fix: use instance case

rules/python/django/insecure_cookie.yml

@@ -1,11 +1,12 @@
 imports:
   - python_shared_django_http_response
+  - python_shared_lang_instance
 patterns:
   - pattern: |
       $<RESPONSE>.set_cookie($<...>secure=$<FALSE>$<...>)
     filters:
       - variable: RESPONSE
-        detection: python_shared_django_http_response
+        detection: python_django_insecure_cookie_http_response_instance
         scope: cursor
       - variable: "FALSE"
         detection: python_django_insecure_cookie_false
@@ -14,6 +15,17 @@ auxiliary:
   - id: python_django_insecure_cookie_false
     patterns:
       - "False"
+  - id: python_django_insecure_cookie_http_response_instance
+    patterns:
+      - pattern: $<HTTP_RESPONSE>
+        filters:
+          - variable: HTTP_RESPONSE
+            detection: python_shared_lang_instance
+            scope: cursor_strict
+            filters:
+              - variable: CLASS
+                detection: python_shared_django_http_response
+                scope: cursor
 languages:
   - python
 severity: medium

tests/python/django/insecure_cookie/testdata/main.py

@@ -1,8 +1,13 @@
+from django.http import HttpResponse
+
 def bad():
+  response = HttpResponse()
   # bearer:expected python_django_insecure_cookie
-  HttpResponse.set_cookie("foo", "bar", max_age=None, secure=False, httponly=False)
+  response.set_cookie("foo", "bar", max_age=None, secure=False, httponly=False)
 
 def ok(): 
-  HttpResponse.set_cookie("foo", "bar")
+  response = HttpResponse()
+
+  response.set_cookie("foo", "bar")
   # still bad but not for this rule
-  HttpResponse.set_cookie("foo", "bar", max_age=None, secure=True, httponly=False)
+  response.set_cookie("foo", "bar", max_age=None, secure=True, httponly=False)