Python: Add Tornado source modeling#4869
Conversation
| TornadoRouteRegex() { | ||
| this instanceof StrConst and | ||
| DataFlow::localFlow(DataFlow::exprNode(this), setup.getUrlPatternArg()) | ||
| } |
There was a problem hiding this comment.
We might be able to ask for a LocalSourceNode here.
There was a problem hiding this comment.
Yep, just rewrote it to match DjangoRouteRegex
|
Preliminary review, since it is only a draft. But it basically looks great 👍 (nice, clean history too) |
Now you can run them, and the examples have been adjusted so they actually work!
I should probably have split this up into 2 commits, so sorry that didn't happen :|
The reason this becomes valueable right now, is that we can mark routed params as taint-sources. Longer down the line, we can (hopefully) detect that a routed param will only accept digits, and mark it safe for some of our taint-tracking queries.
RasmusWL
force-pushed
the
tornado-source-modeling
branch
from
c8ddc8f to
f9a29cb
Compare
|
Basically nothing changed since your last "preliminary" review, now it's just rebased on top of main (meaning the UI is only listing the commits that are part of this PR). Only new thing is using LocalSourceNode as you suggested 😉 |
yoff
left a comment
yoff
left a comment
There was a problem hiding this comment.
Looks good to merge now. Should the remaining failing tests be tracked in an issue or is the (awesome) fail column sufficient?
Good point. We probably should be tracking all those missing models in some issue 👍 |
2 participants
A draft PR since it builds upon the changes from #4864.
Locally confirmed to bring back the missing result for https://lgtm.com/projects/g/ArchiveTeam/wpull?mode=tree.