github / github/codeql

Python: `FlaskApp` instances do not reliably track subclasses

未关闭
#21,854 1 条评论 0 个 reaction 已指派 0 人 在 GitHub 查看
Python question
主要语言
CodeQL
星标
10.1k
派生
2.1k
平均合并
2 天 15 小时
30 天内合并 PR
141

描述

I was running a set of queries on the [CTFd](https://github.com/CTFd/CTFd) repository, and got suspiciously few results for endpoints. After some experimenting I found out that [they subclass `Flask`](https://github.com/CTFd/CTFd/blob/master/CTFd/__init__.py#L51C1-L91C1), which the current query for `FlaskApp::instance()` does not seem to track.

# Minimal example:
Query:
```plaintext
import python

import semmle.python.frameworks.Flask
import semmle.python.ApiGraphs

from API::Node node
where Flask::FlaskApp::instance() = node
select node
```

Python:
```py
from flask import Flask

class Sub(Flask):
def __init__(self, *args, **kwargs):
Flask.__init__(self, *args, **kwargs)

app = Sub(__name__)

@app.route("/")
def hello():
return "world"
```

CodeQL is not able to identify `Sub` as a Flask app, which means the route setup for `hello` cannot be detected as well.

Adding `.getASubclass*()` to [FlaskApp::instance()](https://github.com/github/codeql/blob/main/python/ql/lib/semmle/python/frameworks/Flask.qll#L76C1-L76C64) would probably fix this. If this can be overridden without changes to the library I am open to suggestions, my knowledge of the QL modules is not that great as of now.

贡献指南

打开贡献指南

调研方向

Start in python/ql/lib/semmle/python/frameworks/Flask.qll at FlaskApp::instance(), then reproduce the minimal query and Python subclass example from the issue. Confirm that a Flask subclass is recognized as an app and that the route for hello is detected; add or update the relevant library coverage test if one is found nearby.

由索引模型根据 Issue 内容生成。

评估

技术栈
python
领域
security
Issue 类型
缺陷
难度
3/5
预计耗时
1-2 天
活跃度
冷清
描述清晰度
基本清楚
新手友好度
55/100

把新 issue 发到你的邮箱

精选适合新手参与的 GitHub issue 摘要。