Merge branch 'github:main' into python_jwt

python/change-notes/2021-11-02-flask_admin.md

@@ -1,2 +0,0 @@
-lgtm,codescanning
-* Added modeling of HTTP requests and responses when using `flask_admin` (`Flask-Admin` PyPI package), which leads to additional remote flow sources.

python/change-notes/2021-11-02-toml.md

@@ -1,2 +0,0 @@
-lgtm,codescanning
-* Added modeling of the PyPI package `toml`, which provides encoding/decoding of TOML documents, leading to new taint-tracking steps.

python/change-notes/2021-11-09-model-aiopg.md

@@ -1,2 +0,0 @@
-lgtm,codescanning
-* Added modeling of `aiopg` for sinks executing SQL.

python/change-notes/2021-11-12-fix-pyhton-query-ids.md

@@ -1,2 +0,0 @@
-lgtm,codescanning
-Fixed the query ids of two queries that are meant for manual exploration: `python/count-untrusted-data-external-api` and `python/untrusted-data-to-external-api` have been changed to `py/count-untrusted-data-external-api` and `py/untrusted-data-to-external-api`.

python/change-notes/2021-11-15-model-wsgiref-simple-server-app.md

@@ -1,2 +0,0 @@
-lgtm,codescanning
-* Added modeling of `wsgiref.simple_server` applications, leading to new remote flow sources.

python/change-notes/2021-11-16-posixpath.md

@@ -1,2 +0,0 @@
-lgtm,codescanning
-* Added modeling of the `posixpath`, `ntpath`, and `genericpath` modules for path operations (although these are not supposed to be used), resulting in new sinks for the _Uncontrolled data used in path expression_ (`py/path-injection`) query.

python/change-notes/2021-11-24-FastAPI-Custom-APIRouter-Subclass.md

@@ -1,2 +0,0 @@
-lgtm,codescanning
-* Extended the modeling of FastAPI such that custom subclasses of `fastapi.APIRouter` are recognized.

python/change-notes/2021-11-24-FastAPI-FileResponse-FileSystemAccess copy.md

@@ -1,2 +0,0 @@
-lgtm,codescanning
-* Extended the modeling of FastAPI such that `fastapi.responses.FileResponse` are considered `FileSystemAccess`, making them sinks for the _Uncontrolled data used in path expression_ (`py/path-injection`) query.

python/change-notes/2021-11-26-os-file-access.md

@@ -1,2 +0,0 @@
-lgtm,codescanning
-* Added modeling of many functions from the `os` module that uses file system paths, such as `os.stat`, `os.chdir`, `os.mkdir`, and so on. All of these are new sinks for the _Uncontrolled data used in path expression_ (`py/path-injection`) query.

python/change-notes/2021-11-26-tempfile-file-access.md

@@ -1,2 +0,0 @@
-lgtm,codescanning
-* Added modeling of the `tempfile` module for creating temporary files and directories, such as the functions `tempfile.NamedTemporaryFile` and `tempfile.TemporaryDirectory`. The `suffix`, `prefix`, and `dir` arguments are all vulnerable to path-injection, and these are new sinks for the _Uncontrolled data used in path expression_ (`py/path-injection`) query.

python/downgrades/503c0516fba2e5da9570f00eb34ef43025ecb8fb/py_exprs.ql

@@ -0,0 +1,42 @@
+// First we need to wrap some database types
+class Location extends @location {
+  /** Gets the start line of this location */
+  int getStartLine() {
+    locations_default(this, _, result, _, _, _) or
+    locations_ast(this, _, result, _, _, _)
+  }
+
+  string toString() { result = "<some file>" + ":" + this.getStartLine().toString() }
+}
+
+class Expr_ extends @py_expr {
+  string toString() { result = "Expr" }
+
+  Location getLocation() { py_locations(result, this) }
+}
+
+class ExprParent_ extends @py_expr_parent {
+  string toString() { result = "ExprParent" }
+}
+
+/**
+ * New kinds have been inserted such that
+ * `@py_Name` which used to have index 18 now has index 19.
+ * Entries with lower indices are unchanged.
+ */
+bindingset[new_index]
+int old_index(int new_index) {
+  if new_index < 18 then result = new_index else result + (19 - 18) = new_index
+}
+
+// The schema for py_exprs is:
+//
+// py_exprs(unique int id : @py_expr,
+//     int kind: int ref,
+//     int parent : @py_expr_parent ref,
+//     int idx : int ref);
+from Expr_ expr, int new_kind, ExprParent_ parent, int idx, int old_kind
+where
+  py_exprs(expr, new_kind, parent, idx) and
+  old_kind = old_index(new_kind)
+select expr, old_kind, parent, idx

python/downgrades/503c0516fba2e5da9570f00eb34ef43025ecb8fb/py_stmts.ql

@@ -0,0 +1,42 @@
+// First we need to wrap some database types
+class Location extends @location {
+  /** Gets the start line of this location */
+  int getStartLine() {
+    locations_default(this, _, result, _, _, _) or
+    locations_ast(this, _, result, _, _, _)
+  }
+
+  string toString() { result = "<some file>" + ":" + this.getStartLine().toString() }
+}
+
+class Stmt_ extends @py_stmt {
+  string toString() { result = "Stmt" }
+
+  Location getLocation() { py_locations(result, this) }
+}
+
+class StmtList_ extends @py_stmt_list {
+  string toString() { result = "StmtList" }
+}
+
+/**
+ * New kinds have been inserted such that
+ * `@py_Nonlocal` which used to have index 14 now has index 16.
+ * Entries with lower indices are unchanged.
+ */
+bindingset[new_index]
+int old_index(int new_index) {
+  if new_index < 14 then result = new_index else result + (16 - 14) = new_index
+}
+
+// The schema for py_stmts is:
+//
+// py_stmts(unique int id : @py_stmt,
+//   int kind: int ref,
+//   int parent : @py_stmt_list ref,
+//   int idx : int ref);
+from Stmt_ expr, int new_kind, StmtList_ parent, int idx, int old_kind
+where
+  py_stmts(expr, new_kind, parent, idx) and
+  old_kind = old_index(new_kind)
+select expr, old_kind, parent, idx

python/downgrades/503c0516fba2e5da9570f00eb34ef43025ecb8fb/upgrade.properties

@@ -0,0 +1,6 @@
+description: Add new statements and expressions for the match syntax.
+compatibility: backwards
+py_exprs.rel: run py_exprs.qlo
+py_stmts.rel: run py_stmts.qlo
+py_patterns.rel: delete
+py_patterns_lists.rel: delete

python/downgrades/initial/semmlecode.python.dbscheme

@@ -0,0 +1,994 @@
+/*
+ *      This dbscheme is auto-generated by 'semmle/dbscheme_gen.py'.
+ *      WARNING: Any modifications to this file will be lost.
+ *      Relations can be changed by modifying master.py or
+ *      by adding rules to dbscheme.template
+ */
+
+/* This is a dummy line to alter the dbscheme, so we can make a database upgrade
+ * without actually changing any of the dbscheme predicates. It contains a date
+ * to allow for such updates in the future as well.
+ *
+ * 2020-07-02
+ *
+ * DO NOT remove this comment carelessly, since it can revert the dbscheme back to a
+ * previously seen state (matching a previously seen SHA), which would make the upgrade
+ * mechanism not work properly.
+ */
+
+ /*
+ * External artifacts
+ */
+
+externalDefects(
+  unique int id : @externalDefect,
+  varchar(900) queryPath : string ref,
+  int location : @location ref,
+  varchar(900) message : string ref,
+  float severity : float ref
+);
+
+externalMetrics(
+  unique int id : @externalMetric,
+  varchar(900) queryPath : string ref,
+  int location : @location ref,
+  float value : float ref
+);
+
+externalData(
+  int id : @externalDataElement,
+  varchar(900) queryPath : string ref,
+  int column: int ref,
+  varchar(900) data : string ref
+);
+
+snapshotDate(unique date snapshotDate : date ref);
+
+sourceLocationPrefix(varchar(900) prefix : string ref);
+
+
+/*
+ * Duplicate code
+ */
+
+duplicateCode(
+  unique int id : @duplication,
+  varchar(900) relativePath : string ref,
+  int equivClass : int ref);
+
+similarCode(
+  unique int id : @similarity,
+  varchar(900) relativePath : string ref,
+  int equivClass : int ref);
+
+@duplication_or_similarity = @duplication | @similarity
+
+tokens(
+  int id : @duplication_or_similarity ref,
+  int offset : int ref,
+  int beginLine : int ref,
+  int beginColumn : int ref,
+  int endLine : int ref,
+  int endColumn : int ref);
+
+/*
+ * Line metrics
+ */
+py_codelines(int id : @py_scope ref,
+             int count : int ref);
+
+py_commentlines(int id : @py_scope ref,
+                int count : int ref);
+
+py_docstringlines(int id : @py_scope ref,
+                int count : int ref);
+
+py_alllines(int id : @py_scope ref,
+                int count : int ref);
+
+/*
+ * Version history
+ */
+
+svnentries(
+  int id : @svnentry,
+  varchar(500) revision : string ref,
+  varchar(500) author : string ref,
+  date revisionDate : date ref,
+  int changeSize : int ref
+)
+
+svnaffectedfiles(
+  int id : @svnentry ref,
+  int file : @file ref,
+  varchar(500) action : string ref
+)
+
+svnentrymsg(
+  int id : @svnentry ref,
+  varchar(500) message : string ref
+)
+
+svnchurn(
+  int commit : @svnentry ref,
+  int file : @file ref,
+  int addedLines : int ref,
+  int deletedLines : int ref
+)
+
+/****************************
+        Python dbscheme
+****************************/
+
+files(unique int id: @file,
+      varchar(900) name: string ref);
+
+folders(unique int id: @folder,
+        varchar(900) name: string ref);
+
+@container = @folder | @file;
+
+containerparent(int parent: @container ref,
+                unique int child: @container ref);
+
+@sourceline = @file | @py_Module | @xmllocatable;
+
+numlines(int element_id: @sourceline ref,
+         int num_lines: int ref,
+         int num_code: int ref,
+         int num_comment: int ref
+        );
+
+@location = @location_ast | @location_default ;
+
+locations_default(unique int id: @location_default,
+          int file: @file ref,
+          int beginLine: int ref,
+          int beginColumn: int ref,
+          int endLine: int ref,
+          int endColumn: int ref);
+
+locations_ast(unique int id: @location_ast,
+          int module: @py_Module ref,
+          int beginLine: int ref,
+          int beginColumn: int ref,
+          int endLine: int ref,
+          int endColumn: int ref);
+
+file_contents(unique int file: @file ref, string contents: string ref);
+
+py_module_path(int module: @py_Module ref, int file: @container ref);
+
+variable(unique int id : @py_variable,
+         int scope : @py_scope ref,
+         varchar(1) name : string ref);
+
+py_line_lengths(unique int id : @py_line,
+                int file: @py_Module ref,
+                int line : int ref,
+                int length : int ref);
+
+py_extracted_version(int module : @py_Module ref,
+                     varchar(1) version : string ref);
+
+/* AUTO GENERATED PART STARTS HERE */
+
+
+/* <Field> AnnAssign.location = 0, location */
+/* <Field> AnnAssign.value = 1, expr */
+/* <Field> AnnAssign.annotation = 2, expr */
+/* <Field> AnnAssign.target = 3, expr */
+
+/* <Field> Assert.location = 0, location */
+/* <Field> Assert.test = 1, expr */
+/* <Field> Assert.msg = 2, expr */
+
+/* <Field> Assign.location = 0, location */
+/* <Field> Assign.value = 1, expr */
+/* <Field> Assign.targets = 2, expr_list */
+
+/* <Field> AssignExpr.location = 0, location */
+/* <Field> AssignExpr.parenthesised = 1, bool */
+/* <Field> AssignExpr.value = 2, expr */
+/* <Field> AssignExpr.target = 3, expr */
+
+/* <Field> Attribute.location = 0, location */
+/* <Field> Attribute.parenthesised = 1, bool */
+/* <Field> Attribute.value = 2, expr */
+/* <Field> Attribute.attr = 3, str */
+/* <Field> Attribute.ctx = 4, expr_context */
+
+/* <Field> AugAssign.location = 0, location */
+/* <Field> AugAssign.operation = 1, BinOp */
+
+/* <Field> Await.location = 0, location */
+/* <Field> Await.parenthesised = 1, bool */
+/* <Field> Await.value = 2, expr */
+
+/* <Field> BinaryExpr.location = 0, location */
+/* <Field> BinaryExpr.parenthesised = 1, bool */
+/* <Field> BinaryExpr.left = 2, expr */
+/* <Field> BinaryExpr.op = 3, operator */
+/* <Field> BinaryExpr.right = 4, expr */
+/* <Parent> BinaryExpr = AugAssign  */
+
+/* <Field> BoolExpr.location = 0, location */
+/* <Field> BoolExpr.parenthesised = 1, bool */
+/* <Field> BoolExpr.op = 2, boolop */
+/* <Field> BoolExpr.values = 3, expr_list */
+
+/* <Field> Break.location = 0, location */
+
+/* <Field> Bytes.location = 0, location */
+/* <Field> Bytes.parenthesised = 1, bool */
+/* <Field> Bytes.s = 2, bytes */
+/* <Field> Bytes.prefix = 3, bytes */
+/* <Field> Bytes.implicitly_concatenated_parts = 4, StringPart_list */
+
+/* <Field> Call.location = 0, location */
+/* <Field> Call.parenthesised = 1, bool */
+/* <Field> Call.func = 2, expr */
+/* <Field> Call.positional_args = 3, expr_list */
+/* <Field> Call.named_args = 4, dict_item_list */
+
+/* <Field> Class.name = 0, str */
+/* <Field> Class.body = 1, stmt_list */
+/* <Parent> Class = ClassExpr  */
+
+/* <Field> ClassExpr.location = 0, location */
+/* <Field> ClassExpr.parenthesised = 1, bool */
+/* <Field> ClassExpr.name = 2, str */
+/* <Field> ClassExpr.bases = 3, expr_list */
+/* <Field> ClassExpr.keywords = 4, dict_item_list */
+/* <Field> ClassExpr.inner_scope = 5, Class */
+
+/* <Field> Compare.location = 0, location */
+/* <Field> Compare.parenthesised = 1, bool */
+/* <Field> Compare.left = 2, expr */
+/* <Field> Compare.ops = 3, cmpop_list */
+/* <Field> Compare.comparators = 4, expr_list */
+
+/* <Field> Continue.location = 0, location */
+
+/* <Field> Delete.location = 0, location */
+/* <Field> Delete.targets = 1, expr_list */
+
+/* <Field> Dict.location = 0, location */
+/* <Field> Dict.parenthesised = 1, bool */
+/* <Field> Dict.items = 2, dict_item_list */
+
+/* <Field> DictComp.location = 0, location */
+/* <Field> DictComp.parenthesised = 1, bool */
+/* <Field> DictComp.function = 2, Function */
+/* <Field> DictComp.iterable = 3, expr */
+
+/* <Field> DictUnpacking.location = 0, location */
+/* <Field> DictUnpacking.value = 1, expr */
+
+/* <Field> Ellipsis.location = 0, location */
+/* <Field> Ellipsis.parenthesised = 1, bool */
+
+/* <Field> ExceptStmt.location = 0, location */
+/* <Field> ExceptStmt.type = 1, expr */
+/* <Field> ExceptStmt.name = 2, expr */
+/* <Field> ExceptStmt.body = 3, stmt_list */
+
+/* <Field> Exec.location = 0, location */
+/* <Field> Exec.body = 1, expr */
+/* <Field> Exec.globals = 2, expr */
+/* <Field> Exec.locals = 3, expr */
+
+/* <Field> ExprStmt.location = 0, location */
+/* <Field> ExprStmt.value = 1, expr */
+
+/* <Field> Filter.location = 0, location */
+/* <Field> Filter.parenthesised = 1, bool */
+/* <Field> Filter.value = 2, expr */
+/* <Field> Filter.filter = 3, expr */
+
+/* <Field> For.location = 0, location */
+/* <Field> For.target = 1, expr */
+/* <Field> For.iter = 2, expr */
+/* <Field> For.body = 3, stmt_list */
+/* <Field> For.orelse = 4, stmt_list */
+/* <Field> For.is_async = 5, bool */
+
+/* <Field> FormattedValue.location = 0, location */
+/* <Field> FormattedValue.parenthesised = 1, bool */
+/* <Field> FormattedValue.value = 2, expr */
+/* <Field> FormattedValue.conversion = 3, str */
+/* <Field> FormattedValue.format_spec = 4, JoinedStr */
+
+/* <Field> Function.name = 0, str */
+/* <Field> Function.args = 1, parameter_list */
+/* <Field> Function.vararg = 2, expr */
+/* <Field> Function.kwonlyargs = 3, expr_list */
+/* <Field> Function.kwarg = 4, expr */
+/* <Field> Function.body = 5, stmt_list */
+/* <Field> Function.is_async = 6, bool */
+/* <Parent> Function = FunctionParent  */
+
+/* <Field> FunctionExpr.location = 0, location */
+/* <Field> FunctionExpr.parenthesised = 1, bool */
+/* <Field> FunctionExpr.name = 2, str */
+/* <Field> FunctionExpr.args = 3, arguments */
+/* <Field> FunctionExpr.returns = 4, expr */
+/* <Field> FunctionExpr.inner_scope = 5, Function */
+
+/* <Field> GeneratorExp.location = 0, location */
+/* <Field> GeneratorExp.parenthesised = 1, bool */
+/* <Field> GeneratorExp.function = 2, Function */
+/* <Field> GeneratorExp.iterable = 3, expr */
+
+/* <Field> Global.location = 0, location */
+/* <Field> Global.names = 1, str_list */
+
+/* <Field> If.location = 0, location */
+/* <Field> If.test = 1, expr */
+/* <Field> If.body = 2, stmt_list */
+/* <Field> If.orelse = 3, stmt_list */
+
+/* <Field> IfExp.location = 0, location */
+/* <Field> IfExp.parenthesised = 1, bool */
+/* <Field> IfExp.test = 2, expr */
+/* <Field> IfExp.body = 3, expr */
+/* <Field> IfExp.orelse = 4, expr */
+
+/* <Field> Import.location = 0, location */
+/* <Field> Import.names = 1, alias_list */
+
+/* <Field> ImportExpr.location = 0, location */
+/* <Field> ImportExpr.parenthesised = 1, bool */
+/* <Field> ImportExpr.level = 2, int */
+/* <Field> ImportExpr.name = 3, str */
+/* <Field> ImportExpr.top = 4, bool */
+
+/* <Field> ImportStar.location = 0, location */
+/* <Field> ImportStar.module = 1, expr */
+
+/* <Field> ImportMember.location = 0, location */
+/* <Field> ImportMember.parenthesised = 1, bool */
+/* <Field> ImportMember.module = 2, expr */
+/* <Field> ImportMember.name = 3, str */
+
+/* <Field> Fstring.location = 0, location */
+/* <Field> Fstring.parenthesised = 1, bool */
+/* <Field> Fstring.values = 2, expr_list */
+/* <Parent> Fstring = FormattedValue  */
+
+/* <Field> KeyValuePair.location = 0, location */
+/* <Field> KeyValuePair.value = 1, expr */
+/* <Field> KeyValuePair.key = 2, expr */
+
+/* <Field> Lambda.location = 0, location */
+/* <Field> Lambda.parenthesised = 1, bool */
+/* <Field> Lambda.args = 2, arguments */
+/* <Field> Lambda.inner_scope = 3, Function */
+
+/* <Field> List.location = 0, location */
+/* <Field> List.parenthesised = 1, bool */
+/* <Field> List.elts = 2, expr_list */
+/* <Field> List.ctx = 3, expr_context */
+
+/* <Field> ListComp.location = 0, location */
+/* <Field> ListComp.parenthesised = 1, bool */
+/* <Field> ListComp.function = 2, Function */
+/* <Field> ListComp.iterable = 3, expr */
+/* <Field> ListComp.generators = 4, comprehension_list */
+/* <Field> ListComp.elt = 5, expr */
+
+/* <Field> Module.name = 0, str */
+/* <Field> Module.hash = 1, str */
+/* <Field> Module.body = 2, stmt_list */
+/* <Field> Module.kind = 3, str */
+
+/* <Field> Name.location = 0, location */
+/* <Field> Name.parenthesised = 1, bool */
+/* <Field> Name.variable = 2, variable */
+/* <Field> Name.ctx = 3, expr_context */
+/* <Parent> Name = ParameterList  */
+
+/* <Field> Nonlocal.location = 0, location */
+/* <Field> Nonlocal.names = 1, str_list */
+
+/* <Field> Num.location = 0, location */
+/* <Field> Num.parenthesised = 1, bool */
+/* <Field> Num.n = 2, number */
+/* <Field> Num.text = 3, number */
+
+/* <Field> Pass.location = 0, location */
+
+/* <Field> PlaceHolder.location = 0, location */
+/* <Field> PlaceHolder.parenthesised = 1, bool */
+/* <Field> PlaceHolder.variable = 2, variable */
+/* <Field> PlaceHolder.ctx = 3, expr_context */
+
+/* <Field> Print.location = 0, location */
+/* <Field> Print.dest = 1, expr */
+/* <Field> Print.values = 2, expr_list */
+/* <Field> Print.nl = 3, bool */
+
+/* <Field> Raise.location = 0, location */
+/* <Field> Raise.exc = 1, expr */
+/* <Field> Raise.cause = 2, expr */
+/* <Field> Raise.type = 3, expr */
+/* <Field> Raise.inst = 4, expr */
+/* <Field> Raise.tback = 5, expr */
+
+/* <Field> Repr.location = 0, location */
+/* <Field> Repr.parenthesised = 1, bool */
+/* <Field> Repr.value = 2, expr */
+
+/* <Field> Return.location = 0, location */
+/* <Field> Return.value = 1, expr */
+
+/* <Field> Set.location = 0, location */
+/* <Field> Set.parenthesised = 1, bool */
+/* <Field> Set.elts = 2, expr_list */
+
+/* <Field> SetComp.location = 0, location */
+/* <Field> SetComp.parenthesised = 1, bool */
+/* <Field> SetComp.function = 2, Function */
+/* <Field> SetComp.iterable = 3, expr */
+
+/* <Field> Slice.location = 0, location */
+/* <Field> Slice.parenthesised = 1, bool */
+/* <Field> Slice.start = 2, expr */
+/* <Field> Slice.stop = 3, expr */
+/* <Field> Slice.step = 4, expr */
+
+/* <Field> SpecialOperation.location = 0, location */
+/* <Field> SpecialOperation.parenthesised = 1, bool */
+/* <Field> SpecialOperation.name = 2, str */
+/* <Field> SpecialOperation.arguments = 3, expr_list */
+
+/* <Field> Starred.location = 0, location */
+/* <Field> Starred.parenthesised = 1, bool */
+/* <Field> Starred.value = 2, expr */
+/* <Field> Starred.ctx = 3, expr_context */
+
+/* <Field> Str.location = 0, location */
+/* <Field> Str.parenthesised = 1, bool */
+/* <Field> Str.s = 2, str */
+/* <Field> Str.prefix = 3, str */
+/* <Field> Str.implicitly_concatenated_parts = 4, StringPart_list */
+
+/* <Field> StringPart.text = 0, str */
+/* <Field> StringPart.location = 1, location */
+/* <Parent> StringPart = StringPartList  */
+/* <Parent> StringPartList = BytesOrStr  */
+
+/* <Field> Subscript.location = 0, location */
+/* <Field> Subscript.parenthesised = 1, bool */
+/* <Field> Subscript.value = 2, expr */
+/* <Field> Subscript.index = 3, expr */
+/* <Field> Subscript.ctx = 4, expr_context */
+
+/* <Field> TemplateDottedNotation.location = 0, location */
+/* <Field> TemplateDottedNotation.parenthesised = 1, bool */
+/* <Field> TemplateDottedNotation.value = 2, expr */
+/* <Field> TemplateDottedNotation.attr = 3, str */
+/* <Field> TemplateDottedNotation.ctx = 4, expr_context */
+
+/* <Field> TemplateWrite.location = 0, location */
+/* <Field> TemplateWrite.value = 1, expr */
+
+/* <Field> Try.location = 0, location */
+/* <Field> Try.body = 1, stmt_list */
+/* <Field> Try.orelse = 2, stmt_list */
+/* <Field> Try.handlers = 3, stmt_list */
+/* <Field> Try.finalbody = 4, stmt_list */
+
+/* <Field> Tuple.location = 0, location */
+/* <Field> Tuple.parenthesised = 1, bool */
+/* <Field> Tuple.elts = 2, expr_list */
+/* <Field> Tuple.ctx = 3, expr_context */
+/* <Parent> Tuple = ParameterList  */
+
+/* <Field> UnaryExpr.location = 0, location */
+/* <Field> UnaryExpr.parenthesised = 1, bool */
+/* <Field> UnaryExpr.op = 2, unaryop */
+/* <Field> UnaryExpr.operand = 3, expr */
+
+/* <Field> While.location = 0, location */
+/* <Field> While.test = 1, expr */
+/* <Field> While.body = 2, stmt_list */
+/* <Field> While.orelse = 3, stmt_list */
+
+/* <Field> With.location = 0, location */
+/* <Field> With.context_expr = 1, expr */
+/* <Field> With.optional_vars = 2, expr */
+/* <Field> With.body = 3, stmt_list */
+/* <Field> With.is_async = 4, bool */
+
+/* <Field> Yield.location = 0, location */
+/* <Field> Yield.parenthesised = 1, bool */
+/* <Field> Yield.value = 2, expr */
+
+/* <Field> YieldFrom.location = 0, location */
+/* <Field> YieldFrom.parenthesised = 1, bool */
+/* <Field> YieldFrom.value = 2, expr */
+
+/* <Field> Alias.value = 0, expr */
+/* <Field> Alias.asname = 1, expr */
+/* <Parent> Alias = AliasList  */
+/* <Parent> AliasList = Import  */
+
+/* <Field> Arguments.kw_defaults = 0, expr_list */
+/* <Field> Arguments.defaults = 1, expr_list */
+/* <Field> Arguments.annotations = 2, expr_list */
+/* <Field> Arguments.varargannotation = 3, expr */
+/* <Field> Arguments.kwargannotation = 4, expr */
+/* <Field> Arguments.kw_annotations = 5, expr_list */
+/* <Parent> Arguments = ArgumentsParent  */
+/* <Parent> boolean = BoolParent  */
+/* <Parent> Boolop = BoolExpr  */
+/* <Parent> string = Bytes  */
+/* <Parent> Cmpop = CmpopList  */
+/* <Parent> CmpopList = Compare  */
+
+/* <Field> Comprehension.location = 0, location */
+/* <Field> Comprehension.iter = 1, expr */
+/* <Field> Comprehension.target = 2, expr */
+/* <Field> Comprehension.ifs = 3, expr_list */
+/* <Parent> Comprehension = ComprehensionList  */
+/* <Parent> ComprehensionList = ListComp  */
+/* <Parent> DictItem = DictItemList  */
+/* <Parent> DictItemList = DictItemListParent  */
+
+/* <Field> Expr.location = 0, location */
+/* <Field> Expr.parenthesised = 1, bool */
+/* <Parent> Expr = ExprParent  */
+/* <Parent> ExprContext = ExprContextParent  */
+/* <Parent> ExprList = ExprListParent  */
+/* <Parent> int = ImportExpr  */
+
+/* <Field> Keyword.location = 0, location */
+/* <Field> Keyword.value = 1, expr */
+/* <Field> Keyword.arg = 2, str */
+/* <Parent> Location = LocationParent  */
+/* <Parent> string = Num  */
+/* <Parent> Operator = BinaryExpr  */
+/* <Parent> ParameterList = Function  */
+
+/* <Field> Stmt.location = 0, location */
+/* <Parent> Stmt = StmtList  */
+/* <Parent> StmtList = StmtListParent  */
+/* <Parent> string = StrParent  */
+/* <Parent> StringList = StrListParent  */
+/* <Parent> Unaryop = UnaryExpr  */
+/* <Parent> Variable = VariableParent  */
+py_Classes(unique int id : @py_Class,
+    unique int parent : @py_ClassExpr ref);
+
+py_Functions(unique int id : @py_Function,
+    unique int parent : @py_Function_parent ref);
+
+py_Modules(unique int id : @py_Module);
+
+py_StringParts(unique int id : @py_StringPart,
+    int parent : @py_StringPart_list ref,
+    int idx : int ref);
+
+py_StringPart_lists(unique int id : @py_StringPart_list,
+    unique int parent : @py_Bytes_or_Str ref);
+
+py_aliases(unique int id : @py_alias,
+    int parent : @py_alias_list ref,
+    int idx : int ref);
+
+py_alias_lists(unique int id : @py_alias_list,
+    unique int parent : @py_Import ref);
+
+py_arguments(unique int id : @py_arguments,
+    unique int parent : @py_arguments_parent ref);
+
+py_bools(int parent : @py_bool_parent ref,
+    int idx : int ref);
+
+py_boolops(unique int id : @py_boolop,
+    int kind: int ref,
+    unique int parent : @py_BoolExpr ref);
+
+py_bytes(varchar(1) id : string ref,
+    int parent : @py_Bytes ref,
+    int idx : int ref);
+
+py_cmpops(unique int id : @py_cmpop,
+    int kind: int ref,
+    int parent : @py_cmpop_list ref,
+    int idx : int ref);
+
+py_cmpop_lists(unique int id : @py_cmpop_list,
+    unique int parent : @py_Compare ref);
+
+py_comprehensions(unique int id : @py_comprehension,
+    int parent : @py_comprehension_list ref,
+    int idx : int ref);
+
+py_comprehension_lists(unique int id : @py_comprehension_list,
+    unique int parent : @py_ListComp ref);
+
+py_dict_items(unique int id : @py_dict_item,
+    int kind: int ref,
+    int parent : @py_dict_item_list ref,
+    int idx : int ref);
+
+py_dict_item_lists(unique int id : @py_dict_item_list,
+    unique int parent : @py_dict_item_list_parent ref);
+
+py_exprs(unique int id : @py_expr,
+    int kind: int ref,
+    int parent : @py_expr_parent ref,
+    int idx : int ref);
+
+py_expr_contexts(unique int id : @py_expr_context,
+    int kind: int ref,
+    unique int parent : @py_expr_context_parent ref);
+
+py_expr_lists(unique int id : @py_expr_list,
+    int parent : @py_expr_list_parent ref,
+    int idx : int ref);
+
+py_ints(int id : int ref,
+    unique int parent : @py_ImportExpr ref);
+
+py_locations(unique int id : @location ref,
+    unique int parent : @py_location_parent ref);
+
+py_numbers(varchar(1) id : string ref,
+    int parent : @py_Num ref,
+    int idx : int ref);
+
+py_operators(unique int id : @py_operator,
+    int kind: int ref,
+    unique int parent : @py_BinaryExpr ref);
+
+py_parameter_lists(unique int id : @py_parameter_list,
+    unique int parent : @py_Function ref);
+
+py_stmts(unique int id : @py_stmt,
+    int kind: int ref,
+    int parent : @py_stmt_list ref,
+    int idx : int ref);
+
+py_stmt_lists(unique int id : @py_stmt_list,
+    int parent : @py_stmt_list_parent ref,
+    int idx : int ref);
+
+py_strs(varchar(1) id : string ref,
+    int parent : @py_str_parent ref,
+    int idx : int ref);
+
+py_str_lists(unique int id : @py_str_list,
+    unique int parent : @py_str_list_parent ref);
+
+py_unaryops(unique int id : @py_unaryop,
+    int kind: int ref,
+    unique int parent : @py_UnaryExpr ref);
+
+py_variables(int id : @py_variable ref,
+    unique int parent : @py_variable_parent ref);
+
+case @py_boolop.kind of
+    0 = @py_And
+|   1 = @py_Or;
+
+case @py_cmpop.kind of
+    0 = @py_Eq
+|   1 = @py_Gt
+|   2 = @py_GtE
+|   3 = @py_In
+|   4 = @py_Is
+|   5 = @py_IsNot
+|   6 = @py_Lt
+|   7 = @py_LtE
+|   8 = @py_NotEq
+|   9 = @py_NotIn;
+
+case @py_dict_item.kind of
+    0 = @py_DictUnpacking
+|   1 = @py_KeyValuePair
+|   2 = @py_keyword;
+
+case @py_expr.kind of
+    0 = @py_Attribute
+|   1 = @py_BinaryExpr
+|   2 = @py_BoolExpr
+|   3 = @py_Bytes
+|   4 = @py_Call
+|   5 = @py_ClassExpr
+|   6 = @py_Compare
+|   7 = @py_Dict
+|   8 = @py_DictComp
+|   9 = @py_Ellipsis
+|   10 = @py_FunctionExpr
+|   11 = @py_GeneratorExp
+|   12 = @py_IfExp
+|   13 = @py_ImportExpr
+|   14 = @py_ImportMember
+|   15 = @py_Lambda
+|   16 = @py_List
+|   17 = @py_ListComp
+|   18 = @py_Name
+|   19 = @py_Num
+|   20 = @py_Repr
+|   21 = @py_Set
+|   22 = @py_SetComp
+|   23 = @py_Slice
+|   24 = @py_Starred
+|   25 = @py_Str
+|   26 = @py_Subscript
+|   27 = @py_Tuple
+|   28 = @py_UnaryExpr
+|   29 = @py_Yield
+|   30 = @py_YieldFrom
+|   31 = @py_TemplateDottedNotation
+|   32 = @py_Filter
+|   33 = @py_PlaceHolder
+|   34 = @py_Await
+|   35 = @py_Fstring
+|   36 = @py_FormattedValue
+|   37 = @py_AssignExpr
+|   38 = @py_SpecialOperation;
+
+case @py_expr_context.kind of
+    0 = @py_AugLoad
+|   1 = @py_AugStore
+|   2 = @py_Del
+|   3 = @py_Load
+|   4 = @py_Param
+|   5 = @py_Store;
+
+case @py_operator.kind of
+    0 = @py_Add
+|   1 = @py_BitAnd
+|   2 = @py_BitOr
+|   3 = @py_BitXor
+|   4 = @py_Div
+|   5 = @py_FloorDiv
+|   6 = @py_LShift
+|   7 = @py_Mod
+|   8 = @py_Mult
+|   9 = @py_Pow
+|   10 = @py_RShift
+|   11 = @py_Sub
+|   12 = @py_MatMult;
+
+case @py_stmt.kind of
+    0 = @py_Assert
+|   1 = @py_Assign
+|   2 = @py_AugAssign
+|   3 = @py_Break
+|   4 = @py_Continue
+|   5 = @py_Delete
+|   6 = @py_ExceptStmt
+|   7 = @py_Exec
+|   8 = @py_Expr_stmt
+|   9 = @py_For
+|   10 = @py_Global
+|   11 = @py_If
+|   12 = @py_Import
+|   13 = @py_ImportStar
+|   14 = @py_Nonlocal
+|   15 = @py_Pass
+|   16 = @py_Print
+|   17 = @py_Raise
+|   18 = @py_Return
+|   19 = @py_Try
+|   20 = @py_While
+|   21 = @py_With
+|   22 = @py_TemplateWrite
+|   23 = @py_AnnAssign;
+
+case @py_unaryop.kind of
+    0 = @py_Invert
+|   1 = @py_Not
+|   2 = @py_UAdd
+|   3 = @py_USub;
+
+@py_Bytes_or_Str = @py_Bytes | @py_Str;
+
+@py_Function_parent = @py_DictComp | @py_FunctionExpr | @py_GeneratorExp | @py_Lambda | @py_ListComp | @py_SetComp;
+
+@py_arguments_parent = @py_FunctionExpr | @py_Lambda;
+
+@py_ast_node = @py_Class | @py_Function | @py_Module | @py_StringPart | @py_comprehension | @py_dict_item | @py_expr | @py_stmt;
+
+@py_bool_parent = @py_For | @py_Function | @py_Print | @py_With | @py_expr;
+
+@py_dict_item_list_parent = @py_Call | @py_ClassExpr | @py_Dict;
+
+@py_expr_context_parent = @py_Attribute | @py_List | @py_Name | @py_PlaceHolder | @py_Starred | @py_Subscript | @py_TemplateDottedNotation | @py_Tuple;
+
+@py_expr_list_parent = @py_Assign | @py_BoolExpr | @py_Call | @py_ClassExpr | @py_Compare | @py_Delete | @py_Fstring | @py_Function | @py_List | @py_Print | @py_Set | @py_SpecialOperation | @py_Tuple | @py_arguments | @py_comprehension;
+
+@py_expr_or_stmt = @py_expr | @py_stmt;
+
+@py_expr_parent = @py_AnnAssign | @py_Assert | @py_Assign | @py_AssignExpr | @py_Attribute | @py_AugAssign | @py_Await | @py_BinaryExpr | @py_Call | @py_Compare | @py_DictComp | @py_DictUnpacking | @py_ExceptStmt | @py_Exec | @py_Expr_stmt | @py_Filter | @py_For | @py_FormattedValue | @py_Function | @py_FunctionExpr | @py_GeneratorExp | @py_If | @py_IfExp | @py_ImportMember | @py_ImportStar | @py_KeyValuePair | @py_ListComp | @py_Print | @py_Raise | @py_Repr | @py_Return | @py_SetComp | @py_Slice | @py_Starred | @py_Subscript | @py_TemplateDottedNotation | @py_TemplateWrite | @py_UnaryExpr | @py_While | @py_With | @py_Yield | @py_YieldFrom | @py_alias | @py_arguments | @py_comprehension | @py_expr_list | @py_keyword | @py_parameter_list;
+
+@py_location_parent = @py_DictUnpacking | @py_KeyValuePair | @py_StringPart | @py_comprehension | @py_expr | @py_keyword | @py_stmt;
+
+@py_parameter = @py_Name | @py_Tuple;
+
+@py_scope = @py_Class | @py_Function | @py_Module;
+
+@py_stmt_list_parent = @py_Class | @py_ExceptStmt | @py_For | @py_Function | @py_If | @py_Module | @py_Try | @py_While | @py_With;
+
+@py_str_list_parent = @py_Global | @py_Nonlocal;
+
+@py_str_parent = @py_Attribute | @py_Class | @py_ClassExpr | @py_FormattedValue | @py_Function | @py_FunctionExpr | @py_ImportExpr | @py_ImportMember | @py_Module | @py_SpecialOperation | @py_Str | @py_StringPart | @py_TemplateDottedNotation | @py_keyword | @py_str_list;
+
+@py_variable_parent = @py_Name | @py_PlaceHolder;
+
+
+/*
+ * End of auto-generated part
+ */
+
+
+
+/* Map relative names to absolute names for imports */
+py_absolute_names(int module : @py_Module ref,
+                  varchar(1) relname : string ref,
+                  varchar(1) absname : string ref);
+
+py_exports(int id : @py_Module ref,
+           varchar(1) name : string ref);
+
+/* Successor information */
+py_successors(int predecessor : @py_flow_node ref,
+              int successor : @py_flow_node ref);
+
+py_true_successors(int predecessor : @py_flow_node ref,
+              int successor : @py_flow_node ref);
+
+py_exception_successors(int predecessor : @py_flow_node ref,
+              int successor : @py_flow_node ref);
+
+py_false_successors(int predecessor : @py_flow_node ref,
+              int successor : @py_flow_node ref);
+
+py_flow_bb_node(unique int flownode : @py_flow_node,
+             int realnode : @py_ast_node ref,
+             int basicblock : @py_flow_node ref,
+             int index : int ref);
+
+py_scope_flow(int flow : @py_flow_node ref,
+              int scope : @py_scope ref,
+              int kind : int ref);
+
+py_idoms(unique int node : @py_flow_node ref,
+         int immediate_dominator : @py_flow_node ref);
+
+py_ssa_phi(int phi : @py_ssa_var ref,
+           int arg: @py_ssa_var ref);
+
+py_ssa_var(unique int id : @py_ssa_var,
+            int var : @py_variable ref);
+
+py_ssa_use(int node: @py_flow_node ref,
+           int var : @py_ssa_var ref);
+
+py_ssa_defn(unique int id : @py_ssa_var ref,
+                  int node: @py_flow_node ref);
+
+@py_base_var = @py_variable | @py_ssa_var;
+
+py_scopes(unique int node : @py_expr_or_stmt ref,
+         int scope : @py_scope ref);
+
+py_scope_location(unique int id : @location ref,
+                   unique int scope : @py_scope ref);
+
+py_flags_versioned(varchar(1) name : string ref,
+                   varchar(1) value : string ref,
+                   varchar(1) version : string ref);
+
+py_syntax_error_versioned(unique int id : @location ref,
+                varchar(1) message : string ref,
+                varchar(1) version : string ref);
+
+py_comments(unique int id : @py_comment,
+           varchar(1) text : string ref,
+           unique int location : @location ref);
+
+/* Type information support */
+
+py_cobjects(unique int obj : @py_cobject);
+
+py_cobjecttypes(unique int obj : @py_cobject ref,
+                int typeof : @py_cobject ref);
+
+py_cobjectnames(unique int obj : @py_cobject ref,
+                varchar(1) name : string ref);
+
+/* Kind should be 0 for introspection, > 0 from source, as follows:
+   1 from C extension source
+ */
+py_cobject_sources(int obj : @py_cobject ref,
+                  int kind : int ref);
+
+py_cmembers_versioned(int object : @py_cobject ref,
+                      varchar(1) name : string ref,
+                      int member : @py_cobject ref,
+                      varchar(1) version : string ref);
+
+py_citems(int object : @py_cobject ref,
+            int index : int ref,
+            int member : @py_cobject ref);
+
+ext_argtype(int funcid : @py_object ref,
+            int arg : int ref,
+            int typeid : @py_object ref);
+
+ext_rettype(int funcid : @py_object ref,
+            int typeid : @py_object ref);
+
+ext_proptype(int propid : @py_object ref,
+             int typeid : @py_object ref);
+
+ext_argreturn(int funcid : @py_object ref,
+              int arg : int ref);
+
+py_special_objects(unique int obj : @py_cobject ref,
+                   unique varchar(1) name : string ref);
+
+py_decorated_object(int object : @py_object ref,
+                    int level: int ref);
+
+@py_object = @py_cobject | @py_flow_node;
+
+@py_source_element = @py_ast_node | @container;
+
+/* XML Files */
+
+xmlEncoding  (unique int id: @file ref, varchar(900) encoding: string ref);
+
+xmlDTDs       (unique int id: @xmldtd,
+              varchar(900) root: string ref,
+              varchar(900) publicId: string ref,
+              varchar(900) systemId: string ref,
+              int fileid: @file ref);
+
+xmlElements   (unique int id: @xmlelement,
+              varchar(900) name: string ref,
+              int parentid: @xmlparent ref,
+              int idx: int ref,
+              int fileid: @file ref);
+
+xmlAttrs      (unique int id: @xmlattribute,
+              int elementid: @xmlelement ref,
+              varchar(900) name: string ref,
+              varchar(3600) value: string ref,
+              int idx: int ref,
+              int fileid: @file ref);
+
+xmlNs         (int id: @xmlnamespace,
+              varchar(900) prefixName: string ref,
+              varchar(900) URI: string ref,
+              int fileid: @file ref);
+
+xmlHasNs      (int elementId: @xmlnamespaceable ref,
+              int nsId: @xmlnamespace ref,
+              int fileid: @file ref);
+
+xmlComments   (unique int id: @xmlcomment,
+              varchar(3600) text: string ref,
+              int parentid: @xmlparent ref,
+              int fileid: @file ref);
+
+xmlChars      (unique int id: @xmlcharacters,
+              varchar(3600) text: string ref,
+              int parentid: @xmlparent ref,
+              int idx: int ref,
+              int isCDATA: int ref,
+              int fileid: @file ref);
+
+@xmlparent = @file | @xmlelement;
+@xmlnamespaceable = @xmlelement | @xmlattribute;
+
+xmllocations(int xmlElement: @xmllocatable ref,
+             int location: @location_default ref);
+
+@xmllocatable = @xmlcharacters | @xmlelement | @xmlcomment | @xmlattribute | @xmldtd | @file | @xmlnamespace;

python/downgrades/qlpack.yml

@@ -0,0 +1,4 @@
+name: codeql/python-downgrades
+groups: python
+downgrades: .
+library: true

python/ql/examples/qlpack.yml

@@ -1,4 +1,6 @@
 name: codeql/python-examples
-version: 0.0.2
+groups: 
+  - python
+  - examples
 dependencies:
-    codeql/python-all: "*"
+  codeql/python-all: "*"

python/ql/lib/CHANGELOG.md

@@ -1,3 +1,18 @@
+## 0.0.7
+
+## 0.0.6
+
+## 0.0.5
+
+### Minor Analysis Improvements
+
+* Added modeling of many functions from the `os` module that uses file system paths, such as `os.stat`, `os.chdir`, `os.mkdir`, and so on.
+* Added modeling of the `tempfile` module for creating temporary files and directories, such as the functions `tempfile.NamedTemporaryFile` and `tempfile.TemporaryDirectory`.
+* Extended the modeling of FastAPI such that custom subclasses of `fastapi.APIRouter` are recognized.
+* Extended the modeling of FastAPI such that `fastapi.responses.FileResponse` are considered `FileSystemAccess`.
+* Added modeling of the `posixpath`, `ntpath`, and `genericpath` modules for path operations (although these are not supposed to be used), resulting in new sinks.
+* Added modeling of `wsgiref.simple_server` applications, leading to new remote flow sources.
+
 ## 0.0.4
 
 ### Major Analysis Improvements

python/ql/lib/change-notes/2022-01-11-remove-upgrades-packs.md

@@ -0,0 +1,4 @@
+---
+category: deprecated
+---
+* The `codeql/python-upgrades` CodeQL pack has been removed. All upgrades scripts have been merged into the `codeql/python-all` CodeQL pack.

python/ql/lib/change-notes/2022-01-19-move-regex-injection.md

@@ -0,0 +1,4 @@
+---
+category: deprecated
+---
+* Moved the files defining regex injection configuration and customization, instead of `import semmle.python.security.injection.RegexInjection` please use `import semmle.python.security.dataflow.RegexInjection` (the same for `RegexInjectionCustomizations`).

python/ql/lib/change-notes/released/0.0.5.md

@@ -0,0 +1,10 @@
+## 0.0.5
+
+### Minor Analysis Improvements
+
+* Added modeling of many functions from the `os` module that uses file system paths, such as `os.stat`, `os.chdir`, `os.mkdir`, and so on.
+* Added modeling of the `tempfile` module for creating temporary files and directories, such as the functions `tempfile.NamedTemporaryFile` and `tempfile.TemporaryDirectory`.
+* Extended the modeling of FastAPI such that custom subclasses of `fastapi.APIRouter` are recognized.
+* Extended the modeling of FastAPI such that `fastapi.responses.FileResponse` are considered `FileSystemAccess`.
+* Added modeling of the `posixpath`, `ntpath`, and `genericpath` modules for path operations (although these are not supposed to be used), resulting in new sinks.
+* Added modeling of `wsgiref.simple_server` applications, leading to new remote flow sources.

python/ql/lib/change-notes/released/0.0.6.md

@@ -0,0 +1 @@
+## 0.0.6

python/ql/lib/change-notes/released/0.0.7.md

@@ -0,0 +1 @@
+## 0.0.7

python/ql/lib/codeql-pack.release.yml

@@ -1,2 +1,2 @@
 ---
-lastReleaseVersion: 0.0.4
+lastReleaseVersion: 0.0.7

python/ql/lib/python.qll

@@ -10,6 +10,7 @@ import semmle.python.Class
 import semmle.python.Import
 import semmle.python.Stmts
 import semmle.python.Exprs
+import semmle.python.Patterns
 import semmle.python.Keywords
 import semmle.python.Comprehensions
 import semmle.python.Flow

python/ql/lib/qlpack.yml

@@ -1,8 +1,7 @@
 name: codeql/python-all
-version: 0.0.5-dev
+version: 0.0.8-dev
 groups: python
 dbscheme: semmlecode.python.dbscheme
 extractor: python
 library: true
-dependencies:
-    codeql/python-upgrades: ^0.0.3
+upgrades: upgrades

python/ql/lib/semmle/python/ApiGraphs.qll

@@ -114,13 +114,13 @@ module API {
      * Gets a node such that there is an edge in the API graph between this node and the other
      * one, and that edge is labeled with `lbl`.
      */
-    Node getASuccessor(string lbl) { Impl::edge(this, lbl, result) }
+    Node getASuccessor(Label::ApiLabel lbl) { Impl::edge(this, lbl, result) }
 
     /**
      * Gets a node such that there is an edge in the API graph between that other node and
      * this one, and that edge is labeled with `lbl`
      */
-    Node getAPredecessor(string lbl) { this = result.getASuccessor(lbl) }
+    Node getAPredecessor(Label::ApiLabel lbl) { this = result.getASuccessor(lbl) }
 
     /**
      * Gets a node such that there is an edge in the API graph between this node and the other
@@ -174,9 +174,8 @@ module API {
       length = 0 and
       result = ""
       or
-      exists(Node pred, string lbl, string predpath |
+      exists(Node pred, Label::ApiLabel lbl, string predpath |
         Impl::edge(pred, lbl, this) and
-        lbl != "" and
         predpath = pred.getAPath(length - 1) and
         exists(string dot | if length = 1 then dot = "" else dot = "." |
           result = predpath + dot + lbl and
@@ -335,7 +334,8 @@ module API {
      *
      * For instance, `prefix_member("foo.bar", "baz", "foo.bar.baz")` would hold.
      */
-    private predicate prefix_member(TApiNode base, string member, TApiNode sub) {
+    cached
+    predicate prefix_member(TApiNode base, string member, TApiNode sub) {
       exists(string sub_str, string regexp |
         regexp = "(.+)[.]([^.]+)" and
         base = MkModuleImport(sub_str.regexpCapture(regexp, 1)) and
@@ -386,7 +386,7 @@ module API {
      * `lbl` in the API graph.
      */
     cached
-    predicate use(TApiNode base, string lbl, DataFlow::Node ref) {
+    predicate use(TApiNode base, Label::ApiLabel lbl, DataFlow::Node ref) {
       exists(DataFlow::LocalSourceNode src, DataFlow::LocalSourceNode pred |
         // First, we find a predecessor of the node `ref` that we want to determine. The predecessor
         // is any node that is a type-tracked use of a data flow node (`src`), which is itself a
@@ -481,7 +481,7 @@ module API {
      * Holds if there is an edge from `pred` to `succ` in the API graph that is labeled with `lbl`.
      */
     cached
-    predicate edge(TApiNode pred, string lbl, TApiNode succ) {
+    predicate edge(TApiNode pred, Label::ApiLabel lbl, TApiNode succ) {
       /* There's an edge from the root node for each imported module. */
       exists(string m |
         pred = MkRoot() and
@@ -514,36 +514,126 @@ module API {
     cached
     int distanceFromRoot(TApiNode nd) = shortestDistances(MkRoot/0, edge/2)(_, nd, result)
   }
-}
 
-private module Label {
-  /** Gets the edge label for the module `m`. */
-  bindingset[m]
-  bindingset[result]
-  string mod(string m) { result = "moduleImport(\"" + m + "\")" }
+  /** Provides classes modeling the various edges (labels) in the API graph. */
+  module Label {
+    /** A label in the API-graph */
+    class ApiLabel extends TLabel {
+      /** Gets a string representation of this label. */
+      string toString() { result = "???" }
+    }
 
-  /** Gets the `member` edge label for member `m`. */
-  bindingset[m]
-  bindingset[result]
-  string member(string m) { result = "getMember(\"" + m + "\")" }
+    private import LabelImpl
 
-  /** Gets the `member` edge label for the unknown member. */
-  string unknownMember() { result = "getUnknownMember()" }
+    private module LabelImpl {
+      private import semmle.python.dataflow.new.internal.Builtins
+      private import semmle.python.dataflow.new.internal.ImportStar
 
-  /** Gets the `member` edge label for the given attribute reference. */
-  string memberFromRef(DataFlow::AttrRef pr) {
-    result = member(pr.getAttributeName())
-    or
-    not exists(pr.getAttributeName()) and
-    result = unknownMember()
+      newtype TLabel =
+        MkLabelModule(string mod) { exists(Impl::MkModuleImport(mod)) } or
+        MkLabelMember(string member) {
+          member = any(DataFlow::AttrRef pr).getAttributeName() or
+          exists(Builtins::likelyBuiltin(member)) or
+          ImportStar::namePossiblyDefinedInImportStar(_, member, _) or
+          Impl::prefix_member(_, member, _)
+        } or
+        MkLabelUnknownMember() or
+        MkLabelParameter(int i) {
+          none() // TODO: Fill in when adding def nodes
+        } or
+        MkLabelReturn() or
+        MkLabelSubclass() or
+        MkLabelAwait()
+
+      /** A label for a module. */
+      class LabelModule extends ApiLabel {
+        string mod;
+
+        LabelModule() { this = MkLabelModule(mod) }
+
+        /** Gets the module associated with this label. */
+        string getMod() { result = mod }
+
+        override string toString() { result = "moduleImport(\"" + mod + "\")" }
+      }
+
+      /** A label for the member named `prop`. */
+      class LabelMember extends ApiLabel {
+        string member;
+
+        LabelMember() { this = MkLabelMember(member) }
+
+        /** Gets the property associated with this label. */
+        string getMember() { result = member }
+
+        override string toString() { result = "getMember(\"" + member + "\")" }
+      }
+
+      /** A label for a member with an unknown name. */
+      class LabelUnknownMember extends ApiLabel {
+        LabelUnknownMember() { this = MkLabelUnknownMember() }
+
+        override string toString() { result = "getUnknownMember()" }
+      }
+
+      /** A label for parameter `i`. */
+      class LabelParameter extends ApiLabel {
+        int i;
+
+        LabelParameter() { this = MkLabelParameter(i) }
+
+        override string toString() { result = "getParameter(" + i + ")" }
+
+        /** Gets the index of the parameter for this label. */
+        int getIndex() { result = i }
+      }
+
+      /** A label that gets the return value of a function. */
+      class LabelReturn extends ApiLabel {
+        LabelReturn() { this = MkLabelReturn() }
+
+        override string toString() { result = "getReturn()" }
+      }
+
+      /** A label that gets the subclass of a class. */
+      class LabelSubclass extends ApiLabel {
+        LabelSubclass() { this = MkLabelSubclass() }
+
+        override string toString() { result = "getASubclass()" }
+      }
+
+      /** A label for awaited values. */
+      class LabelAwait extends ApiLabel {
+        LabelAwait() { this = MkLabelAwait() }
+
+        override string toString() { result = "getAwaited()" }
+      }
+    }
+
+    /** Gets the edge label for the module `m`. */
+    LabelModule mod(string m) { result.getMod() = m }
+
+    /** Gets the `member` edge label for member `m`. */
+    LabelMember member(string m) { result.getMember() = m }
+
+    /** Gets the `member` edge label for the unknown member. */
+    LabelUnknownMember unknownMember() { any() }
+
+    /** Gets the `member` edge label for the given attribute reference. */
+    ApiLabel memberFromRef(DataFlow::AttrRef pr) {
+      result = member(pr.getAttributeName())
+      or
+      not exists(pr.getAttributeName()) and
+      result = unknownMember()
+    }
+
+    /** Gets the `return` edge label. */
+    LabelReturn return() { any() }
+
+    /** Gets the `subclass` edge label. */
+    LabelSubclass subclass() { any() }
+
+    /** Gets the `await` edge label. */
+    LabelAwait await() { any() }
   }
-
-  /** Gets the `return` edge label. */
-  string return() { result = "getReturn()" }
-
-  /** Gets the `subclass` edge label. */
-  string subclass() { result = "getASubclass()" }
-
-  /** Gets the `await` edge label. */
-  string await() { result = "getAwaited()" }
 }