Skip to content

Commit 1393b5b

Browse files
committed
Add django qldocs
1 parent 5b46b90 commit 1393b5b

1 file changed

Lines changed: 32 additions & 1 deletion

File tree

  • python/ql/src/experimental/semmle/python/frameworks

python/ql/src/experimental/semmle/python/frameworks/Django.qll

Lines changed: 32 additions & 1 deletion
Original file line numberDiff line numberDiff line change
@@ -96,6 +96,22 @@ private module PrivateDjango {
9696
result = API::moduleImport("django").getMember("core").getMember("mail")
9797
}
9898

99+
/**
100+
* Gets a call to `django.core.mail.send_mail()`.
101+
*
102+
* Given the following example:
103+
*
104+
* ```py
105+
* send_mail("Subject", "plain-text body", "from@example.com", ["to@example.com"], html_message=django.http.request.GET.get("html"))
106+
* ```
107+
*
108+
* * `this` would be `send_mail("Subject", "plain-text body", "from@example.com", ["to@example.com"], html_message=django.http.request.GET.get("html"))`.
109+
* * `getPlainTextBody()`'s result would be `"plain-text body"`.
110+
* * `getHtmlBody()`'s result would be `django.http.request.GET.get("html")`.
111+
* * `getTo()`'s result would be `["to@example.com"]`.
112+
* * `getFrom()`'s result would be `"from@example.com"`.
113+
* * `getSubject()`'s result would be `"Subject"`.
114+
*/
99115
private class DjangoSendMail extends DataFlow::CallCfgNode, EmailSender {
100116
DjangoSendMail() { this = djangoMail().getMember("send_mail").getACall() }
101117

@@ -120,7 +136,22 @@ private module PrivateDjango {
120136
}
121137
}
122138

123-
/** https://github.com/django/django/blob/ca9872905559026af82000e46cde6f7dedc897b6/django/core/mail/__init__.py#L90-L121 */
139+
/**
140+
* Gets a call to `django.core.mail.mail_admins()` or `django.core.mail.mail_managers()`.
141+
*
142+
* Given the following example:
143+
*
144+
* ```py
145+
* mail_admins("Subject", "plain-text body", html_message=django.http.request.GET.get("html"))
146+
* ```
147+
*
148+
* * `this` would be `mail_admins("Subject", "plain-text body", html_message=django.http.request.GET.get("html"))`.
149+
* * `getPlainTextBody()`'s result would be `"plain-text body"`.
150+
* * `getHtmlBody()`'s result would be `django.http.request.GET.get("html")`.
151+
* * `getTo()`'s result would be `none`.
152+
* * `getFrom()`'s result would be `none`.
153+
* * `getSubject()`'s result would be `"Subject"`.
154+
*/
124155
private class DjangoMailInternal extends DataFlow::CallCfgNode, EmailSender {
125156
DjangoMailInternal() {
126157
this = djangoMail().getMember(["mail_admins", "mail_managers"]).getACall()

0 commit comments

Comments
 (0)