hohn/codeql
1
0
Fork 0
mirror of https://github.com/github/codeql.git synced 2026-04-30 19:26:02 +02:00
Code Issues Packages Projects Releases Wiki Activity

Merge pull request #21602 from github/tausbn/python-port-modification-of-locals

Browse Source 
Python: Port ModificationOfLocals.ql
This commit is contained in:
Taus
2026-04-13 13:19:40 +02:00
committed by GitHub
parent 36bbc8ca14 e3688444d7
commit 720ea702fe
2 changed files with 13 additions and 4 deletions
Download Patch File Download Diff File Expand all files Collapse all files

11
python/ql/src/Statements/ModificationOfLocals.ql
View File

@@ -12,10 +12,10 @@
*/ */
import python import python
private import LegacyPointsTo private import semmle.python.ApiGraphs
predicate originIsLocals(ControlFlowNodeWithPointsTo n) { predicate originIsLocals(ControlFlowNode n) {
n.pointsTo(_, _, Value::named("locals").getACall()) API::builtin("locals").getReturn().getAValueReachableFromSource().asCfgNode() = n
} }
predicate modification_of_locals(ControlFlowNode f) { predicate modification_of_locals(ControlFlowNode f) {
@@ -37,5 +37,8 @@ where
// in module level scope `locals() == globals()` // in module level scope `locals() == globals()`
// see https://docs.python.org/3/library/functions.html#locals // see https://docs.python.org/3/library/functions.html#locals
// FP report in https://github.com/github/codeql/issues/6674 // FP report in https://github.com/github/codeql/issues/6674
not a.getScope() instanceof ModuleScope not a.getScope() instanceof Module and
// in class level scope `locals()` reflects the class namespace,
// so modifications do take effect.
not a.getScope() instanceof Class
select a, "Modification of the locals() dictionary will have no effect on the local variables." select a, "Modification of the locals() dictionary will have no effect on the local variables."

6
python/ql/test/query-tests/Statements/general/test.py
View File

@@ -174,3 +174,9 @@ def assert_ok(seq):
# False positive. ODASA-8042. Fixed in PR #2401. # False positive. ODASA-8042. Fixed in PR #2401.
class false_positive: class false_positive:
e = (x for x in []) e = (x for x in [])
# In class-level scope `locals()` reflects the class namespace,
# so modifications do take effect.
class MyClass:
locals()['x'] = 43 # OK
y = x