hohn/codeql
1
0
Fork 0
mirror of https://github.com/github/codeql.git synced 2026-04-28 10:15:14 +02:00
Code Issues Packages Projects Releases Wiki Activity

Python: Avoid overlap between AssignmentDefinition and ParameterDefinition

Browse Source
This commit is contained in:
Rasmus Wriedt Larsen
2023-07-07 14:26:28 +02:00
parent 4e8a1144f2
commit 43b025015d
7 changed files with 25 additions and 67 deletions
Download Patch File Download Diff File Expand all files Collapse all files

10
python/ql/lib/semmle/python/dataflow/new/internal/DataFlowPrivate.qll
View File

@@ -292,12 +292,7 @@ module EssaFlow {
// nodeFrom is `f(42)`, cfg node
// nodeTo is `x`, essa var
nodeFrom.(CfgNode).getNode() =
nodeTo.(EssaNode).getVar().getDefinition().(AssignmentDefinition).getValue() and
// we need to ensure that enclosing callable is the same, since a parameter with a
// default value will be in the scope of the function, while the default value
// itself will be in the scope that _defines_ the function.
// We handle _that_ as a jumpstep
nodeFrom.getEnclosingCallable() = nodeTo.getEnclosingCallable()
nodeTo.(EssaNode).getVar().getDefinition().(AssignmentDefinition).getValue()
or
// With definition
// `with f(42) as x:`
@@ -473,8 +468,7 @@ predicate runtimeJumpStep(Node nodeFrom, Node nodeTo) {
// function, while the default value itself will be in the scope that _defines_ the
// function.
nodeFrom.(CfgNode).getNode() =
nodeTo.(EssaNode).getVar().getDefinition().(AssignmentDefinition).getValue() and
not nodeFrom.getEnclosingCallable() = nodeTo.getEnclosingCallable()
nodeTo.(EssaNode).getVar().getDefinition().(ParameterDefinition).getDefault()
}
/**

3
python/ql/lib/semmle/python/essa/Essa.qll
View File

@@ -501,7 +501,8 @@ class AssignmentDefinition extends EssaNodeDefinition {
ControlFlowNode value;
AssignmentDefinition() {
SsaSource::assignment_definition(this.getSourceVariable(), this.getDefiningNode(), value)
SsaSource::assignment_definition(this.getSourceVariable(), this.getDefiningNode(), value) and
not this instanceof ParameterDefinition
}
ControlFlowNode getValue() { result = value }