Skip to content

Commit be40b54

Browse files
haby0haby0
committed
add test
1 parent b23e28a commit be40b54

26 files changed

+109
-38
lines changed

‎python/ql/lib/semmle/python/frameworks/Aiohttp.qll‎

Lines changed: 3 additions & 4 deletions
Original file line numberDiff line numberDiff line change
@@ -644,7 +644,7 @@ module AiohttpWebModel {
644644
* Provides models for the web server part (`aiohttp.client`) of the `aiohttp` PyPI package.
645645
* See https://docs.aiohttp.org/en/stable/client.html
646646
*/
647-
module AiohttpClientModel {
647+
private module AiohttpClientModel {
648648
/**
649649
* Provides models for the `aiohttp.ClientSession` class
650650
*
@@ -668,7 +668,7 @@ module AiohttpClientModel {
668668
this = instance().getMember(methodName).getACall()
669669
}
670670

671-
DataFlow::Node getUrlArg() {
671+
override DataFlow::Node getAUrlPart() {
672672
result = this.getArgByName("url")
673673
or
674674
not methodName = "request" and
@@ -678,13 +678,12 @@ module AiohttpClientModel {
678678
result = this.getArg(1)
679679
}
680680

681-
override DataFlow::Node getAUrlPart() { result = this.getUrlArg() }
682-
683681
override string getFramework() { result = "aiohttp.ClientSession" }
684682

685683
override predicate disablesCertificateValidation(
686684
DataFlow::Node disablingNode, DataFlow::Node argumentOrigin
687685
) {
686+
// TODO: Look into disabling certificate validation
688687
none()
689688
}
690689
}

‎python/ql/lib/semmle/python/frameworks/Httpx.qll‎

Lines changed: 4 additions & 6 deletions
Original file line numberDiff line numberDiff line change
@@ -20,7 +20,7 @@ module HttpxModel {
2020
this = API::moduleImport("httpx").getMember(methodName).getACall()
2121
}
2222

23-
DataFlow::Node getUrlArg() {
23+
override DataFlow::Node getAUrlPart() {
2424
result = this.getArgByName("url")
2525
or
2626
not methodName = "request" and
@@ -30,13 +30,12 @@ module HttpxModel {
3030
result = this.getArg(1)
3131
}
3232

33-
override DataFlow::Node getAUrlPart() { result = this.getUrlArg() }
34-
3533
override string getFramework() { result = "httpx" }
3634

3735
override predicate disablesCertificateValidation(
3836
DataFlow::Node disablingNode, DataFlow::Node argumentOrigin
3937
) {
38+
// TODO: Look into disabling certificate validation
4039
none()
4140
}
4241
}
@@ -64,7 +63,7 @@ module HttpxModel {
6463
this = instance().getMember(methodName).getACall()
6564
}
6665

67-
DataFlow::Node getUrlArg() {
66+
override DataFlow::Node getAUrlPart() {
6867
result = this.getArgByName("url")
6968
or
7069
not methodName = "request" and
@@ -74,13 +73,12 @@ module HttpxModel {
7473
result = this.getArg(1)
7574
}
7675

77-
override DataFlow::Node getAUrlPart() { result = this.getUrlArg() }
78-
7976
override string getFramework() { result = "httpx.[Async]Client" }
8077

8178
override predicate disablesCertificateValidation(
8279
DataFlow::Node disablingNode, DataFlow::Node argumentOrigin
8380
) {
81+
// TODO: Look into disabling certificate validation
8482
none()
8583
}
8684
}

‎python/ql/lib/semmle/python/frameworks/Libtaxii.qll‎

Lines changed: 2 additions & 3 deletions
Original file line numberDiff line numberDiff line change
@@ -22,15 +22,14 @@ module Libtaxii {
2222
this.getArgByName("allow_url").asExpr().toString() = "True"
2323
}
2424

25-
DataFlow::Node getUrlArg() { result in [this.getArg(0), this.getArgByName("s")] }
26-
27-
override DataFlow::Node getAUrlPart() { result = this.getUrlArg() }
25+
override DataFlow::Node getAUrlPart() { result in [this.getArg(0), this.getArgByName("s")] }
2826

2927
override string getFramework() { result = "libtaxii.common.parse" }
3028

3129
override predicate disablesCertificateValidation(
3230
DataFlow::Node disablingNode, DataFlow::Node argumentOrigin
3331
) {
32+
// TODO: Look into disabling certificate validation
3433
none()
3534
}
3635
}

‎python/ql/lib/semmle/python/frameworks/Pycurl.qll‎

Lines changed: 5 additions & 4 deletions
Original file line numberDiff line numberDiff line change
@@ -25,7 +25,7 @@ module Pycurl {
2525
private API::Node instance() { result = classRef().getReturn() }
2626

2727
/**
28-
* When the first parameter value of the `setopt` function is set to `pycurl.URL`,
28+
* When the first parameter value of the `setopt` function is set to `pycurl.URL`,
2929
* the second parameter value is the request resource link.
3030
*
3131
* See https://pycurl.io/docs/latest/curl.html#set_option.
@@ -36,15 +36,16 @@ module Pycurl {
3636
this.getArg(0).asCfgNode().(AttrNode).getName() = "URL"
3737
}
3838

39-
DataFlow::Node getUrlArg() { result in [this.getArg(1), this.getArgByName("value")] }
40-
41-
override DataFlow::Node getAUrlPart() { result = this.getUrlArg() }
39+
override DataFlow::Node getAUrlPart() {
40+
result in [this.getArg(1), this.getArgByName("value")]
41+
}
4242

4343
override string getFramework() { result = "pycurl.Curl" }
4444

4545
override predicate disablesCertificateValidation(
4646
DataFlow::Node disablingNode, DataFlow::Node argumentOrigin
4747
) {
48+
// TODO: Look into disabling certificate validation
4849
none()
4950
}
5051
}

‎python/ql/lib/semmle/python/frameworks/Urllib.qll‎

Lines changed: 4 additions & 6 deletions
Original file line numberDiff line numberDiff line change
@@ -27,15 +27,14 @@ module Urllib {
2727
this = API::moduleImport("urllib").getMember("request").getMember("Request").getACall()
2828
}
2929

30-
DataFlow::Node getUrlArg() { result in [this.getArg(0), this.getArgByName("url")] }
31-
32-
override DataFlow::Node getAUrlPart() { result = this.getUrlArg() }
30+
override DataFlow::Node getAUrlPart() { result in [this.getArg(0), this.getArgByName("url")] }
3331

3432
override string getFramework() { result = "urllib.request.Request" }
3533

3634
override predicate disablesCertificateValidation(
3735
DataFlow::Node disablingNode, DataFlow::Node argumentOrigin
3836
) {
37+
// TODO: Look into disabling certificate validation
3938
none()
4039
}
4140
}
@@ -49,15 +48,14 @@ module Urllib {
4948
this = API::moduleImport("urllib").getMember("request").getMember("urlopen").getACall()
5049
}
5150

52-
DataFlow::Node getUrlArg() { result in [this.getArg(0), this.getArgByName("url")] }
53-
54-
override DataFlow::Node getAUrlPart() { result = this.getUrlArg() }
51+
override DataFlow::Node getAUrlPart() { result in [this.getArg(0), this.getArgByName("url")] }
5552

5653
override string getFramework() { result = "urllib.request.urlopen" }
5754

5855
override predicate disablesCertificateValidation(
5956
DataFlow::Node disablingNode, DataFlow::Node argumentOrigin
6057
) {
58+
// TODO: Look into disabling certificate validation
6159
none()
6260
}
6361
}

‎python/ql/lib/semmle/python/frameworks/Urllib2.qll‎

Lines changed: 5 additions & 9 deletions
Original file line numberDiff line numberDiff line change
@@ -17,19 +17,16 @@ module Urllib2 {
1717
* - https://docs.python.org/2/library/urllib2.html#urllib2.Request
1818
*/
1919
private class RequestCall extends HTTP::Client::Request::Range, DataFlow::CallCfgNode {
20-
RequestCall() {
21-
this = API::moduleImport("urllib2").getMember("Request").getACall()
22-
}
23-
24-
DataFlow::Node getUrlArg() { result in [this.getArg(0), this.getArgByName("url")] }
20+
RequestCall() { this = API::moduleImport("urllib2").getMember("Request").getACall() }
2521

26-
override DataFlow::Node getAUrlPart() { result = this.getUrlArg() }
22+
override DataFlow::Node getAUrlPart() { result in [this.getArg(0), this.getArgByName("url")] }
2723

2824
override string getFramework() { result = "urllib2.Request" }
2925

3026
override predicate disablesCertificateValidation(
3127
DataFlow::Node disablingNode, DataFlow::Node argumentOrigin
3228
) {
29+
// TODO: Look into disabling certificate validation
3330
none()
3431
}
3532
}
@@ -41,15 +38,14 @@ module Urllib2 {
4138
private class UrlOpenCall extends HTTP::Client::Request::Range, DataFlow::CallCfgNode {
4239
UrlOpenCall() { this = API::moduleImport("urllib2").getMember("urlopen").getACall() }
4340

44-
DataFlow::Node getUrlArg() { result in [this.getArg(0), this.getArgByName("url")] }
45-
46-
override DataFlow::Node getAUrlPart() { result = this.getUrlArg() }
41+
override DataFlow::Node getAUrlPart() { result in [this.getArg(0), this.getArgByName("url")] }
4742

4843
override string getFramework() { result = "urllib2.urlopen" }
4944

5045
override predicate disablesCertificateValidation(
5146
DataFlow::Node disablingNode, DataFlow::Node argumentOrigin
5247
) {
48+
// TODO: Look into disabling certificate validation
5349
none()
5450
}
5551
}

‎python/ql/lib/semmle/python/frameworks/Urllib3.qll‎

Lines changed: 4 additions & 6 deletions
Original file line numberDiff line numberDiff line change
@@ -30,31 +30,29 @@ module Urllib3 {
3030
instance().getMember(["request", "request_encode_url", "request_encode_body"]).getACall()
3131
}
3232

33-
DataFlow::Node getUrlArg() { result in [this.getArg(1), this.getArgByName("url")] }
34-
35-
override DataFlow::Node getAUrlPart() { result = this.getUrlArg() }
33+
override DataFlow::Node getAUrlPart() { result in [this.getArg(1), this.getArgByName("url")] }
3634

3735
override string getFramework() { result = "urllib3.PoolManager" }
3836

3937
override predicate disablesCertificateValidation(
4038
DataFlow::Node disablingNode, DataFlow::Node argumentOrigin
4139
) {
40+
// TODO: Look into disabling certificate validation
4241
none()
4342
}
4443
}
4544

4645
private class UrlOpenCall extends HTTP::Client::Request::Range, DataFlow::CallCfgNode {
4746
UrlOpenCall() { this = instance().getMember("urlopen").getACall() }
4847

49-
DataFlow::Node getUrlArg() { result in [this.getArg(1), this.getArgByName("url")] }
50-
51-
override DataFlow::Node getAUrlPart() { result = this.getUrlArg() }
48+
override DataFlow::Node getAUrlPart() { result in [this.getArg(1), this.getArgByName("url")] }
5249

5350
override string getFramework() { result = "urllib3.PoolManager" }
5451

5552
override predicate disablesCertificateValidation(
5653
DataFlow::Node disablingNode, DataFlow::Node argumentOrigin
5754
) {
55+
// TODO: Look into disabling certificate validation
5856
none()
5957
}
6058
}

‎python/ql/test/library-tests/frameworks/aiohttp/client_request.py‎

Lines changed: 16 additions & 0 deletions
Original file line numberDiff line numberDiff line change
@@ -0,0 +1,16 @@
1+
import aiohttp
2+
import asyncio
3+
4+
s = aiohttp.ClientSession()
5+
resp = s.request("method", "url") # $ clientRequestUrlPart="url"
6+
resp = s.request("method", url="url") # $ clientRequestUrlPart="url"
7+
8+
with aiohttp.ClientSession() as session:
9+
resp = session.get("url") # $ clientRequestUrlPart="url"
10+
resp = session.request(method="GET", url="url") # $ clientRequestUrlPart="url"
11+
12+
# other methods than GET
13+
s = aiohttp.ClientSession()
14+
resp = s.post("url") # $ clientRequestUrlPart="url"
15+
resp = s.patch("url") # $ clientRequestUrlPart="url"
16+
resp = s.options("url") # $ clientRequestUrlPart="url"

‎python/ql/test/library-tests/frameworks/httpx/ConceptsTest.expected‎

Whitespace-only changes.

‎python/ql/test/library-tests/frameworks/httpx/ConceptsTest.ql‎

Lines changed: 2 additions & 0 deletions
Original file line numberDiff line numberDiff line change
@@ -0,0 +1,2 @@
1+
import python
2+
import experimental.meta.ConceptsTest

0 commit comments

Comments
 (0)