Commit Graph

9522 Commits

Author SHA1 Message Date
Taus
c837e1491a Python: Extend DuckTyping module
Adds `overridesMethod` and `isPropertyAccessor`.
2026-03-09 17:13:04 +00:00
Taus
d9693e70de Python: Remove missing results
These results are missing because we no longer (unlike the points-to
analysis) track how many elements a given tuple has. This is something
we might want to implement in the future (most likely through an
`int`-indexed type tracker).
2026-03-09 17:13:04 +00:00
Taus
0509ec6f0b Python: Port WrongNumberArgumentsInClassInstantiation.ql
Included test changes are trivial `toString` changes.
2026-03-09 17:13:03 +00:00
Taus
0094271966 Python: Port WrongNameForArgumentInClassInstantiation.ql 2026-03-09 17:13:03 +00:00
Taus
6c56882a75 Python: Port ShouldBeContextManager.ql
Only trivial test changes.
2026-03-09 17:13:03 +00:00
Taus
7ceb6a5748 Python: Port UselessClass.ql
No test changes.
2026-03-09 17:13:03 +00:00
Taus
c4a4e20be0 Python: Port HashedButNoHash.ql
This one is a bit more involved. Of note is the fact that it at present
only uses local flow when determining the origin of some value (whereas
the points-to version used global flow). It may be desirable to rewrite
this query to use global data-flow, but this should be done with some
care (as using "all unhashable objects" as the set of sources is
somewhat iffy with respect to performance). For that reason, I'm
sticking to mostly local flow (except for well behaved things like types
and built-ins).
2026-03-09 17:13:03 +00:00
Taus
e2dcfae3ee Python: Port InconsistentMRO.ql
For this one we actually lose a test result. However, this is kind of to
be expected since we no longer have the "precise" MRO that the points-to
analysis computes.

Honestly, I'm on the fence about even keeping this query at all. It
seems like it might be superfluous in a world with good Python type
checking.
2026-03-09 17:13:03 +00:00
Taus
8fe680c716 Python: Port PropertyInOldStyleClass.ql
Only trivial test changes.
2026-03-09 17:13:03 +00:00
Taus
8f154f6374 Python: Port SuperInOldStyleClass.ql 2026-03-09 17:13:03 +00:00
Taus
f4f217c993 Python: Port SlotsInOldStyleClass.ql
Only trivial test changes.
2026-03-09 17:13:03 +00:00
Taus
c1beca80e6 Python: Add declares/getAttribute API
These could arguably be moved to `Class` itself, but for now I'm
choosing to limit the changes to the `DuckTyping` module (until we
decide on a proper API).
2026-03-09 17:13:03 +00:00
Taus
793ecb6416 Python: Add DuckTyping::isNewStyle
Approximates the behaviour of `Types::isNewStyle` but without depending
on points-to
2026-03-09 17:13:03 +00:00
Taus
8ffcdfeb05 Python: Port UnusedExceptionObject.ql
Depending on whether other queries depend on this, we may end up moving
the exception utility functions to a more central location.
2026-03-09 17:13:02 +00:00
Taus
918e5e25ec Python: Port ShouldUseWithStatement.ql
Only trivial test changes.
2026-03-09 17:13:02 +00:00
Taus
485e949467 Python: Port NonIteratorInForLoop.ql
Same comment as for the preceding commit. We lose one test result due to
the fact that we don't know what to do about `for ... in 1` (because `1`
is an instance of a built-in). I'm going to defer addressing this until
we get some modelling of built-in types.
2026-03-09 17:13:02 +00:00
Taus
1159d20375 Python: Port ContainsNonContainer.ql
Uses the new `DuckTyping` module to handle recognising whether a class
is a container or not. Only trivial test changes (one version uses
"class", the other "Class").

Note that the ported query has no understanding of built-in classes. At
some point we'll likely want to replace `hasUnresolvedBase` (which will
hold for any class that extends a built-in) with something that's aware
of the built-in classes.
2026-03-09 17:13:02 +00:00
Taus
62d5cac6e0 Python: Introduce DuckTyping module
This module (which for convenience currently resides inside
`DataFlowDispatch`, but this may change later) contains convenience
predicates for bridging the gap between the data-flow layer and the old
points-to analysis.
2026-03-09 17:13:02 +00:00
Taus
452e189bbc Python: Port py/print-during-import
Uses a (perhaps) slightly coarser approximation of what modules are
imported, but it's probably fine.
2026-03-09 16:38:52 +00:00
Taus
5d5060b02b Python: Use API graphs instead of points-to for simple built-ins
Removes the use of points-to for accessing various built-ins from three
of the queries. In order for this to work I had to extend the lists of
known built-ins slightly.
2026-03-09 16:38:52 +00:00
Taus
5d74ad5bc6 Merge pull request #21419 from github/tausbn/python-improve-overloaded-method-resolution
Python: Improve modelling of overloaded methods
2026-03-09 16:25:05 +01:00
Taus
f2bad1e6e1 Python: Improve docstring and make predicate private 2026-03-09 13:41:38 +00:00
Óscar San José
3b9eba2afc Merge branch 'main' of https://github.com/github/codeql into oscarsj/merge-back-rc-3.21 2026-03-06 16:20:36 +01:00
Taus
66ca10c338 Python: Add change note 2026-03-05 22:20:03 +00:00
Taus
fa61f6f3df Python: Model @typing.overload in method resolution
Adds `hasOverloadDecorator` as a predicate on functions. It looks for
decorators called `overload` or `something.overload` (usually
`typing.overload` or `t.overload`). These are then filtered out in the
predicates that (approximate) resolving methods according to the MRO.

As the test introduced in the previous commit shows, this removes the
spurious resolutions we had before.
2026-03-05 22:20:03 +00:00
Taus
0561a63003 Python: Add test for overloaded __init__ resolution
Adds a test showing that `@typing.overload` stubs are spuriously
resolved as call targets alongside the actual `__init__` implementation.
2026-03-05 22:20:03 +00:00
Owen Mansel-Chan
c82f75604a Add change notes 2026-03-05 10:34:30 +00:00
Owen Mansel-Chan
99a4fe4828 Update expected test output column numbers 2026-03-04 15:02:53 +00:00
Owen Mansel-Chan
aa28c94562 Remove double space after $ in inline expectations tests 2026-03-04 14:12:42 +00:00
Owen Mansel-Chan
91b6801db1 py: Inline expectation should have space before $ 2026-03-04 13:11:38 +00:00
Owen Mansel-Chan
5a97348e78 python: Inline expectation should have space after $
This was a regex-find-replace from `# \$(?! )` (using a negative lookahead) to `# $ `.
2026-03-04 12:45:05 +00:00
github-actions[bot]
e152f08468 Post-release preparation for codeql-cli-2.24.3 2026-03-02 22:51:27 +00:00
github-actions[bot]
7795badd18 Release preparation for version 2.24.3 2026-03-02 13:23:40 +00:00
yoff
600f585a31 Merge pull request #21296 from yoff/python/bool-comparison-guards
Python: Handle guards being compared to boolean literals
2026-02-26 21:13:51 +01:00
yoff
89e5a9bd72 Update python/ql/lib/semmle/python/dataflow/new/internal/DataFlowPublic.qll
Co-authored-by: Taus <tausbn@github.com>
2026-02-26 13:14:26 +01:00
yoff
cfbae50845 Python: convert barrier guard to MaD 2026-02-26 13:12:34 +01:00
yoff
9b9c9304c7 Python: simplify logic, suggested in review 2026-02-25 18:16:38 +01:00
yoff
c4f8748a42 Python: simplify barrier guard 2026-02-25 18:03:40 +01:00
Taus
6bfb1e1fae Merge pull request #21344 from github/tausbn/python-remove-points-to-from-metrics-libraries
Python: Remove points-to from metrics library
2026-02-24 15:55:16 +01:00
Taus
f107235db2 Update change note 2026-02-24 15:08:36 +01:00
yoff
7df44f9418 python: add change note 2026-02-24 10:00:22 +01:00
yoff
7351e82c92 python: handle guards compared to boolean literals 2026-02-24 10:00:22 +01:00
yoff
8488039fb9 python: add tests for guards compared to booleans 2026-02-24 10:00:21 +01:00
Jon Janego
e14b4f1c5c Merge branch 'main' into codeql-spark-run-22317536589 2026-02-23 11:52:17 -06:00
Jon Janego
79ac95d8a8 Fix syntax error with '=' in format specifier 2026-02-23 11:50:03 -06:00
Taus
480ae619e6 Merge pull request #21116 from github/tausbn/python-add-dataflow-overlay-annotations
Add `overlay[local]` annotations
2026-02-21 13:44:09 +01:00
Taus
07099f17d6 Python: Add change note 2026-02-19 12:32:27 +00:00
Taus
e8de8433f4 Python: Update all metrics-dependant queries
The ones that no longer require points-to no longer import
`LegacyPointsTo`. The ones that do use the specific
`...MetricsWithPointsTo` classes that are applicable.
2026-02-19 12:32:27 +00:00
Taus
20fea3955e Python: Remove points-to from Metrics.qll
Moves the classes/predicates that _actually_ depend on points-to to the
`LegacyPointsTo` module, leaving behind a module that contains all of
the metrics-related stuff (line counts, nesting depth, etc.) that don't
need points-to to be evaluated.

Consequently, `Metrics` is now no longer a private import in
`python.qll`.
2026-02-19 12:32:27 +00:00
Taus
6b6d8862b0 Merge pull request #21288 from microsoft/azure_python_sanitizer_upstream2
Azure python sanitizer upstream2
2026-02-18 14:59:59 +01:00