Skip to content

Commit e32f8d9

Browse files
committed
Python: Always import ORM steps for data-flow
For C#, see https://github.com/github/codeql/blob/fdd787b89ced5c47362ebbc0156455f6e8d4dfdb/csharp/ql/lib/semmle/code/csharp/dataflow/internal/DataFlowPrivate.qll#L16 that import EntityFramework, which is ORM library.
1 parent 8afd560 commit e32f8d9

File tree

1 file changed

+11
-0
lines changed

1 file changed

+11
-0
lines changed

python/ql/lib/semmle/python/dataflow/new/internal/DataFlowPrivate.qll

Lines changed: 11 additions & 0 deletions
Original file line numberDiff line numberDiff line change
@@ -4,6 +4,17 @@ import semmle.python.SpecialMethods
44
private import semmle.python.essa.SsaCompute
55
private import semmle.python.dataflow.new.internal.ImportStar
66

7+
// Since we allow extra data-flow steps from modeled frameworks, we import these
8+
// up-front, to ensure these are included. This provides a more seamless experience from
9+
// a user point of view, since they don't need to know they need to import a specific
10+
// set of .qll files to get the same data-flow steps as they are used to seeing. This
11+
// also ensures that we don't end up re-evaluating data-flow because it has different
12+
// global steps in some configurations.
13+
//
14+
// This matches behavior in C#.
15+
private import semmle.python.Frameworks
16+
private import semmle.python.Concepts
17+
718
/** Gets the callable in which this node occurs. */
819
DataFlowCallable nodeGetEnclosingCallable(Node n) { result = n.getEnclosingCallable() }
920

0 commit comments

Comments
 (0)