Python: Model RemoteFlowSources on Django forms/fields #5500
Conversation
I'm not feeling 100% confident about `SelfRefMixin`, but since I needed it for both DjangoViewClass and DjangoFormClass, I wanted to avoid copy-pasting this code around. However, I'm not so opitimistic about it that I want to add it to a sharable utility qll file :D
I used some ad-hoc QL queries to help me find all these extra instances, but not quite ready to share that code yet :P
| exists(DjangoFormFieldClass cls, Function meth | | ||
| cls.getAMethod() = meth and | ||
| meth.getName() in ["to_python", "validate", "run_validators", "clean"] and | ||
| this.getParameter() = meth.getArg(1) |
There was a problem hiding this comment.
We have got to fix the naming here, at first reading I thought we needed flow. But this is just stating that the class we define is indeed the 1th parameter of the method.
There was a problem hiding this comment.
@yoff can you come with a suggestion then? I'm not quite sure I understand the problem 😕
There was a problem hiding this comment.
We need to change the name of getArg since it gets a parameter. It is out of scope for this PR.
python/ql/test/library-tests/frameworks/django-v2-v3/taint_forms.py
Outdated
Show resolved
Hide resolved
Not worried about performance. Just that this is probably the first use of |
Co-authored-by: yoff <lerchedahl@gmail.com>
|
I think we should be worried about performance here, as tracking all |
Luckily, we will only track EDIT: started https://jenkins.internal.semmle.com/job/Changes/job/Python-Differences/479/ |
|
Ah, that's a good point. I'm less worried now. 😌 |
|
Performance test is done, and all is looking good ✔️ |
No description provided.