hohn/codeql
1
0
Fork 0
mirror of https://github.com/github/codeql.git synced 2026-04-30 19:26:02 +02:00
Code Issues Packages Projects Releases Wiki Activity

Python: Moves library and queries over to the new predicates, removes old ones

Browse Source
This commit is contained in:
Rebecca Valentine
2020-03-02 18:08:10 -08:00
parent 7930037bb6
commit 31fc0f2240
8 changed files with 23 additions and 23 deletions
Download Patch File Download Diff File Expand all files Collapse all files

26
python/ql/src/Expressions/Formatting/AdvancedFormatting.qll
View File

@@ -1,4 +1,5 @@
import python
private import semmle.python.types.Builtins
library class PossibleAdvancedFormatString extends StrConst {
@@ -104,39 +105,38 @@ private predicate brace_pair(PossibleAdvancedFormatString fmt, int start, int en
)
}
private predicate advanced_format_call_objectapi(Call format_expr, PossibleAdvancedFormatString fmt, int args) {
private predicate advanced_format_call(Call format_expr, PossibleAdvancedFormatString fmt, int args) {
exists(CallNode call |
call = format_expr.getAFlowNode() |
call.getFunction().refersTo(Object::builtin("format")) and call.getArg(0).refersTo(_, fmt.getAFlowNode()) and
call.getFunction().pointsTo(Value::named("format")) and call.getArg(0).pointsTo(_, fmt.getAFlowNode()) and
args = count(format_expr.getAnArg()) - 1
or
call.getFunction().(AttrNode).getObject("format").refersTo(_, fmt.getAFlowNode()) and
call.getFunction().(AttrNode).getObject("format").pointsTo(_, fmt.getAFlowNode()) and
args = count(format_expr.getAnArg())
)
}
class AdvancedFormatString_objectapi extends PossibleAdvancedFormatString {
class AdvancedFormatString extends PossibleAdvancedFormatString {
AdvancedFormatString_objectapi() {
advanced_format_call_objectapi(_, this, _)
AdvancedFormatString() {
advanced_format_call(_, this, _)
}
}
class AdvancedFormattingCall_objectapi extends Call {
class AdvancedFormattingCall extends Call {
AdvancedFormattingCall_objectapi() {
advanced_format_call_objectapi(this, _, _)
AdvancedFormattingCall() {
advanced_format_call(this, _, _)
}
/** Count of the arguments actually provided */
int providedArgCount() {
advanced_format_call_objectapi(this, _, result)
advanced_format_call(this, _, result)
}
AdvancedFormatString_objectapi getAFormat() {
advanced_format_call_objectapi(this, result, _)
AdvancedFormatString getAFormat() {
advanced_format_call(this, result, _)
}
}

2
python/ql/src/Expressions/Formatting/MixedExplicitImplicitIn3101Format.ql
View File

@@ -13,6 +13,6 @@
import python
import AdvancedFormatting
from AdvancedFormattingCall_objectapi call, AdvancedFormatString_objectapi fmt
from AdvancedFormattingCall call, AdvancedFormatString fmt
where call.getAFormat() = fmt and fmt.isImplicitlyNumbered() and fmt.isExplicitlyNumbered()
select fmt, "Formatting string mixes implicitly and explicitly numbered fields."

6
python/ql/src/Expressions/Formatting/UnusedArgumentIn3101Format.ql
View File

@@ -16,11 +16,11 @@ import python
import python
import AdvancedFormatting
int field_count(AdvancedFormatString_objectapi fmt) { result = max(fmt.getFieldNumber(_, _)) + 1 }
int field_count(AdvancedFormatString fmt) { result = max(fmt.getFieldNumber(_, _)) + 1 }
from AdvancedFormattingCall_objectapi call, AdvancedFormatString_objectapi fmt, int arg_count, int max_field
from AdvancedFormattingCall call, AdvancedFormatString fmt, int arg_count, int max_field
where arg_count = call.providedArgCount() and max_field = field_count(fmt) and
call.getAFormat() = fmt and not exists(call.getStarargs()) and
forall(AdvancedFormatString_objectapi other | other = call.getAFormat() | field_count(other) < arg_count)
forall(AdvancedFormatString other | other = call.getAFormat() | field_count(other) < arg_count)
select call, "Too many arguments for string format. Format $@ requires only " + max_field + ", but " +
arg_count.toString() + " are provided.", fmt, "\"" + fmt.getText() + "\""

4
python/ql/src/Expressions/Formatting/UnusedNamedArgumentIn3101Format.ql
View File

@@ -13,10 +13,10 @@
import python
import AdvancedFormatting
from AdvancedFormattingCall_objectapi call, AdvancedFormatString_objectapi fmt, string name, string fmt_repr
from AdvancedFormattingCall call, AdvancedFormatString fmt, string name, string fmt_repr
where call.getAFormat() = fmt and
name = call.getAKeyword().getArg() and
forall(AdvancedFormatString_objectapi format | format = call.getAFormat() | not format.getFieldName(_, _) = name)
forall(AdvancedFormatString format | format = call.getAFormat() | not format.getFieldName(_, _) = name)
and not exists(call.getKwargs()) and
(strictcount(call.getAFormat()) = 1 and fmt_repr = "format \"" + fmt.getText() + "\""
or

2
python/ql/src/Expressions/Formatting/WrongNameInArgumentsFor3101Format.ql
View File

@@ -14,7 +14,7 @@
import python
import AdvancedFormatting
from AdvancedFormattingCall_objectapi call, AdvancedFormatString_objectapi fmt, string name
from AdvancedFormattingCall call, AdvancedFormatString fmt, string name
where call.getAFormat() = fmt and
not name = call.getAKeyword().getArg() and
fmt.getFieldName(_, _) = name

2
python/ql/src/Expressions/Formatting/WrongNumberArgumentsFor3101Format.ql
View File

@@ -14,7 +14,7 @@
import python
import AdvancedFormatting
from AdvancedFormattingCall_objectapi call, AdvancedFormatString_objectapi fmt,
from AdvancedFormattingCall call, AdvancedFormatString fmt,
int arg_count, int max_field, string provided
where arg_count = call.providedArgCount() and max_field = max(fmt.getFieldNumber(_, _)) and
call.getAFormat() = fmt and not exists(call.getStarargs()) and arg_count <= max_field and