Python: Move SmtpMessageConfig to new dataflow API

RasmusWL · RasmusWL · commit 852b01c65da3 · 2023-08-28T15:31:08.000+02:00
diff --git a/python/ql/src/experimental/semmle/python/libraries/SmtpLib.qll b/python/ql/src/experimental/semmle/python/libraries/SmtpLib.qll
@@ -2,7 +2,7 @@ private import python
 private import semmle.python.dataflow.new.DataFlow
 private import experimental.semmle.python.Concepts
 private import semmle.python.ApiGraphs
-private import semmle.python.dataflow.new.TaintTracking2
+private import semmle.python.dataflow.new.TaintTracking
 
 module SmtpLib {
   /** Gets a reference to `smtplib.SMTP_SSL` */
@@ -31,16 +31,16 @@ module SmtpLib {
    * argument. Used because of the impossibility to get local source nodes from `_subparts`'
    * `(List|Tuple)` elements.
    */
-  private class SmtpMessageConfig extends TaintTracking2::Configuration {
-    SmtpMessageConfig() { this = "SMTPMessageConfig" }
+  private module SmtpMessageConfig implements DataFlow::ConfigSig {
+    predicate isSource(DataFlow::Node source) { source = mimeText(_) }
 
-    override predicate isSource(DataFlow::Node source) { source = mimeText(_) }
-
-    override predicate isSink(DataFlow::Node sink) {
+    predicate isSink(DataFlow::Node sink) {
       sink = smtpMimeMultipartInstance().getACall().getArgByName("_subparts")
     }
   }
 
+  module SmtpMessageFlow = TaintTracking::Global<SmtpMessageConfig>;
+
   /**
    * Using the `MimeText` call retrieves the content argument whose type argument equals `mimetype`.
    * This call flows into `MIMEMultipart`'s `_subparts` argument or the `.attach()` method call
@@ -87,8 +87,7 @@ module SmtpLib {
         sink =
           [sendCall.getArg(2), sendCall.getArg(2).(DataFlow::MethodCallNode).getObject()]
               .getALocalSource() and
-        any(SmtpMessageConfig a)
-            .hasFlow(source, sink.(DataFlow::CallCfgNode).getArgByName("_subparts"))
+        SmtpMessageFlow::flow(source, sink.(DataFlow::CallCfgNode).getArgByName("_subparts"))
         or
         // via .attach()
         sink = smtpMimeMultipartInstance().getReturn().getMember("attach").getACall() and
