hohn/codeql
1
0
Fork 0
mirror of https://github.com/github/codeql.git synced 2025-12-20 10:46:30 +01:00
Code Issues Packages Projects Releases Wiki Activity

Python: Model builtin open function better

Browse Source
This commit is contained in:
Rasmus Wriedt Larsen
2020-11-24 18:23:30 +01:00
parent 5af1fdd06f
commit e39bb56078
2 changed files with 19 additions and 19 deletions
Download Patch File Download Diff File Expand all files Collapse all files

30
python/ql/src/semmle/python/frameworks/Stdlib.qll
View File

@@ -651,7 +651,7 @@ private module Stdlib {
* WARNING: Only holds for a few predefined attributes.
*/
private DataFlow::Node builtins_attr(DataFlow::TypeTracker t, string attr_name) {
attr_name in ["exec", "eval", "compile"] and
attr_name in ["exec", "eval", "compile", "open"] and
(
t.start() and
result = DataFlow::importNode(["builtins", "__builtin__"] + "." + attr_name)
@@ -729,6 +729,20 @@ private module Stdlib {
}
}
/**
* A call to the builtin `open` function.
* See https://docs.python.org/3/library/functions.html#open
*/
private class OpenCall extends FileSystemAccess::Range, DataFlow::CfgNode {
override CallNode node;
OpenCall() { node.getFunction() = builtins_attr("open").asCfgNode() }
override DataFlow::Node getAPathArgument() {
result.asCfgNode() in [node.getArg(0), node.getArgByName("file")]
}
}
/**
* An exec statement (only Python 2).
* Se ehttps://docs.python.org/2/reference/simple_stmts.html#the-exec-statement.
@@ -743,20 +757,6 @@ private module Stdlib {
override DataFlow::Node getCode() { result = this }
}
/**
* A call to the builtin `open` function.
* See https://docs.python.org/3/library/functions.html#open
*/
private class OpenCall extends FileSystemAccess::Range, DataFlow::CfgNode {
override CallNode node;
OpenCall() { node.getFunction().(NameNode).getId() = "open" }
override DataFlow::Node getAPathArgument() {
result.asCfgNode() in [node.getArg(0), node.getArgByName("file")]
}
}
// ---------------------------------------------------------------------------
// base64
// ---------------------------------------------------------------------------