Python: Model Connection.execution_options

Author: RasmusWL

python/ql/src/experimental/semmle/python/frameworks/SqlAlchemy.qll

@@ -111,6 +111,8 @@ private module SqlAlchemy {
         this.(DataFlow::MethodCallNode).calls(Engine::instance(), ["begin", "connect"])
         or
         this.(DataFlow::MethodCallNode).calls(instance(), "connect")
+        or
+        this.(DataFlow::MethodCallNode).calls(instance(), "execution_options")
       }
     }
 

python/ql/test/experimental/library-tests/frameworks/sqlalchemy/new_tests.py

@@ -98,7 +98,7 @@
 
 # connection with custom execution options
 conn_with_custom_exe_opts = conn.execution_options(bar=1337)
-result = conn_with_custom_exe_opts.execute(text_sql) # $ MISSING: getSql=text_sql
+result = conn_with_custom_exe_opts.execute(text_sql) # $ getSql=text_sql
 assert result.fetchall() == [("FOO",)]
 
 # Session -- is what you use to work with the ORM layer
@@ -300,7 +300,7 @@ class For14(Base):
 
     # connection with custom execution options
     conn_with_custom_exe_opts = conn.execution_options(bar=1337)
-    result = conn_with_custom_exe_opts.execute(text_sql) # $ MISSING: getSql=text_sql
+    result = conn_with_custom_exe_opts.execute(text_sql) # $ getSql=text_sql
     assert result.fetchall() == [("FOO",)]
 
     # `scalar` is shorthand helper