зеркало из https://github.com/github/codeql.git
Formatting
This commit is contained in:
Родитель
358a1b3a20
Коммит
a05266c236
|
@ -3,35 +3,45 @@
|
|||
* See https://pypi.org/project/streamlit/.
|
||||
*/
|
||||
|
||||
import python
|
||||
import semmle.python.dataflow.new.RemoteFlowSources
|
||||
import semmle.python.dataflow.new.TaintTracking
|
||||
import semmle.python.ApiGraphs
|
||||
import semmle.python.Concepts
|
||||
import python
|
||||
import semmle.python.dataflow.new.RemoteFlowSources
|
||||
import semmle.python.dataflow.new.TaintTracking
|
||||
import semmle.python.ApiGraphs
|
||||
import semmle.python.Concepts
|
||||
|
||||
|
||||
/**
|
||||
/**
|
||||
* Provides models for the `gradio` PyPI package.
|
||||
* See https://pypi.org/project/gradio/.
|
||||
*/
|
||||
module Streamlit {
|
||||
/**
|
||||
* The calls to the interactive streamlit widgets, which take untrusted input.
|
||||
*/
|
||||
private class StreamlitInput extends RemoteFlowSource::Range {
|
||||
StreamlitInput() { this = API::moduleImport("streamlit").getMember(["text_input", "text_area", "chat_input"]).getACall() }
|
||||
override string getSourceType() { result = "Streamlit user input" }
|
||||
}
|
||||
/**
|
||||
* The calls to the interactive streamlit widgets, which take untrusted input.
|
||||
*/
|
||||
private class StreamlitInput extends RemoteFlowSource::Range {
|
||||
StreamlitInput() {
|
||||
this =
|
||||
API::moduleImport("streamlit")
|
||||
.getMember(["text_input", "text_area", "chat_input"])
|
||||
.getACall()
|
||||
}
|
||||
|
||||
/**
|
||||
* The `query` call that can execute raw queries on a connection to a SQL/Sonwflake/Snowpark database.
|
||||
* https://docs.streamlit.io/develop/api-reference/connections/st.connection
|
||||
*/
|
||||
private class QueryMethodCall extends DataFlow::CallCfgNode, SqlExecution::Range {
|
||||
QueryMethodCall() {
|
||||
this = API::moduleImport("streamlit").getMember("connection").getReturn().getMember("query").getACall()
|
||||
}
|
||||
override DataFlow::Node getSql() { result in [this.getArg(0), this.getArgByName("sql")] }
|
||||
}
|
||||
override string getSourceType() { result = "Streamlit user input" }
|
||||
}
|
||||
|
||||
/**
|
||||
* The `query` call that can execute raw queries on a connection to a SQL/Sonwflake/Snowpark database.
|
||||
* https://docs.streamlit.io/develop/api-reference/connections/st.connection
|
||||
*/
|
||||
private class QueryMethodCall extends DataFlow::CallCfgNode, SqlExecution::Range {
|
||||
QueryMethodCall() {
|
||||
this =
|
||||
API::moduleImport("streamlit")
|
||||
.getMember("connection")
|
||||
.getReturn()
|
||||
.getMember("query")
|
||||
.getACall()
|
||||
}
|
||||
|
||||
override DataFlow::Node getSql() { result in [this.getArg(0), this.getArgByName("sql")] }
|
||||
}
|
||||
}
|
||||
|
|
Загрузка…
Ссылка в новой задаче