diff --git a/python/ql/src/semmle/python/dataflow/new/internal/DataFlowPublic.qll b/python/ql/src/semmle/python/dataflow/new/internal/DataFlowPublic.qll index b2e2298182e..dcc175276f8 100644 --- a/python/ql/src/semmle/python/dataflow/new/internal/DataFlowPublic.qll +++ b/python/ql/src/semmle/python/dataflow/new/internal/DataFlowPublic.qll @@ -446,6 +446,8 @@ class LocalSourceNode extends Node { LocalSourceNode() { not simpleLocalFlowStep+(any(CfgNode n), this) and not this instanceof ModuleVariableNode + or + this = any(ModuleVariableNode mvn).getARead() } /** Holds if this `LocalSourceNode` can flow to `nodeTo` in one or more local flow steps. */ diff --git a/python/ql/test/experimental/dataflow/ApiGraphs/test.py b/python/ql/test/experimental/dataflow/ApiGraphs/test.py index 27888cd9f9e..b250c7985e2 100644 --- a/python/ql/test/experimental/dataflow/ApiGraphs/test.py +++ b/python/ql/test/experimental/dataflow/ApiGraphs/test.py @@ -72,7 +72,7 @@ def f(): sink(foo) #$ use=moduleImport("danger").getMember("SOURCE") foo = NONSOURCE change_foo() - sink(foo) #$ MISSING: use=moduleImport("danger").getMember("SOURCE") + sink(foo) #$ use=moduleImport("danger").getMember("SOURCE") # Star imports