|
3 | 3 | * See https://pypi.org/project/streamlit/.
|
4 | 4 | */
|
5 | 5 |
|
6 |
| - import python |
7 |
| - import semmle.python.dataflow.new.RemoteFlowSources |
8 |
| - import semmle.python.dataflow.new.TaintTracking |
9 |
| - import semmle.python.ApiGraphs |
10 |
| - import semmle.python.Concepts |
| 6 | +import python |
| 7 | +import semmle.python.dataflow.new.RemoteFlowSources |
| 8 | +import semmle.python.dataflow.new.TaintTracking |
| 9 | +import semmle.python.ApiGraphs |
| 10 | +import semmle.python.Concepts |
11 | 11 |
|
12 |
| - |
13 |
| - /** |
| 12 | +/** |
14 | 13 | * Provides models for the `gradio` PyPI package.
|
15 | 14 | * See https://pypi.org/project/gradio/.
|
16 | 15 | */
|
17 | 16 | module Streamlit {
|
18 |
| - /** |
19 |
| - * The calls to the interactive streamlit widgets, which take untrusted input. |
20 |
| - */ |
21 |
| - private class StreamlitInput extends RemoteFlowSource::Range { |
22 |
| - StreamlitInput() { this = API::moduleImport("streamlit").getMember(["text_input", "text_area", "chat_input"]).getACall() } |
23 |
| - override string getSourceType() { result = "Streamlit user input" } |
24 |
| - } |
| 17 | + /** |
| 18 | + * The calls to the interactive streamlit widgets, which take untrusted input. |
| 19 | + */ |
| 20 | + private class StreamlitInput extends RemoteFlowSource::Range { |
| 21 | + StreamlitInput() { |
| 22 | + this = |
| 23 | + API::moduleImport("streamlit") |
| 24 | + .getMember(["text_input", "text_area", "chat_input"]) |
| 25 | + .getACall() |
| 26 | + } |
| 27 | + |
| 28 | + override string getSourceType() { result = "Streamlit user input" } |
| 29 | + } |
25 | 30 |
|
26 |
| - /** |
27 |
| - * The `query` call that can execute raw queries on a connection to a SQL/Sonwflake/Snowpark database. |
28 |
| - * https://docs.streamlit.io/develop/api-reference/connections/st.connection |
29 |
| - */ |
30 |
| - private class QueryMethodCall extends DataFlow::CallCfgNode, SqlExecution::Range { |
31 |
| - QueryMethodCall() { |
32 |
| - this = API::moduleImport("streamlit").getMember("connection").getReturn().getMember("query").getACall() |
33 |
| - } |
34 |
| - override DataFlow::Node getSql() { result in [this.getArg(0), this.getArgByName("sql")] } |
35 |
| - } |
| 31 | + /** |
| 32 | + * The `query` call that can execute raw queries on a connection to a SQL/Sonwflake/Snowpark database. |
| 33 | + * https://docs.streamlit.io/develop/api-reference/connections/st.connection |
| 34 | + */ |
| 35 | + private class QueryMethodCall extends DataFlow::CallCfgNode, SqlExecution::Range { |
| 36 | + QueryMethodCall() { |
| 37 | + this = |
| 38 | + API::moduleImport("streamlit") |
| 39 | + .getMember("connection") |
| 40 | + .getReturn() |
| 41 | + .getMember("query") |
| 42 | + .getACall() |
| 43 | + } |
36 | 44 |
|
| 45 | + override DataFlow::Node getSql() { result in [this.getArg(0), this.getArgByName("sql")] } |
| 46 | + } |
37 | 47 | }
|
0 commit comments