From 3206ab0be19038c6d91bc34493d6c3c4101067c2 Mon Sep 17 00:00:00 2001 From: yoff Date: Mon, 27 Jul 2026 17:37:36 +0200 Subject: [PATCH] Python: address CodeQL alerts --- .../controlflow/internal/AstNodeImpl.qll | 18 +++++++++--------- .../semmle/python/controlflow/internal/Cfg.qll | 2 +- .../evaluation-order/NewCfgAllLiveReachable.ql | 1 - .../NewCfgAnnotationHasCfgNode.ql | 1 - .../NewCfgBasicBlockAnnotationGap.ql | 1 - .../NewCfgBasicBlockOrdering.ql | 1 - .../evaluation-order/NewCfgBranchTimestamps.ql | 3 +-- .../NewCfgConsecutivePredecessorTimestamps.ql | 1 - .../NewCfgConsecutiveTimestamps.ql | 1 - .../evaluation-order/NewCfgImpl.qll | 4 +--- .../evaluation-order/NewCfgNeverReachable.ql | 1 - .../evaluation-order/NewCfgNoBackwardFlow.ql | 1 - .../evaluation-order/NewCfgNoBasicBlock.ql | 1 - .../NewCfgNoSharedReachable.ql | 1 - .../evaluation-order/NewCfgStrictForward.ql | 1 - .../evaluation-order/OldCfgImpl.qll | 8 ++++---- 16 files changed, 16 insertions(+), 30 deletions(-) diff --git a/python/ql/lib/semmle/python/controlflow/internal/AstNodeImpl.qll b/python/ql/lib/semmle/python/controlflow/internal/AstNodeImpl.qll index 31bcf19b434..21dbad68b81 100644 --- a/python/ql/lib/semmle/python/controlflow/internal/AstNodeImpl.qll +++ b/python/ql/lib/semmle/python/controlflow/internal/AstNodeImpl.qll @@ -156,7 +156,7 @@ module Ast implements AstSig { /** * A parameter of a callable. * - * Modelled per the C# template (`csharp/.../ControlFlowGraph.qll`): + * modeled per the C# template (`csharp/.../ControlFlowGraph.qll`): * each Python parameter (the `Py::Parameter` AST node, which is a `Name` * or — Python 2 only — a `Tuple` in store context) becomes a CFG node * at a stable position in the enclosing callable's entry sequence. @@ -766,7 +766,7 @@ module Ast implements AstSig { /** * A `from m import *` statement. Evaluates the module expression but * binds no name (the bindings happen by side-effect at runtime, which - * is not modelled at the CFG level). + * is not modeled at the CFG level). */ additional class ImportStarStmt extends Stmt { private Py::ImportStar imp; @@ -921,7 +921,7 @@ module Ast implements AstSig { * latter flattens a tuple of exception types (`except (A, B):`) into * its individual elements, which would yield several patterns for one * handler and violate the shared CFG's single-pattern-per-catch - * contract. The raw child is the one tuple node, modelling the + * contract. The raw child is the one tuple node, modeling the * runtime's single `isinstance(exc, (A, B))` test. */ AstNode getPattern() { @@ -1231,7 +1231,7 @@ module Ast implements AstSig { } /** - * An `import x.y` module expression. Modelled as a leaf — the dotted + * An `import x.y` module expression. modeled as a leaf — the dotted * name is just a string. */ additional class ImportExpression extends Expr { @@ -1629,9 +1629,9 @@ private module Input implements InputSig1, InputSig2 { private string assertThrowTag() { result = "[assert-throw]" } /** - * Holds if the AST node `n` may raise an exception at runtime as part of + * Holds if the expression node `e` may raise an exception at runtime as part of * its normal evaluation (not via an explicit `raise`/`assert`, which are - * modelled separately). + * modeled separately). * * The set mirrors what the legacy CFG used to flag implicitly: function * calls (anything can raise), attribute access (`AttributeError`), @@ -1640,7 +1640,7 @@ private module Input implements InputSig1, InputSig2 { * (`ImportError`/`ModuleNotFoundError`), and generator/coroutine * suspension points (`await`/`yield`/`yield from`). * - * Bare `Name` reads are intentionally excluded — modelling every name + * Bare `Name` reads are intentionally excluded — modeling every name * read as `mayThrow` would explode CFG edge count for negligible * analysis value. `BoolExpr`/`IfExp` containers are also excluded; the * operands they evaluate contribute their own exception edges. @@ -1677,7 +1677,7 @@ private module Input implements InputSig1, InputSig2 { private predicate stmtMayThrow(Py::Stmt s) { s instanceof Py::ImportStar } /** - * Holds if `n` is syntactically inside the body, handlers, `else`, or + * Holds if `py` is syntactically inside the body, handlers, `else`, or * `finally` of a `try` statement (or the body of a `with` statement, * which compiles to an implicit try/finally for `__exit__`) in the * same scope. @@ -1701,7 +1701,7 @@ private module Input implements InputSig1, InputSig2 { * `exprMayThrow` and `stmtMayThrow` for the included AST classes. * * Restricted to nodes inside a `try`/`with` statement: matches Java's - * approach of only modelling exception flow where it can be observed + * approach of only modeling exception flow where it can be observed * by local handling. */ private predicate mayThrow(Ast::AstNode n) { diff --git a/python/ql/lib/semmle/python/controlflow/internal/Cfg.qll b/python/ql/lib/semmle/python/controlflow/internal/Cfg.qll index 4dc6ac20d04..b102c71391f 100644 --- a/python/ql/lib/semmle/python/controlflow/internal/Cfg.qll +++ b/python/ql/lib/semmle/python/controlflow/internal/Cfg.qll @@ -859,7 +859,7 @@ class ExceptGroupFlowNode extends ControlFlowNode { ControlFlowNode getName() { result = this } } -/** Abstract base class for sequence nodes (tuple, list). */ +/** A control flow node corresponding to a sequence (tuple, list). */ abstract class SequenceNode extends ControlFlowNode { /** Gets the `n`th element of this sequence. */ abstract ControlFlowNode getElement(int n); diff --git a/python/ql/test/library-tests/ControlFlow/evaluation-order/NewCfgAllLiveReachable.ql b/python/ql/test/library-tests/ControlFlow/evaluation-order/NewCfgAllLiveReachable.ql index 75f02d14a9c..883b266c82e 100644 --- a/python/ql/test/library-tests/ControlFlow/evaluation-order/NewCfgAllLiveReachable.ql +++ b/python/ql/test/library-tests/ControlFlow/evaluation-order/NewCfgAllLiveReachable.ql @@ -1,7 +1,6 @@ /** New-CFG version of AllLiveReachable. */ import python -import TimerUtils import NewCfgImpl private module Utils = EvalOrderCfgUtils; diff --git a/python/ql/test/library-tests/ControlFlow/evaluation-order/NewCfgAnnotationHasCfgNode.ql b/python/ql/test/library-tests/ControlFlow/evaluation-order/NewCfgAnnotationHasCfgNode.ql index 4b1d82e27e6..bf97a079322 100644 --- a/python/ql/test/library-tests/ControlFlow/evaluation-order/NewCfgAnnotationHasCfgNode.ql +++ b/python/ql/test/library-tests/ControlFlow/evaluation-order/NewCfgAnnotationHasCfgNode.ql @@ -5,7 +5,6 @@ */ import python -import TimerUtils import NewCfgImpl private module Utils = EvalOrderCfgUtils; diff --git a/python/ql/test/library-tests/ControlFlow/evaluation-order/NewCfgBasicBlockAnnotationGap.ql b/python/ql/test/library-tests/ControlFlow/evaluation-order/NewCfgBasicBlockAnnotationGap.ql index 52fbda8cfaa..e12ab8ff5ef 100644 --- a/python/ql/test/library-tests/ControlFlow/evaluation-order/NewCfgBasicBlockAnnotationGap.ql +++ b/python/ql/test/library-tests/ControlFlow/evaluation-order/NewCfgBasicBlockAnnotationGap.ql @@ -11,7 +11,6 @@ */ import python -import TimerUtils import NewCfgImpl private module Utils = EvalOrderCfgUtils; diff --git a/python/ql/test/library-tests/ControlFlow/evaluation-order/NewCfgBasicBlockOrdering.ql b/python/ql/test/library-tests/ControlFlow/evaluation-order/NewCfgBasicBlockOrdering.ql index 27288dcaa67..b8254a8e864 100644 --- a/python/ql/test/library-tests/ControlFlow/evaluation-order/NewCfgBasicBlockOrdering.ql +++ b/python/ql/test/library-tests/ControlFlow/evaluation-order/NewCfgBasicBlockOrdering.ql @@ -6,7 +6,6 @@ */ import python -import TimerUtils import NewCfgImpl private module Utils = EvalOrderCfgUtils; diff --git a/python/ql/test/library-tests/ControlFlow/evaluation-order/NewCfgBranchTimestamps.ql b/python/ql/test/library-tests/ControlFlow/evaluation-order/NewCfgBranchTimestamps.ql index cfd8ffb4e4b..2dc8ae144dc 100644 --- a/python/ql/test/library-tests/ControlFlow/evaluation-order/NewCfgBranchTimestamps.ql +++ b/python/ql/test/library-tests/ControlFlow/evaluation-order/NewCfgBranchTimestamps.ql @@ -16,7 +16,7 @@ * * `match` statements: each `case` body is a syntactically distinct * sub-tree, and the branches don't reconverge through a common * annotation point in the timeline; - * * `try` / `with` and `raise` / `assert`: exception edges are modelled + * * `try` / `with` and `raise` / `assert`: exception edges are modeled * as true/false but flow to syntactically distinct handlers, with no * reconvergence in the linear annotation order; * * short-circuit `and` / `or` (`BoolExpr`): the branches reconverge at @@ -33,7 +33,6 @@ */ import python -import TimerUtils import NewCfgImpl private module Utils = EvalOrderCfgUtils; diff --git a/python/ql/test/library-tests/ControlFlow/evaluation-order/NewCfgConsecutivePredecessorTimestamps.ql b/python/ql/test/library-tests/ControlFlow/evaluation-order/NewCfgConsecutivePredecessorTimestamps.ql index 3feacae264e..0eb8ad5a414 100644 --- a/python/ql/test/library-tests/ControlFlow/evaluation-order/NewCfgConsecutivePredecessorTimestamps.ql +++ b/python/ql/test/library-tests/ControlFlow/evaluation-order/NewCfgConsecutivePredecessorTimestamps.ql @@ -8,7 +8,6 @@ */ import python -import TimerUtils import NewCfgImpl private module Utils = EvalOrderCfgUtils; diff --git a/python/ql/test/library-tests/ControlFlow/evaluation-order/NewCfgConsecutiveTimestamps.ql b/python/ql/test/library-tests/ControlFlow/evaluation-order/NewCfgConsecutiveTimestamps.ql index 657fc80437c..8fc13c9acba 100644 --- a/python/ql/test/library-tests/ControlFlow/evaluation-order/NewCfgConsecutiveTimestamps.ql +++ b/python/ql/test/library-tests/ControlFlow/evaluation-order/NewCfgConsecutiveTimestamps.ql @@ -14,7 +14,6 @@ */ import python -import TimerUtils import NewCfgImpl private module Utils = EvalOrderCfgUtils; diff --git a/python/ql/test/library-tests/ControlFlow/evaluation-order/NewCfgImpl.qll b/python/ql/test/library-tests/ControlFlow/evaluation-order/NewCfgImpl.qll index cbecb2da19d..ae27e8f16a0 100644 --- a/python/ql/test/library-tests/ControlFlow/evaluation-order/NewCfgImpl.qll +++ b/python/ql/test/library-tests/ControlFlow/evaluation-order/NewCfgImpl.qll @@ -74,9 +74,7 @@ module NewCfg implements EvalOrderCfgSig { Py::Scope getScope() { result = NewControlFlowNode.super.getEnclosingCallable().asScope() } - BasicBlock getBasicBlock() { - exists(NewBasicBlock bb, int i | bb.getNode(i) = this and result = bb) - } + BasicBlock getBasicBlock() { exists(NewBasicBlock bb | bb.getNode(_) = this and result = bb) } } /** diff --git a/python/ql/test/library-tests/ControlFlow/evaluation-order/NewCfgNeverReachable.ql b/python/ql/test/library-tests/ControlFlow/evaluation-order/NewCfgNeverReachable.ql index f10df59c34e..db324e6ee76 100644 --- a/python/ql/test/library-tests/ControlFlow/evaluation-order/NewCfgNeverReachable.ql +++ b/python/ql/test/library-tests/ControlFlow/evaluation-order/NewCfgNeverReachable.ql @@ -7,7 +7,6 @@ */ import python -import TimerUtils import NewCfgImpl private module Utils = EvalOrderCfgUtils; diff --git a/python/ql/test/library-tests/ControlFlow/evaluation-order/NewCfgNoBackwardFlow.ql b/python/ql/test/library-tests/ControlFlow/evaluation-order/NewCfgNoBackwardFlow.ql index a45e01b30c1..8cb0dfb143b 100644 --- a/python/ql/test/library-tests/ControlFlow/evaluation-order/NewCfgNoBackwardFlow.ql +++ b/python/ql/test/library-tests/ControlFlow/evaluation-order/NewCfgNoBackwardFlow.ql @@ -7,7 +7,6 @@ */ import python -import TimerUtils import NewCfgImpl private module Utils = EvalOrderCfgUtils; diff --git a/python/ql/test/library-tests/ControlFlow/evaluation-order/NewCfgNoBasicBlock.ql b/python/ql/test/library-tests/ControlFlow/evaluation-order/NewCfgNoBasicBlock.ql index e07890f7250..c0fc86b5130 100644 --- a/python/ql/test/library-tests/ControlFlow/evaluation-order/NewCfgNoBasicBlock.ql +++ b/python/ql/test/library-tests/ControlFlow/evaluation-order/NewCfgNoBasicBlock.ql @@ -5,7 +5,6 @@ */ import python -import TimerUtils import NewCfgImpl private module Utils = EvalOrderCfgUtils; diff --git a/python/ql/test/library-tests/ControlFlow/evaluation-order/NewCfgNoSharedReachable.ql b/python/ql/test/library-tests/ControlFlow/evaluation-order/NewCfgNoSharedReachable.ql index 30d250d32ab..dd174d6d913 100644 --- a/python/ql/test/library-tests/ControlFlow/evaluation-order/NewCfgNoSharedReachable.ql +++ b/python/ql/test/library-tests/ControlFlow/evaluation-order/NewCfgNoSharedReachable.ql @@ -6,7 +6,6 @@ */ import python -import TimerUtils import NewCfgImpl private module Utils = EvalOrderCfgUtils; diff --git a/python/ql/test/library-tests/ControlFlow/evaluation-order/NewCfgStrictForward.ql b/python/ql/test/library-tests/ControlFlow/evaluation-order/NewCfgStrictForward.ql index c93d181d852..e7f4a12ff81 100644 --- a/python/ql/test/library-tests/ControlFlow/evaluation-order/NewCfgStrictForward.ql +++ b/python/ql/test/library-tests/ControlFlow/evaluation-order/NewCfgStrictForward.ql @@ -7,7 +7,6 @@ */ import python -import TimerUtils import NewCfgImpl private module Utils = EvalOrderCfgUtils; diff --git a/python/ql/test/library-tests/ControlFlow/evaluation-order/OldCfgImpl.qll b/python/ql/test/library-tests/ControlFlow/evaluation-order/OldCfgImpl.qll index fc52c8dd3ed..cb7bbb495b8 100644 --- a/python/ql/test/library-tests/ControlFlow/evaluation-order/OldCfgImpl.qll +++ b/python/ql/test/library-tests/ControlFlow/evaluation-order/OldCfgImpl.qll @@ -3,14 +3,14 @@ * Python control flow graph. */ -private import python as Py +private import python as PY import TimerUtils /** Existing Python CFG implementation of the evaluation-order signature. */ module OldCfg implements EvalOrderCfgSig { - class CfgNode = Py::ControlFlowNode; + class CfgNode = PY::ControlFlowNode; - class BasicBlock = Py::BasicBlock; + class BasicBlock = PY::BasicBlock; - CfgNode scopeGetEntryNode(Py::Scope s) { result = s.getEntryNode() } + CfgNode scopeGetEntryNode(PY::Scope s) { result = s.getEntryNode() } }