From 987b10ab3e7c731e1d3f709d997ef0c156770e3b Mon Sep 17 00:00:00 2001 From: Taus Date: Tue, 3 Feb 2026 13:39:06 +0000 Subject: [PATCH] Python: Fix bad join in `OutgoingRequestCall` On `keras-team/keras`, this was producing ~200 million intermediate tuples in order to produce a total of ... 2 tuples. After the refactor, max intermediate tuple count is ~80k for the charpred (and 4 for the new helper predicate). --- .../lib/semmle/python/frameworks/Requests.qll | 22 +++++++++++-------- 1 file changed, 13 insertions(+), 9 deletions(-) diff --git a/python/ql/lib/semmle/python/frameworks/Requests.qll b/python/ql/lib/semmle/python/frameworks/Requests.qll index 4c8038787c9..30980d47322 100644 --- a/python/ql/lib/semmle/python/frameworks/Requests.qll +++ b/python/ql/lib/semmle/python/frameworks/Requests.qll @@ -24,6 +24,18 @@ private import semmle.python.frameworks.data.ModelsAsData * - https://requests.readthedocs.io/en/latest/ */ module Requests { + /** Join-order helper for `OutgoingRequestCall`. */ + pragma[nomagic] + private API::Node sessionInstance() { + exists(API::Node moduleExporting | + moduleExporting in [ + API::moduleImport("requests"), // + API::moduleImport("requests").getMember("sessions") + ] and + result = moduleExporting.getMember(["Session", "session"]).getReturn() + ) + } + /** * An outgoing HTTP request, from the `requests` library. * @@ -37,15 +49,7 @@ module Requests { ( this = API::moduleImport("requests").getMember(methodName).getACall() or - exists(API::Node moduleExporting, API::Node sessionInstance | - moduleExporting in [ - API::moduleImport("requests"), // - API::moduleImport("requests").getMember("sessions") - ] and - sessionInstance = moduleExporting.getMember(["Session", "session"]).getReturn() - | - this = sessionInstance.getMember(methodName).getACall() - ) + this = sessionInstance().getMember(methodName).getACall() ) }