Skip to content

Commit a31bf75

Browse files
committed
Python: Refactor pickle.loads() modeling
1 parent 2539e32 commit a31bf75

File tree

1 file changed

+3
-11
lines changed

1 file changed

+3
-11
lines changed

python/ql/lib/semmle/python/frameworks/Stdlib.qll

Lines changed: 3 additions & 11 deletions
Original file line numberDiff line numberDiff line change
@@ -447,23 +447,15 @@ private module StdlibPrivate {
447447
// ---------------------------------------------------------------------------
448448
// pickle
449449
// ---------------------------------------------------------------------------
450-
/** Gets a reference to the `pickle` module. */
451-
DataFlow::Node pickle() { result = API::moduleImport(["pickle", "cPickle", "_pickle"]).getAUse() }
452-
453-
/** Provides models for the `pickle` module. */
454-
module pickle {
455-
/** Gets a reference to the `pickle.loads` function. */
456-
DataFlow::Node loads() {
457-
result = API::moduleImport(["pickle", "cPickle", "_pickle"]).getMember("loads").getAUse()
458-
}
459-
}
450+
/** Gets a reference to any of the `pickle` modules. */
451+
API::Node pickle() { result = API::moduleImport(["pickle", "cPickle", "_pickle"]) }
460452

461453
/**
462454
* A call to `pickle.loads`
463455
* See https://docs.python.org/3/library/pickle.html#pickle.loads
464456
*/
465457
private class PickleLoadsCall extends Decoding::Range, DataFlow::CallCfgNode {
466-
PickleLoadsCall() { this.getFunction() = pickle::loads() }
458+
PickleLoadsCall() { this = pickle().getMember("loads").getACall() }
467459

468460
override predicate mayExecuteInput() { any() }
469461

0 commit comments

Comments
 (0)