Merge pull request #7033 from RasmusWL/flask-admin

Author: tausbn

docs/codeql/support/reusables/frameworks.rst

@@ -168,6 +168,7 @@ Python built-in support
    Flask, Web framework
    Tornado, Web framework
    Twisted, Web framework
+   Flask-Admin, Web framework
    starlette, Asynchronous Server Gateway Interface (ASGI)
    dill, Serialization
    PyYAML, Serialization

python/change-notes/2021-11-02-flask_admin.md

@@ -0,0 +1,2 @@
+lgtm,codescanning
+* Added modeling of HTTP requests and responses when using `flask_admin` (`Flask-Admin` PyPI package), which leads to additional remote flow sources.

python/ql/lib/semmle/python/Frameworks.qll

@@ -17,6 +17,7 @@ private import semmle.python.frameworks.Django
 private import semmle.python.frameworks.Fabric
 private import semmle.python.frameworks.FastApi
 private import semmle.python.frameworks.Flask
+private import semmle.python.frameworks.FlaskAdmin
 private import semmle.python.frameworks.FlaskSqlAlchemy
 private import semmle.python.frameworks.Idna
 private import semmle.python.frameworks.Invoke

python/ql/lib/semmle/python/frameworks/Flask.qll

@@ -238,7 +238,7 @@ module Flask {
   }
 
   /** A route setup made by flask (sharing handling of URL patterns). */
-  abstract private class FlaskRouteSetup extends HTTP::Server::RouteSetup::Range {
+  abstract class FlaskRouteSetup extends HTTP::Server::RouteSetup::Range {
     override Parameter getARoutedParameter() {
       // If we don't know the URL pattern, we simply mark all parameters as a routed
       // parameter. This should give us more RemoteFlowSources but could also lead to

python/ql/lib/semmle/python/frameworks/FlaskAdmin.qll

@@ -0,0 +1,79 @@
+/**
+ * Provides classes modeling security-relevant aspects of the `Flask-Admin` PyPI package
+ * (imported as `flask_admin`).
+ *
+ * See
+ * - https://flask-admin.readthedocs.io/en/latest/
+ * - https://pypi.org/project/Flask-Admin/
+ */
+
+private import python
+private import semmle.python.dataflow.new.DataFlow
+private import semmle.python.dataflow.new.RemoteFlowSources
+private import semmle.python.dataflow.new.TaintTracking
+private import semmle.python.Concepts
+private import semmle.python.frameworks.Flask
+private import semmle.python.ApiGraphs
+
+/**
+ * Provides models for the `Flask-Admin` PyPI package (imported as `flask_admin`).
+ *
+ * See
+ * - https://flask-admin.readthedocs.io/en/latest/
+ * - https://pypi.org/project/Flask-Admin/
+ */
+private module FlaskAdmin {
+  /**
+   * A call to `flask_admin.expose`, which is used as a decorator to make the
+   * function exposed in the admin interface (and make it a request handler)
+   *
+   * See https://flask-admin.readthedocs.io/en/latest/api/mod_base/#flask_admin.base.expose
+   */
+  private class FlaskAdminExposeCall extends Flask::FlaskRouteSetup, DataFlow::CallCfgNode {
+    FlaskAdminExposeCall() {
+      this = API::moduleImport("flask_admin").getMember("expose").getACall()
+    }
+
+    override DataFlow::Node getUrlPatternArg() {
+      result in [this.getArg(0), this.getArgByName("url")]
+    }
+
+    override Function getARequestHandler() { result.getADecorator().getAFlowNode() = node }
+  }
+
+  /**
+   * A call to `flask_admin.expose_plugview`, which is used as a decorator to make the
+   * class (which we expect to be a flask View class) exposed in the admin interface.
+   *
+   * See https://flask-admin.readthedocs.io/en/latest/api/mod_base/#flask_admin.base.expose_plugview
+   */
+  private class FlaskAdminExposePlugviewCall extends Flask::FlaskRouteSetup, DataFlow::CallCfgNode {
+    FlaskAdminExposePlugviewCall() {
+      this = API::moduleImport("flask_admin").getMember("expose_plugview").getACall()
+    }
+
+    override DataFlow::Node getUrlPatternArg() {
+      result in [this.getArg(0), this.getArgByName("url")]
+    }
+
+    override Parameter getARoutedParameter() {
+      result = super.getARoutedParameter() and
+      (
+        exists(this.getUrlPattern())
+        or
+        // the first argument is `self`, and the second argument `cls` will receive the
+        // containing flask_admin View class -- this is only relevant if the URL pattern
+        // is not known
+        not exists(this.getUrlPattern()) and
+        not result = this.getARequestHandler().getArg([0, 1])
+      )
+    }
+
+    override Function getARequestHandler() {
+      exists(Flask::FlaskViewClass cls |
+        cls.getADecorator().getAFlowNode() = node and
+        result = cls.getARequestHandler()
+      )
+    }
+  }
+}

python/ql/src/meta/alerts/RequestHandlers.ql

@@ -0,0 +1,23 @@
+/**
+ * @name Request Handlers
+ * @description HTTP Server Request Handlers
+ * @kind problem
+ * @problem.severity recommendation
+ * @id py/meta/alerts/request-handlers
+ * @tags meta
+ * @precision very-low
+ */
+
+private import python
+private import semmle.python.dataflow.new.DataFlow
+private import semmle.python.Concepts
+private import meta.MetaMetrics
+
+from HTTP::Server::RequestHandler requestHandler, string title
+where
+  not requestHandler.getLocation().getFile() instanceof IgnoredFile and
+  if requestHandler.isMethod()
+  then
+    title = "Method " + requestHandler.getScope().(Class).getName() + "." + requestHandler.getName()
+  else title = requestHandler.toString()
+select requestHandler, "RequestHandler: " + title

python/ql/test/library-tests/frameworks/flask_admin/ConceptsTest.expected

@@ -0,0 +1,12 @@
+import python
+import experimental.meta.ConceptsTest
+
+class DedicatedResponseTest extends HttpServerHttpResponseTest {
+  DedicatedResponseTest() { file.getShortName() = "response_test.py" }
+}
+
+class OtherResponseTest extends HttpServerHttpResponseTest {
+  OtherResponseTest() { not this instanceof DedicatedResponseTest }
+
+  override string getARelevantTag() { result = "HttpResponse" }
+}

python/ql/test/library-tests/frameworks/flask_admin/ConceptsTest.ql

@@ -0,0 +1,3 @@
+argumentToEnsureNotTaintedNotMarkedAsSpurious
+untaintedArgumentToEnsureTaintedNotMarkedAsMissing
+failures

python/ql/test/library-tests/frameworks/flask_admin/InlineTaintTest.expected

@@ -0,0 +1 @@
+import experimental.meta.InlineTaintTest