Skip to content

Commit f22bd03

Browse files
committed
Python: Slight refactor of LxmlParsing
1 parent f5854f3 commit f22bd03

File tree

1 file changed

+5
-6
lines changed
  • python/ql/lib/semmle/python/frameworks

1 file changed

+5
-6
lines changed

python/ql/lib/semmle/python/frameworks/Lxml.qll

Lines changed: 5 additions & 6 deletions
Original file line numberDiff line numberDiff line change
@@ -235,12 +235,11 @@ private module Lxml {
235235
* - https://lxml.de/apidoc/lxml.etree.html?highlight=parseids#lxml.etree.parseid
236236
*/
237237
private class LxmlParsing extends DataFlow::CallCfgNode, XML::XmlParsing::Range {
238+
string functionName;
239+
238240
LxmlParsing() {
239-
this =
240-
API::moduleImport("lxml")
241-
.getMember("etree")
242-
.getMember(["fromstring", "fromstringlist", "XML", "XMLID", "parse", "parseid"])
243-
.getACall()
241+
functionName in ["fromstring", "fromstringlist", "XML", "XMLID", "parse", "parseid"] and
242+
this = API::moduleImport("lxml").getMember("etree").getMember(functionName).getACall()
244243
}
245244

246245
override DataFlow::Node getAnInput() {
@@ -287,7 +286,7 @@ private module Lxml {
287286
*/
288287
private class FileAccessFromLxmlParsing extends LxmlParsing, FileSystemAccess::Range {
289288
FileAccessFromLxmlParsing() {
290-
this = API::moduleImport("lxml").getMember("etree").getMember(["parse", "parseid"]).getACall()
289+
functionName in ["parse", "parseid"]
291290
// I considered whether we should try to reduce FPs from people passing file-like
292291
// objects, which will not be a file system access (and couldn't cause a
293292
// path-injection).

0 commit comments

Comments
 (0)