Skip to content

Commit 6f0a622

Browse files
committed
Python: Remove ClassInstantiation from Django UploadedFile
since UploadedFile is the abstract base class, all real usage would be of one of the subclasses, so removing this to not provide a false hope that it actually works. I don't think investing the time into making this work would give any value, so that's why I didn't do it ;)
1 parent 7dc6518 commit 6f0a622

File tree

1 file changed

+0
-17
lines changed

1 file changed

+0
-17
lines changed

python/ql/src/semmle/python/frameworks/Django.qll

Lines changed: 0 additions & 17 deletions
Original file line numberDiff line numberDiff line change
@@ -369,16 +369,6 @@ private module Django {
369369
* See https://docs.djangoproject.com/en/3.0/ref/files/uploads/#django.core.files.uploadedfile.UploadedFile.
370370
*/
371371
module UploadedFile {
372-
/** Gets a reference to the `django.core.files.uploadedfile.UploadedFile` class. */
373-
private API::Node classRef() {
374-
result =
375-
API::moduleImport("django")
376-
.getMember("core")
377-
.getMember("files")
378-
.getMember("uploadedfile")
379-
.getMember("UploadedFile")
380-
}
381-
382372
/**
383373
* A source of instances of `django.core.files.uploadedfile.UploadedFile`, extend this class to model new instances.
384374
*
@@ -390,13 +380,6 @@ private module Django {
390380
*/
391381
abstract class InstanceSource extends DataFlow::LocalSourceNode { }
392382

393-
/** A direct instantiation of `django.core.files.uploadedfile.UploadedFile`. */
394-
private class ClassInstantiation extends InstanceSource, DataFlow::CallCfgNode {
395-
override CallNode node;
396-
397-
ClassInstantiation() { this = classRef().getACall() }
398-
}
399-
400383
/** Gets a reference to an instance of `django.core.files.uploadedfile.UploadedFile`. */
401384
private DataFlow::TypeTrackingNode instance(DataFlow::TypeTracker t) {
402385
t.start() and

0 commit comments

Comments
 (0)