Python: More HTTP request handler *args/**kwargs modeling

RasmusWL · RasmusWL · commit a0867b4f662e · 2023-11-21T16:02:40.000+01:00
I looked through all `override Parameter getARoutedParameter() {` in our
codebase, and we now modeling *args/**kwargs for all of them 👍
diff --git a/python/ql/lib/semmle/python/frameworks/FastApi.qll b/python/ql/lib/semmle/python/frameworks/FastApi.qll
@@ -66,6 +66,9 @@ private module FastApi {
       result = this.getARequestHandler().getArgByName(_) and
       // type-annotated with `Response`
       not any(Response::RequestHandlerParam src).asExpr() = result
+      or
+      // **kwargs
+      result = this.getARequestHandler().getKwarg()
     }
 
     override DataFlow::Node getUrlPatternArg() {
diff --git a/python/ql/lib/semmle/python/frameworks/Flask.qll b/python/ql/lib/semmle/python/frameworks/Flask.qll
@@ -279,6 +279,9 @@ module Flask {
           name = match.regexpCapture(werkzeug_rule_re(), 4)
         )
       )
+      or
+      // **kwargs
+      result = this.getARequestHandler().getKwarg()
     }
 
     override string getFramework() { result = "Flask" }
@@ -347,6 +350,12 @@ module Flask {
       // more FPs. If this turns out to be the wrong tradeoff, we can always change our mind.
       result in [this.getArg(_), this.getArgByName(_)] and
       not result = this.getArg(0)
+      or
+      // *args
+      result = this.getVararg()
+      or
+      // **kwargs
+      result = this.getKwarg()
     }
 
     override string getFramework() { result = "Flask" }
diff --git a/python/ql/lib/semmle/python/frameworks/Tornado.qll b/python/ql/lib/semmle/python/frameworks/Tornado.qll
@@ -416,7 +416,10 @@ module Tornado {
       // more FPs. If this turns out to be the wrong tradeoff, we can always change our mind.
       exists(Function requestHandler | requestHandler = this.getARequestHandler() |
         not exists(this.getUrlPattern()) and
-        result in [requestHandler.getArg(_), requestHandler.getArgByName(_)] and
+        result in [
+            requestHandler.getArg(_), requestHandler.getArgByName(_),
+            requestHandler.getVararg().(Parameter), requestHandler.getKwarg().(Parameter)
+          ] and
         not result = requestHandler.getArg(0)
       )
       or
@@ -429,6 +432,12 @@ module Tornado {
         result = requestHandler.getArg(regex.getGroupNumber(_, _))
         or
         result = requestHandler.getArgByName(regex.getGroupName(_, _))
+        or
+        exists(regex.getGroupNumber(_, _)) and
+        result = requestHandler.getVararg()
+        or
+        exists(regex.getGroupName(_, _)) and
+        result = requestHandler.getKwarg()
       )
     }
   }
@@ -446,7 +455,10 @@ module Tornado {
       // Since we don't know the URL pattern, we simply mark all parameters as a routed
       // parameter. This should give us more RemoteFlowSources but could also lead to
       // more FPs. If this turns out to be the wrong tradeoff, we can always change our mind.
-      result in [this.getArg(_), this.getArgByName(_)] and
+      result in [
+          this.getArg(_), this.getArgByName(_), this.getVararg().(Parameter),
+          this.getKwarg().(Parameter)
+        ] and
       not result = this.getArg(0)
     }
 

Original file line number	Diff line number	Diff line change
`@@ -66,6 +66,9 @@ private module FastApi {`
`66`	`66`	`result = this.getARequestHandler().getArgByName(_) and`
`67`	`67`	// type-annotated with `Response`
`68`	`68`	`not any(Response::RequestHandlerParam src).asExpr() = result`
	`69`	`+ or`
	`70`	`+ // **kwargs`
	`71`	`+ result = this.getARequestHandler().getKwarg()`
`69`	`72`	`}`
`70`	`73`
`71`	`74`	`override DataFlow::Node getUrlPatternArg() {`
Original file line number	Diff line number	Diff line change
`@@ -279,6 +279,9 @@ module Flask {`
`279`	`279`	`name = match.regexpCapture(werkzeug_rule_re(), 4)`
`280`	`280`	`)`
`281`	`281`	`)`
	`282`	`+ or`
	`283`	`+ // **kwargs`
	`284`	`+ result = this.getARequestHandler().getKwarg()`
`282`	`285`	`}`
`283`	`286`
`284`	`287`	`override string getFramework() { result = "Flask" }`
`@@ -347,6 +350,12 @@ module Flask {`
`347`	`350`	`// more FPs. If this turns out to be the wrong tradeoff, we can always change our mind.`
`348`	`351`	`result in [this.getArg(_), this.getArgByName(_)] and`
`349`	`352`	`not result = this.getArg(0)`
	`353`	`+ or`
	`354`	`+ // *args`
	`355`	`+ result = this.getVararg()`
	`356`	`+ or`
	`357`	`+ // **kwargs`
	`358`	`+ result = this.getKwarg()`
`350`	`359`	`}`
`351`	`360`
`352`	`361`	`override string getFramework() { result = "Flask" }`