Avoid using Str_ internal class

jorgectf · jorgectf · commit a4204cc04f3d · 2021-11-16T19:00:04.000+01:00
diff --git a/python/ql/src/experimental/semmle/python/frameworks/Django.qll b/python/ql/src/experimental/semmle/python/frameworks/Django.qll
@@ -175,9 +175,12 @@ private module PrivateDjango {
             }
 
             override predicate isSameSite() {
-              this.(DataFlow::CallCfgNode).getArgByName("samesite").asExpr().(Str_).getS() in [
-                  "Strict", "Lax"
-                ]
+              exists(StrConst str |
+                str.getText() in ["Strict", "Lax"] and
+                DataFlow::exprNode(str)
+                    .(DataFlow::LocalSourceNode)
+                    .flowsTo(this.(DataFlow::CallCfgNode).getArgByName("samesite"))
+              )
             }
 
             override DataFlow::Node getHeaderArg() { none() }
diff --git a/python/ql/src/experimental/semmle/python/frameworks/Flask.qll b/python/ql/src/experimental/semmle/python/frameworks/Flask.qll
@@ -121,9 +121,12 @@ module ExperimentalFlask {
     }
 
     override predicate isSameSite() {
-      this.(DataFlow::CallCfgNode).getArgByName("samesite").asExpr().(Str_).getS() in [
-          "Strict", "Lax"
-        ]
+      exists(StrConst str |
+        str.getText() in ["Strict", "Lax"] and
+        DataFlow::exprNode(str)
+            .(DataFlow::LocalSourceNode)
+            .flowsTo(this.(DataFlow::CallCfgNode).getArgByName("samesite"))
+      )
     }
 
     override DataFlow::Node getHeaderArg() { none() }

Original file line number	Diff line number	Diff line change
`@@ -175,9 +175,12 @@ private module PrivateDjango {`
`175`	`175`	`}`
`176`	`176`
`177`	`177`	`override predicate isSameSite() {`
`178`		`- this.(DataFlow::CallCfgNode).getArgByName("samesite").asExpr().(Str_).getS() in [`
`179`		`- "Strict", "Lax"`
`180`		`- ]`
	`178`	`+ exists(StrConst str \|`
	`179`	`+ str.getText() in ["Strict", "Lax"] and`
	`180`	`+ DataFlow::exprNode(str)`
	`181`	`+ .(DataFlow::LocalSourceNode)`
	`182`	`+ .flowsTo(this.(DataFlow::CallCfgNode).getArgByName("samesite"))`
	`183`	`+ )`
`181`	`184`	`}`
`182`	`185`
`183`	`186`	`override DataFlow::Node getHeaderArg() { none() }`
Original file line number	Diff line number	Diff line change
`@@ -121,9 +121,12 @@ module ExperimentalFlask {`
`121`	`121`	`}`
`122`	`122`
`123`	`123`	`override predicate isSameSite() {`
`124`		`- this.(DataFlow::CallCfgNode).getArgByName("samesite").asExpr().(Str_).getS() in [`
`125`		`- "Strict", "Lax"`
`126`		`- ]`
	`124`	`+ exists(StrConst str \|`
	`125`	`+ str.getText() in ["Strict", "Lax"] and`
	`126`	`+ DataFlow::exprNode(str)`
	`127`	`+ .(DataFlow::LocalSourceNode)`
	`128`	`+ .flowsTo(this.(DataFlow::CallCfgNode).getArgByName("samesite"))`
	`129`	`+ )`
`127`	`130`	`}`
`128`	`131`
`129`	`132`	`override DataFlow::Node getHeaderArg() { none() }`