Commit Graph

3 Commits

Author SHA1 Message Date
yoff
2e82990dfd Python: rebless CONSISTENCY queries + revert LongPath
- LongPath.expected: revert wrong rebless from 69c27c53c1b. CI generates
  the long-path file during build, so the long-path entry is correct.

- 4 framework/query DataFlowConsistency.expected: pure toString polish
  (ControlFlowNode for X -> X / After X).

- essa/ssa-compute/CONSISTENCY/TypeTrackingConsistency.expected: deleted.
  The 6 prior 'unreachable node in step of kind ...' violations are gone
  under the new SSA; per CI auto-rebless convention the empty file is
  removed.

- extractor-tests/syntax_error/CONSISTENCY/CfgConsistency.expected: new.
  Documents one expected deadEnd on `break` outside any loop in the
  syntax-error test corpus.

Co-authored-by: Copilot <223556219+Copilot@users.noreply.github.com>
2026-05-28 21:09:49 +00:00
yoff
1bcaa56b10 Python: rebless second round after shared-CFG dataflow migration
Second batch of test reblessings, capturing changes in result content
(not just toString labels):

- Framework taint/concept tests (fastapi, sqlalchemy, aiohttp, lxml,
  stdlib, django-orm): mostly gained MISSING-tainted annotations where
  the new dataflow no longer reaches sinks. Some are real taint
  regressions; left as documented failures for follow-up.

- Exception-handler tests (CWE-209-StackTraceExposure, EmptyExcept,
  CatchingBaseException, IncorrectExceptOrder, FileNotAlwaysClosed,
  FindSubclass/Find, Statements/exit/UseOfExit): the no-raise shared CFG
  abstraction does not emit ExceptionSuccessor abrupt-completion edges
  from arbitrary expressions, so except-handler bodies (and their
  exception target Names) are statically dead. Tracked separately under
  cfg-modelling-exceptions.

- Dataflow-path / control-flow node toString polish across the security
  query suite (PathInjection, CodeInjection, UnsafeUnpacking,
  UnsafeUsageOfClientSideEncryptionVersion, RequestWithoutValidation,
  ReflectedXss, CallGraph): simple-leaf nodes now stringify as their
  AST text instead of 'After X'.

- SSA / call-graph improvements (CmpTest, CallGraph/InlineCallGraphTest):
  fewer SSA mismatches between new and old; two previously-MISSING tt=
  annotations resolved.

Co-authored-by: Copilot <223556219+Copilot@users.noreply.github.com>
2026-05-28 21:09:49 +00:00
Taus
e45f6e9b24 Python: Add copy of extractor tests
These get to live next to the existing library and query tests, and are
run as part of both the Python 2 and Python 3 language tests.
2024-04-15 12:22:07 +00:00