github / github/codeql

Python: `FlaskApp` instances do not reliably track subclasses

Open
#21,854 1 comment 0 reactions 0 assignees View on GitHub
Python question
Dominant language
CodeQL
Stars
10.1k
Forks
2.1k
Avg merge
2d 15h
Merged PRs (30d)
141

Description

I was running a set of queries on the [CTFd](https://github.com/CTFd/CTFd) repository, and got suspiciously few results for endpoints. After some experimenting I found out that [they subclass `Flask`](https://github.com/CTFd/CTFd/blob/master/CTFd/__init__.py#L51C1-L91C1), which the current query for `FlaskApp::instance()` does not seem to track.

# Minimal example:
Query:
```plaintext
import python

import semmle.python.frameworks.Flask
import semmle.python.ApiGraphs

from API::Node node
where Flask::FlaskApp::instance() = node
select node
```

Python:
```py
from flask import Flask

class Sub(Flask):
def __init__(self, *args, **kwargs):
Flask.__init__(self, *args, **kwargs)

app = Sub(__name__)

@app.route("/")
def hello():
return "world"
```

CodeQL is not able to identify `Sub` as a Flask app, which means the route setup for `hello` cannot be detected as well.

Adding `.getASubclass*()` to [FlaskApp::instance()](https://github.com/github/codeql/blob/main/python/ql/lib/semmle/python/frameworks/Flask.qll#L76C1-L76C64) would probably fix this. If this can be overridden without changes to the library I am open to suggestions, my knowledge of the QL modules is not that great as of now.

Contributor guide

Open the contributing guide

Research direction

Start in python/ql/lib/semmle/python/frameworks/Flask.qll at FlaskApp::instance(), then reproduce the minimal query and Python subclass example from the issue. Confirm that a Flask subclass is recognized as an app and that the route for hello is detected; add or update the relevant library coverage test if one is found nearby.

Written by the indexing model from the issue text.

Assessment

Tech stack
python
Domain
security
Issue type
Bug
Difficulty
3/5
Estimated time
1-2 days
Activity status
Quiet
Clarity
Mostly clear
Newbie friendliness
55/100

Get new issues in your inbox

A short digest of beginner-friendly GitHub issues.