This commit is contained in:
Sylwia Budzynska 2024-07-26 14:55:58 +02:00
Родитель 358a1b3a20
Коммит a05266c236
1 изменённых файлов: 34 добавлений и 24 удалений

Просмотреть файл

@ -9,7 +9,6 @@
import semmle.python.ApiGraphs
import semmle.python.Concepts
/**
* Provides models for the `gradio` PyPI package.
* See https://pypi.org/project/gradio/.
@ -19,7 +18,13 @@ module Streamlit {
* The calls to the interactive streamlit widgets, which take untrusted input.
*/
private class StreamlitInput extends RemoteFlowSource::Range {
StreamlitInput() { this = API::moduleImport("streamlit").getMember(["text_input", "text_area", "chat_input"]).getACall() }
StreamlitInput() {
this =
API::moduleImport("streamlit")
.getMember(["text_input", "text_area", "chat_input"])
.getACall()
}
override string getSourceType() { result = "Streamlit user input" }
}
@ -29,9 +34,14 @@ module Streamlit {
*/
private class QueryMethodCall extends DataFlow::CallCfgNode, SqlExecution::Range {
QueryMethodCall() {
this = API::moduleImport("streamlit").getMember("connection").getReturn().getMember("query").getACall()
}
override DataFlow::Node getSql() { result in [this.getArg(0), this.getArgByName("sql")] }
this =
API::moduleImport("streamlit")
.getMember("connection")
.getReturn()
.getMember("query")
.getACall()
}
override DataFlow::Node getSql() { result in [this.getArg(0), this.getArgByName("sql")] }
}
}