Skip to content

Commit 05ab6cd

Browse files
committed
Python: Add RemoteFlowSource for django handler without route
A bit scary that we don't have any tests to indicate that I forgot to add this :O
1 parent d4d6f0c commit 05ab6cd

File tree

1 file changed

+2
-0
lines changed

1 file changed

+2
-0
lines changed

python/ql/src/semmle/python/frameworks/Django.qll

Lines changed: 2 additions & 0 deletions
Original file line numberDiff line numberDiff line change
@@ -1909,6 +1909,8 @@ private module Django {
19091909
RemoteFlowSource::Range, DataFlow::ParameterNode {
19101910
DjangoRouteHandlerRequestParam() {
19111911
this.getParameter() = any(DjangoRouteSetup setup).getARequestHandler().getRequestParam()
1912+
or
1913+
this.getParameter() = any(DjangoViewClassHandlerWithoutKnownRoute setup).getRequestParam()
19121914
}
19131915

19141916
override string getSourceType() { result = "django.http.request.HttpRequest" }

0 commit comments

Comments
 (0)