python: instantiate module for variable capture

This provides variable capture in standard situations:
- nested functions
- lambdas
There are some deficiencies:
- we do not yet handle objects capturing variables.
- we do not handle variables captured via the `nonlocal` keyword.
  This should be solved at the AST level, though, and then it
  should "just work".

There are still inconsistencies in the case where
a `SynthesizedCaptureNode` has a comprehensions
as its enclosing callable. In this case,
`TFunction(cn.getEnclosingCallable())` is not
defined and so getEnclosingCallable does not exist
for the `CaptureNode`.

python/ql/test/experimental/dataflow/variable-capture/by_value.py

@@ -34,14 +34,14 @@ def by_value1():
     a = SOURCE
     def inner(a_val=a):
         SINK(a_val) #$ captured
-        SINK_F(a)
+        SINK_F(a) #$ SPURIOUS: captured
     a = NONSOURCE
     inner()
 
 def by_value2():
     a = NONSOURCE
     def inner(a_val=a):
-        SINK(a) #$ MISSING:captured
+        SINK(a) #$ captured
         SINK_F(a_val)
     a = SOURCE
     inner()

python/ql/test/experimental/dataflow/variable-capture/dataflow-capture-consistency.expected

@@ -0,0 +1,17 @@
+uniqueToString
+uniqueEnclosingCallable
+uniqueDominator
+localDominator
+localSuccessor
+uniqueDefiningScope
+variableIsCaptured
+uniqueLocation
+uniqueCfgNode
+uniqueWriteTarget
+uniqueWriteCfgNode
+uniqueReadVariable
+closureMustHaveBody
+closureAliasMustBeInSameScope
+variableAccessAstNesting
+uniqueCallableLocation
+consistencyOverview

python/ql/test/experimental/dataflow/variable-capture/dataflow-capture-consistency.ql

@@ -0,0 +1,2 @@
+import python
+import semmle.python.dataflow.new.internal.DataFlowPrivate::VariableCapture::Flow::ConsistencyChecks

python/ql/test/experimental/dataflow/variable-capture/dict.py

@@ -37,7 +37,7 @@ def out():
     def captureOut1():
         sinkO1["x"] = SOURCE
     captureOut1()
-    SINK(sinkO1["x"]) #$ MISSING:captured
+    SINK(sinkO1["x"]) #$ captured
 
     sinkO2 = { "x": "" }
     def captureOut2():
@@ -45,7 +45,7 @@ def out():
             sinkO2["x"] = SOURCE
         m()
     captureOut2()
-    SINK(sinkO2["x"]) #$ MISSING:captured
+    SINK(sinkO2["x"]) #$ captured
 
     nonSink0 = { "x": "" }
     def captureOut1NotCalled():
@@ -67,7 +67,7 @@ def through(tainted):
     def captureOut1():
         sinkO1["x"] = tainted
     captureOut1()
-    SINK(sinkO1["x"]) #$ MISSING:captured
+    SINK(sinkO1["x"]) #$ captured
 
     sinkO2 = { "x": "" }
     def captureOut2():
@@ -75,7 +75,7 @@ def through(tainted):
             sinkO2["x"] = tainted
         m()
     captureOut2()
-    SINK(sinkO2["x"]) #$ MISSING:captured
+    SINK(sinkO2["x"]) #$ captured
 
     nonSink1 = { "x": "" }
     def captureOut1NotCalled():

python/ql/test/experimental/dataflow/variable-capture/global.py

@@ -78,7 +78,7 @@ def through(tainted):
         global sinkT1
         sinkT1 = tainted
     captureOut1()
-    SINK(sinkT1) #$ MISSING:captured
+    SINK(sinkT1) #$ captured
 
     def captureOut2():
         def m():
@@ -86,7 +86,7 @@ def through(tainted):
             sinkT2 = tainted
         m()
     captureOut2()
-    SINK(sinkT2) #$ MISSING:captured
+    SINK(sinkT2) #$ captured
 
     def captureOut1NotCalled():
         global nonSinkT1

python/ql/test/experimental/dataflow/variable-capture/in.py

@@ -34,17 +34,17 @@ def SINK_F(x):
 def inParam(tainted):
     def captureIn1():
         sinkI1 = tainted
-        SINK(sinkI1) #$ MISSING:captured
+        SINK(sinkI1) #$ captured
     captureIn1()
 
     def captureIn2():
         def m():
             sinkI2 = tainted
-            SINK(sinkI2) #$ MISSING:captured
+            SINK(sinkI2) #$ captured
         m()
     captureIn2()
 
-    captureIn3 = lambda arg: SINK(tainted)
+    captureIn3 = lambda arg: SINK(tainted) #$ captured
     captureIn3("")
 
     def captureIn1NotCalled():
@@ -68,17 +68,17 @@ def inLocal():
 
     def captureIn1():
         sinkI1 = tainted
-        SINK(sinkI1) #$ MISSING:captured
+        SINK(sinkI1) #$ captured
     captureIn1()
 
     def captureIn2():
         def m():
             sinkI2 = tainted
-            SINK(sinkI2) #$ MISSING:captured
+            SINK(sinkI2) #$ captured
         m()
     captureIn2()
 
-    captureIn3 = lambda arg: SINK(tainted) #$ MISSING:captured
+    captureIn3 = lambda arg: SINK(tainted) #$ captured
     captureIn3("")
 
     def captureIn1NotCalled():