Skip to content

Commit 2309f67

Browse files
RasmusWLyoff
andauthored
Python: Apply suggestions from code review
Co-authored-by: yoff <[email protected]>
1 parent 3e71d7f commit 2309f67

File tree

1 file changed

+2
-6
lines changed

1 file changed

+2
-6
lines changed

python/ql/lib/semmle/python/frameworks/Django.qll

Lines changed: 2 additions & 6 deletions
Original file line numberDiff line numberDiff line change
@@ -584,7 +584,7 @@ module PrivateDjango {
584584
* - https://docs.djangoproject.com/en/3.1/ref/models/fields/#django.db.models.ImageField
585585
*/
586586
module FileField {
587-
/** Gets a reference to the `flask.views.View` class or any subclass. */
587+
/** Gets a reference to the `django.db.models.FileField` or the `django.db.models.ImageField` class or any subclass. */
588588
API::Node subclassRef() {
589589
exists(string className | className in ["FileField", "ImageField"] |
590590
// commonly used alias
@@ -2288,11 +2288,7 @@ module PrivateDjango {
22882288
exists(DataFlow::CallCfgNode call, DataFlow::Node uploadToArg, Function func |
22892289
this.getParameter() = func.getArg(1) and
22902290
call = django::db::models::FileField::subclassRef().getACall() and
2291-
(
2292-
uploadToArg = call.getArg(2)
2293-
or
2294-
uploadToArg = call.getArgByName("upload_to")
2295-
) and
2291+
uploadToArg in [call.getArg(2), call.getArgByName("upload_to")] and
22962292
uploadToArg = poorMansFunctionTracker(func)
22972293
)
22982294
}

0 commit comments

Comments
 (0)