hohn/codeql
1
0
Fork 0
mirror of https://github.com/github/codeql.git synced 2026-04-30 11:15:13 +02:00
Code Issues Packages Projects Releases Wiki Activity

Python: Don't allow getParameter(-1) for BoundMethodValue

Browse Source 
As per discussion in the PR
This commit is contained in:
Rasmus Wriedt Larsen
2020-05-05 11:37:10 +02:00
parent affca1a728
commit 07ae40206f
4 changed files with 13 additions and 8 deletions
Download Patch File Download Diff File Expand all files Collapse all files

12
python/ql/src/semmle/python/objects/Callables.qll
View File

@@ -438,10 +438,18 @@ class BoundMethodObjectInternal extends CallableObjectInternal, TBoundMethod {
PointsTo::pointsTo(result.getFunction(), ctx, this, _)
}
override NameNode getParameter(int n) { result = this.getFunction().getParameter(n + 1) }
/** Gets the parameter node that will be used for `self`. */
NameNode getSelfParameter() { result = this.getFunction().getParameter(0) }
override NameNode getParameter(int n) {
result = this.getFunction().getParameter(n + 1) and
// don't return the parameter for `self` at `n = -1`
n >= 0
}
override NameNode getParameterByName(string name) {
result = this.getFunction().getParameterByName(name)
result = this.getFunction().getParameterByName(name) and
not result = this.getSelfParameter()
}
override predicate neverReturns() { this.getFunction().neverReturns() }

3
python/ql/src/semmle/python/objects/ObjectAPI.qll
View File

@@ -454,6 +454,9 @@ class BoundMethodValue extends CallableValue {
* The value for `o` in `o.func`.
*/
Value getSelf() { result = this.(BoundMethodObjectInternal).getSelf() }
/** Gets the parameter node that will be used for `self`. */
NameNode getSelfParameter() { result = this.(BoundMethodObjectInternal).getSelfParameter() }
}
/**

3
python/ql/test/library-tests/PointsTo/calls/getParameter.expected
View File

@@ -5,9 +5,6 @@
| Function f | 1 | ControlFlowNode for arg1 |
| Function f | 2 | ControlFlowNode for arg2 |
| Method(Function C.n, C()) | 0 | ControlFlowNode for arg1 |
| Method(Function C.n, C()) | -1 | ControlFlowNode for self |
| Method(Function C.n, class C) | 0 | ControlFlowNode for arg1 |
| Method(Function C.n, class C) | -1 | ControlFlowNode for self |
| Method(Function f, C()) | 0 | ControlFlowNode for arg1 |
| Method(Function f, C()) | 1 | ControlFlowNode for arg2 |
| Method(Function f, C()) | -1 | ControlFlowNode for arg0 |

3
python/ql/test/library-tests/PointsTo/calls/getParameterByName.expected
View File

@@ -5,9 +5,6 @@
| Function f | arg1 | ControlFlowNode for arg1 |
| Function f | arg2 | ControlFlowNode for arg2 |
| Method(Function C.n, C()) | arg1 | ControlFlowNode for arg1 |
| Method(Function C.n, C()) | self | ControlFlowNode for self |
| Method(Function C.n, class C) | arg1 | ControlFlowNode for arg1 |
| Method(Function C.n, class C) | self | ControlFlowNode for self |
| Method(Function f, C()) | arg0 | ControlFlowNode for arg0 |
| Method(Function f, C()) | arg1 | ControlFlowNode for arg1 |
| Method(Function f, C()) | arg2 | ControlFlowNode for arg2 |