Thanks to visit codestin.com
Credit goes to github.com

Skip to content

Commit 98be27a

Browse files
markshannonmarkshannon
committed
Python: Add 'attr' predicate as a synomnym for 'getAttribute' to help readability.
1 parent 35fa5d8 commit 98be27a

47 files changed

Lines changed: 87 additions & 86 deletions

Some content is hidden

Large Commits have some content hidden by default. Use the searchbox below for content that may be hidden.

‎change-notes/1.20/analysis-python.md‎

Lines changed: 3 additions & 0 deletions
Original file line numberDiff line numberDiff line change
@@ -8,6 +8,9 @@
88
99
The constants `MULTILINE` and `VERBOSE` in `re` module, are now understood for Python 3.6 and upward.
1010
Removes false positives seen when using Python 3.6, but not when using earlier versions.
11+
The API has been improved to declutter the global namespace and improve discoverability and readability.
12+
* New predicates `ModuleObject::named(name)` and `ModuleObject.attr(name)` have been added, allowing more readable access to common objects. For example, `(any ModuleObject m | m.getName() = "sys").getAttribute("exit")` can be replaced with `ModuleObject::named("sys").attr("exit")`
13+
* The API for accessing builtin functions has been improved. Predicates of the form `theXXXFunction()`, such as `theLenFunction()`, have been deprecated in favour of `Object::builtin(name)`.
1114

1215
## New queries
1316

‎python/ql/src/Expressions/HashedButNoHash.ql‎

Lines changed: 1 addition & 1 deletion
Original file line numberDiff line numberDiff line change
@@ -19,7 +19,7 @@ import python
1919

2020
predicate numpy_array_type(ClassObject na) {
2121
exists(ModuleObject np | np.getName() = "numpy" or np.getName() = "numpy.core" |
22-
na.getAnImproperSuperType() = np.getAttribute("ndarray")
22+
na.getAnImproperSuperType() = np.attr("ndarray")
2323
)
2424
}
2525

‎python/ql/src/Security/CWE-079/Jinja2WithoutEscaping.ql‎

Lines changed: 1 addition & 1 deletion
Original file line numberDiff line numberDiff line change
@@ -15,7 +15,7 @@ import python
1515
ClassObject jinja2EnvironmentOrTemplate() {
1616
exists(ModuleObject jinja2, string name |
1717
jinja2.getName() = "jinja2" and
18-
jinja2.getAttribute(name) = result |
18+
jinja2.attr(name) = result |
1919
name = "Environment" or
2020
name = "Template"
2121
)

‎python/ql/src/Security/CWE-295/RequestWithoutValidation.ql‎

Lines changed: 1 addition & 1 deletion
Original file line numberDiff line numberDiff line change
@@ -17,7 +17,7 @@ import semmle.python.web.Http
1717
FunctionObject requestFunction() {
1818
exists(ModuleObject req |
1919
req.getName() = "requests" and
20-
result = req.getAttribute(httpVerbLower())
20+
result = req.attr(httpVerbLower())
2121
)
2222
}
2323

‎python/ql/src/Security/CWE-326/WeakCrypto.ql‎

Lines changed: 2 additions & 2 deletions
Original file line numberDiff line numberDiff line change
@@ -21,7 +21,7 @@ int minimumSecureKeySize(string algo) {
2121

2222
predicate dsaRsaKeySizeArg(FunctionObject obj, string algorithm, string arg) {
2323
exists(ModuleObject mod |
24-
mod.getAttribute(_) = obj |
24+
mod.attr(_) = obj |
2525
algorithm = "DSA" and
2626
(
2727
mod.getName() = "cryptography.hazmat.primitives.asymmetric.dsa" and arg = "key_size"
@@ -44,7 +44,7 @@ predicate dsaRsaKeySizeArg(FunctionObject obj, string algorithm, string arg) {
4444

4545
predicate ecKeySizeArg(FunctionObject obj, string arg) {
4646
exists(ModuleObject mod |
47-
mod.getAttribute(_) = obj |
47+
mod.attr(_) = obj |
4848
mod.getName() = "cryptography.hazmat.primitives.asymmetric.ec" and arg = "curve"
4949
)
5050
}

‎python/ql/src/Security/CWE-327/InsecureDefaultProtocol.ql‎

Lines changed: 2 additions & 2 deletions
Original file line numberDiff line numberDiff line change
@@ -13,11 +13,11 @@
1313
import python
1414

1515
FunctionObject ssl_wrap_socket() {
16-
result = any(ModuleObject ssl | ssl.getName() = "ssl").getAttribute("wrap_socket")
16+
result = any(ModuleObject ssl | ssl.getName() = "ssl").attr("wrap_socket")
1717
}
1818

1919
ClassObject ssl_Context_class() {
20-
result = any(ModuleObject ssl | ssl.getName() = "ssl").getAttribute("SSLContext")
20+
result = any(ModuleObject ssl | ssl.getName() = "ssl").attr("SSLContext")
2121
}
2222

2323
CallNode unsafe_call(string method_name) {

‎python/ql/src/Security/CWE-327/InsecureProtocol.ql‎

Lines changed: 5 additions & 5 deletions
Original file line numberDiff line numberDiff line change
@@ -12,11 +12,11 @@
1212
import python
1313

1414
FunctionObject ssl_wrap_socket() {
15-
result = the_ssl_module().getAttribute("wrap_socket")
15+
result = the_ssl_module().attr("wrap_socket")
1616
}
1717

1818
ClassObject ssl_Context_class() {
19-
result = the_ssl_module().getAttribute("SSLContext")
19+
result = the_ssl_module().attr("SSLContext")
2020
}
2121

2222
string insecure_version_name() {
@@ -69,20 +69,20 @@ predicate unsafe_ssl_wrap_socket_call(CallNode call, string method_name, string
6969
insecure_version = insecure_version_name()
7070
and
7171
(
72-
call.getArgByName("ssl_version").refersTo(the_ssl_module().getAttribute(insecure_version))
72+
call.getArgByName("ssl_version").refersTo(the_ssl_module().attr(insecure_version))
7373
or
7474
probable_insecure_ssl_constant(call, insecure_version)
7575
)
7676
}
7777

7878
ClassObject the_pyOpenSSL_Context_class() {
79-
result = any(ModuleObject m | m.getName() = "pyOpenSSL.SSL").getAttribute("Context")
79+
result = any(ModuleObject m | m.getName() = "pyOpenSSL.SSL").attr("Context")
8080
}
8181

8282
predicate unsafe_pyOpenSSL_Context_call(CallNode call, string insecure_version) {
8383
call = the_pyOpenSSL_Context_class().getACall() and
8484
insecure_version = insecure_version_name() and
85-
call.getArg(0).refersTo(the_pyOpenSSL_module().getAttribute(insecure_version))
85+
call.getArg(0).refersTo(the_pyOpenSSL_module().attr(insecure_version))
8686
}
8787

8888
from CallNode call, string method_name, string insecure_version

‎python/ql/src/Security/CWE-732/WeakFilePermissions.ql‎

Lines changed: 2 additions & 2 deletions
Original file line numberDiff line numberDiff line change
@@ -35,12 +35,12 @@ string permissive_permission(int p) {
3535
}
3636

3737
predicate chmod_call(CallNode call, FunctionObject chmod, NumericObject num) {
38-
any(ModuleObject os | os.getName() = "os").getAttribute("chmod") = chmod and
38+
any(ModuleObject os | os.getName() = "os").attr("chmod") = chmod and
3939
chmod.getACall() = call and call.getArg(1).refersTo(num)
4040
}
4141

4242
predicate open_call(CallNode call, FunctionObject open, NumericObject num) {
43-
any(ModuleObject os | os.getName() = "os").getAttribute("open") = open and
43+
any(ModuleObject os | os.getName() = "os").attr("open") = open and
4444
open.getACall() = call and call.getArg(2).refersTo(num)
4545
}
4646

‎python/ql/src/Security/CWE-798/HardcodedCredentials.ql‎

Lines changed: 1 addition & 1 deletion
Original file line numberDiff line numberDiff line change
@@ -34,7 +34,7 @@ predicate fewer_characters_than(StrConst str, string char, float fraction) {
3434
}
3535

3636
predicate possible_reflective_name(string name) {
37-
exists(any(ModuleObject m).getAttribute(name))
37+
exists(any(ModuleObject m).attr(name))
3838
or
3939
exists(any(ClassObject c).lookupAttribute(name))
4040
or

‎python/ql/src/Statements/StatementNoEffect.ql‎

Lines changed: 1 addition & 1 deletion
Original file line numberDiff line numberDiff line change
@@ -84,7 +84,7 @@ predicate in_notebook(Expr e) {
8484
}
8585

8686
FunctionObject assertRaises() {
87-
result = ModuleObject::named("unittest").getAttribute("TestCase").(ClassObject).lookupAttribute("assertRaises")
87+
result = ModuleObject::named("unittest").attr("TestCase").(ClassObject).lookupAttribute("assertRaises")
8888
}
8989

9090
/** Holds if expression `e` is in a `with` block that tests for exceptions being raised. */

0 commit comments

Comments
 (0)