Extend documentation

Author: jorgectf

python/ql/src/experimental/semmle/python/Concepts.qll

@@ -14,16 +14,35 @@ private import semmle.python.dataflow.new.RemoteFlowSources
 private import semmle.python.dataflow.new.TaintTracking
 private import experimental.semmle.python.Frameworks
 
+/** Provides classes for modeling HTTP Header APIs. */
 module HeaderDeclaration {
+  /**
+   * A data-flow node that collects functions setting HTTP Headers' content.
+   *
+   * Extend this class to model new APIs. If you want to refine existing API models,
+   * extend `HeaderDeclaration` instead.
+   */
   abstract class Range extends DataFlow::Node {
-    abstract DataFlow::Node getHeaderInputNode();
+    /**
+     * Gets the argument containing the header value.
+     */
+    abstract DataFlow::Node getHeaderInput();
   }
 }
 
+/**
+ * A data-flow node that collects functions setting HTTP Headers' content.
+ *
+ * Extend this class to model new APIs. If you want to refine existing API models,
+ * extend `HeaderDeclaration` instead.
+ */
 class HeaderDeclaration extends DataFlow::Node {
   HeaderDeclaration::Range range;
 
   HeaderDeclaration() { this = range }
 
-  DataFlow::Node getHeaderInputNode() { result = range.getHeaderInputNode() }
+  /**
+   * Gets the argument containing the header value.
+   */
+  DataFlow::Node getHeaderInput() { result = range.getHeaderInput() }
 }

python/ql/src/experimental/semmle/python/security/injection/HTTPHeaders.qll

@@ -4,12 +4,15 @@ import semmle.python.dataflow.new.DataFlow
 import semmle.python.dataflow.new.TaintTracking
 import semmle.python.dataflow.new.RemoteFlowSources
 
+/**
+ * A taint-tracking configuration for detecting HTTP Header injections.
+ */
 class HeaderInjectionFlowConfig extends TaintTracking::Configuration {
   HeaderInjectionFlowConfig() { this = "HeaderInjectionFlowConfig" }
 
   override predicate isSource(DataFlow::Node source) { source instanceof RemoteFlowSource }
 
   override predicate isSink(DataFlow::Node sink) {
-    sink = any(HeaderDeclaration headerDeclaration).getHeaderInputNode()
+    sink = any(HeaderDeclaration headerDeclaration).getHeaderInput()
   }
 }