Merge pull request #16923 from RasmusWL/impossible-isinstance

Python: Add test for impossible isinstance flow

python/ql/test/library-tests/dataflow/tainttracking/isinstance/InlineTaintTest.expected

@@ -0,0 +1,4 @@
+argumentToEnsureNotTaintedNotMarkedAsSpurious
+untaintedArgumentToEnsureTaintedNotMarkedAsMissing
+testFailures
+failures

python/ql/test/library-tests/dataflow/tainttracking/isinstance/InlineTaintTest.ql

@@ -0,0 +1,2 @@
+import experimental.meta.InlineTaintTest
+import MakeInlineTaintTest<TestTaintTrackingConfig>

python/ql/test/library-tests/dataflow/tainttracking/isinstance/test.py

@@ -0,0 +1,11 @@
+def impossible_flow(cond: bool):
+    TAINTED_STRING = "ts"
+    x = (TAINTED_STRING, 42) if cond else "SAFE"
+
+    if isinstance(x, str):
+        # tainted-flow to here is impossible, replicated from path-flow seen in a real
+        # repo.
+        ensure_not_tainted(x) # $ SPURIOUS: tainted
+    else:
+        ensure_tainted(x) # $ tainted
+        ensure_tainted(x[0]) # $ tainted