change-notes

python/ql/lib/semmle/python/frameworks/FastApi.qll

@@ -36,6 +36,9 @@ module FastApi {
   private class AddMiddlewareCall extends DataFlow::CallCfgNode {
     AddMiddlewareCall() { this = App::instance().getMember("add_middleware").getACall() }
 
+    /**
+     * Gets the string corresponding to the middleware
+     */
     string middleware_name() { result = this.getArg(0).asExpr().(Name).toString() }
   }
 

python/ql/lib/semmle/python/frameworks/Starlette.qll

@@ -44,6 +44,9 @@ module Starlette {
       this = [App::instance().getMember("add_middleware").getACall(), Middleware::instance()]
     }
 
+    /**
+     * Gets the string corresponding to the middleware
+     */
     string middleware_name() { result = this.getArg(0).asExpr().(Name).toString() }
   }
 

python/ql/src/change-notes/2024-08-26-Cors-misconfiguration-middleware.md

@@ -0,0 +1,4 @@
+---
+category: newQuery
+---
+* The `py/insecure-cors-setting` query, which finds insecure CORS middleware configurations.