hohn/codeql
1
0
Fork 0
mirror of https://github.com/github/codeql.git synced 2025-12-18 18:10:39 +01:00
Code Issues Packages Projects Releases Wiki Activity

Python: Use API graphs for io.open

Browse Source
This commit is contained in:
Rasmus Wriedt Larsen
2021-03-17 15:11:09 +01:00
parent d52d328587
commit 27032af2eb
1 changed files with 2 additions and 54 deletions
Download Patch File Download Diff File Expand all files Collapse all files

56
python/ql/src/semmle/python/frameworks/Stdlib.qll
View File

@@ -726,7 +726,8 @@ private module Stdlib {
OpenCall() {
this = API::builtin("open").getACall()
or
this.getFunction() = io_attr("open")
// io.open is a special case, since it is an alias for the builtin `open`
this = API::moduleImport("io").getMember("open").getACall()
}
override DataFlow::Node getAPathArgument() {
@@ -880,59 +881,6 @@ private module Stdlib {
}
}
// ---------------------------------------------------------------------------
// io
// ---------------------------------------------------------------------------
/** Gets a reference to the `io` module. */
private DataFlow::Node io(DataFlow::TypeTracker t) {
t.start() and
result = DataFlow::importNode("io")
or
exists(DataFlow::TypeTracker t2 | result = io(t2).track(t2, t))
}
/** Gets a reference to the `io` module. */
DataFlow::Node io() { result = io(DataFlow::TypeTracker::end()) }
/**
* Gets a reference to the attribute `attr_name` of the `io` module.
* WARNING: Only holds for a few predefined attributes.
*/
private DataFlow::Node io_attr(DataFlow::TypeTracker t, string attr_name) {
attr_name in ["open"] and
(
t.start() and
result = DataFlow::importNode("io" + "." + attr_name)
or
t.startInAttr(attr_name) and
result = io()
)
or
// Due to bad performance when using normal setup with `io_attr(t2, attr_name).track(t2, t)`
// we have inlined that code and forced a join
exists(DataFlow::TypeTracker t2 |
exists(DataFlow::StepSummary summary |
io_attr_first_join(t2, attr_name, result, summary) and
t = t2.append(summary)
)
)
}
pragma[nomagic]
private predicate io_attr_first_join(
DataFlow::TypeTracker t2, string attr_name, DataFlow::Node res, DataFlow::StepSummary summary
) {
DataFlow::StepSummary::step(io_attr(t2, attr_name), res, summary)
}
/**
* Gets a reference to the attribute `attr_name` of the `io` module.
* WARNING: Only holds for a few predefined attributes.
*/
private DataFlow::Node io_attr(string attr_name) {
result = io_attr(DataFlow::TypeTracker::end(), attr_name)
}
// ---------------------------------------------------------------------------
// json
// ---------------------------------------------------------------------------