python: various fixes

- compilation
- alerts
- some review comments

python/ql/src/Security/CWE-020-ExternalAPIs/ExternalAPIs.qll

@@ -65,13 +65,17 @@ private class DefaultSafeExternalApi extends SafeExternalApi {
 
 /** A node representing data being passed to an external API through a call. */
 class ExternalApiDataNode extends DataFlow::Node {
-  DataFlowPrivate::DataFlowSourceCall call;
   DataFlowPrivate::NonLibraryDataFlowCallable callable;
   int i;
 
   ExternalApiDataNode() {
-    exists(call.getLocation().getFile().getRelativePath()) and
-    callable = call.getCallable() and
+    exists(DataFlowPrivate::DataFlowSourceCall call |
+      exists(call.getLocation().getFile().getRelativePath())
+    |
+      callable = call.getCallable() and
+      // TODO: this ignores some complexity of keyword arguments (especially keyword-only args)
+      this = call.getArg(i)
+    ) and
     not any(SafeExternalApi safe).getSafeCallable() = callable and
     exists(Value cv | cv = callable.getCallableValue() |
       cv.isAbsent()
@@ -82,8 +86,6 @@ class ExternalApiDataNode extends DataFlow::Node {
       or
       not exists(cv.(CallableValue).getScope().getLocation().getFile().getRelativePath())
     ) and
-    // TODO: this ignores some complexity of keyword arguments (especially keyword-only args)
-    this = call.getArg(i) and
     // Not already modeled as a taint step
     not exists(DataFlow::Node next | TaintTrackingPrivate::defaultAdditionalTaintStep(this, next)) and
     // for `list.append(x)`, we have a additional taint step from x -> [post] list.