff --git a/python/ql/src/semmle/python/web/HttpConstants.qll b/python/ql/src/semmle/python/web/HttpConstants.qll
@@ -1,4 +1,4 @@
-/** Gets an http verb */
+/** Gets an HTTP verb */
 string httpVerb() {
   result = "GET" or
   result = "POST" or
@@ -9,5 +9,5 @@ string httpVerb() {
   result = "HEAD"
 }
 
-/** Gets an http verb, in lower case */
+/** Gets an HTTP verb, in lower case */
 string httpVerbLower() { result = httpVerb().toLowerCase() }

Original file line number	Diff line number	Diff line change
`@@ -1680,8 +1680,7 @@ private module Django {`
`1680`	`1680`	`// TODO: This doesn't handle attribute assignment. Should be OK, but analysis is not as complete as with`
`1681`	`1681`	// points-to and `.lookup`, which would handle `post = my_post_handler` inside class def
`1682`	`1682`	`result = this.getAMethod() and`
`1683`		`- // TODO: Add HTTP verbs`
`1684`		`- result.getName() in ["post", "get"]`
	`1683`	`+ result.getName() = HTTP::httpVerbLower()`
`1685`	`1684`	`}`
`1686`	`1685`
`1687`	`1686`	`/** Gets a reference to this class. */`