Python: Add models for websocket handlers for Tornado

[joefarebrother]

Adds models for WebSocketHandler remote flow sources.

[Copilot]

Pull Request Overview

This pull request adds support for modeling WebSocket handlers in the Tornado framework, specifically adding remote flow source models for tornado.websocket.WebSocketHandler.

• Added modeling for tornado.websocket.WebSocketHandler class and its event handler methods
• Created TornadoWebSocketEventHandler class to identify WebSocket event handlers as request handlers with routed parameters
• Added test cases for WebSocket handler methods including open, on_message, on_ping, on_pong, select_subprotocol, and check_origin

Reviewed Changes

Copilot reviewed 3 out of 3 changed files in this pull request and generated 5 comments.

File	Description
python/ql/lib/semmle/python/frameworks/Tornado.qll	Added WebSocket module modeling including WebSocketHandler class reference, WebSocketHandlerClass extending RequestHandlerClass, and TornadoWebSocketEventHandler for treating WebSocket event handlers as request handlers
python/ql/test/library-tests/frameworks/tornado/routing_test.py	Added test class WebSocket extending tornado.websocket.WebSocketHandler with test methods for various WebSocket event handlers and corresponding route setup
python/ql/lib/change-notes/2025-11-22-tornado-websockets.md	Added change note documenting the addition of remote flow source models for tornado.websocket.WebSocketHandler

---

💡 Add Copilot custom instructions for smarter, more guided reviews. Learn how to get started.

[yoff]

We could possibly do additional modeling like write_message and set_default_headers (perhaps even prepare), but this is still an improvement on its own.

[yoff]

Should we expect # $ HttpResponse here? (and below)

[joefarebrother]

Possibly is reasonable to, if write_message should be considered an HttpResponse write

[joefarebrother]

Added as expectations that are MISSING as write_message is not modeled.

[yoff]

LGTM

[yoff]

DCA run looks good, merging.