From a7ba693ccbd050d9d5d9a04dc5fc7b4bebf7b338 Mon Sep 17 00:00:00 2001 From: erik-krogh Date: Thu, 17 Nov 2022 12:44:56 +0100 Subject: [PATCH] Python: delete old deprecations --- .../change-notes/2022-11-17-deleted-deps.md | 7 ++ .../dataflow/new/internal/DataFlowUtil.qll | 64 ---------- .../lib/semmle/python/frameworks/PEP249.qll | 25 ---- .../lib/semmle/python/frameworks/Werkzeug.qll | 115 ------------------ .../python/frameworks/internal/PEP249Impl.qll | 9 -- 5 files changed, 7 insertions(+), 213 deletions(-) create mode 100644 python/ql/lib/change-notes/2022-11-17-deleted-deps.md diff --git a/python/ql/lib/change-notes/2022-11-17-deleted-deps.md b/python/ql/lib/change-notes/2022-11-17-deleted-deps.md new file mode 100644 index 00000000000..6d366b9c114 --- /dev/null +++ b/python/ql/lib/change-notes/2022-11-17-deleted-deps.md @@ -0,0 +1,7 @@ +--- +category: minorAnalysis +--- +* Deleted the deprecated `importNode` predicate from the `DataFlowUtil.qll` file. +* Deleted the deprecated features from `PEP249.qll` that were not inside the `PEP249` module. +* Deleted the deprecated `werkzeug` from the `Werkzeug` module in `Werkzeug.qll`. +* Deleted the deprecated `methodResult` predicate from `PEP249::Cursor`. \ No newline at end of file diff --git a/python/ql/lib/semmle/python/dataflow/new/internal/DataFlowUtil.qll b/python/ql/lib/semmle/python/dataflow/new/internal/DataFlowUtil.qll index fc697d45524..7f1a6464adf 100644 --- a/python/ql/lib/semmle/python/dataflow/new/internal/DataFlowUtil.qll +++ b/python/ql/lib/semmle/python/dataflow/new/internal/DataFlowUtil.qll @@ -26,67 +26,3 @@ predicate localFlowStep(Node nodeFrom, Node nodeTo) { */ pragma[inline] predicate localFlow(Node source, Node sink) { localFlowStep*(source, sink) } - -/** - * DEPRECATED. Use the API graphs library (`semmle.python.ApiGraphs`) instead. - * - * For a drop-in replacement, use `API::moduleImport(name).getAUse()`. - * - * Gets a `Node` that refers to the module referenced by `name`. - * Note that for the statement `import pkg.mod`, the new variable introduced is `pkg` that is a - * reference to the module `pkg`. - * - * This predicate handles (with optional `... as `): - * 1. `import ` - * 2. `from import ` when ` = + "." + ` - * 3. `from import ` when ` = + "." + ` - * - * Finally, in `from import ` we consider the `ImportExpr` corresponding to - * `` to be a reference to that module. - * - * Note: - * While it is technically possible that `import mypkg.foo` and `from mypkg import foo` can give different values, - * it's highly unlikely that this will be a problem in production level code. - * Example: If `mypkg/__init__.py` contains `foo = 42`, then `from mypkg import foo` will not import the module - * `mypkg/foo.py` but the variable `foo` containing `42` -- however, `import mypkg.foo` will always cause `mypkg.foo` - * to refer to the module. - */ -deprecated Node importNode(string name) { - exists(Variable var, Import imp, Alias alias | - alias = imp.getAName() and - alias.getAsname() = var.getAStore() and - ( - name = alias.getValue().(ImportMember).getImportedModuleName() - or - name = alias.getValue().(ImportExpr).getImportedModuleName() - ) and - result.asExpr() = alias.getValue() - ) - or - // Although it may seem superfluous to consider the `foo` part of `from foo import bar as baz` to - // be a reference to a module (since that reference only makes sense locally within the `import` - // statement), it's important for our use of type trackers to consider this local reference to - // also refer to the `foo` module. That way, if one wants to track references to the `bar` - // attribute using a type tracker, one can simply write - // - // ```ql - // DataFlow::Node bar_attr_tracker(TypeTracker t) { - // t.startInAttr("bar") and - // result = foo_module_tracker() - // or - // exists(TypeTracker t2 | result = bar_attr_tracker(t2).track(t2, t)) - // } - // ``` - // - // Where `foo_module_tracker` is a type tracker that tracks references to the `foo` module. - // Because named imports are modeled as `AttrRead`s, the statement `from foo import bar as baz` - // is interpreted as if it was an assignment `baz = foo.bar`, which means `baz` gets tracked as a - // reference to `foo.bar`, as desired. - exists(ImportExpr imp_expr | - imp_expr.getName() = name and - result.asCfgNode().getNode() = imp_expr and - // in `import foo.bar` we DON'T want to give a result for `importNode("foo.bar")`, - // only for `importNode("foo")`. We exclude those cases with the following clause. - not exists(Import imp | imp.getAName().getValue() = imp_expr) - ) -} diff --git a/python/ql/lib/semmle/python/frameworks/PEP249.qll b/python/ql/lib/semmle/python/frameworks/PEP249.qll index 6c4e07cd801..9d09fc4078b 100644 --- a/python/ql/lib/semmle/python/frameworks/PEP249.qll +++ b/python/ql/lib/semmle/python/frameworks/PEP249.qll @@ -9,28 +9,3 @@ private import semmle.python.dataflow.new.RemoteFlowSources private import semmle.python.Concepts private import semmle.python.ApiGraphs import semmle.python.frameworks.internal.PEP249Impl - -/** - * DEPRECATED: Use `PEP249::PEP249ModuleApiNode` instead. - */ -deprecated class PEP249ModuleApiNode = PEP249::PEP249ModuleApiNode; - -/** - * DEPRECATED: Use `PEP249::Connection` instead. - */ -deprecated module Connection = PEP249::Connection; - -/** - * DEPRECATED: Use `PEP249::Cursor` instead. - */ -deprecated module cursor = PEP249::Cursor; - -/** - * DEPRECATED: Use `PEP249::execute` instead. - */ -deprecated predicate execute = PEP249::execute/0; - -/** - * DEPRECATED: Use `PEP249::connect` instead. - */ -deprecated predicate connect = PEP249::connect/0; diff --git a/python/ql/lib/semmle/python/frameworks/Werkzeug.qll b/python/ql/lib/semmle/python/frameworks/Werkzeug.qll index 2867516dcd8..66cea37020e 100644 --- a/python/ql/lib/semmle/python/frameworks/Werkzeug.qll +++ b/python/ql/lib/semmle/python/frameworks/Werkzeug.qll @@ -231,119 +231,4 @@ module Werkzeug { override string getAsyncMethodName() { none() } } } - - import WerkzeugOld -} - -/** - * Old version that contains the deprecated modules. - */ -private module WerkzeugOld { - /** - * DEPRECATED: Use the modeling available directly in the `Werkzeug` module instead. - * - * Provides models for the `werkzeug` module. - */ - deprecated module werkzeug { - /** - * DEPRECATED: Use the modeling available directly in the `Werkzeug` module instead. - * - * Provides models for the `werkzeug.datastructures` module. - */ - deprecated module datastructures { - /** - * DEPRECATED: Use `Werkzeug::MultiDict` instead. - * - * Provides models for the `werkzeug.datastructures.MultiDict` class - * - * See https://werkzeug.palletsprojects.com/en/1.0.x/datastructures/#werkzeug.datastructures.MultiDict. - */ - deprecated module MultiDict { - /** - * DEPRECATED. Use `Werkzeug::MultiDict::InstanceSource` instead. - * - * A source of instances of `werkzeug.datastructures.MultiDict`, extend this class to model new instances. - * - * This can include instantiations of the class, return values from function - * calls, or a special parameter that will be set when functions are called by an external - * library. - * - * Use the predicate `MultiDict::instance()` to get references to instances of `werkzeug.datastructures.MultiDict`. - */ - abstract deprecated class InstanceSourceApiNode extends API::Node { } - - /** - * DEPRECATED - * - * Gets a reference to the `getlist` method on an instance of `werkzeug.datastructures.MultiDict`. - * - * See https://werkzeug.palletsprojects.com/en/1.0.x/datastructures/#werkzeug.datastructures.Headers.getlist - */ - deprecated DataFlow::Node getlist() { - result = any(InstanceSourceApiNode a).getMember("getlist").getAValueReachableFromSource() - } - - private class MultiDictAdditionalTaintStep extends TaintTracking::AdditionalTaintStep { - override predicate step(DataFlow::Node nodeFrom, DataFlow::Node nodeTo) { - // obj -> obj.getlist - exists(DataFlow::AttrRead read | - read.getObject() = nodeFrom and - nodeTo = read and - nodeTo = getlist() - ) - or - // getlist -> getlist() - nodeFrom = getlist() and - nodeTo.(DataFlow::CallCfgNode).getFunction() = nodeFrom - } - } - } - - /** - * DEPRECATED: Use `Werkzeug::FileStorage` instead. - * - * Provides models for the `werkzeug.datastructures.FileStorage` class - * - * See https://werkzeug.palletsprojects.com/en/1.0.x/datastructures/#werkzeug.datastructures.FileStorage. - */ - deprecated module FileStorage { - /** - * DEPRECATED. Use `Werkzeug::FileStorage::InstanceSource` instead. - * - * A source of instances of `werkzeug.datastructures.FileStorage`, extend this class to model new instances. - * - * This can include instantiations of the class, return values from function - * calls, or a special parameter that will be set when functions are called by an external - * library. - * - * Use the predicate `FileStorage::instance()` to get references to instances of `werkzeug.datastructures.FileStorage`. - */ - abstract deprecated class InstanceSourceApiNode extends API::Node { } - - /** Gets a reference to an instance of `werkzeug.datastructures.FileStorage`. */ - deprecated DataFlow::Node instance() { - result = any(InstanceSourceApiNode a).getAValueReachableFromSource() - } - - private class FileStorageAdditionalTaintStep extends TaintTracking::AdditionalTaintStep { - override predicate step(DataFlow::Node nodeFrom, DataFlow::Node nodeTo) { - nodeFrom = instance() and - exists(DataFlow::AttrRead read | nodeTo = read | - read.getAttributeName() in [ - // str - "filename", "name", "content_type", "mimetype", - // file-like - "stream", - // TODO: werkzeug.datastructures.Headers - "headers", - // dict[str, str] - "mimetype_params" - ] and - read.getObject() = nodeFrom - ) - } - } - } - } - } } diff --git a/python/ql/lib/semmle/python/frameworks/internal/PEP249Impl.qll b/python/ql/lib/semmle/python/frameworks/internal/PEP249Impl.qll index bf63bbb3731..538929bd646 100644 --- a/python/ql/lib/semmle/python/frameworks/internal/PEP249Impl.qll +++ b/python/ql/lib/semmle/python/frameworks/internal/PEP249Impl.qll @@ -129,15 +129,6 @@ module PEP249 { or exists(DataFlow::TypeTracker t2 | result = methodResult(t2).track(t2, t)) } - - /** - * DEPRECATED: Use `Cursor::instance()` to get references to database cursors instead. - * - * Gets a reference to a result of calling the `cursor` method on a database connection. - */ - deprecated DataFlow::Node methodResult() { - methodResult(DataFlow::TypeTracker::end()).flowsTo(result) - } } /**