Python: Add file-like modeling to werkzeug FileStorage

Author: RasmusWL

python/ql/src/semmle/python/frameworks/Werkzeug.qll

@@ -9,6 +9,7 @@ private import python
 private import semmle.python.dataflow.new.DataFlow
 private import semmle.python.dataflow.new.TaintTracking
 private import semmle.python.ApiGraphs
+private import semmle.python.frameworks.Stdlib
 
 /**
  * Provides models for the `Werkzeug` PyPI package.
@@ -107,6 +108,21 @@ module Werkzeug {
             )
           }
         }
+
+        /** A file-like object instance that originates from a `FileStorage`. */
+        class FileStorageFileLikeInstances extends Stdlib::FileLikeObject::InstanceSource {
+          FileStorageFileLikeInstances() {
+            this.(DataFlow::AttrRead).accesses(instance(), "stream")
+            or
+            // All the attributes of the wrapper stream are proxied by the file storage
+            // so it’s possible to do storage.read() instead of the long form
+            // storage.stream.read().
+            //
+            // due to the `InstanceSourceApiNode` stuff, we can't just make
+            // `InstanceSource` extend `Stdlib::FileLikeObject::InstanceSource`
+            this = any(InstanceSourceApiNode api).getAnImmediateUse()
+          }
+        }
       }
     }
   }

python/ql/test/library-tests/frameworks/flask/taint_test.py

@@ -70,6 +70,8 @@ def test_taint(name = "World!", number="0", foo="foo"):  # $requestHandler route
         request.files['key'], # $ tainted
         request.files['key'].filename, # $ MISSING: tainted
         request.files['key'].stream, # $ MISSING: tainted
+        request.files['key'].read(), # $ MISSING: tainted
+        request.files['key'].stream.read(), # $ MISSING: tainted
         request.files.get('key'), # $ tainted
         request.files.get('key').filename, # $ MISSING: tainted
         request.files.get('key').stream, # $ MISSING: tainted