Thanks to visit codestin.com
Credit goes to github.com

Skip to content

Commit d98aae9

Browse files
RasmusWLRasmusWL
committed
Python: Expose framework identifier for route-setup and req handler
This makes collecting metrics on framework coverage a bit simpler (specifically giving the RoutedParameter class a more descriptive result for getSourceType). I guess it can also help a bit when trying to get an overview of a new DB, but making metrics collection easier is my main motivation for this.
1 parent bf401c7 commit d98aae9

5 files changed

Lines changed: 33 additions & 3 deletions

File tree

‎python/ql/src/semmle/python/Concepts.qll‎

Lines changed: 18 additions & 2 deletions
Original file line numberDiff line numberDiff line change
@@ -325,6 +325,9 @@ module HTTP {
325325
* requests for this route, if any. These automatically become a `RemoteFlowSource`.
326326
*/
327327
Parameter getARoutedParameter() { result = range.getARoutedParameter() }
328+
329+
/** Gets a string that identifies the framework used for this route setup. */
330+
string getFramework() { result = range.getFramework() }
328331
}
329332

330333
/** Provides a class for modeling new HTTP routing APIs. */
@@ -359,6 +362,9 @@ module HTTP {
359362
* requests for this route, if any. These automatically become a `RemoteFlowSource`.
360363
*/
361364
abstract Parameter getARoutedParameter();
365+
366+
/** Gets a string that identifies the framework used for this route setup. */
367+
abstract string getFramework();
362368
}
363369
}
364370

@@ -378,6 +384,9 @@ module HTTP {
378384
* requests, if any. These automatically become a `RemoteFlowSource`.
379385
*/
380386
Parameter getARoutedParameter() { result = range.getARoutedParameter() }
387+
388+
/** Gets a string that identifies the framework used for this route setup. */
389+
string getFramework() { result = range.getFramework() }
381390
}
382391

383392
/** Provides a class for modeling new HTTP request handlers. */
@@ -396,6 +405,9 @@ module HTTP {
396405
* requests, if any. These automatically become a `RemoteFlowSource`.
397406
*/
398407
abstract Parameter getARoutedParameter();
408+
409+
/** Gets a string that identifies the framework used for this request handler. */
410+
abstract string getFramework();
399411
}
400412
}
401413

@@ -408,13 +420,17 @@ module HTTP {
408420
result = rs.getARoutedParameter() and
409421
result in [this.getArg(_), this.getArgByName(_)]
410422
}
423+
424+
override string getFramework() { result = rs.getFramework() }
411425
}
412426

413427
/** A parameter that will receive parts of the url when handling an incoming request. */
414428
private class RoutedParameter extends RemoteFlowSource::Range, DataFlow::ParameterNode {
415-
RoutedParameter() { this.getParameter() = any(RequestHandler handler).getARoutedParameter() }
429+
RequestHandler handler;
430+
431+
RoutedParameter() { this.getParameter() = handler.getARoutedParameter() }
416432

417-
override string getSourceType() { result = "RoutedParameter" }
433+
override string getSourceType() { result = handler.getFramework() + " RoutedParameter" }
418434
}
419435

420436
/**

‎python/ql/src/semmle/python/frameworks/Django.qll‎

Lines changed: 4 additions & 0 deletions
Original file line numberDiff line numberDiff line change
@@ -2158,6 +2158,8 @@ private module Django {
21582158
result = vc.getARequestHandler()
21592159
)
21602160
}
2161+
2162+
override string getFramework() { result = "Django" }
21612163
}
21622164

21632165
/** A request handler defined in a django view class, that has no known route. */
@@ -2175,6 +2177,8 @@ private module Django {
21752177
result in [this.getArg(_), this.getArgByName(_)] and
21762178
not result = any(int i | i <= this.getRequestParamIndex() | this.getArg(i))
21772179
}
2180+
2181+
override string getFramework() { result = "Django" }
21782182
}
21792183

21802184
/**

‎python/ql/src/semmle/python/frameworks/Flask.qll‎

Lines changed: 4 additions & 0 deletions
Original file line numberDiff line numberDiff line change
@@ -219,6 +219,8 @@ private module FlaskModel {
219219
)
220220
)
221221
}
222+
223+
override string getFramework() { result = "Flask" }
222224
}
223225

224226
/**
@@ -277,6 +279,8 @@ private module FlaskModel {
277279
result in [this.getArg(_), this.getArgByName(_)] and
278280
not result = this.getArg(0)
279281
}
282+
283+
override string getFramework() { result = "Flask" }
280284
}
281285

282286
// ---------------------------------------------------------------------------

‎python/ql/src/semmle/python/frameworks/Stdlib.qll‎

Lines changed: 2 additions & 0 deletions
Original file line numberDiff line numberDiff line change
@@ -1629,6 +1629,8 @@ private module Stdlib {
16291629
}
16301630

16311631
override Parameter getARoutedParameter() { none() }
1632+
1633+
override string getFramework() { result = "Stdlib" }
16321634
}
16331635
}
16341636

‎python/ql/src/semmle/python/frameworks/Tornado.qll‎

Lines changed: 5 additions & 1 deletion
Original file line numberDiff line numberDiff line change
@@ -486,7 +486,9 @@ private module Tornado {
486486
}
487487

488488
/** A tornado route setup. */
489-
abstract class TornadoRouteSetup extends HTTP::Server::RouteSetup::Range { }
489+
abstract class TornadoRouteSetup extends HTTP::Server::RouteSetup::Range {
490+
override string getFramework() { result = "Tornado" }
491+
}
490492

491493
/**
492494
* A regex that is used to set up a route.
@@ -561,6 +563,8 @@ private module Tornado {
561563
result in [this.getArg(_), this.getArgByName(_)] and
562564
not result = this.getArg(0)
563565
}
566+
567+
override string getFramework() { result = "Tornado" }
564568
}
565569

566570
// ---------------------------------------------------------------------------

0 commit comments

Comments
 (0)