Python: Model django.conf.urls.url (v 1.x)

Author: RasmusWL

python/ql/src/experimental/semmle/python/frameworks/Django.qll

@@ -34,7 +34,7 @@ private module Django {
    * WARNING: Only holds for a few predefined attributes.
    */
   private DataFlow::Node django_attr(DataFlow::TypeTracker t, string attr_name) {
-    attr_name in ["db", "urls", "http"] and
+    attr_name in ["db", "urls", "http", "conf"] and
     (
       t.start() and
       result = DataFlow::importNode("django" + "." + attr_name)
@@ -437,6 +437,55 @@ private module Django {
       DataFlow::Node re_path() { result = urls_attr("re_path") }
     }
 
+    // -------------------------------------------------------------------------
+    // django.conf
+    // -------------------------------------------------------------------------
+    /** Gets a reference to the `django.conf` module. */
+    DataFlow::Node conf() { result = django_attr("conf") }
+
+    /** Provides models for the `django.conf` module */
+    module conf {
+      // -------------------------------------------------------------------------
+      // django.conf.urls
+      // -------------------------------------------------------------------------
+      /** Gets a reference to the `django.conf.urls` module. */
+      private DataFlow::Node urls(DataFlow::TypeTracker t) {
+        t.start() and
+        result = DataFlow::importNode("django.conf.urls")
+        or
+        t.startInAttr("urls") and
+        result = conf()
+        or
+        exists(DataFlow::TypeTracker t2 | result = urls(t2).track(t2, t))
+      }
+
+      // NOTE: had to rename due to shadowing rules in QL
+      /** Gets a reference to the `django.conf.urls` module. */
+      DataFlow::Node conf_urls() { result = urls(DataFlow::TypeTracker::end()) }
+
+      // NOTE: had to rename due to shadowing rules in QL
+      /** Provides models for the `django.conf.urls` module */
+      module conf_urls {
+        /** Gets a reference to the `django.conf.urls.url` function. */
+        private DataFlow::Node url(DataFlow::TypeTracker t) {
+          t.start() and
+          result = DataFlow::importNode("django.conf.urls.url")
+          or
+          t.startInAttr("url") and
+          result = conf_urls()
+          or
+          exists(DataFlow::TypeTracker t2 | result = url(t2).track(t2, t))
+        }
+
+        /**
+         * Gets a reference to the `django.conf.urls.url` function.
+         *
+         * See https://docs.djangoproject.com/en/1.11/ref/urls/#django.conf.urls.url
+         */
+        DataFlow::Node url() { result = url(DataFlow::TypeTracker::end()) }
+      }
+    }
+
     // -------------------------------------------------------------------------
     // django.http
     // -------------------------------------------------------------------------
@@ -684,28 +733,56 @@ private module Django {
     }
   }
 
+  /** A Django route setup that uses a Regex to specify route (and routed parameters). */
+  abstract private class DjangoRegexRouteSetup extends DjangoRouteSetup {
+    override Parameter getARoutedParameter() {
+      // If we don't know the URL pattern, we simply mark all parameters as a routed
+      // parameter. This should give us more RemoteFlowSources but could also lead to
+      // more FPs. If this turns out to be the wrong tradeoff, we can always change our mind.
+      exists(DjangoRouteHandler routeHandler | routeHandler = this.getARouteHandler() |
+        not exists(this.getUrlPattern()) and
+        result in [routeHandler.getArg(_), routeHandler.getArgByName(_)] and
+        not result = any(int i | i <= routeHandler.getRequestParamIndex() | routeHandler.getArg(i))
+      )
+      or
+      exists(DjangoRouteHandler routeHandler, DjangoRouteRegex regex |
+        routeHandler = this.getARouteHandler() and
+        regex.getRouteSetup() = this
+      |
+        // either using named capture groups (passed as keyword arguments) or using
+        // unnamed capture groups (passed as positional arguments)
+        not exists(regex.getGroupName(_, _)) and
+        // first group will have group number 1
+        result =
+          routeHandler.getArg(routeHandler.getRequestParamIndex() + regex.getGroupNumber(_, _))
+        or
+        result = routeHandler.getArgByName(regex.getGroupName(_, _))
+      )
+    }
+  }
+
   /**
-   * A regex that is used in a call to `django.urls.re_path`.
+   * A regex that is used to set up a route.
    *
    * Needs this subclass to be considered a RegexString.
    */
-  private class DjangoUrlsRePathRegex extends RegexString {
-    DjangoUrlsRePathCall rePathCall;
+  private class DjangoRouteRegex extends RegexString {
+    DjangoRegexRouteSetup rePathCall;
 
-    DjangoUrlsRePathRegex() {
+    DjangoRouteRegex() {
       this instanceof StrConst and
       DataFlow::localFlow(DataFlow::exprNode(this), rePathCall.getUrlPatternArg())
     }
 
-    DjangoUrlsRePathCall getRePathCall() { result = rePathCall }
+    DjangoRegexRouteSetup getRouteSetup() { result = rePathCall }
   }
 
   /**
    * A call to `django.urls.re_path`.
    *
    * See https://docs.djangoproject.com/en/3.0/ref/urls/#re_path
    */
-  private class DjangoUrlsRePathCall extends DjangoRouteSetup {
+  private class DjangoUrlsRePathCall extends DjangoRegexRouteSetup {
     override CallNode node;
 
     DjangoUrlsRePathCall() { node.getFunction() = django::urls::re_path().asCfgNode() }
@@ -720,29 +797,26 @@ private module Django {
         djangoRouteHandlerFunctionTracker(result) = viewArg
       )
     }
+  }
 
-    override Parameter getARoutedParameter() {
-      // If we don't know the URL pattern, we simply mark all parameters as a routed
-      // parameter. This should give us more RemoteFlowSources but could also lead to
-      // more FPs. If this turns out to be the wrong tradeoff, we can always change our mind.
-      exists(DjangoRouteHandler routeHandler | routeHandler = this.getARouteHandler() |
-        not exists(this.getUrlPattern()) and
-        result in [routeHandler.getArg(_), routeHandler.getArgByName(_)] and
-        not result = any(int i | i <= routeHandler.getRequestParamIndex() | routeHandler.getArg(i))
-      )
-      or
-      exists(DjangoRouteHandler routeHandler, DjangoUrlsRePathRegex regex |
-        routeHandler = this.getARouteHandler() and
-        regex.getRePathCall() = this
-      |
-        // either using named capture groups (passed as keyword arguments) or using
-        // unnamed capture groups (passed as positional arguments)
-        not exists(regex.getGroupName(_, _)) and
-        // first group will have group number 1
-        result =
-          routeHandler.getArg(routeHandler.getRequestParamIndex() + regex.getGroupNumber(_, _))
-        or
-        result = routeHandler.getArgByName(regex.getGroupName(_, _))
+  /**
+   * A call to `django.conf.urls.url`.
+   *
+   * See https://docs.djangoproject.com/en/1.11/ref/urls/#django.conf.urls.url
+   */
+  private class DjangoConfUrlsUrlCall extends DjangoRegexRouteSetup {
+    override CallNode node;
+
+    DjangoConfUrlsUrlCall() { node.getFunction() = django::conf::conf_urls::url().asCfgNode() }
+
+    override DataFlow::Node getUrlPatternArg() {
+      result.asCfgNode() = [node.getArg(0), node.getArgByName("regex")]
+    }
+
+    override DjangoRouteHandler getARouteHandler() {
+      exists(DataFlow::Node viewArg |
+        viewArg.asCfgNode() in [node.getArg(1), node.getArgByName("view")] and
+        djangoRouteHandlerFunctionTracker(result) = viewArg
       )
     }
   }

python/ql/test/experimental/library-tests/frameworks/django-v1/routing_test.py

@@ -4,19 +4,19 @@
 from django.views.generic import View
 
 
-def url_match_xss(request, foo, bar, no_taint=None):  # $f-:routeHandler $f-:routedParameter=foo $f-:routedParameter=bar
+def url_match_xss(request, foo, bar, no_taint=None):  # $routeHandler $routedParameter=foo $routedParameter=bar
     return HttpResponse('url_match_xss: {} {}'.format(foo, bar))
 
 
-def get_params_xss(request):  # $f-:routeHandler
+def get_params_xss(request):  # $routeHandler
     return HttpResponse(request.GET.get("untrusted"))
 
 
-def post_params_xss(request):  # $f-:routeHandler
+def post_params_xss(request):  # $routeHandler
     return HttpResponse(request.POST.get("untrusted"))
 
 
-def http_resp_write(request):  # $f-:routeHandler
+def http_resp_write(request):  # $routeHandler
     rsp = HttpResponse()
     rsp.write(request.GET.get("untrusted"))
     return rsp
@@ -36,44 +36,44 @@ def get(self, request, untrusted):  # $f-:routeHandler $f-:routedParameter=untru
         return HttpResponse('ClassView get: {}'.format(untrusted))
 
 
-def show_articles(request, page_number=1):  # $f-:routeHandler $f-:routedParameter=page_number
+def show_articles(request, page_number=1):  # $routeHandler $routedParameter=page_number
     page_number = int(page_number)
     return HttpResponse('articles page: {}'.format(page_number))
 
 
-def xxs_positional_arg(request, arg0, arg1, no_taint=None):  # $f-:routeHandler $f-:routedParameter=arg0 $f-:routedParameter=arg1
+def xxs_positional_arg(request, arg0, arg1, no_taint=None):  # $routeHandler $routedParameter=arg0 $routedParameter=arg1
     return HttpResponse('xxs_positional_arg: {} {}'.format(arg0, arg1))
 
 
 urlpatterns = [
-    url(r"^url_match/(?P<foo>[^/]+)/(?P<bar>[^/]+)", url_match_xss),  # $f-:routeSetup="^url_match/(?P<foo>[^/]+)/(?P<bar>[^/]+)"
-    url(r"^get_params", get_params_xss),  # $f-:routeSetup="^get_params"
-    url(r"^post_params", post_params_xss),  # $f-:routeSetup="^post_params"
-    url(r"^http_resp_write", http_resp_write),  # $f-:routeSetup="^http_resp_write"
-    url(r"^class_view/(?P<untrusted>.+)", ClassView.as_view()),  # $f-:routeSetup="^class_view/(?P<untrusted>.+)"
+    url(r"^url_match/(?P<foo>[^/]+)/(?P<bar>[^/]+)", url_match_xss),  # $routeSetup="^url_match/(?P<foo>[^/]+)/(?P<bar>[^/]+)"
+    url(r"^get_params", get_params_xss),  # $routeSetup="^get_params"
+    url(r"^post_params", post_params_xss),  # $routeSetup="^post_params"
+    url(r"^http_resp_write", http_resp_write),  # $routeSetup="^http_resp_write"
+    url(r"^class_view/(?P<untrusted>.+)", ClassView.as_view()),  # $routeSetup="^class_view/(?P<untrusted>.+)"
 
     # one pattern to support `articles/page-<n>` and ensuring that articles/ goes to page-1
-    url(r"articles/^(?:page-(?P<page_number>\d+)/)?", show_articles),  # $f-:routeSetup="articles/^(?:page-(?P<page_number>\d+)/)?"
+    url(r"articles/^(?:page-(?P<page_number>\d+)/)?", show_articles),  # $routeSetup="articles/^(?:page-(?P<page_number>\d+)/)?"
     # passing as positional argument is not the recommended way of doing things, but it is certainly
     # possible
-    url(r"^([^/]+)/(?:foo|bar)/([^/]+)", xxs_positional_arg, name='xxs_positional_arg'),  # $f-:routeSetup="^([^/]+)/(?:foo|bar)/([^/]+)"
+    url(r"^([^/]+)/(?:foo|bar)/([^/]+)", xxs_positional_arg, name='xxs_positional_arg'),  # $routeSetup="^([^/]+)/(?:foo|bar)/([^/]+)"
 ]
 
 ################################################################################
 # Using patterns() for routing
 
-def show_user(request, username):  # $f-:routeHandler $f-:routedParameter=username
+def show_user(request, username):  # $routeHandler $routedParameter=username
     return HttpResponse('show_user {}'.format(username))
 
 
-urlpatterns = patterns(url(r"^users/(?P<username>[^/]+)", show_user))  # $f-:routeSetup="^users/(?P<username>[^/]+)"
+urlpatterns = patterns(url(r"^users/(?P<username>[^/]+)", show_user))  # $routeSetup="^users/(?P<username>[^/]+)"
 
 ################################################################################
 # Show we understand the keyword arguments to django.conf.urls.url
 
-def kw_args(request):  # $f-:routeHandler
+def kw_args(request):  # $routeHandler
     return HttpResponse('kw_args')
 
 urlpatterns = [
-    url(view=kw_args, regex=r"^kw_args")  # $f-:routeSetup="^kw_args"
+    url(view=kw_args, regex=r"^kw_args")  # $routeSetup="^kw_args"
 ]

python/ql/test/experimental/library-tests/frameworks/django-v2-v3/routing_test.py

@@ -101,9 +101,9 @@ def not_valid_identifier(request):  # $routeHandler
 # This version 1.x way of defining urls is deprecated in Django 3.1, but still works
 from django.conf.urls import url
 
-def deprecated(request):  # $f-:routeHandler
+def deprecated(request):  # $routeHandler
     return HttpResponse('deprecated')
 
 urlpatterns = [
-    url(r"^deprecated/", deprecated),  # $f-:routeSetup="^deprecated/"
+    url(r"^deprecated/", deprecated),  # $routeSetup="^deprecated/"
 ]

python/ql/test/experimental/library-tests/frameworks/django-v2-v3/testapp/urls.py

@@ -11,5 +11,5 @@
     # inline expectation tests (which thinks the `$` would mark the beginning of a new
     # line)
     re_path(r"^ba[rz]/", views.bar_baz),  # $routeSetup="^ba[rz]/"
-    url(r"^deprecated/", views.deprecated),  # $f-routeSetup="^deprecated/"
+    url(r"^deprecated/", views.deprecated),  # $routeSetup="^deprecated/"
 ]

python/ql/test/experimental/library-tests/frameworks/django-v2-v3/testapp/views.py

@@ -6,5 +6,5 @@ def foo(request: HttpRequest):  # $routeHandler
 def bar_baz(request: HttpRequest):  # $routeHandler
     return HttpResponse("bar_baz")
 
-def deprecated(request: HttpRequest):  # $f-:routeHandler
+def deprecated(request: HttpRequest):  # $routeHandler
     return HttpResponse("deprecated")