Python: Modernise the py/non-iterable-in-for-loop query.

Also adds a small test case exhibiting the same false positive seen in
ODASA-8042.

python/ql/src/Statements/NonIteratorInForLoop.ql

@@ -13,11 +13,11 @@
 
 import python
 
-from For loop, ControlFlowNode iter, ClassObject t, ControlFlowNode origin
+from For loop, ControlFlowNode iter, Value v, ClassValue t, ControlFlowNode origin
 where loop.getIter().getAFlowNode() = iter and
-iter.refersTo(_, t, origin) and 
-not t.isIterable() and not t.failedInference() and
-not t = theNoneType() and
+iter.pointsTo(_, v, origin) and v.getClass() = t and
+not t.isIterable() and not t.failedInference(_) and
+not v = Value::named("None") and
 not t.isDescriptorType()
 
 select loop, "$@ of class '$@' may be used in for-loop.", origin, "Non-iterator", t, t.getName()

python/ql/src/semmle/python/objects/ObjectAPI.qll

@@ -346,6 +346,18 @@ class ClassValue extends Value {
         this.(ClassObjectInternal).lookup("__call__", _, _)
     }
 
+    /** Holds if this class is an iterable. */
+    predicate isIterable() {
+        this.hasAttribute("__iter__")
+        or
+        this.hasAttribute("__getitem__")
+    }
+
+    /** Holds if this class is a descriptor. */
+    predicate isDescriptorType() {
+        this.hasAttribute("__get__")
+    }
+
     /** Gets the qualified name for this class.
      * Should return the same name as the `__qualname__` attribute on classes in Python 3.
      */