Python: Replace type tracking with global data-flow

This takes care of most of the false negatives from the preceding
commit.

Additionally, we add models for some known wrappers of `socket.socket`
from the `gevent` and `eventlet` packages.
This commit is contained in:
Taus
2026-03-26 14:53:18 +00:00
parent 1ecd9e83b8
commit c439fc5d45
7 changed files with 44 additions and 43 deletions

View File

@@ -0,0 +1,9 @@
extensions:
- addsTo:
pack: codeql/python-all
extensible: typeModel
data:
# See https://eventlet.readthedocs.io/en/latest/patching.html
- ['socket.socket', 'eventlet', 'Member[green].Member[socket].Member[socket].ReturnValue']
# eventlet also re-exports as eventlet.socket for convenience
- ['socket.socket', 'eventlet', 'Member[socket].Member[socket].ReturnValue']

View File

@@ -0,0 +1,7 @@
extensions:
- addsTo:
pack: codeql/python-all
extensible: typeModel
data:
# See https://www.gevent.org/api/gevent.socket.html
- ['socket.socket', 'gevent', 'Member[socket].Member[socket].ReturnValue']

View File

@@ -27,6 +27,8 @@ extensions:
extensible: sinkModel
data:
- ["zipfile.ZipFile","Member[extractall].Argument[0,path:]", "path-injection"]
# See https://docs.python.org/3/library/socket.html#socket.socket.bind
- ["socket.socket", "Member[bind].Argument[0,address:]", "bind-socket-all-interfaces"]
- addsTo:
pack: codeql/python-all
@@ -184,6 +186,8 @@ extensions:
pack: codeql/python-all
extensible: typeModel
data:
# See https://docs.python.org/3/library/socket.html#socket.socket
- ['socket.socket', 'socket', 'Member[socket].ReturnValue']
# See https://docs.python.org/3/library/urllib.parse.html#urllib.parse.urlparse
- ["urllib.parse.ParseResult~Subclass", 'urllib', 'Member[parse].Member[urlparse]']