Merge pull request github#6732 from RasmusWL/minor-sqlalchemy-comment-fixes

Author: yoff

python/ql/lib/semmle/python/frameworks/SqlAlchemy.qll

@@ -300,10 +300,9 @@ module SqlAlchemy {
    *   there are many many constructs we would need to have models for. (see the 2
    *   examples below)
    *
-   * So instead we flag user-input to a TextClause with its' own query
-   * (`py/sqlalchemy-textclause-injection`). And so we don't highlight any parts of an
-   * ORM constructed query such as these as containing SQL, and don't need the additional
-   * taint steps either.
+   * So instead we extended the SQL injection query to include TextClause construction
+   * as a sink. And so we don't highlight any parts of an ORM constructed query such as
+   * these as containing SQL, and don't need the additional taint steps either.
    *
    * See
    * - https://docs.sqlalchemy.org/en/14/core/sqlelement.html#sqlalchemy.sql.expression.TextClause.

python/ql/test/library-tests/frameworks/sqlalchemy/new_tests.py

@@ -202,8 +202,8 @@ class For14(Base):
 # - This would require a LOT of modeling for these additional taint steps, since there
 #   are many many constructs we would need to have models for. (see the 2 examples below)
 #
-# So instead we flag user-input to a TextClause with its' own query. And so we don't
-# highlight any parts of an ORM constructed query such as these as containing SQL.
+# So instead we extended the SQL injection query to include TextClause construction as a
+# sink directly.
 
 # `filter` provides more general filtering
 # see https://docs.sqlalchemy.org/en/14/orm/tutorial.html#common-filter-operators