Python: Solve deprecation warnings for old experimental queries

RasmusWL · RasmusWL · commit 94f9656e8e60 · 2022-02-10T00:09:43.000+01:00
diff --git a/python/ql/src/experimental/Security/CWE-074/TemplateInjection.ql b/python/ql/src/experimental/Security/CWE-074/TemplateInjection.ql
@@ -21,11 +21,11 @@ import semmle.python.security.strings.Untrusted
 class TemplateInjectionConfiguration extends TaintTracking::Configuration {
   TemplateInjectionConfiguration() { this = "Template injection configuration" }
 
-  override predicate isSource(TaintTracking::Source source) {
+  deprecated override predicate isSource(TaintTracking::Source source) {
     source instanceof HttpRequestTaintSource
   }
 
-  override predicate isSink(TaintTracking::Sink sink) { sink instanceof SSTISink }
+  deprecated override predicate isSink(TaintTracking::Sink sink) { sink instanceof SSTISink }
 }
 
 from TemplateInjectionConfiguration config, TaintedPathSource src, TaintedPathSink sink
diff --git a/python/ql/src/experimental/Security/CWE-091/Xslt.ql b/python/ql/src/experimental/Security/CWE-091/Xslt.ql
@@ -20,11 +20,11 @@ import experimental.semmle.python.security.injection.XSLT
 class XSLTInjectionConfiguration extends TaintTracking::Configuration {
   XSLTInjectionConfiguration() { this = "XSLT injection configuration" }
 
-  override predicate isSource(TaintTracking::Source source) {
+  deprecated override predicate isSource(TaintTracking::Source source) {
     source instanceof HttpRequestTaintSource
   }
 
-  override predicate isSink(TaintTracking::Sink sink) {
+  deprecated override predicate isSink(TaintTracking::Sink sink) {
     sink instanceof XSLTInjection::XSLTInjectionSink
   }
 }
diff --git a/python/ql/src/experimental/semmle/python/security/injection/XSLT.qll b/python/ql/src/experimental/semmle/python/security/injection/XSLT.qll
@@ -21,7 +21,7 @@ module XSLTInjection {
   /**
    * A kind of "taint", representing an untrusted XML string
    */
-  private class ExternalXmlStringKind extends ExternalStringKind {
+  deprecated private class ExternalXmlStringKind extends ExternalStringKind {
     ExternalXmlStringKind() { this = "etree.XML string" }
 
     override TaintKind getTaintForFlowStep(ControlFlowNode fromnode, ControlFlowNode tonode) {
diff --git a/python/ql/src/experimental/semmle/python/templates/Airspeed.qll b/python/ql/src/experimental/semmle/python/templates/Airspeed.qll
@@ -5,15 +5,15 @@ import semmle.python.web.HttpRequest
 import experimental.semmle.python.templates.SSTISink
 
 /** returns the ClassValue representing `airspeed.Template` */
-ClassValue theAirspeedTemplateClass() { result = Value::named("airspeed.Template") }
+deprecated ClassValue theAirspeedTemplateClass() { result = Value::named("airspeed.Template") }
 
 /**
  * Sink representing the `airspeed.Template` class instantiation argument.
  *
  *  import airspeed
  *  temp = airspeed.Template(`"sink"`)
  */
-class AirspeedTemplateSink extends SSTISink {
+deprecated class AirspeedTemplateSink extends SSTISink {
   override string toString() { result = "argument to airspeed.Template()" }
 
   AirspeedTemplateSink() {
diff --git a/python/ql/src/experimental/semmle/python/templates/Bottle.qll b/python/ql/src/experimental/semmle/python/templates/Bottle.qll
@@ -5,15 +5,17 @@ import semmle.python.web.HttpRequest
 import experimental.semmle.python.templates.SSTISink
 
 /** returns the ClassValue representing `bottle.SimpleTemplate` */
-ClassValue theBottleSimpleTemplateClass() { result = Value::named("bottle.SimpleTemplate") }
+deprecated ClassValue theBottleSimpleTemplateClass() {
+  result = Value::named("bottle.SimpleTemplate")
+}
 
 /**
  * Sink representing the `bottle.SimpleTemplate` class instantiation argument.
  *
  *  from bottle import SimpleTemplate
  *  template = SimpleTemplate(`sink`)
  */
-class BottleSimpleTemplateSink extends SSTISink {
+deprecated class BottleSimpleTemplateSink extends SSTISink {
   override string toString() { result = "argument to bottle.SimpleTemplate()" }
 
   BottleSimpleTemplateSink() {
@@ -32,7 +34,7 @@ class BottleSimpleTemplateSink extends SSTISink {
  *  from bottle import template
  *  tmp = template(`sink`)
  */
-class BottleTemplateSink extends SSTISink {
+deprecated class BottleTemplateSink extends SSTISink {
   override string toString() { result = "argument to bottle.template()" }
 
   BottleTemplateSink() {
diff --git a/python/ql/src/experimental/semmle/python/templates/Chameleon.qll b/python/ql/src/experimental/semmle/python/templates/Chameleon.qll
@@ -5,15 +5,17 @@ import semmle.python.web.HttpRequest
 import experimental.semmle.python.templates.SSTISink
 
 /** returns the ClassValue representing `chameleon.PageTemplate` */
-ClassValue theChameleonPageTemplateClass() { result = Value::named("chameleon.PageTemplate") }
+deprecated ClassValue theChameleonPageTemplateClass() {
+  result = Value::named("chameleon.PageTemplate")
+}
 
 /**
  * Sink representing the `chameleon.PageTemplate` class instantiation argument.
  *
  *  from chameleon import PageTemplate
  *  template = PageTemplate(`sink`)
  */
-class ChameleonTemplateSink extends SSTISink {
+deprecated class ChameleonTemplateSink extends SSTISink {
   override string toString() { result = "argument to Chameleon.PageTemplate()" }
 
   ChameleonTemplateSink() {
diff --git a/python/ql/src/experimental/semmle/python/templates/Cheetah.qll b/python/ql/src/experimental/semmle/python/templates/Cheetah.qll
@@ -5,7 +5,9 @@ import semmle.python.web.HttpRequest
 import experimental.semmle.python.templates.SSTISink
 
 /** returns the ClassValue representing `Cheetah.Template.Template` */
-ClassValue theCheetahTemplateClass() { result = Value::named("Cheetah.Template.Template") }
+deprecated ClassValue theCheetahTemplateClass() {
+  result = Value::named("Cheetah.Template.Template")
+}
 
 /**
  * Sink representing the instantiation argument of any class which derives from
@@ -22,7 +24,7 @@ ClassValue theCheetahTemplateClass() { result = Value::named("Cheetah.Template.T
  *  from Cheetah.Template import Template
  *  t3 = Template("sink")
  */
-class CheetahTemplateInstantiationSink extends SSTISink {
+deprecated class CheetahTemplateInstantiationSink extends SSTISink {
   override string toString() { result = "argument to Cheetah.Template.Template()" }
 
   CheetahTemplateInstantiationSink() {
diff --git a/python/ql/src/experimental/semmle/python/templates/Chevron.qll b/python/ql/src/experimental/semmle/python/templates/Chevron.qll
@@ -5,15 +5,15 @@ import semmle.python.web.HttpRequest
 import experimental.semmle.python.templates.SSTISink
 
 /** returns the Value representing `chevron.render` function */
-Value theChevronRenderFunc() { result = Value::named("chevron.render") }
+deprecated Value theChevronRenderFunc() { result = Value::named("chevron.render") }
 
 /**
  * Sink representing the `chevron.render` function call argument.
  *
  *  import chevron
  *  tmp = chevron.render(`sink`,{ 'key' : 'value' })
  */
-class ChevronRenderSink extends SSTISink {
+deprecated class ChevronRenderSink extends SSTISink {
   override string toString() { result = "argument to chevron.render()" }
 
   ChevronRenderSink() {
diff --git a/python/ql/src/experimental/semmle/python/templates/DjangoTemplate.qll b/python/ql/src/experimental/semmle/python/templates/DjangoTemplate.qll
@@ -4,15 +4,15 @@ import python
 import semmle.python.web.HttpRequest
 import experimental.semmle.python.templates.SSTISink
 
-ClassValue theDjangoTemplateClass() { result = Value::named("django.template.Template") }
+deprecated ClassValue theDjangoTemplateClass() { result = Value::named("django.template.Template") }
 
 /**
  * Sink representng `django.template.Template` class instantiation argument.
  *
  *  from django.template import Template
  *  template = Template(`sink`)
  */
-class DjangoTemplateTemplateSink extends SSTISink {
+deprecated class DjangoTemplateTemplateSink extends SSTISink {
   override string toString() { result = "argument to Django.template()" }
 
   DjangoTemplateTemplateSink() {
diff --git a/python/ql/src/experimental/semmle/python/templates/FlaskTemplate.qll b/python/ql/src/experimental/semmle/python/templates/FlaskTemplate.qll
@@ -4,15 +4,17 @@ import python
 import semmle.python.web.HttpRequest
 import experimental.semmle.python.templates.SSTISink
 
-Value theFlaskRenderTemplateClass() { result = Value::named("flask.render_template_string") }
+deprecated Value theFlaskRenderTemplateClass() {
+  result = Value::named("flask.render_template_string")
+}
 
 /**
  * Sink representng `flask.render_template_string` function call argument.
  *
  *  from flask import render_template_string
  *  render_template_string(`sink`)
  */
-class FlaskTemplateSink extends SSTISink {
+deprecated class FlaskTemplateSink extends SSTISink {
   override string toString() { result = "argument to flask.render_template_string()" }
 
   FlaskTemplateSink() {
diff --git a/python/ql/src/experimental/semmle/python/templates/Genshi.qll b/python/ql/src/experimental/semmle/python/templates/Genshi.qll
@@ -5,10 +5,12 @@ import semmle.python.web.HttpRequest
 import experimental.semmle.python.templates.SSTISink
 
 /** returns the ClassValue representing `Genshi.template.TextTemplate` */
-ClassValue theGenshiTextTemplateClass() { result = Value::named("genshi.template.TextTemplate") }
+deprecated ClassValue theGenshiTextTemplateClass() {
+  result = Value::named("genshi.template.TextTemplate")
+}
 
 /** returns the ClassValue representing `Genshi.template.MarkupTemplate` */
-ClassValue theGenshiMarkupTemplateClass() {
+deprecated ClassValue theGenshiMarkupTemplateClass() {
   result = Value::named("genshi.template.MarkupTemplate")
 }
 
@@ -18,7 +20,7 @@ ClassValue theGenshiMarkupTemplateClass() {
  *  from genshi.template import TextTemplate
  *  tmpl = TextTemplate('sink')
  */
-class GenshiTextTemplateSink extends SSTISink {
+deprecated class GenshiTextTemplateSink extends SSTISink {
   override string toString() { result = "argument to genshi.template.TextTemplate()" }
 
   GenshiTextTemplateSink() {
@@ -37,7 +39,7 @@ class GenshiTextTemplateSink extends SSTISink {
  *  from genshi.template import MarkupTemplate
  *  tmpl = MarkupTemplate('sink')
  */
-class GenshiMarkupTemplateSink extends SSTISink {
+deprecated class GenshiMarkupTemplateSink extends SSTISink {
   override string toString() { result = "argument to genshi.template.MarkupTemplate()" }
 
   GenshiMarkupTemplateSink() {
diff --git a/python/ql/src/experimental/semmle/python/templates/Jinja.qll b/python/ql/src/experimental/semmle/python/templates/Jinja.qll
@@ -5,18 +5,18 @@ import semmle.python.web.HttpRequest
 import experimental.semmle.python.templates.SSTISink
 
 /** returns the ClassValue representing `jinja2.Template` */
-ClassValue theJinja2TemplateClass() { result = Value::named("jinja2.Template") }
+deprecated ClassValue theJinja2TemplateClass() { result = Value::named("jinja2.Template") }
 
 /** returns the ClassValue representing `jinja2.Template` */
-Value theJinja2FromStringValue() { result = Value::named("jinja2.from_string") }
+deprecated Value theJinja2FromStringValue() { result = Value::named("jinja2.from_string") }
 
 /**
  * Sink representing the `jinja2.Template` class instantiation argument.
  *
  *  from jinja2 import Template
  *  template = Template(`sink`)
  */
-class Jinja2TemplateSink extends SSTISink {
+deprecated class Jinja2TemplateSink extends SSTISink {
   override string toString() { result = "argument to jinja2.Template()" }
 
   Jinja2TemplateSink() {
@@ -35,7 +35,7 @@ class Jinja2TemplateSink extends SSTISink {
  *  from jinja2 import from_string
  *  template = from_string(`sink`)
  */
-class Jinja2FromStringSink extends SSTISink {
+deprecated class Jinja2FromStringSink extends SSTISink {
   override string toString() { result = "argument to jinja2.from_string()" }
 
   Jinja2FromStringSink() {
diff --git a/python/ql/src/experimental/semmle/python/templates/Mako.qll b/python/ql/src/experimental/semmle/python/templates/Mako.qll
@@ -5,15 +5,15 @@ import semmle.python.web.HttpRequest
 import experimental.semmle.python.templates.SSTISink
 
 /** returns the ClassValue representing `mako.template.Template` */
-ClassValue theMakoTemplateClass() { result = Value::named("mako.template.Template") }
+deprecated ClassValue theMakoTemplateClass() { result = Value::named("mako.template.Template") }
 
 /**
  * Sink representing the `mako.template.Template` class instantiation argument.
  *
  *  from mako.template import Template
  *  mytemplate = Template("hello world!")
  */
-class MakoTemplateSink extends SSTISink {
+deprecated class MakoTemplateSink extends SSTISink {
   override string toString() { result = "argument to mako.template.Template()" }
 
   MakoTemplateSink() {
diff --git a/python/ql/src/experimental/semmle/python/templates/SSTISink.qll b/python/ql/src/experimental/semmle/python/templates/SSTISink.qll
@@ -4,4 +4,4 @@ import semmle.python.dataflow.TaintTracking
  * A generic taint sink that is vulnerable to template inclusions.
  * The `temp` in `jinja2.Template(temp)` and similar.
  */
-abstract class SSTISink extends TaintSink { }
+abstract deprecated class SSTISink extends TaintSink { }
diff --git a/python/ql/src/experimental/semmle/python/templates/TRender.qll b/python/ql/src/experimental/semmle/python/templates/TRender.qll
@@ -5,15 +5,15 @@ import semmle.python.web.HttpRequest
 import experimental.semmle.python.templates.SSTISink
 
 /** returns the ClassValue representing `trender.TRender` */
-ClassValue theTRenderTemplateClass() { result = Value::named("trender.TRender") }
+deprecated ClassValue theTRenderTemplateClass() { result = Value::named("trender.TRender") }
 
 /**
  * Sink representing the `trender.TRender` class instantiation argument.
  *
  *  from trender import TRender
  *  template = TRender(`sink`)
  */
-class TRenderTemplateSink extends SSTISink {
+deprecated class TRenderTemplateSink extends SSTISink {
   override string toString() { result = "argument to trender.TRender()" }
 
   TRenderTemplateSink() {
diff --git a/python/ql/test/experimental/semmle/python/templates/AirspeedSSTISinks.expected b/python/ql/test/experimental/semmle/python/templates/AirspeedSSTISinks.expected
@@ -1 +1,2 @@
+WARNING: Type SSTISink has been deprecated and may be removed in future (AirspeedSSTISinks.ql:4,6-14)
 | Airspeed.py:10:30:10:35 | argument to airspeed.Template() |
diff --git a/python/ql/test/experimental/semmle/python/templates/BottleSSTISinks.expected b/python/ql/test/experimental/semmle/python/templates/BottleSSTISinks.expected
@@ -1,2 +1,3 @@
+WARNING: Type SSTISink has been deprecated and may be removed in future (BottleSSTISinks.ql:4,6-14)
 | Bottle.py:11:26:11:33 | argument to bottle.SimpleTemplate() |
 | Bottle.py:17:17:17:24 | argument to bottle.template() |
diff --git a/python/ql/test/experimental/semmle/python/templates/ChameleonSSTISinks.expected b/python/ql/test/experimental/semmle/python/templates/ChameleonSSTISinks.expected
@@ -1 +1,2 @@
+WARNING: Type SSTISink has been deprecated and may be removed in future (ChameleonSSTISinks.ql:4,6-14)
 | Chameleon.py:5:29:5:34 | argument to Chameleon.PageTemplate() |
diff --git a/python/ql/test/experimental/semmle/python/templates/CheetahSSTISinks.expected b/python/ql/test/experimental/semmle/python/templates/CheetahSSTISinks.expected
@@ -1,2 +1,3 @@
+WARNING: Type SSTISink has been deprecated and may be removed in future (CheetahSSTISinks.ql:4,6-14)
 | CheetahSinks.py:10:21:10:26 | argument to Cheetah.Template.Template() |
 | CheetahSinks.py:20:20:20:25 | argument to Cheetah.Template.Template() |
diff --git a/python/ql/test/experimental/semmle/python/templates/ChevronSSTISinks.expected b/python/ql/test/experimental/semmle/python/templates/ChevronSSTISinks.expected
@@ -1 +1,2 @@
+WARNING: Type SSTISink has been deprecated and may be removed in future (ChevronSSTISinks.ql:4,6-14)
 | ChevronSinks.py:10:27:10:32 | argument to chevron.render() |
diff --git a/python/ql/test/experimental/semmle/python/templates/DjangoSSTISinks.expected b/python/ql/test/experimental/semmle/python/templates/DjangoSSTISinks.expected
@@ -1 +1,2 @@
+WARNING: Type SSTISink has been deprecated and may be removed in future (DjangoSSTISinks.ql:4,6-14)
 | DjangoTemplates.py:9:18:9:25 | argument to Django.template() |
diff --git a/python/ql/test/experimental/semmle/python/templates/GenshiSSTISinks.expected b/python/ql/test/experimental/semmle/python/templates/GenshiSSTISinks.expected
@@ -1,2 +1,3 @@
+WARNING: Type SSTISink has been deprecated and may be removed in future (GenshiSSTISinks.ql:4,6-14)
 | Genshi.py:5:27:5:32 | argument to genshi.template.MarkupTemplate() |
 | Genshi.py:10:25:10:30 | argument to genshi.template.TextTemplate() |
diff --git a/python/ql/test/experimental/semmle/python/templates/JinjaSSTISinks.expected b/python/ql/test/experimental/semmle/python/templates/JinjaSSTISinks.expected
@@ -1,3 +1,4 @@
+WARNING: Type SSTISink has been deprecated and may be removed in future (JinjaSSTISinks.ql:4,6-14)
 | Jinja2Templates.py:6:25:6:30 | argument to jinja2.Template() |
 | Jinja2Templates.py:11:25:11:30 | argument to jinja2.Template() |
 | Jinja2Templates.py:16:25:16:37 | argument to jinja2.Template() |
diff --git a/python/ql/test/experimental/semmle/python/templates/MakoSSTISinks.expected b/python/ql/test/experimental/semmle/python/templates/MakoSSTISinks.expected
@@ -1 +1,2 @@
+WARNING: Type SSTISink has been deprecated and may be removed in future (MakoSSTISinks.ql:4,6-14)
 | Mako.py:5:27:5:32 | argument to mako.template.Template() |
diff --git a/python/ql/test/experimental/semmle/python/templates/TRenderSSTISinks.expected b/python/ql/test/experimental/semmle/python/templates/TRenderSSTISinks.expected
@@ -1 +1,2 @@
+WARNING: Type SSTISink has been deprecated and may be removed in future (TRenderSSTISinks.ql:4,6-14)
 | TRender.py:6:24:6:31 | argument to trender.TRender() |

Original file line number	Diff line number	Diff line change
`@@ -21,11 +21,11 @@ import semmle.python.security.strings.Untrusted`
`21`	`21`	`class TemplateInjectionConfiguration extends TaintTracking::Configuration {`
`22`	`22`	`TemplateInjectionConfiguration() { this = "Template injection configuration" }`
`23`	`23`
`24`		`- override predicate isSource(TaintTracking::Source source) {`
	`24`	`+ deprecated override predicate isSource(TaintTracking::Source source) {`
`25`	`25`	`source instanceof HttpRequestTaintSource`
`26`	`26`	`}`
`27`	`27`
`28`		`- override predicate isSink(TaintTracking::Sink sink) { sink instanceof SSTISink }`
	`28`	`+ deprecated override predicate isSink(TaintTracking::Sink sink) { sink instanceof SSTISink }`
`29`	`29`	`}`
`30`	`30`
`31`	`31`	`from TemplateInjectionConfiguration config, TaintedPathSource src, TaintedPathSink sink`
Original file line number	Diff line number	Diff line change
`@@ -20,11 +20,11 @@ import experimental.semmle.python.security.injection.XSLT`
`20`	`20`	`class XSLTInjectionConfiguration extends TaintTracking::Configuration {`
`21`	`21`	`XSLTInjectionConfiguration() { this = "XSLT injection configuration" }`
`22`	`22`
`23`		`- override predicate isSource(TaintTracking::Source source) {`
	`23`	`+ deprecated override predicate isSource(TaintTracking::Source source) {`
`24`	`24`	`source instanceof HttpRequestTaintSource`
`25`	`25`	`}`
`26`	`26`
`27`		`- override predicate isSink(TaintTracking::Sink sink) {`
	`27`	`+ deprecated override predicate isSink(TaintTracking::Sink sink) {`
`28`	`28`	`sink instanceof XSLTInjection::XSLTInjectionSink`
`29`	`29`	`}`
`30`	`30`	`}`