Skip to content

Commit 9942c3f

Browse files
committed
Python: Autoformat twisted library
1 parent ac55e6a commit 9942c3f

3 files changed

Lines changed: 32 additions & 59 deletions

File tree

Lines changed: 13 additions & 31 deletions
Original file line numberDiff line numberDiff line change
@@ -1,53 +1,35 @@
11
import python
2-
32
import semmle.python.security.TaintTracking
43
import semmle.python.web.Http
54
import Twisted
65

76
/** A twisted.web.http.Request object */
87
class TwistedRequest extends TaintKind {
9-
10-
TwistedRequest() {
11-
this = "twisted.request.http.Request"
12-
}
8+
TwistedRequest() { this = "twisted.request.http.Request" }
139

1410
override TaintKind getTaintOfAttribute(string name) {
1511
result instanceof ExternalStringSequenceDictKind and
16-
(
17-
name = "args"
18-
)
12+
name = "args"
1913
or
2014
result instanceof ExternalStringKind and
21-
(
22-
name = "uri"
23-
)
15+
name = "uri"
2416
}
2517

2618
override TaintKind getTaintOfMethodResult(string name) {
27-
(
28-
name = "getHeader" or
29-
name = "getCookie" or
30-
name = "getUser" or
31-
name = "getPassword"
32-
) and
33-
result instanceof ExternalStringKind
19+
(
20+
name = "getHeader" or
21+
name = "getCookie" or
22+
name = "getUser" or
23+
name = "getPassword"
24+
) and
25+
result instanceof ExternalStringKind
3426
}
35-
3627
}
3728

38-
3929
class TwistedRequestSource extends TaintSource {
30+
TwistedRequestSource() { isTwistedRequestInstance(this) }
4031

41-
TwistedRequestSource() {
42-
isTwistedRequestInstance(this)
43-
}
44-
45-
override string toString() {
46-
result = "Twisted request source"
47-
}
48-
49-
override predicate isSourceOf(TaintKind kind) {
50-
kind instanceof TwistedRequest
51-
}
32+
override string toString() { result = "Twisted request source" }
5233

34+
override predicate isSourceOf(TaintKind kind) { kind instanceof TwistedRequest }
5335
}

python/ql/src/semmle/python/web/twisted/Response.qll

Lines changed: 5 additions & 14 deletions
Original file line numberDiff line numberDiff line change
@@ -1,5 +1,4 @@
11
import python
2-
32
import semmle.python.security.TaintTracking
43
import semmle.python.web.Http
54
import semmle.python.security.strings.Basic
@@ -17,21 +16,17 @@ class TwistedResponse extends TaintSink {
1716
)
1817
}
1918

20-
override predicate sinks(TaintKind kind) {
21-
kind instanceof ExternalStringKind
22-
}
19+
override predicate sinks(TaintKind kind) { kind instanceof ExternalStringKind }
2320

24-
override string toString() {
25-
result = "Twisted response"
26-
}
21+
override string toString() { result = "Twisted response" }
2722
}
2823

2924
/**
3025
* A sink of taint in the form of a "setter" method on a twisted request
3126
* object, which affects the properties of the subsequent response sent to this
3227
* request.
3328
*/
34-
class TwistedRequestSetter extends HttpResponseTaintSink {
29+
class TwistedRequestSetter extends HttpResponseTaintSink {
3530
TwistedRequestSetter() {
3631
exists(CallNode call, ControlFlowNode node, string name |
3732
(
@@ -45,11 +40,7 @@ class TwistedResponse extends TaintSink {
4540
)
4641
}
4742

48-
override predicate sinks(TaintKind kind) {
49-
kind instanceof ExternalStringKind
50-
}
43+
override predicate sinks(TaintKind kind) { kind instanceof ExternalStringKind }
5144

52-
override string toString() {
53-
result = "Twisted request setter"
54-
}
45+
override string toString() { result = "Twisted request setter" }
5546
}
Lines changed: 14 additions & 14 deletions
Original file line numberDiff line numberDiff line change
@@ -1,5 +1,4 @@
11
import python
2-
32
import semmle.python.security.TaintTracking
43

54
private ClassValue theTwistedHttpRequestClass() {
@@ -10,9 +9,7 @@ private ClassValue theTwistedHttpResourceClass() {
109
result = Value::named("twisted.web.resource.Resource")
1110
}
1211

13-
ClassValue aTwistedRequestHandlerClass() {
14-
result.getABaseType+() = theTwistedHttpResourceClass()
15-
}
12+
ClassValue aTwistedRequestHandlerClass() { result.getABaseType+() = theTwistedHttpResourceClass() }
1613

1714
FunctionValue getTwistedRequestHandlerMethod(string name) {
1815
result = aTwistedRequestHandlerClass().declaredAttribute(name)
@@ -24,29 +21,32 @@ predicate isKnownRequestHandlerMethodName(string name) {
2421
name.matches("render_%")
2522
}
2623

27-
/** Holds if `node` is likely to refer to an instance of the twisted
24+
/**
25+
* Holds if `node` is likely to refer to an instance of the twisted
2826
* `Request` class.
2927
*/
3028
predicate isTwistedRequestInstance(NameNode node) {
3129
node.pointsTo().getClass() = theTwistedHttpRequestClass()
3230
or
33-
/* In points-to analysis cannot infer that a given object is an instance of
31+
/*
32+
* In points-to analysis cannot infer that a given object is an instance of
3433
* the `twisted.web.http.Request` class, we also include any parameter
3534
* called `request` that appears inside a subclass of a request handler
3635
* class, and the appropriate arguments of known request handler methods.
3736
*/
37+
3838
exists(Function func | func = node.getScope() |
3939
func.getEnclosingScope() = aTwistedRequestHandlerClass().getScope()
4040
) and
4141
(
42-
/* Any parameter called `request` */
43-
node.getId() = "request" and
44-
node.isParameter()
45-
or
46-
/* Any request parameter of a known request handler method */
47-
exists(Function func | node.getScope() = func |
48-
isKnownRequestHandlerMethodName(func.getName()) and
49-
node.getNode() = func.getArg(1)
42+
/* Any parameter called `request` */
43+
node.getId() = "request" and
44+
node.isParameter()
45+
or
46+
/* Any request parameter of a known request handler method */
47+
exists(Function func | node.getScope() = func |
48+
isKnownRequestHandlerMethodName(func.getName()) and
49+
node.getNode() = func.getArg(1)
5050
)
5151
)
5252
}

0 commit comments

Comments
 (0)