hohn/codeql
1
0
Fork 0
mirror of https://github.com/github/codeql.git synced 2026-05-04 13:15:21 +02:00
Code Issues Packages Projects Releases Wiki Activity

Python: Expose importNode instead of importModule/importMember

Browse Source 
Since predicate name `import` is not allowed, I adopted `importNode` as it sort
of matches what `exprNode` does.

---

Due to only using `importMember` in `os_attr` we previously didn't handle
`import os.path as alias` :|

I did creat a hotfix for this (https://github.com/github/codeql/pull/4446), but
in doing so I realized the core of the problem: We're exposing ourselves to
making these kinds of mistakes by having BOTH importModule and importMember, and
we don't really gain anything from doing this!

We do loose the ability to easily only modeling `from mod import val` and not
`import mod.val`, but I don't think that will ever be relevant.

This change will also make us to recognize some invalid code, for example in

    import os.system as runtime_error

we would now model that `runtime_error` is a reference to the `os.system`
function (although the actual import would result in a runtime error).

Overall these are tradeoffs I'm willing to make, as it does makes things simpler
from a QL modeling point of view, and THAT sounds nice 👍
This commit is contained in:
Rasmus Wriedt Larsen
2020-10-09 14:37:23 +02:00
parent 4bfd55f1af
commit 76c9b8c49f
7 changed files with 13 additions and 43 deletions
Download Patch File Download Diff File Expand all files Collapse all files

7
python/ql/test/experimental/dataflow/import-helper/ImportHelper.expected
View File

@@ -1,4 +1,3 @@
importModule
| test1.py:1:8:1:12 | ControlFlowNode for ImportExpr | mypkg |
| test1.py:1:8:1:12 | GSSA Variable mypkg | mypkg |
| test2.py:1:6:1:10 | ControlFlowNode for ImportExpr | mypkg |
@@ -32,9 +31,3 @@ importModule
| test7.py:5:8:5:16 | GSSA Variable mypkg | mypkg |
| test7.py:9:6:9:10 | ControlFlowNode for ImportExpr | mypkg |
| test7.py:9:19:9:21 | GSSA Variable foo | mypkg.foo |
importMember
| test2.py:1:19:1:21 | GSSA Variable foo | mypkg | foo |
| test2.py:1:24:1:26 | GSSA Variable bar | mypkg | bar |
| test5.py:9:26:9:29 | GSSA Variable _bar | mypkg | bar |
| test7.py:1:19:1:21 | GSSA Variable foo | mypkg | foo |
| test7.py:9:19:9:21 | GSSA Variable foo | mypkg | foo |

6
python/ql/test/experimental/dataflow/import-helper/ImportHelper.ql
View File

@@ -1,8 +1,4 @@
import python
import experimental.dataflow.DataFlow
query predicate importModule(DataFlow::Node res, string name) { res = DataFlow::importModule(name) }
query predicate importMember(DataFlow::Node res, string moduleName, string memberName) {
res = DataFlow::importMember(moduleName, memberName)
}
query predicate importNode(DataFlow::Node res, string name) { res = DataFlow::importNode(name) }

2
python/ql/test/experimental/dataflow/tainttracking/defaultAdditionalTaintStep/TestTaint.expected
View File

@@ -140,7 +140,7 @@
| test_string.py:159 | ok | test_os_path_join | os.path.join(..) |
| test_string.py:160 | ok | test_os_path_join | os.path.join(..) |
| test_string.py:161 | ok | test_os_path_join | os.path.join(..) |
| test_string.py:162 | fail | test_os_path_join | ospath_alias.join(..) |
| test_string.py:162 | ok | test_os_path_join | ospath_alias.join(..) |
| test_unpacking.py:16 | ok | unpacking | a |
| test_unpacking.py:16 | ok | unpacking | b |
| test_unpacking.py:16 | ok | unpacking | c |

2
python/ql/test/experimental/dataflow/typetracking/moduleattr.ql
View File

@@ -4,7 +4,7 @@ import experimental.dataflow.TypeTracker
DataFlow::Node module_tracker(TypeTracker t) {
t.start() and
result = DataFlow::importModule("module")
result = DataFlow::importNode("module")
or
exists(TypeTracker t2 | result = module_tracker(t2).track(t2, t))
}