Python: Add Tornado models

tausbn · RasmusWL · commit 1269a98d2beb · 2023-12-08T11:27:51.000+01:00
diff --git a/python/ql/lib/semmle/python/frameworks/Tornado.qll b/python/ql/lib/semmle/python/frameworks/Tornado.qll
@@ -218,7 +218,11 @@ module Tornado {
        */
       module Application {
         /** Gets a reference to the `tornado.web.Application` class. */
-        API::Node classRef() { result = web().getMember("Application") }
+        API::Node classRef() {
+          result = web().getMember("Application")
+          or
+          result = ModelOutput::getATypeNode("tornado.web.Application~Subclass").getASubclass*()
+        }
 
         /**
          * A source of instances of `tornado.web.Application`, extend this class to model new instances.
@@ -275,7 +279,12 @@ module Tornado {
        */
       module HttpServerRequest {
         /** Gets a reference to the `tornado.httputil.HttpServerRequest` class. */
-        API::Node classRef() { result = httputil().getMember("HttpServerRequest") }
+        API::Node classRef() {
+          result = httputil().getMember("HttpServerRequest")
+          or
+          result =
+            ModelOutput::getATypeNode("tornado.httputil.HttpServerRequest~Subclass").getASubclass*()
+        }
 
         /**
          * A source of instances of `tornado.httputil.HttpServerRequest`, extend this class to model new instances.
diff --git a/python/ql/src/meta/ClassHierarchy/Find.ql b/python/ql/src/meta/ClassHierarchy/Find.ql
@@ -25,6 +25,7 @@ private import semmle.python.frameworks.Multidict
 private import semmle.python.frameworks.Pycurl
 private import semmle.python.frameworks.RestFramework
 private import semmle.python.frameworks.SqlAlchemy
+private import semmle.python.frameworks.Tornado
 import semmle.python.frameworks.data.internal.ApiGraphModelsExtensions as Extensions
 
 class FlaskViewClasses extends FindSubclassesSpec {
@@ -380,6 +381,22 @@ class StringIO extends FindSubclassesSpec {
   override API::Node getAlreadyModeledClass() { result = StdlibPrivate::StringIO::classRef() }
 }
 
+class TornadoApplication extends FindSubclassesSpec {
+  TornadoApplication() { this = "tornado.web.Application~Subclass" }
+
+  override API::Node getAlreadyModeledClass() {
+    result = Tornado::TornadoModule::Web::Application::classRef()
+  }
+}
+
+class TornadoRequest extends FindSubclassesSpec {
+  TornadoRequest() { this = "tornado.httputil.HttpServerRequest~Subclass" }
+
+  override API::Node getAlreadyModeledClass() {
+    result = Tornado::TornadoModule::HttpUtil::HttpServerRequest::classRef()
+  }
+}
+
 bindingset[fullyQualified]
 predicate fullyQualifiedToYamlFormat(string fullyQualified, string type2, string path) {
   exists(int firstDot | firstDot = fullyQualified.indexOf(".", 0, 0) |
