@@ -5,9 +5,7 @@ import semmle.python.web.Http
55// TODO: Since django uses `path = partial(...)`, our analysis doesn't understand this is
66// a FunctionValue, so we can't use `FunctionValue.getArgumentForCall`
77// https://github.com/django/django/blob/master/django/urls/conf.py#L76
8-
98abstract class DjangoRoute extends CallNode {
10-
119 abstract FunctionValue getViewFunction ( ) ;
1210
1311 abstract string getANamedArgument ( ) ;
@@ -19,41 +17,35 @@ abstract class DjangoRoute extends CallNode {
1917 abstract int getNumPositionalArguments ( ) ;
2018}
2119
22- // We need this "dummy" class, since otherwise the regex argument would not be considered a regex (RegexString is abstract)
20+ // We need this "dummy" class, since otherwise the regex argument would not be considered
21+ // a regex (RegexString is abstract)
2322class DjangoRouteRegex extends RegexString {
24- DjangoRouteRegex ( ) {
25- exists ( DjangoRegexRoute route | route .getRouteArg ( ) = this .getAFlowNode ( ) )
26- }
23+ DjangoRouteRegex ( ) { exists ( DjangoRegexRoute route | route .getRouteArg ( ) = this .getAFlowNode ( ) ) }
2724}
2825
2926class DjangoRegexRoute extends DjangoRoute {
30-
3127 ControlFlowNode route ;
3228 FunctionValue view ;
3329
3430 DjangoRegexRoute ( ) {
35-
3631 exists ( FunctionValue route_maker |
3732 // Django 1.x
3833 Value:: named ( "django.conf.urls.url" ) = route_maker and
3934 route_maker .getArgumentForCall ( this , 0 ) = route and
4035 route_maker .getArgumentForCall ( this , 1 ) .pointsTo ( view )
4136 )
4237 or
38+ // Django 2.x and 3.x: https://docs.djangoproject.com/en/3.0/ref/urls/#re-path
39+ this = Value:: named ( "django.urls.re_path" ) .getACall ( ) and
4340 (
44- // Django 2.x and 3.x: https://docs.djangoproject.com/en/3.0/ref/urls/#re-path
45- this = Value:: named ( "django.urls.re_path" ) .getACall ( ) and
46- (
47- route = this .getArg ( 0 )
48- or
49- route = this .getArgByName ( "route" )
50-
51- ) and
52- (
53- this .getArg ( 1 ) .pointsTo ( view )
54- or
55- this .getArgByName ( "view" ) .pointsTo ( view )
56- )
41+ route = this .getArg ( 0 )
42+ or
43+ route = this .getArgByName ( "route" )
44+ ) and
45+ (
46+ this .getArg ( 1 ) .pointsTo ( view )
47+ or
48+ this .getArgByName ( "view" ) .pointsTo ( view )
5749 )
5850 }
5951
@@ -62,23 +54,20 @@ class DjangoRegexRoute extends DjangoRoute {
6254 ControlFlowNode getRouteArg ( ) { result = route }
6355
6456 override string getANamedArgument ( ) {
65- exists ( DjangoRouteRegex regex |
66- regex .getAFlowNode ( ) = route |
57+ exists ( DjangoRouteRegex regex | regex .getAFlowNode ( ) = route |
6758 result = regex .getGroupName ( _, _)
6859 )
6960 }
7061
7162 override int getNumPositionalArguments ( ) {
7263 not exists ( this .getANamedArgument ( ) ) and
73- exists ( DjangoRouteRegex regex |
74- regex .getAFlowNode ( ) = route |
64+ exists ( DjangoRouteRegex regex | regex .getAFlowNode ( ) = route |
7565 result = count ( regex .getGroupNumber ( _, _) )
7666 )
7767 }
7868}
7969
8070class DjangoPathRoute extends DjangoRoute {
81-
8271 ControlFlowNode route ;
8372 FunctionValue view ;
8473
@@ -89,7 +78,6 @@ class DjangoPathRoute extends DjangoRoute {
8978 route = this .getArg ( 0 )
9079 or
9180 route = this .getArgByName ( "route" )
92-
9381 ) and
9482 (
9583 this .getArg ( 1 ) .pointsTo ( view )
@@ -110,7 +98,5 @@ class DjangoPathRoute extends DjangoRoute {
11098 )
11199 }
112100
113- override int getNumPositionalArguments ( ) {
114- none ( )
115- }
101+ override int getNumPositionalArguments ( ) { none ( ) }
116102}
0 commit comments