hohn/codeql
1
0
Fork 0
mirror of https://github.com/github/codeql.git synced 2026-04-30 19:26:02 +02:00
Code Issues Packages Projects Releases Wiki Activity

Merge pull request #2922 from tausbn/python-fix-multi-assign-points-to

Browse Source 
Python: Fix bug in `multi_assignment_points_to`.
This commit is contained in:
Rasmus Wriedt Larsen
2020-03-18 17:50:37 +01:00
committed by GitHub
parent b0303158a5 c724b17368
commit 290e33a912
16 changed files with 105 additions and 8 deletions
Download Patch File Download Diff File Expand all files Collapse all files

1
python/ql/src/semmle/python/essa/Essa.qll
View File

@@ -608,6 +608,7 @@ class MultiAssignmentDefinition extends EssaNodeDefinition {
)
}
/** Holds if `this` has (zero-based) index `index` in `lhs`. */
predicate indexOf(int index, SequenceNode lhs) {
SsaSource::multi_assignment_definition(this.getSourceVariable(), this.getDefiningNode(), index, lhs)
}

19
python/ql/src/semmle/python/pointsto/PointsTo.qll
View File

@@ -506,12 +506,21 @@ cached module PointsToInternal {
value = sequence.getItem(index)
}
pragma [noinline]
private predicate multi_assignment_points_to(MultiAssignmentDefinition def, PointsToContext context, ObjectInternal value, ControlFlowNode origin) {
exists(int index, ControlFlowNode rhs, SequenceObjectInternal sequence |
def.indexOf(index, rhs) and
sequence_index_points_to(rhs, context, sequence, value, index) and
pragma[noinline]
private predicate multi_assignment_points_to(
MultiAssignmentDefinition def, PointsToContext context, ObjectInternal value,
ControlFlowNode origin
) {
exists(int index, ControlFlowNode lhs, ControlFlowNode rhs, ObjectInternal sequence |
def.indexOf(index, lhs) and
lhs.(DefinitionNode).getValue() = rhs and
origin = def.getDefiningNode()
|
sequence_index_points_to(rhs, context, sequence, value, index)
or
pointsTo(rhs, context, sequence, _) and
sequence.subscriptUnknown() and
value = TUnknown()
)
}

4
python/ql/test/library-tests/PointsTo/new/Dataflow.expected
View File

@@ -62,6 +62,10 @@
| a_simple.py:49 | g_0 = a |
| a_simple.py:49 | h_0 = b |
| a_simple.py:49 | i_0 = c |
| a_simple.py:53 | l_0 = BinaryExpr[0] |
| a_simple.py:53 | m_0 = BinaryExpr[1] |
| a_simple.py:56 | s_0 = a[0] |
| a_simple.py:56 | u_0 = a[1] |
| b_condition.py:0 | __name___0 = ScopeEntryDefinition |
| b_condition.py:0 | __package___0 = ScopeEntryDefinition |
| b_condition.py:0 | double_attr_check_0 = ScopeEntryDefinition |

4
python/ql/test/library-tests/PointsTo/new/Definitions.expected
View File

@@ -45,6 +45,10 @@
| a_simple.py:49 | Local Variable g | AssignmentDefinition |
| a_simple.py:49 | Local Variable h | AssignmentDefinition |
| a_simple.py:49 | Local Variable i | AssignmentDefinition |
| a_simple.py:53 | Local Variable l | MultiAssignmentDefinition |
| a_simple.py:53 | Local Variable m | MultiAssignmentDefinition |
| a_simple.py:56 | Local Variable s | MultiAssignmentDefinition |
| a_simple.py:56 | Local Variable u | MultiAssignmentDefinition |
| b_condition.py:0 | Global Variable __name__ | ScopeEntryDefinition |
| b_condition.py:0 | Global Variable __package__ | ScopeEntryDefinition |
| b_condition.py:0 | Global Variable double_attr_check | ScopeEntryDefinition |

11
python/ql/test/library-tests/PointsTo/new/PointsToUnknown.expected
View File

@@ -1,19 +1,29 @@
| a_simple.py:20 | ControlFlowNode for For | 20 |
| a_simple.py:20 | ControlFlowNode for seq | 18 |
| a_simple.py:21 | ControlFlowNode for x | 20 |
| a_simple.py:24 | ControlFlowNode for x | 23 |
| a_simple.py:29 | ControlFlowNode for For | 29 |
| a_simple.py:29 | ControlFlowNode for x | 27 |
| a_simple.py:30 | ControlFlowNode for p | 29 |
| a_simple.py:35 | ControlFlowNode for Subscript | 35 |
| a_simple.py:36 | ControlFlowNode for Subscript | 36 |
| a_simple.py:40 | ControlFlowNode for a | 38 |
| a_simple.py:40 | ControlFlowNode for b | 38 |
| a_simple.py:40 | ControlFlowNode for c | 38 |
| a_simple.py:46 | ControlFlowNode for x | 42 |
| a_simple.py:47 | ControlFlowNode for y | 42 |
| a_simple.py:48 | ControlFlowNode for z | 42 |
| a_simple.py:49 | ControlFlowNode for a | 38 |
| a_simple.py:49 | ControlFlowNode for b | 38 |
| a_simple.py:49 | ControlFlowNode for c | 38 |
| a_simple.py:50 | ControlFlowNode for g | 38 |
| a_simple.py:51 | ControlFlowNode for h | 38 |
| a_simple.py:52 | ControlFlowNode for i | 38 |
| a_simple.py:54 | ControlFlowNode for l | 53 |
| a_simple.py:55 | ControlFlowNode for m | 53 |
| a_simple.py:56 | ControlFlowNode for a | 38 |
| a_simple.py:57 | ControlFlowNode for s | 56 |
| a_simple.py:58 | ControlFlowNode for u | 56 |
| b_condition.py:5 | ControlFlowNode for IfExp | 5 |
| b_condition.py:5 | ControlFlowNode for cond | 5 |
| b_condition.py:5 | ControlFlowNode for unknown | 5 |
@@ -231,6 +241,7 @@
| r_regressions.py:39 | ControlFlowNode for y | 27 |
| r_regressions.py:43 | ControlFlowNode for x | 43 |
| r_regressions.py:43 | ControlFlowNode for x() | 43 |
| r_regressions.py:44 | ControlFlowNode for data | 43 |
| r_regressions.py:52 | ControlFlowNode for msg | 51 |
| r_regressions.py:64 | ControlFlowNode for do_validation | 64 |
| r_regressions.py:64 | ControlFlowNode for do_validation() | 64 |

10
python/ql/test/library-tests/PointsTo/new/PointsToWithContext.expected
View File

@@ -56,6 +56,11 @@ WARNING: Predicate points_to has been deprecated and may be removed in future (P
| a_simple.py:41 | ControlFlowNode for t | Tuple | builtin-class tuple | 39 | runtime |
| a_simple.py:42 | ControlFlowNode for Tuple | Tuple | builtin-class tuple | 40 | runtime |
| a_simple.py:42 | ControlFlowNode for w | Tuple | builtin-class tuple | 40 | runtime |
| a_simple.py:43 | ControlFlowNode for p | int 1 | builtin-class int | 41 | runtime |
| a_simple.py:44 | ControlFlowNode for q | int 2 | builtin-class int | 41 | runtime |
| a_simple.py:45 | ControlFlowNode for r | int 3 | builtin-class int | 41 | runtime |
| a_simple.py:47 | ControlFlowNode for y | 'b' | builtin-class str | 42 | runtime |
| a_simple.py:48 | ControlFlowNode for z | 'c' | builtin-class str | 42 | runtime |
| a_simple.py:49 | ControlFlowNode for Tuple | Tuple | builtin-class tuple | 49 | runtime |
| a_simple.py:49 | ControlFlowNode for b | 'b' | builtin-class str | 38 | runtime |
| a_simple.py:49 | ControlFlowNode for c | 'c' | builtin-class str | 38 | runtime |
@@ -63,6 +68,11 @@ WARNING: Predicate points_to has been deprecated and may be removed in future (P
| a_simple.py:49 | ControlFlowNode for i | 'c' | builtin-class str | 38 | runtime |
| a_simple.py:51 | ControlFlowNode for h | 'b' | builtin-class str | 38 | runtime |
| a_simple.py:52 | ControlFlowNode for i | 'c' | builtin-class str | 38 | runtime |
| a_simple.py:53 | ControlFlowNode for BinaryExpr | BinaryExpr | builtin-class tuple | 53 | runtime |
| a_simple.py:53 | ControlFlowNode for IntegerLiteral | int 1 | builtin-class int | 53 | runtime |
| a_simple.py:53 | ControlFlowNode for IntegerLiteral | int 2 | builtin-class int | 53 | runtime |
| a_simple.py:53 | ControlFlowNode for Tuple | BinaryExpr | builtin-class tuple | 53 | runtime |
| a_simple.py:53 | ControlFlowNode for Tuple | Tuple | builtin-class tuple | 53 | runtime |
| b_condition.py:4 | ControlFlowNode for FunctionExpr | Function f | builtin-class function | 4 | import |
| b_condition.py:4 | ControlFlowNode for f | Function f | builtin-class function | 4 | import |
| b_condition.py:5 | ControlFlowNode for IfExp | NoneType None | builtin-class NoneType | 5 | runtime |

10
python/ql/test/library-tests/PointsTo/new/PointsToWithType.expected
View File

@@ -56,6 +56,11 @@ WARNING: Predicate points_to has been deprecated and may be removed in future (P
| a_simple.py:41 | ControlFlowNode for t | Tuple | builtin-class tuple | 39 |
| a_simple.py:42 | ControlFlowNode for Tuple | Tuple | builtin-class tuple | 40 |
| a_simple.py:42 | ControlFlowNode for w | Tuple | builtin-class tuple | 40 |
| a_simple.py:43 | ControlFlowNode for p | int 1 | builtin-class int | 41 |
| a_simple.py:44 | ControlFlowNode for q | int 2 | builtin-class int | 41 |
| a_simple.py:45 | ControlFlowNode for r | int 3 | builtin-class int | 41 |
| a_simple.py:47 | ControlFlowNode for y | 'b' | builtin-class str | 42 |
| a_simple.py:48 | ControlFlowNode for z | 'c' | builtin-class str | 42 |
| a_simple.py:49 | ControlFlowNode for Tuple | Tuple | builtin-class tuple | 49 |
| a_simple.py:49 | ControlFlowNode for b | 'b' | builtin-class str | 38 |
| a_simple.py:49 | ControlFlowNode for c | 'c' | builtin-class str | 38 |
@@ -63,6 +68,11 @@ WARNING: Predicate points_to has been deprecated and may be removed in future (P
| a_simple.py:49 | ControlFlowNode for i | 'c' | builtin-class str | 38 |
| a_simple.py:51 | ControlFlowNode for h | 'b' | builtin-class str | 38 |
| a_simple.py:52 | ControlFlowNode for i | 'c' | builtin-class str | 38 |
| a_simple.py:53 | ControlFlowNode for BinaryExpr | BinaryExpr | builtin-class tuple | 53 |
| a_simple.py:53 | ControlFlowNode for IntegerLiteral | int 1 | builtin-class int | 53 |
| a_simple.py:53 | ControlFlowNode for IntegerLiteral | int 2 | builtin-class int | 53 |
| a_simple.py:53 | ControlFlowNode for Tuple | BinaryExpr | builtin-class tuple | 53 |
| a_simple.py:53 | ControlFlowNode for Tuple | Tuple | builtin-class tuple | 53 |
| b_condition.py:4 | ControlFlowNode for FunctionExpr | Function f | builtin-class function | 4 |
| b_condition.py:4 | ControlFlowNode for f | Function f | builtin-class function | 4 |
| b_condition.py:5 | ControlFlowNode for IfExp | NoneType None | builtin-class NoneType | 5 |

5
python/ql/test/library-tests/PointsTo/new/SSA.expected
View File

@@ -31,6 +31,11 @@ WARNING: Predicate ssa_variable_points_to has been deprecated and may be removed
| a_simple.py:38 | multi_assign_and_packing_0 = FunctionExpr | Function multi_assign_and_packing | builtin-class function |
| a_simple.py:39 | t_0 = Tuple | Tuple | builtin-class tuple |
| a_simple.py:40 | w_0 = Tuple | Tuple | builtin-class tuple |
| a_simple.py:41 | p_0 = t[0] | int 1 | builtin-class int |
| a_simple.py:41 | q_0 = t[1] | int 2 | builtin-class int |
| a_simple.py:41 | r_0 = t[2] | int 3 | builtin-class int |
| a_simple.py:42 | y_0 = w[1] | 'b' | builtin-class str |
| a_simple.py:42 | z_0 = w[2] | 'c' | builtin-class str |
| a_simple.py:49 | h_0 = b | 'b' | builtin-class str |
| a_simple.py:49 | i_0 = c | 'c' | builtin-class str |
| b_condition.py:0 | __name___0 = ScopeEntryDefinition | 'code.b_condition' | builtin-class str |

8
python/ql/test/library-tests/PointsTo/new/SourceNodeDefinitions.expected
View File

@@ -46,10 +46,14 @@
| a_simple.py:38 | Local Variable g | Entry node for Function multi_assign_and_packing | definition |
| a_simple.py:38 | Local Variable h | Entry node for Function multi_assign_and_packing | definition |
| a_simple.py:38 | Local Variable i | Entry node for Function multi_assign_and_packing | definition |
| a_simple.py:38 | Local Variable l | Entry node for Function multi_assign_and_packing | definition |
| a_simple.py:38 | Local Variable m | Entry node for Function multi_assign_and_packing | definition |
| a_simple.py:38 | Local Variable p | Entry node for Function multi_assign_and_packing | definition |
| a_simple.py:38 | Local Variable q | Entry node for Function multi_assign_and_packing | definition |
| a_simple.py:38 | Local Variable r | Entry node for Function multi_assign_and_packing | definition |
| a_simple.py:38 | Local Variable s | Entry node for Function multi_assign_and_packing | definition |
| a_simple.py:38 | Local Variable t | Entry node for Function multi_assign_and_packing | definition |
| a_simple.py:38 | Local Variable u | Entry node for Function multi_assign_and_packing | definition |
| a_simple.py:38 | Local Variable w | Entry node for Function multi_assign_and_packing | definition |
| a_simple.py:38 | Local Variable x | Entry node for Function multi_assign_and_packing | definition |
| a_simple.py:38 | Local Variable y | Entry node for Function multi_assign_and_packing | definition |
@@ -65,6 +69,10 @@
| a_simple.py:49 | Local Variable g | ControlFlowNode for g | definition |
| a_simple.py:49 | Local Variable h | ControlFlowNode for h | definition |
| a_simple.py:49 | Local Variable i | ControlFlowNode for i | definition |
| a_simple.py:53 | Local Variable l | ControlFlowNode for l | definition |
| a_simple.py:53 | Local Variable m | ControlFlowNode for m | definition |
| a_simple.py:56 | Local Variable s | ControlFlowNode for s | definition |
| a_simple.py:56 | Local Variable u | ControlFlowNode for u | definition |
| b_condition.py:0 | Global Variable __name__ | Entry node for Module code.b_condition | definition |
| b_condition.py:0 | Global Variable __package__ | Entry node for Module code.b_condition | definition |
| b_condition.py:0 | Global Variable double_attr_check | Entry node for Module code.b_condition | definition |

9
python/ql/test/library-tests/PointsTo/new/SsaUses.expected
View File

@@ -62,10 +62,14 @@
| a_simple.py:38 | g_0 | Exit node for Function multi_assign_and_packing |
| a_simple.py:38 | h_0 | Exit node for Function multi_assign_and_packing |
| a_simple.py:38 | i_0 | Exit node for Function multi_assign_and_packing |
| a_simple.py:38 | l_0 | Exit node for Function multi_assign_and_packing |
| a_simple.py:38 | m_0 | Exit node for Function multi_assign_and_packing |
| a_simple.py:38 | p_0 | Exit node for Function multi_assign_and_packing |
| a_simple.py:38 | q_0 | Exit node for Function multi_assign_and_packing |
| a_simple.py:38 | r_0 | Exit node for Function multi_assign_and_packing |
| a_simple.py:38 | s_0 | Exit node for Function multi_assign_and_packing |
| a_simple.py:38 | t_0 | Exit node for Function multi_assign_and_packing |
| a_simple.py:38 | u_0 | Exit node for Function multi_assign_and_packing |
| a_simple.py:38 | w_0 | Exit node for Function multi_assign_and_packing |
| a_simple.py:38 | x_0 | Exit node for Function multi_assign_and_packing |
| a_simple.py:38 | y_0 | Exit node for Function multi_assign_and_packing |
@@ -87,6 +91,11 @@
| a_simple.py:50 | g_0 | ControlFlowNode for g |
| a_simple.py:51 | h_0 | ControlFlowNode for h |
| a_simple.py:52 | i_0 | ControlFlowNode for i |
| a_simple.py:54 | l_0 | ControlFlowNode for l |
| a_simple.py:55 | m_0 | ControlFlowNode for m |
| a_simple.py:56 | a_0 | ControlFlowNode for a |
| a_simple.py:57 | s_0 | ControlFlowNode for s |
| a_simple.py:58 | u_0 | ControlFlowNode for u |
| b_condition.py:0 | __name___0 | Exit node for Module code.b_condition |
| b_condition.py:0 | __package___0 | Exit node for Module code.b_condition |
| b_condition.py:0 | double_attr_check_1 | Exit node for Module code.b_condition |

10
python/ql/test/library-tests/PointsTo/new/Values.expected
View File

@@ -41,6 +41,11 @@
| a_simple.py:42 | ControlFlowNode for w | runtime | (Unknown value, 'b', Unknown value, ) | builtin-class tuple |
| a_simple.py:42 | ControlFlowNode for w | runtime | (Unknown value, Unknown value, 'c', ) | builtin-class tuple |
| a_simple.py:42 | ControlFlowNode for w | runtime | (Unknown value, Unknown value, Unknown value, ) | builtin-class tuple |
| a_simple.py:43 | ControlFlowNode for p | runtime | int 1 | builtin-class int |
| a_simple.py:44 | ControlFlowNode for q | runtime | int 2 | builtin-class int |
| a_simple.py:45 | ControlFlowNode for r | runtime | int 3 | builtin-class int |
| a_simple.py:47 | ControlFlowNode for y | runtime | 'b' | builtin-class str |
| a_simple.py:48 | ControlFlowNode for z | runtime | 'c' | builtin-class str |
| a_simple.py:49 | ControlFlowNode for Tuple | runtime | (Unknown value, 'b', 'c', ) | builtin-class tuple |
| a_simple.py:49 | ControlFlowNode for Tuple | runtime | (Unknown value, 'b', Unknown value, ) | builtin-class tuple |
| a_simple.py:49 | ControlFlowNode for Tuple | runtime | (Unknown value, Unknown value, 'c', ) | builtin-class tuple |
@@ -49,6 +54,11 @@
| a_simple.py:49 | ControlFlowNode for c | runtime | 'c' | builtin-class str |
| a_simple.py:51 | ControlFlowNode for h | runtime | 'b' | builtin-class str |
| a_simple.py:52 | ControlFlowNode for i | runtime | 'c' | builtin-class str |
| a_simple.py:53 | ControlFlowNode for BinaryExpr | runtime | instance of tuple | builtin-class tuple |
| a_simple.py:53 | ControlFlowNode for IntegerLiteral | runtime | int 1 | builtin-class int |
| a_simple.py:53 | ControlFlowNode for IntegerLiteral | runtime | int 2 | builtin-class int |
| a_simple.py:53 | ControlFlowNode for Tuple | runtime | (int 1, ) | builtin-class tuple |
| a_simple.py:53 | ControlFlowNode for Tuple | runtime | (int 2, ) | builtin-class tuple |
| b_condition.py:4 | ControlFlowNode for FunctionExpr | import | Function f | builtin-class function |
| b_condition.py:5 | ControlFlowNode for IfExp | runtime | None | builtin-class NoneType |
| b_condition.py:5 | ControlFlowNode for None | runtime | None | builtin-class NoneType |

9
python/ql/test/library-tests/PointsTo/new/VarUses.expected
View File

@@ -47,10 +47,14 @@
| a_simple.py:38 | g | Exit node for Function multi_assign_and_packing |
| a_simple.py:38 | h | Exit node for Function multi_assign_and_packing |
| a_simple.py:38 | i | Exit node for Function multi_assign_and_packing |
| a_simple.py:38 | l | Exit node for Function multi_assign_and_packing |
| a_simple.py:38 | m | Exit node for Function multi_assign_and_packing |
| a_simple.py:38 | p | Exit node for Function multi_assign_and_packing |
| a_simple.py:38 | q | Exit node for Function multi_assign_and_packing |
| a_simple.py:38 | r | Exit node for Function multi_assign_and_packing |
| a_simple.py:38 | s | Exit node for Function multi_assign_and_packing |
| a_simple.py:38 | t | Exit node for Function multi_assign_and_packing |
| a_simple.py:38 | u | Exit node for Function multi_assign_and_packing |
| a_simple.py:38 | w | Exit node for Function multi_assign_and_packing |
| a_simple.py:38 | x | Exit node for Function multi_assign_and_packing |
| a_simple.py:38 | y | Exit node for Function multi_assign_and_packing |
@@ -72,6 +76,11 @@
| a_simple.py:50 | g | ControlFlowNode for g |
| a_simple.py:51 | h | ControlFlowNode for h |
| a_simple.py:52 | i | ControlFlowNode for i |
| a_simple.py:54 | l | ControlFlowNode for l |
| a_simple.py:55 | m | ControlFlowNode for m |
| a_simple.py:56 | a | ControlFlowNode for a |
| a_simple.py:57 | s | ControlFlowNode for s |
| a_simple.py:58 | u | ControlFlowNode for u |
| b_condition.py:0 | Exception | Exit node for Module code.b_condition |
| b_condition.py:0 | TypeError | Exit node for Module code.b_condition |
| b_condition.py:0 | __name__ | Exit node for Module code.b_condition |

7
python/ql/test/library-tests/PointsTo/new/code/a_simple.py
View File

@@ -50,3 +50,10 @@ def multi_assign_and_packing(a, b="b", c="c"):
g
h
i
l, m = (1,) + (2,)
l
m
s, u = a
s
u

2
python/ql/test/library-tests/PointsTo/regressions/missing/if-urlsplit-access/Test.expected
View File

@@ -1,3 +1,3 @@
| test.py:5:7:5:9 | ControlFlowNode for foo | int 42 |
| test.py:11:11:11:13 | ControlFlowNode for foo | int 1 |
| test.py:17:11:17:13 | ControlFlowNode for foo | <MISSING pointsTo()> |
| test.py:17:11:17:13 | ControlFlowNode for foo | int 2 |

2
python/ql/test/library-tests/PointsTo/regressions/missing/if-urlsplit-access/test.py
View File

@@ -14,4 +14,4 @@ def func(url):
return # using `pass` here instead makes points-to work
foo = 2
check(foo) # no points-to information
check(foo) # Points-to was missing here. Fixed by https://github.com/Semmle/ql/pull/2922

2
python/ql/test/query-tests/analysis/pointsto/Pruned.expected
View File

@@ -1 +1 @@
| 1185 |
| 1183 |