From 2a0c451d2d3ceeeb4a6d10a619cbe084e0f133bd Mon Sep 17 00:00:00 2001 From: Rasmus Lerchedahl Petersen Date: Mon, 18 Mar 2024 10:29:36 +0100 Subject: [PATCH] python: No `fieldFlowBranchLimit` for `SummarizedCallable`s Like https://github.com/github/codeql/pull/15689 for Ruby. --- .../python/dataflow/new/internal/DataFlowImplSpecific.qll | 2 ++ .../experimental/dataflow/summaries/conflicting_summaries.py | 2 +- 2 files changed, 3 insertions(+), 1 deletion(-) diff --git a/python/ql/lib/semmle/python/dataflow/new/internal/DataFlowImplSpecific.qll b/python/ql/lib/semmle/python/dataflow/new/internal/DataFlowImplSpecific.qll index cffdefe41ba..704af5b08e7 100644 --- a/python/ql/lib/semmle/python/dataflow/new/internal/DataFlowImplSpecific.qll +++ b/python/ql/lib/semmle/python/dataflow/new/internal/DataFlowImplSpecific.qll @@ -22,4 +22,6 @@ module PythonDataFlow implements InputSig { predicate neverSkipInPathGraph = Private::neverSkipInPathGraph/1; Node exprNode(DataFlowExpr e) { result = Public::exprNode(e) } + + predicate ignoreFieldFlowBranchLimit(DataFlowCallable c) { exists(c.asLibraryCallable()) } } diff --git a/python/ql/test/experimental/dataflow/summaries/conflicting_summaries.py b/python/ql/test/experimental/dataflow/summaries/conflicting_summaries.py index 9528e9cdafc..7b031f37a9f 100644 --- a/python/ql/test/experimental/dataflow/summaries/conflicting_summaries.py +++ b/python/ql/test/experimental/dataflow/summaries/conflicting_summaries.py @@ -7,7 +7,7 @@ from extracted_package.functions import with_subpath, without_subpath # can be concluded from its definition. This seems to discard all summaries, including # the one with flow to `ReturnValue.Attribute[pattern]`. ensure_tainted( - with_subpath(ts).pattern, # $ MISSING: tainted + with_subpath(ts).pattern, # $ tainted with_subpath(ts), # $ tainted with_subpath(ts), # $ tainted )