File tree Expand file tree Collapse file tree 3 files changed +3
-10
lines changed
python/ql/src/semmle/python/web/django Expand file tree Collapse file tree 3 files changed +3
-10
lines changed Original file line number Diff line number Diff line change @@ -29,9 +29,7 @@ deprecated class DjangoRedirect = DjangoShortcutsRedirectSink;
2929 */
3030class DjangoRedirectResponseSink extends HttpRedirectTaintSink {
3131 DjangoRedirectResponseSink ( ) {
32- exists ( CallNode call |
33- call = any ( DjangoRedirectResponseClass cls ) .getACall ( )
34- |
32+ exists ( CallNode call | call = any ( DjangoRedirectResponseClass cls ) .getACall ( ) |
3533 this = call .getArg ( 0 )
3634 or
3735 this = call .getArgByName ( "redirect_to" )
Original file line number Diff line number Diff line change @@ -21,11 +21,7 @@ private class DjangoResponseKind extends TaintKind {
2121
2222/** INTERNAL taint-source used for tracking a django response object. */
2323private class DjangoResponseSource extends TaintSource {
24- DjangoResponseSource ( ) {
25- exists ( DjangoContentResponseClass cls |
26- cls .getACall ( ) = this
27- )
28- }
24+ DjangoResponseSource ( ) { exists ( DjangoContentResponseClass cls | cls .getACall ( ) = this ) }
2925
3026 override predicate isSourceOf ( TaintKind kind ) { kind instanceof DjangoResponseKind }
3127
Original file line number Diff line number Diff line change @@ -51,7 +51,6 @@ class DjangoContentResponseClass extends ClassValue {
5151 // `django.http.response.HttpResponseNotAllowed` it would make much more sense to add
5252 // the custom logic in this class (or subclass), than to handle all of it in the sink
5353 // definition.
54-
5554 /** Gets the `content` argument of a `call` to the constructor */
5655 ControlFlowNode getContentArg ( CallNode call ) { none ( ) }
5756
@@ -60,7 +59,7 @@ class DjangoContentResponseClass extends ClassValue {
6059}
6160
6261/** A class that is a Django Response, and is vulnerable to XSS. */
63- class DjangoXSSVulnerableResponseClass extends DjangoContentResponseClass {
62+ class DjangoXSSVulnerableResponseClass extends DjangoContentResponseClass {
6463 DjangoXSSVulnerableResponseClass ( ) {
6564 // We want to avoid FPs on subclasses that are not exposed to XSS, for example `JsonResponse`.
6665 // The easiest way is to disregard any subclass that has a special `__init__` method.
You can’t perform that action at this time.
0 commit comments