File tree Expand file tree Collapse file tree 10 files changed +3
-12
lines changed
python/ql/lib/semmle/python Expand file tree Collapse file tree 10 files changed +3
-12
lines changed Original file line number Diff line number Diff line change @@ -872,7 +872,7 @@ class TemplateConstruction extends DataFlow::Node instanceof TemplateConstructio
872872 DataFlow:: Node getSourceArg ( ) { result = super .getSourceArg ( ) }
873873}
874874
875- /** Provides classes for modelling template construction APIs. */
875+ /** Provides classes for modeling template construction APIs. */
876876module TemplateConstruction {
877877 /**
878878 * A data-flow node that constructs a template in a templating engine.
@@ -886,7 +886,6 @@ module TemplateConstruction {
886886 }
887887}
888888
889-
890889/** Provides classes for modeling HTTP-related APIs. */
891890module Http {
892891 /** Gets an HTTP verb, in upper case */
Original file line number Diff line number Diff line change 44 */
55
66private import python
7- private import semmle.python.dataflow.new.DataFlow
87private import semmle.python.ApiGraphs
98private import semmle.python.Concepts
109
Original file line number Diff line number Diff line change 44 */
55
66private import python
7- private import semmle.python.dataflow.new.DataFlow
87private import semmle.python.ApiGraphs
98private import semmle.python.Concepts
109
Original file line number Diff line number Diff line change 44 */
55
66private import python
7- private import semmle.python.dataflow.new.DataFlow
87private import semmle.python.ApiGraphs
98private import semmle.python.Concepts
109
Original file line number Diff line number Diff line change @@ -3000,7 +3000,6 @@ module PrivateDjango {
30003000 // ---------------------------------------------------------------------------
30013001 // Templates
30023002 // ---------------------------------------------------------------------------
3003-
30043003 /** A call to `django.template.Template` */
30053004 private class DjangoTemplateConstruction extends TemplateConstruction:: Range , API:: CallNode {
30063005 DjangoTemplateConstruction ( ) {
@@ -3009,6 +3008,5 @@ module PrivateDjango {
30093008
30103009 override DataFlow:: Node getSourceArg ( ) { result = this .getArg ( 0 ) }
30113010 }
3012-
30133011 // TODO: Support `from_string` on instances of `django.template.Engine`.
30143012}
Original file line number Diff line number Diff line change 44 */
55
66private import python
7- private import semmle.python.dataflow.new.DataFlow
87private import semmle.python.ApiGraphs
98private import semmle.python.Concepts
109
Original file line number Diff line number Diff line change 44 */
55
66private import python
7- private import semmle.python.dataflow.new.DataFlow
87private import semmle.python.ApiGraphs
98private import semmle.python.Concepts
109private import semmle.python.frameworks.data.ModelsAsData
Original file line number Diff line number Diff line change 44 */
55
66private import python
7- private import semmle.python.dataflow.new.DataFlow
87private import semmle.python.ApiGraphs
98private import semmle.python.Concepts
109
Original file line number Diff line number Diff line change 44 */
55
66private import python
7- private import semmle.python.dataflow.new.DataFlow
87private import semmle.python.ApiGraphs
98private import semmle.python.Concepts
109
Original file line number Diff line number Diff line change @@ -11,12 +11,13 @@ import semmle.python.dataflow.new.DataFlow
1111import semmle.python.dataflow.new.TaintTracking
1212import TemplateInjectionCustomizations:: TemplateInjection
1313
14- module TemplateInjectionConfig implements DataFlow:: ConfigSig {
14+ private module TemplateInjectionConfig implements DataFlow:: ConfigSig {
1515 predicate isSource ( DataFlow:: Node node ) { node instanceof Source }
1616
1717 predicate isSink ( DataFlow:: Node node ) { node instanceof Sink }
1818
1919 predicate isBarrierIn ( DataFlow:: Node node ) { node instanceof Sanitizer }
2020}
2121
22+ /** Global taint-tracking for detecting "template injection" vulnerabilities. */
2223module TemplateInjectionFlow = TaintTracking:: Global< TemplateInjectionConfig > ;
You can’t perform that action at this time.
0 commit comments