hohn/codeql
1
0
Fork 0
mirror of https://github.com/github/codeql.git synced 2026-04-30 19:26:02 +02:00
Code Issues Packages Projects Releases Wiki Activity

Python points-to/taint-tracking: Fix up flow into __init__ methods.

Browse Source
This commit is contained in:
Mark Shannon
2019-04-11 10:32:27 +01:00
parent 53f859117e
commit 3b42f3cea3
4 changed files with 11 additions and 8 deletions
Download Patch File Download Diff File Expand all files Collapse all files

5
python/ql/src/semmle/python/objects/Classes.qll
View File

@@ -97,9 +97,8 @@ class PythonClassObjectInternal extends ClassObjectInternal, TPythonClassObject
override predicate calleeAndOffset(Function scope, int paramOffset) {
exists(PythonFunctionObjectInternal init |
// TO DO... Lookup init...
none() |
init.getScope() = scope and paramOffset = 1
this.lookup("__init__", init, _) and
init.calleeAndOffset(scope, paramOffset-1)
)
}

4
python/ql/src/semmle/python/objects/ObjectAPI.qll
View File

@@ -146,5 +146,9 @@ class ClassValue extends Value {
result = Types::getMro(this).getAnItem()
}
Value lookup(string name) {
this.(ClassObjectInternal).lookup(name, result, _)
}
}

6
python/ql/src/semmle/python/security/TaintTracking.qll
View File

@@ -1069,7 +1069,7 @@ library module TaintFlowImplementation {
predicate self_init_end_transfer(EssaVariable self, CallContext callee, CallNode call, CallContext caller) {
exists(ClassValue cls, Function init |
call.getFunction().pointsTo(cls) and
init = cls.attr("__init__").(CallableValue).getScope() and
init = cls.lookup("__init__").(CallableValue).getScope() and
self.getSourceVariable().(Variable).isSelf() and self.getScope() = init
|
callee = caller.getCallee(call)
@@ -1218,7 +1218,7 @@ library module TaintFlowImplementation {
pragma [noinline]
predicate class_initializer_argument(ClassValue cls, int n, CallNode call, CallableValue func, ControlFlowNode argument, NameNode param) {
call.getFunction().pointsTo(cls) and
cls.attr("__init__") = func and
cls.lookup("__init__") = func and
call.getArg(n) = argument and
param.getNode() = func.getScope().getArg(n+1)
}
@@ -1510,7 +1510,7 @@ class CallContext extends TCallContext {
exists(ClassValue cls,CallNode call |
this = TCalleeContext(call, _, _) and
call.getFunction().pointsTo(cls) and
s = cls.attr("__init__").(CallableValue).getScope() and
s = cls.lookup("__init__").(CallableValue).getScope() and
call.getFunction().pointsTo(cls)
)
}

4
python/ql/src/semmle/python/types/ClassObject.qll
View File

@@ -108,7 +108,7 @@ class ClassObject extends Object {
Will include attributes of super-classes */
Object lookupAttribute(string name) {
exists(Value val |
theClass().attribute(name, val, _) and
theClass().lookup(name, val, _) and
result = val.getSource()
)
}
@@ -135,7 +135,7 @@ class ClassObject extends Object {
/** Whether the named attribute refers to the object, class and origin */
predicate attributeRefersTo(string name, Object obj, ClassObject cls, ControlFlowNode origin) {
exists(Value val, CfgOrigin valorig |
theClass().attribute(name, val, valorig) and
theClass().lookup(name, val, valorig) and
obj = val.getSource() and
cls = val.getClass().getSource() and
origin = valorig.toCfgNode()