Skip to content

Commit a05266c

Browse files
Formatting
1 parent 358a1b3 commit a05266c

File tree

1 file changed

+34
-24
lines changed

1 file changed

+34
-24
lines changed

python/ql/lib/semmle/python/frameworks/Streamlit.qll

Lines changed: 34 additions & 24 deletions
Original file line numberDiff line numberDiff line change
@@ -3,35 +3,45 @@
33
* See https://pypi.org/project/streamlit/.
44
*/
55

6-
import python
7-
import semmle.python.dataflow.new.RemoteFlowSources
8-
import semmle.python.dataflow.new.TaintTracking
9-
import semmle.python.ApiGraphs
10-
import semmle.python.Concepts
6+
import python
7+
import semmle.python.dataflow.new.RemoteFlowSources
8+
import semmle.python.dataflow.new.TaintTracking
9+
import semmle.python.ApiGraphs
10+
import semmle.python.Concepts
1111

12-
13-
/**
12+
/**
1413
* Provides models for the `gradio` PyPI package.
1514
* See https://pypi.org/project/gradio/.
1615
*/
1716
module Streamlit {
18-
/**
19-
* The calls to the interactive streamlit widgets, which take untrusted input.
20-
*/
21-
private class StreamlitInput extends RemoteFlowSource::Range {
22-
StreamlitInput() { this = API::moduleImport("streamlit").getMember(["text_input", "text_area", "chat_input"]).getACall() }
23-
override string getSourceType() { result = "Streamlit user input" }
24-
}
17+
/**
18+
* The calls to the interactive streamlit widgets, which take untrusted input.
19+
*/
20+
private class StreamlitInput extends RemoteFlowSource::Range {
21+
StreamlitInput() {
22+
this =
23+
API::moduleImport("streamlit")
24+
.getMember(["text_input", "text_area", "chat_input"])
25+
.getACall()
26+
}
27+
28+
override string getSourceType() { result = "Streamlit user input" }
29+
}
2530

26-
/**
27-
* The `query` call that can execute raw queries on a connection to a SQL/Sonwflake/Snowpark database.
28-
* https://docs.streamlit.io/develop/api-reference/connections/st.connection
29-
*/
30-
private class QueryMethodCall extends DataFlow::CallCfgNode, SqlExecution::Range {
31-
QueryMethodCall() {
32-
this = API::moduleImport("streamlit").getMember("connection").getReturn().getMember("query").getACall()
33-
}
34-
override DataFlow::Node getSql() { result in [this.getArg(0), this.getArgByName("sql")] }
35-
}
31+
/**
32+
* The `query` call that can execute raw queries on a connection to a SQL/Sonwflake/Snowpark database.
33+
* https://docs.streamlit.io/develop/api-reference/connections/st.connection
34+
*/
35+
private class QueryMethodCall extends DataFlow::CallCfgNode, SqlExecution::Range {
36+
QueryMethodCall() {
37+
this =
38+
API::moduleImport("streamlit")
39+
.getMember("connection")
40+
.getReturn()
41+
.getMember("query")
42+
.getACall()
43+
}
3644

45+
override DataFlow::Node getSql() { result in [this.getArg(0), this.getArgByName("sql")] }
46+
}
3747
}

0 commit comments

Comments
 (0)