Python: support some custom subclasses

Rasmus Lerchedahl Petersen · Rasmus Lerchedahl Petersen · commit e7c9bc388b84 · 2020-10-30T14:16:48.000+01:00
diff --git a/python/ql/src/experimental/semmle/python/frameworks/Django.qll b/python/ql/src/experimental/semmle/python/frameworks/Django.qll
@@ -710,6 +710,9 @@ private module Django {
             t.start() and
             result = http_attr("HttpResponse")
             or
+            // subclass
+            result.asExpr().(ClassExpr).getABase() = classRef(t.continue()).asExpr()
+            or
             exists(DataFlow::TypeTracker t2 | result = classRef(t2).track(t2, t))
           }
 
diff --git a/python/ql/test/experimental/library-tests/frameworks/django-v1/response_test.py b/python/ql/test/experimental/library-tests/frameworks/django-v1/response_test.py
@@ -43,4 +43,11 @@ def __init__(self, banner, content, *args, **kwargs):
         super().__init__(content, *args, content_type="text/html", **kwargs)
 
 def xss__custom_response(request):
-    return CustomResponse("ACME Responses", request.GET("name"))  # $f-:HttpResponse $f-:mimetype=text/html $f-:responseBody=Attribute()
+    return CustomResponse("ACME Responses", request.GET("name"))  # $HttpResponse $f-:mimetype=text/html $f-:responseBody=Attribute() $f+:responseBody="ACME Responses"
+
+class CustomJsonResponse(JsonResponse):
+    def __init__(self, banner, content, *args, **kwargs):
+        super().__init__(content, *args, content_type="text/html", **kwargs)
+
+def safe__custom_json_response(request):
+    return CustomJsonResponse("ACME Responses", {"foo": request.GET.get("foo")})  # $f-:HttpResponse $f-:mimetype=application/json $f-:responseBody=Dict

Original file line number	Diff line number	Diff line change
`@@ -710,6 +710,9 @@ private module Django {`
`710`	`710`	`t.start() and`
`711`	`711`	`result = http_attr("HttpResponse")`
`712`	`712`	`or`
	`713`	`+ // subclass`
	`714`	`+ result.asExpr().(ClassExpr).getABase() = classRef(t.continue()).asExpr()`
	`715`	`+ or`
`713`	`716`	`exists(DataFlow::TypeTracker t2 \| result = classRef(t2).track(t2, t))`
`714`	`717`	`}`
`715`	`718`