@@ -2,13 +2,13 @@ import python
22
33import semmle.python.security.TaintTracking
44
5- private ClassObject theTurboGearsControllerClass ( ) {
6- result = ModuleObject :: named ( "tg" ) . attr ( " TGController")
5+ private ClassValue theTurboGearsControllerClass ( ) {
6+ result = Value :: named ( "tg. TGController" )
77}
88
99
10- ClassObject aTurboGearsControllerClass ( ) {
11- result .getASuperType ( ) = theTurboGearsControllerClass ( )
10+ ClassValue aTurboGearsControllerClass ( ) {
11+ result .getABaseType + ( ) = theTurboGearsControllerClass ( )
1212}
1313
1414
@@ -17,13 +17,13 @@ class TurboGearsControllerMethod extends Function {
1717 ControlFlowNode decorator ;
1818
1919 TurboGearsControllerMethod ( ) {
20- aTurboGearsControllerClass ( ) .getPyClass ( ) = this .getScope ( ) and
20+ aTurboGearsControllerClass ( ) .getScope ( ) = this .getScope ( ) and
2121 decorator = this .getADecorator ( ) .getAFlowNode ( ) and
2222 /* Is decorated with @expose() or @expose(path) */
2323 (
2424 decorator .( CallNode ) .getFunction ( ) .( NameNode ) .getId ( ) = "expose"
2525 or
26- decorator .refersTo ( _ , ModuleObject :: named ( "tg" ) . attr ( " expose") , _ )
26+ decorator .pointsTo ( ) . getClass ( ) = Value :: named ( "tg. expose" )
2727 )
2828 }
2929
@@ -35,21 +35,12 @@ class TurboGearsControllerMethod extends Function {
3535 exists ( templateName ( ) )
3636 }
3737
38- string getTemplateName ( ) {
39- exists ( StringObject str |
40- templateName ( ) .refersTo ( str ) and
41- result = str .getText ( )
42- )
43- }
44-
4538 Dict getValidationDict ( ) {
46- exists ( Call call , Object dict |
39+ exists ( Call call , Value dict |
4740 call = this .getADecorator ( ) and
4841 call .getFunc ( ) .( Name ) .getId ( ) = "validate" and
49- call .getArg ( 0 ) .refersTo ( dict ) and
50- result = dict .getOrigin ( )
42+ call .getArg ( 0 ) .pointsTo ( dict , result )
5143 )
5244 }
5345
5446}
55-
0 commit comments