Python: Add note about parseid/XMLID

RasmusWL · RasmusWL · commit 6774085e7af7 · 2022-03-31T11:19:25.000+02:00
diff --git a/python/ql/lib/semmle/python/frameworks/Lxml.qll b/python/ql/lib/semmle/python/frameworks/Lxml.qll
@@ -263,6 +263,13 @@ private module Lxml {
 
     override predicate mayExecuteInput() { none() }
 
-    override DataFlow::Node getOutput() { result = this }
+    override DataFlow::Node getOutput() {
+      // Note: for `parseid` the result of the call is a tuple with `(root, dict)`, so
+      // maybe we should not just say that the entire tuple is the decoding output... my
+      // gut feeling is that THIS instance doesn't matter too much, but that it would be
+      // nice to be able to do this in general. (this is a problem for both `lxml.etree`
+      // and `xml.etree`)
+      result = this
+    }
   }
 }
diff --git a/python/ql/lib/semmle/python/frameworks/Stdlib.qll b/python/ql/lib/semmle/python/frameworks/Stdlib.qll
@@ -3297,7 +3297,14 @@ private module StdlibPrivate {
 
     override predicate mayExecuteInput() { none() }
 
-    override DataFlow::Node getOutput() { result = this }
+    override DataFlow::Node getOutput() {
+      // Note: for `XMLID` the result of the call is a tuple with `(root, dict)`, so
+      // maybe we should not just say that the entire tuple is the decoding output... my
+      // gut feeling is that THIS instance doesn't matter too much, but that it would be
+      // nice to be able to do this in general. (this is a problem for both `lxml.etree`
+      // and `xml.etree`)
+      result = this
+    }
   }
 }
 

Original file line number	Diff line number	Diff line change
`@@ -263,6 +263,13 @@ private module Lxml {`
`263`	`263`
`264`	`264`	`override predicate mayExecuteInput() { none() }`
`265`	`265`
`266`		`- override DataFlow::Node getOutput() { result = this }`
	`266`	`+ override DataFlow::Node getOutput() {`
	`267`	+ // Note: for `parseid` the result of the call is a tuple with `(root, dict)`, so
	`268`	`+ // maybe we should not just say that the entire tuple is the decoding output... my`
	`269`	`+ // gut feeling is that THIS instance doesn't matter too much, but that it would be`
	`270`	+ // nice to be able to do this in general. (this is a problem for both `lxml.etree`
	`271`	+ // and `xml.etree`)
	`272`	`+ result = this`
	`273`	`+ }`
`267`	`274`	`}`
`268`	`275`	`}`
Original file line number	Diff line number	Diff line change
`@@ -3297,7 +3297,14 @@ private module StdlibPrivate {`
`3297`	`3297`
`3298`	`3298`	`override predicate mayExecuteInput() { none() }`
`3299`	`3299`
`3300`		`- override DataFlow::Node getOutput() { result = this }`
	`3300`	`+ override DataFlow::Node getOutput() {`
	`3301`	+ // Note: for `XMLID` the result of the call is a tuple with `(root, dict)`, so
	`3302`	`+ // maybe we should not just say that the entire tuple is the decoding output... my`
	`3303`	`+ // gut feeling is that THIS instance doesn't matter too much, but that it would be`
	`3304`	+ // nice to be able to do this in general. (this is a problem for both `lxml.etree`
	`3305`	+ // and `xml.etree`)
	`3306`	`+ result = this`
	`3307`	`+ }`
`3301`	`3308`	`}`
`3302`	`3309`	`}`
`3303`	`3310`