mirror of
https://github.com/github/codeql.git
synced 2026-06-05 13:37:06 +02:00
Compare commits
11 Commits
andersfugm
...
yoff/pytho
| Author | SHA1 | Date | |
|---|---|---|---|
|
b783ed69c5 | ||
|
|
5b9803e03c | ||
|
|
b2ff09f70a | ||
|
|
4aee0b3c87 | ||
|
|
a2295e7216 | ||
|
|
0623acc7f5 | ||
|
|
dc5aa8e0f5 | ||
|
|
db1e5035b4 | ||
|
|
7a3f546587 | ||
|
|
821325b7e5 | ||
|
|
4d2296d4f0 |
@@ -248,7 +248,6 @@ use_repo(
|
||||
"kotlin-compiler-2.2.20-Beta2",
|
||||
"kotlin-compiler-2.3.0",
|
||||
"kotlin-compiler-2.3.20",
|
||||
"kotlin-compiler-2.4.0",
|
||||
"kotlin-compiler-embeddable-1.8.0",
|
||||
"kotlin-compiler-embeddable-1.9.0-Beta",
|
||||
"kotlin-compiler-embeddable-1.9.20-Beta",
|
||||
@@ -260,7 +259,6 @@ use_repo(
|
||||
"kotlin-compiler-embeddable-2.2.20-Beta2",
|
||||
"kotlin-compiler-embeddable-2.3.0",
|
||||
"kotlin-compiler-embeddable-2.3.20",
|
||||
"kotlin-compiler-embeddable-2.4.0",
|
||||
"kotlin-stdlib-1.8.0",
|
||||
"kotlin-stdlib-1.9.0-Beta",
|
||||
"kotlin-stdlib-1.9.20-Beta",
|
||||
@@ -272,7 +270,6 @@ use_repo(
|
||||
"kotlin-stdlib-2.2.20-Beta2",
|
||||
"kotlin-stdlib-2.3.0",
|
||||
"kotlin-stdlib-2.3.20",
|
||||
"kotlin-stdlib-2.4.0",
|
||||
)
|
||||
|
||||
go_sdk = use_extension("@rules_go//go:extensions.bzl", "go_sdk")
|
||||
|
||||
@@ -21,7 +21,7 @@
|
||||
Java,"Java 7 to 26 [6]_","javac (OpenJDK and Oracle JDK),
|
||||
|
||||
Eclipse compiler for Java (ECJ) [7]_",``.java``
|
||||
Kotlin,"Kotlin 1.8.0 to 2.4.\ *x*","kotlinc",``.kt``
|
||||
Kotlin,"Kotlin 1.8.0 to 2.3.2\ *x*","kotlinc",``.kt``
|
||||
JavaScript,ECMAScript 2022 or lower,Not applicable,"``.js``, ``.jsx``, ``.mjs``, ``.es``, ``.es6``, ``.htm``, ``.html``, ``.xhtm``, ``.xhtml``, ``.vue``, ``.hbs``, ``.ejs``, ``.njk``, ``.json``, ``.yaml``, ``.yml``, ``.raml``, ``.xml`` [8]_"
|
||||
Python [9]_,"2.7, 3.5, 3.6, 3.7, 3.8, 3.9, 3.10, 3.11, 3.12, 3.13",Not applicable,``.py``
|
||||
Ruby [10]_,"up to 3.3",Not applicable,"``.rb``, ``.erb``, ``.gemspec``, ``Gemfile``"
|
||||
|
||||
@@ -9,9 +9,9 @@ import semmle.go.dataflow.internal.FlowSummaryImpl as FlowSummaryImpl
|
||||
import utils.test.InlineFlowTest
|
||||
|
||||
module Config implements DataFlow::ConfigSig {
|
||||
predicate isSource(DataFlow::Node source) { sourceNode(source, "qltest") }
|
||||
predicate isSource(DataFlow::Node src) { sourceNode(src, "qltest") }
|
||||
|
||||
predicate isSink(DataFlow::Node sink) { sinkNode(sink, "qltest") }
|
||||
predicate isSink(DataFlow::Node src) { sinkNode(src, "qltest") }
|
||||
}
|
||||
|
||||
import ValueFlowTest<Config>
|
||||
|
||||
@@ -1,2 +0,0 @@
|
||||
reverseRead
|
||||
| main.go:23:3:23:5 | out | Origin of readStep is missing a PostUpdateNode. |
|
||||
@@ -4,7 +4,7 @@ func source() string {
|
||||
return "untrusted data"
|
||||
}
|
||||
|
||||
func sink(any) {
|
||||
func sink(string) {
|
||||
}
|
||||
|
||||
type A struct {
|
||||
@@ -19,10 +19,6 @@ func functionWithVarArgsParameter(s ...string) string {
|
||||
return s[1]
|
||||
}
|
||||
|
||||
func functionWithVarArgsOutParameter(in string, out ...*string) {
|
||||
*out[0] = in
|
||||
}
|
||||
|
||||
func functionWithSliceOfStructsParameter(s []A) string {
|
||||
return s[1].f
|
||||
}
|
||||
@@ -42,12 +38,6 @@ func main() {
|
||||
sink(functionWithVarArgsParameter(sSlice...)) // $ hasValueFlow="call to functionWithVarArgsParameter"
|
||||
sink(functionWithVarArgsParameter(s0, s1)) // $ hasValueFlow="call to functionWithVarArgsParameter"
|
||||
|
||||
var out1 *string
|
||||
var out2 *string
|
||||
functionWithVarArgsOutParameter(source(), out1, out2)
|
||||
sink(out1) // $ MISSING: hasValueFlow="out1"
|
||||
sink(out2) // $ MISSING: hasValueFlow="out2"
|
||||
|
||||
sliceOfStructs := []A{{f: source()}}
|
||||
sink(sliceOfStructs[0].f) // $ hasValueFlow="selection of f"
|
||||
|
||||
|
||||
@@ -1,2 +0,0 @@
|
||||
invalidModelRow
|
||||
testFailures
|
||||
@@ -1,21 +0,0 @@
|
||||
extensions:
|
||||
- addsTo:
|
||||
pack: codeql/go-all
|
||||
extensible: summaryModel
|
||||
data:
|
||||
- ["github.com/nonexistent/test", "", False, "FunctionWithParameter", "", "", "Argument[0]", "ReturnValue", "value", "manual"]
|
||||
- ["github.com/nonexistent/test", "", False, "FunctionWithSliceParameter", "", "", "Argument[0].ArrayElement", "ReturnValue", "value", "manual"]
|
||||
- ["github.com/nonexistent/test", "", False, "FunctionWithVarArgsParameter", "", "", "Argument[0].ArrayElement", "ReturnValue", "value", "manual"]
|
||||
- ["github.com/nonexistent/test", "", False, "FunctionWithVarArgsOutParameter", "", "", "Argument[0]", "Argument[1].ArrayElement", "value", "manual"]
|
||||
- ["github.com/nonexistent/test", "", False, "FunctionWithSliceOfStructsParameter", "", "", "Argument[0].ArrayElement.Field[github.com/nonexistent/test.A.Field]", "ReturnValue", "value", "manual"]
|
||||
- ["github.com/nonexistent/test", "", False, "FunctionWithVarArgsOfStructsParameter", "", "", "Argument[0].ArrayElement.Field[github.com/nonexistent/test.A.Field]", "ReturnValue", "value", "manual"]
|
||||
- addsTo:
|
||||
pack: codeql/go-all
|
||||
extensible: sourceModel
|
||||
data:
|
||||
- ["github.com/nonexistent/test", "", False, "VariadicSource", "", "", "Argument[0]", "qltest", "manual"]
|
||||
- addsTo:
|
||||
pack: codeql/go-all
|
||||
extensible: sinkModel
|
||||
data:
|
||||
- ["github.com/nonexistent/test", "", False, "VariadicSink", "", "", "Argument[0]", "qltest", "manual"]
|
||||
@@ -1,22 +0,0 @@
|
||||
import go
|
||||
import semmle.go.dataflow.ExternalFlow
|
||||
import ModelValidation
|
||||
import utils.test.InlineFlowTest
|
||||
|
||||
module Config implements DataFlow::ConfigSig {
|
||||
predicate isSource(DataFlow::Node source) {
|
||||
sourceNode(source, "qltest")
|
||||
or
|
||||
exists(Function fn | fn.hasQualifiedName(_, ["source", "taint"]) |
|
||||
source = fn.getACall().getResult()
|
||||
)
|
||||
}
|
||||
|
||||
predicate isSink(DataFlow::Node sink) {
|
||||
sinkNode(sink, "qltest")
|
||||
or
|
||||
exists(Function fn | fn.hasQualifiedName(_, "sink") | sink = fn.getACall().getAnArgument())
|
||||
}
|
||||
}
|
||||
|
||||
import FlowTest<Config, Config>
|
||||
@@ -1,5 +0,0 @@
|
||||
module semmle.go.Packages
|
||||
|
||||
go 1.25
|
||||
|
||||
require github.com/nonexistent/test v0.0.0-20200203000000-0000000000000
|
||||
@@ -1,56 +0,0 @@
|
||||
package main
|
||||
|
||||
import (
|
||||
"github.com/nonexistent/test"
|
||||
)
|
||||
|
||||
func source() string {
|
||||
return "untrusted data"
|
||||
}
|
||||
|
||||
func sink(any) {
|
||||
}
|
||||
|
||||
func main() {
|
||||
s := source()
|
||||
sink(test.FunctionWithParameter(s)) // $ hasValueFlow="call to FunctionWithParameter"
|
||||
|
||||
stringSlice := []string{source()}
|
||||
sink(stringSlice[0]) // $ hasValueFlow="index expression"
|
||||
|
||||
s0 := ""
|
||||
s1 := source()
|
||||
sSlice := []string{s0, s1}
|
||||
sink(test.FunctionWithParameter(sSlice[1])) // $ hasValueFlow="call to FunctionWithParameter"
|
||||
sink(test.FunctionWithSliceParameter(sSlice)) // $ hasValueFlow="call to FunctionWithSliceParameter"
|
||||
sink(test.FunctionWithVarArgsParameter(sSlice...)) // $ hasValueFlow="call to FunctionWithVarArgsParameter"
|
||||
sink(test.FunctionWithVarArgsParameter(s0, s1)) // $ hasValueFlow="call to FunctionWithVarArgsParameter"
|
||||
|
||||
var out1 *string
|
||||
var out2 *string
|
||||
test.FunctionWithVarArgsOutParameter(source(), out1, out2)
|
||||
sink(out1) // $ MISSING: hasValueFlow="out1"
|
||||
sink(out2) // $ MISSING: hasValueFlow="out2"
|
||||
|
||||
sliceOfStructs := []test.A{{Field: source()}}
|
||||
sink(sliceOfStructs[0].Field) // $ hasValueFlow="selection of Field"
|
||||
|
||||
a0 := test.A{Field: ""}
|
||||
a1 := test.A{Field: source()}
|
||||
aSlice := []test.A{a0, a1}
|
||||
sink(test.FunctionWithSliceOfStructsParameter(aSlice)) // $ hasValueFlow="call to FunctionWithSliceOfStructsParameter"
|
||||
sink(test.FunctionWithVarArgsOfStructsParameter(aSlice...)) // $ hasValueFlow="call to FunctionWithVarArgsOfStructsParameter"
|
||||
sink(test.FunctionWithVarArgsOfStructsParameter(a0, a1)) // $ hasValueFlow="call to FunctionWithVarArgsOfStructsParameter"
|
||||
|
||||
var variadicSource string
|
||||
test.VariadicSource(&variadicSource)
|
||||
sink(variadicSource) // $ MISSING: hasTaintFlow="variadicSource"
|
||||
sink(&variadicSource) // $ MISSING: hasTaintFlow="&..."
|
||||
|
||||
var variadicSourcePtr *string
|
||||
test.VariadicSource(variadicSourcePtr)
|
||||
sink(variadicSourcePtr) // $ MISSING: hasTaintFlow="variadicSourcePtr"
|
||||
sink(*variadicSourcePtr) // $ MISSING: hasTaintFlow="star expression"
|
||||
|
||||
test.VariadicSink(source()) // $ hasTaintFlow="[]type{args}"
|
||||
}
|
||||
@@ -1,32 +0,0 @@
|
||||
package test
|
||||
|
||||
type A struct {
|
||||
Field string
|
||||
}
|
||||
|
||||
func FunctionWithParameter(s string) string {
|
||||
return ""
|
||||
}
|
||||
|
||||
func FunctionWithSliceParameter(s []string) string {
|
||||
return ""
|
||||
}
|
||||
|
||||
func FunctionWithVarArgsParameter(s ...string) string {
|
||||
return ""
|
||||
}
|
||||
|
||||
func FunctionWithVarArgsOutParameter(in string, out ...*string) {
|
||||
}
|
||||
|
||||
func FunctionWithSliceOfStructsParameter(s []A) string {
|
||||
return ""
|
||||
}
|
||||
|
||||
func FunctionWithVarArgsOfStructsParameter(s ...A) string {
|
||||
return ""
|
||||
}
|
||||
|
||||
func VariadicSource(s ...*string) {}
|
||||
|
||||
func VariadicSink(s ...string) {}
|
||||
@@ -1,3 +0,0 @@
|
||||
# github.com/nonexistent/test v0.0.0-20200203000000-0000000000000
|
||||
## explicit
|
||||
github.com/nonexistent/test
|
||||
@@ -20,9 +20,6 @@ class SummaryModelTest extends DataFlow::FunctionModel {
|
||||
this.hasQualifiedName("github.com/nonexistent/test", "FunctionWithVarArgsParameter") and
|
||||
(inp.isParameter(_) and outp.isResult())
|
||||
or
|
||||
this.hasQualifiedName("github.com/nonexistent/test", "FunctionWithVarArgsOutParameter") and
|
||||
(inp.isParameter(0) and outp.isParameter(any(int i | i >= 1)))
|
||||
or
|
||||
this.hasQualifiedName("github.com/nonexistent/test", "FunctionWithSliceOfStructsParameter") and
|
||||
(inp.isParameter(0) and outp.isResult())
|
||||
or
|
||||
|
||||
@@ -1,5 +1,5 @@
|
||||
module semmle.go.Packages
|
||||
|
||||
go 1.25
|
||||
go 1.17
|
||||
|
||||
require github.com/nonexistent/test v0.0.0-20200203000000-0000000000000
|
||||
|
||||
@@ -8,7 +8,7 @@ func source() string {
|
||||
return "untrusted data"
|
||||
}
|
||||
|
||||
func sink(any) {
|
||||
func sink(string) {
|
||||
}
|
||||
|
||||
func main() {
|
||||
@@ -21,17 +21,10 @@ func main() {
|
||||
s0 := ""
|
||||
s1 := source()
|
||||
sSlice := []string{s0, s1}
|
||||
sink(test.FunctionWithParameter(sSlice[1])) // $ hasValueFlow="call to FunctionWithParameter"
|
||||
sink(test.FunctionWithSliceParameter(sSlice)) // $ hasTaintFlow="call to FunctionWithSliceParameter" MISSING: hasValueFlow="call to FunctionWithSliceParameter"
|
||||
sink(test.FunctionWithVarArgsParameter(sSlice...)) // $ hasTaintFlow="call to FunctionWithVarArgsParameter" MISSING: hasValueFlow="call to FunctionWithVarArgsParameter"
|
||||
randomFunctionWithMoreThanOneParameter(1, 2, 3, 4, 5) // This is needed to make the next line pass, because we need to have seen a call to a function with at least 2 parameters for ParameterInput to exist with index 1.
|
||||
sink(test.FunctionWithVarArgsParameter(s0, s1)) // $ hasValueFlow="call to FunctionWithVarArgsParameter"
|
||||
|
||||
var out1 *string
|
||||
var out2 *string
|
||||
test.FunctionWithVarArgsOutParameter(source(), out1, out2)
|
||||
sink(out1) // $ hasValueFlow="out1"
|
||||
sink(out2) // $ hasValueFlow="out2"
|
||||
sink(test.FunctionWithParameter(sSlice[1])) // $ hasValueFlow="call to FunctionWithParameter"
|
||||
sink(test.FunctionWithSliceParameter(sSlice)) // $ hasTaintFlow="call to FunctionWithSliceParameter" MISSING: hasValueFlow="call to FunctionWithSliceParameter"
|
||||
sink(test.FunctionWithVarArgsParameter(sSlice...)) // $ hasTaintFlow="call to FunctionWithVarArgsParameter" MISSING: hasValueFlow="call to FunctionWithVarArgsParameter"
|
||||
sink(test.FunctionWithVarArgsParameter(s0, s1)) // $ MISSING: hasValueFlow="call to FunctionWithVarArgsParameter"
|
||||
|
||||
sliceOfStructs := []test.A{{Field: source()}}
|
||||
sink(sliceOfStructs[0].Field) // $ hasValueFlow="selection of Field"
|
||||
@@ -44,6 +37,3 @@ func main() {
|
||||
sink(test.FunctionWithVarArgsOfStructsParameter(aSlice...)) // $ MISSING: hasValueFlow="call to FunctionWithVarArgsOfStructsParameter"
|
||||
sink(test.FunctionWithVarArgsOfStructsParameter(a0, a1)) // $ MISSING: hasValueFlow="call to FunctionWithVarArgsOfStructsParameter"
|
||||
}
|
||||
|
||||
func randomFunctionWithMoreThanOneParameter(i1, i2, i3, i4, i5 int) {
|
||||
}
|
||||
|
||||
Binary file not shown.
@@ -16,9 +16,6 @@ func FunctionWithVarArgsParameter(s ...string) string {
|
||||
return ""
|
||||
}
|
||||
|
||||
func FunctionWithVarArgsOutParameter(in string, out ...*string) {
|
||||
}
|
||||
|
||||
func FunctionWithSliceOfStructsParameter(s []A) string {
|
||||
return ""
|
||||
}
|
||||
|
||||
@@ -64,14 +64,8 @@ _resources = [
|
||||
r[len("src/main/resources/"):],
|
||||
)
|
||||
for r in glob(["src/main/resources/**"])
|
||||
if r != "src/main/resources/META-INF/services/org.jetbrains.kotlin.compiler.plugin.CompilerPluginRegistrar"
|
||||
]
|
||||
|
||||
_compiler_plugin_registrar_service = (
|
||||
"src/main/resources/META-INF/services/org.jetbrains.kotlin.compiler.plugin.CompilerPluginRegistrar",
|
||||
"META-INF/services/org.jetbrains.kotlin.compiler.plugin.CompilerPluginRegistrar",
|
||||
)
|
||||
|
||||
kt_javac_options(
|
||||
name = "javac-options",
|
||||
release = "8",
|
||||
@@ -97,26 +91,19 @@ kt_javac_options(
|
||||
# * `resource_strip_prefix` is unique per jar, so we must also put other resources under the same version prefix
|
||||
genrule(
|
||||
name = "resources-%s" % v,
|
||||
srcs = [src for src, _ in _resources] + (
|
||||
[_compiler_plugin_registrar_service[0]] if not version_less(v, "2.4.0") else []
|
||||
),
|
||||
srcs = [src for src, _ in _resources],
|
||||
outs = [
|
||||
"%s/com/github/codeql/extractor.name" % v,
|
||||
] + [
|
||||
"%s/%s" % (v, target)
|
||||
for _, target in _resources
|
||||
] + (
|
||||
["%s/%s" % (v, _compiler_plugin_registrar_service[1])] if not version_less(v, "2.4.0") else []
|
||||
),
|
||||
],
|
||||
cmd = "\n".join([
|
||||
"echo %s-%s > $(RULEDIR)/%s/com/github/codeql/extractor.name" % (_extractor_name_prefix, v, v),
|
||||
] + [
|
||||
"cp $(execpath %s) $(RULEDIR)/%s/%s" % (source, v, target)
|
||||
for source, target in _resources
|
||||
] + (
|
||||
["cp $(execpath %s) $(RULEDIR)/%s/%s" % (_compiler_plugin_registrar_service[0], v, _compiler_plugin_registrar_service[1])]
|
||||
if not version_less(v, "2.4.0") else []
|
||||
)),
|
||||
]),
|
||||
),
|
||||
kt_jvm_library(
|
||||
name = "%s-%s" % (_extractor_name_prefix, v),
|
||||
|
||||
BIN
java/kotlin-extractor/deps/kotlin-compiler-2.4.0.jar
(Stored with Git LFS)
BIN
java/kotlin-extractor/deps/kotlin-compiler-2.4.0.jar
(Stored with Git LFS)
Binary file not shown.
BIN
java/kotlin-extractor/deps/kotlin-compiler-embeddable-2.4.0.jar
(Stored with Git LFS)
BIN
java/kotlin-extractor/deps/kotlin-compiler-embeddable-2.4.0.jar
(Stored with Git LFS)
Binary file not shown.
BIN
java/kotlin-extractor/deps/kotlin-stdlib-2.4.0.jar
(Stored with Git LFS)
BIN
java/kotlin-extractor/deps/kotlin-stdlib-2.4.0.jar
(Stored with Git LFS)
Binary file not shown.
@@ -27,7 +27,7 @@ import shutil
|
||||
import io
|
||||
import os
|
||||
|
||||
DEFAULT_VERSION = "2.4.0"
|
||||
DEFAULT_VERSION = "2.3.20"
|
||||
|
||||
|
||||
def options():
|
||||
|
||||
@@ -3,21 +3,32 @@
|
||||
|
||||
package com.github.codeql
|
||||
|
||||
import com.intellij.mock.MockProject
|
||||
import com.intellij.openapi.extensions.LoadingOrder
|
||||
import org.jetbrains.kotlin.backend.common.extensions.IrGenerationExtension
|
||||
import org.jetbrains.kotlin.config.CompilerConfiguration
|
||||
|
||||
class KotlinExtractorComponentRegistrar : Kotlin2ComponentRegistrar() {
|
||||
override fun doRegisterExtensions(configuration: CompilerConfiguration) {
|
||||
override fun registerProjectComponents(
|
||||
project: MockProject,
|
||||
configuration: CompilerConfiguration
|
||||
) {
|
||||
val invocationTrapFile = configuration[KEY_INVOCATION_TRAP_FILE]
|
||||
if (invocationTrapFile == null) {
|
||||
throw Exception("Required argument for TRAP invocation file not given")
|
||||
}
|
||||
registerExtractorExtension(
|
||||
// Register with LoadingOrder.LAST to ensure the extractor runs after other
|
||||
// IR generation plugins (like kotlinx.serialization) have generated their code.
|
||||
val extensionPoint = project.extensionArea.getExtensionPoint(IrGenerationExtension.extensionPointName)
|
||||
extensionPoint.registerExtension(
|
||||
KotlinExtractorExtension(
|
||||
invocationTrapFile,
|
||||
configuration[KEY_CHECK_TRAP_IDENTICAL] ?: false,
|
||||
configuration[KEY_COMPILATION_STARTTIME],
|
||||
configuration[KEY_EXIT_AFTER_EXTRACTION] ?: false
|
||||
)
|
||||
),
|
||||
LoadingOrder.LAST,
|
||||
project
|
||||
)
|
||||
}
|
||||
}
|
||||
|
||||
@@ -173,9 +173,9 @@ open class KotlinFileExtractor(
|
||||
when (d) {
|
||||
is IrFunction ->
|
||||
when (d.name.asString()) {
|
||||
"toString" -> d.codeQlValueParameters.isEmpty()
|
||||
"hashCode" -> d.codeQlValueParameters.isEmpty()
|
||||
"equals" -> d.codeQlValueParameters.singleOrNull()?.type?.isNullableAny() ?: false
|
||||
"toString" -> d.valueParameters.isEmpty()
|
||||
"hashCode" -> d.valueParameters.isEmpty()
|
||||
"equals" -> d.valueParameters.singleOrNull()?.type?.isNullableAny() ?: false
|
||||
else -> false
|
||||
} && isJavaBinaryDeclaration(d)
|
||||
else -> false
|
||||
@@ -721,7 +721,7 @@ open class KotlinFileExtractor(
|
||||
(it.type as? IrSimpleType)?.classFqName?.asString() != "kotlin.Deprecated"
|
||||
} +
|
||||
// Note we lose any arguments to @java.lang.Deprecated that were written in source.
|
||||
codeQlAnnotationFromSymbolOwner(
|
||||
IrConstructorCallImpl.fromSymbolOwner(
|
||||
UNDEFINED_OFFSET,
|
||||
UNDEFINED_OFFSET,
|
||||
jldConstructor.returnType,
|
||||
@@ -781,13 +781,13 @@ open class KotlinFileExtractor(
|
||||
val locId = tw.getLocation(constructorCall)
|
||||
tw.writeHasLocation(id, locId)
|
||||
|
||||
for (i in 0 until constructorCall.codeQlValueArgumentsCount) {
|
||||
val param = constructorCall.symbol.owner.codeQlValueParameters[i]
|
||||
for (i in 0 until constructorCall.valueArgumentsCount) {
|
||||
val param = constructorCall.symbol.owner.valueParameters[i]
|
||||
val prop =
|
||||
constructorCall.symbol.owner.parentAsClass.declarations
|
||||
.filterIsInstance<IrProperty>()
|
||||
.first { it.name == param.name }
|
||||
val v = constructorCall.codeQlGetValueArgument(i) ?: param.defaultValue?.expression
|
||||
val v = constructorCall.getValueArgument(i) ?: param.defaultValue?.expression
|
||||
val getter = prop.getter
|
||||
if (getter == null) {
|
||||
logger.warnElement("Expected annotation property to define a getter", prop)
|
||||
@@ -1115,9 +1115,9 @@ open class KotlinFileExtractor(
|
||||
returnId,
|
||||
0,
|
||||
returnId,
|
||||
f.codeQlValueParameters.size,
|
||||
f.valueParameters.size,
|
||||
{ argParent, idxOffset ->
|
||||
f.codeQlValueParameters.forEachIndexed { idx, param ->
|
||||
f.valueParameters.forEachIndexed { idx, param ->
|
||||
val syntheticParamId = useValueParameter(param, proxyFunctionId)
|
||||
extractVariableAccess(
|
||||
syntheticParamId,
|
||||
@@ -1695,9 +1695,9 @@ open class KotlinFileExtractor(
|
||||
returnId,
|
||||
0,
|
||||
returnId,
|
||||
f.codeQlValueParameters.size,
|
||||
f.valueParameters.size,
|
||||
{ argParentId, idxOffset ->
|
||||
f.codeQlValueParameters.mapIndexed { idx, param ->
|
||||
f.valueParameters.mapIndexed { idx, param ->
|
||||
val syntheticParamId = useValueParameter(param, functionId)
|
||||
extractVariableAccess(
|
||||
syntheticParamId,
|
||||
@@ -1792,7 +1792,7 @@ open class KotlinFileExtractor(
|
||||
extractBody: Boolean,
|
||||
extractMethodAndParameterTypeAccesses: Boolean
|
||||
) {
|
||||
if (f.codeQlValueParameters.none { it.defaultValue != null }) return
|
||||
if (f.valueParameters.none { it.defaultValue != null }) return
|
||||
|
||||
val id = getDefaultsMethodLabel(f)
|
||||
if (id == null) {
|
||||
@@ -1800,7 +1800,7 @@ open class KotlinFileExtractor(
|
||||
return
|
||||
}
|
||||
val locId = getLocation(f, null)
|
||||
val extReceiver = f.codeQlExtensionReceiverParameter
|
||||
val extReceiver = f.extensionReceiverParameter
|
||||
val dispatchReceiver = if (f.shouldExtractAsStatic) null else f.dispatchReceiverParameter
|
||||
val parameterTypes = getDefaultsMethodArgTypes(f)
|
||||
val allParamTypeResults =
|
||||
@@ -1869,7 +1869,7 @@ open class KotlinFileExtractor(
|
||||
tw.writeCompiler_generated(id, CompilerGeneratedKinds.DEFAULT_ARGUMENTS_METHOD.kind)
|
||||
|
||||
if (extractBody) {
|
||||
val nonSyntheticParams = listOfNotNull(dispatchReceiver) + f.codeQlValueParameters
|
||||
val nonSyntheticParams = listOfNotNull(dispatchReceiver) + f.valueParameters
|
||||
// This stack entry represents as if we're extracting the 'real' function `f`, giving
|
||||
// the indices of its non-synthetic parameters
|
||||
// such that when we extract the default expressions below, any reference to f's nth
|
||||
@@ -1895,12 +1895,12 @@ open class KotlinFileExtractor(
|
||||
val realParamsVarId = getValueParameterLabel(id, parameterTypes.size - 2)
|
||||
val intType = pluginContext.irBuiltIns.intType
|
||||
val paramIdxOffset =
|
||||
listOf(dispatchReceiver, f.codeQlExtensionReceiverParameter).count { it != null }
|
||||
listOf(dispatchReceiver, f.extensionReceiverParameter).count { it != null }
|
||||
extractBlockBody(id, locId).also { blockId ->
|
||||
var nextStmt = 0
|
||||
// For each parameter with a default, sub in the default value if the caller
|
||||
// hasn't supplied a value:
|
||||
f.codeQlValueParameters.forEachIndexed { paramIdx, param ->
|
||||
f.valueParameters.forEachIndexed { paramIdx, param ->
|
||||
val defaultVal = param.defaultValue
|
||||
if (defaultVal != null) {
|
||||
extractIfStmt(locId, blockId, nextStmt++, id).also { ifId ->
|
||||
@@ -1975,7 +1975,7 @@ open class KotlinFileExtractor(
|
||||
id
|
||||
)
|
||||
tw.writeHasLocation(thisCallId, locId)
|
||||
f.codeQlValueParameters.forEachIndexed { idx, param ->
|
||||
f.valueParameters.forEachIndexed { idx, param ->
|
||||
extractVariableAccess(
|
||||
tw.getLabelFor<DbParam>(getValueParameterLabel(id, idx)),
|
||||
param.type,
|
||||
@@ -2003,9 +2003,9 @@ open class KotlinFileExtractor(
|
||||
)
|
||||
.also { thisCallId ->
|
||||
val realFnIdxOffset =
|
||||
if (f.codeQlExtensionReceiverParameter != null) 1 else 0
|
||||
if (f.extensionReceiverParameter != null) 1 else 0
|
||||
val paramMappings =
|
||||
f.codeQlValueParameters.mapIndexed { idx, param ->
|
||||
f.valueParameters.mapIndexed { idx, param ->
|
||||
Triple(
|
||||
param.type,
|
||||
idx + paramIdxOffset,
|
||||
@@ -2156,7 +2156,7 @@ open class KotlinFileExtractor(
|
||||
val dispatchReceiver =
|
||||
f.dispatchReceiverParameter?.let { IrGetValueImpl(-1, -1, it.symbol) }
|
||||
val extensionReceiver =
|
||||
f.codeQlExtensionReceiverParameter?.let { IrGetValueImpl(-1, -1, it.symbol) }
|
||||
f.extensionReceiverParameter?.let { IrGetValueImpl(-1, -1, it.symbol) }
|
||||
|
||||
extractExpressionBody(overloadId, realFunctionLocId).also { returnId ->
|
||||
extractsDefaultsCall(
|
||||
@@ -2180,28 +2180,28 @@ open class KotlinFileExtractor(
|
||||
if (!f.hasAnnotation(jvmOverloadsFqName)) {
|
||||
if (
|
||||
f is IrConstructor &&
|
||||
f.codeQlValueParameters.isNotEmpty() &&
|
||||
f.codeQlValueParameters.all { it.defaultValue != null } &&
|
||||
f.valueParameters.isNotEmpty() &&
|
||||
f.valueParameters.all { it.defaultValue != null } &&
|
||||
f.parentClassOrNull?.let {
|
||||
// Don't create a default constructor for an annotation class, or a class
|
||||
// that explicitly declares a no-arg constructor.
|
||||
!it.isAnnotationClass &&
|
||||
it.declarations.none { d ->
|
||||
d is IrConstructor && d.codeQlValueParameters.isEmpty()
|
||||
d is IrConstructor && d.valueParameters.isEmpty()
|
||||
}
|
||||
} == true
|
||||
) {
|
||||
// Per https://kotlinlang.org/docs/classes.html#creating-instances-of-classes, a
|
||||
// single default overload gets created specifically
|
||||
// when we have all default parameters, regardless of `@JvmOverloads`.
|
||||
extractGeneratedOverload(f.codeQlValueParameters.map { _ -> null })
|
||||
extractGeneratedOverload(f.valueParameters.map { _ -> null })
|
||||
}
|
||||
return
|
||||
}
|
||||
|
||||
val paramList: MutableList<IrValueParameter?> = f.codeQlValueParameters.toMutableList()
|
||||
for (n in (f.codeQlValueParameters.size - 1) downTo 0) {
|
||||
if (f.codeQlValueParameters[n].defaultValue != null) {
|
||||
val paramList: MutableList<IrValueParameter?> = f.valueParameters.toMutableList()
|
||||
for (n in (f.valueParameters.size - 1) downTo 0) {
|
||||
if (f.valueParameters[n].defaultValue != null) {
|
||||
paramList[n] = null // Remove this parameter, to be replaced by a default value
|
||||
extractGeneratedOverload(paramList)
|
||||
}
|
||||
@@ -2327,7 +2327,7 @@ open class KotlinFileExtractor(
|
||||
getClassByFqName(pluginContext, it)?.let { annotationClass ->
|
||||
annotationClass.owner.declarations.firstIsInstanceOrNull<IrConstructor>()?.let {
|
||||
annotationConstructor ->
|
||||
codeQlAnnotationFromSymbolOwner(
|
||||
IrConstructorCallImpl.fromSymbolOwner(
|
||||
UNDEFINED_OFFSET,
|
||||
UNDEFINED_OFFSET,
|
||||
annotationConstructor.returnType,
|
||||
@@ -2388,13 +2388,13 @@ open class KotlinFileExtractor(
|
||||
id
|
||||
}
|
||||
|
||||
val extReceiver = f.codeQlExtensionReceiverParameter
|
||||
val extReceiver = f.extensionReceiverParameter
|
||||
// The following parameter order is correct, because member $default methods (where
|
||||
// the order would be [dispatchParam], [extensionParam], normalParams) are not
|
||||
// extracted here
|
||||
val fParameters =
|
||||
listOfNotNull(extReceiver) +
|
||||
(overriddenAttributes?.valueParameters ?: f.codeQlValueParameters)
|
||||
(overriddenAttributes?.valueParameters ?: f.valueParameters)
|
||||
val paramTypes =
|
||||
fParameters.mapIndexed { i, vp ->
|
||||
extractValueParameter(
|
||||
@@ -3069,14 +3069,14 @@ open class KotlinFileExtractor(
|
||||
logger.errorElement("Unexpected dispatch receiver found", c)
|
||||
}
|
||||
|
||||
if (c.codeQlValueArgumentsCount < 1) {
|
||||
if (c.valueArgumentsCount < 1) {
|
||||
logger.errorElement("No arguments found", c)
|
||||
return
|
||||
}
|
||||
|
||||
extractArgument(id, c, callable, enclosingStmt, 0, "Operand null")
|
||||
|
||||
if (c.codeQlValueArgumentsCount > 1) {
|
||||
if (c.valueArgumentsCount > 1) {
|
||||
logger.errorElement("Extra arguments found", c)
|
||||
}
|
||||
}
|
||||
@@ -3095,21 +3095,21 @@ open class KotlinFileExtractor(
|
||||
logger.errorElement("Unexpected dispatch receiver found", c)
|
||||
}
|
||||
|
||||
if (c.codeQlValueArgumentsCount < 1) {
|
||||
if (c.valueArgumentsCount < 1) {
|
||||
logger.errorElement("No arguments found", c)
|
||||
return
|
||||
}
|
||||
|
||||
extractArgument(id, c, callable, enclosingStmt, 0, "LHS null")
|
||||
|
||||
if (c.codeQlValueArgumentsCount < 2) {
|
||||
if (c.valueArgumentsCount < 2) {
|
||||
logger.errorElement("No RHS found", c)
|
||||
return
|
||||
}
|
||||
|
||||
extractArgument(id, c, callable, enclosingStmt, 1, "RHS null")
|
||||
|
||||
if (c.codeQlValueArgumentsCount > 2) {
|
||||
if (c.valueArgumentsCount > 2) {
|
||||
logger.errorElement("Extra arguments found", c)
|
||||
}
|
||||
}
|
||||
@@ -3122,7 +3122,7 @@ open class KotlinFileExtractor(
|
||||
idx: Int,
|
||||
msg: String
|
||||
) {
|
||||
val op = c.codeQlGetValueArgument(idx)
|
||||
val op = c.getValueArgument(idx)
|
||||
if (op == null) {
|
||||
logger.errorElement(msg, c)
|
||||
} else {
|
||||
@@ -3267,8 +3267,8 @@ open class KotlinFileExtractor(
|
||||
// and which should be replaced by defaults. The final Object parameter is apparently always
|
||||
// null.
|
||||
(listOfNotNull(if (f.shouldExtractAsStatic) null else f.dispatchReceiverParameter?.type) +
|
||||
listOfNotNull(f.codeQlExtensionReceiverParameter?.type) +
|
||||
f.codeQlValueParameters.map { it.type } +
|
||||
listOfNotNull(f.extensionReceiverParameter?.type) +
|
||||
f.valueParameters.map { it.type } +
|
||||
listOf(pluginContext.irBuiltIns.intType, getDefaultsMethodLastArgType(f)))
|
||||
.map { erase(it) }
|
||||
|
||||
@@ -3345,7 +3345,7 @@ open class KotlinFileExtractor(
|
||||
val overriddenCallTarget =
|
||||
(callTarget as? IrSimpleFunction)?.allOverridden(includeSelf = true)?.firstOrNull {
|
||||
it.overriddenSymbols.isEmpty() &&
|
||||
it.codeQlValueParameters.any { p -> p.defaultValue != null }
|
||||
it.valueParameters.any { p -> p.defaultValue != null }
|
||||
} ?: callTarget
|
||||
if (isExternalDeclaration(overriddenCallTarget)) {
|
||||
// Likewise, ensure the overridden target gets extracted.
|
||||
@@ -3419,7 +3419,7 @@ open class KotlinFileExtractor(
|
||||
}
|
||||
|
||||
val valueArgsWithDummies =
|
||||
valueArguments.zip(callTarget.codeQlValueParameters).map { (expr, param) ->
|
||||
valueArguments.zip(callTarget.valueParameters).map { (expr, param) ->
|
||||
expr ?: IrConstImpl.defaultValueForType(0, 0, param.type)
|
||||
}
|
||||
|
||||
@@ -3529,7 +3529,7 @@ open class KotlinFileExtractor(
|
||||
callTarget: IrFunction,
|
||||
valueArguments: List<IrExpression?>
|
||||
): Boolean {
|
||||
val varargParam = callTarget.codeQlValueParameters.withIndex().find { it.value.isVararg }
|
||||
val varargParam = callTarget.valueParameters.withIndex().find { it.value.isVararg }
|
||||
// If the vararg param is the only one not specified, and it has no default value, then we
|
||||
// don't need to call a $default method,
|
||||
// as omitting it already implies passing an empty vararg array.
|
||||
@@ -3805,7 +3805,7 @@ open class KotlinFileExtractor(
|
||||
) =
|
||||
extractCallValueArguments(
|
||||
callId,
|
||||
(0 until call.codeQlValueArgumentsCount).map { call.codeQlGetValueArgument(it) },
|
||||
(0 until call.valueArgumentsCount).map { call.getValueArgument(it) },
|
||||
enclosingStmt,
|
||||
enclosingCallable,
|
||||
idxOffset
|
||||
@@ -3874,7 +3874,7 @@ open class KotlinFileExtractor(
|
||||
(owner.parentClassOrNull?.fqNameWhenAvailable?.asString() == type ||
|
||||
(owner.parent is IrExternalPackageFragment &&
|
||||
getFileClassFqName(owner)?.asString() == type)) &&
|
||||
owner.codeQlValueParameters
|
||||
owner.valueParameters
|
||||
.map { it.type.classFqName?.asString() }
|
||||
.toTypedArray() contentEquals parameterTypes
|
||||
}
|
||||
@@ -3926,8 +3926,8 @@ open class KotlinFileExtractor(
|
||||
val result =
|
||||
javaLangString?.declarations?.findSubType<IrFunction> {
|
||||
it.name.asString() == "valueOf" &&
|
||||
it.codeQlValueParameters.size == 1 &&
|
||||
it.codeQlValueParameters[0].type == pluginContext.irBuiltIns.anyNType
|
||||
it.valueParameters.size == 1 &&
|
||||
it.valueParameters[0].type == pluginContext.irBuiltIns.anyNType
|
||||
}
|
||||
if (result == null) {
|
||||
logger.error("Couldn't find declaration java.lang.String.valueOf(Object)")
|
||||
@@ -3951,7 +3951,7 @@ open class KotlinFileExtractor(
|
||||
val kotlinNoWhenBranchMatchedConstructor by lazy {
|
||||
val result =
|
||||
kotlinNoWhenBranchMatchedExn?.declarations?.findSubType<IrConstructor> {
|
||||
it.codeQlValueParameters.isEmpty()
|
||||
it.valueParameters.isEmpty()
|
||||
}
|
||||
if (result == null) {
|
||||
logger.error("Couldn't find no-arg constructor for kotlin.NoWhenBranchMatchedException")
|
||||
@@ -3990,7 +3990,7 @@ open class KotlinFileExtractor(
|
||||
verboseln("No match as function name is ${target.name.asString()} not $fName")
|
||||
return false
|
||||
}
|
||||
val extensionReceiverParameter = target.codeQlExtensionReceiverParameter
|
||||
val extensionReceiverParameter = target.extensionReceiverParameter
|
||||
val targetClass =
|
||||
if (extensionReceiverParameter == null) {
|
||||
if (isNullable == true) {
|
||||
@@ -4098,8 +4098,8 @@ open class KotlinFileExtractor(
|
||||
) {
|
||||
val typeArgs =
|
||||
if (extractMethodTypeArguments)
|
||||
(0 until c.codeQlTypeArgumentsCount)
|
||||
.map { c.codeQlGetTypeArgument(it) }
|
||||
(0 until c.typeArgumentsCount)
|
||||
.map { c.getTypeArgument(it) }
|
||||
.requireNoNullsOrNull()
|
||||
else listOf()
|
||||
|
||||
@@ -4116,9 +4116,9 @@ open class KotlinFileExtractor(
|
||||
parent,
|
||||
idx,
|
||||
enclosingStmt,
|
||||
(0 until c.codeQlValueArgumentsCount).map { c.codeQlGetValueArgument(it) },
|
||||
(0 until c.valueArgumentsCount).map { c.getValueArgument(it) },
|
||||
c.dispatchReceiver,
|
||||
c.codeQlExtensionReceiver,
|
||||
c.extensionReceiver,
|
||||
typeArgs,
|
||||
extractClassTypeArguments,
|
||||
c.superQualifierSymbol
|
||||
@@ -4126,12 +4126,12 @@ open class KotlinFileExtractor(
|
||||
}
|
||||
|
||||
fun extractSpecialEnumFunction(fnName: String) {
|
||||
if (c.codeQlTypeArgumentsCount != 1) {
|
||||
if (c.typeArgumentsCount != 1) {
|
||||
logger.errorElement("Expected to find exactly one type argument", c)
|
||||
return
|
||||
}
|
||||
|
||||
val enumType = (c.codeQlGetTypeArgument(0) as? IrSimpleType)?.classifier?.owner
|
||||
val enumType = (c.getTypeArgument(0) as? IrSimpleType)?.classifier?.owner
|
||||
if (enumType == null) {
|
||||
logger.errorElement("Couldn't find type of enum type", c)
|
||||
return
|
||||
@@ -4178,13 +4178,13 @@ open class KotlinFileExtractor(
|
||||
} else {
|
||||
extractExpressionExpr(receiver, callable, id, 0, enclosingStmt)
|
||||
}
|
||||
if (c.codeQlValueArgumentsCount < 1) {
|
||||
if (c.valueArgumentsCount < 1) {
|
||||
logger.errorElement("No RHS found", c)
|
||||
} else {
|
||||
if (c.codeQlValueArgumentsCount > 1) {
|
||||
if (c.valueArgumentsCount > 1) {
|
||||
logger.errorElement("Extra arguments found", c)
|
||||
}
|
||||
val arg = c.codeQlGetValueArgument(0)
|
||||
val arg = c.getValueArgument(0)
|
||||
if (arg == null) {
|
||||
logger.errorElement("RHS null", c)
|
||||
} else {
|
||||
@@ -4205,7 +4205,7 @@ open class KotlinFileExtractor(
|
||||
} else {
|
||||
extractExpressionExpr(receiver, callable, id, 0, enclosingStmt)
|
||||
}
|
||||
if (c.codeQlValueArgumentsCount > 0) {
|
||||
if (c.valueArgumentsCount > 0) {
|
||||
logger.errorElement("Extra arguments found", c)
|
||||
}
|
||||
}
|
||||
@@ -4219,7 +4219,7 @@ open class KotlinFileExtractor(
|
||||
}
|
||||
|
||||
fun binopExt(id: Label<out DbExpr>) {
|
||||
binopReceiver(id, c.codeQlExtensionReceiver, "Extension receiver")
|
||||
binopReceiver(id, c.extensionReceiver, "Extension receiver")
|
||||
}
|
||||
|
||||
fun unaryopDisp(id: Label<out DbExpr>) {
|
||||
@@ -4227,7 +4227,7 @@ open class KotlinFileExtractor(
|
||||
}
|
||||
|
||||
fun unaryopExt(id: Label<out DbExpr>) {
|
||||
unaryopReceiver(id, c.codeQlExtensionReceiver, "Extension receiver")
|
||||
unaryopReceiver(id, c.extensionReceiver, "Extension receiver")
|
||||
}
|
||||
|
||||
val dr = c.dispatchReceiver
|
||||
@@ -4249,7 +4249,7 @@ open class KotlinFileExtractor(
|
||||
parent,
|
||||
idx,
|
||||
enclosingStmt,
|
||||
listOf(c.codeQlExtensionReceiver, c.codeQlGetValueArgument(0)),
|
||||
listOf(c.extensionReceiver, c.getValueArgument(0)),
|
||||
null,
|
||||
null
|
||||
)
|
||||
@@ -4350,7 +4350,7 @@ open class KotlinFileExtractor(
|
||||
// != gets desugared into not and ==. Here we resugar it.
|
||||
c.origin == IrStatementOrigin.EXCLEQ &&
|
||||
isFunction(target, "kotlin", "Boolean", "not") &&
|
||||
c.codeQlValueArgumentsCount == 0 &&
|
||||
c.valueArgumentsCount == 0 &&
|
||||
dr != null &&
|
||||
dr is IrCall &&
|
||||
isBuiltinCallInternal(dr, "EQEQ") -> {
|
||||
@@ -4362,7 +4362,7 @@ open class KotlinFileExtractor(
|
||||
}
|
||||
c.origin == IrStatementOrigin.EXCLEQEQ &&
|
||||
isFunction(target, "kotlin", "Boolean", "not") &&
|
||||
c.codeQlValueArgumentsCount == 0 &&
|
||||
c.valueArgumentsCount == 0 &&
|
||||
dr != null &&
|
||||
dr is IrCall &&
|
||||
isBuiltinCallInternal(dr, "EQEQEQ") -> {
|
||||
@@ -4374,7 +4374,7 @@ open class KotlinFileExtractor(
|
||||
}
|
||||
c.origin == IrStatementOrigin.EXCLEQ &&
|
||||
isFunction(target, "kotlin", "Boolean", "not") &&
|
||||
c.codeQlValueArgumentsCount == 0 &&
|
||||
c.valueArgumentsCount == 0 &&
|
||||
dr != null &&
|
||||
dr is IrCall &&
|
||||
isBuiltinCallInternal(dr, "ieee754equals") -> {
|
||||
@@ -4576,7 +4576,7 @@ open class KotlinFileExtractor(
|
||||
parent,
|
||||
idx,
|
||||
enclosingStmt,
|
||||
listOf(c.codeQlExtensionReceiver),
|
||||
listOf(c.extensionReceiver),
|
||||
null,
|
||||
null
|
||||
)
|
||||
@@ -4596,8 +4596,8 @@ open class KotlinFileExtractor(
|
||||
val locId = tw.getLocation(c)
|
||||
extractExprContext(id, locId, callable, enclosingStmt)
|
||||
|
||||
if (c.codeQlTypeArgumentsCount == 1) {
|
||||
val typeArgument = c.codeQlGetTypeArgument(0)
|
||||
if (c.typeArgumentsCount == 1) {
|
||||
val typeArgument = c.getTypeArgument(0)
|
||||
if (typeArgument == null) {
|
||||
logger.errorElement("Type argument missing in an arrayOfNulls call", c)
|
||||
} else {
|
||||
@@ -4618,8 +4618,8 @@ open class KotlinFileExtractor(
|
||||
)
|
||||
}
|
||||
|
||||
if (c.codeQlValueArgumentsCount == 1) {
|
||||
val dim = c.codeQlGetValueArgument(0)
|
||||
if (c.valueArgumentsCount == 1) {
|
||||
val dim = c.getValueArgument(0)
|
||||
if (dim != null) {
|
||||
extractExpressionExpr(dim, callable, id, 0, enclosingStmt)
|
||||
} else {
|
||||
@@ -4651,8 +4651,8 @@ open class KotlinFileExtractor(
|
||||
c.type.getArrayElementTypeCodeQL(pluginContext.irBuiltIns)
|
||||
} else {
|
||||
// TODO: is there any reason not to always use getArrayElementTypeCodeQL?
|
||||
if (c.codeQlTypeArgumentsCount == 1) {
|
||||
c.codeQlGetTypeArgument(0).also {
|
||||
if (c.typeArgumentsCount == 1) {
|
||||
c.getTypeArgument(0).also {
|
||||
if (it == null) {
|
||||
logger.errorElement(
|
||||
"Type argument missing in an arrayOf call",
|
||||
@@ -4670,7 +4670,7 @@ open class KotlinFileExtractor(
|
||||
}
|
||||
|
||||
val arg =
|
||||
if (c.codeQlValueArgumentsCount == 1) c.codeQlGetValueArgument(0)
|
||||
if (c.valueArgumentsCount == 1) c.getValueArgument(0)
|
||||
else {
|
||||
logger.errorElement(
|
||||
"Expected to find only one (vararg) argument in ${c.symbol.owner.name.asString()} call",
|
||||
@@ -4719,7 +4719,7 @@ open class KotlinFileExtractor(
|
||||
return
|
||||
}
|
||||
|
||||
val ext = c.codeQlExtensionReceiver
|
||||
val ext = c.extensionReceiver
|
||||
if (ext == null) {
|
||||
logger.errorElement(
|
||||
"No extension receiver found for `KClass::java` call",
|
||||
@@ -4826,8 +4826,8 @@ open class KotlinFileExtractor(
|
||||
c.origin == IrStatementOrigin.EQ &&
|
||||
c.dispatchReceiver != null -> {
|
||||
val array = c.dispatchReceiver
|
||||
val arrayIdx = c.codeQlGetValueArgument(0)
|
||||
val assignedValue = c.codeQlGetValueArgument(1)
|
||||
val arrayIdx = c.getValueArgument(0)
|
||||
val assignedValue = c.getValueArgument(1)
|
||||
|
||||
if (array != null && arrayIdx != null && assignedValue != null) {
|
||||
|
||||
@@ -4882,22 +4882,22 @@ open class KotlinFileExtractor(
|
||||
}
|
||||
isBuiltinCall(c, "<unsafe-coerce>", "kotlin.jvm.internal") -> {
|
||||
|
||||
if (c.codeQlValueArgumentsCount != 1) {
|
||||
if (c.valueArgumentsCount != 1) {
|
||||
logger.errorElement(
|
||||
"Expected to find one argument for a kotlin.jvm.internal.<unsafe-coerce>() call, but found ${c.codeQlValueArgumentsCount}",
|
||||
"Expected to find one argument for a kotlin.jvm.internal.<unsafe-coerce>() call, but found ${c.valueArgumentsCount}",
|
||||
c
|
||||
)
|
||||
return
|
||||
}
|
||||
|
||||
if (c.codeQlTypeArgumentsCount != 2) {
|
||||
if (c.typeArgumentsCount != 2) {
|
||||
logger.errorElement(
|
||||
"Expected to find two type arguments for a kotlin.jvm.internal.<unsafe-coerce>() call, but found ${c.codeQlTypeArgumentsCount}",
|
||||
"Expected to find two type arguments for a kotlin.jvm.internal.<unsafe-coerce>() call, but found ${c.typeArgumentsCount}",
|
||||
c
|
||||
)
|
||||
return
|
||||
}
|
||||
val valueArg = c.codeQlGetValueArgument(0)
|
||||
val valueArg = c.getValueArgument(0)
|
||||
if (valueArg == null) {
|
||||
logger.errorElement(
|
||||
"Cannot find value argument for a kotlin.jvm.internal.<unsafe-coerce>() call",
|
||||
@@ -4905,7 +4905,7 @@ open class KotlinFileExtractor(
|
||||
)
|
||||
return
|
||||
}
|
||||
val typeArg = c.codeQlGetTypeArgument(1)
|
||||
val typeArg = c.getTypeArgument(1)
|
||||
if (typeArg == null) {
|
||||
logger.errorElement(
|
||||
"Cannot find type argument for a kotlin.jvm.internal.<unsafe-coerce>() call",
|
||||
@@ -4924,7 +4924,7 @@ open class KotlinFileExtractor(
|
||||
extractExpressionExpr(valueArg, callable, id, 1, enclosingStmt)
|
||||
}
|
||||
isBuiltinCallInternal(c, "dataClassArrayMemberToString") -> {
|
||||
val arrayArg = c.codeQlGetValueArgument(0)
|
||||
val arrayArg = c.getValueArgument(0)
|
||||
val realArrayClass = arrayArg?.type?.classOrNull
|
||||
if (realArrayClass == null) {
|
||||
logger.errorElement(
|
||||
@@ -4936,8 +4936,8 @@ open class KotlinFileExtractor(
|
||||
val realCallee =
|
||||
javaUtilArrays?.declarations?.findSubType<IrFunction> { decl ->
|
||||
decl.name.asString() == "toString" &&
|
||||
decl.codeQlValueParameters.size == 1 &&
|
||||
decl.codeQlValueParameters[0].type.classOrNull?.let {
|
||||
decl.valueParameters.size == 1 &&
|
||||
decl.valueParameters[0].type.classOrNull?.let {
|
||||
it == realArrayClass
|
||||
} == true
|
||||
}
|
||||
@@ -4962,7 +4962,7 @@ open class KotlinFileExtractor(
|
||||
}
|
||||
}
|
||||
isBuiltinCallInternal(c, "dataClassArrayMemberHashCode") -> {
|
||||
val arrayArg = c.codeQlGetValueArgument(0)
|
||||
val arrayArg = c.getValueArgument(0)
|
||||
val realArrayClass = arrayArg?.type?.classOrNull
|
||||
if (realArrayClass == null) {
|
||||
logger.errorElement(
|
||||
@@ -4974,8 +4974,8 @@ open class KotlinFileExtractor(
|
||||
val realCallee =
|
||||
javaUtilArrays?.declarations?.findSubType<IrFunction> { decl ->
|
||||
decl.name.asString() == "hashCode" &&
|
||||
decl.codeQlValueParameters.size == 1 &&
|
||||
decl.codeQlValueParameters[0].type.classOrNull?.let {
|
||||
decl.valueParameters.size == 1 &&
|
||||
decl.valueParameters[0].type.classOrNull?.let {
|
||||
it == realArrayClass
|
||||
} == true
|
||||
}
|
||||
@@ -5155,7 +5155,7 @@ open class KotlinFileExtractor(
|
||||
val type = useType(eType)
|
||||
val isAnonymous = eType.isAnonymous
|
||||
val locId = tw.getLocation(e)
|
||||
val valueArgs = (0 until e.codeQlValueArgumentsCount).map { e.codeQlGetValueArgument(it) }
|
||||
val valueArgs = (0 until e.valueArgumentsCount).map { e.getValueArgument(it) }
|
||||
|
||||
val id =
|
||||
if (
|
||||
@@ -5211,10 +5211,10 @@ open class KotlinFileExtractor(
|
||||
realCallTarget is IrConstructor &&
|
||||
realCallTarget.parentClassOrNull?.fqNameWhenAvailable?.asString() ==
|
||||
"kotlin.Enum" &&
|
||||
realCallTarget.codeQlValueParameters.size == 2 &&
|
||||
realCallTarget.codeQlValueParameters[0].type ==
|
||||
realCallTarget.valueParameters.size == 2 &&
|
||||
realCallTarget.valueParameters[0].type ==
|
||||
pluginContext.irBuiltIns.stringType &&
|
||||
realCallTarget.codeQlValueParameters[1].type == pluginContext.irBuiltIns.intType
|
||||
realCallTarget.valueParameters[1].type == pluginContext.irBuiltIns.intType
|
||||
) {
|
||||
|
||||
val id0 =
|
||||
@@ -5287,7 +5287,7 @@ open class KotlinFileExtractor(
|
||||
}
|
||||
|
||||
val args =
|
||||
(0 until e.codeQlTypeArgumentsCount).map { e.codeQlGetTypeArgument(it) }.requireNoNullsOrNull()
|
||||
(0 until e.typeArgumentsCount).map { e.getTypeArgument(it) }.requireNoNullsOrNull()
|
||||
if (args == null) {
|
||||
logger.warnElement("Found null type argument in enum constructor call", e)
|
||||
return
|
||||
@@ -5365,7 +5365,7 @@ open class KotlinFileExtractor(
|
||||
// Check for an expression like x = get(x).op(e):
|
||||
val opReceiver = updateRhs.dispatchReceiver
|
||||
if (isExpectedLhs(opReceiver)) {
|
||||
updateRhs.codeQlGetValueArgument(0)
|
||||
updateRhs.getValueArgument(0)
|
||||
} else null
|
||||
} else null
|
||||
}
|
||||
@@ -5560,7 +5560,7 @@ open class KotlinFileExtractor(
|
||||
"set"
|
||||
)
|
||||
) {
|
||||
val updateRhs0 = arraySetCall.codeQlGetValueArgument(1)
|
||||
val updateRhs0 = arraySetCall.getValueArgument(1)
|
||||
if (updateRhs0 == null) {
|
||||
logger.errorElement("Update RHS not found", e)
|
||||
return false
|
||||
@@ -6403,12 +6403,12 @@ open class KotlinFileExtractor(
|
||||
val ids = getLocallyVisibleFunctionLabels(e.function)
|
||||
val locId = tw.getLocation(e)
|
||||
|
||||
val ext = e.function.codeQlExtensionReceiverParameter
|
||||
val ext = e.function.extensionReceiverParameter
|
||||
val parameters =
|
||||
if (ext != null) {
|
||||
listOf(ext) + e.function.codeQlValueParameters
|
||||
listOf(ext) + e.function.valueParameters
|
||||
} else {
|
||||
e.function.codeQlValueParameters
|
||||
e.function.valueParameters
|
||||
}
|
||||
|
||||
var types = parameters.map { it.type }
|
||||
@@ -6670,7 +6670,7 @@ open class KotlinFileExtractor(
|
||||
is IrFunction -> {
|
||||
if (
|
||||
ownerParent.dispatchReceiverParameter == owner &&
|
||||
ownerParent.codeQlExtensionReceiverParameter != null
|
||||
ownerParent.extensionReceiverParameter != null
|
||||
) {
|
||||
|
||||
val ownerParent2 = ownerParent.parent
|
||||
@@ -7089,7 +7089,7 @@ open class KotlinFileExtractor(
|
||||
makeReceiverInfo(callableReferenceExpr.dispatchReceiver, 0)
|
||||
private val extensionReceiverInfo =
|
||||
makeReceiverInfo(
|
||||
callableReferenceExpr.codeQlExtensionReceiver,
|
||||
callableReferenceExpr.extensionReceiver,
|
||||
if (dispatchReceiverInfo == null) 0 else 1
|
||||
)
|
||||
|
||||
@@ -7627,8 +7627,8 @@ open class KotlinFileExtractor(
|
||||
}
|
||||
|
||||
val expressionTypeArguments =
|
||||
(0 until propertyReferenceExpr.codeQlTypeArgumentsCount).mapNotNull {
|
||||
propertyReferenceExpr.codeQlGetTypeArgument(it)
|
||||
(0 until propertyReferenceExpr.typeArgumentsCount).mapNotNull {
|
||||
propertyReferenceExpr.getTypeArgument(it)
|
||||
}
|
||||
|
||||
val idPropertyRef = tw.getFreshIdLabel<DbPropertyref>()
|
||||
@@ -7808,7 +7808,7 @@ open class KotlinFileExtractor(
|
||||
* constructor(dispatchReceiver: TD, extensionReceiver: TE) {
|
||||
* super()
|
||||
* this.dispatchReceiver = dispatchReceiver
|
||||
* this.codeQlExtensionReceiver = extensionReceiver
|
||||
* this.extensionReceiver = extensionReceiver
|
||||
* }
|
||||
* fun invoke(a0:T0, a1:T1, ... aI: TI): R { return this.dispatchReceiver.FN(a0,a1,...,aI) } OR
|
||||
* fun invoke( a1:T1, ... aI: TI): R { return this.dispatchReceiver.FN(this.dispatchReceiver,a1,...,aI) } OR
|
||||
@@ -7829,7 +7829,7 @@ open class KotlinFileExtractor(
|
||||
|
||||
if (
|
||||
functionReferenceExpr.dispatchReceiver != null &&
|
||||
functionReferenceExpr.codeQlExtensionReceiver != null
|
||||
functionReferenceExpr.extensionReceiver != null
|
||||
) {
|
||||
logger.errorElement(
|
||||
"Unexpected: dispatchReceiver and extensionReceiver are both non-null",
|
||||
@@ -7840,7 +7840,7 @@ open class KotlinFileExtractor(
|
||||
|
||||
if (
|
||||
target.owner.dispatchReceiverParameter != null &&
|
||||
target.owner.codeQlExtensionReceiverParameter != null
|
||||
target.owner.extensionReceiverParameter != null
|
||||
) {
|
||||
logger.errorElement(
|
||||
"Unexpected: dispatch and extension parameters are both non-null",
|
||||
@@ -7899,8 +7899,8 @@ open class KotlinFileExtractor(
|
||||
null
|
||||
}
|
||||
expressionTypeArguments =
|
||||
(0 until functionReferenceExpr.codeQlTypeArgumentsCount).mapNotNull {
|
||||
functionReferenceExpr.codeQlGetTypeArgument(it)
|
||||
(0 until functionReferenceExpr.typeArgumentsCount).mapNotNull {
|
||||
functionReferenceExpr.getTypeArgument(it)
|
||||
}
|
||||
dispatchReceiverIdx = -1
|
||||
}
|
||||
@@ -7965,7 +7965,7 @@ open class KotlinFileExtractor(
|
||||
functionReferenceExpr,
|
||||
declarationParent,
|
||||
null,
|
||||
{ it.codeQlValueParameters.size == 1 }
|
||||
{ it.valueParameters.size == 1 }
|
||||
) {
|
||||
// The argument to FunctionReference's constructor is the function arity.
|
||||
extractConstantInteger(
|
||||
@@ -8572,7 +8572,7 @@ open class KotlinFileExtractor(
|
||||
reverse: Boolean = false
|
||||
) {
|
||||
val typeArguments =
|
||||
(0 until c.codeQlTypeArgumentsCount).map { c.codeQlGetTypeArgument(it) }.requireNoNullsOrNull()
|
||||
(0 until c.typeArgumentsCount).map { c.getTypeArgument(it) }.requireNoNullsOrNull()
|
||||
if (typeArguments == null) {
|
||||
logger.errorElement("Found a null type argument for a member access expression", c)
|
||||
} else {
|
||||
@@ -8923,11 +8923,11 @@ open class KotlinFileExtractor(
|
||||
tw.writeVariableBinding(lhsId, fieldId)
|
||||
|
||||
val parameters = mutableListOf<IrValueParameter>()
|
||||
val extParam = samMember.codeQlExtensionReceiverParameter
|
||||
val extParam = samMember.extensionReceiverParameter
|
||||
if (extParam != null) {
|
||||
parameters.add(extParam)
|
||||
}
|
||||
parameters.addAll(samMember.codeQlValueParameters)
|
||||
parameters.addAll(samMember.valueParameters)
|
||||
|
||||
fun extractArgument(
|
||||
p: IrValueParameter,
|
||||
@@ -9032,7 +9032,7 @@ open class KotlinFileExtractor(
|
||||
elementToReportOn: IrElement,
|
||||
declarationParent: IrDeclarationParent,
|
||||
compilerGeneratedKindOverride: CompilerGeneratedKinds? = null,
|
||||
superConstructorSelector: (IrFunction) -> Boolean = { it.codeQlValueParameters.isEmpty() },
|
||||
superConstructorSelector: (IrFunction) -> Boolean = { it.valueParameters.isEmpty() },
|
||||
extractSuperconstructorArgs: (Label<DbSuperconstructorinvocationstmt>) -> Unit = {},
|
||||
): Label<out DbClassorinterface> {
|
||||
// Write class
|
||||
|
||||
@@ -12,7 +12,7 @@ import org.jetbrains.kotlin.ir.ObsoleteDescriptorBasedAPI
|
||||
import org.jetbrains.kotlin.ir.declarations.*
|
||||
import org.jetbrains.kotlin.ir.expressions.*
|
||||
import org.jetbrains.kotlin.ir.symbols.*
|
||||
import com.github.codeql.utils.versions.codeQlAddAnnotations
|
||||
import org.jetbrains.kotlin.ir.types.addAnnotations
|
||||
import org.jetbrains.kotlin.ir.types.classFqName
|
||||
import org.jetbrains.kotlin.ir.types.classifierOrNull
|
||||
import org.jetbrains.kotlin.ir.types.classOrNull
|
||||
@@ -355,7 +355,7 @@ open class KotlinUsesExtractor(
|
||||
}
|
||||
|
||||
private fun propertySignature(p: IrProperty) =
|
||||
((p.getter ?: p.setter)?.codeQlExtensionReceiverParameter?.let {
|
||||
((p.getter ?: p.setter)?.extensionReceiverParameter?.let {
|
||||
useType(erase(it.type)).javaResult.signature
|
||||
} ?: "")
|
||||
|
||||
@@ -368,7 +368,7 @@ open class KotlinUsesExtractor(
|
||||
// useDeclarationParent -> useFunction
|
||||
// -> extractFunctionLaterIfExternalFileMember, which would result for `fun <T> f(t:
|
||||
// T) { ... }` for example.
|
||||
(listOfNotNull(d.codeQlExtensionReceiverParameter) + d.codeQlValueParameters)
|
||||
(listOfNotNull(d.extensionReceiverParameter) + d.valueParameters)
|
||||
.map { useType(erase(it.type)).javaResult.signature }
|
||||
.joinToString(separator = ",", prefix = "(", postfix = ")")
|
||||
is IrProperty -> propertySignature(d) + externalClassExtractor.propertySignature
|
||||
@@ -488,8 +488,8 @@ open class KotlinUsesExtractor(
|
||||
val result =
|
||||
replacementClass.declarations.findSubType<IrSimpleFunction> { replacementDecl ->
|
||||
replacementDecl.name == f.name &&
|
||||
replacementDecl.codeQlValueParameters.size == f.codeQlValueParameters.size &&
|
||||
replacementDecl.codeQlValueParameters.zip(f.codeQlValueParameters).all {
|
||||
replacementDecl.valueParameters.size == f.valueParameters.size &&
|
||||
replacementDecl.valueParameters.zip(f.valueParameters).all {
|
||||
erase(it.first.type) == erase(it.second.type)
|
||||
}
|
||||
}
|
||||
@@ -1265,7 +1265,7 @@ open class KotlinUsesExtractor(
|
||||
private fun getWildcardSuppressionDirective(t: IrAnnotationContainer): Boolean? =
|
||||
t.getAnnotation(jvmWildcardSuppressionAnnotation)?.let {
|
||||
@Suppress("USELESS_CAST") // `as? Boolean` is not needed for Kotlin < 2.1
|
||||
(it.codeQlGetValueArgument(0) as? CodeQLIrConst<Boolean>)?.value as? Boolean ?: true
|
||||
(it.getValueArgument(0) as? CodeQLIrConst<Boolean>)?.value as? Boolean ?: true
|
||||
}
|
||||
|
||||
private fun addJavaLoweringArgumentWildcards(
|
||||
@@ -1376,9 +1376,9 @@ open class KotlinUsesExtractor(
|
||||
f.parent,
|
||||
parentId,
|
||||
getFunctionShortName(f).nameInDB,
|
||||
(maybeParameterList ?: f.codeQlValueParameters).map { it.type },
|
||||
(maybeParameterList ?: f.valueParameters).map { it.type },
|
||||
getAdjustedReturnType(f),
|
||||
f.codeQlExtensionReceiverParameter?.type,
|
||||
f.extensionReceiverParameter?.type,
|
||||
getFunctionTypeParameters(f),
|
||||
classTypeArgsIncludingOuterClasses,
|
||||
overridesCollectionsMethodWithAlteredParameterTypes(f),
|
||||
@@ -1401,12 +1401,12 @@ open class KotlinUsesExtractor(
|
||||
// The name of the function; normally f.name.asString().
|
||||
name: String,
|
||||
// The types of the value parameters that the functions takes; normally
|
||||
// f.codeQlValueParameters.map { it.type }.
|
||||
// f.valueParameters.map { it.type }.
|
||||
parameterTypes: List<IrType>,
|
||||
// The return type of the function; normally f.returnType.
|
||||
returnType: IrType,
|
||||
// The extension receiver of the function, if any; normally
|
||||
// f.codeQlExtensionReceiverParameter?.type.
|
||||
// f.extensionReceiverParameter?.type.
|
||||
extensionParamType: IrType?,
|
||||
// The type parameters of the function. This does not include type parameters of enclosing
|
||||
// classes.
|
||||
@@ -1579,7 +1579,7 @@ open class KotlinUsesExtractor(
|
||||
parentClass.fqNameWhenAvailable?.asString() !=
|
||||
"java.util.concurrent.ConcurrentHashMap" ||
|
||||
getFunctionShortName(f).nameInDB != "keySet" ||
|
||||
f.codeQlValueParameters.isNotEmpty() ||
|
||||
f.valueParameters.isNotEmpty() ||
|
||||
f.returnType.classFqName?.asString() != "kotlin.collections.MutableSet"
|
||||
) {
|
||||
return f.returnType
|
||||
@@ -1587,7 +1587,7 @@ open class KotlinUsesExtractor(
|
||||
|
||||
val otherKeySet =
|
||||
parentClass.declarations.findSubType<IrFunction> {
|
||||
it.name.asString() == "keySet" && it.codeQlValueParameters.size == 1
|
||||
it.name.asString() == "keySet" && it.valueParameters.size == 1
|
||||
} ?: return f.returnType
|
||||
|
||||
return otherKeySet.returnType.codeQlWithHasQuestionMark(false)
|
||||
@@ -1695,8 +1695,8 @@ open class KotlinUsesExtractor(
|
||||
javaClass.declarations.findSubType<IrFunction> { decl ->
|
||||
!decl.isFakeOverride &&
|
||||
decl.name.asString() == jvmName &&
|
||||
decl.codeQlValueParameters.size == f.codeQlValueParameters.size &&
|
||||
decl.codeQlValueParameters.zip(f.codeQlValueParameters).all { p ->
|
||||
decl.valueParameters.size == f.valueParameters.size &&
|
||||
decl.valueParameters.zip(f.valueParameters).all { p ->
|
||||
erase(p.first.type).classifierOrNull ==
|
||||
erase(p.second.type).classifierOrNull
|
||||
}
|
||||
@@ -2125,7 +2125,7 @@ open class KotlinUsesExtractor(
|
||||
}
|
||||
|
||||
return if (t.arguments.isNotEmpty())
|
||||
t.codeQlAddAnnotations(listOf(RawTypeAnnotation.annotationConstructor))
|
||||
t.addAnnotations(listOf(RawTypeAnnotation.annotationConstructor))
|
||||
else t
|
||||
}
|
||||
}
|
||||
@@ -2153,7 +2153,7 @@ open class KotlinUsesExtractor(
|
||||
val idxOffset =
|
||||
if (
|
||||
declarationParent is IrFunction &&
|
||||
declarationParent.codeQlExtensionReceiverParameter != null
|
||||
declarationParent.extensionReceiverParameter != null
|
||||
)
|
||||
// For extension functions increase the index to match what the java extractor sees:
|
||||
1
|
||||
@@ -2187,7 +2187,7 @@ open class KotlinUsesExtractor(
|
||||
// Gets a field's corresponding property's extension receiver type, if any
|
||||
fun getExtensionReceiverType(f: IrField) =
|
||||
f.correspondingPropertySymbol?.owner?.let {
|
||||
(it.getter ?: it.setter)?.codeQlExtensionReceiverParameter?.type
|
||||
(it.getter ?: it.setter)?.extensionReceiverParameter?.type
|
||||
}
|
||||
|
||||
fun getFieldLabel(f: IrField): String {
|
||||
@@ -2222,14 +2222,14 @@ open class KotlinUsesExtractor(
|
||||
val setter = p.setter
|
||||
|
||||
val func = getter ?: setter
|
||||
val ext = func?.codeQlExtensionReceiverParameter
|
||||
val ext = func?.extensionReceiverParameter
|
||||
|
||||
return if (ext == null) {
|
||||
"@\"property;{$parentId};${p.name.asString()}\""
|
||||
} else {
|
||||
val returnType =
|
||||
getter?.returnType
|
||||
?: setter?.codeQlValueParameters?.singleOrNull()?.type
|
||||
?: setter?.valueParameters?.singleOrNull()?.type
|
||||
?: pluginContext.irBuiltIns.unitType
|
||||
val typeParams = getFunctionTypeParameters(func)
|
||||
|
||||
|
||||
@@ -1,10 +1,5 @@
|
||||
package com.github.codeql
|
||||
|
||||
import com.github.codeql.utils.versions.codeQlAnnotationFromSymbolOwner
|
||||
import com.github.codeql.utils.versions.codeQlGetValueArgument
|
||||
import com.github.codeql.utils.versions.codeQlPutValueArgument
|
||||
import com.github.codeql.utils.versions.codeQlSetAnnotations
|
||||
import com.github.codeql.utils.versions.codeQlSetDispatchReceiverParameter
|
||||
import com.github.codeql.utils.versions.createImplicitParameterDeclarationWithWrappedDescriptor
|
||||
import java.lang.annotation.ElementType
|
||||
import java.util.HashSet
|
||||
@@ -100,7 +95,7 @@ class MetaAnnotationSupport(
|
||||
JvmAnnotationNames.REPEATABLE_ANNOTATION
|
||||
}
|
||||
return if (jvmRepeatable != null) {
|
||||
((jvmRepeatable.codeQlGetValueArgument(0) as? IrClassReference)?.symbol as? IrClassSymbol)
|
||||
((jvmRepeatable.getValueArgument(0) as? IrClassReference)?.symbol as? IrClassSymbol)
|
||||
?.owner
|
||||
} else {
|
||||
getOrCreateSyntheticRepeatableAnnotationContainer(annotationClass)
|
||||
@@ -122,12 +117,12 @@ class MetaAnnotationSupport(
|
||||
)
|
||||
return null
|
||||
} else {
|
||||
return codeQlAnnotationFromSymbolOwner(
|
||||
return IrConstructorCallImpl.fromSymbolOwner(
|
||||
containerClass.defaultType,
|
||||
containerConstructor.symbol
|
||||
)
|
||||
.apply {
|
||||
codeQlPutValueArgument(
|
||||
putValueArgument(
|
||||
0,
|
||||
IrVarargImpl(
|
||||
UNDEFINED_OFFSET,
|
||||
@@ -149,7 +144,7 @@ class MetaAnnotationSupport(
|
||||
|
||||
// Taken from AdditionalClassAnnotationLowering.kt
|
||||
private fun loadAnnotationTargets(targetEntry: IrConstructorCall): Set<KotlinTarget>? {
|
||||
val valueArgument = targetEntry.codeQlGetValueArgument(0) as? IrVararg ?: return null
|
||||
val valueArgument = targetEntry.getValueArgument(0) as? IrVararg ?: return null
|
||||
return valueArgument.elements
|
||||
.filterIsInstance<IrGetEnumValue>()
|
||||
.mapNotNull { KotlinTarget.valueOrNull(it.symbol.owner.name.asString()) }
|
||||
@@ -235,14 +230,14 @@ class MetaAnnotationSupport(
|
||||
)
|
||||
}
|
||||
|
||||
return codeQlAnnotationFromSymbolOwner(
|
||||
return IrConstructorCallImpl.fromSymbolOwner(
|
||||
UNDEFINED_OFFSET,
|
||||
UNDEFINED_OFFSET,
|
||||
targetConstructor.returnType,
|
||||
targetConstructor.symbol,
|
||||
0
|
||||
)
|
||||
.apply { codeQlPutValueArgument(0, vararg) }
|
||||
.apply { putValueArgument(0, vararg) }
|
||||
}
|
||||
|
||||
private val javaAnnotationRetention by lazy {
|
||||
@@ -268,7 +263,7 @@ class MetaAnnotationSupport(
|
||||
// Taken from AnnotationCodegen.kt (not available in Kotlin < 1.6.20)
|
||||
private fun IrClass.getAnnotationRetention(): KotlinRetention? {
|
||||
val retentionArgument =
|
||||
getAnnotation(StandardNames.FqNames.retention)?.codeQlGetValueArgument(0) as? IrGetEnumValue
|
||||
getAnnotation(StandardNames.FqNames.retention)?.getValueArgument(0) as? IrGetEnumValue
|
||||
?: return null
|
||||
val retentionArgumentValue = retentionArgument.symbol.owner
|
||||
return KotlinRetention.valueOf(retentionArgumentValue.name.asString())
|
||||
@@ -288,7 +283,7 @@ class MetaAnnotationSupport(
|
||||
val targetConstructor =
|
||||
retentionType.declarations.firstIsInstanceOrNull<IrConstructor>() ?: return null
|
||||
|
||||
return codeQlAnnotationFromSymbolOwner(
|
||||
return IrConstructorCallImpl.fromSymbolOwner(
|
||||
UNDEFINED_OFFSET,
|
||||
UNDEFINED_OFFSET,
|
||||
targetConstructor.returnType,
|
||||
@@ -296,7 +291,7 @@ class MetaAnnotationSupport(
|
||||
0
|
||||
)
|
||||
.apply {
|
||||
codeQlPutValueArgument(
|
||||
putValueArgument(
|
||||
0,
|
||||
IrGetEnumValueImpl(
|
||||
UNDEFINED_OFFSET,
|
||||
@@ -338,7 +333,7 @@ class MetaAnnotationSupport(
|
||||
return
|
||||
}
|
||||
val newParam = thisReceiever.copyTo(this)
|
||||
codeQlSetDispatchReceiverParameter(newParam)
|
||||
dispatchReceiverParameter = newParam
|
||||
body =
|
||||
factory
|
||||
.createBlockBody(UNDEFINED_OFFSET, UNDEFINED_OFFSET)
|
||||
@@ -411,7 +406,7 @@ class MetaAnnotationSupport(
|
||||
val repeatableContainerAnnotation =
|
||||
kotlinAnnotationRepeatableContainer?.constructors?.single()
|
||||
|
||||
codeQlSetAnnotations(containerClass,
|
||||
containerClass.annotations =
|
||||
annotationClass.annotations
|
||||
.filter {
|
||||
it.isAnnotationWithEqualFqName(StandardNames.FqNames.retention) ||
|
||||
@@ -420,7 +415,7 @@ class MetaAnnotationSupport(
|
||||
.map { it.deepCopyWithSymbols(containerClass) } +
|
||||
listOfNotNull(
|
||||
repeatableContainerAnnotation?.let {
|
||||
codeQlAnnotationFromSymbolOwner(
|
||||
IrConstructorCallImpl.fromSymbolOwner(
|
||||
UNDEFINED_OFFSET,
|
||||
UNDEFINED_OFFSET,
|
||||
it.returnType,
|
||||
@@ -429,7 +424,6 @@ class MetaAnnotationSupport(
|
||||
)
|
||||
}
|
||||
)
|
||||
)
|
||||
|
||||
containerClass
|
||||
}
|
||||
@@ -468,14 +462,14 @@ class MetaAnnotationSupport(
|
||||
containerClass.symbol,
|
||||
containerClass.defaultType
|
||||
)
|
||||
return codeQlAnnotationFromSymbolOwner(
|
||||
return IrConstructorCallImpl.fromSymbolOwner(
|
||||
UNDEFINED_OFFSET,
|
||||
UNDEFINED_OFFSET,
|
||||
repeatableConstructor.returnType,
|
||||
repeatableConstructor.symbol,
|
||||
0
|
||||
)
|
||||
.apply { codeQlPutValueArgument(0, containerReference) }
|
||||
.apply { putValueArgument(0, containerReference) }
|
||||
}
|
||||
|
||||
private val javaAnnotationDocumented by lazy {
|
||||
@@ -494,7 +488,7 @@ class MetaAnnotationSupport(
|
||||
javaAnnotationDocumented?.declarations?.firstIsInstanceOrNull<IrConstructor>()
|
||||
?: return null
|
||||
|
||||
return codeQlAnnotationFromSymbolOwner(
|
||||
return IrConstructorCallImpl.fromSymbolOwner(
|
||||
UNDEFINED_OFFSET,
|
||||
UNDEFINED_OFFSET,
|
||||
documentedConstructor.returnType,
|
||||
|
||||
@@ -1,7 +1,6 @@
|
||||
package com.github.codeql
|
||||
|
||||
import com.github.codeql.KotlinUsesExtractor.LocallyVisibleFunctionLabels
|
||||
import com.github.codeql.utils.versions.codeQlExtensionReceiver
|
||||
import com.semmle.extractor.java.PopulateFile
|
||||
import com.semmle.util.unicode.UTF8Util
|
||||
import java.io.BufferedWriter
|
||||
@@ -332,7 +331,7 @@ open class FileTrapWriter(
|
||||
is IrCall -> {
|
||||
// Calls have incorrect startOffset, so we adjust them:
|
||||
val dr = e.dispatchReceiver?.let { getStartOffset(it) }
|
||||
val er = e.codeQlExtensionReceiver?.let { getStartOffset(it) }
|
||||
val er = e.extensionReceiver?.let { getStartOffset(it) }
|
||||
offsetMinOf(e.startOffset, dr, er)
|
||||
}
|
||||
else -> e.startOffset
|
||||
|
||||
@@ -2,7 +2,6 @@ package com.github.codeql.comments
|
||||
|
||||
import com.github.codeql.*
|
||||
import com.github.codeql.utils.isLocalFunction
|
||||
import com.github.codeql.utils.versions.codeQlExtensionReceiverParameter
|
||||
import com.github.codeql.utils.versions.isDispatchReceiver
|
||||
import org.jetbrains.kotlin.ir.IrElement
|
||||
import org.jetbrains.kotlin.ir.declarations.*
|
||||
@@ -12,7 +11,7 @@ import org.jetbrains.kotlin.ir.util.parentClassOrNull
|
||||
|
||||
private fun IrValueParameter.isExtensionReceiver(): Boolean {
|
||||
val parentFun = parent as? IrFunction ?: return false
|
||||
return parentFun.codeQlExtensionReceiverParameter == this
|
||||
return parentFun.extensionReceiverParameter == this
|
||||
}
|
||||
|
||||
open class CommentExtractor(
|
||||
|
||||
@@ -1,8 +1,6 @@
|
||||
package com.github.codeql.utils
|
||||
|
||||
import com.github.codeql.utils.versions.CodeQLIrConst
|
||||
import com.github.codeql.utils.versions.codeQlGetValueArgument
|
||||
import com.github.codeql.utils.versions.codeQlValueArgumentsCount
|
||||
import org.jetbrains.kotlin.builtins.StandardNames
|
||||
import org.jetbrains.kotlin.ir.declarations.IrAnnotationContainer
|
||||
import org.jetbrains.kotlin.ir.declarations.IrClass
|
||||
@@ -78,9 +76,9 @@ private fun getSpecialJvmName(f: IrFunction): String? {
|
||||
fun getJvmName(container: IrAnnotationContainer): String? {
|
||||
for (a: IrConstructorCall in container.annotations) {
|
||||
val t = a.type
|
||||
if (t is IrSimpleType && a.codeQlValueArgumentsCount == 1) {
|
||||
if (t is IrSimpleType && a.valueArgumentsCount == 1) {
|
||||
val owner = t.classifier.owner
|
||||
val v = a.codeQlGetValueArgument(0)
|
||||
val v = a.getValueArgument(0)
|
||||
if (owner is IrClass) {
|
||||
val aPkg = owner.packageFqName?.asString()
|
||||
val name = owner.name.asString()
|
||||
|
||||
@@ -18,7 +18,7 @@ import org.jetbrains.kotlin.ir.expressions.IrConstructorCall
|
||||
import org.jetbrains.kotlin.ir.expressions.impl.*
|
||||
import org.jetbrains.kotlin.ir.symbols.IrTypeParameterSymbol
|
||||
import org.jetbrains.kotlin.ir.symbols.impl.DescriptorlessExternalPackageFragmentSymbol
|
||||
import com.github.codeql.utils.versions.codeQlAddAnnotations
|
||||
import org.jetbrains.kotlin.ir.types.addAnnotations
|
||||
import org.jetbrains.kotlin.ir.types.classifierOrNull
|
||||
import org.jetbrains.kotlin.ir.types.makeNotNull
|
||||
import org.jetbrains.kotlin.ir.types.makeNullable
|
||||
@@ -192,7 +192,7 @@ object RawTypeAnnotation {
|
||||
addConstructor { isPrimary = true }
|
||||
}
|
||||
val constructor = annoClass.constructors.single()
|
||||
codeQlAnnotationFromSymbolOwner(constructor.constructedClassType, constructor.symbol)
|
||||
IrConstructorCallImpl.fromSymbolOwner(constructor.constructedClassType, constructor.symbol)
|
||||
}
|
||||
}
|
||||
|
||||
@@ -202,7 +202,7 @@ fun IrType.toRawType(): IrType =
|
||||
when (val owner = this.classifier.owner) {
|
||||
is IrClass -> {
|
||||
if (this.arguments.isNotEmpty())
|
||||
this.codeQlAddAnnotations(listOf(RawTypeAnnotation.annotationConstructor))
|
||||
this.addAnnotations(listOf(RawTypeAnnotation.annotationConstructor))
|
||||
else this
|
||||
}
|
||||
is IrTypeParameter -> owner.superTypes[0].toRawType()
|
||||
@@ -215,7 +215,7 @@ fun IrType.toRawType(): IrType =
|
||||
fun IrClass.toRawType(): IrType {
|
||||
val result = this.typeWith(listOf())
|
||||
return if (this.typeParameters.isNotEmpty())
|
||||
result.codeQlAddAnnotations(listOf(RawTypeAnnotation.annotationConstructor))
|
||||
result.addAnnotations(listOf(RawTypeAnnotation.annotationConstructor))
|
||||
else result
|
||||
}
|
||||
|
||||
|
||||
@@ -1,71 +0,0 @@
|
||||
package com.github.codeql.utils.versions
|
||||
|
||||
import org.jetbrains.kotlin.ir.declarations.IrFunction
|
||||
import org.jetbrains.kotlin.ir.declarations.IrValueParameter
|
||||
import org.jetbrains.kotlin.ir.expressions.IrConstructorCall
|
||||
import org.jetbrains.kotlin.ir.expressions.IrExpression
|
||||
import org.jetbrains.kotlin.ir.expressions.IrMemberAccessExpression
|
||||
import org.jetbrains.kotlin.ir.expressions.impl.*
|
||||
import org.jetbrains.kotlin.ir.symbols.IrConstructorSymbol
|
||||
import org.jetbrains.kotlin.ir.types.IrType
|
||||
import org.jetbrains.kotlin.ir.types.addAnnotations
|
||||
|
||||
/**
|
||||
* Compatibility accessors for pre-2.4.0 API patterns.
|
||||
* In pre-2.4.0 versions, these delegate directly to the existing APIs.
|
||||
*/
|
||||
|
||||
// IrFunction: valueParameters
|
||||
val IrFunction.codeQlValueParameters: List<IrValueParameter>
|
||||
get() = valueParameters
|
||||
|
||||
// IrFunction: extensionReceiverParameter
|
||||
val IrFunction.codeQlExtensionReceiverParameter: IrValueParameter?
|
||||
get() = extensionReceiverParameter
|
||||
|
||||
// IrMemberAccessExpression: valueArgumentsCount
|
||||
val IrMemberAccessExpression<*>.codeQlValueArgumentsCount: Int
|
||||
get() = valueArgumentsCount
|
||||
|
||||
// IrMemberAccessExpression: getValueArgument
|
||||
fun IrMemberAccessExpression<*>.codeQlGetValueArgument(index: Int): IrExpression? = getValueArgument(index)
|
||||
|
||||
// IrMemberAccessExpression: putValueArgument
|
||||
fun IrMemberAccessExpression<*>.codeQlPutValueArgument(index: Int, value: IrExpression?) {
|
||||
putValueArgument(index, value)
|
||||
}
|
||||
|
||||
// IrMemberAccessExpression: extensionReceiver
|
||||
var IrMemberAccessExpression<*>.codeQlExtensionReceiver: IrExpression?
|
||||
get() = extensionReceiver
|
||||
set(value) { extensionReceiver = value }
|
||||
|
||||
// IrMemberAccessExpression: typeArgumentsCount
|
||||
val IrMemberAccessExpression<*>.codeQlTypeArgumentsCount: Int
|
||||
get() = typeArgumentsCount
|
||||
|
||||
// IrMemberAccessExpression: getTypeArgument
|
||||
fun IrMemberAccessExpression<*>.codeQlGetTypeArgument(index: Int): IrType? = getTypeArgument(index)
|
||||
|
||||
// addAnnotations compat: in pre-2.4.0, addAnnotations expects List<IrConstructorCall>
|
||||
fun IrType.codeQlAddAnnotations(annotations: List<IrConstructorCall>): IrType =
|
||||
addAnnotations(annotations)
|
||||
|
||||
// IrMutableAnnotationContainer.annotations setter: in pre-2.4.0, annotations is var with List<IrConstructorCall>
|
||||
fun codeQlSetAnnotations(container: org.jetbrains.kotlin.ir.declarations.IrMutableAnnotationContainer, annotations: List<IrConstructorCall>) {
|
||||
container.annotations = annotations
|
||||
}
|
||||
|
||||
// IrFunction: set dispatch receiver parameter (pre-2.4.0 it's a var)
|
||||
fun IrFunction.codeQlSetDispatchReceiverParameter(param: IrValueParameter?) {
|
||||
dispatchReceiverParameter = param
|
||||
}
|
||||
|
||||
// In pre-2.4.0, annotations are List<IrConstructorCall> so IrConstructorCallImpl works directly.
|
||||
fun codeQlAnnotationFromSymbolOwner(
|
||||
startOffset: Int, endOffset: Int, type: IrType, symbol: IrConstructorSymbol, typeArgumentsCount: Int
|
||||
): IrConstructorCall =
|
||||
IrConstructorCallImpl.fromSymbolOwner(startOffset, endOffset, type, symbol, typeArgumentsCount)
|
||||
|
||||
fun codeQlAnnotationFromSymbolOwner(type: IrType, symbol: IrConstructorSymbol): IrConstructorCall =
|
||||
IrConstructorCallImpl.fromSymbolOwner(type, symbol)
|
||||
@@ -3,32 +3,10 @@
|
||||
|
||||
package com.github.codeql
|
||||
|
||||
import com.intellij.mock.MockProject
|
||||
import com.intellij.openapi.extensions.LoadingOrder
|
||||
import org.jetbrains.kotlin.backend.common.extensions.IrGenerationExtension
|
||||
import org.jetbrains.kotlin.compiler.plugin.ComponentRegistrar
|
||||
import org.jetbrains.kotlin.compiler.plugin.ExperimentalCompilerApi
|
||||
import org.jetbrains.kotlin.config.CompilerConfiguration
|
||||
|
||||
@OptIn(ExperimentalCompilerApi::class)
|
||||
abstract class Kotlin2ComponentRegistrar : ComponentRegistrar {
|
||||
/* Nothing to do; supportsK2 doesn't exist yet. */
|
||||
|
||||
private var project: MockProject? = null
|
||||
|
||||
override fun registerProjectComponents(
|
||||
project: MockProject,
|
||||
configuration: CompilerConfiguration
|
||||
) {
|
||||
this.project = project
|
||||
doRegisterExtensions(configuration)
|
||||
}
|
||||
|
||||
abstract fun doRegisterExtensions(configuration: CompilerConfiguration)
|
||||
|
||||
fun registerExtractorExtension(extension: IrGenerationExtension) {
|
||||
val p = project ?: throw IllegalStateException("registerExtractorExtension called before registerProjectComponents")
|
||||
val extensionPoint = p.extensionArea.getExtensionPoint(IrGenerationExtension.extensionPointName)
|
||||
extensionPoint.registerExtension(extension, LoadingOrder.LAST, p)
|
||||
}
|
||||
}
|
||||
|
||||
@@ -3,35 +3,11 @@
|
||||
|
||||
package com.github.codeql
|
||||
|
||||
import com.intellij.mock.MockProject
|
||||
import com.intellij.openapi.extensions.LoadingOrder
|
||||
import org.jetbrains.kotlin.backend.common.extensions.IrGenerationExtension
|
||||
import org.jetbrains.kotlin.compiler.plugin.ComponentRegistrar
|
||||
import org.jetbrains.kotlin.compiler.plugin.ExperimentalCompilerApi
|
||||
import org.jetbrains.kotlin.config.CompilerConfiguration
|
||||
|
||||
@OptIn(ExperimentalCompilerApi::class)
|
||||
abstract class Kotlin2ComponentRegistrar : ComponentRegistrar {
|
||||
override val supportsK2: Boolean
|
||||
get() = true
|
||||
|
||||
private var project: MockProject? = null
|
||||
|
||||
override fun registerProjectComponents(
|
||||
project: MockProject,
|
||||
configuration: CompilerConfiguration
|
||||
) {
|
||||
this.project = project
|
||||
doRegisterExtensions(configuration)
|
||||
}
|
||||
|
||||
abstract fun doRegisterExtensions(configuration: CompilerConfiguration)
|
||||
|
||||
fun registerExtractorExtension(extension: IrGenerationExtension) {
|
||||
val p = project ?: throw IllegalStateException("registerExtractorExtension called before registerProjectComponents")
|
||||
// Register with LoadingOrder.LAST to ensure the extractor runs after other
|
||||
// IR generation plugins (like kotlinx.serialization) have generated their code.
|
||||
val extensionPoint = p.extensionArea.getExtensionPoint(IrGenerationExtension.extensionPointName)
|
||||
extensionPoint.registerExtension(extension, LoadingOrder.LAST, p)
|
||||
}
|
||||
}
|
||||
|
||||
@@ -1,108 +0,0 @@
|
||||
@file:Suppress("DEPRECATION")
|
||||
|
||||
package com.github.codeql.utils.versions
|
||||
|
||||
import org.jetbrains.kotlin.ir.declarations.IrFunction
|
||||
import org.jetbrains.kotlin.ir.declarations.IrValueParameter
|
||||
import org.jetbrains.kotlin.ir.expressions.IrAnnotation
|
||||
import org.jetbrains.kotlin.ir.expressions.IrConstructorCall
|
||||
import org.jetbrains.kotlin.ir.expressions.IrExpression
|
||||
import org.jetbrains.kotlin.ir.expressions.IrMemberAccessExpression
|
||||
import org.jetbrains.kotlin.ir.expressions.impl.IrAnnotationImpl
|
||||
import org.jetbrains.kotlin.ir.expressions.impl.fromSymbolOwner
|
||||
import org.jetbrains.kotlin.ir.symbols.IrConstructorSymbol
|
||||
import org.jetbrains.kotlin.ir.types.IrType
|
||||
import org.jetbrains.kotlin.ir.types.addAnnotations
|
||||
|
||||
/**
|
||||
* Compatibility accessors for pre-2.4.0 API patterns.
|
||||
* In 2.4.0, valueParameters/extensionReceiverParameter/extensionReceiver/
|
||||
* getValueArgument/putValueArgument/valueArgumentsCount/typeArgumentsCount/getTypeArgument
|
||||
* have been removed. This file provides the 2.4.0 implementations.
|
||||
*/
|
||||
|
||||
// IrFunction: valueParameters -> parameters filtered to Regular kind
|
||||
val IrFunction.codeQlValueParameters: List<IrValueParameter>
|
||||
get() = parameters.filter { it.kind == org.jetbrains.kotlin.ir.declarations.IrParameterKind.Regular }
|
||||
|
||||
// IrFunction: extensionReceiverParameter
|
||||
val IrFunction.codeQlExtensionReceiverParameter: IrValueParameter?
|
||||
get() = parameters.firstOrNull { it.kind == org.jetbrains.kotlin.ir.declarations.IrParameterKind.ExtensionReceiver }
|
||||
|
||||
// Helper: get the offset of value arguments in the arguments list
|
||||
// In 2.4.0, arguments[] includes dispatch/extension receivers before regular params
|
||||
private fun IrMemberAccessExpression<*>.valueArgumentOffset(): Int {
|
||||
val owner = symbol.owner as? IrFunction ?: return 0
|
||||
return owner.parameters.count { it.kind != org.jetbrains.kotlin.ir.declarations.IrParameterKind.Regular }
|
||||
}
|
||||
|
||||
// IrMemberAccessExpression: valueArgumentsCount
|
||||
val IrMemberAccessExpression<*>.codeQlValueArgumentsCount: Int
|
||||
get() = arguments.size - valueArgumentOffset()
|
||||
|
||||
// IrMemberAccessExpression: getValueArgument
|
||||
fun IrMemberAccessExpression<*>.codeQlGetValueArgument(index: Int): IrExpression? = arguments[index + valueArgumentOffset()]
|
||||
|
||||
// IrMemberAccessExpression: putValueArgument
|
||||
fun IrMemberAccessExpression<*>.codeQlPutValueArgument(index: Int, value: IrExpression?) {
|
||||
arguments[index + valueArgumentOffset()] = value
|
||||
}
|
||||
|
||||
// IrMemberAccessExpression: extensionReceiver
|
||||
var IrMemberAccessExpression<*>.codeQlExtensionReceiver: IrExpression?
|
||||
get() {
|
||||
val erp = symbol.owner.let { it as? IrFunction }?.codeQlExtensionReceiverParameter ?: return null
|
||||
return arguments[erp.indexInParameters]
|
||||
}
|
||||
set(value) {
|
||||
val erp = symbol.owner.let { it as? IrFunction }?.codeQlExtensionReceiverParameter ?: return
|
||||
arguments[erp.indexInParameters] = value
|
||||
}
|
||||
|
||||
// IrMemberAccessExpression: typeArgumentsCount
|
||||
val IrMemberAccessExpression<*>.codeQlTypeArgumentsCount: Int
|
||||
get() = typeArguments.size
|
||||
|
||||
// IrMemberAccessExpression: getTypeArgument
|
||||
fun IrMemberAccessExpression<*>.codeQlGetTypeArgument(index: Int): IrType? = typeArguments[index]
|
||||
|
||||
// addAnnotations compat: in 2.4.0, addAnnotations expects List<IrAnnotation>
|
||||
// IrAnnotation extends IrConstructorCall, so we cast
|
||||
@Suppress("UNCHECKED_CAST")
|
||||
fun IrType.codeQlAddAnnotations(annotations: List<IrConstructorCall>): IrType =
|
||||
addAnnotations(annotations as List<IrAnnotation>)
|
||||
|
||||
// IrMutableAnnotationContainer.annotations setter: in 2.4.0, expects List<IrAnnotation>
|
||||
@Suppress("UNCHECKED_CAST")
|
||||
fun codeQlSetAnnotations(container: org.jetbrains.kotlin.ir.declarations.IrMutableAnnotationContainer, annotations: List<IrConstructorCall>) {
|
||||
container.annotations = annotations as List<IrAnnotation>
|
||||
}
|
||||
|
||||
// IrFunction: set dispatch receiver parameter
|
||||
// In 2.4.0, dispatchReceiverParameter is val; modify the parameters list directly.
|
||||
fun IrFunction.codeQlSetDispatchReceiverParameter(param: IrValueParameter?) {
|
||||
val existing = parameters.indexOfFirst { it.kind == org.jetbrains.kotlin.ir.declarations.IrParameterKind.DispatchReceiver }
|
||||
val mutableParams = parameters.toMutableList()
|
||||
if (existing >= 0) {
|
||||
if (param != null) {
|
||||
mutableParams[existing] = param
|
||||
} else {
|
||||
mutableParams.removeAt(existing)
|
||||
}
|
||||
} else if (param != null) {
|
||||
param.kind = org.jetbrains.kotlin.ir.declarations.IrParameterKind.DispatchReceiver
|
||||
mutableParams.add(0, param)
|
||||
}
|
||||
parameters = mutableParams
|
||||
}
|
||||
|
||||
// In 2.4.0, annotation lists require IrAnnotation instances.
|
||||
// Use IrAnnotationImpl.fromSymbolOwner instead of IrConstructorCallImpl.fromSymbolOwner.
|
||||
fun codeQlAnnotationFromSymbolOwner(
|
||||
startOffset: Int, endOffset: Int, type: IrType, symbol: IrConstructorSymbol, typeArgumentsCount: Int
|
||||
): IrConstructorCall =
|
||||
IrAnnotationImpl.fromSymbolOwner(startOffset, endOffset, type, symbol, typeArgumentsCount)
|
||||
|
||||
fun codeQlAnnotationFromSymbolOwner(type: IrType, symbol: IrConstructorSymbol): IrConstructorCall =
|
||||
IrAnnotationImpl.fromSymbolOwner(type, symbol)
|
||||
|
||||
@@ -1,46 +0,0 @@
|
||||
@file:Suppress("DEPRECATION", "DEPRECATION_ERROR")
|
||||
@file:OptIn(ExperimentalCompilerApi::class)
|
||||
|
||||
package com.github.codeql
|
||||
|
||||
import com.intellij.mock.MockProject
|
||||
import org.jetbrains.kotlin.backend.common.extensions.IrGenerationExtension
|
||||
import org.jetbrains.kotlin.compiler.plugin.ComponentRegistrar
|
||||
import org.jetbrains.kotlin.compiler.plugin.CompilerPluginRegistrar
|
||||
import org.jetbrains.kotlin.compiler.plugin.ExperimentalCompilerApi
|
||||
import org.jetbrains.kotlin.config.CompilerConfiguration
|
||||
|
||||
abstract class Kotlin2ComponentRegistrar : CompilerPluginRegistrar(), ComponentRegistrar {
|
||||
override val supportsK2: Boolean
|
||||
get() = true
|
||||
|
||||
override val pluginId: String
|
||||
get() = "com.github.codeql.kotlin-extractor"
|
||||
|
||||
// ComponentRegistrar implementation (legacy path, still called by Kotlin compiler)
|
||||
override fun registerProjectComponents(
|
||||
project: MockProject,
|
||||
configuration: CompilerConfiguration
|
||||
) {
|
||||
// In 2.4.0, we use CompilerPluginRegistrar path instead.
|
||||
// This is only called if the compiler uses the ComponentRegistrar service file.
|
||||
// We do nothing here since registerExtensions will be called separately.
|
||||
}
|
||||
|
||||
private var extensionStorage: CompilerPluginRegistrar.ExtensionStorage? = null
|
||||
private var registeredExtension: IrGenerationExtension? = null
|
||||
|
||||
override fun ExtensionStorage.registerExtensions(configuration: CompilerConfiguration) {
|
||||
this@Kotlin2ComponentRegistrar.extensionStorage = this
|
||||
doRegisterExtensions(configuration)
|
||||
}
|
||||
|
||||
abstract fun doRegisterExtensions(configuration: CompilerConfiguration)
|
||||
|
||||
fun registerExtractorExtension(extension: IrGenerationExtension) {
|
||||
val storage = extensionStorage ?: throw IllegalStateException("registerExtractorExtension called before registerExtensions")
|
||||
with(storage) {
|
||||
IrGenerationExtension.registerExtension(extension)
|
||||
}
|
||||
}
|
||||
}
|
||||
@@ -1,13 +0,0 @@
|
||||
package com.github.codeql.utils.versions
|
||||
|
||||
import org.jetbrains.kotlin.ir.declarations.IrFunction
|
||||
import org.jetbrains.kotlin.ir.declarations.IrParameterKind
|
||||
import org.jetbrains.kotlin.ir.declarations.IrValueParameter
|
||||
|
||||
fun parameterIndexExcludingReceivers(vp: IrValueParameter): Int {
|
||||
val offset =
|
||||
(vp.parent as? IrFunction)?.let { f ->
|
||||
f.parameters.count { it.kind == IrParameterKind.DispatchReceiver || it.kind == IrParameterKind.ExtensionReceiver || it.kind == IrParameterKind.Context }
|
||||
} ?: 0
|
||||
return vp.indexInParameters - offset
|
||||
}
|
||||
@@ -1 +0,0 @@
|
||||
com.github.codeql.KotlinExtractorComponentRegistrar
|
||||
@@ -11,7 +11,6 @@ VERSIONS = [
|
||||
"2.2.20-Beta2",
|
||||
"2.3.0",
|
||||
"2.3.20",
|
||||
"2.4.0",
|
||||
]
|
||||
|
||||
def _version_to_tuple(v):
|
||||
|
||||
@@ -1,5 +1,5 @@
|
||||
{
|
||||
"markdownMessage": "The Kotlin version installed (`999.999.999`) is too recent for this version of CodeQL. Install a version lower than 2.4.10.",
|
||||
"markdownMessage": "The Kotlin version installed (`999.999.999`) is too recent for this version of CodeQL. Install a version lower than 2.3.30.",
|
||||
"severity": "error",
|
||||
"source": {
|
||||
"extractorName": "java",
|
||||
|
||||
@@ -1,4 +0,0 @@
|
||||
---
|
||||
category: minorAnalysis
|
||||
---
|
||||
* Improved modeling of Apache HttpClient `execute` method sinks for `java/ssrf` and `java/non-https-url`.
|
||||
@@ -1,4 +0,0 @@
|
||||
---
|
||||
category: feature
|
||||
---
|
||||
* Kotlin 2.4.0 can now be analysed.
|
||||
@@ -11,7 +11,7 @@ extensions:
|
||||
- ["org.apache.http.client.methods", "HttpPost", False, "HttpPost", "", "", "Argument[0]", "request-forgery", "manual"]
|
||||
- ["org.apache.http.client.methods", "HttpPut", False, "HttpPut", "", "", "Argument[0]", "request-forgery", "manual"]
|
||||
- ["org.apache.http.client.methods", "HttpRequestBase", True, "setURI", "", "", "Argument[0]", "request-forgery", "manual"]
|
||||
- ["org.apache.http.client.methods", "HttpRequestWrapper", True, "setURI", "(URI)", "", "Argument[0]", "request-forgery", "ai-manual"]
|
||||
- ["org.apache.http.client.methods", "HttpRequestWrapper", True, "setURI", "(URI)", "", "Argument[0]", "request-forgery", "hq-manual"]
|
||||
- ["org.apache.http.client.methods", "HttpTrace", False, "HttpTrace", "", "", "Argument[0]", "request-forgery", "manual"]
|
||||
- ["org.apache.http.client.methods", "RequestBuilder", False, "delete", "", "", "Argument[0]", "request-forgery", "manual"]
|
||||
- ["org.apache.http.client.methods", "RequestBuilder", False, "get", "", "", "Argument[0]", "request-forgery", "manual"]
|
||||
@@ -22,29 +22,3 @@ extensions:
|
||||
- ["org.apache.http.client.methods", "RequestBuilder", False, "put", "", "", "Argument[0]", "request-forgery", "manual"]
|
||||
- ["org.apache.http.client.methods", "RequestBuilder", False, "setUri", "", "", "Argument[0]", "request-forgery", "manual"]
|
||||
- ["org.apache.http.client.methods", "RequestBuilder", False, "trace", "", "", "Argument[0]", "request-forgery", "manual"]
|
||||
- addsTo:
|
||||
pack: codeql/java-all
|
||||
extensible: summaryModel
|
||||
data:
|
||||
- ["org.apache.http.client.methods", "RequestBuilder", True, "build", "()", "", "Argument[this]", "ReturnValue", "taint", "ai-manual"]
|
||||
- ["org.apache.http.client.methods", "RequestBuilder", True, "delete", "(String)", "", "Argument[0]", "ReturnValue", "taint", "ai-manual"]
|
||||
- ["org.apache.http.client.methods", "RequestBuilder", True, "delete", "(URI)", "", "Argument[0]", "ReturnValue", "taint", "ai-manual"]
|
||||
- ["org.apache.http.client.methods", "RequestBuilder", True, "get", "(String)", "", "Argument[0]", "ReturnValue", "taint", "ai-manual"]
|
||||
- ["org.apache.http.client.methods", "RequestBuilder", True, "get", "(URI)", "", "Argument[0]", "ReturnValue", "taint", "ai-manual"]
|
||||
- ["org.apache.http.client.methods", "RequestBuilder", True, "getUri", "()", "", "Argument[this]", "ReturnValue", "taint", "ai-manual"]
|
||||
- ["org.apache.http.client.methods", "RequestBuilder", True, "head", "(String)", "", "Argument[0]", "ReturnValue", "taint", "ai-manual"]
|
||||
- ["org.apache.http.client.methods", "RequestBuilder", True, "head", "(URI)", "", "Argument[0]", "ReturnValue", "taint", "ai-manual"]
|
||||
- ["org.apache.http.client.methods", "RequestBuilder", True, "options", "(String)", "", "Argument[0]", "ReturnValue", "taint", "ai-manual"]
|
||||
- ["org.apache.http.client.methods", "RequestBuilder", True, "options", "(URI)", "", "Argument[0]", "ReturnValue", "taint", "ai-manual"]
|
||||
- ["org.apache.http.client.methods", "RequestBuilder", True, "patch", "(String)", "", "Argument[0]", "ReturnValue", "taint", "ai-manual"]
|
||||
- ["org.apache.http.client.methods", "RequestBuilder", True, "patch", "(URI)", "", "Argument[0]", "ReturnValue", "taint", "ai-manual"]
|
||||
- ["org.apache.http.client.methods", "RequestBuilder", True, "post", "(String)", "", "Argument[0]", "ReturnValue", "taint", "ai-manual"]
|
||||
- ["org.apache.http.client.methods", "RequestBuilder", True, "post", "(URI)", "", "Argument[0]", "ReturnValue", "taint", "ai-manual"]
|
||||
- ["org.apache.http.client.methods", "RequestBuilder", True, "put", "(String)", "", "Argument[0]", "ReturnValue", "taint", "ai-manual"]
|
||||
- ["org.apache.http.client.methods", "RequestBuilder", True, "put", "(URI)", "", "Argument[0]", "ReturnValue", "taint", "ai-manual"]
|
||||
- ["org.apache.http.client.methods", "RequestBuilder", True, "setUri", "(String)", "", "Argument[0]", "Argument[this]", "taint", "ai-manual"]
|
||||
- ["org.apache.http.client.methods", "RequestBuilder", True, "setUri", "(String)", "", "Argument[0]", "ReturnValue", "taint", "ai-manual"]
|
||||
- ["org.apache.http.client.methods", "RequestBuilder", True, "setUri", "(URI)", "", "Argument[0]", "Argument[this]", "taint", "ai-manual"]
|
||||
- ["org.apache.http.client.methods", "RequestBuilder", True, "setUri", "(URI)", "", "Argument[0]", "ReturnValue", "taint", "ai-manual"]
|
||||
- ["org.apache.http.client.methods", "RequestBuilder", True, "trace", "(String)", "", "Argument[0]", "ReturnValue", "taint", "ai-manual"]
|
||||
- ["org.apache.http.client.methods", "RequestBuilder", True, "trace", "(URI)", "", "Argument[0]", "ReturnValue", "taint", "ai-manual"]
|
||||
|
||||
@@ -3,11 +3,6 @@ extensions:
|
||||
pack: codeql/java-all
|
||||
extensible: sinkModel
|
||||
data:
|
||||
- ["org.apache.http.client", "HttpClient", True, "execute", "(HttpHost,HttpRequest)", "", "Argument[0]", "request-forgery", "ai-manual"]
|
||||
- ["org.apache.http.client", "HttpClient", True, "execute", "(HttpHost,HttpRequest,HttpContext)", "", "Argument[0]", "request-forgery", "ai-manual"]
|
||||
- ["org.apache.http.client", "HttpClient", True, "execute", "(HttpHost,HttpRequest,ResponseHandler)", "", "Argument[0]", "request-forgery", "ai-manual"]
|
||||
- ["org.apache.http.client", "HttpClient", True, "execute", "(HttpHost,HttpRequest,ResponseHandler,HttpContext)", "", "Argument[0]", "request-forgery", "ai-manual"]
|
||||
- ["org.apache.http.client", "HttpClient", True, "execute", "(HttpUriRequest)", "", "Argument[0]", "request-forgery", "ai-manual"]
|
||||
- ["org.apache.http.client", "HttpClient", True, "execute", "(HttpUriRequest,HttpContext)", "", "Argument[0]", "request-forgery", "ai-manual"]
|
||||
- ["org.apache.http.client", "HttpClient", True, "execute", "(HttpUriRequest,ResponseHandler)", "", "Argument[0]", "request-forgery", "ai-manual"]
|
||||
- ["org.apache.http.client", "HttpClient", True, "execute", "(HttpUriRequest,ResponseHandler,HttpContext)", "", "Argument[0]", "request-forgery", "ai-manual"]
|
||||
- ["org.apache.http.client", "HttpClient", True, "execute", "(HttpUriRequest)", "", "Argument[0]", "request-forgery", "ai-manual"]
|
||||
|
||||
@@ -1,45 +0,0 @@
|
||||
import java.io.IOException;
|
||||
|
||||
import org.apache.http.HttpHost;
|
||||
import org.apache.http.HttpRequest;
|
||||
import org.apache.http.client.HttpClient;
|
||||
import org.apache.http.client.ResponseHandler;
|
||||
import org.apache.http.client.methods.HttpUriRequest;
|
||||
import org.apache.http.client.methods.RequestBuilder;
|
||||
import org.apache.http.impl.client.HttpClients;
|
||||
import org.apache.http.message.BasicHttpRequest;
|
||||
import org.apache.http.protocol.HttpContext;
|
||||
import javax.servlet.ServletException;
|
||||
import javax.servlet.http.HttpServlet;
|
||||
import javax.servlet.http.HttpServletRequest;
|
||||
import javax.servlet.http.HttpServletResponse;
|
||||
|
||||
public class ApacheHttpClientExecuteSSRF extends HttpServlet {
|
||||
|
||||
protected void doGet(HttpServletRequest request, HttpServletResponse response)
|
||||
throws ServletException, IOException {
|
||||
try {
|
||||
|
||||
String source = request.getParameter("host"); // $ Source
|
||||
|
||||
HttpHost host = new HttpHost(source);
|
||||
HttpRequest req = new BasicHttpRequest("GET", "/");
|
||||
HttpUriRequest uriReq = RequestBuilder.get(source).build(); // $ Alert
|
||||
HttpContext context = null;
|
||||
HttpClient client = HttpClients.createDefault();
|
||||
ResponseHandler<Object> handler = null;
|
||||
|
||||
client.execute(host, req); // $ Alert
|
||||
client.execute(host, req, context); // $ Alert
|
||||
client.execute(host, req, handler); // $ Alert
|
||||
client.execute(host, req, handler, context); // $ Alert
|
||||
client.execute(uriReq); // $ Alert
|
||||
client.execute(uriReq, context); // $ Alert
|
||||
client.execute(uriReq, handler); // $ Alert
|
||||
client.execute(uriReq, handler, context); // $ Alert
|
||||
|
||||
} catch (Exception e) {
|
||||
// TODO: handle exception
|
||||
}
|
||||
}
|
||||
}
|
||||
File diff suppressed because it is too large
Load Diff
@@ -1 +1 @@
|
||||
//semmle-extractor-options: --javac-args -source 11 -target 11 -cp ${testdir}/../../../stubs/javax-validation-constraints:${testdir}/../../../stubs/springframework-5.8.x:${testdir}/../../../stubs/javax-ws-rs-api-2.1.1:${testdir}/../../../stubs/javax-ws-rs-api-3.0.0:${testdir}/../../../stubs/apache-http-4.4.13/:${testdir}/../../../stubs/apache-http-client-4.4.13:${testdir}/../../../stubs/projectreactor-3.4.3/:${testdir}/../../../stubs/postgresql-42.3.3/:${testdir}/../../../stubs/HikariCP-3.4.5/:${testdir}/../../../stubs/spring-jdbc-5.3.8/:${testdir}/../../../stubs/jdbi3-core-3.27.2/:${testdir}/../../../stubs/cargo:${testdir}/../../../stubs/javafx-web:${testdir}/../../../stubs/apache-commons-jelly-1.0.1:${testdir}/../../../stubs/dom4j-2.1.1:${testdir}/../../../stubs/jaxen-1.2.0:${testdir}/../../../stubs/stapler-1.263:${testdir}/../../../stubs/javax-servlet-2.5:${testdir}/../../../stubs/apache-commons-fileupload-1.4:${testdir}/../../../stubs/saxon-xqj-9.x:${testdir}/../../../stubs/apache-commons-beanutils:${testdir}/../../../stubs/apache-commons-lang:${testdir}/../../../stubs/apache-http-5:${testdir}/../../../stubs/playframework-2.6.x:${testdir}/../../../stubs/jaxws-api-2.0:${testdir}/../../../stubs/apache-cxf
|
||||
//semmle-extractor-options: --javac-args -source 11 -target 11 -cp ${testdir}/../../../stubs/javax-validation-constraints:${testdir}/../../../stubs/springframework-5.8.x:${testdir}/../../../stubs/javax-ws-rs-api-2.1.1:${testdir}/../../../stubs/javax-ws-rs-api-3.0.0:${testdir}/../../../stubs/apache-http-4.4.13/:${testdir}/../../../stubs/projectreactor-3.4.3/:${testdir}/../../../stubs/postgresql-42.3.3/:${testdir}/../../../stubs/HikariCP-3.4.5/:${testdir}/../../../stubs/spring-jdbc-5.3.8/:${testdir}/../../../stubs/jdbi3-core-3.27.2/:${testdir}/../../../stubs/cargo:${testdir}/../../../stubs/javafx-web:${testdir}/../../../stubs/apache-commons-jelly-1.0.1:${testdir}/../../../stubs/dom4j-2.1.1:${testdir}/../../../stubs/jaxen-1.2.0:${testdir}/../../../stubs/stapler-1.263:${testdir}/../../../stubs/javax-servlet-2.5:${testdir}/../../../stubs/apache-commons-fileupload-1.4:${testdir}/../../../stubs/saxon-xqj-9.x:${testdir}/../../../stubs/apache-commons-beanutils:${testdir}/../../../stubs/apache-commons-lang:${testdir}/../../../stubs/apache-http-5:${testdir}/../../../stubs/playframework-2.6.x:${testdir}/../../../stubs/jaxws-api-2.0:${testdir}/../../../stubs/apache-cxf
|
||||
|
||||
@@ -1,23 +0,0 @@
|
||||
// Generated automatically from org.apache.http.client.HttpClient for testing purposes
|
||||
|
||||
package org.apache.http.client;
|
||||
|
||||
import java.io.IOException;
|
||||
import org.apache.http.HttpHost;
|
||||
import org.apache.http.HttpRequest;
|
||||
import org.apache.http.HttpResponse;
|
||||
import org.apache.http.client.methods.HttpUriRequest;
|
||||
import org.apache.http.protocol.HttpContext;
|
||||
|
||||
public interface HttpClient {
|
||||
HttpResponse execute(HttpHost target, HttpRequest request) throws IOException;
|
||||
HttpResponse execute(HttpHost target, HttpRequest request, HttpContext context) throws IOException;
|
||||
<T> T execute(HttpHost target, HttpRequest request, ResponseHandler<? extends T> responseHandler) throws IOException;
|
||||
<T> T execute(HttpHost target, HttpRequest request, ResponseHandler<? extends T> responseHandler, HttpContext context)
|
||||
throws IOException;
|
||||
HttpResponse execute(HttpUriRequest request) throws IOException;
|
||||
HttpResponse execute(HttpUriRequest request, HttpContext context) throws IOException;
|
||||
<T> T execute(HttpUriRequest request, ResponseHandler<? extends T> responseHandler) throws IOException;
|
||||
<T> T execute(HttpUriRequest request, ResponseHandler<? extends T> responseHandler, HttpContext context)
|
||||
throws IOException;
|
||||
}
|
||||
@@ -1,9 +0,0 @@
|
||||
// Generated automatically from org.apache.http.client.ResponseHandler for testing purposes
|
||||
|
||||
package org.apache.http.client;
|
||||
|
||||
import org.apache.http.HttpResponse;
|
||||
|
||||
public interface ResponseHandler<T> {
|
||||
T handleResponse(HttpResponse response);
|
||||
}
|
||||
@@ -1,7 +0,0 @@
|
||||
package org.apache.http.impl.client;
|
||||
|
||||
import org.apache.http.client.HttpClient;
|
||||
|
||||
public abstract class CloseableHttpClient implements HttpClient {
|
||||
|
||||
}
|
||||
@@ -1,10 +0,0 @@
|
||||
// Generated automatically from org.apache.http.client.HttpClient for testing purposes
|
||||
|
||||
package org.apache.http.impl.client;
|
||||
|
||||
import java.io.IOException;
|
||||
import org.apache.http.impl.client.CloseableHttpClient;
|
||||
|
||||
public final class HttpClients {
|
||||
public static CloseableHttpClient createDefault() { return null; }
|
||||
}
|
||||
@@ -21,19 +21,13 @@ file_coverage_languages:
|
||||
scc_languages:
|
||||
- TypeScript
|
||||
- TypeScript Typings
|
||||
- name: vue
|
||||
display_name: Vue.js component
|
||||
scc_languages:
|
||||
- Vue
|
||||
github_api_languages:
|
||||
- JavaScript
|
||||
- TypeScript
|
||||
- Vue
|
||||
scc_languages:
|
||||
- JavaScript
|
||||
- TypeScript
|
||||
- TypeScript Typings
|
||||
- Vue
|
||||
file_types:
|
||||
- name: javascript
|
||||
display_name: JavaScript
|
||||
|
||||
2
python/ql/consistency-queries/CfgConsistency.ql
Normal file
2
python/ql/consistency-queries/CfgConsistency.ql
Normal file
@@ -0,0 +1,2 @@
|
||||
import semmle.python.controlflow.internal.AstNodeImpl
|
||||
import ControlFlow::Consistency
|
||||
@@ -9,6 +9,7 @@ private import semmle.python.dataflow.new.internal.DataFlowImplSpecific
|
||||
private import semmle.python.dataflow.new.internal.DataFlowDispatch
|
||||
private import semmle.python.dataflow.new.internal.TaintTrackingImplSpecific
|
||||
private import codeql.dataflow.internal.DataFlowImplConsistency
|
||||
private import semmle.python.controlflow.internal.Cfg as Cfg
|
||||
|
||||
private module Input implements InputSig<Location, PythonDataFlow> {
|
||||
private import Private
|
||||
@@ -72,7 +73,7 @@ private module Input implements InputSig<Location, PythonDataFlow> {
|
||||
// resolve to multiple functions), but we only make _one_ ArgumentNode for each
|
||||
// argument in the CallNode, we end up violating this consistency check in those
|
||||
// cases. (see `getCallArg` in DataFlowDispatch.qll)
|
||||
exists(DataFlowCall other, CallNode cfgCall | other != call |
|
||||
exists(DataFlowCall other, Cfg::CallNode cfgCall | other != call |
|
||||
call.getNode() = cfgCall and
|
||||
other.getNode() = cfgCall and
|
||||
isArgumentNode(arg, call, _) and
|
||||
@@ -88,16 +89,16 @@ private module Input implements InputSig<Location, PythonDataFlow> {
|
||||
// allow it instead.
|
||||
(
|
||||
call.getScope() = attr.getScope() and
|
||||
any(CfgNode n | n.asCfgNode() = call.getNode().(CallNode).getFunction()).getALocalSource() =
|
||||
attr
|
||||
any(CfgNode n | n.asCfgNode() = call.getNode().(Cfg::CallNode).getFunction())
|
||||
.getALocalSource() = attr
|
||||
or
|
||||
not exists(call.getScope().(Function).getDefinition()) and
|
||||
call.getScope().getScope+() = attr.getScope()
|
||||
) and
|
||||
(
|
||||
other.getScope() = attr.getScope() and
|
||||
any(CfgNode n | n.asCfgNode() = other.getNode().(CallNode).getFunction()).getALocalSource() =
|
||||
attr
|
||||
any(CfgNode n | n.asCfgNode() = other.getNode().(Cfg::CallNode).getFunction())
|
||||
.getALocalSource() = attr
|
||||
or
|
||||
not exists(other.getScope().(Function).getDefinition()) and
|
||||
other.getScope().getScope+() = attr.getScope()
|
||||
|
||||
@@ -213,9 +213,11 @@ class ExprWithPointsTo extends Expr {
|
||||
* Gets what this expression might "refer-to" in the given `context`.
|
||||
*/
|
||||
predicate refersTo(Context context, Object obj, ClassObject cls, AstNode origin) {
|
||||
this.getAFlowNode()
|
||||
.(ControlFlowNodeWithPointsTo)
|
||||
.refersTo(context, obj, cls, origin.getAFlowNode())
|
||||
exists(ControlFlowNode this_, ControlFlowNode origin_ |
|
||||
this_.getNode() = this and origin_.getNode() = origin
|
||||
|
|
||||
this_.(ControlFlowNodeWithPointsTo).refersTo(context, obj, cls, origin_)
|
||||
)
|
||||
}
|
||||
|
||||
/**
|
||||
@@ -226,7 +228,11 @@ class ExprWithPointsTo extends Expr {
|
||||
*/
|
||||
pragma[nomagic]
|
||||
predicate refersTo(Object obj, AstNode origin) {
|
||||
this.getAFlowNode().(ControlFlowNodeWithPointsTo).refersTo(obj, origin.getAFlowNode())
|
||||
exists(ControlFlowNode this_, ControlFlowNode origin_ |
|
||||
this_.getNode() = this and origin_.getNode() = origin
|
||||
|
|
||||
this_.(ControlFlowNodeWithPointsTo).refersTo(obj, origin_)
|
||||
)
|
||||
}
|
||||
|
||||
/**
|
||||
@@ -240,16 +246,22 @@ class ExprWithPointsTo extends Expr {
|
||||
* in the given `context`.
|
||||
*/
|
||||
predicate pointsTo(Context context, Value value, AstNode origin) {
|
||||
this.getAFlowNode()
|
||||
.(ControlFlowNodeWithPointsTo)
|
||||
.pointsTo(context, value, origin.getAFlowNode())
|
||||
exists(ControlFlowNode this_, ControlFlowNode origin_ |
|
||||
this_.getNode() = this and origin_.getNode() = origin
|
||||
|
|
||||
this_.(ControlFlowNodeWithPointsTo).pointsTo(context, value, origin_)
|
||||
)
|
||||
}
|
||||
|
||||
/**
|
||||
* Holds if this expression might "point-to" to `value` which is from `origin`.
|
||||
*/
|
||||
predicate pointsTo(Value value, AstNode origin) {
|
||||
this.getAFlowNode().(ControlFlowNodeWithPointsTo).pointsTo(value, origin.getAFlowNode())
|
||||
exists(ControlFlowNode this_, ControlFlowNode origin_ |
|
||||
this_.getNode() = this and origin_.getNode() = origin
|
||||
|
|
||||
this_.(ControlFlowNodeWithPointsTo).pointsTo(value, origin_)
|
||||
)
|
||||
}
|
||||
|
||||
/**
|
||||
@@ -475,7 +487,10 @@ class FunctionMetricsWithPointsTo extends FunctionMetrics {
|
||||
not non_coupling_method(result) and
|
||||
exists(Call call | call.getScope() = this |
|
||||
exists(FunctionObject callee | callee.getFunction() = result |
|
||||
call.getAFlowNode().getFunction().(ControlFlowNodeWithPointsTo).refersTo(callee)
|
||||
exists(CallNode call_ |
|
||||
call_.getNode() = call and
|
||||
call_.getFunction().(ControlFlowNodeWithPointsTo).refersTo(callee)
|
||||
)
|
||||
)
|
||||
or
|
||||
exists(Attribute a | call.getFunc() = a |
|
||||
|
||||
@@ -64,7 +64,7 @@ private predicate jump_to_defn(ControlFlowNode use, Definition defn) {
|
||||
private predicate preferred_jump_to_defn(Expr use, Definition def) {
|
||||
not use instanceof ClassExpr and
|
||||
not use instanceof FunctionExpr and
|
||||
jump_to_defn(use.getAFlowNode(), def)
|
||||
exists(ControlFlowNode useNode | useNode.getNode() = use | jump_to_defn(useNode, def))
|
||||
}
|
||||
|
||||
private predicate unique_jump_to_defn(Expr use, Definition def) {
|
||||
@@ -452,7 +452,7 @@ private predicate self_parameter_jump_to_defn_attribute(
|
||||
* This exists primarily for testing use `getPreferredDefinition()` instead.
|
||||
*/
|
||||
Definition getADefinition(Expr use) {
|
||||
jump_to_defn(use.getAFlowNode(), result) and
|
||||
exists(ControlFlowNode useNode | useNode.getNode() = use | jump_to_defn(useNode, result)) and
|
||||
not use instanceof Call and
|
||||
not use.isArtificial() and
|
||||
// Not the use itself
|
||||
|
||||
4
python/ql/lib/change-notes/2026-05-19-add-shared-cfg.md
Normal file
4
python/ql/lib/change-notes/2026-05-19-add-shared-cfg.md
Normal file
@@ -0,0 +1,4 @@
|
||||
---
|
||||
category: minorAnalysis
|
||||
---
|
||||
* A new Python control flow graph implementation has been added under `semmle.python.controlflow.internal.Cfg` (backed by `AstNodeImpl.qll`), built on the shared `codeql.controlflow.ControlFlowGraph` library. It is not yet used by the dataflow library or any production query; the legacy CFG in `semmle/python/Flow.qll` remains the default. The new library is exposed for tests and for upcoming migrations.
|
||||
4
python/ql/lib/change-notes/2026-05-19-add-shared-ssa.md
Normal file
4
python/ql/lib/change-notes/2026-05-19-add-shared-ssa.md
Normal file
@@ -0,0 +1,4 @@
|
||||
---
|
||||
category: minorAnalysis
|
||||
---
|
||||
* A new SSA adapter has been added under `semmle.python.dataflow.new.internal.SsaImpl`, built on the shared `codeql.ssa.Ssa` library and the new shared CFG (`semmle.python.controlflow.internal.Cfg`). It is not yet used by the dataflow library or any production query; the legacy ESSA SSA in `semmle/python/essa/*` remains the default. The new SSA adapter is exposed for tests and for the upcoming dataflow migration.
|
||||
@@ -0,0 +1,5 @@
|
||||
---
|
||||
category: deprecated
|
||||
---
|
||||
* The `AstNode.getAFlowNode()` predicate has been deprecated. Use `ControlFlowNode.getNode()` from the other direction instead: replace `e.getAFlowNode() = n` with `n.getNode() = e`. This is a preparatory step towards migrating the dataflow library off the legacy CFG; it has no semantic effect.
|
||||
|
||||
@@ -0,0 +1,4 @@
|
||||
---
|
||||
category: minorAnalysis
|
||||
---
|
||||
* Simplified the internal predicates that detect `@staticmethod`, `@classmethod` and `@property` decorators to match the decorator's AST `Name` directly, rather than going through the CFG and requiring the name to resolve globally. Code that shadows these three builtin decorators at the module-scope will now be classified by the decorator name alone; in practice, shadowing these names is extremely rare and the call-graph results are unchanged.
|
||||
@@ -0,0 +1,4 @@
|
||||
---
|
||||
category: deprecated
|
||||
---
|
||||
* The `Function.getAReturnValueFlowNode()` predicate has been deprecated. Bind a `Return` node explicitly instead — `exists(Return ret | ret.getScope() = f and n.getNode() = ret.getValue())`. This is a preparatory step towards migrating the dataflow library off the legacy CFG; it has no semantic effect.
|
||||
@@ -0,0 +1,4 @@
|
||||
---
|
||||
category: breaking
|
||||
---
|
||||
* The deprecated `AstNode.getAFlowNode()` and `Function.getAReturnValueFlowNode()` predicates now return nodes from the new shared CFG (`Cfg::ControlFlowNode`) rather than from the legacy CFG (`ControlFlowNode`). Callers that still rely on these deprecated APIs and feed the result into legacy-CFG-aware predicates will no longer type-check; migrate to `n.getNode() = e` (or, for return values, the explicit `Return` pattern shown in the deprecation message) to get nodes from the dataflow library's current CFG.
|
||||
45
python/ql/lib/printCfgNew.ql
Normal file
45
python/ql/lib/printCfgNew.ql
Normal file
@@ -0,0 +1,45 @@
|
||||
/**
|
||||
* @name Print CFG (New)
|
||||
* @description Produces a representation of a file's Control Flow Graph
|
||||
* using the new shared control flow library.
|
||||
* This query is used by the VS Code extension.
|
||||
* @id python/print-cfg
|
||||
* @kind graph
|
||||
* @tags ide-contextual-queries/print-cfg
|
||||
*/
|
||||
|
||||
private import python as Py
|
||||
import semmle.python.controlflow.internal.AstNodeImpl
|
||||
|
||||
external string selectedSourceFile();
|
||||
|
||||
private predicate selectedSourceFileAlias = selectedSourceFile/0;
|
||||
|
||||
external int selectedSourceLine();
|
||||
|
||||
private predicate selectedSourceLineAlias = selectedSourceLine/0;
|
||||
|
||||
external int selectedSourceColumn();
|
||||
|
||||
private predicate selectedSourceColumnAlias = selectedSourceColumn/0;
|
||||
|
||||
module ViewCfgQueryInput implements ControlFlow::ViewCfgQueryInputSig<Py::File> {
|
||||
predicate selectedSourceFile = selectedSourceFileAlias/0;
|
||||
|
||||
predicate selectedSourceLine = selectedSourceLineAlias/0;
|
||||
|
||||
predicate selectedSourceColumn = selectedSourceColumnAlias/0;
|
||||
|
||||
predicate cfgScopeSpan(
|
||||
Ast::Callable callable, Py::File file, int startLine, int startColumn, int endLine,
|
||||
int endColumn
|
||||
) {
|
||||
exists(Py::Scope scope |
|
||||
scope = callable.asScope() and
|
||||
file = scope.getLocation().getFile() and
|
||||
scope.getLocation().hasLocationInfo(_, startLine, startColumn, endLine, endColumn)
|
||||
)
|
||||
}
|
||||
}
|
||||
|
||||
import ControlFlow::ViewCfgQuery<Py::File, ViewCfgQueryInput>
|
||||
@@ -6,8 +6,9 @@
|
||||
* directed and labeled; they specify how the components represented by nodes relate to each other.
|
||||
*/
|
||||
|
||||
// Importing python under the `py` namespace to avoid importing `CallNode` from `Flow.qll` and thereby having a naming conflict with `API::CallNode`.
|
||||
// Importing python under the `PY` namespace to avoid pulling in `CallNode` from `Flow.qll` (via `import python`) and thereby having a naming conflict with `API::CallNode`.
|
||||
private import python as PY
|
||||
private import semmle.python.controlflow.internal.Cfg as Cfg
|
||||
import semmle.python.dataflow.new.DataFlow
|
||||
private import semmle.python.internal.CachedStages
|
||||
|
||||
@@ -282,7 +283,7 @@ module API {
|
||||
index = this.getIndex() and
|
||||
(
|
||||
// subscripting
|
||||
exists(PY::SubscriptNode subscript |
|
||||
exists(Cfg::SubscriptNode subscript |
|
||||
subscript.getObject() = this.getAValueReachableFromSource().asCfgNode() and
|
||||
subscript.getIndex() = index.asSink().asCfgNode()
|
||||
|
|
||||
@@ -290,7 +291,7 @@ module API {
|
||||
subscript = result.asSource().asCfgNode()
|
||||
or
|
||||
// writing
|
||||
subscript.(PY::DefinitionNode).getValue() = result.asSink().asCfgNode()
|
||||
subscript.(Cfg::DefinitionNode).getValue() = result.asSink().asCfgNode()
|
||||
)
|
||||
or
|
||||
// dictionary literals
|
||||
@@ -684,7 +685,7 @@ module API {
|
||||
* Ignores relative imports, such as `from ..foo.bar import baz`.
|
||||
*/
|
||||
private predicate imports(DataFlow::CfgNode imp, string name) {
|
||||
exists(PY::ImportExprNode iexpr |
|
||||
exists(Cfg::ImportExprNode iexpr |
|
||||
imp.getNode() = iexpr and
|
||||
not iexpr.getNode().isRelative() and
|
||||
name = iexpr.getNode().getImportedModuleName()
|
||||
@@ -775,7 +776,7 @@ module API {
|
||||
// list literals, from `x` to `[x]`
|
||||
// TODO: once convenient, this should be done at a higher level than the AST,
|
||||
// at least at the CFG layer, to take splitting into account.
|
||||
// Also consider `SequenceNode for generality.
|
||||
// Also consider `Cfg::SequenceNode` for generality.
|
||||
exists(PY::List list | list = pred.(DataFlow::ExprNode).getNode().getNode() |
|
||||
rhs.(DataFlow::ExprNode).getNode().getNode() = list.getAnElt() and
|
||||
lbl = Label::subscript()
|
||||
@@ -805,7 +806,7 @@ module API {
|
||||
subscript = trackUseNode(src).getSubscript(index)
|
||||
|
|
||||
// from `x` to a definition of `x[...]`
|
||||
rhs.asCfgNode() = subscript.asCfgNode().(PY::DefinitionNode).getValue() and
|
||||
rhs.asCfgNode() = subscript.asCfgNode().(Cfg::DefinitionNode).getValue() and
|
||||
lbl = Label::subscript()
|
||||
or
|
||||
// from `x` to `"key"` in `x["key"]`
|
||||
|
||||
@@ -3,6 +3,7 @@ module;
|
||||
|
||||
import python
|
||||
private import semmle.python.internal.CachedStages
|
||||
private import semmle.python.controlflow.internal.Cfg as Cfg
|
||||
|
||||
/** A syntactic node (Class, Function, Module, Expr, Stmt or Comprehension) corresponding to a flow node */
|
||||
abstract class AstNode extends AstNode_ {
|
||||
@@ -16,21 +17,25 @@ abstract class AstNode extends AstNode_ {
|
||||
/** Gets the scope that this node occurs in */
|
||||
abstract Scope getScope();
|
||||
|
||||
/**
|
||||
* Gets a flow node corresponding directly to this node.
|
||||
* NOTE: For some statements and other purely syntactic elements,
|
||||
* there may not be a `ControlFlowNode`
|
||||
*/
|
||||
cached
|
||||
ControlFlowNode getAFlowNode() {
|
||||
Stages::AST::ref() and
|
||||
py_flow_bb_node(result, this, _, _)
|
||||
}
|
||||
|
||||
/** Gets the location for this AST node */
|
||||
cached
|
||||
Location getLocation() { none() }
|
||||
|
||||
/**
|
||||
* DEPRECATED: use `ControlFlowNode.getNode()` from the other direction instead;
|
||||
* that is, replace `e.getAFlowNode() = n` with `n.getNode() = e`. This API is
|
||||
* being removed to untangle the AST and CFG hierarchies.
|
||||
*
|
||||
* Gets a flow node corresponding directly to this node, from the new
|
||||
* (shared) CFG. NOTE: For some statements and other purely syntactic
|
||||
* elements, there may not be a `ControlFlowNode`.
|
||||
*/
|
||||
cached
|
||||
deprecated Cfg::ControlFlowNode getAFlowNode() {
|
||||
Stages::AST::ref() and
|
||||
result.getNode() = this
|
||||
}
|
||||
|
||||
/**
|
||||
* Whether this syntactic element is artificial, that is it is generated
|
||||
* by the compiler and is not present in the source
|
||||
|
||||
@@ -5,6 +5,7 @@
|
||||
*/
|
||||
|
||||
private import python
|
||||
private import semmle.python.controlflow.internal.Cfg as Cfg
|
||||
private import semmle.python.dataflow.new.DataFlow
|
||||
private import semmle.python.dataflow.new.internal.DataFlowImplSpecific
|
||||
private import semmle.python.dataflow.new.RemoteFlowSources
|
||||
@@ -214,7 +215,7 @@ module Path {
|
||||
SafeAccessCheck() { this = DataFlow::BarrierGuard<safeAccessCheck/3>::getABarrierNode() }
|
||||
}
|
||||
|
||||
private predicate safeAccessCheck(DataFlow::GuardNode g, ControlFlowNode node, boolean branch) {
|
||||
private predicate safeAccessCheck(DataFlow::GuardNode g, Cfg::ControlFlowNode node, boolean branch) {
|
||||
g.(SafeAccessCheck::Range).checks(node, branch)
|
||||
}
|
||||
|
||||
@@ -223,7 +224,7 @@ module Path {
|
||||
/** A data-flow node that checks that a path is safe to access in some way, for example by having a controlled prefix. */
|
||||
abstract class Range extends DataFlow::GuardNode {
|
||||
/** Holds if this guard validates `node` upon evaluating to `branch`. */
|
||||
abstract predicate checks(ControlFlowNode node, boolean branch);
|
||||
abstract predicate checks(Cfg::ControlFlowNode node, boolean branch);
|
||||
}
|
||||
}
|
||||
}
|
||||
|
||||
@@ -28,7 +28,9 @@ class Expr extends Expr_, AstNode {
|
||||
/** Whether this expression may have a side effect (as determined purely from its syntax) */
|
||||
predicate hasSideEffects() {
|
||||
/* If an exception raised by this expression handled, count that as a side effect */
|
||||
this.getAFlowNode().getASuccessor().getNode() instanceof ExceptStmt
|
||||
exists(ControlFlowNode n | n.getNode() = this |
|
||||
n.getASuccessor().getNode() instanceof ExceptStmt
|
||||
)
|
||||
or
|
||||
this.getASubExpression().hasSideEffects()
|
||||
}
|
||||
@@ -68,8 +70,6 @@ class Attribute extends Attribute_ {
|
||||
/* syntax: Expr.name */
|
||||
override Expr getASubExpression() { result = this.getObject() }
|
||||
|
||||
override AttrNode getAFlowNode() { result = super.getAFlowNode() }
|
||||
|
||||
/** Gets the name of this attribute. That is the `name` in `obj.name` */
|
||||
string getName() { result = Attribute_.super.getAttr() }
|
||||
|
||||
@@ -96,8 +96,6 @@ class Subscript extends Subscript_ {
|
||||
}
|
||||
|
||||
Expr getObject() { result = Subscript_.super.getValue() }
|
||||
|
||||
override SubscriptNode getAFlowNode() { result = super.getAFlowNode() }
|
||||
}
|
||||
|
||||
/** A call expression, such as `func(...)` */
|
||||
@@ -113,8 +111,6 @@ class Call extends Call_ {
|
||||
|
||||
override string toString() { result = this.getFunc().toString() + "()" }
|
||||
|
||||
override CallNode getAFlowNode() { result = super.getAFlowNode() }
|
||||
|
||||
/** Gets a tuple (*) argument of this call. */
|
||||
Expr getStarargs() { result = this.getAPositionalArg().(Starred).getValue() }
|
||||
|
||||
@@ -200,8 +196,6 @@ class IfExp extends IfExp_ {
|
||||
override Expr getASubExpression() {
|
||||
result = this.getTest() or result = this.getBody() or result = this.getOrelse()
|
||||
}
|
||||
|
||||
override IfExprNode getAFlowNode() { result = super.getAFlowNode() }
|
||||
}
|
||||
|
||||
/** A starred expression, such as the `*rest` in the assignment `first, *rest = seq` */
|
||||
@@ -410,8 +404,6 @@ class PlaceHolder extends PlaceHolder_ {
|
||||
override Expr getASubExpression() { none() }
|
||||
|
||||
override string toString() { result = "$" + this.getId() }
|
||||
|
||||
override NameNode getAFlowNode() { result = super.getAFlowNode() }
|
||||
}
|
||||
|
||||
/** A tuple expression such as `( 1, 3, 5, 7, 9 )` */
|
||||
@@ -478,8 +470,6 @@ class Name extends Name_ {
|
||||
|
||||
override string toString() { result = this.getId() }
|
||||
|
||||
override NameNode getAFlowNode() { result = super.getAFlowNode() }
|
||||
|
||||
override predicate isArtificial() {
|
||||
/* Artificial variable names in comprehensions all start with "." */
|
||||
this.getId().charAt(0) = "."
|
||||
@@ -585,8 +575,6 @@ abstract class NameConstant extends Name, ImmutableLiteral {
|
||||
|
||||
override predicate isConstant() { any() }
|
||||
|
||||
override NameConstantNode getAFlowNode() { result = Name.super.getAFlowNode() }
|
||||
|
||||
override predicate isArtificial() { none() }
|
||||
}
|
||||
|
||||
|
||||
@@ -1,7 +1,7 @@
|
||||
overlay[local]
|
||||
module;
|
||||
|
||||
import python
|
||||
import python as Py
|
||||
private import semmle.python.internal.CachedStages
|
||||
private import codeql.controlflow.BasicBlock as BB
|
||||
|
||||
@@ -17,7 +17,7 @@ private import codeql.controlflow.BasicBlock as BB
|
||||
*/
|
||||
|
||||
private predicate augstore(ControlFlowNode load, ControlFlowNode store) {
|
||||
exists(Expr load_store | exists(AugAssign aa | aa.getTarget() = load_store) |
|
||||
exists(Py::Expr load_store | exists(Py::AugAssign aa | aa.getTarget() = load_store) |
|
||||
toAst(load) = load_store and
|
||||
toAst(store) = load_store and
|
||||
load.strictlyDominates(store)
|
||||
@@ -25,7 +25,7 @@ private predicate augstore(ControlFlowNode load, ControlFlowNode store) {
|
||||
}
|
||||
|
||||
/** A non-dispatched getNode() to avoid negative recursion issues */
|
||||
private AstNode toAst(ControlFlowNode n) { py_flow_bb_node(n, result, _, _) }
|
||||
private Py::AstNode toAst(ControlFlowNode n) { py_flow_bb_node(n, result, _, _) }
|
||||
|
||||
/**
|
||||
* A control flow node. Control flow nodes have a many-to-one relation with syntactic nodes,
|
||||
@@ -35,19 +35,19 @@ private AstNode toAst(ControlFlowNode n) { py_flow_bb_node(n, result, _, _) }
|
||||
class ControlFlowNode extends @py_flow_node {
|
||||
/** Whether this control flow node is a load (including those in augmented assignments) */
|
||||
predicate isLoad() {
|
||||
exists(Expr e | e = toAst(this) | py_expr_contexts(_, 3, e) and not augstore(_, this))
|
||||
exists(Py::Expr e | e = toAst(this) | py_expr_contexts(_, 3, e) and not augstore(_, this))
|
||||
}
|
||||
|
||||
/** Whether this control flow node is a store (including those in augmented assignments) */
|
||||
predicate isStore() {
|
||||
exists(Expr e | e = toAst(this) | py_expr_contexts(_, 5, e) or augstore(_, this))
|
||||
exists(Py::Expr e | e = toAst(this) | py_expr_contexts(_, 5, e) or augstore(_, this))
|
||||
}
|
||||
|
||||
/** Whether this control flow node is a delete */
|
||||
predicate isDelete() { exists(Expr e | e = toAst(this) | py_expr_contexts(_, 2, e)) }
|
||||
predicate isDelete() { exists(Py::Expr e | e = toAst(this) | py_expr_contexts(_, 2, e)) }
|
||||
|
||||
/** Whether this control flow node is a parameter */
|
||||
predicate isParameter() { exists(Expr e | e = toAst(this) | py_expr_contexts(_, 4, e)) }
|
||||
predicate isParameter() { exists(Py::Expr e | e = toAst(this) | py_expr_contexts(_, 4, e)) }
|
||||
|
||||
/** Whether this control flow node is a store in an augmented assignment */
|
||||
predicate isAugStore() { augstore(_, this) }
|
||||
@@ -57,61 +57,61 @@ class ControlFlowNode extends @py_flow_node {
|
||||
|
||||
/** Whether this flow node corresponds to a literal */
|
||||
predicate isLiteral() {
|
||||
toAst(this) instanceof Bytes
|
||||
toAst(this) instanceof Py::Bytes
|
||||
or
|
||||
toAst(this) instanceof Dict
|
||||
toAst(this) instanceof Py::Dict
|
||||
or
|
||||
toAst(this) instanceof DictComp
|
||||
toAst(this) instanceof Py::DictComp
|
||||
or
|
||||
toAst(this) instanceof Set
|
||||
toAst(this) instanceof Py::Set
|
||||
or
|
||||
toAst(this) instanceof SetComp
|
||||
toAst(this) instanceof Py::SetComp
|
||||
or
|
||||
toAst(this) instanceof Ellipsis
|
||||
toAst(this) instanceof Py::Ellipsis
|
||||
or
|
||||
toAst(this) instanceof GeneratorExp
|
||||
toAst(this) instanceof Py::GeneratorExp
|
||||
or
|
||||
toAst(this) instanceof Lambda
|
||||
toAst(this) instanceof Py::Lambda
|
||||
or
|
||||
toAst(this) instanceof ListComp
|
||||
toAst(this) instanceof Py::ListComp
|
||||
or
|
||||
toAst(this) instanceof List
|
||||
toAst(this) instanceof Py::List
|
||||
or
|
||||
toAst(this) instanceof Num
|
||||
toAst(this) instanceof Py::Num
|
||||
or
|
||||
toAst(this) instanceof Tuple
|
||||
toAst(this) instanceof Py::Tuple
|
||||
or
|
||||
toAst(this) instanceof Unicode
|
||||
toAst(this) instanceof Py::Unicode
|
||||
or
|
||||
toAst(this) instanceof NameConstant
|
||||
toAst(this) instanceof Py::NameConstant
|
||||
}
|
||||
|
||||
/** Whether this flow node corresponds to an attribute expression */
|
||||
predicate isAttribute() { toAst(this) instanceof Attribute }
|
||||
predicate isAttribute() { toAst(this) instanceof Py::Attribute }
|
||||
|
||||
/** Whether this flow node corresponds to an subscript expression */
|
||||
predicate isSubscript() { toAst(this) instanceof Subscript }
|
||||
predicate isSubscript() { toAst(this) instanceof Py::Subscript }
|
||||
|
||||
/** Whether this flow node corresponds to an import member */
|
||||
predicate isImportMember() { toAst(this) instanceof ImportMember }
|
||||
predicate isImportMember() { toAst(this) instanceof Py::ImportMember }
|
||||
|
||||
/** Whether this flow node corresponds to a call */
|
||||
predicate isCall() { toAst(this) instanceof Call }
|
||||
predicate isCall() { toAst(this) instanceof Py::Call }
|
||||
|
||||
/** Whether this flow node is the first in a module */
|
||||
predicate isModuleEntry() { this.isEntryNode() and toAst(this) instanceof Module }
|
||||
predicate isModuleEntry() { this.isEntryNode() and toAst(this) instanceof Py::Module }
|
||||
|
||||
/** Whether this flow node corresponds to an import */
|
||||
predicate isImport() { toAst(this) instanceof ImportExpr }
|
||||
predicate isImport() { toAst(this) instanceof Py::ImportExpr }
|
||||
|
||||
/** Whether this flow node corresponds to a conditional expression */
|
||||
predicate isIfExp() { toAst(this) instanceof IfExp }
|
||||
predicate isIfExp() { toAst(this) instanceof Py::IfExp }
|
||||
|
||||
/** Whether this flow node corresponds to a function definition expression */
|
||||
predicate isFunction() { toAst(this) instanceof FunctionExpr }
|
||||
predicate isFunction() { toAst(this) instanceof Py::FunctionExpr }
|
||||
|
||||
/** Whether this flow node corresponds to a class definition expression */
|
||||
predicate isClass() { toAst(this) instanceof ClassExpr }
|
||||
predicate isClass() { toAst(this) instanceof Py::ClassExpr }
|
||||
|
||||
/** Gets a predecessor of this flow node */
|
||||
ControlFlowNode getAPredecessor() { this = result.getASuccessor() }
|
||||
@@ -123,25 +123,25 @@ class ControlFlowNode extends @py_flow_node {
|
||||
ControlFlowNode getImmediateDominator() { py_idoms(this, result) }
|
||||
|
||||
/** Gets the syntactic element corresponding to this flow node */
|
||||
AstNode getNode() { py_flow_bb_node(this, result, _, _) }
|
||||
Py::AstNode getNode() { py_flow_bb_node(this, result, _, _) }
|
||||
|
||||
/** Gets a textual representation of this element. */
|
||||
cached
|
||||
string toString() {
|
||||
Stages::AST::ref() and
|
||||
// Since modules can have ambigous names, entry nodes can too, if we do not collate them.
|
||||
exists(Scope s | s.getEntryNode() = this |
|
||||
exists(Py::Scope s | s.getEntryNode() = this |
|
||||
result = "Entry node for " + concat( | | s.toString(), ",")
|
||||
)
|
||||
or
|
||||
exists(Scope s | s.getANormalExit() = this | result = "Exit node for " + s.toString())
|
||||
exists(Py::Scope s | s.getANormalExit() = this | result = "Exit node for " + s.toString())
|
||||
or
|
||||
not exists(Scope s | s.getEntryNode() = this or s.getANormalExit() = this) and
|
||||
not exists(Py::Scope s | s.getEntryNode() = this or s.getANormalExit() = this) and
|
||||
result = "ControlFlowNode for " + this.getNode().toString()
|
||||
}
|
||||
|
||||
/** Gets the location of this ControlFlowNode */
|
||||
Location getLocation() { result = this.getNode().getLocation() }
|
||||
Py::Location getLocation() { result = this.getNode().getLocation() }
|
||||
|
||||
/** Whether this flow node is the first in its scope */
|
||||
predicate isEntryNode() { py_scope_flow(this, _, -1) }
|
||||
@@ -151,9 +151,9 @@ class ControlFlowNode extends @py_flow_node {
|
||||
|
||||
/** Gets the scope containing this flow node */
|
||||
cached
|
||||
Scope getScope() {
|
||||
Py::Scope getScope() {
|
||||
Stages::AST::ref() and
|
||||
if this.getNode() instanceof Scope
|
||||
if this.getNode() instanceof Py::Scope
|
||||
then
|
||||
/* Entry or exit node */
|
||||
result = this.getNode()
|
||||
@@ -161,7 +161,7 @@ class ControlFlowNode extends @py_flow_node {
|
||||
}
|
||||
|
||||
/** Gets the enclosing module */
|
||||
Module getEnclosingModule() { result = this.getScope().getEnclosingModule() }
|
||||
Py::Module getEnclosingModule() { result = this.getScope().getEnclosingModule() }
|
||||
|
||||
/** Gets a successor for this node if the relevant condition is True. */
|
||||
ControlFlowNode getATrueSuccessor() {
|
||||
@@ -188,7 +188,7 @@ class ControlFlowNode extends @py_flow_node {
|
||||
}
|
||||
|
||||
/** Whether the scope may be exited as a result of this node raising an exception */
|
||||
predicate isExceptionalExit(Scope s) { py_scope_flow(this, s, 1) }
|
||||
predicate isExceptionalExit(Py::Scope s) { py_scope_flow(this, s, 1) }
|
||||
|
||||
/** Whether this node is a normal (non-exceptional) exit */
|
||||
predicate isNormalExit() { py_scope_flow(this, _, 0) or py_scope_flow(this, _, 2) }
|
||||
@@ -236,7 +236,7 @@ class ControlFlowNode extends @py_flow_node {
|
||||
/* join-ordering helper for `getAChild() */
|
||||
pragma[noinline]
|
||||
private ControlFlowNode getExprChild(BasicBlock dom) {
|
||||
this.getNode().(Expr).getAChildNode() = result.getNode() and
|
||||
this.getNode().(Py::Expr).getAChildNode() = result.getNode() and
|
||||
result.getBasicBlock().dominates(dom) and
|
||||
not this instanceof UnaryExprNode
|
||||
}
|
||||
@@ -249,16 +249,16 @@ class ControlFlowNode extends @py_flow_node {
|
||||
*/
|
||||
|
||||
private class AnyNode extends ControlFlowNode {
|
||||
override AstNode getNode() { result = super.getNode() }
|
||||
override Py::AstNode getNode() { result = super.getNode() }
|
||||
}
|
||||
|
||||
/** A control flow node corresponding to a call expression, such as `func(...)` */
|
||||
class CallNode extends ControlFlowNode {
|
||||
CallNode() { toAst(this) instanceof Call }
|
||||
CallNode() { toAst(this) instanceof Py::Call }
|
||||
|
||||
/** Gets the flow node corresponding to the function expression for the call corresponding to this flow node */
|
||||
ControlFlowNode getFunction() {
|
||||
exists(Call c |
|
||||
exists(Py::Call c |
|
||||
this.getNode() = c and
|
||||
c.getFunc() = result.getNode() and
|
||||
result.getBasicBlock().dominates(this.getBasicBlock())
|
||||
@@ -267,7 +267,7 @@ class CallNode extends ControlFlowNode {
|
||||
|
||||
/** Gets the flow node corresponding to the n'th positional argument of the call corresponding to this flow node */
|
||||
ControlFlowNode getArg(int n) {
|
||||
exists(Call c |
|
||||
exists(Py::Call c |
|
||||
this.getNode() = c and
|
||||
c.getArg(n) = result.getNode() and
|
||||
result.getBasicBlock().dominates(this.getBasicBlock())
|
||||
@@ -276,7 +276,7 @@ class CallNode extends ControlFlowNode {
|
||||
|
||||
/** Gets the flow node corresponding to the named argument of the call corresponding to this flow node */
|
||||
ControlFlowNode getArgByName(string name) {
|
||||
exists(Call c, Keyword k |
|
||||
exists(Py::Call c, Py::Keyword k |
|
||||
this.getNode() = c and
|
||||
k = c.getANamedArg() and
|
||||
k.getValue() = result.getNode() and
|
||||
@@ -292,7 +292,7 @@ class CallNode extends ControlFlowNode {
|
||||
result = this.getArgByName(_)
|
||||
}
|
||||
|
||||
override Call getNode() { result = super.getNode() }
|
||||
override Py::Call getNode() { result = super.getNode() }
|
||||
|
||||
predicate isDecoratorCall() {
|
||||
this.isClassDecoratorCall()
|
||||
@@ -301,11 +301,11 @@ class CallNode extends ControlFlowNode {
|
||||
}
|
||||
|
||||
predicate isClassDecoratorCall() {
|
||||
exists(ClassExpr cls | this.getNode() = cls.getADecoratorCall())
|
||||
exists(Py::ClassExpr cls | this.getNode() = cls.getADecoratorCall())
|
||||
}
|
||||
|
||||
predicate isFunctionDecoratorCall() {
|
||||
exists(FunctionExpr func | this.getNode() = func.getADecoratorCall())
|
||||
exists(Py::FunctionExpr func | this.getNode() = func.getADecoratorCall())
|
||||
}
|
||||
|
||||
/** Gets the first tuple (*) argument of this call, if any. */
|
||||
@@ -323,11 +323,11 @@ class CallNode extends ControlFlowNode {
|
||||
|
||||
/** A control flow corresponding to an attribute expression, such as `value.attr` */
|
||||
class AttrNode extends ControlFlowNode {
|
||||
AttrNode() { toAst(this) instanceof Attribute }
|
||||
AttrNode() { toAst(this) instanceof Py::Attribute }
|
||||
|
||||
/** Gets the flow node corresponding to the object of the attribute expression corresponding to this flow node */
|
||||
ControlFlowNode getObject() {
|
||||
exists(Attribute a |
|
||||
exists(Py::Attribute a |
|
||||
this.getNode() = a and
|
||||
a.getObject() = result.getNode() and
|
||||
result.getBasicBlock().dominates(this.getBasicBlock())
|
||||
@@ -339,7 +339,7 @@ class AttrNode extends ControlFlowNode {
|
||||
* with the matching name
|
||||
*/
|
||||
ControlFlowNode getObject(string name) {
|
||||
exists(Attribute a |
|
||||
exists(Py::Attribute a |
|
||||
this.getNode() = a and
|
||||
a.getObject() = result.getNode() and
|
||||
a.getName() = name and
|
||||
@@ -348,57 +348,57 @@ class AttrNode extends ControlFlowNode {
|
||||
}
|
||||
|
||||
/** Gets the attribute name of the attribute expression corresponding to this flow node */
|
||||
string getName() { exists(Attribute a | this.getNode() = a and a.getName() = result) }
|
||||
string getName() { exists(Py::Attribute a | this.getNode() = a and a.getName() = result) }
|
||||
|
||||
override Attribute getNode() { result = super.getNode() }
|
||||
override Py::Attribute getNode() { result = super.getNode() }
|
||||
}
|
||||
|
||||
/** A control flow node corresponding to a `from ... import ...` expression */
|
||||
class ImportMemberNode extends ControlFlowNode {
|
||||
ImportMemberNode() { toAst(this) instanceof ImportMember }
|
||||
ImportMemberNode() { toAst(this) instanceof Py::ImportMember }
|
||||
|
||||
/**
|
||||
* Gets the flow node corresponding to the module in the import-member expression corresponding to this flow node,
|
||||
* with the matching name
|
||||
*/
|
||||
ControlFlowNode getModule(string name) {
|
||||
exists(ImportMember i | this.getNode() = i and i.getModule() = result.getNode() |
|
||||
exists(Py::ImportMember i | this.getNode() = i and i.getModule() = result.getNode() |
|
||||
i.getName() = name and
|
||||
result.getBasicBlock().dominates(this.getBasicBlock())
|
||||
)
|
||||
}
|
||||
|
||||
override ImportMember getNode() { result = super.getNode() }
|
||||
override Py::ImportMember getNode() { result = super.getNode() }
|
||||
}
|
||||
|
||||
/** A control flow node corresponding to an artificial expression representing an import */
|
||||
class ImportExprNode extends ControlFlowNode {
|
||||
ImportExprNode() { toAst(this) instanceof ImportExpr }
|
||||
ImportExprNode() { toAst(this) instanceof Py::ImportExpr }
|
||||
|
||||
override ImportExpr getNode() { result = super.getNode() }
|
||||
override Py::ImportExpr getNode() { result = super.getNode() }
|
||||
}
|
||||
|
||||
/** A control flow node corresponding to a `from ... import *` statement */
|
||||
class ImportStarNode extends ControlFlowNode {
|
||||
ImportStarNode() { toAst(this) instanceof ImportStar }
|
||||
ImportStarNode() { toAst(this) instanceof Py::ImportStar }
|
||||
|
||||
/** Gets the flow node corresponding to the module in the import-star corresponding to this flow node */
|
||||
ControlFlowNode getModule() {
|
||||
exists(ImportStar i | this.getNode() = i and i.getModuleExpr() = result.getNode() |
|
||||
exists(Py::ImportStar i | this.getNode() = i and i.getModuleExpr() = result.getNode() |
|
||||
result.getBasicBlock().dominates(this.getBasicBlock())
|
||||
)
|
||||
}
|
||||
|
||||
override ImportStar getNode() { result = super.getNode() }
|
||||
override Py::ImportStar getNode() { result = super.getNode() }
|
||||
}
|
||||
|
||||
/** A control flow node corresponding to a subscript expression, such as `value[slice]` */
|
||||
class SubscriptNode extends ControlFlowNode {
|
||||
SubscriptNode() { toAst(this) instanceof Subscript }
|
||||
SubscriptNode() { toAst(this) instanceof Py::Subscript }
|
||||
|
||||
/** flow node corresponding to the value of the sequence in a subscript operation */
|
||||
ControlFlowNode getObject() {
|
||||
exists(Subscript s |
|
||||
exists(Py::Subscript s |
|
||||
this.getNode() = s and
|
||||
s.getObject() = result.getNode() and
|
||||
result.getBasicBlock().dominates(this.getBasicBlock())
|
||||
@@ -407,23 +407,23 @@ class SubscriptNode extends ControlFlowNode {
|
||||
|
||||
/** flow node corresponding to the index in a subscript operation */
|
||||
ControlFlowNode getIndex() {
|
||||
exists(Subscript s |
|
||||
exists(Py::Subscript s |
|
||||
this.getNode() = s and
|
||||
s.getIndex() = result.getNode() and
|
||||
result.getBasicBlock().dominates(this.getBasicBlock())
|
||||
)
|
||||
}
|
||||
|
||||
override Subscript getNode() { result = super.getNode() }
|
||||
override Py::Subscript getNode() { result = super.getNode() }
|
||||
}
|
||||
|
||||
/** A control flow node corresponding to a comparison operation, such as `x<y` */
|
||||
class CompareNode extends ControlFlowNode {
|
||||
CompareNode() { toAst(this) instanceof Compare }
|
||||
CompareNode() { toAst(this) instanceof Py::Compare }
|
||||
|
||||
/** Whether left and right are a pair of operands for this comparison */
|
||||
predicate operands(ControlFlowNode left, Cmpop op, ControlFlowNode right) {
|
||||
exists(Compare c, Expr eleft, Expr eright |
|
||||
predicate operands(ControlFlowNode left, Py::Cmpop op, ControlFlowNode right) {
|
||||
exists(Py::Compare c, Py::Expr eleft, Py::Expr eright |
|
||||
this.getNode() = c and left.getNode() = eleft and right.getNode() = eright
|
||||
|
|
||||
eleft = c.getLeft() and eright = c.getComparator(0) and op = c.getOp(0)
|
||||
@@ -436,26 +436,26 @@ class CompareNode extends ControlFlowNode {
|
||||
right.getBasicBlock().dominates(this.getBasicBlock())
|
||||
}
|
||||
|
||||
override Compare getNode() { result = super.getNode() }
|
||||
override Py::Compare getNode() { result = super.getNode() }
|
||||
}
|
||||
|
||||
/** A control flow node corresponding to a conditional expression such as, `body if test else orelse` */
|
||||
class IfExprNode extends ControlFlowNode {
|
||||
IfExprNode() { toAst(this) instanceof IfExp }
|
||||
IfExprNode() { toAst(this) instanceof Py::IfExp }
|
||||
|
||||
/** flow node corresponding to one of the operands of an if-expression */
|
||||
ControlFlowNode getAnOperand() { result = this.getAPredecessor() }
|
||||
|
||||
override IfExp getNode() { result = super.getNode() }
|
||||
override Py::IfExp getNode() { result = super.getNode() }
|
||||
}
|
||||
|
||||
/** A control flow node corresponding to an assignment expression such as `lhs := rhs`. */
|
||||
class AssignmentExprNode extends ControlFlowNode {
|
||||
AssignmentExprNode() { toAst(this) instanceof AssignExpr }
|
||||
AssignmentExprNode() { toAst(this) instanceof Py::AssignExpr }
|
||||
|
||||
/** Gets the flow node corresponding to the left-hand side of the assignment expression */
|
||||
ControlFlowNode getTarget() {
|
||||
exists(AssignExpr a |
|
||||
exists(Py::AssignExpr a |
|
||||
this.getNode() = a and
|
||||
a.getTarget() = result.getNode() and
|
||||
result.getBasicBlock().dominates(this.getBasicBlock())
|
||||
@@ -464,27 +464,27 @@ class AssignmentExprNode extends ControlFlowNode {
|
||||
|
||||
/** Gets the flow node corresponding to the right-hand side of the assignment expression */
|
||||
ControlFlowNode getValue() {
|
||||
exists(AssignExpr a |
|
||||
exists(Py::AssignExpr a |
|
||||
this.getNode() = a and
|
||||
a.getValue() = result.getNode() and
|
||||
result.getBasicBlock().dominates(this.getBasicBlock())
|
||||
)
|
||||
}
|
||||
|
||||
override AssignExpr getNode() { result = super.getNode() }
|
||||
override Py::AssignExpr getNode() { result = super.getNode() }
|
||||
}
|
||||
|
||||
/** A control flow node corresponding to a binary expression, such as `x + y` */
|
||||
class BinaryExprNode extends ControlFlowNode {
|
||||
BinaryExprNode() { toAst(this) instanceof BinaryExpr }
|
||||
BinaryExprNode() { toAst(this) instanceof Py::BinaryExpr }
|
||||
|
||||
/** flow node corresponding to one of the operands of a binary expression */
|
||||
ControlFlowNode getAnOperand() { result = this.getLeft() or result = this.getRight() }
|
||||
|
||||
override BinaryExpr getNode() { result = super.getNode() }
|
||||
override Py::BinaryExpr getNode() { result = super.getNode() }
|
||||
|
||||
ControlFlowNode getLeft() {
|
||||
exists(BinaryExpr b |
|
||||
exists(Py::BinaryExpr b |
|
||||
this.getNode() = b and
|
||||
result.getNode() = b.getLeft() and
|
||||
result.getBasicBlock().dominates(this.getBasicBlock())
|
||||
@@ -492,7 +492,7 @@ class BinaryExprNode extends ControlFlowNode {
|
||||
}
|
||||
|
||||
ControlFlowNode getRight() {
|
||||
exists(BinaryExpr b |
|
||||
exists(Py::BinaryExpr b |
|
||||
this.getNode() = b and
|
||||
result.getNode() = b.getRight() and
|
||||
result.getBasicBlock().dominates(this.getBasicBlock())
|
||||
@@ -500,11 +500,11 @@ class BinaryExprNode extends ControlFlowNode {
|
||||
}
|
||||
|
||||
/** Gets the operator of this binary expression node. */
|
||||
Operator getOp() { result = this.getNode().getOp() }
|
||||
Py::Operator getOp() { result = this.getNode().getOp() }
|
||||
|
||||
/** Whether left and right are a pair of operands for this binary expression */
|
||||
predicate operands(ControlFlowNode left, Operator op, ControlFlowNode right) {
|
||||
exists(BinaryExpr b, Expr eleft, Expr eright |
|
||||
predicate operands(ControlFlowNode left, Py::Operator op, ControlFlowNode right) {
|
||||
exists(Py::BinaryExpr b, Py::Expr eleft, Py::Expr eright |
|
||||
this.getNode() = b and left.getNode() = eleft and right.getNode() = eright
|
||||
|
|
||||
eleft = b.getLeft() and eright = b.getRight() and op = b.getOp()
|
||||
@@ -516,20 +516,20 @@ class BinaryExprNode extends ControlFlowNode {
|
||||
|
||||
/** A control flow node corresponding to a boolean shortcut (and/or) operation */
|
||||
class BoolExprNode extends ControlFlowNode {
|
||||
BoolExprNode() { toAst(this) instanceof BoolExpr }
|
||||
BoolExprNode() { toAst(this) instanceof Py::BoolExpr }
|
||||
|
||||
/** flow node corresponding to one of the operands of a boolean expression */
|
||||
ControlFlowNode getAnOperand() {
|
||||
exists(BoolExpr b | this.getNode() = b and result.getNode() = b.getAValue()) and
|
||||
exists(Py::BoolExpr b | this.getNode() = b and result.getNode() = b.getAValue()) and
|
||||
this.getBasicBlock().dominates(result.getBasicBlock())
|
||||
}
|
||||
|
||||
override BoolExpr getNode() { result = super.getNode() }
|
||||
override Py::BoolExpr getNode() { result = super.getNode() }
|
||||
}
|
||||
|
||||
/** A control flow node corresponding to a unary expression: (`+x`), (`-x`) or (`~x`) */
|
||||
class UnaryExprNode extends ControlFlowNode {
|
||||
UnaryExprNode() { toAst(this) instanceof UnaryExpr }
|
||||
UnaryExprNode() { toAst(this) instanceof Py::UnaryExpr }
|
||||
|
||||
/**
|
||||
* Gets flow node corresponding to the operand of a unary expression.
|
||||
@@ -540,7 +540,7 @@ class UnaryExprNode extends ControlFlowNode {
|
||||
*/
|
||||
ControlFlowNode getOperand() { result = this.getAPredecessor() }
|
||||
|
||||
override UnaryExpr getNode() { result = super.getNode() }
|
||||
override Py::UnaryExpr getNode() { result = super.getNode() }
|
||||
|
||||
override ControlFlowNode getAChild() { result = this.getAPredecessor() }
|
||||
}
|
||||
@@ -555,27 +555,27 @@ class DefinitionNode extends ControlFlowNode {
|
||||
cached
|
||||
DefinitionNode() {
|
||||
Stages::AST::ref() and
|
||||
exists(Assign a | a.getATarget().getAFlowNode() = this)
|
||||
exists(Py::Assign a | this.getNode() = a.getATarget())
|
||||
or
|
||||
exists(AssignExpr a | a.getTarget().getAFlowNode() = this)
|
||||
exists(Py::AssignExpr a | this.getNode() = a.getTarget())
|
||||
or
|
||||
exists(AnnAssign a | a.getTarget().getAFlowNode() = this and exists(a.getValue()))
|
||||
exists(Py::AnnAssign a | this.getNode() = a.getTarget() and exists(a.getValue()))
|
||||
or
|
||||
exists(Alias a | a.getAsname().getAFlowNode() = this)
|
||||
exists(Py::Alias a | this.getNode() = a.getAsname())
|
||||
or
|
||||
augstore(_, this)
|
||||
or
|
||||
// `x, y = 1, 2` where LHS is a combination of list or tuples
|
||||
exists(Assign a | list_or_tuple_nested_element(a.getATarget()).getAFlowNode() = this)
|
||||
exists(Py::Assign a | this.getNode() = list_or_tuple_nested_element(a.getATarget()))
|
||||
or
|
||||
exists(For for | for.getTarget().getAFlowNode() = this)
|
||||
exists(Py::For for | this.getNode() = for.getTarget())
|
||||
or
|
||||
exists(Parameter param | this = param.asName().getAFlowNode() and exists(param.getDefault()))
|
||||
exists(Py::Parameter param | this.getNode() = param.asName() and exists(param.getDefault()))
|
||||
}
|
||||
|
||||
/** flow node corresponding to the value assigned for the definition corresponding to this flow node */
|
||||
ControlFlowNode getValue() {
|
||||
result = assigned_value(this.getNode()).getAFlowNode() and
|
||||
result.getNode() = assigned_value(this.getNode()) and
|
||||
(
|
||||
result.getBasicBlock().dominates(this.getBasicBlock())
|
||||
or
|
||||
@@ -584,16 +584,16 @@ class DefinitionNode extends ControlFlowNode {
|
||||
// since the default value for a parameter is evaluated in the same basic block as
|
||||
// the function definition, but the parameter belongs to the basic block of the function,
|
||||
// there is no dominance relationship between the two.
|
||||
exists(Parameter param | this = param.asName().getAFlowNode())
|
||||
exists(Py::Parameter param | this.getNode() = param.asName())
|
||||
)
|
||||
}
|
||||
}
|
||||
|
||||
private Expr list_or_tuple_nested_element(Expr list_or_tuple) {
|
||||
exists(Expr elt |
|
||||
elt = list_or_tuple.(Tuple).getAnElt()
|
||||
private Py::Expr list_or_tuple_nested_element(Py::Expr list_or_tuple) {
|
||||
exists(Py::Expr elt |
|
||||
elt = list_or_tuple.(Py::Tuple).getAnElt()
|
||||
or
|
||||
elt = list_or_tuple.(List).getAnElt()
|
||||
elt = list_or_tuple.(Py::List).getAnElt()
|
||||
|
|
||||
result = elt
|
||||
or
|
||||
@@ -603,12 +603,12 @@ private Expr list_or_tuple_nested_element(Expr list_or_tuple) {
|
||||
|
||||
/**
|
||||
* A control flow node corresponding to a deletion statement, such as `del x`.
|
||||
* There can be multiple `DeletionNode`s for each `Delete` such that each
|
||||
* There can be multiple `DeletionNode`s for each `Py::Delete` such that each
|
||||
* target has own `DeletionNode`. The CFG for `del a, x.y` looks like:
|
||||
* `NameNode('a') -> DeletionNode -> NameNode('b') -> AttrNode('y') -> DeletionNode`.
|
||||
*/
|
||||
class DeletionNode extends ControlFlowNode {
|
||||
DeletionNode() { toAst(this) instanceof Delete }
|
||||
DeletionNode() { toAst(this) instanceof Py::Delete }
|
||||
|
||||
/** Gets the unique target of this deletion node. */
|
||||
ControlFlowNode getTarget() { result.getASuccessor() = this }
|
||||
@@ -617,9 +617,9 @@ class DeletionNode extends ControlFlowNode {
|
||||
/** A control flow node corresponding to a sequence (tuple or list) literal */
|
||||
abstract class SequenceNode extends ControlFlowNode {
|
||||
SequenceNode() {
|
||||
toAst(this) instanceof Tuple
|
||||
toAst(this) instanceof Py::Tuple
|
||||
or
|
||||
toAst(this) instanceof List
|
||||
toAst(this) instanceof Py::List
|
||||
}
|
||||
|
||||
/** Gets the control flow node for an element of this sequence */
|
||||
@@ -632,11 +632,11 @@ abstract class SequenceNode extends ControlFlowNode {
|
||||
|
||||
/** A control flow node corresponding to a tuple expression such as `( 1, 3, 5, 7, 9 )` */
|
||||
class TupleNode extends SequenceNode {
|
||||
TupleNode() { toAst(this) instanceof Tuple }
|
||||
TupleNode() { toAst(this) instanceof Py::Tuple }
|
||||
|
||||
override ControlFlowNode getElement(int n) {
|
||||
Stages::AST::ref() and
|
||||
exists(Tuple t | this.getNode() = t and result.getNode() = t.getElt(n)) and
|
||||
exists(Py::Tuple t | this.getNode() = t and result.getNode() = t.getElt(n)) and
|
||||
(
|
||||
result.getBasicBlock().dominates(this.getBasicBlock())
|
||||
or
|
||||
@@ -647,10 +647,10 @@ class TupleNode extends SequenceNode {
|
||||
|
||||
/** A control flow node corresponding to a list expression, such as `[ 1, 3, 5, 7, 9 ]` */
|
||||
class ListNode extends SequenceNode {
|
||||
ListNode() { toAst(this) instanceof List }
|
||||
ListNode() { toAst(this) instanceof Py::List }
|
||||
|
||||
override ControlFlowNode getElement(int n) {
|
||||
exists(List l | this.getNode() = l and result.getNode() = l.getElt(n)) and
|
||||
exists(Py::List l | this.getNode() = l and result.getNode() = l.getElt(n)) and
|
||||
(
|
||||
result.getBasicBlock().dominates(this.getBasicBlock())
|
||||
or
|
||||
@@ -661,10 +661,10 @@ class ListNode extends SequenceNode {
|
||||
|
||||
/** A control flow node corresponding to a set expression, such as `{ 1, 3, 5, 7, 9 }` */
|
||||
class SetNode extends ControlFlowNode {
|
||||
SetNode() { toAst(this) instanceof Set }
|
||||
SetNode() { toAst(this) instanceof Py::Set }
|
||||
|
||||
ControlFlowNode getAnElement() {
|
||||
exists(Set s | this.getNode() = s and result.getNode() = s.getElt(_)) and
|
||||
exists(Py::Set s | this.getNode() = s and result.getNode() = s.getElt(_)) and
|
||||
(
|
||||
result.getBasicBlock().dominates(this.getBasicBlock())
|
||||
or
|
||||
@@ -675,20 +675,20 @@ class SetNode extends ControlFlowNode {
|
||||
|
||||
/** A control flow node corresponding to a dictionary literal, such as `{ 'a': 1, 'b': 2 }` */
|
||||
class DictNode extends ControlFlowNode {
|
||||
DictNode() { toAst(this) instanceof Dict }
|
||||
DictNode() { toAst(this) instanceof Py::Dict }
|
||||
|
||||
/**
|
||||
* Gets a key of this dictionary literal node, for those items that have keys
|
||||
* E.g, in {'a':1, **b} this returns only 'a'
|
||||
*/
|
||||
ControlFlowNode getAKey() {
|
||||
exists(Dict d | this.getNode() = d and result.getNode() = d.getAKey()) and
|
||||
exists(Py::Dict d | this.getNode() = d and result.getNode() = d.getAKey()) and
|
||||
result.getBasicBlock().dominates(this.getBasicBlock())
|
||||
}
|
||||
|
||||
/** Gets a value of this dictionary literal node */
|
||||
ControlFlowNode getAValue() {
|
||||
exists(Dict d | this.getNode() = d and result.getNode() = d.getAValue()) and
|
||||
exists(Py::Dict d | this.getNode() = d and result.getNode() = d.getAValue()) and
|
||||
result.getBasicBlock().dominates(this.getBasicBlock())
|
||||
}
|
||||
}
|
||||
@@ -712,21 +712,23 @@ class IterableNode extends ControlFlowNode {
|
||||
}
|
||||
}
|
||||
|
||||
private AstNode assigned_value(Expr lhs) {
|
||||
private Py::AstNode assigned_value(Py::Expr lhs) {
|
||||
/* lhs = result */
|
||||
exists(Assign a | a.getATarget() = lhs and result = a.getValue())
|
||||
exists(Py::Assign a | a.getATarget() = lhs and result = a.getValue())
|
||||
or
|
||||
/* lhs := result */
|
||||
exists(AssignExpr a | a.getTarget() = lhs and result = a.getValue())
|
||||
exists(Py::AssignExpr a | a.getTarget() = lhs and result = a.getValue())
|
||||
or
|
||||
/* lhs : annotation = result */
|
||||
exists(AnnAssign a | a.getTarget() = lhs and result = a.getValue())
|
||||
exists(Py::AnnAssign a | a.getTarget() = lhs and result = a.getValue())
|
||||
or
|
||||
/* import result as lhs */
|
||||
exists(Alias a | a.getAsname() = lhs and result = a.getValue())
|
||||
exists(Py::Alias a | a.getAsname() = lhs and result = a.getValue())
|
||||
or
|
||||
/* lhs += x => result = (lhs + x) */
|
||||
exists(AugAssign a, BinaryExpr b | b = a.getOperation() and result = b and lhs = b.getLeft())
|
||||
exists(Py::AugAssign a, Py::BinaryExpr b |
|
||||
b = a.getOperation() and result = b and lhs = b.getLeft()
|
||||
)
|
||||
or
|
||||
/*
|
||||
* ..., lhs, ... = ..., result, ...
|
||||
@@ -734,31 +736,31 @@ private AstNode assigned_value(Expr lhs) {
|
||||
* ..., (..., lhs, ...), ... = ..., (..., result, ...), ...
|
||||
*/
|
||||
|
||||
exists(Assign a | nested_sequence_assign(a.getATarget(), a.getValue(), lhs, result))
|
||||
exists(Py::Assign a | nested_sequence_assign(a.getATarget(), a.getValue(), lhs, result))
|
||||
or
|
||||
/* for lhs in seq: => `result` is the `for` node, representing the `iter(next(seq))` operation. */
|
||||
result.(For).getTarget() = lhs
|
||||
result.(Py::For).getTarget() = lhs
|
||||
or
|
||||
exists(Parameter param | lhs = param.asName() and result = param.getDefault())
|
||||
exists(Py::Parameter param | lhs = param.asName() and result = param.getDefault())
|
||||
}
|
||||
|
||||
predicate nested_sequence_assign(
|
||||
Expr left_parent, Expr right_parent, Expr left_result, Expr right_result
|
||||
Py::Expr left_parent, Py::Expr right_parent, Py::Expr left_result, Py::Expr right_result
|
||||
) {
|
||||
exists(Assign a |
|
||||
exists(Py::Assign a |
|
||||
a.getATarget().getASubExpression*() = left_parent and
|
||||
a.getValue().getASubExpression*() = right_parent
|
||||
) and
|
||||
exists(int i, Expr left_elem, Expr right_elem |
|
||||
exists(int i, Py::Expr left_elem, Py::Expr right_elem |
|
||||
(
|
||||
left_elem = left_parent.(Tuple).getElt(i)
|
||||
left_elem = left_parent.(Py::Tuple).getElt(i)
|
||||
or
|
||||
left_elem = left_parent.(List).getElt(i)
|
||||
left_elem = left_parent.(Py::List).getElt(i)
|
||||
) and
|
||||
(
|
||||
right_elem = right_parent.(Tuple).getElt(i)
|
||||
right_elem = right_parent.(Py::Tuple).getElt(i)
|
||||
or
|
||||
right_elem = right_parent.(List).getElt(i)
|
||||
right_elem = right_parent.(Py::List).getElt(i)
|
||||
)
|
||||
|
|
||||
left_result = left_elem and right_result = right_elem
|
||||
@@ -769,9 +771,9 @@ predicate nested_sequence_assign(
|
||||
|
||||
/** A flow node for a `for` statement. */
|
||||
class ForNode extends ControlFlowNode {
|
||||
ForNode() { toAst(this) instanceof For }
|
||||
ForNode() { toAst(this) instanceof Py::For }
|
||||
|
||||
override For getNode() { result = super.getNode() }
|
||||
override Py::For getNode() { result = super.getNode() }
|
||||
|
||||
/** Holds if this `for` statement causes iteration over `sequence` storing each step of the iteration in `target` */
|
||||
predicate iterates(ControlFlowNode target, ControlFlowNode sequence) {
|
||||
@@ -782,7 +784,7 @@ class ForNode extends ControlFlowNode {
|
||||
|
||||
/** Gets the sequence node for this `for` statement. */
|
||||
ControlFlowNode getSequence() {
|
||||
exists(For for |
|
||||
exists(Py::For for |
|
||||
toAst(this) = for and
|
||||
for.getIter() = result.getNode()
|
||||
|
|
||||
@@ -792,7 +794,7 @@ class ForNode extends ControlFlowNode {
|
||||
|
||||
/** A possible `target` for this `for` statement, not accounting for loop unrolling */
|
||||
private ControlFlowNode possibleTarget() {
|
||||
exists(For for |
|
||||
exists(Py::For for |
|
||||
toAst(this) = for and
|
||||
for.getTarget() = result.getNode() and
|
||||
this.getBasicBlock().dominates(result.getBasicBlock())
|
||||
@@ -809,11 +811,11 @@ class ForNode extends ControlFlowNode {
|
||||
|
||||
/** A flow node for a `raise` statement */
|
||||
class RaiseStmtNode extends ControlFlowNode {
|
||||
RaiseStmtNode() { toAst(this) instanceof Raise }
|
||||
RaiseStmtNode() { toAst(this) instanceof Py::Raise }
|
||||
|
||||
/** Gets the control flow node for the exception raised by this raise statement */
|
||||
ControlFlowNode getException() {
|
||||
exists(Raise r |
|
||||
exists(Py::Raise r |
|
||||
r = toAst(this) and
|
||||
r.getException() = toAst(result) and
|
||||
result.getBasicBlock().dominates(this.getBasicBlock())
|
||||
@@ -827,36 +829,36 @@ class RaiseStmtNode extends ControlFlowNode {
|
||||
*/
|
||||
class NameNode extends ControlFlowNode {
|
||||
NameNode() {
|
||||
exists(Name n | py_flow_bb_node(this, n, _, _))
|
||||
exists(Py::Name n | py_flow_bb_node(this, n, _, _))
|
||||
or
|
||||
exists(PlaceHolder p | py_flow_bb_node(this, p, _, _))
|
||||
exists(Py::PlaceHolder p | py_flow_bb_node(this, p, _, _))
|
||||
}
|
||||
|
||||
/** Whether this flow node defines the variable `v`. */
|
||||
predicate defines(Variable v) {
|
||||
exists(Name d | this.getNode() = d and d.defines(v)) and
|
||||
predicate defines(Py::Variable v) {
|
||||
exists(Py::Name d | this.getNode() = d and d.defines(v)) and
|
||||
not this.isLoad()
|
||||
}
|
||||
|
||||
/** Whether this flow node deletes the variable `v`. */
|
||||
predicate deletes(Variable v) { exists(Name d | this.getNode() = d and d.deletes(v)) }
|
||||
predicate deletes(Py::Variable v) { exists(Py::Name d | this.getNode() = d and d.deletes(v)) }
|
||||
|
||||
/** Whether this flow node uses the variable `v`. */
|
||||
predicate uses(Variable v) {
|
||||
predicate uses(Py::Variable v) {
|
||||
this.isLoad() and
|
||||
exists(Name u | this.getNode() = u and u.uses(v))
|
||||
exists(Py::Name u | this.getNode() = u and u.uses(v))
|
||||
or
|
||||
exists(PlaceHolder u |
|
||||
this.getNode() = u and u.getVariable() = v and u.getCtx() instanceof Load
|
||||
exists(Py::PlaceHolder u |
|
||||
this.getNode() = u and u.getVariable() = v and u.getCtx() instanceof Py::Load
|
||||
)
|
||||
or
|
||||
Scopes::use_of_global_variable(this, v.getScope(), v.getId())
|
||||
}
|
||||
|
||||
string getId() {
|
||||
result = this.getNode().(Name).getId()
|
||||
result = this.getNode().(Py::Name).getId()
|
||||
or
|
||||
result = this.getNode().(PlaceHolder).getId()
|
||||
result = this.getNode().(Py::PlaceHolder).getId()
|
||||
}
|
||||
|
||||
/** Whether this is a use of a local variable. */
|
||||
@@ -868,82 +870,84 @@ class NameNode extends ControlFlowNode {
|
||||
/** Whether this is a use of a global (including builtin) variable. */
|
||||
predicate isGlobal() { Scopes::use_of_global_variable(this, _, _) }
|
||||
|
||||
predicate isSelf() { exists(SsaVariable selfvar | selfvar.isSelf() and selfvar.getAUse() = this) }
|
||||
predicate isSelf() {
|
||||
exists(Py::SsaVariable selfvar | selfvar.isSelf() and selfvar.getAUse() = this)
|
||||
}
|
||||
}
|
||||
|
||||
/** A control flow node corresponding to a named constant, one of `None`, `True` or `False`. */
|
||||
class NameConstantNode extends NameNode {
|
||||
NameConstantNode() { exists(NameConstant n | py_flow_bb_node(this, n, _, _)) }
|
||||
NameConstantNode() { exists(Py::NameConstant n | py_flow_bb_node(this, n, _, _)) }
|
||||
/*
|
||||
* We ought to override uses as well, but that has
|
||||
* a serious performance impact.
|
||||
* deprecated predicate uses(Variable v) { none() }
|
||||
* deprecated predicate uses(Py::Variable v) { none() }
|
||||
*/
|
||||
|
||||
}
|
||||
|
||||
/** A control flow node corresponding to a starred expression, `*a`. */
|
||||
class StarredNode extends ControlFlowNode {
|
||||
StarredNode() { toAst(this) instanceof Starred }
|
||||
StarredNode() { toAst(this) instanceof Py::Starred }
|
||||
|
||||
ControlFlowNode getValue() { toAst(result) = toAst(this).(Starred).getValue() }
|
||||
ControlFlowNode getValue() { toAst(result) = toAst(this).(Py::Starred).getValue() }
|
||||
}
|
||||
|
||||
/** The ControlFlowNode for an 'except' statement. */
|
||||
class ExceptFlowNode extends ControlFlowNode {
|
||||
ExceptFlowNode() { this.getNode() instanceof ExceptStmt }
|
||||
ExceptFlowNode() { this.getNode() instanceof Py::ExceptStmt }
|
||||
|
||||
/**
|
||||
* Gets the type handled by this exception handler.
|
||||
* `ExceptionType` in `except ExceptionType as e:`
|
||||
* `Py::ExceptionType` in `except Py::ExceptionType as e:`
|
||||
*/
|
||||
ControlFlowNode getType() {
|
||||
exists(ExceptStmt ex |
|
||||
exists(Py::ExceptStmt ex |
|
||||
this.getBasicBlock().dominates(result.getBasicBlock()) and
|
||||
ex = this.getNode() and
|
||||
result = ex.getType().getAFlowNode()
|
||||
result.getNode() = ex.getType()
|
||||
)
|
||||
}
|
||||
|
||||
/**
|
||||
* Gets the name assigned to the handled exception, if any.
|
||||
* `e` in `except ExceptionType as e:`
|
||||
* `e` in `except Py::ExceptionType as e:`
|
||||
*/
|
||||
ControlFlowNode getName() {
|
||||
exists(ExceptStmt ex |
|
||||
exists(Py::ExceptStmt ex |
|
||||
this.getBasicBlock().dominates(result.getBasicBlock()) and
|
||||
ex = this.getNode() and
|
||||
result = ex.getName().getAFlowNode()
|
||||
result.getNode() = ex.getName()
|
||||
)
|
||||
}
|
||||
}
|
||||
|
||||
/** The ControlFlowNode for an 'except*' statement. */
|
||||
class ExceptGroupFlowNode extends ControlFlowNode {
|
||||
ExceptGroupFlowNode() { this.getNode() instanceof ExceptGroupStmt }
|
||||
ExceptGroupFlowNode() { this.getNode() instanceof Py::ExceptGroupStmt }
|
||||
|
||||
/**
|
||||
* Gets the type handled by this exception handler.
|
||||
* `ExceptionType` in `except* ExceptionType as e:`
|
||||
* `Py::ExceptionType` in `except* Py::ExceptionType as e:`
|
||||
*/
|
||||
ControlFlowNode getType() {
|
||||
this.getBasicBlock().dominates(result.getBasicBlock()) and
|
||||
result = this.getNode().(ExceptGroupStmt).getType().getAFlowNode()
|
||||
result.getNode() = this.getNode().(Py::ExceptGroupStmt).getType()
|
||||
}
|
||||
|
||||
/**
|
||||
* Gets the name assigned to the handled exception, if any.
|
||||
* `e` in `except* ExceptionType as e:`
|
||||
* `e` in `except* Py::ExceptionType as e:`
|
||||
*/
|
||||
ControlFlowNode getName() {
|
||||
this.getBasicBlock().dominates(result.getBasicBlock()) and
|
||||
result = this.getNode().(ExceptGroupStmt).getName().getAFlowNode()
|
||||
result.getNode() = this.getNode().(Py::ExceptGroupStmt).getName()
|
||||
}
|
||||
}
|
||||
|
||||
private module Scopes {
|
||||
private predicate fast_local(NameNode n) {
|
||||
exists(FastLocalVariable v |
|
||||
exists(Py::FastLocalVariable v |
|
||||
n.uses(v) and
|
||||
v.getScope() = n.getScope()
|
||||
)
|
||||
@@ -952,15 +956,15 @@ private module Scopes {
|
||||
predicate local(NameNode n) {
|
||||
fast_local(n)
|
||||
or
|
||||
exists(SsaVariable var |
|
||||
exists(Py::SsaVariable var |
|
||||
var.getAUse() = n and
|
||||
n.getScope() instanceof Class and
|
||||
n.getScope() instanceof Py::Class and
|
||||
exists(var.getDefinition())
|
||||
)
|
||||
}
|
||||
|
||||
predicate non_local(NameNode n) {
|
||||
exists(FastLocalVariable flv |
|
||||
exists(Py::FastLocalVariable flv |
|
||||
flv.getALoad() = n.getNode() and
|
||||
not flv.getScope() = n.getScope()
|
||||
)
|
||||
@@ -968,20 +972,20 @@ private module Scopes {
|
||||
|
||||
// magic is fine, but we get questionable join-ordering of it
|
||||
pragma[nomagic]
|
||||
predicate use_of_global_variable(NameNode n, Module scope, string name) {
|
||||
predicate use_of_global_variable(NameNode n, Py::Module scope, string name) {
|
||||
n.isLoad() and
|
||||
not non_local(n) and
|
||||
not exists(SsaVariable var | var.getAUse() = n |
|
||||
var.getVariable() instanceof FastLocalVariable
|
||||
not exists(Py::SsaVariable var | var.getAUse() = n |
|
||||
var.getVariable() instanceof Py::FastLocalVariable
|
||||
or
|
||||
n.getScope() instanceof Class and
|
||||
n.getScope() instanceof Py::Class and
|
||||
not maybe_undefined(var)
|
||||
) and
|
||||
name = n.getId() and
|
||||
scope = n.getEnclosingModule()
|
||||
}
|
||||
|
||||
private predicate maybe_undefined(SsaVariable var) {
|
||||
private predicate maybe_undefined(Py::SsaVariable var) {
|
||||
not exists(var.getDefinition()) and not py_ssa_phi(var, _)
|
||||
or
|
||||
var.getDefinition().isDelete()
|
||||
@@ -1058,13 +1062,13 @@ class BasicBlock extends @py_flow_node {
|
||||
private predicate oneNodeBlock() { this.firstNode() = this.getLastNode() }
|
||||
|
||||
private predicate startLocationInfo(string file, int line, int col) {
|
||||
if this.firstNode().getNode() instanceof Scope
|
||||
if this.firstNode().getNode() instanceof Py::Scope
|
||||
then this.firstNode().getASuccessor().getLocation().hasLocationInfo(file, line, col, _, _)
|
||||
else this.firstNode().getLocation().hasLocationInfo(file, line, col, _, _)
|
||||
}
|
||||
|
||||
private predicate endLocationInfo(int endl, int endc) {
|
||||
if this.getLastNode().getNode() instanceof Scope and not this.oneNodeBlock()
|
||||
if this.getLastNode().getNode() instanceof Py::Scope and not this.oneNodeBlock()
|
||||
then this.getLastNode().getAPredecessor().getLocation().hasLocationInfo(_, _, _, endl, endc)
|
||||
else this.getLastNode().getLocation().hasLocationInfo(_, _, _, endl, endc)
|
||||
}
|
||||
@@ -1081,7 +1085,7 @@ class BasicBlock extends @py_flow_node {
|
||||
|
||||
/** Whether flow from this basic block reaches a normal exit from its scope */
|
||||
predicate reachesExit() {
|
||||
exists(Scope s | s.getANormalExit().getBasicBlock() = this)
|
||||
exists(Py::Scope s | s.getANormalExit().getBasicBlock() = this)
|
||||
or
|
||||
this.getASuccessor().reachesExit()
|
||||
}
|
||||
@@ -1122,7 +1126,7 @@ class BasicBlock extends @py_flow_node {
|
||||
|
||||
/** Gets the scope of this block */
|
||||
pragma[nomagic]
|
||||
Scope getScope() {
|
||||
Py::Scope getScope() {
|
||||
exists(ControlFlowNode n | n.getBasicBlock() = this |
|
||||
/* Take care not to use an entry or exit node as that node's scope will be the outer scope */
|
||||
not py_scope_flow(n, _, -1) and
|
||||
@@ -1145,17 +1149,17 @@ class BasicBlock extends @py_flow_node {
|
||||
predicate reaches(BasicBlock other) { this = other or this.strictlyReaches(other) }
|
||||
|
||||
/**
|
||||
* Gets the `ConditionBlock`, if any, that controls this block and
|
||||
* does not control any other `ConditionBlock`s that control this block.
|
||||
* That is the `ConditionBlock` that is closest dominator.
|
||||
* Gets the `Py::ConditionBlock`, if any, that controls this block and
|
||||
* does not control any other `Py::ConditionBlock`s that control this block.
|
||||
* That is the `Py::ConditionBlock` that is closest dominator.
|
||||
*/
|
||||
ConditionBlock getImmediatelyControllingBlock() {
|
||||
Py::ConditionBlock getImmediatelyControllingBlock() {
|
||||
result = this.nonControllingImmediateDominator*().getImmediateDominator()
|
||||
}
|
||||
|
||||
private BasicBlock nonControllingImmediateDominator() {
|
||||
result = this.getImmediateDominator() and
|
||||
not result.(ConditionBlock).controls(this, _)
|
||||
not result.(Py::ConditionBlock).controls(this, _)
|
||||
}
|
||||
|
||||
/**
|
||||
@@ -1175,7 +1179,7 @@ private class ControlFlowNodeAlias = ControlFlowNode;
|
||||
|
||||
final private class FinalBasicBlock = BasicBlock;
|
||||
|
||||
module Cfg implements BB::CfgSig<Location> {
|
||||
module Cfg implements BB::CfgSig<Py::Location> {
|
||||
private import codeql.controlflow.SuccessorType
|
||||
|
||||
class ControlFlowNode = ControlFlowNodeAlias;
|
||||
@@ -1186,7 +1190,7 @@ module Cfg implements BB::CfgSig<Location> {
|
||||
// Using the location of the first node is simple
|
||||
// and we just need a way to identify the basic block
|
||||
// during debugging, so this will be serviceable.
|
||||
Location getLocation() { result = super.getNode(0).getLocation() }
|
||||
Py::Location getLocation() { result = super.getNode(0).getLocation() }
|
||||
|
||||
int length() { result = count(int i | exists(this.getNode(i))) }
|
||||
|
||||
|
||||
@@ -2,6 +2,7 @@ overlay[local]
|
||||
module;
|
||||
|
||||
import python
|
||||
private import semmle.python.controlflow.internal.Cfg as Cfg
|
||||
|
||||
/**
|
||||
* A function, independent of defaults and binding.
|
||||
@@ -153,8 +154,16 @@ class Function extends Function_, Scope, AstNode {
|
||||
|
||||
override predicate contains(AstNode inner) { Scope.super.contains(inner) }
|
||||
|
||||
/** Gets a control flow node for a return value of this function */
|
||||
ControlFlowNode getAReturnValueFlowNode() {
|
||||
/**
|
||||
* DEPRECATED: bind a `Return` node explicitly instead, e.g.
|
||||
* `exists(Return ret | ret.getScope() = this and n.getNode() = ret.getValue())`.
|
||||
* This API is being phased out together with `AstNode.getAFlowNode()` to
|
||||
* untangle the AST and CFG hierarchies.
|
||||
*
|
||||
* Gets a control flow node for a return value of this function, from the
|
||||
* new (shared) CFG.
|
||||
*/
|
||||
deprecated Cfg::ControlFlowNode getAReturnValueFlowNode() {
|
||||
exists(Return ret |
|
||||
ret.getScope() = this and
|
||||
ret.getValue() = result.getNode()
|
||||
|
||||
@@ -162,8 +162,6 @@ class ImportMember extends ImportMember_ {
|
||||
string getImportedModuleName() {
|
||||
result = this.getModule().(ImportExpr).getImportedModuleName() + "." + this.getName()
|
||||
}
|
||||
|
||||
override ImportMemberNode getAFlowNode() { result = super.getAFlowNode() }
|
||||
}
|
||||
|
||||
/** An import statement */
|
||||
|
||||
@@ -46,20 +46,23 @@ class SelfAttributeRead extends SelfAttribute {
|
||||
}
|
||||
|
||||
predicate guardedByHasattr() {
|
||||
exists(Variable var, ControlFlowNode n |
|
||||
var.getAUse() = this.getObject().getAFlowNode() and
|
||||
exists(Variable var, ControlFlowNode n, ControlFlowNode this_, ControlFlowNode obj_ |
|
||||
this_.getNode() = this and obj_.getNode() = this.getObject()
|
||||
|
|
||||
var.getAUse() = obj_ and
|
||||
hasattr(n, var.getAUse(), this.getName()) and
|
||||
n.strictlyDominates(this.getAFlowNode())
|
||||
n.strictlyDominates(this_)
|
||||
)
|
||||
}
|
||||
|
||||
pragma[noinline]
|
||||
predicate locallyDefined() {
|
||||
exists(SelfAttributeStore store |
|
||||
this.getName() = store.getName() and
|
||||
this.getScope() = store.getScope()
|
||||
exists(SelfAttributeStore store, ControlFlowNode store_, ControlFlowNode this_ |
|
||||
store_.getNode() = store and this_.getNode() = this
|
||||
|
|
||||
store.getAFlowNode().strictlyDominates(this.getAFlowNode())
|
||||
this.getName() = store.getName() and
|
||||
this.getScope() = store.getScope() and
|
||||
store_.strictlyDominates(this_)
|
||||
)
|
||||
}
|
||||
}
|
||||
|
||||
1688
python/ql/lib/semmle/python/controlflow/internal/AstNodeImpl.qll
Normal file
1688
python/ql/lib/semmle/python/controlflow/internal/AstNodeImpl.qll
Normal file
File diff suppressed because it is too large
Load Diff
1163
python/ql/lib/semmle/python/controlflow/internal/Cfg.qll
Normal file
1163
python/ql/lib/semmle/python/controlflow/internal/Cfg.qll
Normal file
File diff suppressed because it is too large
Load Diff
@@ -1,36 +1,43 @@
|
||||
/** Provides commonly used BarrierGuards. */
|
||||
|
||||
private import python
|
||||
private import semmle.python.controlflow.internal.Cfg as Cfg
|
||||
private import semmle.python.dataflow.new.DataFlow
|
||||
|
||||
private predicate constCompare(DataFlow::GuardNode g, ControlFlowNode node, boolean branch) {
|
||||
exists(CompareNode cn | cn = g |
|
||||
exists(ImmutableLiteral const, Cmpop op |
|
||||
op = any(Eq eq) and branch = true
|
||||
or
|
||||
op = any(NotEq ne) and branch = false
|
||||
private predicate constCompare(DataFlow::GuardNode g, Cfg::ControlFlowNode node, boolean branch) {
|
||||
exists(Cfg::CompareNode cn | cn = g |
|
||||
exists(ImmutableLiteral const, Cmpop op, Cfg::ControlFlowNode c |
|
||||
c.getNode() = const and
|
||||
(
|
||||
op = any(Eq eq) and branch = true
|
||||
or
|
||||
op = any(NotEq ne) and branch = false
|
||||
)
|
||||
|
|
||||
cn.operands(const.getAFlowNode(), op, node)
|
||||
cn.operands(c, op, node)
|
||||
or
|
||||
cn.operands(node, op, const.getAFlowNode())
|
||||
cn.operands(node, op, c)
|
||||
)
|
||||
or
|
||||
exists(NameConstant const, Cmpop op |
|
||||
op = any(Is is_) and branch = true
|
||||
or
|
||||
op = any(IsNot isn) and branch = false
|
||||
exists(NameConstant const, Cmpop op, Cfg::ControlFlowNode c |
|
||||
c.getNode() = const and
|
||||
(
|
||||
op = any(Is is_) and branch = true
|
||||
or
|
||||
op = any(IsNot isn) and branch = false
|
||||
)
|
||||
|
|
||||
cn.operands(const.getAFlowNode(), op, node)
|
||||
cn.operands(c, op, node)
|
||||
or
|
||||
cn.operands(node, op, const.getAFlowNode())
|
||||
cn.operands(node, op, c)
|
||||
)
|
||||
or
|
||||
exists(IterableNode const_iterable, Cmpop op |
|
||||
exists(Cfg::IterableNode const_iterable, Cmpop op |
|
||||
op = any(In in_) and branch = true
|
||||
or
|
||||
op = any(NotIn ni) and branch = false
|
||||
|
|
||||
forall(ControlFlowNode elem | elem = const_iterable.getAnElement() |
|
||||
forall(Cfg::ControlFlowNode elem | elem = const_iterable.getAnElement() |
|
||||
elem.getNode() instanceof ImmutableLiteral
|
||||
) and
|
||||
cn.operands(node, op, const_iterable)
|
||||
|
||||
@@ -4,6 +4,7 @@
|
||||
*/
|
||||
|
||||
private import python
|
||||
private import semmle.python.controlflow.internal.Cfg as Cfg
|
||||
private import semmle.python.dataflow.new.DataFlow
|
||||
// Need to import `semmle.python.Frameworks` since frameworks can extend `SensitiveDataSource::Range`
|
||||
private import semmle.python.Frameworks
|
||||
@@ -105,7 +106,7 @@ private module SensitiveDataModeling {
|
||||
or
|
||||
// to cover functions that we don't have the definition for, and where the
|
||||
// reference to the function has not already been marked as being sensitive
|
||||
this.getFunction().asCfgNode().(NameNode).getId() = sensitiveString(classification)
|
||||
this.getFunction().asCfgNode().(Cfg::NameNode).getId() = sensitiveString(classification)
|
||||
}
|
||||
|
||||
override SensitiveDataClassification getClassification() { result = classification }
|
||||
@@ -251,12 +252,12 @@ private module SensitiveDataModeling {
|
||||
SensitiveDataClassification classification;
|
||||
|
||||
SensitiveVariableAssignment() {
|
||||
exists(DefinitionNode def |
|
||||
def.(NameNode).getId() = sensitiveString(classification) and
|
||||
exists(Cfg::DefinitionNode def |
|
||||
def.(Cfg::NameNode).getId() = sensitiveString(classification) and
|
||||
(
|
||||
this.asCfgNode() = def.getValue()
|
||||
or
|
||||
this.asCfgNode() = def.getValue().(ForNode).getSequence()
|
||||
this.asCfgNode() = def.getValue().(Cfg::ForNode).getSequence()
|
||||
) and
|
||||
not this.asExpr() instanceof FunctionExpr and
|
||||
not this.asExpr() instanceof ClassExpr
|
||||
@@ -293,7 +294,7 @@ private module SensitiveDataModeling {
|
||||
SensitiveDataClassification classification;
|
||||
|
||||
SensitiveSubscript() {
|
||||
this.asCfgNode().(SubscriptNode).getIndex() =
|
||||
this.asCfgNode().(Cfg::SubscriptNode).getIndex() =
|
||||
sensitiveLookupStringConst(classification).asCfgNode()
|
||||
}
|
||||
|
||||
|
||||
@@ -3,6 +3,7 @@ overlay[local]
|
||||
module;
|
||||
|
||||
private import python
|
||||
private import semmle.python.controlflow.internal.Cfg as Cfg
|
||||
import DataFlowUtil
|
||||
import DataFlowPublic
|
||||
private import DataFlowPrivate
|
||||
@@ -83,9 +84,9 @@ abstract class AttrWrite extends AttrRef {
|
||||
* ```python
|
||||
* object.attr = value
|
||||
* ```
|
||||
* Also gives access to the `value` being written, by extending `DefinitionNode`.
|
||||
* Also gives access to the `value` being written, by extending `Cfg::DefinitionNode`.
|
||||
*/
|
||||
private class AttributeAssignmentNode extends DefinitionNode, AttrNode { }
|
||||
private class AttributeAssignmentNode extends Cfg::DefinitionNode, Cfg::AttrNode { }
|
||||
|
||||
/** A simple attribute assignment: `object.attr = value`. */
|
||||
private class AttributeAssignmentAsAttrWrite extends AttrWrite, CfgNode {
|
||||
@@ -131,13 +132,13 @@ private class GlobalAttributeAssignmentAsAttrWrite extends AttrWrite, CfgNode {
|
||||
override string getAttributeName() { result = node.getName() }
|
||||
}
|
||||
|
||||
/** Represents `CallNode`s that may refer to calls to built-in functions or classes. */
|
||||
private class BuiltInCallNode extends CallNode {
|
||||
/** Represents `Cfg::CallNode`s that may refer to calls to built-in functions or classes. */
|
||||
private class BuiltInCallNode extends Cfg::CallNode {
|
||||
string name;
|
||||
|
||||
BuiltInCallNode() {
|
||||
// TODO disallow instances where the name of the built-in may refer to an in-scope variable of that name.
|
||||
exists(NameNode id |
|
||||
exists(Cfg::NameNode id |
|
||||
name = Builtins::getBuiltinName() and
|
||||
this.getFunction() = id and
|
||||
id.getId() = name and
|
||||
@@ -145,7 +146,7 @@ private class BuiltInCallNode extends CallNode {
|
||||
)
|
||||
}
|
||||
|
||||
/** Gets the name of the built-in function that is called at this `CallNode` */
|
||||
/** Gets the name of the built-in function that is called at this `Cfg::CallNode` */
|
||||
string getBuiltinName() { result = name }
|
||||
}
|
||||
|
||||
@@ -157,20 +158,20 @@ private class BuiltinAttrCallNode extends BuiltInCallNode {
|
||||
BuiltinAttrCallNode() { name in ["setattr", "getattr", "hasattr", "delattr"] }
|
||||
|
||||
/** Gets the control flow node for object on which the attribute is accessed. */
|
||||
ControlFlowNode getObject() { result in [this.getArg(0), this.getArgByName("object")] }
|
||||
Cfg::ControlFlowNode getObject() { result in [this.getArg(0), this.getArgByName("object")] }
|
||||
|
||||
/**
|
||||
* Gets the control flow node for the value that is being written to the attribute.
|
||||
* Only relevant for `setattr` calls.
|
||||
*/
|
||||
ControlFlowNode getValue() {
|
||||
Cfg::ControlFlowNode getValue() {
|
||||
// only valid for `setattr`
|
||||
name = "setattr" and
|
||||
result in [this.getArg(2), this.getArgByName("value")]
|
||||
}
|
||||
|
||||
/** Gets the control flow node that defines the name of the attribute being accessed. */
|
||||
ControlFlowNode getName() { result in [this.getArg(1), this.getArgByName("name")] }
|
||||
Cfg::ControlFlowNode getName() { result in [this.getArg(1), this.getArgByName("name")] }
|
||||
}
|
||||
|
||||
/** Represents calls to the built-in `setattr`. */
|
||||
@@ -205,10 +206,10 @@ private class SetAttrCallAsAttrWrite extends AttrWrite, CfgNode {
|
||||
* attr = value
|
||||
* ...
|
||||
* ```
|
||||
* Instances of this class correspond to the `NameNode` for `attr`, and also gives access to `value` by
|
||||
* virtue of being a `DefinitionNode`.
|
||||
* Instances of this class correspond to the `Cfg::NameNode` for `attr`, and also gives access to `value` by
|
||||
* virtue of being a `Cfg::DefinitionNode`.
|
||||
*/
|
||||
private class ClassAttributeAssignmentNode extends DefinitionNode, NameNode {
|
||||
private class ClassAttributeAssignmentNode extends Cfg::DefinitionNode, Cfg::NameNode {
|
||||
ClassAttributeAssignmentNode() { this.getScope() = any(ClassExpr c).getInnerScope() }
|
||||
}
|
||||
|
||||
@@ -228,7 +229,7 @@ private class ClassDefinitionAsAttrWrite extends AttrWrite, CfgNode {
|
||||
|
||||
override Node getValue() { result.asCfgNode() = node.getValue() }
|
||||
|
||||
override Node getObject() { result.asCfgNode() = cls.getAFlowNode() }
|
||||
override Node getObject() { result.asCfgNode().getNode() = cls }
|
||||
|
||||
override ExprNode getAttributeNameExpr() { none() }
|
||||
|
||||
@@ -248,7 +249,7 @@ abstract class AttrRead extends AttrRef, Node, LocalSourceNode {
|
||||
|
||||
/** A simple attribute read, e.g. `object.attr` */
|
||||
private class AttributeReadAsAttrRead extends AttrRead, CfgNode {
|
||||
override AttrNode node;
|
||||
override Cfg::AttrNode node;
|
||||
|
||||
AttributeReadAsAttrRead() { node.isLoad() }
|
||||
|
||||
@@ -285,7 +286,7 @@ private class GetAttrCallAsAttrRead extends AttrRead, CfgNode {
|
||||
* is treated as if it is a read of the attribute `module.attr`, even if `module` is not imported directly.
|
||||
*/
|
||||
private class ModuleAttributeImportAsAttrRead extends AttrRead, CfgNode {
|
||||
override ImportMemberNode node;
|
||||
override Cfg::ImportMemberNode node;
|
||||
|
||||
override Node getObject() { result.asCfgNode() = node.getModule(_) }
|
||||
|
||||
|
||||
@@ -3,6 +3,7 @@ overlay[local]
|
||||
module;
|
||||
|
||||
private import python
|
||||
private import semmle.python.controlflow.internal.Cfg as Cfg
|
||||
private import semmle.python.dataflow.new.DataFlow
|
||||
private import semmle.python.dataflow.new.internal.ImportStar
|
||||
|
||||
@@ -67,7 +68,7 @@ module Builtins {
|
||||
DataFlow::CfgNode likelyBuiltin(string name) {
|
||||
exists(Module m |
|
||||
result.getNode() =
|
||||
any(NameNode n |
|
||||
any(Cfg::NameNode n |
|
||||
possible_builtin_accessed_in_module(n, name, m) and
|
||||
not possible_builtin_defined_in_module(name, m)
|
||||
)
|
||||
@@ -87,7 +88,7 @@ module Builtins {
|
||||
* Holds if `n` is an access of a global variable called `name` (which is also the name of a
|
||||
* built-in) inside the module `m`.
|
||||
*/
|
||||
private predicate possible_builtin_accessed_in_module(NameNode n, string name, Module m) {
|
||||
private predicate possible_builtin_accessed_in_module(Cfg::NameNode n, string name, Module m) {
|
||||
n.isGlobal() and
|
||||
n.isLoad() and
|
||||
name = n.getId() and
|
||||
|
||||
@@ -25,7 +25,7 @@
|
||||
* what callable this call might end up targeting.
|
||||
*
|
||||
* Specifically this means that we cannot use type-backtrackers from the function of a
|
||||
* `CallNode`, since there is no `CallNode` to backtrack from for `func` in the example
|
||||
* `Cfg::CallNode`, since there is no `Cfg::CallNode` to backtrack from for `func` in the example
|
||||
* above.
|
||||
*
|
||||
* Note: This hasn't been 100% realized yet, so we don't currently expose a predicate to
|
||||
@@ -35,6 +35,7 @@ overlay[local?]
|
||||
module;
|
||||
|
||||
private import python
|
||||
private import semmle.python.controlflow.internal.Cfg as Cfg
|
||||
private import DataFlowPublic
|
||||
private import DataFlowPrivate
|
||||
private import FlowSummaryImpl as FlowSummaryImpl
|
||||
@@ -162,7 +163,7 @@ newtype TArgumentPosition =
|
||||
*/
|
||||
TLambdaSelfArgumentPosition() or
|
||||
TPositionalArgumentPosition(int index) {
|
||||
exists(any(CallNode c).getArg(index))
|
||||
exists(any(Cfg::CallNode c).getArg(index))
|
||||
or
|
||||
// since synthetic calls within a summarized callable could use a unique argument
|
||||
// position, we need to ensure we make these available (these are specified as
|
||||
@@ -174,7 +175,7 @@ newtype TArgumentPosition =
|
||||
index = 0
|
||||
} or
|
||||
TKeywordArgumentPosition(string name) {
|
||||
exists(any(CallNode c).getArgByName(name))
|
||||
exists(any(Cfg::CallNode c).getArgByName(name))
|
||||
or
|
||||
// see comment for TPositionalArgumentPosition
|
||||
FlowSummaryImpl::ParsePositions::isParsedKeywordParameterPosition(_, name)
|
||||
@@ -256,9 +257,12 @@ predicate parameterMatch(ParameterPosition ppos, ArgumentPosition apos) {
|
||||
*/
|
||||
overlay[local]
|
||||
predicate isStaticmethod(Function func) {
|
||||
exists(NameNode id | id.getId() = "staticmethod" and id.isGlobal() |
|
||||
func.getADecorator() = id.getNode()
|
||||
)
|
||||
// The decorator is *syntactically* a `Name` "staticmethod" — we don't
|
||||
// care which variable it resolves to. `staticmethod` is a builtin and
|
||||
// is almost never shadowed in a module-level scope; even if a class
|
||||
// redefines `staticmethod` in its body, the class body has not started
|
||||
// executing yet at the decorator position, so Python uses the builtin.
|
||||
func.getADecorator().(Name).getId() = "staticmethod"
|
||||
}
|
||||
|
||||
/**
|
||||
@@ -268,9 +272,9 @@ predicate isStaticmethod(Function func) {
|
||||
*/
|
||||
overlay[local]
|
||||
predicate isClassmethod(Function func) {
|
||||
exists(NameNode id | id.getId() = "classmethod" and id.isGlobal() |
|
||||
func.getADecorator() = id.getNode()
|
||||
)
|
||||
// See `isStaticmethod` for the rationale for matching on the AST `Name`
|
||||
// rather than going via the CFG and `isGlobal()`.
|
||||
func.getADecorator().(Name).getId() = "classmethod"
|
||||
or
|
||||
exists(Class cls |
|
||||
cls.getAMethod() = func and
|
||||
@@ -285,9 +289,8 @@ predicate isClassmethod(Function func) {
|
||||
/** Holds if the function `func` has a `property` decorator. */
|
||||
overlay[local]
|
||||
predicate hasPropertyDecorator(Function func) {
|
||||
exists(NameNode id | id.getId() = "property" and id.isGlobal() |
|
||||
func.getADecorator() = id.getNode()
|
||||
)
|
||||
// See `isStaticmethod` for the rationale for matching on the AST `Name`.
|
||||
func.getADecorator().(Name).getId() = "property"
|
||||
}
|
||||
|
||||
/**
|
||||
@@ -295,10 +298,12 @@ predicate hasPropertyDecorator(Function func) {
|
||||
*/
|
||||
overlay[local]
|
||||
predicate hasContextmanagerDecorator(Function func) {
|
||||
exists(ControlFlowNode contextmanager |
|
||||
contextmanager.(NameNode).getId() = "contextmanager" and contextmanager.(NameNode).isGlobal()
|
||||
exists(Cfg::ControlFlowNode contextmanager |
|
||||
contextmanager.(Cfg::NameNode).getId() = "contextmanager" and
|
||||
contextmanager.(Cfg::NameNode).isGlobal()
|
||||
or
|
||||
contextmanager.(AttrNode).getObject("contextmanager").(NameNode).getId() = "contextlib"
|
||||
contextmanager.(Cfg::AttrNode).getObject("contextmanager").(Cfg::NameNode).getId() =
|
||||
"contextlib"
|
||||
|
|
||||
func.getADecorator() = contextmanager.getNode()
|
||||
)
|
||||
@@ -314,10 +319,10 @@ predicate hasContextmanagerDecorator(Function func) {
|
||||
*/
|
||||
overlay[local]
|
||||
private predicate hasOverloadDecorator(Function func) {
|
||||
exists(ControlFlowNode overload |
|
||||
overload.(NameNode).getId() = "overload" and overload.(NameNode).isGlobal()
|
||||
exists(Cfg::ControlFlowNode overload |
|
||||
overload.(Cfg::NameNode).getId() = "overload" and overload.(Cfg::NameNode).isGlobal()
|
||||
or
|
||||
overload.(AttrNode).getObject("overload").(NameNode).isGlobal()
|
||||
overload.(Cfg::AttrNode).getObject("overload").(Cfg::NameNode).isGlobal()
|
||||
|
|
||||
func.getADecorator() = overload.getNode()
|
||||
)
|
||||
@@ -536,7 +541,7 @@ class LibraryCallableValue extends DataFlowCallable, TLibraryCallable {
|
||||
// =============================================================================
|
||||
/** Gets a call to `type`. */
|
||||
private CallCfgNode getTypeCall() {
|
||||
exists(NameNode id | id.getId() = "type" and id.isGlobal() |
|
||||
exists(Cfg::NameNode id | id.getId() = "type" and id.isGlobal() |
|
||||
result.getFunction().asCfgNode() = id
|
||||
)
|
||||
}
|
||||
@@ -548,7 +553,7 @@ private CallCfgNode getSuperCall() {
|
||||
// link below), but otherwise only 2 edgecases. Overall it seems ok to ignore this complexity.
|
||||
//
|
||||
// https://github.com/python/cpython/blob/18b1782192f85bd26db89f5bc850f8bee4247c1a/Lib/unittest/mock.py#L48-L50
|
||||
exists(NameNode id | id.getId() = "super" and id.isGlobal() |
|
||||
exists(Cfg::NameNode id | id.getId() = "super" and id.isGlobal() |
|
||||
result.getFunction().asCfgNode() = id
|
||||
)
|
||||
}
|
||||
@@ -1034,7 +1039,7 @@ private module MethodCalls {
|
||||
*/
|
||||
pragma[nomagic]
|
||||
private predicate directCall(
|
||||
CallNode call, Function target, string functionName, Class cls, AttrRead attr, Node self
|
||||
Cfg::CallNode call, Function target, string functionName, Class cls, AttrRead attr, Node self
|
||||
) {
|
||||
target = findFunctionAccordingToMroKnownStartingClass(cls, functionName) and
|
||||
directCall_join(call, functionName, cls, attr, self)
|
||||
@@ -1043,7 +1048,7 @@ private module MethodCalls {
|
||||
/** Extracted to give good join order */
|
||||
pragma[nomagic]
|
||||
private predicate directCall_join(
|
||||
CallNode call, string functionName, Class cls, AttrRead attr, Node self
|
||||
Cfg::CallNode call, string functionName, Class cls, AttrRead attr, Node self
|
||||
) {
|
||||
call.getFunction() = attrReadTracker(attr).asCfgNode() and
|
||||
attr.accesses(self, functionName) and
|
||||
@@ -1060,7 +1065,7 @@ private module MethodCalls {
|
||||
*/
|
||||
pragma[nomagic]
|
||||
private predicate callWithinMethodImplicitSelfOrCls(
|
||||
CallNode call, Function target, string functionName, Class classWithMethod, AttrRead attr,
|
||||
Cfg::CallNode call, Function target, string functionName, Class classWithMethod, AttrRead attr,
|
||||
Node self
|
||||
) {
|
||||
target = findFunctionAccordingToMro(getADirectSubclass*(classWithMethod), functionName) and
|
||||
@@ -1070,7 +1075,7 @@ private module MethodCalls {
|
||||
/** Extracted to give good join order */
|
||||
pragma[nomagic]
|
||||
private predicate callWithinMethodImplicitSelfOrCls_join(
|
||||
CallNode call, string functionName, Class classWithMethod, AttrRead attr, Node self
|
||||
Cfg::CallNode call, string functionName, Class classWithMethod, AttrRead attr, Node self
|
||||
) {
|
||||
call.getFunction() = attrReadTracker(attr).asCfgNode() and
|
||||
attr.accesses(self, functionName) and
|
||||
@@ -1082,7 +1087,7 @@ private module MethodCalls {
|
||||
* resolve the call to a known target (since the only super class might be the
|
||||
* builtin `object`, so we never have the implementation of `__new__` in the DB).
|
||||
*/
|
||||
predicate fromSuperNewCall(CallNode call, Class classUsedInSuper, AttrRead attr, Node self) {
|
||||
predicate fromSuperNewCall(Cfg::CallNode call, Class classUsedInSuper, AttrRead attr, Node self) {
|
||||
fromSuper_join(call, "__new__", classUsedInSuper, attr, self) and
|
||||
self in [classTracker(_), clsArgumentTracker(_)]
|
||||
}
|
||||
@@ -1104,7 +1109,7 @@ private module MethodCalls {
|
||||
*/
|
||||
pragma[nomagic]
|
||||
predicate fromSuper(
|
||||
CallNode call, Function target, string functionName, Class classUsedInSuper, AttrRead attr,
|
||||
Cfg::CallNode call, Function target, string functionName, Class classUsedInSuper, AttrRead attr,
|
||||
Node self
|
||||
) {
|
||||
target = findFunctionAccordingToMro(getNextClassInMro(classUsedInSuper), functionName) and
|
||||
@@ -1114,7 +1119,7 @@ private module MethodCalls {
|
||||
/** Extracted to give good join order */
|
||||
pragma[nomagic]
|
||||
private predicate fromSuper_join(
|
||||
CallNode call, string functionName, Class classUsedInSuper, AttrRead attr, Node self
|
||||
Cfg::CallNode call, string functionName, Class classUsedInSuper, AttrRead attr, Node self
|
||||
) {
|
||||
call.getFunction() = attrReadTracker(attr).asCfgNode() and
|
||||
(
|
||||
@@ -1133,7 +1138,7 @@ private module MethodCalls {
|
||||
)
|
||||
}
|
||||
|
||||
predicate resolveMethodCall(CallNode call, Function target, CallType type, Node self) {
|
||||
predicate resolveMethodCall(Cfg::CallNode call, Function target, CallType type, Node self) {
|
||||
(
|
||||
directCall(call, target, _, _, _, self)
|
||||
or
|
||||
@@ -1180,7 +1185,7 @@ import MethodCalls
|
||||
* NOTE: We have this predicate mostly to be able to compare with old point-to
|
||||
* call-graph resolution. So it could be removed in the future.
|
||||
*/
|
||||
predicate resolveClassCall(CallNode call, Class cls) {
|
||||
predicate resolveClassCall(Cfg::CallNode call, Class cls) {
|
||||
call.getFunction() = classTracker(cls).asCfgNode()
|
||||
or
|
||||
// `cls()` inside a classmethod (which also contains `type(self)()` inside a method)
|
||||
@@ -1210,7 +1215,7 @@ Function invokedFunctionFromClassConstruction(Class cls, string funcName) {
|
||||
*
|
||||
* See https://docs.python.org/3/reference/datamodel.html#object.__call__
|
||||
*/
|
||||
predicate resolveClassInstanceCall(CallNode call, Function target, Node self) {
|
||||
predicate resolveClassInstanceCall(Cfg::CallNode call, Function target, Node self) {
|
||||
exists(Class cls |
|
||||
call.getFunction() = classInstanceTracker(cls).asCfgNode() and
|
||||
target = findFunctionAccordingToMroKnownStartingClass(cls, "__call__")
|
||||
@@ -1229,7 +1234,7 @@ predicate resolveClassInstanceCall(CallNode call, Function target, Node self) {
|
||||
* Holds if `call` is a call to the `target`, with call-type `type`.
|
||||
*/
|
||||
cached
|
||||
predicate resolveCall(CallNode call, Function target, CallType type) {
|
||||
predicate resolveCall(Cfg::CallNode call, Function target, CallType type) {
|
||||
Stages::DataFlow::ref() and
|
||||
(
|
||||
type instanceof CallTypePlainFunction and
|
||||
@@ -1254,11 +1259,11 @@ predicate resolveCall(CallNode call, Function target, CallType type) {
|
||||
// =============================================================================
|
||||
/**
|
||||
* Holds if the argument of `call` at position `apos` is `arg`. This is just a helper
|
||||
* predicate that maps ArgumentPositions to the arguments of the underlying `CallNode`.
|
||||
* predicate that maps ArgumentPositions to the arguments of the underlying `Cfg::CallNode`.
|
||||
*/
|
||||
overlay[local]
|
||||
cached
|
||||
predicate normalCallArg(CallNode call, Node arg, ArgumentPosition apos) {
|
||||
predicate normalCallArg(Cfg::CallNode call, Node arg, ArgumentPosition apos) {
|
||||
exists(int index |
|
||||
apos.isPositional(index) and
|
||||
arg.asCfgNode() = call.getArg(index)
|
||||
@@ -1273,7 +1278,7 @@ predicate normalCallArg(CallNode call, Node arg, ArgumentPosition apos) {
|
||||
exists(int index |
|
||||
apos.isStarArgs(index) and
|
||||
arg.asCfgNode() = call.getStarArg() and
|
||||
// since `CallNode.getArg` doesn't include `*args`, we need to drop to the AST level
|
||||
// since `Cfg::CallNode.getArg` doesn't include `*args`, we need to drop to the AST level
|
||||
// to get the index. Notice that we only use the AST for getting the index, so we
|
||||
// don't need to check for dominance in regards to splitting.
|
||||
call.getStarArg().getNode() = call.getNode().getPositionalArg(index).(Starred).getValue()
|
||||
@@ -1347,7 +1352,9 @@ predicate normalCallArg(CallNode call, Node arg, ArgumentPosition apos) {
|
||||
* translated into `l.clear()`, and we can still have use-use flow.
|
||||
*/
|
||||
cached
|
||||
predicate getCallArg(CallNode call, Function target, CallType type, Node arg, ArgumentPosition apos) {
|
||||
predicate getCallArg(
|
||||
Cfg::CallNode call, Function target, CallType type, Node arg, ArgumentPosition apos
|
||||
) {
|
||||
Stages::DataFlow::ref() and
|
||||
resolveCall(call, target, type) and
|
||||
(
|
||||
@@ -1440,10 +1447,13 @@ private predicate sameEnclosingCallable(Node node1, Node node2) {
|
||||
// DataFlowCall
|
||||
// =============================================================================
|
||||
newtype TDataFlowCall =
|
||||
TNormalCall(CallNode call, Function target, CallType type) { resolveCall(call, target, type) } or
|
||||
TNormalCall(Cfg::CallNode call, Function target, CallType type) {
|
||||
resolveCall(call, target, type) and
|
||||
Cfg::isCanonicalAstNodeRepresentative(call)
|
||||
} or
|
||||
/** A call to the generated function inside a comprehension */
|
||||
TComprehensionCall(Comp c) or
|
||||
TPotentialLibraryCall(CallNode call) or
|
||||
TPotentialLibraryCall(Cfg::CallNode call) { Cfg::isCanonicalAstNodeRepresentative(call) } or
|
||||
/** A synthesized call inside a summarized callable */
|
||||
TSummaryCall(
|
||||
FlowSummaryImpl::Public::SummarizedCallable c, FlowSummaryImpl::Private::SummaryNode receiver
|
||||
@@ -1463,7 +1473,7 @@ abstract class DataFlowCall extends TDataFlowCall {
|
||||
abstract ArgumentNode getArgument(ArgumentPosition apos);
|
||||
|
||||
/** Get the control flow node representing this call, if any. */
|
||||
abstract ControlFlowNode getNode();
|
||||
abstract Cfg::ControlFlowNode getNode();
|
||||
|
||||
/** Gets the enclosing callable of this call. */
|
||||
DataFlowCallable getEnclosingCallable() { result = getCallableScope(this.getScope()) }
|
||||
@@ -1494,28 +1504,28 @@ abstract class ExtractedDataFlowCall extends DataFlowCall {
|
||||
}
|
||||
|
||||
/**
|
||||
* A resolved call in source code with an underlying `CallNode`.
|
||||
* A resolved call in source code with an underlying `Cfg::CallNode`.
|
||||
*
|
||||
* This is considered normal, compared with special calls such as `obj[0]` calling the
|
||||
* `__getitem__` method on the object. However, this also includes calls that go to the
|
||||
* `__call__` special method.
|
||||
*/
|
||||
class NormalCall extends ExtractedDataFlowCall, TNormalCall {
|
||||
CallNode call;
|
||||
Cfg::CallNode call;
|
||||
Function target;
|
||||
CallType type;
|
||||
|
||||
NormalCall() { this = TNormalCall(call, target, type) }
|
||||
|
||||
override string toString() {
|
||||
// note: if we used toString directly on the CallNode we would get
|
||||
// `ControlFlowNode for func()`
|
||||
// but the `ControlFlowNode` part is just clutter, so we go directly to the AST node
|
||||
// note: if we used toString directly on the Cfg::CallNode we would get
|
||||
// `Cfg::ControlFlowNode for func()`
|
||||
// but the `Cfg::ControlFlowNode` part is just clutter, so we go directly to the AST node
|
||||
// instead.
|
||||
result = call.getNode().toString()
|
||||
}
|
||||
|
||||
override ControlFlowNode getNode() { result = call }
|
||||
override Cfg::ControlFlowNode getNode() { result = call }
|
||||
|
||||
override Scope getScope() { result = call.getScope() }
|
||||
|
||||
@@ -1543,7 +1553,7 @@ class ComprehensionCall extends ExtractedDataFlowCall, TComprehensionCall {
|
||||
|
||||
override string toString() { result = "comprehension call" }
|
||||
|
||||
override ControlFlowNode getNode() { result.getNode() = c }
|
||||
override Cfg::ControlFlowNode getNode() { result.getNode() = c }
|
||||
|
||||
override Scope getScope() { result = c.getScope() }
|
||||
|
||||
@@ -1566,14 +1576,14 @@ class ComprehensionCall extends ExtractedDataFlowCall, TComprehensionCall {
|
||||
* in this class.
|
||||
*/
|
||||
class PotentialLibraryCall extends ExtractedDataFlowCall, TPotentialLibraryCall {
|
||||
CallNode call;
|
||||
Cfg::CallNode call;
|
||||
|
||||
PotentialLibraryCall() { this = TPotentialLibraryCall(call) }
|
||||
|
||||
override string toString() {
|
||||
// note: if we used toString directly on the CallNode we would get
|
||||
// `ControlFlowNode for func()`
|
||||
// but the `ControlFlowNode` part is just clutter, so we go directly to the AST node
|
||||
// note: if we used toString directly on the Cfg::CallNode we would get
|
||||
// `Cfg::ControlFlowNode for func()`
|
||||
// but the `Cfg::ControlFlowNode` part is just clutter, so we go directly to the AST node
|
||||
// instead.
|
||||
result = call.getNode().toString()
|
||||
}
|
||||
@@ -1590,10 +1600,10 @@ class PotentialLibraryCall extends ExtractedDataFlowCall, TPotentialLibraryCall
|
||||
// potential self argument, from `foo.bar()` -- note that this could also just be a
|
||||
// module reference, but we really don't have a good way of knowing :|
|
||||
apos.isSelf() and
|
||||
result.asCfgNode() = call.getFunction().(AttrNode).getObject()
|
||||
result.asCfgNode() = call.getFunction().(Cfg::AttrNode).getObject()
|
||||
}
|
||||
|
||||
override ControlFlowNode getNode() { result = call }
|
||||
override Cfg::ControlFlowNode getNode() { result = call }
|
||||
|
||||
override Scope getScope() { result = call.getScope() }
|
||||
}
|
||||
@@ -1625,7 +1635,7 @@ class SummaryCall extends DataFlowCall, TSummaryCall {
|
||||
|
||||
override ArgumentNode getArgument(ArgumentPosition apos) { none() }
|
||||
|
||||
override ControlFlowNode getNode() { none() }
|
||||
override Cfg::ControlFlowNode getNode() { none() }
|
||||
|
||||
override string toString() { result = "[summary] call to " + receiver + " in " + c }
|
||||
|
||||
@@ -1767,12 +1777,12 @@ private class SummaryPostUpdateNode extends FlowSummaryNode, PostUpdateNodeImpl
|
||||
* This is used for tracking flow through captured variables.
|
||||
*/
|
||||
class SynthCapturedVariablesArgumentNode extends Node, TSynthCapturedVariablesArgumentNode {
|
||||
ControlFlowNode callable;
|
||||
Cfg::ControlFlowNode callable;
|
||||
|
||||
SynthCapturedVariablesArgumentNode() { this = TSynthCapturedVariablesArgumentNode(callable) }
|
||||
|
||||
/** Gets the `CallNode` corresponding to this captured variables argument node. */
|
||||
CallNode getCallNode() { result.getFunction() = callable }
|
||||
/** Gets the `Cfg::CallNode` corresponding to this captured variables argument node. */
|
||||
Cfg::CallNode getCallNode() { result.getFunction() = callable }
|
||||
|
||||
/** Gets the `CfgNode` that corresponds to this synthetic node. */
|
||||
CfgNode getUnderlyingNode() { result.asCfgNode() = callable }
|
||||
@@ -1790,7 +1800,7 @@ class CapturedVariablesArgumentNodeAsArgumentNode extends ArgumentNode,
|
||||
{
|
||||
overlay[global]
|
||||
override predicate argumentOf(DataFlowCall call, ArgumentPosition pos) {
|
||||
exists(CallNode callNode | callNode = this.getCallNode() |
|
||||
exists(Cfg::CallNode callNode | callNode = this.getCallNode() |
|
||||
callNode = call.getNode() and
|
||||
exists(Function target | resolveCall(callNode, target, _) |
|
||||
target = any(VariableCapture::CapturedVariable v).getACapturingScope()
|
||||
@@ -1804,7 +1814,7 @@ class CapturedVariablesArgumentNodeAsArgumentNode extends ArgumentNode,
|
||||
class SynthCapturedVariablesArgumentPostUpdateNode extends PostUpdateNodeImpl,
|
||||
TSynthCapturedVariablesArgumentPostUpdateNode
|
||||
{
|
||||
ControlFlowNode callable;
|
||||
Cfg::ControlFlowNode callable;
|
||||
|
||||
SynthCapturedVariablesArgumentPostUpdateNode() {
|
||||
this = TSynthCapturedVariablesArgumentPostUpdateNode(callable)
|
||||
@@ -1911,8 +1921,8 @@ abstract class ReturnNode extends Node {
|
||||
class ExtractedReturnNode extends ReturnNode, CfgNode {
|
||||
// See `TaintTrackingImplementation::returnFlowStep`
|
||||
ExtractedReturnNode() {
|
||||
node = any(Return ret).getValue().getAFlowNode() or
|
||||
node = any(Yield yield).getAFlowNode()
|
||||
node.getNode() = any(Return ret).getValue() or
|
||||
node.getNode() = any(Yield yield)
|
||||
}
|
||||
|
||||
override ReturnKind getKind() { any() }
|
||||
@@ -1930,7 +1940,7 @@ class ExtractedReturnNode extends ReturnNode, CfgNode {
|
||||
class YieldNodeInContextManagerFunction extends ReturnNode, CfgNode {
|
||||
YieldNodeInContextManagerFunction() {
|
||||
hasContextmanagerDecorator(node.getScope()) and
|
||||
node = any(Yield yield).getValue().getAFlowNode()
|
||||
node.getNode() = any(Yield yield).getValue()
|
||||
}
|
||||
|
||||
override ReturnKind getKind() { any() }
|
||||
|
||||
@@ -2,8 +2,9 @@ overlay[local?]
|
||||
module;
|
||||
|
||||
private import python
|
||||
private import semmle.python.controlflow.internal.Cfg as Cfg
|
||||
private import DataFlowPublic
|
||||
private import semmle.python.essa.SsaCompute
|
||||
private import semmle.python.dataflow.new.internal.SsaImpl as SsaImpl
|
||||
private import semmle.python.dataflow.new.internal.ImportResolution
|
||||
private import FlowSummaryImpl as FlowSummaryImpl
|
||||
private import semmle.python.frameworks.data.ModelsAsData
|
||||
@@ -43,13 +44,23 @@ predicate isArgumentNode(ArgumentNode arg, DataFlowCall c, ArgumentPosition pos)
|
||||
// Nodes
|
||||
//--------
|
||||
overlay[local]
|
||||
predicate isExpressionNode(ControlFlowNode node) { node.getNode() instanceof Expr }
|
||||
predicate isExpressionNode(Cfg::ControlFlowNode node) {
|
||||
node.getNode() instanceof Expr
|
||||
or
|
||||
// `Cfg::ForNode` wraps a `For` statement's iter position, but
|
||||
// overrides `.getNode()` to return the `Py::For` statement (for
|
||||
// legacy parity). The underlying AST is still an `Expr` (the iter
|
||||
// expression); we want a dataflow node here so that for-loop
|
||||
// content reads (`for y in l`) have a source expression node to
|
||||
// read content from.
|
||||
node instanceof Cfg::ForNode
|
||||
}
|
||||
|
||||
// =============================================================================
|
||||
// SyntheticPreUpdateNode
|
||||
// =============================================================================
|
||||
class SyntheticPreUpdateNode extends Node, TSyntheticPreUpdateNode {
|
||||
CallNode node;
|
||||
Cfg::CallNode node;
|
||||
|
||||
SyntheticPreUpdateNode() { this = TSyntheticPreUpdateNode(node) }
|
||||
|
||||
@@ -151,7 +162,7 @@ predicate synthStarArgsElementParameterNodeStoreStep(
|
||||
* been passed in a `**kwargs` argument.
|
||||
*/
|
||||
class SynthDictSplatArgumentNode extends Node, TSynthDictSplatArgumentNode {
|
||||
CallNode node;
|
||||
Cfg::CallNode node;
|
||||
|
||||
SynthDictSplatArgumentNode() { this = TSynthDictSplatArgumentNode(node) }
|
||||
|
||||
@@ -165,7 +176,7 @@ class SynthDictSplatArgumentNode extends Node, TSynthDictSplatArgumentNode {
|
||||
private predicate synthDictSplatArgumentNodeStoreStep(
|
||||
ArgumentNode nodeFrom, DictionaryElementContent c, SynthDictSplatArgumentNode nodeTo
|
||||
) {
|
||||
exists(string name, CallNode call, ArgumentPosition keywordPos |
|
||||
exists(string name, Cfg::CallNode call, ArgumentPosition keywordPos |
|
||||
nodeTo = TSynthDictSplatArgumentNode(call) and
|
||||
getCallArg(call, _, _, nodeFrom, keywordPos) and
|
||||
keywordPos.isKeyword(name) and
|
||||
@@ -185,8 +196,8 @@ private predicate synthDictSplatArgumentNodeStoreStep(
|
||||
*/
|
||||
predicate yieldStoreStep(Node nodeFrom, Content c, Node nodeTo) {
|
||||
exists(Yield yield |
|
||||
nodeTo.asCfgNode() = yield.getAFlowNode() and
|
||||
nodeFrom.asCfgNode() = yield.getValue().getAFlowNode() and
|
||||
nodeTo.asCfgNode().getNode() = yield and
|
||||
nodeFrom.asCfgNode().getNode() = yield.getValue() and
|
||||
// TODO: Consider if this will also need to transfer dictionary content
|
||||
// once dictionary comprehensions are supported.
|
||||
c instanceof ListElementContent
|
||||
@@ -289,7 +300,7 @@ abstract class PostUpdateNodeImpl extends Node {
|
||||
* Synthetic post-update nodes for synthetic nodes need to be listed one by one.
|
||||
*/
|
||||
class SyntheticPostUpdateNode extends PostUpdateNodeImpl, TSyntheticPostUpdateNode {
|
||||
ControlFlowNode node;
|
||||
Cfg::ControlFlowNode node;
|
||||
|
||||
SyntheticPostUpdateNode() { this = TSyntheticPostUpdateNode(node) }
|
||||
|
||||
@@ -333,16 +344,42 @@ module LocalFlow {
|
||||
// `x = f(42)`
|
||||
// nodeFrom is `f(42)`
|
||||
// nodeTo is `x`
|
||||
exists(AssignmentDefinition def |
|
||||
//
|
||||
// We use the CFG-level `DefinitionNode.getValue()` directly rather
|
||||
// than going through SSA, because the new SSA library prunes write
|
||||
// definitions that have no subsequent read in the same scope (e.g.
|
||||
// a module-level `def f():` whose `f` is only read inside other
|
||||
// functions). The CFG-level link is unconditional.
|
||||
//
|
||||
// The Name-target restriction mirrors legacy ESSA's
|
||||
// `SsaDefinitions::assignment_definition`, which required
|
||||
// `defn.(NameNode).defines(v)`. Subscript and attribute writes
|
||||
// (`x[i] = 42`, `obj.attr = 42`) are intentionally excluded — their
|
||||
// value flow is handled by the content-flow / `AttrWrite` machinery,
|
||||
// not by a local-flow step *into* the Subscript/Attribute expression.
|
||||
// Excluding them is essential for keeping augmented-assignment
|
||||
// targets (`x[i] += 42`) classifiable as `LocalSourceNode` on the
|
||||
// read side: the single canonical CFG node is both a load and a
|
||||
// store, and any incoming local-flow step would disqualify it from
|
||||
// being a local source.
|
||||
exists(Cfg::DefinitionNode def |
|
||||
nodeFrom.(CfgNode).getNode() = def.getValue() and
|
||||
nodeTo.(CfgNode).getNode() = def.getDefiningNode()
|
||||
nodeTo.(CfgNode).getNode() = def and
|
||||
def instanceof Cfg::NameNode and
|
||||
// Parameter defaults are evaluated in the enclosing scope, while the
|
||||
// parameter itself lives in the function's scope. The cross-scope
|
||||
// edge is provided by `runtimeJumpStep` instead.
|
||||
not exists(Py::Parameter param | def.getNode() = param.asName())
|
||||
)
|
||||
or
|
||||
// With definition
|
||||
// `with f(42) as x:`
|
||||
// nodeFrom is `f(42)`
|
||||
// nodeTo is `x`
|
||||
exists(With with, ControlFlowNode contextManager, WithDefinition withDef, ControlFlowNode var |
|
||||
exists(
|
||||
With with, Cfg::ControlFlowNode contextManager, SsaImpl::WithDefinition withDef,
|
||||
Cfg::ControlFlowNode var
|
||||
|
|
||||
var = withDef.getDefiningNode()
|
||||
|
|
||||
nodeFrom.(CfgNode).getNode() = contextManager and
|
||||
@@ -361,13 +398,13 @@ module LocalFlow {
|
||||
|
||||
predicate expressionFlowStep(Node nodeFrom, Node nodeTo) {
|
||||
// If expressions
|
||||
nodeFrom.asCfgNode() = nodeTo.asCfgNode().(IfExprNode).getAnOperand()
|
||||
nodeFrom.asCfgNode() = nodeTo.asCfgNode().(Cfg::IfExprNode).getAnOperand()
|
||||
or
|
||||
// Assignment expressions
|
||||
nodeFrom.asCfgNode() = nodeTo.asCfgNode().(AssignmentExprNode).getValue()
|
||||
nodeFrom.asCfgNode() = nodeTo.asCfgNode().(Cfg::AssignmentExprNode).getValue()
|
||||
or
|
||||
// boolean inline expressions such as `x or y` or `x and y`
|
||||
nodeFrom.asCfgNode() = nodeTo.asCfgNode().(BoolExprNode).getAnOperand()
|
||||
nodeFrom.asCfgNode() = nodeTo.asCfgNode().(Cfg::BoolExprNode).getAnOperand()
|
||||
or
|
||||
// Flow inside an unpacking assignment
|
||||
iterableUnpackingFlowStep(nodeFrom, nodeTo)
|
||||
@@ -376,12 +413,28 @@ module LocalFlow {
|
||||
matchFlowStep(nodeFrom, nodeTo)
|
||||
}
|
||||
|
||||
predicate useToNextUse(NameNode nodeFrom, NameNode nodeTo) {
|
||||
AdjacentUses::adjacentUseUse(nodeFrom, nodeTo)
|
||||
predicate useToNextUse(Cfg::NameNode nodeFrom, Cfg::NameNode nodeTo) {
|
||||
// The SSA-level adjacent-use predicate works on specific CFG variants
|
||||
// (e.g. boolean-outcome `[true]`/`[false]` or emptiness `[empty]`/`[non-empty]`
|
||||
// splits of the same AST node), but dataflow values are insensitive to
|
||||
// those splits — there is at most one `CfgNode` per AST. Project both
|
||||
// ends through `Cfg::isCanonicalAstNodeRepresentative` so all variants
|
||||
// contribute their use-use edges to the canonical pair.
|
||||
exists(Cfg::NameNode fromVariant, Cfg::NameNode toVariant |
|
||||
SsaImpl::AdjacentUses::adjacentUseUse(fromVariant, toVariant) and
|
||||
fromVariant.getNode() = nodeFrom.getNode() and
|
||||
toVariant.getNode() = nodeTo.getNode() and
|
||||
Cfg::isCanonicalAstNodeRepresentative(nodeFrom) and
|
||||
Cfg::isCanonicalAstNodeRepresentative(nodeTo)
|
||||
)
|
||||
}
|
||||
|
||||
predicate defToFirstUse(EssaVariable var, NameNode nodeTo) {
|
||||
AdjacentUses::firstUse(var.getDefinition(), nodeTo)
|
||||
predicate defToFirstUse(SsaImpl::EssaVariable var, Cfg::NameNode nodeTo) {
|
||||
exists(Cfg::NameNode toVariant |
|
||||
SsaImpl::AdjacentUses::firstUse(var.getDefinition(), toVariant) and
|
||||
toVariant.getNode() = nodeTo.getNode() and
|
||||
Cfg::isCanonicalAstNodeRepresentative(nodeTo)
|
||||
)
|
||||
}
|
||||
|
||||
predicate useUseFlowStep(Node nodeFrom, Node nodeTo) {
|
||||
@@ -390,12 +443,14 @@ module LocalFlow {
|
||||
// `x = f(y)`
|
||||
// nodeFrom is `y` on first line
|
||||
// nodeTo is `y` on second line
|
||||
exists(EssaDefinition def |
|
||||
nodeFrom.(CfgNode).getNode() = def.(EssaNodeDefinition).getDefiningNode()
|
||||
exists(SsaImpl::EssaDefinition def, Cfg::NameNode toVariant |
|
||||
nodeFrom.(CfgNode).getNode() = def.(SsaImpl::EssaNodeDefinition).getDefiningNode()
|
||||
or
|
||||
nodeFrom.(ScopeEntryDefinitionNode).getDefinition() = def
|
||||
|
|
||||
AdjacentUses::firstUse(def, nodeTo.(CfgNode).getNode())
|
||||
SsaImpl::AdjacentUses::firstUse(def, toVariant) and
|
||||
toVariant.getNode() = nodeTo.(CfgNode).getNode().getNode() and
|
||||
Cfg::isCanonicalAstNodeRepresentative(nodeTo.(CfgNode).getNode())
|
||||
)
|
||||
or
|
||||
// Next use after use
|
||||
@@ -557,9 +612,9 @@ predicate runtimeJumpStep(Node nodeFrom, Node nodeTo) {
|
||||
// a parameter with a default value, since the parameter will be in the scope of the
|
||||
// function, while the default value itself will be in the scope that _defines_ the
|
||||
// function.
|
||||
exists(ParameterDefinition param |
|
||||
exists(SsaImpl::ParameterDefinition param |
|
||||
// note: we go to the _control-flow node_ of the parameter, and not the ESSA node of the parameter, since for type-tracking, the ESSA node is not a LocalSourceNode, so we would get in trouble.
|
||||
nodeFrom.asCfgNode() = param.getDefault() and
|
||||
nodeFrom.asCfgNode().getNode() = param.getParameter().(Parameter).getDefault() and
|
||||
nodeTo.asCfgNode() = param.getDefiningNode()
|
||||
)
|
||||
or
|
||||
@@ -663,7 +718,7 @@ predicate neverSkipInPathGraph(Node n) {
|
||||
// ```
|
||||
// we would end up saying that the path MUST not skip the x in `y = x`, which is just
|
||||
// annoying and doesn't help the path explanation become clearer.
|
||||
n.asCfgNode() = any(EssaNodeDefinition def).getDefiningNode()
|
||||
n.asCfgNode() = any(SsaImpl::EssaNodeDefinition def).getDefiningNode()
|
||||
}
|
||||
|
||||
/**
|
||||
@@ -872,7 +927,7 @@ predicate listStoreStep(CfgNode nodeFrom, ListElementContent c, CfgNode nodeTo)
|
||||
// nodeFrom is `42`, cfg node
|
||||
// nodeTo is the list, `[..., 42, ...]`, cfg node
|
||||
// c denotes element of list
|
||||
nodeTo.getNode().(ListNode).getAnElement() = nodeFrom.getNode() and
|
||||
nodeTo.getNode().(Cfg::ListNode).getAnElement() = nodeFrom.getNode() and
|
||||
not nodeTo.getNode() instanceof UnpackingAssignmentSequenceTarget and
|
||||
// Suppress unused variable warning
|
||||
c = c
|
||||
@@ -885,7 +940,7 @@ predicate setStoreStep(CfgNode nodeFrom, SetElementContent c, CfgNode nodeTo) {
|
||||
// nodeFrom is `42`, cfg node
|
||||
// nodeTo is the set, `{..., 42, ...}`, cfg node
|
||||
// c denotes element of list
|
||||
nodeTo.getNode().(SetNode).getAnElement() = nodeFrom.getNode() and
|
||||
nodeTo.getNode().(Cfg::SetNode).getAnElement() = nodeFrom.getNode() and
|
||||
// Suppress unused variable warning
|
||||
c = c
|
||||
}
|
||||
@@ -898,7 +953,7 @@ predicate tupleStoreStep(CfgNode nodeFrom, TupleElementContent c, CfgNode nodeTo
|
||||
// nodeTo is the tuple, `(..., 42, ...)`, cfg node
|
||||
// c denotes element of tuple and index of nodeFrom
|
||||
exists(int n |
|
||||
nodeTo.getNode().(TupleNode).getElement(n) = nodeFrom.getNode() and
|
||||
nodeTo.getNode().(Cfg::TupleNode).getElement(n) = nodeFrom.getNode() and
|
||||
not nodeTo.getNode() instanceof UnpackingAssignmentSequenceTarget and
|
||||
c.getIndex() = n
|
||||
)
|
||||
@@ -912,7 +967,7 @@ predicate dictStoreStep(CfgNode nodeFrom, DictionaryElementContent c, Node nodeT
|
||||
// nodeTo is the dict, `{..., "key" = 42, ...}`, cfg node
|
||||
// c denotes element of dictionary and the key `"key"`
|
||||
exists(KeyValuePair item |
|
||||
item = nodeTo.asCfgNode().(DictNode).getNode().(Dict).getAnItem() and
|
||||
item = nodeTo.asCfgNode().(Cfg::DictNode).getNode().(Dict).getAnItem() and
|
||||
nodeFrom.getNode().getNode() = item.getValue() and
|
||||
c.getKey() = item.getKey().(StringLiteral).getS()
|
||||
)
|
||||
@@ -927,9 +982,9 @@ predicate dictStoreStep(CfgNode nodeFrom, DictionaryElementContent c, Node nodeT
|
||||
private predicate moreDictStoreSteps(CfgNode nodeFrom, DictionaryElementContent c, Node nodeTo) {
|
||||
// NOTE: It's important to add logic to the newtype definition of
|
||||
// DictionaryElementContent if you add new cases here.
|
||||
exists(SubscriptNode subscript |
|
||||
exists(Cfg::SubscriptNode subscript |
|
||||
nodeTo.(PostUpdateNode).getPreUpdateNode().asCfgNode() = subscript.getObject() and
|
||||
nodeFrom.asCfgNode() = subscript.(DefinitionNode).getValue() and
|
||||
nodeFrom.asCfgNode() = subscript.(Cfg::DefinitionNode).getValue() and
|
||||
c.getKey() = subscript.getIndex().getNode().(StringLiteral).getText()
|
||||
)
|
||||
or
|
||||
@@ -942,8 +997,8 @@ private predicate moreDictStoreSteps(CfgNode nodeFrom, DictionaryElementContent
|
||||
}
|
||||
|
||||
predicate dictClearStep(Node node, DictionaryElementContent c) {
|
||||
exists(SubscriptNode subscript |
|
||||
subscript instanceof DefinitionNode and
|
||||
exists(Cfg::SubscriptNode subscript |
|
||||
subscript instanceof Cfg::DefinitionNode and
|
||||
node.asCfgNode() = subscript.getObject() and
|
||||
c.getKey() = subscript.getIndex().getNode().(StringLiteral).getText()
|
||||
)
|
||||
@@ -1018,7 +1073,7 @@ predicate subscriptReadStep(CfgNode nodeFrom, Content c, CfgNode nodeTo) {
|
||||
// nodeFrom is `l`, cfg node
|
||||
// nodeTo is `l[3]`, cfg node
|
||||
// c is compatible with 3
|
||||
nodeFrom.getNode() = nodeTo.getNode().(SubscriptNode).getObject() and
|
||||
nodeFrom.getNode() = nodeTo.getNode().(Cfg::SubscriptNode).getObject() and
|
||||
(
|
||||
c instanceof ListElementContent
|
||||
or
|
||||
@@ -1027,10 +1082,10 @@ predicate subscriptReadStep(CfgNode nodeFrom, Content c, CfgNode nodeTo) {
|
||||
c instanceof DictionaryElementAnyContent
|
||||
or
|
||||
c.(TupleElementContent).getIndex() =
|
||||
nodeTo.getNode().(SubscriptNode).getIndex().getNode().(IntegerLiteral).getValue()
|
||||
nodeTo.getNode().(Cfg::SubscriptNode).getIndex().getNode().(IntegerLiteral).getValue()
|
||||
or
|
||||
c.(DictionaryElementContent).getKey() =
|
||||
nodeTo.getNode().(SubscriptNode).getIndex().getNode().(StringLiteral).getS()
|
||||
nodeTo.getNode().(Cfg::SubscriptNode).getIndex().getNode().(StringLiteral).getS()
|
||||
)
|
||||
}
|
||||
|
||||
|
||||
@@ -5,11 +5,12 @@ overlay[local]
|
||||
module;
|
||||
|
||||
private import python
|
||||
private import semmle.python.controlflow.internal.Cfg as Cfg
|
||||
private import DataFlowPrivate
|
||||
import semmle.python.dataflow.new.TypeTracking
|
||||
import Attributes
|
||||
import LocalSources
|
||||
private import semmle.python.essa.SsaCompute
|
||||
private import semmle.python.dataflow.new.internal.SsaImpl as SsaImpl
|
||||
private import semmle.python.dataflow.new.internal.ImportStar
|
||||
private import semmle.python.frameworks.data.ModelsAsData
|
||||
private import FlowSummaryImpl as FlowSummaryImpl
|
||||
@@ -27,16 +28,21 @@ private import semmle.python.frameworks.data.ModelsAsData
|
||||
overlay[local]
|
||||
newtype TNode =
|
||||
/** A node corresponding to a control flow node. */
|
||||
TCfgNode(ControlFlowNode node) {
|
||||
isExpressionNode(node)
|
||||
or
|
||||
node.getNode() instanceof Pattern
|
||||
TCfgNode(Cfg::ControlFlowNode node) {
|
||||
(
|
||||
isExpressionNode(node)
|
||||
or
|
||||
node.getNode() instanceof Pattern
|
||||
) and
|
||||
Cfg::isCanonicalAstNodeRepresentative(node)
|
||||
} or
|
||||
/**
|
||||
* A node corresponding to a scope entry definition. That is, the value of a variable
|
||||
* as it enters a scope.
|
||||
*/
|
||||
TScopeEntryDefinitionNode(ScopeEntryDefinition def) { not def.getScope() instanceof Module } or
|
||||
TScopeEntryDefinitionNode(SsaImpl::ScopeEntryDefinition def) {
|
||||
not def.getScope() instanceof Module
|
||||
} or
|
||||
/**
|
||||
* A synthetic node representing the value of an object before a state change.
|
||||
*
|
||||
@@ -47,36 +53,39 @@ newtype TNode =
|
||||
// NOTE: since we can't rely on the call graph, but we want to have synthetic
|
||||
// pre-update nodes for class calls, we end up getting synthetic pre-update nodes for
|
||||
// ALL calls :|
|
||||
TSyntheticPreUpdateNode(CallNode call) or
|
||||
TSyntheticPreUpdateNode(Cfg::CallNode call) { Cfg::isCanonicalAstNodeRepresentative(call) } or
|
||||
/**
|
||||
* A synthetic node representing the value of an object after a state change.
|
||||
* See QLDoc for `PostUpdateNode`.
|
||||
*/
|
||||
TSyntheticPostUpdateNode(ControlFlowNode node) {
|
||||
exists(CallNode call |
|
||||
node = call.getArg(_)
|
||||
TSyntheticPostUpdateNode(Cfg::ControlFlowNode node) {
|
||||
Cfg::isCanonicalAstNodeRepresentative(node) and
|
||||
(
|
||||
exists(Cfg::CallNode call |
|
||||
node = call.getArg(_)
|
||||
or
|
||||
node = call.getArgByName(_)
|
||||
or
|
||||
// `self` argument when handling class instance calls (`__call__` special method))
|
||||
node = call.getFunction()
|
||||
)
|
||||
or
|
||||
node = call.getArgByName(_)
|
||||
node = any(Cfg::AttrNode a).getObject()
|
||||
or
|
||||
// `self` argument when handling class instance calls (`__call__` special method))
|
||||
node = call.getFunction()
|
||||
node = any(Cfg::SubscriptNode s).getObject()
|
||||
or
|
||||
// self parameter when used implicitly in `super()`
|
||||
exists(Class cls, Function func, SsaImpl::ParameterDefinition def |
|
||||
func = cls.getAMethod() and
|
||||
not isStaticmethod(func) and
|
||||
// this matches what we do in ExtractedParameterNode
|
||||
def.getDefiningNode() = node and
|
||||
def.getParameter() = func.getArg(0)
|
||||
)
|
||||
or
|
||||
// the iterable argument to the implicit comprehension function
|
||||
node.getNode() = any(Comp c).getIterable()
|
||||
)
|
||||
or
|
||||
node = any(AttrNode a).getObject()
|
||||
or
|
||||
node = any(SubscriptNode s).getObject()
|
||||
or
|
||||
// self parameter when used implicitly in `super()`
|
||||
exists(Class cls, Function func, ParameterDefinition def |
|
||||
func = cls.getAMethod() and
|
||||
not isStaticmethod(func) and
|
||||
// this matches what we do in ExtractedParameterNode
|
||||
def.getDefiningNode() = node and
|
||||
def.getParameter() = func.getArg(0)
|
||||
)
|
||||
or
|
||||
// the iterable argument to the implicit comprehension function
|
||||
node.getNode() = any(Comp c).getIterable()
|
||||
} or
|
||||
/** A node representing a global (module-level) variable in a specific module. */
|
||||
TModuleVariableNode(Module m, GlobalVariable v) { v.getScope() = m } or
|
||||
@@ -112,7 +121,9 @@ newtype TNode =
|
||||
exists(ParameterPosition ppos | ppos.isStarArgs(_) | exists(callable.getParameter(ppos)))
|
||||
} or
|
||||
/** A synthetic node to capture keyword arguments that are passed to a `**kwargs` parameter. */
|
||||
TSynthDictSplatArgumentNode(CallNode call) { exists(call.getArgByName(_)) } or
|
||||
TSynthDictSplatArgumentNode(Cfg::CallNode call) {
|
||||
exists(call.getArgByName(_)) and Cfg::isCanonicalAstNodeRepresentative(call)
|
||||
} or
|
||||
/** A synthetic node to allow flow to keyword parameters from a `**kwargs` argument. */
|
||||
TSynthDictSplatParameterNode(DataFlowCallable callable) {
|
||||
exists(ParameterPosition ppos | ppos.isKeyword(_) | exists(callable.getParameter(ppos)))
|
||||
@@ -128,15 +139,17 @@ newtype TNode =
|
||||
* A synthetic node representing the values of the variables captured
|
||||
* by the callable being called.
|
||||
*/
|
||||
TSynthCapturedVariablesArgumentNode(ControlFlowNode callable) {
|
||||
callable = any(CallNode c).getFunction()
|
||||
TSynthCapturedVariablesArgumentNode(Cfg::ControlFlowNode callable) {
|
||||
callable = any(Cfg::CallNode c).getFunction() and
|
||||
Cfg::isCanonicalAstNodeRepresentative(callable)
|
||||
} or
|
||||
/**
|
||||
* A synthetic node representing the values of the variables captured
|
||||
* by the callable being called, after the output has been computed.
|
||||
*/
|
||||
TSynthCapturedVariablesArgumentPostUpdateNode(ControlFlowNode callable) {
|
||||
callable = any(CallNode c).getFunction()
|
||||
TSynthCapturedVariablesArgumentPostUpdateNode(Cfg::ControlFlowNode callable) {
|
||||
callable = any(Cfg::CallNode c).getFunction() and
|
||||
Cfg::isCanonicalAstNodeRepresentative(callable)
|
||||
} or
|
||||
/** A synthetic node representing the values of variables captured by a comprehension. */
|
||||
TSynthCompCapturedVariablesArgumentNode(Comp comp) {
|
||||
@@ -194,7 +207,7 @@ class Node extends TNode {
|
||||
}
|
||||
|
||||
/** Gets the control-flow node corresponding to this node, if any. */
|
||||
ControlFlowNode asCfgNode() { none() }
|
||||
Cfg::ControlFlowNode asCfgNode() { none() }
|
||||
|
||||
/** Gets the expression corresponding to this node, if any. */
|
||||
Expr asExpr() { none() }
|
||||
@@ -207,14 +220,14 @@ class Node extends TNode {
|
||||
|
||||
/** A data-flow node corresponding to a control-flow node. */
|
||||
class CfgNode extends Node, TCfgNode {
|
||||
ControlFlowNode node;
|
||||
Cfg::ControlFlowNode node;
|
||||
|
||||
CfgNode() { this = TCfgNode(node) }
|
||||
|
||||
/** Gets the `ControlFlowNode` represented by this data-flow node. */
|
||||
ControlFlowNode getNode() { result = node }
|
||||
/** Gets the `Cfg::ControlFlowNode` represented by this data-flow node. */
|
||||
Cfg::ControlFlowNode getNode() { result = node }
|
||||
|
||||
override ControlFlowNode asCfgNode() { result = node }
|
||||
override Cfg::ControlFlowNode asCfgNode() { result = node }
|
||||
|
||||
/** Gets a textual representation of this element. */
|
||||
override string toString() { result = node.toString() }
|
||||
@@ -224,9 +237,9 @@ class CfgNode extends Node, TCfgNode {
|
||||
override Location getLocation() { result = node.getLocation() }
|
||||
}
|
||||
|
||||
/** A data-flow node corresponding to a `CallNode` in the control-flow graph. */
|
||||
/** A data-flow node corresponding to a `Cfg::CallNode` in the control-flow graph. */
|
||||
class CallCfgNode extends CfgNode, LocalSourceNode {
|
||||
override CallNode node;
|
||||
override Cfg::CallNode node;
|
||||
|
||||
/**
|
||||
* Gets the data-flow node for the function component of the call corresponding to this data-flow
|
||||
@@ -307,15 +320,15 @@ ExprNode exprNode(DataFlowExpr e) { result.getNode().getNode() = e }
|
||||
* as it enters a scope.
|
||||
*/
|
||||
class ScopeEntryDefinitionNode extends Node, TScopeEntryDefinitionNode {
|
||||
ScopeEntryDefinition def;
|
||||
SsaImpl::ScopeEntryDefinition def;
|
||||
|
||||
ScopeEntryDefinitionNode() { this = TScopeEntryDefinitionNode(def) }
|
||||
|
||||
/** Gets the `ScopeEntryDefinition` associated with this node. */
|
||||
ScopeEntryDefinition getDefinition() { result = def }
|
||||
/** Gets the `SsaImpl::ScopeEntryDefinition` associated with this node. */
|
||||
SsaImpl::ScopeEntryDefinition getDefinition() { result = def }
|
||||
|
||||
/** Gets the source variable represented by this node. */
|
||||
SsaSourceVariable getVariable() { result = def.getSourceVariable() }
|
||||
SsaImpl::SsaSourceVariable getVariable() { result = def.getSourceVariable() }
|
||||
|
||||
override Location getLocation() { result = def.getLocation() }
|
||||
|
||||
@@ -337,7 +350,7 @@ class ParameterNode extends Node instanceof ParameterNodeImpl {
|
||||
/** A parameter node found in the source code (not in a summary). */
|
||||
class ExtractedParameterNode extends ParameterNodeImpl, CfgNode {
|
||||
//, LocalSourceNode {
|
||||
ParameterDefinition def;
|
||||
SsaImpl::ParameterDefinition def;
|
||||
|
||||
ExtractedParameterNode() { node = def.getDefiningNode() }
|
||||
|
||||
@@ -368,10 +381,10 @@ Node getCallArgApproximation() {
|
||||
exists(Class c | result.asExpr() = c.getAMethod().getArg(0))
|
||||
or
|
||||
// the object part of an attribute expression (which might be a bound method)
|
||||
result.asCfgNode() = any(AttrNode a).getObject()
|
||||
result.asCfgNode() = any(Cfg::AttrNode a).getObject()
|
||||
or
|
||||
// the function part of any call
|
||||
result.asCfgNode() = any(CallNode c).getFunction()
|
||||
result.asCfgNode() = any(Cfg::CallNode c).getFunction()
|
||||
}
|
||||
|
||||
/** Gets the extracted argument nodes that do not rely on `getCallArg`. */
|
||||
@@ -380,7 +393,7 @@ private Node implicitArgumentNode() {
|
||||
normalCallArg(_, result, _)
|
||||
or
|
||||
// and self arguments
|
||||
result.asCfgNode() = any(CallNode c).getFunction().(AttrNode).getObject()
|
||||
result.asCfgNode() = any(Cfg::CallNode c).getFunction().(Cfg::AttrNode).getObject()
|
||||
or
|
||||
// for comprehensions, we allow the synthetic `iterable` argument
|
||||
result.asExpr() = any(Comp c).getIterable()
|
||||
@@ -485,21 +498,24 @@ class ModuleVariableNode extends Node, TModuleVariableNode {
|
||||
|
||||
/** Gets a node that reads this variable, excluding reads that happen through `from ... import *`. */
|
||||
Node getALocalRead() {
|
||||
result.asCfgNode() = var.getALoad().getAFlowNode() and
|
||||
result.asCfgNode().getNode() = var.getALoad() and
|
||||
not result.getScope() = mod
|
||||
}
|
||||
|
||||
/** Gets an `EssaNode` that corresponds to an assignment of this global variable. */
|
||||
/** Gets a CFG node that corresponds to an assignment of this global variable. */
|
||||
Node getAWrite() {
|
||||
any(EssaNodeDefinition def).definedBy(var, result.asCfgNode().(DefinitionNode))
|
||||
exists(Cfg::NameNode n |
|
||||
n.defines(var) and
|
||||
result.asCfgNode() = n
|
||||
)
|
||||
}
|
||||
|
||||
/** Gets the possible values of the variable at the end of import time */
|
||||
CfgNode getADefiningWrite() {
|
||||
exists(SsaVariable def |
|
||||
def = any(SsaVariable ssa_var).getAnUltimateDefinition() and
|
||||
def.getDefinition() = result.asCfgNode() and
|
||||
def.getVariable() = var
|
||||
exists(SsaImpl::EssaVariable def |
|
||||
def = any(SsaImpl::EssaVariable ssa_var).getAnUltimateDefinition() and
|
||||
def.getDefinition().(SsaImpl::EssaNodeDefinition).getDefiningNode() = result.asCfgNode() and
|
||||
def.getSourceVariable().getVariable() = var
|
||||
)
|
||||
}
|
||||
|
||||
@@ -516,7 +532,7 @@ private ModuleVariableNode import_star_read(Node n) {
|
||||
overlay[global]
|
||||
pragma[nomagic]
|
||||
private predicate resolved_import_star_module(Module m, string name, Node n) {
|
||||
exists(NameNode nn | nn = n.asCfgNode() |
|
||||
exists(Cfg::NameNode nn | nn = n.asCfgNode() |
|
||||
ImportStar::importStarResolvesTo(pragma[only_bind_into](nn), m) and
|
||||
nn.getId() = name
|
||||
)
|
||||
@@ -574,88 +590,116 @@ class StarPatternElementNode extends Node, TStarPatternElementNode {
|
||||
}
|
||||
|
||||
/**
|
||||
* Gets a node that controls whether other nodes are evaluated.
|
||||
* A node that participates in a conditional split: a CFG node whose
|
||||
* evaluation outcome (true/false) is used to choose between two
|
||||
* successor basic blocks. In the new shared CFG, such nodes appear in
|
||||
* pairs of `isAfterTrue`/`isAfterFalse` annotated CFG nodes.
|
||||
*
|
||||
* In the base case, this is the last node of `conditionBlock`, and `flipped` is `false`.
|
||||
* This definition accounts for (short circuting) `and`- and `or`-expressions, as the structure
|
||||
* of basic blocks will reflect their semantics.
|
||||
* Users typically obtain a `GuardNode` by casting from a more specific
|
||||
* Cfg type: `g.(Cfg::CallNode)` for a call-based check, etc.
|
||||
*
|
||||
* However, in the program
|
||||
* ```python
|
||||
* if not is_safe(path):
|
||||
* return
|
||||
* ```
|
||||
* the last node in the `ConditionBlock` is `not is_safe(path)`.
|
||||
*
|
||||
* We would like to consider also `is_safe(path)` a guard node, albeit with `flipped` being `true`.
|
||||
* Thus we recurse through `not`-expressions.
|
||||
* This replaces the legacy (pre-shared-CFG) `GuardNode`/`flipped`
|
||||
* machinery: the shared CFG carries outcome information structurally
|
||||
* (via `isAfterTrue`/`isAfterFalse`), so no separate polarity field
|
||||
* is required.
|
||||
*/
|
||||
ControlFlowNode guardNode(ConditionBlock conditionBlock, boolean flipped) {
|
||||
// Base case: the last node truly does determine which successor is chosen
|
||||
result = conditionBlock.getLastNode() and
|
||||
flipped = false
|
||||
or
|
||||
// Recursive cases:
|
||||
// if a guard node is a `not`-expression,
|
||||
// the operand is also a guard node, but with inverted polarity.
|
||||
exists(UnaryExprNode notNode |
|
||||
result = notNode.getOperand() and
|
||||
notNode.getNode().getOp() instanceof Not
|
||||
|
|
||||
notNode = guardNode(conditionBlock, flipped.booleanNot())
|
||||
)
|
||||
or
|
||||
// if a guard node is compared to a boolean literal,
|
||||
// the other operand is also a guard node,
|
||||
// but with polarity depending on the literal (and on the comparison).
|
||||
exists(CompareNode cmpNode, Cmpop op, ControlFlowNode b, boolean should_flip |
|
||||
(
|
||||
cmpNode.operands(result, op, b) or
|
||||
cmpNode.operands(b, op, result)
|
||||
) and
|
||||
not result.getNode() instanceof BooleanLiteral and
|
||||
(
|
||||
// comparing to the boolean
|
||||
(op instanceof Eq or op instanceof Is) and
|
||||
// we should flip if the value compared against, here the value of `b`, is false
|
||||
should_flip = b.getNode().(BooleanLiteral).booleanValue().booleanNot()
|
||||
or
|
||||
// comparing to the negation of the boolean
|
||||
(op instanceof NotEq or op instanceof IsNot) and
|
||||
// again, we should flip if the value compared against, here the value of `not b`, is false.
|
||||
// That is, if the value of `b` is true.
|
||||
should_flip = b.getNode().(BooleanLiteral).booleanValue()
|
||||
class GuardNode extends Cfg::ControlFlowNode {
|
||||
GuardNode() {
|
||||
// This is the canonical (post-order) version of an AST node, and
|
||||
// some `[true]`/`[false]` variant of the same AST exists. We
|
||||
// include the canonical node because users identify guards by
|
||||
// their AST (`g.(Cfg::CallNode)` etc.), and the outcome-tagged
|
||||
// variants are accessed by `outcomeOfGuard` below.
|
||||
exists(Cfg::ControlFlowNode outcome |
|
||||
outcome.getNode() = this.getNode() and
|
||||
(outcome.isAfterTrue(_) or outcome.isAfterFalse(_))
|
||||
)
|
||||
|
|
||||
// we flip `flipped` according to `should_flip` via the formula `flipped xor should_flip`.
|
||||
flipped in [true, false] and
|
||||
cmpNode = guardNode(conditionBlock, flipped.booleanXor(should_flip))
|
||||
)
|
||||
or
|
||||
// Or: this IS one of the outcome-tagged variants, supporting
|
||||
// users who want to query the split point directly.
|
||||
this.isAfterTrue(_)
|
||||
or
|
||||
this.isAfterFalse(_)
|
||||
}
|
||||
|
||||
/** Holds if this guard controls block `b` upon evaluating to `branch`. */
|
||||
predicate controlsBlock(Cfg::BasicBlock b, boolean branch) {
|
||||
branch in [true, false] and
|
||||
exists(Cfg::ControlFlowNode outcomeNode |
|
||||
outcomeOfGuard(this, outcomeNode, branch) and
|
||||
outcomeNode.getBasicBlock().dominates(b)
|
||||
)
|
||||
}
|
||||
}
|
||||
|
||||
/**
|
||||
* A node that controls whether other nodes are evaluated.
|
||||
* Holds if some execution that arrives at `outcomeNode` corresponds
|
||||
* to `guard` having evaluated to `branch`.
|
||||
*
|
||||
* The field `flipped` allows us to match `GuardNode`s underneath
|
||||
* `not`-expressions and still choose the appropriate branch.
|
||||
* For a direct guard `if g:`, the outcome node is `g` itself with
|
||||
* `isAfterTrue`/`isAfterFalse`. For wrapped guards like `not g` or
|
||||
* `g == True`, the outcome is on the wrapping expression with an
|
||||
* appropriate polarity transform — we follow those wrappers up the
|
||||
* AST to find the outermost expression that carries an actual
|
||||
* `isAfterTrue`/`isAfterFalse` outcome.
|
||||
*/
|
||||
class GuardNode extends ControlFlowNode {
|
||||
ConditionBlock conditionBlock;
|
||||
boolean flipped;
|
||||
|
||||
GuardNode() { this = guardNode(conditionBlock, flipped) }
|
||||
|
||||
/** Holds if this guard controls block `b` upon evaluating to `branch`. */
|
||||
predicate controlsBlock(BasicBlock b, boolean branch) {
|
||||
branch in [true, false] and
|
||||
conditionBlock.controls(b, branch.booleanXor(flipped))
|
||||
}
|
||||
private predicate outcomeOfGuard(
|
||||
Cfg::ControlFlowNode guard, Cfg::ControlFlowNode outcomeNode, boolean branch
|
||||
) {
|
||||
// Base case: the guard itself splits — the outcome node is the
|
||||
// first node of an outcome BB, with matching outcome label.
|
||||
// (The shared CFG also marks inner expressions with outcome flags
|
||||
// for analysis purposes, but only "splitting" nodes — those that
|
||||
// actually start an outcome BB — are valid guards on their own.)
|
||||
// The guard must be the canonical AST representative for its AST:
|
||||
// each AST expression has at most one canonical representative, and
|
||||
// admitting non-canonical outcome-tagged variants (e.g. `After l [false]`
|
||||
// when the canonical is `After l [true]`) would let them spuriously
|
||||
// "control" the `[true]`-tagged BB via the AST-matching join below.
|
||||
Cfg::isCanonicalAstNodeRepresentative(guard) and
|
||||
outcomeNode.getNode() = guard.getNode() and
|
||||
outcomeNode = outcomeNode.getBasicBlock().firstNode() and
|
||||
(
|
||||
outcomeNode.isAfterTrue(_) and branch = true
|
||||
or
|
||||
outcomeNode.isAfterFalse(_) and branch = false
|
||||
)
|
||||
or
|
||||
// Recursive: `not guard` — same outcome split as `guard`, flipped.
|
||||
exists(Cfg::UnaryExprNode notNode, boolean notBranch |
|
||||
notNode.getOperand().getNode() = guard.getNode() and
|
||||
notNode.getNode().getOp() instanceof Not and
|
||||
outcomeOfGuard(notNode, outcomeNode, notBranch) and
|
||||
branch = notBranch.booleanNot()
|
||||
)
|
||||
or
|
||||
// Recursive: comparisons against a boolean literal.
|
||||
exists(
|
||||
Cfg::CompareNode cmpNode, Cmpop op, Cfg::ControlFlowNode otherOperand,
|
||||
Cfg::ControlFlowNode guardOperand, boolean polarity, boolean cmpBranch
|
||||
|
|
||||
guardOperand.getNode() = guard.getNode() and
|
||||
(
|
||||
cmpNode.operands(guardOperand, op, otherOperand) or
|
||||
cmpNode.operands(otherOperand, op, guardOperand)
|
||||
) and
|
||||
not guard.getNode() instanceof BooleanLiteral and
|
||||
(
|
||||
(op instanceof Eq or op instanceof Is) and
|
||||
polarity = otherOperand.getNode().(BooleanLiteral).booleanValue()
|
||||
or
|
||||
(op instanceof NotEq or op instanceof IsNot) and
|
||||
polarity = otherOperand.getNode().(BooleanLiteral).booleanValue().booleanNot()
|
||||
) and
|
||||
outcomeOfGuard(cmpNode, outcomeNode, cmpBranch) and
|
||||
branch = cmpBranch.booleanXor(polarity.booleanNot())
|
||||
)
|
||||
}
|
||||
|
||||
/**
|
||||
* Holds if the guard `g` validates `node` upon evaluating to `branch`.
|
||||
*/
|
||||
signature predicate guardChecksSig(GuardNode g, ControlFlowNode node, boolean branch);
|
||||
signature predicate guardChecksSig(GuardNode g, Cfg::ControlFlowNode node, boolean branch);
|
||||
|
||||
/**
|
||||
* Provides a set of barrier nodes for a guard that validates a node.
|
||||
@@ -670,7 +714,9 @@ module BarrierGuard<guardChecksSig/3 guardChecks> {
|
||||
result = ParameterizedBarrierGuard<Unit, extendedGuardChecks/4>::getABarrierNode(_)
|
||||
}
|
||||
|
||||
private predicate extendedGuardChecks(GuardNode g, ControlFlowNode node, boolean branch, Unit u) {
|
||||
private predicate extendedGuardChecks(
|
||||
GuardNode g, Cfg::ControlFlowNode node, boolean branch, Unit u
|
||||
) {
|
||||
guardChecks(g, node, branch) and
|
||||
u = u
|
||||
}
|
||||
@@ -680,7 +726,7 @@ bindingset[this]
|
||||
private signature class ParamSig;
|
||||
|
||||
private module WithParam<ParamSig P> {
|
||||
signature predicate guardChecksSig(GuardNode g, ControlFlowNode node, boolean branch, P param);
|
||||
signature predicate guardChecksSig(GuardNode g, Cfg::ControlFlowNode node, boolean branch, P param);
|
||||
}
|
||||
|
||||
/**
|
||||
@@ -693,10 +739,19 @@ module ParameterizedBarrierGuard<ParamSig P, WithParam<P>::guardChecksSig/4 guar
|
||||
/** Gets a node that is safely guarded by the given guard check with parameter `param`. */
|
||||
overlay[global]
|
||||
ExprNode getABarrierNode(P param) {
|
||||
exists(GuardNode g, EssaDefinition def, ControlFlowNode node, boolean branch |
|
||||
AdjacentUses::useOfDef(def, node) and
|
||||
exists(GuardNode g, SsaImpl::EssaDefinition def, Cfg::ControlFlowNode node, boolean branch |
|
||||
SsaImpl::AdjacentUses::useOfDef(def, node) and
|
||||
guardChecks(g, node, branch, param) and
|
||||
AdjacentUses::useOfDef(def, result.asCfgNode()) and
|
||||
SsaImpl::AdjacentUses::useOfDef(def, result.asCfgNode()) and
|
||||
// The protected use must be a different SSA position than the test
|
||||
// position itself: in the shared CFG the test expression's
|
||||
// canonical CFG node is the firstNode of its own true-branch BB
|
||||
// (`controlsBlock` is reflexive on dominance), and that canonical
|
||||
// node is also the SSA-use position on the def-use chain leading
|
||||
// to the actual branch uses. Without this guard, the test
|
||||
// position would be returned as a barrier and block flow before
|
||||
// it can reach the genuine uses in either branch.
|
||||
node != result.asCfgNode() and
|
||||
g.controlsBlock(result.asCfgNode().getBasicBlock(), branch)
|
||||
)
|
||||
}
|
||||
@@ -712,7 +767,7 @@ module ExternalBarrierGuard {
|
||||
private import semmle.python.ApiGraphs
|
||||
|
||||
overlay[global]
|
||||
private predicate guardCheck(GuardNode g, ControlFlowNode node, boolean branch, string kind) {
|
||||
private predicate guardCheck(GuardNode g, Cfg::ControlFlowNode node, boolean branch, string kind) {
|
||||
exists(API::CallNode call, API::Node parameter |
|
||||
parameter = call.getAParameter() and
|
||||
parameter = ModelOutput::getABarrierGuardNode(kind, branch)
|
||||
@@ -748,10 +803,10 @@ newtype TContent =
|
||||
TSetElementContent() or
|
||||
/** An element of a tuple at a specific index. */
|
||||
TTupleElementContent(int index) {
|
||||
exists(any(TupleNode tn).getElement(index))
|
||||
exists(any(Cfg::TupleNode tn).getElement(index))
|
||||
or
|
||||
// Arguments can overflow and end up in the starred parameter tuple.
|
||||
exists(any(CallNode cn).getArg(index))
|
||||
exists(any(Cfg::CallNode cn).getArg(index))
|
||||
or
|
||||
// since flow summaries might use tuples, we ensure that we at least have valid
|
||||
// TTupleElementContent for the 0..7 (7 was picked to match `small_tuple` in
|
||||
@@ -768,10 +823,14 @@ newtype TContent =
|
||||
or
|
||||
// d["key"] = ...
|
||||
key =
|
||||
any(SubscriptNode sub | sub.isStore() | sub.getIndex().getNode().(StringLiteral).getText())
|
||||
any(Cfg::SubscriptNode sub |
|
||||
sub.isStore()
|
||||
|
|
||||
sub.getIndex().getNode().(StringLiteral).getText()
|
||||
)
|
||||
or
|
||||
// d.setdefault("key", ...)
|
||||
exists(CallNode call | call.getFunction().(AttrNode).getName() = "setdefault" |
|
||||
exists(Cfg::CallNode call | call.getFunction().(Cfg::AttrNode).getName() = "setdefault" |
|
||||
key = call.getArg(0).getNode().(StringLiteral).getText()
|
||||
)
|
||||
} or
|
||||
|
||||
@@ -5,11 +5,24 @@
|
||||
*/
|
||||
|
||||
private import python
|
||||
private import semmle.python.controlflow.internal.Cfg as Cfg
|
||||
private import semmle.python.dataflow.new.internal.SsaImpl as SsaImpl
|
||||
private import semmle.python.dataflow.new.DataFlow
|
||||
private import semmle.python.dataflow.new.internal.ImportStar
|
||||
private import semmle.python.dataflow.new.TypeTracking
|
||||
private import semmle.python.dataflow.new.internal.DataFlowPrivate
|
||||
private import semmle.python.essa.SsaDefinitions
|
||||
|
||||
/**
|
||||
* Holds if the name of `var` refers to a submodule of a package and `init` is
|
||||
* the `__init__` module of that package. Locally inlined replacement for the
|
||||
* legacy `SsaSource::init_module_submodule_defn` so that this module has no
|
||||
* direct dependency on `semmle.python.essa.SsaDefinitions`.
|
||||
*/
|
||||
private predicate initModuleSubmoduleDefn(GlobalVariable var, Module init) {
|
||||
init.isPackageInit() and
|
||||
exists(init.getPackage().getSubModule(var.getId())) and
|
||||
var.getScope() = init
|
||||
}
|
||||
|
||||
/**
|
||||
* Python modules and the way imports are resolved are... complicated. Here's a crash course in how
|
||||
@@ -69,13 +82,19 @@ module ImportResolution {
|
||||
* Holds if there is an ESSA step from `defFrom` to `defTo`, which should be allowed
|
||||
* for import resolution.
|
||||
*/
|
||||
private predicate allowedEssaImportStep(EssaDefinition defFrom, EssaDefinition defTo) {
|
||||
private predicate allowedEssaImportStep(
|
||||
SsaImpl::EssaDefinition defFrom, SsaImpl::EssaDefinition defTo
|
||||
) {
|
||||
// to handle definitions guarded by if-then-else
|
||||
defFrom = defTo.(PhiFunction).getAnInput()
|
||||
defFrom = defTo.(SsaImpl::PhiFunction).getAnInput()
|
||||
or
|
||||
// refined variable
|
||||
// example: https://github.com/nvbn/thefuck/blob/ceeaeab94b5df5a4fe9d94d61e4f6b0bbea96378/thefuck/utils.py#L25-L45
|
||||
defFrom = defTo.(EssaNodeRefinement).getInput().getDefinition()
|
||||
// to handle uncertain writes such as `from X import *`, which create an
|
||||
// uncertain SSA definition for every name in the importing scope. The
|
||||
// immediately preceding definition is still potentially the value of the
|
||||
// module export.
|
||||
SsaImpl::Ssa::uncertainWriteDefinitionInput(defTo, defFrom)
|
||||
// Note: legacy ESSA refinement-step (e.g. for `foo.bar = X`) is
|
||||
// not modelled in the new SSA beyond the cases handled above.
|
||||
}
|
||||
|
||||
/**
|
||||
@@ -92,30 +111,32 @@ module ImportResolution {
|
||||
// Definitions made inside `m` itself
|
||||
//
|
||||
// for code such as `foo = ...; foo.bar = ...` there will be TWO
|
||||
// EssaDefinition/EssaVariable. One for `foo = ...` (AssignmentDefinition) and one
|
||||
// SsaImpl::EssaDefinition/SsaImpl::EssaVariable. One for `foo = ...` (SsaImpl::AssignmentDefinition) and one
|
||||
// for `foo.bar = ...`. The one for `foo.bar = ...` (EssaNodeRefinement). The
|
||||
// EssaNodeRefinement is the one that will reach the end of the module (normal
|
||||
// exit).
|
||||
//
|
||||
// However, we cannot just use the EssaNodeRefinement as the `val`, because the
|
||||
// normal data-flow depends on use-use flow, and use-use flow targets CFG nodes not
|
||||
// EssaNodes. So we need to go back from the EssaDefinition/EssaVariable that
|
||||
// EssaNodes. So we need to go back from the SsaImpl::EssaDefinition/SsaImpl::EssaVariable that
|
||||
// reaches the end of the module, to the first definition of the variable, and then
|
||||
// track forwards using use-use flow to find a suitable CFG node that has flow into
|
||||
// it from use-use flow.
|
||||
exists(EssaVariable lastUseVar, EssaVariable firstDef |
|
||||
exists(SsaImpl::EssaVariable lastUseVar, SsaImpl::EssaVariable firstDef |
|
||||
lastUseVar.getName() = name and
|
||||
// we ignore special variable $ introduced by our analysis (not used for anything)
|
||||
// we ignore special variable * introduced by `from <pkg> import *` -- TODO: understand why we even have this?
|
||||
not name in ["$", "*"] and
|
||||
lastUseVar.getAUse() = m.getANormalExit() and
|
||||
exists(Cfg::ControlFlowNode exit |
|
||||
exit.isNormalExit() and exit.getScope() = m and lastUseVar.getAUse() = exit
|
||||
) and
|
||||
allowedEssaImportStep*(firstDef, lastUseVar) and
|
||||
not allowedEssaImportStep(_, firstDef)
|
||||
|
|
||||
not LocalFlow::defToFirstUse(firstDef, _) and
|
||||
val.asCfgNode() = firstDef.getDefinition().(EssaNodeDefinition).getDefiningNode()
|
||||
val.asCfgNode() = firstDef.getDefinition().(SsaImpl::EssaNodeDefinition).getDefiningNode()
|
||||
or
|
||||
exists(ControlFlowNode mid, ControlFlowNode end |
|
||||
exists(Cfg::ControlFlowNode mid, Cfg::ControlFlowNode end |
|
||||
LocalFlow::defToFirstUse(firstDef, mid) and
|
||||
LocalFlow::useToNextUse*(mid, end) and
|
||||
not LocalFlow::useToNextUse(end, _) and
|
||||
@@ -143,9 +164,9 @@ module ImportResolution {
|
||||
* handles simple cases where we can statically tell that this is the case.
|
||||
*/
|
||||
private predicate all_mentions_name(Module m, string name) {
|
||||
exists(DefinitionNode def, SequenceNode n |
|
||||
exists(Cfg::DefinitionNode def, Cfg::SequenceNode n |
|
||||
def.getValue() = n and
|
||||
def.(NameNode).getId() = "__all__" and
|
||||
def.(Cfg::NameNode).getId() = "__all__" and
|
||||
def.getScope() = m and
|
||||
any(StringLiteral s | s.getText() = name) = n.getAnElement().getNode()
|
||||
)
|
||||
@@ -158,18 +179,20 @@ module ImportResolution {
|
||||
*/
|
||||
private predicate no_or_complicated_all(Module m) {
|
||||
// No mention of `__all__` in the module
|
||||
not exists(DefinitionNode def | def.getScope() = m and def.(NameNode).getId() = "__all__")
|
||||
not exists(Cfg::DefinitionNode def |
|
||||
def.getScope() = m and def.(Cfg::NameNode).getId() = "__all__"
|
||||
)
|
||||
or
|
||||
// `__all__` is set to a non-sequence value
|
||||
exists(DefinitionNode def |
|
||||
def.(NameNode).getId() = "__all__" and
|
||||
exists(Cfg::DefinitionNode def |
|
||||
def.(Cfg::NameNode).getId() = "__all__" and
|
||||
def.getScope() = m and
|
||||
not def.getValue() instanceof SequenceNode
|
||||
not def.getValue() instanceof Cfg::SequenceNode
|
||||
)
|
||||
or
|
||||
// `__all__` is used in some way that doesn't involve storing a value in it. This usually means
|
||||
// it is being mutated through `append` or `extend`, which we don't handle.
|
||||
exists(NameNode n | n.getId() = "__all__" and n.getScope() = m and n.isLoad())
|
||||
exists(Cfg::NameNode n | n.getId() = "__all__" and n.getScope() = m and n.isLoad())
|
||||
}
|
||||
|
||||
private predicate potential_module_export(Module m, string name) {
|
||||
@@ -177,7 +200,7 @@ module ImportResolution {
|
||||
or
|
||||
no_or_complicated_all(m) and
|
||||
(
|
||||
exists(NameNode n | n.getId() = name and n.getScope() = m and name.charAt(0) != "_")
|
||||
exists(Cfg::NameNode n | n.getId() = name and n.getScope() = m and name.charAt(0) != "_")
|
||||
or
|
||||
exists(Alias a | a.getAsname().(Name).getId() = name and a.getValue().getScope() = m)
|
||||
)
|
||||
@@ -207,12 +230,12 @@ module ImportResolution {
|
||||
|
||||
/** Gets a module that may have been added to `sys.modules`. */
|
||||
private Module sys_modules_module_with_name(string name) {
|
||||
exists(ControlFlowNode n, DataFlow::Node mod |
|
||||
exists(SubscriptNode sub |
|
||||
exists(Cfg::ControlFlowNode n, DataFlow::Node mod |
|
||||
exists(Cfg::SubscriptNode sub |
|
||||
sub.getObject() = sys_modules_reference().asCfgNode() and
|
||||
sub.getIndex() = n and
|
||||
n.getNode().(StringLiteral).getText() = name and
|
||||
sub.(DefinitionNode).getValue() = mod.asCfgNode() and
|
||||
sub.(Cfg::DefinitionNode).getValue() = mod.asCfgNode() and
|
||||
mod = getModuleReference(result)
|
||||
)
|
||||
)
|
||||
@@ -324,11 +347,11 @@ module ImportResolution {
|
||||
// name as a submodule, we always consider that this attribute _could_ be a
|
||||
// reference to the submodule, even if we don't know that the submodule has been
|
||||
// imported yet.
|
||||
exists(string submodule, Module package, EssaVariable var |
|
||||
exists(string submodule, Module package, SsaImpl::EssaVariable var |
|
||||
submodule = var.getName() and
|
||||
SsaSource::init_module_submodule_defn(var.getSourceVariable(), package.getEntryNode()) and
|
||||
initModuleSubmoduleDefn(var.getSourceVariable().getVariable(), package) and
|
||||
m = getModuleFromName(package.getPackageName() + "." + submodule) and
|
||||
result.asCfgNode() = var.getDefinition().(EssaNodeDefinition).getDefiningNode()
|
||||
result.asCfgNode() = var.getDefinition().(SsaImpl::EssaNodeDefinition).getDefiningNode()
|
||||
)
|
||||
}
|
||||
|
||||
|
||||
@@ -3,6 +3,7 @@ overlay[local]
|
||||
module;
|
||||
|
||||
private import python
|
||||
private import semmle.python.controlflow.internal.Cfg as Cfg
|
||||
private import semmle.python.dataflow.new.internal.Builtins
|
||||
private import semmle.python.dataflow.new.internal.ImportResolution
|
||||
private import semmle.python.dataflow.new.DataFlow
|
||||
@@ -15,7 +16,7 @@ module ImportStar {
|
||||
*/
|
||||
overlay[local]
|
||||
cached
|
||||
predicate namePossiblyDefinedInImportStar(NameNode n, string name, Scope s) {
|
||||
predicate namePossiblyDefinedInImportStar(Cfg::NameNode n, string name, Scope s) {
|
||||
n.isLoad() and
|
||||
name = n.getId() and
|
||||
s = n.getScope().getEnclosingScope*() and
|
||||
@@ -52,7 +53,7 @@ module ImportStar {
|
||||
/** Holds if a global variable called `name` is assigned a value in the module `m`. */
|
||||
cached
|
||||
predicate globalNameDefinedInModule(string name, Module m) {
|
||||
exists(NameNode n |
|
||||
exists(Cfg::NameNode n |
|
||||
not exists(LocalVariable v | n.defines(v)) and
|
||||
n.isStore() and
|
||||
name = n.getId() and
|
||||
@@ -66,7 +67,7 @@ module ImportStar {
|
||||
*/
|
||||
overlay[global]
|
||||
cached
|
||||
predicate importStarResolvesTo(NameNode n, Module m) {
|
||||
predicate importStarResolvesTo(Cfg::NameNode n, Module m) {
|
||||
m = getStarImported+(n.getEnclosingModule()) and
|
||||
globalNameDefinedInModule(n.getId(), m) and
|
||||
not isDefinedLocally(n.getNode())
|
||||
@@ -99,7 +100,7 @@ module ImportStar {
|
||||
*/
|
||||
overlay[local]
|
||||
cached
|
||||
ControlFlowNode potentialImportStarBase(Scope s) {
|
||||
result = any(ImportStarNode n | n.getScope() = s).getModule()
|
||||
Cfg::ControlFlowNode potentialImportStarBase(Scope s) {
|
||||
result = any(Cfg::ImportStarNode n | n.getScope() = s).getModule()
|
||||
}
|
||||
}
|
||||
|
||||
@@ -170,6 +170,8 @@ overlay[local]
|
||||
module;
|
||||
|
||||
private import python
|
||||
private import semmle.python.controlflow.internal.Cfg as Cfg
|
||||
private import semmle.python.dataflow.new.internal.SsaImpl as SsaImpl
|
||||
private import DataFlowPublic
|
||||
|
||||
/**
|
||||
@@ -178,7 +180,7 @@ private import DataFlowPublic
|
||||
* This class abstracts away the differing representations of comprehensions and
|
||||
* for statements.
|
||||
*/
|
||||
class ForTarget extends ControlFlowNode {
|
||||
class ForTarget extends Cfg::ControlFlowNode {
|
||||
Expr source;
|
||||
|
||||
ForTarget() {
|
||||
@@ -198,7 +200,7 @@ class ForTarget extends ControlFlowNode {
|
||||
}
|
||||
|
||||
/** The LHS of an assignment, it also records the assigned value. */
|
||||
class AssignmentTarget extends ControlFlowNode {
|
||||
class AssignmentTarget extends Cfg::ControlFlowNode {
|
||||
Expr value;
|
||||
|
||||
AssignmentTarget() {
|
||||
@@ -209,7 +211,7 @@ class AssignmentTarget extends ControlFlowNode {
|
||||
}
|
||||
|
||||
/** A direct (or top-level) target of an unpacking assignment. */
|
||||
class UnpackingAssignmentDirectTarget extends ControlFlowNode instanceof SequenceNode {
|
||||
class UnpackingAssignmentDirectTarget extends Cfg::ControlFlowNode instanceof Cfg::SequenceNode {
|
||||
Expr value;
|
||||
|
||||
UnpackingAssignmentDirectTarget() {
|
||||
@@ -222,7 +224,7 @@ class UnpackingAssignmentDirectTarget extends ControlFlowNode instanceof Sequenc
|
||||
}
|
||||
|
||||
/** A (possibly recursive) target of an unpacking assignment. */
|
||||
class UnpackingAssignmentTarget extends ControlFlowNode {
|
||||
class UnpackingAssignmentTarget extends Cfg::ControlFlowNode {
|
||||
UnpackingAssignmentTarget() {
|
||||
this instanceof UnpackingAssignmentDirectTarget
|
||||
or
|
||||
@@ -231,10 +233,11 @@ class UnpackingAssignmentTarget extends ControlFlowNode {
|
||||
}
|
||||
|
||||
/** A (possibly recursive) target of an unpacking assignment which is also a sequence. */
|
||||
class UnpackingAssignmentSequenceTarget extends UnpackingAssignmentTarget instanceof SequenceNode {
|
||||
ControlFlowNode getElement(int i) { result = super.getElement(i) }
|
||||
class UnpackingAssignmentSequenceTarget extends UnpackingAssignmentTarget instanceof Cfg::SequenceNode
|
||||
{
|
||||
Cfg::ControlFlowNode getElement(int i) { result = super.getElement(i) }
|
||||
|
||||
ControlFlowNode getAnElement() { result = this.getElement(_) }
|
||||
Cfg::ControlFlowNode getAnElement() { result = this.getElement(_) }
|
||||
}
|
||||
|
||||
/**
|
||||
@@ -255,7 +258,7 @@ predicate iterableUnpackingAssignmentFlowStep(Node nodeFrom, Node nodeTo) {
|
||||
predicate iterableUnpackingForReadStep(CfgNode nodeFrom, Content c, Node nodeTo) {
|
||||
exists(ForTarget target |
|
||||
nodeFrom.getNode().getNode() = target.getSource() and
|
||||
target instanceof SequenceNode and
|
||||
target instanceof Cfg::SequenceNode and
|
||||
nodeTo = TIterableSequenceNode(target)
|
||||
) and
|
||||
(
|
||||
@@ -323,11 +326,11 @@ predicate iterableUnpackingConvertingStoreStep(Node nodeFrom, Content c, Node no
|
||||
*/
|
||||
predicate iterableUnpackingElementReadStep(Node nodeFrom, Content c, Node nodeTo) {
|
||||
exists(
|
||||
UnpackingAssignmentSequenceTarget target, int index, ControlFlowNode element, int starIndex
|
||||
UnpackingAssignmentSequenceTarget target, int index, Cfg::ControlFlowNode element, int starIndex
|
||||
|
|
||||
target.getElement(starIndex) instanceof StarredNode
|
||||
target.getElement(starIndex) instanceof Cfg::StarredNode
|
||||
or
|
||||
not exists(target.getAnElement().(StarredNode)) and
|
||||
not exists(target.getAnElement().(Cfg::StarredNode)) and
|
||||
starIndex = -1
|
||||
|
|
||||
nodeFrom.(CfgNode).getNode() = target and
|
||||
@@ -342,18 +345,18 @@ predicate iterableUnpackingElementReadStep(Node nodeFrom, Content c, Node nodeTo
|
||||
else c.(TupleElementContent).getIndex() >= index - 1
|
||||
) and
|
||||
(
|
||||
if element instanceof SequenceNode
|
||||
if element instanceof Cfg::SequenceNode
|
||||
then
|
||||
// Step 5b
|
||||
nodeTo = TIterableSequenceNode(element)
|
||||
else
|
||||
if element instanceof StarredNode
|
||||
if element instanceof Cfg::StarredNode
|
||||
then
|
||||
// Step 5c
|
||||
nodeTo = TIterableElementNode(element)
|
||||
else
|
||||
// Step 5a
|
||||
exists(MultiAssignmentDefinition mad | element = mad.getDefiningNode() |
|
||||
exists(SsaImpl::MultiAssignmentDefinition mad | element = mad.getDefiningNode() |
|
||||
nodeTo.(CfgNode).getNode() = element
|
||||
)
|
||||
)
|
||||
@@ -366,7 +369,7 @@ predicate iterableUnpackingElementReadStep(Node nodeFrom, Content c, Node nodeTo
|
||||
* content type `ListElementContent`.
|
||||
*/
|
||||
predicate iterableUnpackingStarredElementStoreStep(Node nodeFrom, Content c, Node nodeTo) {
|
||||
exists(ControlFlowNode starred, MultiAssignmentDefinition mad |
|
||||
exists(Cfg::ControlFlowNode starred, SsaImpl::MultiAssignmentDefinition mad |
|
||||
starred.getNode() instanceof Starred and
|
||||
starred = mad.getDefiningNode()
|
||||
|
|
||||
|
||||
@@ -9,6 +9,7 @@ overlay[local]
|
||||
module;
|
||||
|
||||
private import python
|
||||
private import semmle.python.controlflow.internal.Cfg as Cfg
|
||||
import DataFlowPublic
|
||||
private import DataFlowPrivate
|
||||
private import semmle.python.internal.CachedStages
|
||||
@@ -314,7 +315,7 @@ private module Cached {
|
||||
*/
|
||||
cached
|
||||
predicate subscript(LocalSourceNode node, CfgNode subscript, CfgNode index) {
|
||||
exists(CfgNode seq, SubscriptNode subscriptNode | subscriptNode = subscript.getNode() |
|
||||
exists(CfgNode seq, Cfg::SubscriptNode subscriptNode | subscriptNode = subscript.getNode() |
|
||||
node.flowsTo(seq) and
|
||||
seq.getNode() = subscriptNode.getObject() and
|
||||
index.getNode() = subscriptNode.getIndex()
|
||||
|
||||
@@ -91,9 +91,7 @@ predicate matchAsFlowStep(Node nodeFrom, Node nodeTo) {
|
||||
or
|
||||
// the interior pattern flows to the alias
|
||||
nodeFrom.(CfgNode).getNode().getNode() = subject.getPattern() and
|
||||
exists(PatternAliasDefinition pad | pad.getDefiningNode().getNode() = alias |
|
||||
nodeTo.(CfgNode).getNode() = pad.getDefiningNode()
|
||||
)
|
||||
nodeTo.(CfgNode).getNode().getNode() = alias
|
||||
)
|
||||
}
|
||||
|
||||
@@ -124,11 +122,9 @@ predicate matchLiteralFlowStep(Node nodeFrom, Node nodeTo) {
|
||||
* syntax (toplevel): `case var:`
|
||||
*/
|
||||
predicate matchCaptureFlowStep(Node nodeFrom, Node nodeTo) {
|
||||
exists(MatchCapturePattern capture, Name var | capture.getVariable() = var |
|
||||
exists(MatchCapturePattern capture |
|
||||
nodeFrom.(CfgNode).getNode().getNode() = capture and
|
||||
exists(PatternCaptureDefinition pcd | pcd.getDefiningNode().getNode() = var |
|
||||
nodeTo.(CfgNode).getNode() = pcd.getDefiningNode()
|
||||
)
|
||||
nodeTo.(CfgNode).getNode().getNode() = capture.getVariable()
|
||||
)
|
||||
}
|
||||
|
||||
|
||||
547
python/ql/lib/semmle/python/dataflow/new/internal/SsaImpl.qll
Normal file
547
python/ql/lib/semmle/python/dataflow/new/internal/SsaImpl.qll
Normal file
@@ -0,0 +1,547 @@
|
||||
/**
|
||||
* Provides the Python SSA implementation built on the new (shared) CFG.
|
||||
*
|
||||
* Mirrors the Java SSA adapter at
|
||||
* `java/ql/lib/semmle/code/java/dataflow/internal/SsaImpl.qll`:
|
||||
* an `InputSig` is defined in terms of positional `(BasicBlock, int)`
|
||||
* variable references, and the shared
|
||||
* `codeql.ssa.Ssa::Make<Location, Cfg, Input>` module is then
|
||||
* instantiated.
|
||||
*
|
||||
* `SourceVariable` is the AST-level `Py::Variable`. Variable references
|
||||
* are looked up via the CFG facade's `NameNode.defines`/`uses`/`deletes`
|
||||
* predicates, which themselves are one-line bridges to AST-level
|
||||
* `Name.defines`/`uses`/`deletes`.
|
||||
*
|
||||
* Implicit-entry definitions are inserted for:
|
||||
* - non-local / global / builtin variables that are read in the scope
|
||||
* but never assigned (no enclosing CFG node defines them),
|
||||
* - captured variables (variables defined in an enclosing scope that
|
||||
* are read inside the scope), and
|
||||
* - parameters, but only if the corresponding parameter name is *not*
|
||||
* itself a CFG node. With the C#-style parameter wiring already
|
||||
* installed in `AstNodeImpl.qll`, parameter names *are* CFG nodes,
|
||||
* so the regular `variableWrite` path handles them — no `i = -1`
|
||||
* entry is needed for ordinary parameters.
|
||||
*/
|
||||
overlay[local?]
|
||||
module;
|
||||
|
||||
private import python as Py
|
||||
private import semmle.python.controlflow.internal.AstNodeImpl as CfgImpl
|
||||
private import semmle.python.controlflow.internal.Cfg as Cfg
|
||||
private import codeql.ssa.Ssa as SsaImplCommon
|
||||
private import codeql.controlflow.BasicBlock as BB
|
||||
|
||||
/**
|
||||
* Adapts the Python `Cfg` facade to the shared SSA library's `CfgSig`.
|
||||
* All members are inherited from `Cfg::ControlFlowNode` and
|
||||
* `Cfg::BasicBlock`.
|
||||
*/
|
||||
private module CfgForSsa implements BB::CfgSig<Py::Location> {
|
||||
class ControlFlowNode = CfgImpl::ControlFlowNode;
|
||||
|
||||
class BasicBlock = CfgImpl::BasicBlock;
|
||||
|
||||
class EntryBasicBlock = CfgImpl::Cfg::EntryBasicBlock;
|
||||
|
||||
predicate dominatingEdge = CfgImpl::Cfg::dominatingEdge/2;
|
||||
}
|
||||
|
||||
/**
|
||||
* A source variable for SSA, wrapping a Python AST `Variable`.
|
||||
*
|
||||
* We only track variables that are read at least once in their scope —
|
||||
* tracking write-only variables would be unnecessary work — *except*
|
||||
* for module-scope globals, where the "read" can be external (e.g.
|
||||
* `import mymodule; mymodule.x`). Such globals are tracked
|
||||
* unconditionally so that import-resolution can find their defining
|
||||
* write.
|
||||
*/
|
||||
private newtype TSsaSourceVariable =
|
||||
TPyVar(Py::Variable v) {
|
||||
// Has a use somewhere — read-relevant for SSA.
|
||||
exists(Cfg::NameNode n | n.uses(v))
|
||||
or
|
||||
// Or has a deletion (treated as a write that destroys the value).
|
||||
exists(Cfg::NameNode n | n.deletes(v))
|
||||
or
|
||||
// Or is a module-scope global written in this module — must be
|
||||
// tracked even if never read locally, because importers may read
|
||||
// it as an attribute on the module object.
|
||||
v.getScope() instanceof Py::Module and
|
||||
exists(Cfg::NameNode n | n.defines(v))
|
||||
or
|
||||
// Or is a parameter — parameters must always have a
|
||||
// `ParameterDefinition` for dataflow argument-routing to work,
|
||||
// even if the parameter is never read in its scope. Mirrors
|
||||
// legacy ESSA's `ParameterDefinition` (which fired for every
|
||||
// parameter binding regardless of liveness).
|
||||
exists(Py::Parameter p | p.asName() = v.getAStore())
|
||||
}
|
||||
|
||||
/**
|
||||
* A source variable for SSA, wrapping a Python AST `Variable`.
|
||||
*/
|
||||
class SsaSourceVariable extends TSsaSourceVariable {
|
||||
/** Gets the underlying Python AST variable. */
|
||||
Py::Variable getVariable() { this = TPyVar(result) }
|
||||
|
||||
/** Gets the (textual) name of this variable. */
|
||||
string getName() { result = this.getVariable().getId() }
|
||||
|
||||
/** Gets a textual representation of this source variable. */
|
||||
string toString() { result = this.getVariable().toString() }
|
||||
|
||||
/** Gets the location of this source variable. */
|
||||
Py::Location getLocation() { result = this.getVariable().getScope().getLocation() }
|
||||
|
||||
/** Gets the scope in which this variable lives. */
|
||||
Py::Scope getScope() { result = this.getVariable().getScope() }
|
||||
|
||||
/**
|
||||
* Gets a use of this variable as it appears in the source — a `NameNode`
|
||||
* that loads or deletes the variable. Mirrors legacy
|
||||
* `SsaSourceVariable.getASourceUse()`.
|
||||
*/
|
||||
Cfg::ControlFlowNode getASourceUse() {
|
||||
exists(Cfg::NameNode n | result = n |
|
||||
n.uses(this.getVariable()) or n.deletes(this.getVariable())
|
||||
)
|
||||
}
|
||||
|
||||
/**
|
||||
* Gets an implicit use of this variable. The new SSA does not have
|
||||
* implicit-use refinements, but we keep this for API parity — every
|
||||
* normal-exit of the variable's scope counts as a sink, ensuring
|
||||
* variables stay live to scope exit for taint-tracking.
|
||||
*/
|
||||
Cfg::ControlFlowNode getAnImplicitUse() {
|
||||
result.isNormalExit() and result.getScope() = this.getScope()
|
||||
}
|
||||
|
||||
/**
|
||||
* Gets a use of this variable — either an explicit source use or an
|
||||
* implicit use at scope exit. Mirrors legacy `SsaSourceVariable.getAUse()`.
|
||||
*/
|
||||
Cfg::ControlFlowNode getAUse() {
|
||||
result = this.getASourceUse() or result = this.getAnImplicitUse()
|
||||
}
|
||||
}
|
||||
|
||||
/**
|
||||
* Holds if `v` is a non-local read in scope `s`, in the sense that `s`
|
||||
* uses `v` but does not write it within `s`. This includes globals,
|
||||
* builtins, and variables captured from an enclosing function scope.
|
||||
*
|
||||
* The `Py::Variable` `v` lives in some defining scope (the module for
|
||||
* globals, an outer function for closures, etc.); the reading scope
|
||||
* `s` is the scope where the use of `v` occurs.
|
||||
*/
|
||||
private predicate nonLocalReadIn(Py::Variable v, Py::Scope s) {
|
||||
exists(Cfg::NameNode n |
|
||||
n.uses(v) and
|
||||
n.getScope() = s and
|
||||
not exists(Cfg::NameNode def | def.defines(v) and def.getScope() = s)
|
||||
) and
|
||||
// Match legacy ESSA: only create entry defs for variables that have
|
||||
// at least one defining store somewhere — otherwise the entry def
|
||||
// represents "nothing reaches here", which is the default anyway and
|
||||
// introduces no useful flow. (Legacy's `ModuleVariable` required a
|
||||
// store; this is the closure-aware generalisation.)
|
||||
exists(Cfg::NameNode store | store.defines(v))
|
||||
}
|
||||
|
||||
/**
|
||||
* Holds if `bb` is the entry basic block of a scope where `v` should
|
||||
* have an implicit entry definition. This covers:
|
||||
* - non-local / global / builtin variables read in `s`, and
|
||||
* - captured variables (defined in an enclosing scope but read in `s`).
|
||||
*
|
||||
* Each reading scope gets its own entry def, so a closure variable can
|
||||
* have multiple entry defs across all functions/methods that read it.
|
||||
*
|
||||
* Parameters are *not* included: their bound `Name` is itself a CFG
|
||||
* node (per the C#-style parameter wiring), so `variableWrite` fires at
|
||||
* the parameter's natural CFG index.
|
||||
*/
|
||||
private predicate hasEntryDefIn(SsaSourceVariable v, CfgImpl::BasicBlock bb) {
|
||||
exists(Py::Scope s |
|
||||
nonLocalReadIn(v.getVariable(), s) and
|
||||
bb = entryBlock(s)
|
||||
)
|
||||
}
|
||||
|
||||
/**
|
||||
* Gets the entry basic block of scope `s`, where implicit entry
|
||||
* definitions are placed (at synthetic index `-1`).
|
||||
*/
|
||||
private CfgImpl::BasicBlock entryBlock(Py::Scope s) {
|
||||
exists(CfgImpl::ControlFlowNode entry |
|
||||
entry instanceof CfgImpl::ControlFlow::EntryNode and
|
||||
entry.getEnclosingCallable().asScope() = s and
|
||||
result = entry.getBasicBlock()
|
||||
)
|
||||
}
|
||||
|
||||
/**
|
||||
* The SSA `InputSig` for Python. References are positional
|
||||
* `(BasicBlock, int)` pairs into the new CFG.
|
||||
*/
|
||||
private module SsaImplInput implements SsaImplCommon::InputSig<Py::Location, CfgImpl::BasicBlock> {
|
||||
class SourceVariable = SsaSourceVariable;
|
||||
|
||||
predicate variableWrite(CfgImpl::BasicBlock bb, int i, SourceVariable v, boolean certain) {
|
||||
// Explicit binding at a CFG node — includes assignments,
|
||||
// parameter Names (wired in via the C# pattern), exception-handler
|
||||
// `as`-bindings, import aliases, and match-pattern captures.
|
||||
exists(Cfg::NameNode n |
|
||||
bb.getNode(i) = n and
|
||||
n.defines(v.getVariable()) and
|
||||
certain = true
|
||||
)
|
||||
or
|
||||
// `del x` — removes the binding. Modelled as a certain write that
|
||||
// makes any subsequent read invalid.
|
||||
exists(Cfg::NameNode n |
|
||||
bb.getNode(i) = n and
|
||||
n.deletes(v.getVariable()) and
|
||||
certain = true
|
||||
)
|
||||
or
|
||||
// Implicit entry definition for non-local / captured / global /
|
||||
// builtin variables read in some scope. Each reading scope's entry
|
||||
// block gets one such write, allowing closures: e.g. when `x` is a
|
||||
// parameter of an outer function and read inside a nested
|
||||
// function, both scopes get entry defs for `x`.
|
||||
hasEntryDefIn(v, bb) and
|
||||
i = -1 and
|
||||
certain = true
|
||||
or
|
||||
// `from X import *` — possibly rebinds every name in the importing
|
||||
// scope. Modelled as an uncertain write at the import-star's CFG
|
||||
// position for every variable that lives in (or is referenced
|
||||
// from) the same scope as the import-star. Mirrors legacy ESSA's
|
||||
// `ImportStarRefinement` (see `essa/SsaDefinitions.qll`'s
|
||||
// `import_star_refinement` predicate). The write is uncertain so
|
||||
// that prior definitions of the variable remain available — the
|
||||
// shared-SSA `SsaUncertainWrite` merges the new value with the
|
||||
// immediately preceding definition.
|
||||
exists(Cfg::ImportStarNode imp |
|
||||
bb.getNode(i) = imp and
|
||||
certain = false and
|
||||
(
|
||||
v.getVariable().getScope() = imp.getScope()
|
||||
or
|
||||
// Variable is defined in some other scope but referenced in
|
||||
// the same scope as the import-star (matches legacy clause 2:
|
||||
// `other.uses(v) and def.getScope() = other.getScope()`).
|
||||
exists(Cfg::NameNode other |
|
||||
other.uses(v.getVariable()) and
|
||||
imp.getScope() = other.getScope()
|
||||
)
|
||||
)
|
||||
)
|
||||
}
|
||||
|
||||
predicate variableRead(CfgImpl::BasicBlock bb, int i, SourceVariable v, boolean certain) {
|
||||
// Explicit source use — a `Name` load or a `del x` of the variable.
|
||||
exists(Cfg::NameNode n |
|
||||
bb.getNode(i) = n and
|
||||
n.uses(v.getVariable()) and
|
||||
certain = true
|
||||
)
|
||||
or
|
||||
// Synthetic use at the normal exit of the variable's defining scope.
|
||||
// This keeps every variable live to scope exit so that callers (e.g.
|
||||
// `module_export` in ImportResolution.qll, or taint-tracking pass-through
|
||||
// through unread locals) can ask "which definition reaches end of
|
||||
// scope?". Mirrors legacy ESSA's `SsaSourceVariable.getAUse()` which
|
||||
// included `getScope().getANormalExit()`.
|
||||
exists(Cfg::ControlFlowNode exit |
|
||||
exit.isNormalExit() and
|
||||
exit.getScope() = v.getVariable().getScope() and
|
||||
bb.getNode(i) = exit and
|
||||
certain = true
|
||||
)
|
||||
}
|
||||
}
|
||||
|
||||
/**
|
||||
* The shared SSA instantiation for Python.
|
||||
*
|
||||
* Members:
|
||||
* - `Definition` — the union of explicit, uncertain, and phi definitions
|
||||
* - `WriteDefinition`, `UncertainWriteDefinition`, `PhiNode`
|
||||
* - the standard SSA predicates (`getAUse`, `getAnUltimateDefinition`, ...).
|
||||
*/
|
||||
module Ssa = SsaImplCommon::Make<Py::Location, CfgForSsa, SsaImplInput>;
|
||||
|
||||
final class Definition = Ssa::Definition;
|
||||
|
||||
final class WriteDefinition = Ssa::WriteDefinition;
|
||||
|
||||
final class UncertainWriteDefinition = Ssa::UncertainWriteDefinition;
|
||||
|
||||
final class PhiNode = Ssa::PhiNode;
|
||||
|
||||
// ===========================================================================
|
||||
// ESSA-shaped adapter layer
|
||||
//
|
||||
// The dataflow library (`python/ql/lib/semmle/python/dataflow/new/`) and
|
||||
// related modules (`ApiGraphs.qll`, etc.) consume the legacy ESSA API
|
||||
// (`EssaVariable`, `EssaDefinition`, `AssignmentDefinition`,
|
||||
// `ScopeEntryDefinition`, `ParameterDefinition`, `WithDefinition`,
|
||||
// `PhiFunction`, plus the `AdjacentUses` module). To migrate them off
|
||||
// the legacy CFG, we expose the same API surface on top of the
|
||||
// shared SSA built above.
|
||||
//
|
||||
// This adapter is intentionally narrow: it covers only the predicates
|
||||
// that new dataflow consumes. The richer legacy ESSA — refinement
|
||||
// nodes, attribute refinements, edge refinements — stays available
|
||||
// via `semmle.python.essa.Essa` for points-to / legacy code.
|
||||
// ===========================================================================
|
||||
/**
|
||||
* Gets the CFG node at which a write definition's binding takes place.
|
||||
*
|
||||
* For ordinary writes (assignment, deletion, parameter) this is the
|
||||
* canonical CFG node of the bound Name. For implicit entry definitions
|
||||
* (synthesised at position `-1` of a scope's entry BB) this is the
|
||||
* scope's entry node.
|
||||
*/
|
||||
private Cfg::ControlFlowNode writeDefNode(Ssa::WriteDefinition def) {
|
||||
exists(CfgImpl::BasicBlock bb, int i | def.definesAt(_, bb, i) |
|
||||
i >= 0 and result = bb.getNode(i)
|
||||
or
|
||||
i = -1 and result = bb.getNode(0)
|
||||
)
|
||||
}
|
||||
|
||||
/**
|
||||
* A write definition whose binding has a corresponding CFG node — i.e.
|
||||
* everything that's not a phi node. Mirrors legacy ESSA's
|
||||
* `EssaNodeDefinition`.
|
||||
*/
|
||||
class EssaNodeDefinition extends Ssa::WriteDefinition {
|
||||
/** Gets the CFG node where this definition's binding takes place. */
|
||||
Cfg::ControlFlowNode getDefiningNode() { result = writeDefNode(this) }
|
||||
|
||||
/** Gets the variable defined here (legacy name). */
|
||||
SsaSourceVariable getVariable() { result = this.getSourceVariable() }
|
||||
|
||||
/** Gets the enclosing scope. */
|
||||
Py::Scope getScope() {
|
||||
exists(Cfg::ControlFlowNode n | n = this.getDefiningNode() | result = n.getScope())
|
||||
}
|
||||
|
||||
/**
|
||||
* Holds if this definition defines source variable `v` at CFG node
|
||||
* `defNode`. Flatter form of `getSourceVariable()` +
|
||||
* `getDefiningNode()`, matching legacy ESSA's `definedBy`.
|
||||
*/
|
||||
predicate definedBy(SsaSourceVariable v, Cfg::ControlFlowNode defNode) {
|
||||
v = this.getSourceVariable() and defNode = this.getDefiningNode()
|
||||
}
|
||||
}
|
||||
|
||||
/**
|
||||
* An assignment definition: any binding where the value being assigned
|
||||
* is statically known via `Cfg::DefinitionNode.getValue()`. Includes
|
||||
* plain assignments, walrus, annotated assignments, augmented
|
||||
* assignments, import aliases (`import x` / `from m import x [as y]`),
|
||||
* `with ... as x`, and for-target bindings (where `getValue()` returns
|
||||
* the iter expression's CFG node). Excludes parameter bindings —
|
||||
* those are modelled by `ParameterDefinition`.
|
||||
*/
|
||||
class AssignmentDefinition extends EssaNodeDefinition {
|
||||
AssignmentDefinition() {
|
||||
exists(Cfg::NameNode n | n = this.getDefiningNode() |
|
||||
exists(n.(Cfg::DefinitionNode).getValue()) and
|
||||
not n.(Cfg::ControlFlowNode).isParameter()
|
||||
)
|
||||
}
|
||||
|
||||
/** Gets the CFG node for the value being assigned, if statically known. */
|
||||
Cfg::ControlFlowNode getValue() {
|
||||
result = this.getDefiningNode().(Cfg::DefinitionNode).getValue()
|
||||
}
|
||||
}
|
||||
|
||||
/**
|
||||
* A parameter definition — the binding of a parameter name in a
|
||||
* function's scope.
|
||||
*/
|
||||
class ParameterDefinition extends EssaNodeDefinition {
|
||||
ParameterDefinition() { this.getDefiningNode().isParameter() }
|
||||
|
||||
/** Gets the AST `Parameter` (a `Py::Name` in param context). */
|
||||
Py::Name getParameter() { result = this.getDefiningNode().getNode() }
|
||||
}
|
||||
|
||||
/**
|
||||
* A definition introduced by a `with ... as x:` clause.
|
||||
*/
|
||||
class WithDefinition extends EssaNodeDefinition {
|
||||
WithDefinition() {
|
||||
exists(Cfg::NameNode n, Py::With w |
|
||||
n = this.getDefiningNode() and
|
||||
w.getOptionalVars() = n.getNode()
|
||||
)
|
||||
}
|
||||
}
|
||||
|
||||
/**
|
||||
* An assignment where the LHS is a tuple/list and the RHS is unpacked:
|
||||
* `a, b = (1, 2)` or `a, *rest = xs`. The SSA def lives at the inner
|
||||
* `Name` CFG node, but for IterableUnpacking integration we expose
|
||||
* the enclosing `StarredNode` as the `getDefiningNode()` for `*rest`
|
||||
* patterns — mirroring legacy ESSA's `multi_assignment_definition`,
|
||||
* which placed the def at the StarredNode CFG node.
|
||||
*/
|
||||
class MultiAssignmentDefinition extends EssaNodeDefinition {
|
||||
MultiAssignmentDefinition() {
|
||||
exists(Cfg::NameNode n | n = super.getDefiningNode() |
|
||||
exists(Py::Assign a, Py::Expr lhs |
|
||||
a.getATarget() = lhs and
|
||||
(lhs instanceof Py::Tuple or lhs instanceof Py::List) and
|
||||
lhs.getASubExpression+() = n.getNode()
|
||||
)
|
||||
or
|
||||
// For-loop with tuple/list target: `for a, b in xs:` —
|
||||
// tuple-unpacking semantics applies to the for-target.
|
||||
exists(Py::For f, Py::Expr lhs |
|
||||
f.getTarget() = lhs and
|
||||
(lhs instanceof Py::Tuple or lhs instanceof Py::List) and
|
||||
lhs.getASubExpression+() = n.getNode()
|
||||
)
|
||||
)
|
||||
}
|
||||
|
||||
override Cfg::ControlFlowNode getDefiningNode() {
|
||||
// Default: the underlying `Name` CFG node (where the SSA def lives).
|
||||
not exists(Cfg::StarredNode s |
|
||||
s.getNode().(Py::Starred).getValue() = super.getDefiningNode().getNode()
|
||||
) and
|
||||
result = super.getDefiningNode()
|
||||
or
|
||||
// Exception: for `*rest`, expose the enclosing `Starred` CFG node
|
||||
// so that `IterableUnpacking::iterableUnpackingStarredElementStoreStep`
|
||||
// can attach the rest-list to it.
|
||||
exists(Cfg::StarredNode s |
|
||||
s.getNode().(Py::Starred).getValue() = super.getDefiningNode().getNode()
|
||||
|
|
||||
result = s
|
||||
)
|
||||
}
|
||||
}
|
||||
|
||||
/**
|
||||
* An implicit entry definition for a non-local / captured / global /
|
||||
* builtin variable read in a scope but not defined there.
|
||||
*
|
||||
* Inherits from `EssaNodeDefinition` and exposes the scope's entry node
|
||||
* as its defining node (matching legacy ESSA semantics).
|
||||
*/
|
||||
class ScopeEntryDefinition extends EssaNodeDefinition {
|
||||
ScopeEntryDefinition() {
|
||||
exists(CfgImpl::BasicBlock bb |
|
||||
this.definesAt(_, bb, -1) and
|
||||
bb instanceof CfgImpl::Cfg::EntryBasicBlock
|
||||
)
|
||||
}
|
||||
|
||||
/** Gets the enclosing scope (the scope whose entry block this def is in). */
|
||||
override Py::Scope getScope() {
|
||||
exists(CfgImpl::BasicBlock bb |
|
||||
this.definesAt(_, bb, -1) and
|
||||
result = bb.getNode(0).(Cfg::ControlFlowNode).getScope()
|
||||
)
|
||||
}
|
||||
}
|
||||
|
||||
/** A phi node (alias matching legacy naming). */
|
||||
class PhiFunction extends PhiNode {
|
||||
/**
|
||||
* Gets an input to this phi function (a definition that flows into
|
||||
* the phi from one of its predecessor blocks). Mirrors legacy
|
||||
* ESSA's `PhiFunction.getAnInput()`.
|
||||
*/
|
||||
Ssa::Definition getAnInput() { Ssa::phiHasInputFromBlock(this, result, _) }
|
||||
}
|
||||
|
||||
/** Base class for all ESSA definitions (legacy-shaped). */
|
||||
class EssaDefinition = Ssa::Definition;
|
||||
|
||||
/**
|
||||
* An adapter representing a single SSA-defined "variable" — wrapping
|
||||
* one `Ssa::Definition`. Mirrors legacy `EssaVariable` API.
|
||||
*/
|
||||
class EssaVariable extends Ssa::Definition {
|
||||
/** Gets the underlying SSA definition (legacy name). */
|
||||
Ssa::Definition getDefinition() { result = this }
|
||||
|
||||
/**
|
||||
* Gets a CFG node where this definition is used. Includes regular
|
||||
* `Name` reads as well as the synthetic scope-exit "use" registered
|
||||
* via `SsaImplInput::variableRead` — mirrors legacy ESSA's
|
||||
* `EssaVariable.getAUse()` which inherited the synthetic exit-use
|
||||
* from `SsaSourceVariable`.
|
||||
*/
|
||||
Cfg::ControlFlowNode getAUse() {
|
||||
exists(CfgImpl::BasicBlock bb, int i |
|
||||
Ssa::ssaDefReachesRead(this.getSourceVariable(), this, bb, i) and
|
||||
bb.getNode(i) = result
|
||||
)
|
||||
}
|
||||
|
||||
/** Gets the (textual) name of the underlying variable. */
|
||||
string getName() { result = this.getSourceVariable().getVariable().getId() }
|
||||
|
||||
/** Gets the scope in which this variable lives. */
|
||||
Py::Scope getScope() { result = this.getSourceVariable().getVariable().getScope() }
|
||||
|
||||
/** Gets an ultimate non-phi ancestor of this definition. */
|
||||
EssaVariable getAnUltimateDefinition() {
|
||||
if this instanceof PhiNode
|
||||
then
|
||||
exists(Ssa::Definition input |
|
||||
Ssa::phiHasInputFromBlock(this, input, _) and
|
||||
result = input.(EssaVariable).getAnUltimateDefinition()
|
||||
)
|
||||
else result = this
|
||||
}
|
||||
}
|
||||
|
||||
/**
|
||||
* Adjacent use-use and def-use relations exposed by the shared SSA
|
||||
* library. Provides the same interface as legacy
|
||||
* `semmle.python.essa.SsaCompute::AdjacentUses`.
|
||||
*/
|
||||
module AdjacentUses {
|
||||
/** Holds if `nodeFrom` and `nodeTo` are adjacent uses of the same SSA variable. */
|
||||
predicate adjacentUseUse(Cfg::NameNode nodeFrom, Cfg::NameNode nodeTo) {
|
||||
exists(SsaSourceVariable v, CfgImpl::BasicBlock bb1, int i1, CfgImpl::BasicBlock bb2, int i2 |
|
||||
Ssa::adjacentUseUse(bb1, i1, bb2, i2, v, _) and
|
||||
nodeFrom = bb1.getNode(i1) and
|
||||
nodeTo = bb2.getNode(i2)
|
||||
)
|
||||
}
|
||||
|
||||
/** Holds if `use` is a first use of definition `def`. */
|
||||
predicate firstUse(Ssa::Definition def, Cfg::NameNode use) {
|
||||
exists(CfgImpl::BasicBlock bb, int i |
|
||||
Ssa::firstUse(def, bb, i, _) and
|
||||
use = bb.getNode(i)
|
||||
)
|
||||
}
|
||||
|
||||
/**
|
||||
* Holds if `use` is any reachable use of definition `def`. Combines
|
||||
* `firstUse` with transitive use-use adjacency.
|
||||
*/
|
||||
predicate useOfDef(Ssa::Definition def, Cfg::NameNode use) {
|
||||
firstUse(def, use)
|
||||
or
|
||||
exists(Cfg::NameNode mid | useOfDef(def, mid) and adjacentUseUse(mid, use))
|
||||
}
|
||||
}
|
||||
@@ -1,4 +1,6 @@
|
||||
private import python
|
||||
private import semmle.python.controlflow.internal.Cfg as Cfg
|
||||
private import semmle.python.dataflow.new.internal.SsaImpl as SsaImpl
|
||||
private import semmle.python.dataflow.new.DataFlow
|
||||
private import semmle.python.dataflow.new.internal.DataFlowPrivate as DataFlowPrivate
|
||||
private import FlowSummaryImpl as FlowSummaryImpl
|
||||
@@ -75,7 +77,7 @@ import Cached
|
||||
* and isn't a big problem in practice.
|
||||
*/
|
||||
predicate concatStep(DataFlow::CfgNode nodeFrom, DataFlow::CfgNode nodeTo) {
|
||||
exists(BinaryExprNode add | add = nodeTo.getNode() |
|
||||
exists(Cfg::BinaryExprNode add | add = nodeTo.getNode() |
|
||||
add.getOp() instanceof Add and add.getAnOperand() = nodeFrom.getNode()
|
||||
)
|
||||
}
|
||||
@@ -84,7 +86,7 @@ predicate concatStep(DataFlow::CfgNode nodeFrom, DataFlow::CfgNode nodeTo) {
|
||||
* Holds if taint can flow from `nodeFrom` to `nodeTo` with a step related to subscripting.
|
||||
*/
|
||||
predicate subscriptStep(DataFlow::CfgNode nodeFrom, DataFlow::CfgNode nodeTo) {
|
||||
nodeTo.getNode().(SubscriptNode).getObject() = nodeFrom.getNode()
|
||||
nodeTo.getNode().(Cfg::SubscriptNode).getObject() = nodeFrom.getNode()
|
||||
}
|
||||
|
||||
/**
|
||||
@@ -100,15 +102,15 @@ predicate stringManipulation(DataFlow::CfgNode nodeFrom, DataFlow::CfgNode nodeT
|
||||
(
|
||||
call = API::builtin(["str", "bytes", "unicode"]).getACall()
|
||||
or
|
||||
call.getFunction().asCfgNode().(NameNode).getId() in ["str", "bytes", "unicode"]
|
||||
call.getFunction().asCfgNode().(Cfg::NameNode).getId() in ["str", "bytes", "unicode"]
|
||||
) and
|
||||
nodeFrom in [call.getArg(0), call.getArgByName("object")]
|
||||
)
|
||||
or
|
||||
// String methods. Note that this doesn't recognize `meth = "foo".upper; meth()`
|
||||
exists(CallNode call, string method_name, ControlFlowNode object |
|
||||
exists(Cfg::CallNode call, string method_name, Cfg::ControlFlowNode object |
|
||||
call = nodeTo.getNode() and
|
||||
object = call.getFunction().(AttrNode).getObject(method_name)
|
||||
object = call.getFunction().(Cfg::AttrNode).getObject(method_name)
|
||||
|
|
||||
nodeFrom.getNode() = object and
|
||||
method_name in [
|
||||
@@ -139,7 +141,7 @@ predicate stringManipulation(DataFlow::CfgNode nodeFrom, DataFlow::CfgNode nodeT
|
||||
)
|
||||
or
|
||||
// % formatting
|
||||
exists(BinaryExprNode fmt | fmt = nodeTo.getNode() |
|
||||
exists(Cfg::BinaryExprNode fmt | fmt = nodeTo.getNode() |
|
||||
fmt.getOp() instanceof Mod and
|
||||
(
|
||||
fmt.getLeft() = nodeFrom.getNode()
|
||||
@@ -149,7 +151,7 @@ predicate stringManipulation(DataFlow::CfgNode nodeFrom, DataFlow::CfgNode nodeT
|
||||
)
|
||||
or
|
||||
// string multiplication -- `"foo" * 10`
|
||||
exists(BinaryExprNode mult | mult = nodeTo.getNode() |
|
||||
exists(Cfg::BinaryExprNode mult | mult = nodeTo.getNode() |
|
||||
mult.getOp() instanceof Mult and
|
||||
mult.getLeft() = nodeFrom.getNode()
|
||||
)
|
||||
@@ -207,8 +209,8 @@ predicate awaitStep(DataFlow::Node nodeFrom, DataFlow::Node nodeTo) {
|
||||
* the variable `f` is tainted if the result of `open("foo")` is tainted.
|
||||
*/
|
||||
predicate asyncWithStep(DataFlow::Node nodeFrom, DataFlow::Node nodeTo) {
|
||||
exists(With with, ControlFlowNode contextManager, ControlFlowNode var |
|
||||
var = any(WithDefinition wd).getDefiningNode()
|
||||
exists(With with, Cfg::ControlFlowNode contextManager, Cfg::ControlFlowNode var |
|
||||
var = any(SsaImpl::WithDefinition wd).getDefiningNode()
|
||||
|
|
||||
nodeFrom.(DataFlow::CfgNode).getNode() = contextManager and
|
||||
nodeTo.(DataFlow::CfgNode).getNode() = var and
|
||||
|
||||
@@ -2,6 +2,8 @@ import codeql.util.Unit
|
||||
import codeql.typetracking.TypeTracking as Shared
|
||||
import codeql.typetracking.internal.TypeTrackingImpl as SharedImpl
|
||||
private import python
|
||||
private import semmle.python.controlflow.internal.Cfg as Cfg
|
||||
private import semmle.python.dataflow.new.internal.SsaImpl as SsaImpl
|
||||
private import semmle.python.internal.CachedStages
|
||||
private import semmle.python.dataflow.new.internal.DataFlowPublic as DataFlowPublic
|
||||
private import semmle.python.dataflow.new.internal.DataFlowPrivate as DataFlowPrivate
|
||||
@@ -94,8 +96,10 @@ private module SummaryTypeTrackerInput implements SummaryTypeTracker::Input {
|
||||
Node returnOf(Node callable, SummaryComponent return) {
|
||||
return = FlowSummaryImpl::Private::SummaryComponent::return() and
|
||||
// `result` should be the return value of a callable expression (lambda or function) referenced by `callable`
|
||||
result.asCfgNode() =
|
||||
callable.getALocalSource().asExpr().(CallableExpr).getInnerScope().getAReturnValueFlowNode()
|
||||
exists(Return ret |
|
||||
ret.getScope() = callable.getALocalSource().asExpr().(CallableExpr).getInnerScope() and
|
||||
result.asCfgNode().getNode() = ret.getValue()
|
||||
)
|
||||
}
|
||||
|
||||
// Relating callables to nodes
|
||||
@@ -160,7 +164,7 @@ module TypeTrackingInput implements Shared::TypeTrackingInput<Location> {
|
||||
// ignore the flow steps from the synthetic sequence node to the real sequence node,
|
||||
// since we only support one level of content in type-trackers, and the nested
|
||||
// structure requires two levels at least to be useful.
|
||||
not exists(SequenceNode outer |
|
||||
not exists(Cfg::SequenceNode outer |
|
||||
outer.getAnElement() = nodeTo.asCfgNode() and
|
||||
IterableUnpacking::iterableUnpackingTupleFlowStep(nodeFrom, nodeTo)
|
||||
)
|
||||
@@ -259,7 +263,7 @@ module TypeTrackingInput implements Shared::TypeTrackingInput<Location> {
|
||||
// Since we only support one level of content in type-trackers we don't actually
|
||||
// support `(aa, ab), (ba, bb) = ...`. Therefore we exclude the read-step from `(aa,
|
||||
// ab)` to `aa` (since it is not needed).
|
||||
not exists(SequenceNode outer |
|
||||
not exists(Cfg::SequenceNode outer |
|
||||
outer.getAnElement() = nodeFrom.asCfgNode() and
|
||||
IterableUnpacking::iterableUnpackingTupleFlowStep(_, nodeFrom)
|
||||
) and
|
||||
@@ -269,7 +273,7 @@ module TypeTrackingInput implements Shared::TypeTrackingInput<Location> {
|
||||
IterableUnpacking::iterableUnpackingForReadStep(_, _, seq) and
|
||||
IterableUnpacking::iterableUnpackingConvertingReadStep(seq, _, elem) and
|
||||
IterableUnpacking::iterableUnpackingConvertingStoreStep(elem, _, nodeFrom) and
|
||||
nodeFrom.asCfgNode() instanceof SequenceNode
|
||||
nodeFrom.asCfgNode() instanceof Cfg::SequenceNode
|
||||
)
|
||||
or
|
||||
TypeTrackerSummaryFlow::basicLoadStep(nodeFrom, nodeTo, content)
|
||||
@@ -306,13 +310,15 @@ module TypeTrackingInput implements Shared::TypeTrackingInput<Location> {
|
||||
//
|
||||
// nodeFrom is `expr`
|
||||
// nodeTo is entry node for `f`
|
||||
exists(ScopeEntryDefinition e, SsaSourceVariable var, DefinitionNode def |
|
||||
exists(
|
||||
SsaImpl::ScopeEntryDefinition e, SsaImpl::SsaSourceVariable var, Cfg::DefinitionNode def
|
||||
|
|
||||
e.getSourceVariable() = var and
|
||||
var.hasDefiningNode(def)
|
||||
def.getNode() = var.getVariable().getAStore()
|
||||
|
|
||||
nodeTo.(DataFlowPublic::ScopeEntryDefinitionNode).getDefinition() = e and
|
||||
nodeFrom.asCfgNode() = def and
|
||||
var.getScope().getScope*() = nodeFrom.getScope()
|
||||
var.getVariable().getScope().getScope*() = nodeFrom.getScope()
|
||||
)
|
||||
}
|
||||
|
||||
|
||||
@@ -3,6 +3,9 @@ overlay[local]
|
||||
module;
|
||||
|
||||
private import python
|
||||
private import semmle.python.controlflow.internal.Cfg as Cfg
|
||||
private import semmle.python.controlflow.internal.AstNodeImpl as CfgImpl
|
||||
private import semmle.python.dataflow.new.internal.SsaImpl as SsaImpl
|
||||
private import DataFlowPublic
|
||||
private import semmle.python.dataflow.new.internal.DataFlowPrivate
|
||||
private import codeql.dataflow.VariableCapture as Shared
|
||||
@@ -14,10 +17,10 @@ private import codeql.dataflow.VariableCapture as Shared
|
||||
// The first is the main implementation, the second is a performance motivated restriction.
|
||||
// The restriction is to clear any `CapturedVariableContent` before writing a new one
|
||||
// to avoid long access paths (see the link for a nice explanation).
|
||||
private module CaptureInput implements Shared::InputSig<Location, Cfg::BasicBlock> {
|
||||
private module CaptureInput implements Shared::InputSig<Location, CfgImpl::BasicBlock> {
|
||||
private import python as PY
|
||||
|
||||
additional class ExprCfgNode extends ControlFlowNode {
|
||||
additional class ExprCfgNode extends Cfg::ControlFlowNode {
|
||||
ExprCfgNode() { isExpressionNode(this) }
|
||||
}
|
||||
|
||||
@@ -25,7 +28,9 @@ private module CaptureInput implements Shared::InputSig<Location, Cfg::BasicBloc
|
||||
predicate isConstructor() { none() }
|
||||
}
|
||||
|
||||
Callable basicBlockGetEnclosingCallable(Cfg::BasicBlock bb) { result = bb.getScope() }
|
||||
Callable basicBlockGetEnclosingCallable(CfgImpl::BasicBlock bb) {
|
||||
result = bb.getEnclosingCallable().asScope()
|
||||
}
|
||||
|
||||
class CapturedVariable extends LocalVariable {
|
||||
Function f;
|
||||
@@ -51,27 +56,29 @@ private module CaptureInput implements Shared::InputSig<Location, Cfg::BasicBloc
|
||||
class CapturedParameter extends CapturedVariable {
|
||||
CapturedParameter() { this.isParameter() }
|
||||
|
||||
ControlFlowNode getCfgNode() { result.getNode().(Parameter) = this.getAnAccess() }
|
||||
Cfg::ControlFlowNode getCfgNode() { result.getNode().(Parameter) = this.getAnAccess() }
|
||||
}
|
||||
|
||||
class Expr extends ExprCfgNode {
|
||||
predicate hasCfgNode(Cfg::BasicBlock bb, int i) { this = bb.getNode(i) }
|
||||
predicate hasCfgNode(CfgImpl::BasicBlock bb, int i) { this = bb.getNode(i) }
|
||||
}
|
||||
|
||||
class VariableWrite extends ControlFlowNode {
|
||||
class VariableWrite extends Cfg::ControlFlowNode {
|
||||
CapturedVariable v;
|
||||
|
||||
VariableWrite() { this = v.getAStore().getAFlowNode().(DefinitionNode).getValue() }
|
||||
VariableWrite() {
|
||||
exists(Cfg::DefinitionNode d | d.getNode() = v.getAStore() | this = d.getValue())
|
||||
}
|
||||
|
||||
CapturedVariable getVariable() { result = v }
|
||||
|
||||
predicate hasCfgNode(Cfg::BasicBlock bb, int i) { this = bb.getNode(i) }
|
||||
predicate hasCfgNode(CfgImpl::BasicBlock bb, int i) { this = bb.getNode(i) }
|
||||
}
|
||||
|
||||
class VariableRead extends Expr {
|
||||
CapturedVariable v;
|
||||
|
||||
VariableRead() { this = v.getALoad().getAFlowNode() }
|
||||
VariableRead() { this.getNode() = v.getALoad() }
|
||||
|
||||
CapturedVariable getVariable() { result = v }
|
||||
}
|
||||
@@ -80,9 +87,14 @@ private module CaptureInput implements Shared::InputSig<Location, Cfg::BasicBloc
|
||||
// TODO: Other languages have an extra case here looking like
|
||||
// simpleAstFlowStep(nodeFrom, nodeTo)
|
||||
// we should investigate the potential benefit of adding that.
|
||||
exists(SsaVariable def |
|
||||
exists(SsaImpl::EssaVariable def |
|
||||
def.getAUse() = nodeTo and
|
||||
def.getAnUltimateDefinition().getDefinition().(DefinitionNode).getValue() = nodeFrom
|
||||
def.getAnUltimateDefinition()
|
||||
.getDefinition()
|
||||
.(SsaImpl::EssaNodeDefinition)
|
||||
.getDefiningNode()
|
||||
.(Cfg::DefinitionNode)
|
||||
.getValue() = nodeFrom
|
||||
)
|
||||
}
|
||||
|
||||
@@ -107,7 +119,7 @@ class CapturedVariable = CaptureInput::CapturedVariable;
|
||||
|
||||
class ClosureExpr = CaptureInput::ClosureExpr;
|
||||
|
||||
module Flow = Shared::Flow<Location, Cfg, CaptureInput>;
|
||||
module Flow = Shared::Flow<Location, Cfg::CfgSigImpl, CaptureInput>;
|
||||
|
||||
private Flow::ClosureNode asClosureNode(Node n) {
|
||||
result = n.(SynthCaptureNode).getSynthesizedCaptureNode()
|
||||
|
||||
@@ -448,8 +448,7 @@ class TaintTrackingImplementation extends string instanceof TaintTracking::Confi
|
||||
context = TNoParam() and
|
||||
src = TTaintTrackingNode_(retval, TNoParam(), path, kind, this) and
|
||||
node.asCfgNode() = call and
|
||||
retval.asCfgNode() =
|
||||
any(Return ret | ret.getScope() = pyfunc.getScope()).getValue().getAFlowNode()
|
||||
retval.asCfgNode().getNode() = any(Return ret | ret.getScope() = pyfunc.getScope()).getValue()
|
||||
) and
|
||||
edgeLabel = "return"
|
||||
}
|
||||
@@ -471,8 +470,7 @@ class TaintTrackingImplementation extends string instanceof TaintTracking::Confi
|
||||
this.callContexts(call, src, pyfunc, context, callee) and
|
||||
retnode = TTaintTrackingNode_(retval, callee, path, kind, this) and
|
||||
node.asCfgNode() = call and
|
||||
retval.asCfgNode() =
|
||||
any(Return ret | ret.getScope() = pyfunc.getScope()).getValue().getAFlowNode()
|
||||
retval.asCfgNode().getNode() = any(Return ret | ret.getScope() = pyfunc.getScope()).getValue()
|
||||
) and
|
||||
edgeLabel = "call"
|
||||
}
|
||||
@@ -716,8 +714,10 @@ private class EssaTaintTracking extends string instanceof TaintTracking::Configu
|
||||
src = TTaintTrackingNode_(srcnode, context, path, srckind, this) and
|
||||
path.noAttribute()
|
||||
|
|
||||
assign.getValue().getAFlowNode() = srcnode.asCfgNode() and
|
||||
depth = iterable_unpacking_descent(assign.getATarget().getAFlowNode(), defn.getDefiningNode()) and
|
||||
srcnode.asCfgNode().getNode() = assign.getValue() and
|
||||
exists(SequenceNode left_parent | left_parent.getNode() = assign.getATarget() |
|
||||
depth = iterable_unpacking_descent(left_parent, defn.getDefiningNode())
|
||||
) and
|
||||
kind = taint_at_depth(srckind, depth)
|
||||
)
|
||||
}
|
||||
@@ -964,7 +964,7 @@ private TaintKind taint_at_depth(SequenceKind parent_kind, int depth) {
|
||||
* - with `left_defn` = `*y`, `left_parent` = `((x, *y), ...)`, result = 1
|
||||
*/
|
||||
int iterable_unpacking_descent(SequenceNode left_parent, ControlFlowNode left_defn) {
|
||||
exists(Assign a | a.getATarget().getASubExpression*().getAFlowNode() = left_parent) and
|
||||
exists(Assign a | left_parent.getNode() = a.getATarget().getASubExpression*()) and
|
||||
left_parent.getAnElement() = left_defn and
|
||||
// Handle `a, *b = some_iterable`
|
||||
if left_defn instanceof StarredNode then result = 0 else result = 1
|
||||
|
||||
@@ -56,7 +56,7 @@ module SsaSource {
|
||||
predicate with_definition(Variable v, ControlFlowNode defn) {
|
||||
exists(With with, Name var |
|
||||
with.getOptionalVars() = var and
|
||||
var.getAFlowNode() = defn
|
||||
defn.getNode() = var
|
||||
|
|
||||
var = v.getAStore()
|
||||
)
|
||||
@@ -67,7 +67,7 @@ module SsaSource {
|
||||
predicate pattern_capture_definition(Variable v, ControlFlowNode defn) {
|
||||
exists(MatchCapturePattern capture, Name var |
|
||||
capture.getVariable() = var and
|
||||
var.getAFlowNode() = defn
|
||||
defn.getNode() = var
|
||||
|
|
||||
var = v.getAStore()
|
||||
)
|
||||
@@ -78,7 +78,7 @@ module SsaSource {
|
||||
predicate pattern_alias_definition(Variable v, ControlFlowNode defn) {
|
||||
exists(MatchAsPattern pattern, Name var |
|
||||
pattern.getAlias() = var and
|
||||
var.getAFlowNode() = defn
|
||||
defn.getNode() = var
|
||||
|
|
||||
var = v.getAStore()
|
||||
)
|
||||
|
||||
@@ -4,6 +4,7 @@
|
||||
*/
|
||||
|
||||
private import python
|
||||
private import semmle.python.controlflow.internal.Cfg as Cfg
|
||||
private import semmle.python.Concepts
|
||||
private import semmle.python.ApiGraphs
|
||||
private import semmle.python.dataflow.new.RemoteFlowSources
|
||||
@@ -59,7 +60,7 @@ module Bottle {
|
||||
|
||||
override Parameter getARoutedParameter() { none() }
|
||||
|
||||
override Function getARequestHandler() { result.getADecorator().getAFlowNode() = node }
|
||||
override Function getARequestHandler() { node.getNode() = result.getADecorator() }
|
||||
}
|
||||
}
|
||||
|
||||
@@ -73,7 +74,10 @@ module Bottle {
|
||||
/** A response returned by a view callable. */
|
||||
class BottleReturnResponse extends Http::Server::HttpResponse::Range {
|
||||
BottleReturnResponse() {
|
||||
this.asCfgNode() = any(View::ViewCallable vc).getAReturnValueFlowNode()
|
||||
exists(Return ret |
|
||||
ret.getScope() = any(View::ViewCallable vc) and
|
||||
this.asCfgNode().getNode() = ret.getValue()
|
||||
)
|
||||
}
|
||||
|
||||
override DataFlow::Node getBody() { result = this }
|
||||
@@ -154,9 +158,9 @@ module Bottle {
|
||||
DataFlow::Node value;
|
||||
|
||||
HeaderWriteSubscript() {
|
||||
exists(SubscriptNode subscript |
|
||||
exists(Cfg::SubscriptNode subscript |
|
||||
this.asCfgNode() = subscript and
|
||||
value.asCfgNode() = subscript.(DefinitionNode).getValue() and
|
||||
value.asCfgNode() = subscript.(Cfg::DefinitionNode).getValue() and
|
||||
name.asCfgNode() = subscript.getIndex() and
|
||||
subscript.getObject() = headers().asSource().asCfgNode()
|
||||
)
|
||||
|
||||
@@ -4,6 +4,7 @@
|
||||
*/
|
||||
|
||||
private import python
|
||||
private import semmle.python.controlflow.internal.Cfg as Cfg
|
||||
private import semmle.python.dataflow.new.DataFlow
|
||||
private import semmle.python.dataflow.new.RemoteFlowSources
|
||||
private import semmle.python.dataflow.new.TaintTracking
|
||||
@@ -1305,7 +1306,7 @@ module PrivateDjango {
|
||||
dict.(DataFlow::MethodCallNode).calls(files, "dict")
|
||||
)
|
||||
|
|
||||
this.asCfgNode().(SubscriptNode).getObject() = dict.asCfgNode()
|
||||
this.asCfgNode().(Cfg::SubscriptNode).getObject() = dict.asCfgNode()
|
||||
or
|
||||
this.(DataFlow::MethodCallNode).calls(dict, "get")
|
||||
)
|
||||
@@ -1314,7 +1315,7 @@ module PrivateDjango {
|
||||
exists(DataFlow::AttrRead files, DataFlow::MethodCallNode getlistCall |
|
||||
files.accesses(instance(), "FILES") and
|
||||
getlistCall.calls(files, "getlist") and
|
||||
this.asCfgNode().(SubscriptNode).getObject() = getlistCall.asCfgNode()
|
||||
this.asCfgNode().(Cfg::SubscriptNode).getObject() = getlistCall.asCfgNode()
|
||||
)
|
||||
}
|
||||
}
|
||||
@@ -2216,7 +2217,7 @@ module PrivateDjango {
|
||||
DataFlow::Node value;
|
||||
|
||||
DjangoResponseCookieSubscriptWrite() {
|
||||
exists(SubscriptNode subscript, DataFlow::AttrRead cookieLookup |
|
||||
exists(Cfg::SubscriptNode subscript, DataFlow::AttrRead cookieLookup |
|
||||
// To give `this` a value, we need to choose between either LHS or RHS,
|
||||
// and just go with the LHS
|
||||
this.asCfgNode() = subscript
|
||||
@@ -2228,7 +2229,7 @@ module PrivateDjango {
|
||||
|
|
||||
cookieLookup.flowsTo(subscriptObj)
|
||||
) and
|
||||
value.asCfgNode() = subscript.(DefinitionNode).getValue() and
|
||||
value.asCfgNode() = subscript.(Cfg::DefinitionNode).getValue() and
|
||||
index.asCfgNode() = subscript.getIndex()
|
||||
)
|
||||
}
|
||||
@@ -2249,7 +2250,7 @@ module PrivateDjango {
|
||||
DataFlow::Node value;
|
||||
|
||||
DjangoResponseHeaderSubscriptWrite() {
|
||||
exists(SubscriptNode subscript, DataFlow::AttrRead headerLookup |
|
||||
exists(Cfg::SubscriptNode subscript, DataFlow::AttrRead headerLookup |
|
||||
// To give `this` a value, we need to choose between either LHS or RHS,
|
||||
// and just go with the LHS
|
||||
this.asCfgNode() = subscript
|
||||
@@ -2261,7 +2262,7 @@ module PrivateDjango {
|
||||
|
|
||||
headerLookup.flowsTo(subscriptObj)
|
||||
) and
|
||||
value.asCfgNode() = subscript.(DefinitionNode).getValue() and
|
||||
value.asCfgNode() = subscript.(Cfg::DefinitionNode).getValue() and
|
||||
index.asCfgNode() = subscript.getIndex()
|
||||
)
|
||||
}
|
||||
@@ -2284,14 +2285,14 @@ module PrivateDjango {
|
||||
DataFlow::Node value;
|
||||
|
||||
DjangoResponseSubscriptWrite() {
|
||||
exists(SubscriptNode subscript |
|
||||
exists(Cfg::SubscriptNode subscript |
|
||||
// To give `this` a value, we need to choose between either LHS or RHS,
|
||||
// and just go with the LHS
|
||||
this.asCfgNode() = subscript
|
||||
|
|
||||
subscript.getObject() =
|
||||
DjangoImpl::DjangoHttp::Response::HttpResponse::instance().asCfgNode() and
|
||||
value.asCfgNode() = subscript.(DefinitionNode).getValue() and
|
||||
value.asCfgNode() = subscript.(Cfg::DefinitionNode).getValue() and
|
||||
index.asCfgNode() = subscript.getIndex()
|
||||
)
|
||||
}
|
||||
@@ -2426,7 +2427,7 @@ module PrivateDjango {
|
||||
/** Gets a reference to the result of calling the `as_view` classmethod of this class. */
|
||||
private DataFlow::TypeTrackingNode asViewResult(DataFlow::TypeTracker t) {
|
||||
t.start() and
|
||||
result.asCfgNode().(CallNode).getFunction() = this.asViewRef().asCfgNode()
|
||||
result.asCfgNode().(Cfg::CallNode).getFunction() = this.asViewRef().asCfgNode()
|
||||
or
|
||||
exists(DataFlow::TypeTracker t2 | result = this.asViewResult(t2).track(t2, t))
|
||||
}
|
||||
@@ -2872,7 +2873,10 @@ module PrivateDjango {
|
||||
DataFlow::CfgNode
|
||||
{
|
||||
DjangoRedirectViewGetRedirectUrlReturn() {
|
||||
node = any(GetRedirectUrlFunction f).getAReturnValueFlowNode()
|
||||
exists(Return ret |
|
||||
ret.getScope() = any(GetRedirectUrlFunction f) and
|
||||
node.getNode() = ret.getValue()
|
||||
)
|
||||
}
|
||||
|
||||
override DataFlow::Node getRedirectLocation() { result = this }
|
||||
|
||||
@@ -4,6 +4,7 @@
|
||||
*/
|
||||
|
||||
private import python
|
||||
private import semmle.python.controlflow.internal.Cfg as Cfg
|
||||
private import semmle.python.dataflow.new.DataFlow
|
||||
private import semmle.python.dataflow.new.RemoteFlowSources
|
||||
private import semmle.python.dataflow.new.TaintTracking
|
||||
@@ -129,7 +130,7 @@ module FastApi {
|
||||
result in [this.getArg(0), this.getArgByName("path")]
|
||||
}
|
||||
|
||||
override Function getARequestHandler() { result.getADecorator().getAFlowNode() = node }
|
||||
override Function getARequestHandler() { node.getNode() = result.getADecorator() }
|
||||
|
||||
override string getFramework() { result = "FastAPI" }
|
||||
|
||||
@@ -309,7 +310,10 @@ module FastApi {
|
||||
FastApiRouteSetup routeSetup;
|
||||
|
||||
FastApiRequestHandlerReturn() {
|
||||
node = routeSetup.getARequestHandler().getAReturnValueFlowNode()
|
||||
exists(Return ret |
|
||||
ret.getScope() = routeSetup.getARequestHandler() and
|
||||
node.getNode() = ret.getValue()
|
||||
)
|
||||
}
|
||||
|
||||
override DataFlow::Node getBody() { result = this }
|
||||
@@ -438,7 +442,7 @@ module FastApi {
|
||||
DataFlow::Node value;
|
||||
|
||||
HeaderSubscriptWrite() {
|
||||
exists(SubscriptNode subscript, DataFlow::AttrRead headerLookup |
|
||||
exists(Cfg::SubscriptNode subscript, DataFlow::AttrRead headerLookup |
|
||||
// To give `this` a value, we need to choose between either LHS or RHS,
|
||||
// and just go with the LHS
|
||||
this.asCfgNode() = subscript
|
||||
@@ -447,7 +451,7 @@ module FastApi {
|
||||
exists(DataFlow::Node subscriptObj | subscriptObj.asCfgNode() = subscript.getObject() |
|
||||
headerLookup.flowsTo(subscriptObj)
|
||||
) and
|
||||
value.asCfgNode() = subscript.(DefinitionNode).getValue() and
|
||||
value.asCfgNode() = subscript.(Cfg::DefinitionNode).getValue() and
|
||||
index.asCfgNode() = subscript.getIndex()
|
||||
)
|
||||
}
|
||||
|
||||
@@ -371,7 +371,7 @@ module Flask {
|
||||
result in [this.getArg(0), this.getArgByName("rule")]
|
||||
}
|
||||
|
||||
override Function getARequestHandler() { result.getADecorator().getAFlowNode() = node }
|
||||
override Function getARequestHandler() { node.getNode() = result.getADecorator() }
|
||||
}
|
||||
|
||||
/**
|
||||
@@ -536,7 +536,7 @@ module Flask {
|
||||
FlaskRouteHandlerReturn() {
|
||||
exists(Function routeHandler |
|
||||
routeHandler = any(FlaskRouteSetup rs).getARequestHandler() and
|
||||
node = routeHandler.getAReturnValueFlowNode() and
|
||||
exists(Return ret | ret.getScope() = routeHandler and node.getNode() = ret.getValue()) and
|
||||
not this instanceof Flask::Response::InstanceSource
|
||||
)
|
||||
}
|
||||
|
||||
@@ -38,7 +38,7 @@ private module FlaskAdmin {
|
||||
result in [this.getArg(0), this.getArgByName("url")]
|
||||
}
|
||||
|
||||
override Function getARequestHandler() { result.getADecorator().getAFlowNode() = node }
|
||||
override Function getARequestHandler() { node.getNode() = result.getADecorator() }
|
||||
}
|
||||
|
||||
/**
|
||||
@@ -71,7 +71,7 @@ private module FlaskAdmin {
|
||||
|
||||
override Function getARequestHandler() {
|
||||
exists(Flask::FlaskViewClass cls |
|
||||
cls.getADecorator().getAFlowNode() = node and
|
||||
node.getNode() = cls.getADecorator() and
|
||||
result = cls.getARequestHandler()
|
||||
)
|
||||
}
|
||||
|
||||
@@ -4,6 +4,7 @@
|
||||
*/
|
||||
|
||||
import python
|
||||
private import semmle.python.controlflow.internal.Cfg as Cfg
|
||||
import semmle.python.dataflow.new.RemoteFlowSources
|
||||
import semmle.python.dataflow.new.TaintTracking
|
||||
import semmle.python.ApiGraphs
|
||||
@@ -51,9 +52,9 @@ module Gradio {
|
||||
// limit only to lists of parameters given to `inputs`.
|
||||
(
|
||||
(
|
||||
call.getKeywordParameter("inputs").asSink().asCfgNode() instanceof ListNode
|
||||
call.getKeywordParameter("inputs").asSink().asCfgNode() instanceof Cfg::ListNode
|
||||
or
|
||||
call.getParameter(1).asSink().asCfgNode() instanceof ListNode
|
||||
call.getParameter(1).asSink().asCfgNode() instanceof Cfg::ListNode
|
||||
) and
|
||||
(
|
||||
this = call.getKeywordParameter("inputs").getASubscript().getAValueReachingSink()
|
||||
@@ -75,8 +76,8 @@ module Gradio {
|
||||
exists(GradioInput call |
|
||||
this = call.getParameter(0, "fn").getParameter(_).asSource() and
|
||||
// exclude lists of parameters given to `inputs`
|
||||
not call.getKeywordParameter("inputs").asSink().asCfgNode() instanceof ListNode and
|
||||
not call.getParameter(1).asSink().asCfgNode() instanceof ListNode
|
||||
not call.getKeywordParameter("inputs").asSink().asCfgNode() instanceof Cfg::ListNode and
|
||||
not call.getParameter(1).asSink().asCfgNode() instanceof Cfg::ListNode
|
||||
)
|
||||
}
|
||||
|
||||
@@ -105,16 +106,16 @@ module Gradio {
|
||||
// handle cases where there are multiple arguments passed as a list to `inputs`
|
||||
(
|
||||
(
|
||||
node.getKeywordParameter("inputs").asSink().asCfgNode() instanceof ListNode
|
||||
node.getKeywordParameter("inputs").asSink().asCfgNode() instanceof Cfg::ListNode
|
||||
or
|
||||
node.getParameter(1).asSink().asCfgNode() instanceof ListNode
|
||||
node.getParameter(1).asSink().asCfgNode() instanceof Cfg::ListNode
|
||||
) and
|
||||
exists(int i | nodeTo = node.getParameter(0, "fn").getParameter(i).asSource() |
|
||||
nodeFrom.asCfgNode() =
|
||||
node.getKeywordParameter("inputs").asSink().asCfgNode().(ListNode).getElement(i)
|
||||
node.getKeywordParameter("inputs").asSink().asCfgNode().(Cfg::ListNode).getElement(i)
|
||||
or
|
||||
nodeFrom.asCfgNode() =
|
||||
node.getParameter(1).asSink().asCfgNode().(ListNode).getElement(i)
|
||||
node.getParameter(1).asSink().asCfgNode().(Cfg::ListNode).getElement(i)
|
||||
)
|
||||
)
|
||||
)
|
||||
|
||||
@@ -4,6 +4,7 @@
|
||||
*/
|
||||
|
||||
private import python
|
||||
private import semmle.python.controlflow.internal.Cfg as Cfg
|
||||
private import semmle.python.dataflow.new.DataFlow
|
||||
private import semmle.python.dataflow.new.TaintTracking
|
||||
private import semmle.python.Concepts
|
||||
@@ -46,7 +47,7 @@ module MarkupSafeModel {
|
||||
|
||||
/** A direct instantiation of `markupsafe.Markup`. */
|
||||
private class ClassInstantiation extends InstanceSource, DataFlow::CallCfgNode {
|
||||
override CallNode node;
|
||||
override Cfg::CallNode node;
|
||||
|
||||
ClassInstantiation() { this = classRef().getACall() }
|
||||
}
|
||||
@@ -64,7 +65,7 @@ module MarkupSafeModel {
|
||||
|
||||
/** A string concatenation with a `markupsafe.Markup` involved. */
|
||||
class StringConcat extends Markup::InstanceSource, DataFlow::CfgNode {
|
||||
override BinaryExprNode node;
|
||||
override Cfg::BinaryExprNode node;
|
||||
|
||||
StringConcat() {
|
||||
node.getOp() instanceof Add and
|
||||
@@ -79,7 +80,7 @@ module MarkupSafeModel {
|
||||
|
||||
/** A %-style string format with `markupsafe.Markup` as the format string. */
|
||||
class PercentStringFormat extends Markup::InstanceSource, DataFlow::CfgNode {
|
||||
override BinaryExprNode node;
|
||||
override Cfg::BinaryExprNode node;
|
||||
|
||||
PercentStringFormat() {
|
||||
node.getOp() instanceof Mod and
|
||||
|
||||
@@ -7,6 +7,7 @@
|
||||
*/
|
||||
|
||||
private import python
|
||||
private import semmle.python.controlflow.internal.Cfg as Cfg
|
||||
private import semmle.python.Concepts
|
||||
private import semmle.python.ApiGraphs
|
||||
private import semmle.python.frameworks.data.ModelsAsData
|
||||
@@ -56,7 +57,7 @@ module Pycurl {
|
||||
{
|
||||
OutgoingRequestCall() {
|
||||
this = setopt().getACall() and
|
||||
this.getArg(0).asCfgNode().(AttrNode).getName() = "URL"
|
||||
this.getArg(0).asCfgNode().(Cfg::AttrNode).getName() = "URL"
|
||||
}
|
||||
|
||||
override DataFlow::Node getAUrlPart() {
|
||||
@@ -81,7 +82,7 @@ module Pycurl {
|
||||
private class CurlSslCall extends Http::Client::Request::Range instanceof DataFlow::CallCfgNode {
|
||||
CurlSslCall() {
|
||||
this = setopt().getACall() and
|
||||
this.getArg(0).asCfgNode().(AttrNode).getName() = ["SSL_VERIFYPEER", "SSL_VERIFYHOST"]
|
||||
this.getArg(0).asCfgNode().(Cfg::AttrNode).getName() = ["SSL_VERIFYPEER", "SSL_VERIFYHOST"]
|
||||
}
|
||||
|
||||
override DataFlow::Node getAUrlPart() { none() }
|
||||
|
||||
@@ -7,6 +7,7 @@
|
||||
*/
|
||||
|
||||
private import python
|
||||
private import semmle.python.controlflow.internal.Cfg as Cfg
|
||||
private import semmle.python.dataflow.new.DataFlow
|
||||
private import semmle.python.dataflow.new.TaintTracking
|
||||
private import semmle.python.Concepts
|
||||
@@ -93,7 +94,7 @@ module Pydantic {
|
||||
// be a Pydantic model. So `model[0]` will be an overapproximation, but should not
|
||||
// really cause problems (since we don't expect real code to contain such accesses)
|
||||
nodeFrom = instance() and
|
||||
nodeTo.asCfgNode().(SubscriptNode).getObject() = nodeFrom.asCfgNode()
|
||||
nodeTo.asCfgNode().(Cfg::SubscriptNode).getObject() = nodeFrom.asCfgNode()
|
||||
}
|
||||
|
||||
/**
|
||||
|
||||
@@ -166,7 +166,10 @@ module Pyramid {
|
||||
/** A response returned by a view callable. */
|
||||
private class PyramidReturnResponse extends Http::Server::HttpResponse::Range {
|
||||
PyramidReturnResponse() {
|
||||
this.asCfgNode() = any(View::ViewCallable vc).getAReturnValueFlowNode() and
|
||||
exists(Return ret |
|
||||
ret.getScope() = any(View::ViewCallable vc) and
|
||||
this.asCfgNode().getNode() = ret.getValue()
|
||||
) and
|
||||
not this = instance()
|
||||
}
|
||||
|
||||
|
||||
Some files were not shown because too many files have changed in this diff Show More
Reference in New Issue
Block a user