Python: Model kombu.serialization

tausbn · RasmusWL · commit d29879a84446 · 2023-12-08T11:27:52.000+01:00
More `pickle` wrappers.
diff --git a/python/ql/lib/semmle/python/frameworks/Stdlib.qll b/python/ql/lib/semmle/python/frameworks/Stdlib.qll
@@ -1298,14 +1298,21 @@ module StdlibPrivate {
   // pickle
   // ---------------------------------------------------------------------------
   /** Gets a reference to any of the `pickle` modules. */
-  API::Node pickle() { result = API::moduleImport(["pickle", "cPickle", "_pickle", "cloudpickle"]) }
+  API::Node pickle() {
+    result = API::moduleImport(["pickle", "cPickle", "_pickle", "cloudpickle"]) or
+    result = API::moduleImport("kombu").getMember("serialization").getMember("pickle")
+  }
 
   /**
    * A call to `pickle.load`
    * See https://docs.python.org/3/library/pickle.html#pickle.load
    */
   private class PickleLoadCall extends Decoding::Range, DataFlow::CallCfgNode {
-    PickleLoadCall() { this = pickle().getMember("load").getACall() }
+    PickleLoadCall() {
+      this = pickle().getMember("load").getACall() or
+      this =
+        API::moduleImport("kombu").getMember("serialization").getMember("pickle_load").getACall()
+    }
 
     override predicate mayExecuteInput() { any() }
 
