Python: Attempt to model invoke.task decorator

RasmusWL · RasmusWL · commit 6d7f4a048bac · 2020-10-07T12:26:49.000+02:00
diff --git a/python/ql/src/experimental/semmle/python/frameworks/Invoke.qll b/python/ql/src/experimental/semmle/python/frameworks/Invoke.qll
@@ -31,7 +31,7 @@ private module Invoke {
    * WARNING: Only holds for a few predefined attributes.
    */
   private DataFlow::Node invoke_attr(DataFlow::TypeTracker t, string attr_name) {
-    attr_name in ["run", "sudo", "context", "Context"] and
+    attr_name in ["run", "sudo", "context", "Context", "task"] and
     (
       t.start() and
       result = DataFlow::importMember("invoke", attr_name)
@@ -97,6 +97,12 @@ private module Invoke {
           result.asCfgNode().(CallNode).getFunction() =
             invoke::context::Context::class_().asCfgNode()
           or
+          t.start() and
+          exists(Function func |
+            func.getADecorator() = invoke_attr("task").asExpr() and
+            result.asExpr() = func.getArg(0)
+          )
+          or
           exists(DataFlow::TypeTracker t2 | result = instance(t2).track(t2, t))
         }
 
