Python: allow any positional argument in annotate

yoff · yoff · commit e51543ea792e · 2020-10-21T13:17:20.000+02:00
diff --git a/python/ql/src/experimental/semmle/python/frameworks/Django.qll b/python/ql/src/experimental/semmle/python/frameworks/Django.qll
@@ -307,7 +307,7 @@ private module Django {
 
     ObjectsAnnotate() {
       node.getFunction() = django::db::models::objects_attr("annotate").asCfgNode() and
-      raw in [node.getArg(0), node.getArgByName(_)] and
+      raw in [node.getArg(_), node.getArgByName(_)] and
       raw.getFunction() = django::db::models::expressions::RawSQL::classRef().asCfgNode()
     }
 

Original file line number	Diff line number	Diff line change
`@@ -307,7 +307,7 @@ private module Django {`
`307`	`307`
`308`	`308`	`ObjectsAnnotate() {`
`309`	`309`	`node.getFunction() = django::db::models::objects_attr("annotate").asCfgNode() and`
`310`		`- raw in [node.getArg(0), node.getArgByName(_)] and`
	`310`	`+ raw in [node.getArg(_), node.getArgByName(_)] and`
`311`	`311`	`raw.getFunction() = django::db::models::expressions::RawSQL::classRef().asCfgNode()`
`312`	`312`	`}`
`313`	`313`