Skip to content

Commit de69e4c

Browse files
committed
Python: Expand on SubclassFinder implementation note
1 parent f7b5332 commit de69e4c

File tree

1 file changed

+21
-15
lines changed

1 file changed

+21
-15
lines changed

python/ql/lib/semmle/python/frameworks/internal/SubclassFinder.qll

Lines changed: 21 additions & 15 deletions
Original file line numberDiff line numberDiff line change
@@ -42,24 +42,30 @@ private module NotExposed {
4242
// Implementation below
4343
// ---------------------------------------------------------------------------
4444
//
45-
// inherent problem with API graphs is that there doesn't need to exist a result for
46-
// all the stuff we have already modeled... as an example, the following query has no
47-
// results when evaluated against a django/django DB
45+
// We are looking to find all subclassed of the already modelled classes, and ideally
46+
// we would identify an `API::Node` for each (then `toString` would give the API
47+
// path).
4848
//
49-
// select API::moduleImport("django")
50-
// .getMember("contrib")
51-
// .getMember("admin")
52-
// .getMember("views")
53-
// .getMember("main")
54-
// .getMember("ChangeListSearchForm")
49+
// An inherent problem with API graphs is that there doesn't need to exist a result
50+
// for the API graph path that we want to add to our modeling (the path to the new
51+
// subclass). As an example, the following query has no results when evaluated against
52+
// a django/django DB.
5553
//
56-
// therefore we use fully qualified names to capture new classes/new aliases.
54+
// select API::moduleImport("django") .getMember("contrib") .getMember("admin")
55+
// .getMember("views") .getMember("main") .getMember("ChangeListSearchForm")
5756
//
58-
// note that this implementation was originally created to help with automatically
59-
// modeling packages in mind, and was just copied for this purpose. See
60-
// https://github.com/github/codeql/pull/5632 for more discussion. I wanted to get
61-
// this into the codeql-repo, so it could be of use when modeling 3rd party libraries,
62-
// and save some manual effort.
57+
//
58+
// Since it is a Form subclass that we would want to capture for our Django modeling,
59+
// we want to extend our modeling (that is written in a qll file) with exactly that
60+
// piece of code, but since the API::Node doesn't exist, we can't select that from a
61+
// predicate and print its path. We need a different approach, and for that we use
62+
// fully qualified names to capture new classes/new aliases, and transform these into
63+
// API paths (to be included in the modeling that is inserted into the `.qll` files),
64+
// see `fullyQualifiedToAPIGraphPath`.
65+
//
66+
// NOTE: this implementation was originally created to help with automatically
67+
// modeling packages in mind, and has been adjusted to help with manual library
68+
// modeling. See https://github.com/github/codeql/pull/5632 for more discussion.
6369
//
6470
//
6571
bindingset[fullyQaulified]

0 commit comments

Comments
 (0)