Python: Expose HTTP verbs in HTTP concept

Let's discuss whether doing it this way is reasonable, since I'm not 100% sure
whether this fits into "concepts" or not.

Author: RasmusWL

python/ql/src/semmle/python/Concepts.qll

@@ -295,6 +295,8 @@ module SqlExecution {
 
 /** Provides classes for modeling HTTP-related APIs. */
 module HTTP {
+  import semmle.python.web.HttpConstants
+
   /** Provides classes for modeling HTTP servers. */
   module Server {
     /**

python/ql/src/semmle/python/frameworks/Django.qll

@@ -1680,8 +1680,7 @@ private module Django {
       // TODO: This doesn't handle attribute assignment. Should be OK, but analysis is not as complete as with
       // points-to and `.lookup`, which would handle `post = my_post_handler` inside class def
       result = this.getAMethod() and
-      // TODO: Add HTTP verbs
-      result.getName() in ["post", "get"]
+      result.getName() = HTTP::httpVerbLower()
     }
 
     /** Gets a reference to this class. */

python/ql/src/semmle/python/web/HttpConstants.qll

@@ -1,4 +1,4 @@
-/** Gets an http verb */
+/** Gets an HTTP verb */
 string httpVerb() {
   result = "GET" or
   result = "POST" or
@@ -9,5 +9,5 @@ string httpVerb() {
   result = "HEAD"
 }
 
-/** Gets an http verb, in lower case */
+/** Gets an HTTP verb, in lower case */
 string httpVerbLower() { result = httpVerb().toLowerCase() }