Skip to content

Commit 52ceb7f

Browse files
Apply suggestions from code review
Co-authored-by: yoff <[email protected]>
1 parent 944f884 commit 52ceb7f

File tree

2 files changed

+21
-13
lines changed

2 files changed

+21
-13
lines changed

python/ql/lib/semmle/python/frameworks/Gradio.qll

Lines changed: 4 additions & 11 deletions
Original file line numberDiff line numberDiff line change
@@ -47,9 +47,7 @@ module Gradio {
4747
*/
4848
class GradioInputList extends RemoteFlowSource::Range {
4949
GradioInputList() {
50-
exists(API::CallNode call |
51-
call instanceof GradioInput
52-
and
50+
exists(GradioInput call |
5351
// limit only to lists of parameters given to `inputs`.
5452
(
5553
(
@@ -74,9 +72,7 @@ module Gradio {
7472
*/
7573
class GradioInputParameter extends RemoteFlowSource::Range {
7674
GradioInputParameter() {
77-
exists(API::CallNode call |
78-
call instanceof GradioInput
79-
and
75+
exists(GradioInput call |
8076
this = call.getParameter(0, "fn").getParameter(_).asSource() and
8177
// exclude lists of parameters given to `inputs`
8278
not call.getKeywordParameter("inputs").asSink().asCfgNode() instanceof ListNode and
@@ -92,8 +88,7 @@ module Gradio {
9288
*/
9389
class GradioInputDecorator extends RemoteFlowSource::Range {
9490
GradioInputDecorator() {
95-
exists(API::CallNode call |
96-
call instanceof GradioInput and
91+
exists(GradioInput call |
9792
this = call.getReturn().getACall().getParameter(0).getParameter(_).asSource()
9893
)
9994
}
@@ -106,9 +101,7 @@ module Gradio {
106101
*/
107102
private class ListTaintStep extends TaintTracking::AdditionalTaintStep {
108103
override predicate step(DataFlow::Node nodeFrom, DataFlow::Node nodeTo) {
109-
exists(API::CallNode node |
110-
node instanceof GradioInput
111-
and
104+
exists(GradioInput node |
112105
// handle cases where there are multiple arguments passed as a list to `inputs`
113106
(
114107
(
Lines changed: 17 additions & 2 deletions
Original file line numberDiff line numberDiff line change
@@ -1,5 +1,20 @@
11
import python
22
import semmle.python.dataflow.new.RemoteFlowSources
3+
import TestUtilities.InlineExpectationsTest
4+
private import semmle.python.dataflow.new.internal.PrintNode
35

4-
from RemoteFlowSource rfs
5-
select rfs
6+
module SourceTest implements TestSig {
7+
string getARelevantTag() { result = "source" }
8+
9+
predicate hasActualResult(Location location, string element, string tag, string value) {
10+
exists(location.getFile().getRelativePath()) and
11+
exists(RemoteFlowSource rfs |
12+
location = rfs.getLocation() and
13+
element = rfs.toString() and
14+
value = prettyNode(rfs) and
15+
tag = "source"
16+
)
17+
}
18+
}
19+
20+
import MakeTest<SourceTest>

0 commit comments

Comments
 (0)