Skip to content

Commit 637c52d

Browse files
am0o0am0o0
committed
separate each new FileSystemAccess packages.
1 parent 92b13c4 commit 637c52d

5 files changed

Lines changed: 110 additions & 61 deletions

File tree

‎python/ql/lib/semmle/python/frameworks/Aiofile.qll‎

Lines changed: 42 additions & 0 deletions
Original file line numberDiff line numberDiff line change
@@ -0,0 +1,42 @@
1+
/**
2+
* Provides classes modeling security-relevant aspects of the `aiofile` PyPI package.
3+
*
4+
* See https://pypi.org/project/aiofile.
5+
*/
6+
7+
private import python
8+
private import semmle.python.dataflow.new.DataFlow
9+
private import semmle.python.dataflow.new.RemoteFlowSources
10+
private import semmle.python.dataflow.new.TaintTracking
11+
private import semmle.python.Concepts
12+
private import semmle.python.ApiGraphs
13+
14+
/**
15+
* Provides models for the `aiofile` PyPI package.
16+
*
17+
* See https://pypi.org/project/aiofile.
18+
*/
19+
private module Aiofile {
20+
/**
21+
* A call to the `async_open` function or `AIOFile` constructor from `aiofile` as a sink for Filesystem access.
22+
*/
23+
class FileResponseCall extends FileSystemAccess::Range, API::CallNode {
24+
string methodName;
25+
26+
FileResponseCall() {
27+
this = API::moduleImport("aiofile").getMember("async_open").getACall() and
28+
methodName = "async_open"
29+
or
30+
this = API::moduleImport("aiofile").getMember("AIOFile").getACall() and
31+
methodName = "AIOFile"
32+
}
33+
34+
override DataFlow::Node getAPathArgument() {
35+
result = this.getParameter(0, "file_specifier").asSink() and
36+
methodName = "async_open"
37+
or
38+
result = this.getParameter(0, "filename").asSink() and
39+
methodName = "AIOFile"
40+
}
41+
}
42+
}

‎python/ql/lib/semmle/python/frameworks/Aiofiles.qll‎

Lines changed: 28 additions & 0 deletions
Original file line numberDiff line numberDiff line change
@@ -0,0 +1,28 @@
1+
/**
2+
* Provides classes modeling security-relevant aspects of the `aiofiles` PyPI package.
3+
*
4+
* See https://pypi.org/project/aiofiles.
5+
*/
6+
7+
private import python
8+
private import semmle.python.dataflow.new.DataFlow
9+
private import semmle.python.dataflow.new.RemoteFlowSources
10+
private import semmle.python.dataflow.new.TaintTracking
11+
private import semmle.python.Concepts
12+
private import semmle.python.ApiGraphs
13+
14+
/**
15+
* Provides models for the `aiofiles` PyPI package.
16+
*
17+
* See https://pypi.org/project/aiofiles.
18+
*/
19+
private module Aiofiles {
20+
/**
21+
* A call to the `open` function from `aiofiles` as a sink for Filesystem access.
22+
*/
23+
class FileResponseCall extends FileSystemAccess::Range, API::CallNode {
24+
FileResponseCall() { this = API::moduleImport("aiofiles").getMember("open").getACall() }
25+
26+
override DataFlow::Node getAPathArgument() { result = this.getParameter(0, "file").asSink() }
27+
}
28+
}

python/ql/lib/semmle/python/frameworks/FileSystemAccess.qll renamed to python/ql/lib/semmle/python/frameworks/Anyio.qll

Lines changed: 5 additions & 46 deletions
Original file line numberDiff line numberDiff line change
@@ -1,5 +1,7 @@
11
/**
2-
* Provides classes modeling security-relevant aspects of the I/O file write or file read operations
2+
* Provides classes modeling security-relevant aspects of the `anyio` PyPI package.
3+
*
4+
* See https://pypi.org/project/anyio.
35
*/
46

57
private import python
@@ -9,53 +11,10 @@ private import semmle.python.dataflow.new.TaintTracking
911
private import semmle.python.Concepts
1012
private import semmle.python.ApiGraphs
1113

12-
/**
13-
* Provides models for the `aiofile` PyPI package.
14-
* See https://github.com/agronholm/anyio.
15-
*/
16-
private module Aiofile {
17-
/**
18-
* A call to the `async_open` function or `AIOFile` constructor from `aiofile` as a sink for Filesystem access.
19-
*/
20-
class FileResponseCall extends FileSystemAccess::Range, API::CallNode {
21-
string methodName;
22-
23-
FileResponseCall() {
24-
this = API::moduleImport("aiofile").getMember("async_open").getACall() and
25-
methodName = "async_open"
26-
or
27-
this = API::moduleImport("aiofile").getMember("AIOFile").getACall() and
28-
methodName = "AIOFile"
29-
}
30-
31-
override DataFlow::Node getAPathArgument() {
32-
result = this.getParameter(0, "file_specifier").asSink() and
33-
methodName = "async_open"
34-
or
35-
result = this.getParameter(0, "filename").asSink() and
36-
methodName = "AIOFile"
37-
}
38-
}
39-
}
40-
41-
/**
42-
* Provides models for the `aiofiles` PyPI package.
43-
* See https://github.com/Tinche/aiofiles.
44-
*/
45-
private module Aiofiles {
46-
/**
47-
* A call to the `open` function from `aiofiles` as a sink for Filesystem access.
48-
*/
49-
class FileResponseCall extends FileSystemAccess::Range, API::CallNode {
50-
FileResponseCall() { this = API::moduleImport("aiofiles").getMember("open").getACall() }
51-
52-
override DataFlow::Node getAPathArgument() { result = this.getParameter(0, "file").asSink() }
53-
}
54-
}
55-
5614
/**
5715
* Provides models for the `anyio` PyPI package.
58-
* See https://github.com/agronholm/anyio.
16+
*
17+
* See https://pypi.org/project/anyio.
5918
*/
6019
private module Anyio {
6120
/**

‎python/ql/lib/semmle/python/frameworks/Starlette.qll‎

Lines changed: 0 additions & 15 deletions
Original file line numberDiff line numberDiff line change
@@ -175,19 +175,4 @@ module Starlette {
175175

176176
override DataFlow::Node getAPathArgument() { result = this.getParameter(0, "path").asSink() }
177177
}
178-
179-
/**
180-
* A call to the `baize.asgi.FileResponse` constructor as a sink for Filesystem access.
181-
*
182-
* it is not contained to Starlette source code but it is mentioned in documents as an alternative to Starlette FileResponse
183-
*/
184-
class BaizeFileResponseCall extends FileSystemAccess::Range, API::CallNode {
185-
BaizeFileResponseCall() {
186-
this = API::moduleImport("baize").getMember("asgi").getMember("FileResponse").getACall()
187-
}
188-
189-
override DataFlow::Node getAPathArgument() {
190-
result = this.getParameter(0, "filepath").asSink()
191-
}
192-
}
193178
}

‎python/ql/lib/semmle/python/frameworks/baize.qll‎

Lines changed: 35 additions & 0 deletions
Original file line numberDiff line numberDiff line change
@@ -0,0 +1,35 @@
1+
/**
2+
* Provides classes modeling security-relevant aspects of the `baize` PyPI package.
3+
*
4+
* See https://pypi.org/project/baize.
5+
*/
6+
7+
private import python
8+
private import semmle.python.dataflow.new.DataFlow
9+
private import semmle.python.dataflow.new.TaintTracking
10+
private import semmle.python.Concepts
11+
private import semmle.python.ApiGraphs
12+
private import semmle.python.frameworks.internal.InstanceTaintStepsHelper
13+
private import semmle.python.frameworks.Stdlib
14+
15+
/**
16+
* Provides models for `baize` PyPI package.
17+
*
18+
* See https://pypi.org/project/baize.
19+
*/
20+
module Starlette {
21+
/**
22+
* A call to the `baize.asgi.FileResponse` constructor as a sink for Filesystem access.
23+
*
24+
* it is not contained to Starlette source code but it is mentioned in documents as an alternative to Starlette FileResponse
25+
*/
26+
class BaizeFileResponseCall extends FileSystemAccess::Range, API::CallNode {
27+
BaizeFileResponseCall() {
28+
this = API::moduleImport("baize").getMember("asgi").getMember("FileResponse").getACall()
29+
}
30+
31+
override DataFlow::Node getAPathArgument() {
32+
result = this.getParameter(0, "filepath").asSink()
33+
}
34+
}
35+
}

0 commit comments

Comments
 (0)