Python: Fix concepts-tests for SQLAlchemy

RasmusWL · RasmusWL · commit eac1c5d10982 · 2021-06-29T10:58:28.000+02:00
diff --git a/python/ql/test/experimental/library-tests/frameworks/sqlalchemy/ConceptsTest.ql b/python/ql/test/experimental/library-tests/frameworks/sqlalchemy/ConceptsTest.ql
@@ -1,2 +1,3 @@
 import python
 import experimental.meta.ConceptsTest
+import experimental.semmle.python.frameworks.SqlAlchemy
diff --git a/python/ql/test/experimental/library-tests/frameworks/sqlalchemy/SqlExecution.py b/python/ql/test/experimental/library-tests/frameworks/sqlalchemy/SqlExecution.py
@@ -34,23 +34,24 @@ class User(Base):
 session.commit()
 
 # Injection without requiring the text() taint-step
-session.query(User).filter_by(name="some sql")  # $getSql="some sql"
-session.scalar("some sql")  # $getSql="some sql"
-engine.scalar("some sql")  # $getSql="some sql"
-session.execute("some sql")  # $getSql="some sql"
+session.query(User).filter_by(name="some sql")  # $ MISSING: getSql="some sql"
+session.scalar("some sql")  # $ getSql="some sql"
+engine.scalar("some sql")  # $ getSql="some sql"
+session.execute("some sql")  # $ getSql="some sql"
 
 with engine.connect() as connection:
-    connection.execute("some sql")  # $getSql="some sql"
+    connection.execute("some sql")  # $ getSql="some sql"
 
 with engine.begin() as connection:
-    connection.execute("some sql")  # $getSql="some sql"
+    connection.execute("some sql")  # $ getSql="some sql"
 
 # Injection requiring the text() taint-step
-session.query(User).filter(text("some sql"))  # $getSql="some sql"
-session.query(User).group_by( User.id ).having(text("some sql"))  # $getSql="some sql"
-session.query(User).group_by(text("name='some sql'")).first()  # $getSql="some sql"
-session.query(User).order_by(text("name='some sql'")).first()  # $getSql="some sql"
+t = text("some sql")
+session.query(User).filter(t)  # $ getSql=t
+session.query(User).group_by(User.id).having(t)  # $ getSql=Attribute MISSING: getSql=t
+session.query(User).group_by(t).first()  # $ getSql=t
+session.query(User).order_by(t).first()  # $ getSql=t
 
-query = select(User).where(User.name == text("some sql"))  # $getSql="some sql"
+query = select(User).where(User.name == t)  # $ MISSING: getSql=t
 with engine.connect() as conn:
-    conn.execute(query)
+    conn.execute(query) # $ getSql=query

Original file line number	Diff line number	Diff line change
`@@ -1,2 +1,3 @@`
`1`	`1`	`import python`
`2`	`2`	`import experimental.meta.ConceptsTest`
	`3`	`+import experimental.semmle.python.frameworks.SqlAlchemy`