Compare commits

..

2 Commits

Author SHA1 Message Date
yoff
9c41238eee Apply suggestions from code review
Co-authored-by: Copilot Autofix powered by AI <175728472+Copilot@users.noreply.github.com>
2026-06-22 13:37:46 +00:00
Copilot
d7c0ef7e4d Python: qualify Flow.qll's AST references with Py:: prefix
Preparatory refactor for the shared-CFG dataflow migration. Switches
'import python' to 'import python as Py' inside Flow.qll, and qualifies
every AST-class reference (Expr, Bytes, Dict, AssignExpr, Compare,
Module, Scope, Call, Attribute, SsaVariable, AugAssign, etc.) with the
Py:: prefix.

Flow.qll's own CFG types (ControlFlowNode, BasicBlock, CallNode,
NameNode, DefinitionNode, CompareNode, ...) keep their unqualified
names — they remain the public CFG API exported from this file.

This is a semantic noop: the qualification was applied mechanically by
script and no name resolution changes. Verified by:
- All 361 lib/ + src/ queries compile clean.
- All 186 ControlFlow + PointsTo + dataflow library-tests pass.

Co-authored-by: Copilot <223556219+Copilot@users.noreply.github.com>
2026-06-22 13:37:45 +00:00
7 changed files with 216 additions and 626 deletions

View File

@@ -13,7 +13,7 @@ func logSomething(entry *logrus.Entry) {
entry.Traceln(text) // $ logger=text entry.Traceln(text) // $ logger=text
} }
func logrusCalls(selector int) { func logrusCalls() {
err := errors.New("Error") err := errors.New("Error")
var fields logrus.Fields = nil var fields logrus.Fields = nil
var fn logrus.LogFunction = nil var fn logrus.LogFunction = nil
@@ -27,15 +27,11 @@ func logrusCalls(selector int) {
tmp = logrus.WithFields(fields) // $ logger=fields tmp = logrus.WithFields(fields) // $ logger=fields
logSomething(tmp) logSomething(tmp)
logrus.Error(text) // $ logger=text logrus.Error(text) // $ logger=text
logrus.Infof(fmt, text) // $ logger=fmt logger=text logrus.Fatalf(fmt, text) // $ logger=fmt logger=text
if selector == 0 { logrus.Panicln(text) // $ logger=text
logrus.Fatalf(fmt, text) // $ logger=fmt logger=text logrus.Infof(fmt, text) // $ logger=fmt logger=text
} else if selector == 1 { logrus.FatalFn(fn) // $ logger=fn
logrus.Panicln(text) // $ logger=text
} else if selector == 2 {
logrus.FatalFn(fn) // $ logger=fn
}
// components corresponding to the format specifier "%T" are not considered vulnerable // components corresponding to the format specifier "%T" are not considered vulnerable
logrus.Infof("%s: found type %T", text, v) // $ logger="%s: found type %T" logger=text type-logger=v logrus.Infof("%s: found type %T", text, v) // $ logger="%s: found type %T" logger=text type-logger=v

View File

@@ -8,6 +8,6 @@ var v []byte
func main() { func main() {
glogTest(len(v)) glogTest(len(v))
stdlib(len(v)) stdlib()
slogTest() slogTest()
} }

View File

@@ -4,69 +4,37 @@ import (
"log" "log"
) )
func stdlib(selector int) { func stdlib() {
var logger log.Logger var logger log.Logger
logger.SetPrefix("prefix: ") logger.SetPrefix("prefix: ")
switch selector { logger.Fatal(text) // $ logger=text
case 0: logger.Fatalf(fmt, text) // $ logger=fmt logger=text
logger.Fatal(text) // $ logger=text logger.Fatalln(text) // $ logger=text
case 1: logger.Panic(text) // $ logger=text
logger.Fatalf(fmt, text) // $ logger=fmt logger=text logger.Panicf(fmt, text) // $ logger=fmt logger=text
case 2: logger.Panicln(text) // $ logger=text
logger.Fatalln(text) // $ logger=text logger.Print(text) // $ logger=text
case 3: logger.Printf(fmt, text) // $ logger=fmt logger=text
logger.Panic(text) // $ logger=text logger.Println(text) // $ logger=text
case 4:
logger.Panicf(fmt, text) // $ logger=fmt logger=text
case 5:
logger.Panicln(text) // $ logger=text
case 6:
logger.Print(text) // $ logger=text
case 7:
logger.Printf(fmt, text) // $ logger=fmt logger=text
case 8:
logger.Println(text) // $ logger=text
}
// components corresponding to the format specifier "%T" are not considered vulnerable // components corresponding to the format specifier "%T" are not considered vulnerable
switch selector { logger.Fatalf("%s: found type %T", text, v) // $ logger="%s: found type %T" logger=text type-logger=v
case 9: logger.Panicf("%s: found type %T", text, v) // $ logger="%s: found type %T" logger=text type-logger=v
logger.Fatalf("%s: found type %T", text, v) // $ logger="%s: found type %T" logger=text type-logger=v logger.Printf("%s: found type %T", text, v) // $ logger="%s: found type %T" logger=text type-logger=v
case 10:
logger.Panicf("%s: found type %T", text, v) // $ logger="%s: found type %T" logger=text type-logger=v
case 11:
logger.Printf("%s: found type %T", text, v) // $ logger="%s: found type %T" logger=text type-logger=v
}
log.SetPrefix("prefix: ") log.SetPrefix("prefix: ")
switch selector { log.Fatal(text) // $ logger=text
case 12: log.Fatalf(fmt, text) // $ logger=fmt logger=text
log.Fatal(text) // $ logger=text log.Fatalln(text) // $ logger=text
case 13: log.Panic(text) // $ logger=text
log.Fatalf(fmt, text) // $ logger=fmt logger=text log.Panicf(fmt, text) // $ logger=fmt logger=text
case 14: log.Panicln(text) // $ logger=text
log.Fatalln(text) // $ logger=text log.Print(text) // $ logger=text
case 15: log.Printf(fmt, text) // $ logger=fmt logger=text
log.Panic(text) // $ logger=text log.Println(text) // $ logger=text
case 16:
log.Panicf(fmt, text) // $ logger=fmt logger=text
case 17:
log.Panicln(text) // $ logger=text
case 18:
log.Print(text) // $ logger=text
case 19:
log.Printf(fmt, text) // $ logger=fmt logger=text
case 20:
log.Println(text) // $ logger=text
}
// components corresponding to the format specifier "%T" are not considered vulnerable // components corresponding to the format specifier "%T" are not considered vulnerable
switch selector { log.Fatalf("%s: found type %T", text, v) // $ logger="%s: found type %T" logger=text type-logger=v
case 21: log.Panicf("%s: found type %T", text, v) // $ logger="%s: found type %T" logger=text type-logger=v
log.Fatalf("%s: found type %T", text, v) // $ logger="%s: found type %T" logger=text type-logger=v log.Printf("%s: found type %T", text, v) // $ logger="%s: found type %T" logger=text type-logger=v
case 22:
log.Panicf("%s: found type %T", text, v) // $ logger="%s: found type %T" logger=text type-logger=v
case 23:
log.Printf("%s: found type %T", text, v) // $ logger="%s: found type %T" logger=text type-logger=v
}
} }

View File

@@ -34,265 +34,6 @@
| DuplicateSwitchCase.go:16:1:16:14 | function declaration | DuplicateSwitchCase.go:0:0:0:0 | exit | | DuplicateSwitchCase.go:16:1:16:14 | function declaration | DuplicateSwitchCase.go:0:0:0:0 | exit |
| DuplicateSwitchCase.go:16:6:16:9 | skip | DuplicateSwitchCase.go:16:1:16:14 | function declaration | | DuplicateSwitchCase.go:16:6:16:9 | skip | DuplicateSwitchCase.go:16:1:16:14 | function declaration |
| DuplicateSwitchCase.go:16:13:16:14 | skip | DuplicateSwitchCase.go:16:1:16:14 | exit | | DuplicateSwitchCase.go:16:13:16:14 | skip | DuplicateSwitchCase.go:16:1:16:14 | exit |
| epilogues.go:0:0:0:0 | entry | epilogues.go:3:1:3:12 | skip |
| epilogues.go:3:1:3:12 | skip | epilogues.go:8:1:10:1 | skip |
| epilogues.go:8:1:10:1 | skip | epilogues.go:12:21:12:23 | skip |
| epilogues.go:12:1:14:1 | entry | epilogues.go:12:7:12:7 | argument corresponding to l |
| epilogues.go:12:1:14:1 | function declaration | epilogues.go:16:20:16:27 | skip |
| epilogues.go:12:7:12:7 | argument corresponding to l | epilogues.go:12:7:12:7 | initialization of l |
| epilogues.go:12:7:12:7 | initialization of l | epilogues.go:12:25:12:27 | argument corresponding to msg |
| epilogues.go:12:21:12:23 | skip | epilogues.go:12:1:14:1 | function declaration |
| epilogues.go:12:25:12:27 | argument corresponding to msg | epilogues.go:12:25:12:27 | initialization of msg |
| epilogues.go:12:25:12:27 | initialization of msg | epilogues.go:12:37:12:40 | argument corresponding to code |
| epilogues.go:12:37:12:40 | argument corresponding to code | epilogues.go:12:37:12:40 | initialization of code |
| epilogues.go:12:37:12:40 | initialization of code | epilogues.go:13:2:13:12 | selection of Println |
| epilogues.go:13:2:13:12 | selection of Println | epilogues.go:13:14:13:14 | l |
| epilogues.go:13:2:13:33 | call to Println | epilogues.go:12:1:14:1 | exit |
| epilogues.go:13:14:13:14 | implicit dereference | epilogues.go:12:1:14:1 | exit |
| epilogues.go:13:14:13:14 | implicit dereference | epilogues.go:13:14:13:21 | selection of prefix |
| epilogues.go:13:14:13:14 | l | epilogues.go:13:14:13:14 | implicit dereference |
| epilogues.go:13:14:13:21 | selection of prefix | epilogues.go:13:24:13:26 | msg |
| epilogues.go:13:24:13:26 | msg | epilogues.go:13:29:13:32 | code |
| epilogues.go:13:29:13:32 | code | epilogues.go:13:2:13:33 | call to Println |
| epilogues.go:16:1:18:1 | entry | epilogues.go:16:7:16:7 | argument corresponding to l |
| epilogues.go:16:1:18:1 | function declaration | epilogues.go:23:6:23:15 | skip |
| epilogues.go:16:7:16:7 | argument corresponding to l | epilogues.go:16:7:16:7 | initialization of l |
| epilogues.go:16:7:16:7 | initialization of l | epilogues.go:16:29:16:31 | argument corresponding to msg |
| epilogues.go:16:20:16:27 | skip | epilogues.go:16:1:18:1 | function declaration |
| epilogues.go:16:29:16:31 | argument corresponding to msg | epilogues.go:16:29:16:31 | initialization of msg |
| epilogues.go:16:29:16:31 | initialization of msg | epilogues.go:17:2:17:12 | selection of Println |
| epilogues.go:17:2:17:12 | selection of Println | epilogues.go:17:14:17:14 | l |
| epilogues.go:17:2:17:27 | call to Println | epilogues.go:16:1:18:1 | exit |
| epilogues.go:17:14:17:14 | l | epilogues.go:17:14:17:21 | selection of prefix |
| epilogues.go:17:14:17:21 | selection of prefix | epilogues.go:17:24:17:26 | msg |
| epilogues.go:17:24:17:26 | msg | epilogues.go:17:2:17:27 | call to Println |
| epilogues.go:23:1:27:1 | entry | epilogues.go:24:5:24:5 | skip |
| epilogues.go:23:1:27:1 | function declaration | epilogues.go:31:6:31:13 | skip |
| epilogues.go:23:6:23:15 | skip | epilogues.go:23:1:27:1 | function declaration |
| epilogues.go:24:5:24:5 | assignment to r | epilogues.go:24:21:24:21 | r |
| epilogues.go:24:5:24:5 | skip | epilogues.go:24:10:24:16 | recover |
| epilogues.go:24:10:24:16 | recover | epilogues.go:24:10:24:18 | call to recover |
| epilogues.go:24:10:24:18 | call to recover | epilogues.go:24:5:24:5 | assignment to r |
| epilogues.go:24:21:24:21 | r | epilogues.go:24:26:24:28 | nil |
| epilogues.go:24:21:24:28 | ...!=... | epilogues.go:23:1:27:1 | exit |
| epilogues.go:24:21:24:28 | ...!=... | epilogues.go:24:21:24:28 | ...!=... is false |
| epilogues.go:24:21:24:28 | ...!=... | epilogues.go:24:21:24:28 | ...!=... is true |
| epilogues.go:24:21:24:28 | ...!=... is false | epilogues.go:23:1:27:1 | exit |
| epilogues.go:24:21:24:28 | ...!=... is true | epilogues.go:25:3:25:13 | selection of Println |
| epilogues.go:24:26:24:28 | nil | epilogues.go:24:21:24:28 | ...!=... |
| epilogues.go:25:3:25:13 | selection of Println | epilogues.go:25:15:25:26 | "recovered:" |
| epilogues.go:25:3:25:30 | call to Println | epilogues.go:23:1:27:1 | exit |
| epilogues.go:25:15:25:26 | "recovered:" | epilogues.go:25:29:25:29 | r |
| epilogues.go:25:29:25:29 | r | epilogues.go:25:3:25:30 | call to Println |
| epilogues.go:31:1:33:1 | entry | epilogues.go:31:15:31:15 | argument corresponding to x |
| epilogues.go:31:1:33:1 | function declaration | epilogues.go:36:6:36:12 | skip |
| epilogues.go:31:6:31:13 | skip | epilogues.go:31:1:33:1 | function declaration |
| epilogues.go:31:15:31:15 | argument corresponding to x | epilogues.go:31:15:31:15 | initialization of x |
| epilogues.go:31:15:31:15 | initialization of x | epilogues.go:32:9:32:9 | x |
| epilogues.go:32:2:32:13 | return statement | epilogues.go:31:1:33:1 | exit |
| epilogues.go:32:9:32:9 | x | epilogues.go:32:13:32:13 | 2 |
| epilogues.go:32:9:32:13 | ...*... | epilogues.go:32:2:32:13 | return statement |
| epilogues.go:32:13:32:13 | 2 | epilogues.go:32:9:32:13 | ...*... |
| epilogues.go:36:1:38:1 | entry | epilogues.go:37:2:37:12 | selection of Println |
| epilogues.go:36:1:38:1 | function declaration | epilogues.go:42:6:42:18 | skip |
| epilogues.go:36:6:36:12 | skip | epilogues.go:36:1:38:1 | function declaration |
| epilogues.go:37:2:37:12 | selection of Println | epilogues.go:37:14:37:19 | "void" |
| epilogues.go:37:2:37:20 | call to Println | epilogues.go:36:1:38:1 | exit |
| epilogues.go:37:14:37:19 | "void" | epilogues.go:37:2:37:20 | call to Println |
| epilogues.go:42:1:48:1 | entry | epilogues.go:42:20:42:20 | argument corresponding to x |
| epilogues.go:42:1:48:1 | function declaration | epilogues.go:51:6:51:21 | skip |
| epilogues.go:42:6:42:18 | skip | epilogues.go:42:1:48:1 | function declaration |
| epilogues.go:42:20:42:20 | argument corresponding to x | epilogues.go:42:20:42:20 | initialization of x |
| epilogues.go:42:20:42:20 | initialization of x | epilogues.go:42:28:42:33 | zero value for result |
| epilogues.go:42:28:42:33 | implicit read of result | epilogues.go:42:40:42:42 | implicit read of err |
| epilogues.go:42:28:42:33 | initialization of result | epilogues.go:42:40:42:42 | zero value for err |
| epilogues.go:42:28:42:33 | zero value for result | epilogues.go:42:28:42:33 | initialization of result |
| epilogues.go:42:40:42:42 | implicit read of err | epilogues.go:42:1:48:1 | exit |
| epilogues.go:42:40:42:42 | initialization of err | epilogues.go:43:5:43:5 | x |
| epilogues.go:42:40:42:42 | zero value for err | epilogues.go:42:40:42:42 | initialization of err |
| epilogues.go:43:5:43:5 | x | epilogues.go:43:9:43:9 | 0 |
| epilogues.go:43:5:43:9 | ...<... | epilogues.go:43:5:43:9 | ...<... is false |
| epilogues.go:43:5:43:9 | ...<... | epilogues.go:43:5:43:9 | ...<... is true |
| epilogues.go:43:5:43:9 | ...<... is false | epilogues.go:47:9:47:9 | x |
| epilogues.go:43:5:43:9 | ...<... is true | epilogues.go:44:3:44:8 | skip |
| epilogues.go:43:9:43:9 | 0 | epilogues.go:43:5:43:9 | ...<... |
| epilogues.go:44:3:44:8 | assignment to result | epilogues.go:45:3:45:8 | return statement |
| epilogues.go:44:3:44:8 | skip | epilogues.go:44:13:44:13 | x |
| epilogues.go:44:12:44:13 | -... | epilogues.go:44:3:44:8 | assignment to result |
| epilogues.go:44:13:44:13 | x | epilogues.go:44:12:44:13 | -... |
| epilogues.go:45:3:45:8 | return statement | epilogues.go:42:28:42:33 | implicit read of result |
| epilogues.go:47:2:47:14 | return statement | epilogues.go:42:28:42:33 | implicit read of result |
| epilogues.go:47:9:47:9 | implicit write of result | epilogues.go:47:12:47:14 | nil |
| epilogues.go:47:9:47:9 | x | epilogues.go:47:9:47:9 | implicit write of result |
| epilogues.go:47:12:47:14 | implicit write of err | epilogues.go:47:2:47:14 | return statement |
| epilogues.go:47:12:47:14 | nil | epilogues.go:47:12:47:14 | implicit write of err |
| epilogues.go:51:1:54:1 | entry | epilogues.go:51:23:51:23 | argument corresponding to x |
| epilogues.go:51:1:54:1 | function declaration | epilogues.go:59:6:59:25 | skip |
| epilogues.go:51:6:51:21 | skip | epilogues.go:51:1:54:1 | function declaration |
| epilogues.go:51:23:51:23 | argument corresponding to x | epilogues.go:51:23:51:23 | initialization of x |
| epilogues.go:51:23:51:23 | initialization of x | epilogues.go:51:31:51:31 | zero value for n |
| epilogues.go:51:31:51:31 | implicit read of n | epilogues.go:51:1:54:1 | exit |
| epilogues.go:51:31:51:31 | initialization of n | epilogues.go:52:2:52:2 | skip |
| epilogues.go:51:31:51:31 | zero value for n | epilogues.go:51:31:51:31 | initialization of n |
| epilogues.go:52:2:52:2 | assignment to n | epilogues.go:53:2:53:7 | return statement |
| epilogues.go:52:2:52:2 | skip | epilogues.go:52:6:52:6 | x |
| epilogues.go:52:6:52:6 | x | epilogues.go:52:10:52:10 | 1 |
| epilogues.go:52:6:52:10 | ...+... | epilogues.go:52:2:52:2 | assignment to n |
| epilogues.go:52:10:52:10 | 1 | epilogues.go:52:6:52:10 | ...+... |
| epilogues.go:53:2:53:7 | return statement | epilogues.go:51:31:51:31 | implicit read of n |
| epilogues.go:59:1:62:1 | entry | epilogues.go:59:27:59:27 | argument corresponding to l |
| epilogues.go:59:1:62:1 | function declaration | epilogues.go:66:6:66:26 | skip |
| epilogues.go:59:6:59:25 | skip | epilogues.go:59:1:62:1 | function declaration |
| epilogues.go:59:27:59:27 | argument corresponding to l | epilogues.go:59:27:59:27 | initialization of l |
| epilogues.go:59:27:59:27 | initialization of l | epilogues.go:59:41:59:45 | argument corresponding to items |
| epilogues.go:59:41:59:45 | argument corresponding to items | epilogues.go:59:41:59:45 | initialization of items |
| epilogues.go:59:41:59:45 | initialization of items | epilogues.go:60:8:60:8 | l |
| epilogues.go:60:2:60:33 | defer statement | epilogues.go:61:2:61:12 | selection of Println |
| epilogues.go:60:8:60:8 | l | epilogues.go:60:8:60:12 | selection of log |
| epilogues.go:60:8:60:12 | selection of log | epilogues.go:60:14:60:20 | "count" |
| epilogues.go:60:8:60:33 | call to log | epilogues.go:59:1:62:1 | exit |
| epilogues.go:60:14:60:20 | "count" | epilogues.go:60:23:60:25 | len |
| epilogues.go:60:23:60:25 | len | epilogues.go:60:27:60:31 | items |
| epilogues.go:60:23:60:32 | call to len | epilogues.go:60:2:60:33 | defer statement |
| epilogues.go:60:27:60:31 | items | epilogues.go:60:23:60:32 | call to len |
| epilogues.go:61:2:61:12 | selection of Println | epilogues.go:61:14:61:25 | "processing" |
| epilogues.go:61:2:61:38 | call to Println | epilogues.go:60:8:60:33 | call to log |
| epilogues.go:61:14:61:25 | "processing" | epilogues.go:61:28:61:30 | len |
| epilogues.go:61:28:61:30 | len | epilogues.go:61:32:61:36 | items |
| epilogues.go:61:28:61:37 | call to len | epilogues.go:61:2:61:38 | call to Println |
| epilogues.go:61:32:61:36 | items | epilogues.go:61:28:61:37 | call to len |
| epilogues.go:66:1:71:1 | entry | epilogues.go:66:28:66:33 | argument corresponding to prefix |
| epilogues.go:66:1:71:1 | function declaration | epilogues.go:77:6:77:20 | skip |
| epilogues.go:66:6:66:26 | skip | epilogues.go:66:1:71:1 | function declaration |
| epilogues.go:66:28:66:33 | argument corresponding to prefix | epilogues.go:66:28:66:33 | initialization of prefix |
| epilogues.go:66:28:66:33 | initialization of prefix | epilogues.go:67:2:67:2 | skip |
| epilogues.go:67:2:67:2 | assignment to l | epilogues.go:68:8:68:8 | l |
| epilogues.go:67:2:67:2 | skip | epilogues.go:67:7:67:31 | struct literal |
| epilogues.go:67:7:67:31 | struct literal | epilogues.go:67:25:67:30 | prefix |
| epilogues.go:67:17:67:30 | init of key-value pair | epilogues.go:67:2:67:2 | assignment to l |
| epilogues.go:67:25:67:30 | prefix | epilogues.go:67:17:67:30 | init of key-value pair |
| epilogues.go:68:2:68:24 | defer statement | epilogues.go:69:10:69:10 | l |
| epilogues.go:68:8:68:8 | l | epilogues.go:68:8:68:17 | selection of logValue |
| epilogues.go:68:8:68:17 | selection of logValue | epilogues.go:68:19:68:23 | "bye" |
| epilogues.go:68:8:68:24 | call to logValue | epilogues.go:66:1:71:1 | exit |
| epilogues.go:68:19:68:23 | "bye" | epilogues.go:68:2:68:24 | defer statement |
| epilogues.go:69:2:69:25 | defer statement | epilogues.go:70:2:70:12 | selection of Println |
| epilogues.go:69:8:69:15 | selection of log | epilogues.go:69:17:69:21 | "ptr" |
| epilogues.go:69:8:69:25 | call to log | epilogues.go:68:8:68:24 | call to logValue |
| epilogues.go:69:9:69:10 | &... | epilogues.go:69:8:69:15 | selection of log |
| epilogues.go:69:10:69:10 | l | epilogues.go:69:9:69:10 | &... |
| epilogues.go:69:17:69:21 | "ptr" | epilogues.go:69:24:69:24 | 7 |
| epilogues.go:69:24:69:24 | 7 | epilogues.go:69:2:69:25 | defer statement |
| epilogues.go:70:2:70:12 | selection of Println | epilogues.go:70:14:70:19 | "body" |
| epilogues.go:70:2:70:20 | call to Println | epilogues.go:69:8:69:25 | call to log |
| epilogues.go:70:14:70:19 | "body" | epilogues.go:70:2:70:20 | call to Println |
| epilogues.go:77:1:82:1 | entry | epilogues.go:77:22:77:22 | argument corresponding to x |
| epilogues.go:77:1:82:1 | function declaration | epilogues.go:87:6:87:20 | skip |
| epilogues.go:77:6:77:20 | skip | epilogues.go:77:1:82:1 | function declaration |
| epilogues.go:77:22:77:22 | argument corresponding to x | epilogues.go:77:22:77:22 | initialization of x |
| epilogues.go:77:22:77:22 | initialization of x | epilogues.go:78:8:80:2 | function literal |
| epilogues.go:78:2:80:15 | defer statement | epilogues.go:81:2:81:12 | selection of Println |
| epilogues.go:78:8:80:2 | entry | epilogues.go:78:13:78:17 | argument corresponding to label |
| epilogues.go:78:8:80:2 | function literal | epilogues.go:80:4:80:9 | "done" |
| epilogues.go:78:8:80:15 | function call | epilogues.go:77:1:82:1 | exit |
| epilogues.go:78:13:78:17 | argument corresponding to label | epilogues.go:78:13:78:17 | initialization of label |
| epilogues.go:78:13:78:17 | initialization of label | epilogues.go:78:27:78:27 | argument corresponding to n |
| epilogues.go:78:27:78:27 | argument corresponding to n | epilogues.go:78:27:78:27 | initialization of n |
| epilogues.go:78:27:78:27 | initialization of n | epilogues.go:79:3:79:13 | selection of Println |
| epilogues.go:79:3:79:13 | selection of Println | epilogues.go:79:15:79:19 | label |
| epilogues.go:79:3:79:23 | call to Println | epilogues.go:78:8:80:2 | exit |
| epilogues.go:79:15:79:19 | label | epilogues.go:79:22:79:22 | n |
| epilogues.go:79:22:79:22 | n | epilogues.go:79:3:79:23 | call to Println |
| epilogues.go:80:4:80:9 | "done" | epilogues.go:80:12:80:12 | x |
| epilogues.go:80:12:80:12 | x | epilogues.go:80:14:80:14 | 1 |
| epilogues.go:80:12:80:14 | ...+... | epilogues.go:78:2:80:15 | defer statement |
| epilogues.go:80:14:80:14 | 1 | epilogues.go:80:12:80:14 | ...+... |
| epilogues.go:81:2:81:12 | selection of Println | epilogues.go:81:14:81:19 | "body" |
| epilogues.go:81:2:81:23 | call to Println | epilogues.go:78:8:80:15 | function call |
| epilogues.go:81:14:81:19 | "body" | epilogues.go:81:22:81:22 | x |
| epilogues.go:81:22:81:22 | x | epilogues.go:81:2:81:23 | call to Println |
| epilogues.go:87:1:98:1 | entry | epilogues.go:87:22:87:22 | argument corresponding to x |
| epilogues.go:87:1:98:1 | function declaration | epilogues.go:102:6:102:24 | skip |
| epilogues.go:87:6:87:20 | skip | epilogues.go:87:1:98:1 | function declaration |
| epilogues.go:87:22:87:22 | argument corresponding to x | epilogues.go:87:22:87:22 | initialization of x |
| epilogues.go:87:22:87:22 | initialization of x | epilogues.go:87:30:87:35 | zero value for result |
| epilogues.go:87:30:87:35 | implicit read of result | epilogues.go:87:1:98:1 | exit |
| epilogues.go:87:30:87:35 | initialization of result | epilogues.go:88:8:92:2 | function literal |
| epilogues.go:87:30:87:35 | zero value for result | epilogues.go:87:30:87:35 | initialization of result |
| epilogues.go:88:2:92:4 | defer statement | epilogues.go:93:5:93:5 | x |
| epilogues.go:88:8:92:2 | entry | epilogues.go:89:6:89:6 | skip |
| epilogues.go:88:8:92:2 | function literal | epilogues.go:88:2:92:4 | defer statement |
| epilogues.go:88:8:92:4 | function call | epilogues.go:87:1:98:1 | exit |
| epilogues.go:88:8:92:4 | function call | epilogues.go:87:30:87:35 | implicit read of result |
| epilogues.go:89:6:89:6 | assignment to r | epilogues.go:89:22:89:22 | r |
| epilogues.go:89:6:89:6 | skip | epilogues.go:89:11:89:17 | recover |
| epilogues.go:89:11:89:17 | recover | epilogues.go:89:11:89:19 | call to recover |
| epilogues.go:89:11:89:19 | call to recover | epilogues.go:89:6:89:6 | assignment to r |
| epilogues.go:89:22:89:22 | r | epilogues.go:89:27:89:29 | nil |
| epilogues.go:89:22:89:29 | ...!=... | epilogues.go:88:8:92:2 | exit |
| epilogues.go:89:22:89:29 | ...!=... | epilogues.go:89:22:89:29 | ...!=... is false |
| epilogues.go:89:22:89:29 | ...!=... | epilogues.go:89:22:89:29 | ...!=... is true |
| epilogues.go:89:22:89:29 | ...!=... is false | epilogues.go:88:8:92:2 | exit |
| epilogues.go:89:22:89:29 | ...!=... is true | epilogues.go:90:4:90:9 | skip |
| epilogues.go:89:27:89:29 | nil | epilogues.go:89:22:89:29 | ...!=... |
| epilogues.go:90:4:90:9 | assignment to result | epilogues.go:88:8:92:2 | exit |
| epilogues.go:90:4:90:9 | skip | epilogues.go:90:13:90:14 | -... |
| epilogues.go:90:13:90:14 | -... | epilogues.go:90:4:90:9 | assignment to result |
| epilogues.go:93:5:93:5 | x | epilogues.go:93:9:93:9 | 0 |
| epilogues.go:93:5:93:9 | ...<... | epilogues.go:93:5:93:9 | ...<... is false |
| epilogues.go:93:5:93:9 | ...<... | epilogues.go:93:5:93:9 | ...<... is true |
| epilogues.go:93:5:93:9 | ...<... is false | epilogues.go:96:2:96:7 | skip |
| epilogues.go:93:5:93:9 | ...<... is true | epilogues.go:94:3:94:7 | panic |
| epilogues.go:93:9:93:9 | 0 | epilogues.go:93:5:93:9 | ...<... |
| epilogues.go:94:3:94:7 | panic | epilogues.go:94:9:94:13 | "neg" |
| epilogues.go:94:3:94:14 | call to panic | epilogues.go:88:8:92:4 | function call |
| epilogues.go:94:9:94:13 | "neg" | epilogues.go:94:3:94:14 | call to panic |
| epilogues.go:96:2:96:7 | assignment to result | epilogues.go:97:9:97:14 | result |
| epilogues.go:96:2:96:7 | skip | epilogues.go:96:11:96:11 | x |
| epilogues.go:96:11:96:11 | x | epilogues.go:96:15:96:15 | x |
| epilogues.go:96:11:96:15 | ...*... | epilogues.go:96:2:96:7 | assignment to result |
| epilogues.go:96:15:96:15 | x | epilogues.go:96:11:96:15 | ...*... |
| epilogues.go:97:2:97:14 | return statement | epilogues.go:88:8:92:4 | function call |
| epilogues.go:97:9:97:14 | implicit write of result | epilogues.go:97:2:97:14 | return statement |
| epilogues.go:97:9:97:14 | result | epilogues.go:97:9:97:14 | implicit write of result |
| epilogues.go:102:1:110:1 | entry | epilogues.go:102:26:102:26 | argument corresponding to x |
| epilogues.go:102:1:110:1 | function declaration | epilogues.go:115:6:115:22 | skip |
| epilogues.go:102:6:102:24 | skip | epilogues.go:102:1:110:1 | function declaration |
| epilogues.go:102:26:102:26 | argument corresponding to x | epilogues.go:102:26:102:26 | initialization of x |
| epilogues.go:102:26:102:26 | initialization of x | epilogues.go:102:34:102:35 | zero value for ok |
| epilogues.go:102:34:102:35 | implicit read of ok | epilogues.go:102:43:102:43 | implicit read of n |
| epilogues.go:102:34:102:35 | initialization of ok | epilogues.go:102:43:102:43 | zero value for n |
| epilogues.go:102:34:102:35 | zero value for ok | epilogues.go:102:34:102:35 | initialization of ok |
| epilogues.go:102:43:102:43 | implicit read of n | epilogues.go:102:1:110:1 | exit |
| epilogues.go:102:43:102:43 | initialization of n | epilogues.go:103:8:103:17 | epiRecover |
| epilogues.go:102:43:102:43 | zero value for n | epilogues.go:102:43:102:43 | initialization of n |
| epilogues.go:103:2:103:19 | defer statement | epilogues.go:104:5:104:5 | x |
| epilogues.go:103:8:103:17 | epiRecover | epilogues.go:103:2:103:19 | defer statement |
| epilogues.go:103:8:103:19 | call to epiRecover | epilogues.go:102:1:110:1 | exit |
| epilogues.go:103:8:103:19 | call to epiRecover | epilogues.go:102:34:102:35 | implicit read of ok |
| epilogues.go:104:5:104:5 | x | epilogues.go:104:10:104:10 | 0 |
| epilogues.go:104:5:104:10 | ...==... | epilogues.go:104:5:104:10 | ...==... is false |
| epilogues.go:104:5:104:10 | ...==... | epilogues.go:104:5:104:10 | ...==... is true |
| epilogues.go:104:5:104:10 | ...==... is false | epilogues.go:107:2:107:2 | skip |
| epilogues.go:104:5:104:10 | ...==... is true | epilogues.go:105:3:105:8 | return statement |
| epilogues.go:104:10:104:10 | 0 | epilogues.go:104:5:104:10 | ...==... |
| epilogues.go:105:3:105:8 | return statement | epilogues.go:103:8:103:19 | call to epiRecover |
| epilogues.go:107:2:107:2 | assignment to n | epilogues.go:108:2:108:3 | skip |
| epilogues.go:107:2:107:2 | skip | epilogues.go:107:6:107:6 | x |
| epilogues.go:107:6:107:6 | x | epilogues.go:107:2:107:2 | assignment to n |
| epilogues.go:108:2:108:3 | assignment to ok | epilogues.go:109:2:109:7 | return statement |
| epilogues.go:108:2:108:3 | skip | epilogues.go:108:7:108:10 | true |
| epilogues.go:108:7:108:10 | true | epilogues.go:108:2:108:3 | assignment to ok |
| epilogues.go:109:2:109:7 | return statement | epilogues.go:103:8:103:19 | call to epiRecover |
| epilogues.go:115:1:118:1 | entry | epilogues.go:116:8:116:17 | epiRecover |
| epilogues.go:115:1:118:1 | function declaration | epilogues.go:0:0:0:0 | exit |
| epilogues.go:115:6:115:22 | skip | epilogues.go:115:1:118:1 | function declaration |
| epilogues.go:116:2:116:19 | defer statement | epilogues.go:117:2:117:6 | panic |
| epilogues.go:116:8:116:17 | epiRecover | epilogues.go:116:2:116:19 | defer statement |
| epilogues.go:116:8:116:19 | call to epiRecover | epilogues.go:115:1:118:1 | exit |
| epilogues.go:117:2:117:6 | panic | epilogues.go:117:8:117:13 | "boom" |
| epilogues.go:117:2:117:14 | call to panic | epilogues.go:116:8:116:19 | call to epiRecover |
| epilogues.go:117:8:117:13 | "boom" | epilogues.go:117:2:117:14 | call to panic |
| equalitytests.go:0:0:0:0 | entry | equalitytests.go:3:1:5:1 | skip | | equalitytests.go:0:0:0:0 | entry | equalitytests.go:3:1:5:1 | skip |
| equalitytests.go:3:1:5:1 | skip | equalitytests.go:7:1:9:1 | skip | | equalitytests.go:3:1:5:1 | skip | equalitytests.go:7:1:9:1 | skip |
| equalitytests.go:7:1:9:1 | skip | equalitytests.go:11:6:11:18 | skip | | equalitytests.go:7:1:9:1 | skip | equalitytests.go:11:6:11:18 | skip |

View File

@@ -1,4 +1,3 @@
| epilogues.go:115:6:115:22 | epiRecoverUnnamed | github.com/github/codeql-go/ql/test/library-tests/semmle/go/controlflow/ControlFlowGraph.epiRecoverUnnamed |
| file://:0:0:0:0 | Exit | os.Exit | | file://:0:0:0:0 | Exit | os.Exit |
| file://:0:0:0:0 | Fatal | log.Fatal | | file://:0:0:0:0 | Fatal | log.Fatal |
| file://:0:0:0:0 | Fatal | log.Logger.Fatal | | file://:0:0:0:0 | Fatal | log.Logger.Fatal |

View File

@@ -1,118 +0,0 @@
package main
import "fmt"
// epiLogger has methods with both pointer and value receivers, used to check
// that the receiver and arguments of a deferred call are evaluated at the
// `defer` statement rather than in the function epilogue.
type epiLogger struct {
prefix string
}
func (l *epiLogger) log(msg string, code int) {
fmt.Println(l.prefix, msg, code)
}
func (l epiLogger) logValue(msg string) {
fmt.Println(l.prefix, msg)
}
// epiRecover recovers from a panic. It is used as a deferred function so we can
// check that control flow returns to the result-read nodes and the normal exit
// node after recovering.
func epiRecover() {
if r := recover(); r != nil {
fmt.Println("recovered:", r)
}
}
// epiPlain has no named result variable and a single `return` with a child
// expression.
func epiPlain(x int) int {
return x * 2
}
// epiVoid has no named result variable and no `return` statement at all.
func epiVoid() {
fmt.Println("void")
}
// epiNamedMixed has named result variables and a mix of a bare `return` (no
// child expressions) and a `return` with child expressions.
func epiNamedMixed(x int) (result int, err error) {
if x < 0 {
result = -x
return
}
return x, nil
}
// epiNamedBareOnly has a named result variable and only a bare `return`.
func epiNamedBareOnly(x int) (n int) {
n = x + 1
return
}
// epiDeferReceiverArgs has a deferred call with a (pointer) receiver and
// arguments that are expressions, so we can check the receiver `l` and the
// arguments `"count"` and `len(items)` are evaluated at the `defer` statement.
func epiDeferReceiverArgs(l *epiLogger, items []int) {
defer l.log("count", len(items))
fmt.Println("processing", len(items))
}
// epiDeferValueReceiver has deferred calls with a value receiver and an
// address-of receiver, both with arguments evaluated at the `defer` statement.
func epiDeferValueReceiver(prefix string) {
l := epiLogger{prefix: prefix}
defer l.logValue("bye")
defer (&l).log("ptr", 7)
fmt.Println("body")
}
// epiDeferFuncLit has a deferred function literal with parameters, so we can
// check that the arguments `"done"` and `x+1` are evaluated at the `defer`
// statement and that control flow enters the function literal body when it is
// invoked at the function epilogue.
func epiDeferFuncLit(x int) {
defer func(label string, n int) {
fmt.Println(label, n)
}("done", x+1)
fmt.Println("body", x)
}
// epiRecoverNamed has a named result variable and a deferred closure containing
// `recover()`. After recovering on the panic path, control flow should return
// to the result-read nodes and the normal exit node.
func epiRecoverNamed(x int) (result int) {
defer func() {
if r := recover(); r != nil {
result = -1
}
}()
if x < 0 {
panic("neg")
}
result = x * x
return result
}
// epiRecoverNamedBare has named result variables, a deferred function
// containing `recover()`, and only bare `return` statements.
func epiRecoverNamedBare(x int) (ok bool, n int) {
defer epiRecover()
if x == 0 {
return
}
n = x
ok = true
return
}
// epiRecoverUnnamed has no named result variables and a deferred function
// containing `recover()`; after recovering, control flow should reach the
// normal exit node directly (there are no result-read nodes).
func epiRecoverUnnamed() {
defer epiRecover()
panic("boom")
}

View File

@@ -1,7 +1,7 @@
overlay[local] overlay[local]
module; module;
import python import python as Py
private import semmle.python.internal.CachedStages private import semmle.python.internal.CachedStages
private import codeql.controlflow.BasicBlock as BB private import codeql.controlflow.BasicBlock as BB
@@ -17,7 +17,7 @@ private import codeql.controlflow.BasicBlock as BB
*/ */
private predicate augstore(ControlFlowNode load, ControlFlowNode store) { private predicate augstore(ControlFlowNode load, ControlFlowNode store) {
exists(Expr load_store | exists(AugAssign aa | aa.getTarget() = load_store) | exists(Py::Expr load_store | exists(Py::AugAssign aa | aa.getTarget() = load_store) |
toAst(load) = load_store and toAst(load) = load_store and
toAst(store) = load_store and toAst(store) = load_store and
load.strictlyDominates(store) load.strictlyDominates(store)
@@ -25,7 +25,7 @@ private predicate augstore(ControlFlowNode load, ControlFlowNode store) {
} }
/** A non-dispatched getNode() to avoid negative recursion issues */ /** A non-dispatched getNode() to avoid negative recursion issues */
private AstNode toAst(ControlFlowNode n) { py_flow_bb_node(n, result, _, _) } private Py::AstNode toAst(ControlFlowNode n) { py_flow_bb_node(n, result, _, _) }
/** /**
* A control flow node. Control flow nodes have a many-to-one relation with syntactic nodes, * A control flow node. Control flow nodes have a many-to-one relation with syntactic nodes,
@@ -35,19 +35,19 @@ private AstNode toAst(ControlFlowNode n) { py_flow_bb_node(n, result, _, _) }
class ControlFlowNode extends @py_flow_node { class ControlFlowNode extends @py_flow_node {
/** Whether this control flow node is a load (including those in augmented assignments) */ /** Whether this control flow node is a load (including those in augmented assignments) */
predicate isLoad() { predicate isLoad() {
exists(Expr e | e = toAst(this) | py_expr_contexts(_, 3, e) and not augstore(_, this)) exists(Py::Expr e | e = toAst(this) | py_expr_contexts(_, 3, e) and not augstore(_, this))
} }
/** Whether this control flow node is a store (including those in augmented assignments) */ /** Whether this control flow node is a store (including those in augmented assignments) */
predicate isStore() { predicate isStore() {
exists(Expr e | e = toAst(this) | py_expr_contexts(_, 5, e) or augstore(_, this)) exists(Py::Expr e | e = toAst(this) | py_expr_contexts(_, 5, e) or augstore(_, this))
} }
/** Whether this control flow node is a delete */ /** Whether this control flow node is a delete */
predicate isDelete() { exists(Expr e | e = toAst(this) | py_expr_contexts(_, 2, e)) } predicate isDelete() { exists(Py::Expr e | e = toAst(this) | py_expr_contexts(_, 2, e)) }
/** Whether this control flow node is a parameter */ /** Whether this control flow node is a parameter */
predicate isParameter() { exists(Expr e | e = toAst(this) | py_expr_contexts(_, 4, e)) } predicate isParameter() { exists(Py::Expr e | e = toAst(this) | py_expr_contexts(_, 4, e)) }
/** Whether this control flow node is a store in an augmented assignment */ /** Whether this control flow node is a store in an augmented assignment */
predicate isAugStore() { augstore(_, this) } predicate isAugStore() { augstore(_, this) }
@@ -57,61 +57,61 @@ class ControlFlowNode extends @py_flow_node {
/** Whether this flow node corresponds to a literal */ /** Whether this flow node corresponds to a literal */
predicate isLiteral() { predicate isLiteral() {
toAst(this) instanceof Bytes toAst(this) instanceof Py::Bytes
or or
toAst(this) instanceof Dict toAst(this) instanceof Py::Dict
or or
toAst(this) instanceof DictComp toAst(this) instanceof Py::DictComp
or or
toAst(this) instanceof Set toAst(this) instanceof Py::Set
or or
toAst(this) instanceof SetComp toAst(this) instanceof Py::SetComp
or or
toAst(this) instanceof Ellipsis toAst(this) instanceof Py::Ellipsis
or or
toAst(this) instanceof GeneratorExp toAst(this) instanceof Py::GeneratorExp
or or
toAst(this) instanceof Lambda toAst(this) instanceof Py::Lambda
or or
toAst(this) instanceof ListComp toAst(this) instanceof Py::ListComp
or or
toAst(this) instanceof List toAst(this) instanceof Py::List
or or
toAst(this) instanceof Num toAst(this) instanceof Py::Num
or or
toAst(this) instanceof Tuple toAst(this) instanceof Py::Tuple
or or
toAst(this) instanceof Unicode toAst(this) instanceof Py::Unicode
or or
toAst(this) instanceof NameConstant toAst(this) instanceof Py::NameConstant
} }
/** Whether this flow node corresponds to an attribute expression */ /** Whether this flow node corresponds to an attribute expression */
predicate isAttribute() { toAst(this) instanceof Attribute } predicate isAttribute() { toAst(this) instanceof Py::Attribute }
/** Whether this flow node corresponds to an subscript expression */ /** Whether this flow node corresponds to an subscript expression */
predicate isSubscript() { toAst(this) instanceof Subscript } predicate isSubscript() { toAst(this) instanceof Py::Subscript }
/** Whether this flow node corresponds to an import member */ /** Whether this flow node corresponds to an import member */
predicate isImportMember() { toAst(this) instanceof ImportMember } predicate isImportMember() { toAst(this) instanceof Py::ImportMember }
/** Whether this flow node corresponds to a call */ /** Whether this flow node corresponds to a call */
predicate isCall() { toAst(this) instanceof Call } predicate isCall() { toAst(this) instanceof Py::Call }
/** Whether this flow node is the first in a module */ /** Whether this flow node is the first in a module */
predicate isModuleEntry() { this.isEntryNode() and toAst(this) instanceof Module } predicate isModuleEntry() { this.isEntryNode() and toAst(this) instanceof Py::Module }
/** Whether this flow node corresponds to an import */ /** Whether this flow node corresponds to an import */
predicate isImport() { toAst(this) instanceof ImportExpr } predicate isImport() { toAst(this) instanceof Py::ImportExpr }
/** Whether this flow node corresponds to a conditional expression */ /** Whether this flow node corresponds to a conditional expression */
predicate isIfExp() { toAst(this) instanceof IfExp } predicate isIfExp() { toAst(this) instanceof Py::IfExp }
/** Whether this flow node corresponds to a function definition expression */ /** Whether this flow node corresponds to a function definition expression */
predicate isFunction() { toAst(this) instanceof FunctionExpr } predicate isFunction() { toAst(this) instanceof Py::FunctionExpr }
/** Whether this flow node corresponds to a class definition expression */ /** Whether this flow node corresponds to a class definition expression */
predicate isClass() { toAst(this) instanceof ClassExpr } predicate isClass() { toAst(this) instanceof Py::ClassExpr }
/** Gets a predecessor of this flow node */ /** Gets a predecessor of this flow node */
ControlFlowNode getAPredecessor() { this = result.getASuccessor() } ControlFlowNode getAPredecessor() { this = result.getASuccessor() }
@@ -123,25 +123,25 @@ class ControlFlowNode extends @py_flow_node {
ControlFlowNode getImmediateDominator() { py_idoms(this, result) } ControlFlowNode getImmediateDominator() { py_idoms(this, result) }
/** Gets the syntactic element corresponding to this flow node */ /** Gets the syntactic element corresponding to this flow node */
AstNode getNode() { py_flow_bb_node(this, result, _, _) } Py::AstNode getNode() { py_flow_bb_node(this, result, _, _) }
/** Gets a textual representation of this element. */ /** Gets a textual representation of this element. */
cached cached
string toString() { string toString() {
Stages::AST::ref() and Stages::AST::ref() and
// Since modules can have ambigous names, entry nodes can too, if we do not collate them. // Since modules can have ambigous names, entry nodes can too, if we do not collate them.
exists(Scope s | s.getEntryNode() = this | exists(Py::Scope s | s.getEntryNode() = this |
result = "Entry node for " + concat( | | s.toString(), ",") result = "Entry node for " + concat( | | s.toString(), ",")
) )
or or
exists(Scope s | s.getANormalExit() = this | result = "Exit node for " + s.toString()) exists(Py::Scope s | s.getANormalExit() = this | result = "Exit node for " + s.toString())
or or
not exists(Scope s | s.getEntryNode() = this or s.getANormalExit() = this) and not exists(Py::Scope s | s.getEntryNode() = this or s.getANormalExit() = this) and
result = "ControlFlowNode for " + this.getNode().toString() result = "ControlFlowNode for " + this.getNode().toString()
} }
/** Gets the location of this ControlFlowNode */ /** Gets the location of this ControlFlowNode */
Location getLocation() { result = this.getNode().getLocation() } Py::Location getLocation() { result = this.getNode().getLocation() }
/** Whether this flow node is the first in its scope */ /** Whether this flow node is the first in its scope */
predicate isEntryNode() { py_scope_flow(this, _, -1) } predicate isEntryNode() { py_scope_flow(this, _, -1) }
@@ -151,9 +151,9 @@ class ControlFlowNode extends @py_flow_node {
/** Gets the scope containing this flow node */ /** Gets the scope containing this flow node */
cached cached
Scope getScope() { Py::Scope getScope() {
Stages::AST::ref() and Stages::AST::ref() and
if this.getNode() instanceof Scope if this.getNode() instanceof Py::Scope
then then
/* Entry or exit node */ /* Entry or exit node */
result = this.getNode() result = this.getNode()
@@ -161,7 +161,7 @@ class ControlFlowNode extends @py_flow_node {
} }
/** Gets the enclosing module */ /** Gets the enclosing module */
Module getEnclosingModule() { result = this.getScope().getEnclosingModule() } Py::Module getEnclosingModule() { result = this.getScope().getEnclosingModule() }
/** Gets a successor for this node if the relevant condition is True. */ /** Gets a successor for this node if the relevant condition is True. */
ControlFlowNode getATrueSuccessor() { ControlFlowNode getATrueSuccessor() {
@@ -188,7 +188,7 @@ class ControlFlowNode extends @py_flow_node {
} }
/** Whether the scope may be exited as a result of this node raising an exception */ /** Whether the scope may be exited as a result of this node raising an exception */
predicate isExceptionalExit(Scope s) { py_scope_flow(this, s, 1) } predicate isExceptionalExit(Py::Scope s) { py_scope_flow(this, s, 1) }
/** Whether this node is a normal (non-exceptional) exit */ /** Whether this node is a normal (non-exceptional) exit */
predicate isNormalExit() { py_scope_flow(this, _, 0) or py_scope_flow(this, _, 2) } predicate isNormalExit() { py_scope_flow(this, _, 0) or py_scope_flow(this, _, 2) }
@@ -236,7 +236,7 @@ class ControlFlowNode extends @py_flow_node {
/* join-ordering helper for `getAChild() */ /* join-ordering helper for `getAChild() */
pragma[noinline] pragma[noinline]
private ControlFlowNode getExprChild(BasicBlock dom) { private ControlFlowNode getExprChild(BasicBlock dom) {
this.getNode().(Expr).getAChildNode() = result.getNode() and this.getNode().(Py::Expr).getAChildNode() = result.getNode() and
result.getBasicBlock().dominates(dom) and result.getBasicBlock().dominates(dom) and
not this instanceof UnaryExprNode not this instanceof UnaryExprNode
} }
@@ -249,16 +249,16 @@ class ControlFlowNode extends @py_flow_node {
*/ */
private class AnyNode extends ControlFlowNode { private class AnyNode extends ControlFlowNode {
override AstNode getNode() { result = super.getNode() } override Py::AstNode getNode() { result = super.getNode() }
} }
/** A control flow node corresponding to a call expression, such as `func(...)` */ /** A control flow node corresponding to a call expression, such as `func(...)` */
class CallNode extends ControlFlowNode { class CallNode extends ControlFlowNode {
CallNode() { toAst(this) instanceof Call } CallNode() { toAst(this) instanceof Py::Call }
/** Gets the flow node corresponding to the function expression for the call corresponding to this flow node */ /** Gets the flow node corresponding to the function expression for the call corresponding to this flow node */
ControlFlowNode getFunction() { ControlFlowNode getFunction() {
exists(Call c | exists(Py::Call c |
this.getNode() = c and this.getNode() = c and
c.getFunc() = result.getNode() and c.getFunc() = result.getNode() and
result.getBasicBlock().dominates(this.getBasicBlock()) result.getBasicBlock().dominates(this.getBasicBlock())
@@ -267,7 +267,7 @@ class CallNode extends ControlFlowNode {
/** Gets the flow node corresponding to the n'th positional argument of the call corresponding to this flow node */ /** Gets the flow node corresponding to the n'th positional argument of the call corresponding to this flow node */
ControlFlowNode getArg(int n) { ControlFlowNode getArg(int n) {
exists(Call c | exists(Py::Call c |
this.getNode() = c and this.getNode() = c and
c.getArg(n) = result.getNode() and c.getArg(n) = result.getNode() and
result.getBasicBlock().dominates(this.getBasicBlock()) result.getBasicBlock().dominates(this.getBasicBlock())
@@ -276,7 +276,7 @@ class CallNode extends ControlFlowNode {
/** Gets the flow node corresponding to the named argument of the call corresponding to this flow node */ /** Gets the flow node corresponding to the named argument of the call corresponding to this flow node */
ControlFlowNode getArgByName(string name) { ControlFlowNode getArgByName(string name) {
exists(Call c, Keyword k | exists(Py::Call c, Py::Keyword k |
this.getNode() = c and this.getNode() = c and
k = c.getANamedArg() and k = c.getANamedArg() and
k.getValue() = result.getNode() and k.getValue() = result.getNode() and
@@ -292,7 +292,7 @@ class CallNode extends ControlFlowNode {
result = this.getArgByName(_) result = this.getArgByName(_)
} }
override Call getNode() { result = super.getNode() } override Py::Call getNode() { result = super.getNode() }
predicate isDecoratorCall() { predicate isDecoratorCall() {
this.isClassDecoratorCall() this.isClassDecoratorCall()
@@ -301,11 +301,11 @@ class CallNode extends ControlFlowNode {
} }
predicate isClassDecoratorCall() { predicate isClassDecoratorCall() {
exists(ClassExpr cls | this.getNode() = cls.getADecoratorCall()) exists(Py::ClassExpr cls | this.getNode() = cls.getADecoratorCall())
} }
predicate isFunctionDecoratorCall() { predicate isFunctionDecoratorCall() {
exists(FunctionExpr func | this.getNode() = func.getADecoratorCall()) exists(Py::FunctionExpr func | this.getNode() = func.getADecoratorCall())
} }
/** Gets the first tuple (*) argument of this call, if any. */ /** Gets the first tuple (*) argument of this call, if any. */
@@ -323,11 +323,11 @@ class CallNode extends ControlFlowNode {
/** A control flow corresponding to an attribute expression, such as `value.attr` */ /** A control flow corresponding to an attribute expression, such as `value.attr` */
class AttrNode extends ControlFlowNode { class AttrNode extends ControlFlowNode {
AttrNode() { toAst(this) instanceof Attribute } AttrNode() { toAst(this) instanceof Py::Attribute }
/** Gets the flow node corresponding to the object of the attribute expression corresponding to this flow node */ /** Gets the flow node corresponding to the object of the attribute expression corresponding to this flow node */
ControlFlowNode getObject() { ControlFlowNode getObject() {
exists(Attribute a | exists(Py::Attribute a |
this.getNode() = a and this.getNode() = a and
a.getObject() = result.getNode() and a.getObject() = result.getNode() and
result.getBasicBlock().dominates(this.getBasicBlock()) result.getBasicBlock().dominates(this.getBasicBlock())
@@ -339,7 +339,7 @@ class AttrNode extends ControlFlowNode {
* with the matching name * with the matching name
*/ */
ControlFlowNode getObject(string name) { ControlFlowNode getObject(string name) {
exists(Attribute a | exists(Py::Attribute a |
this.getNode() = a and this.getNode() = a and
a.getObject() = result.getNode() and a.getObject() = result.getNode() and
a.getName() = name and a.getName() = name and
@@ -348,57 +348,57 @@ class AttrNode extends ControlFlowNode {
} }
/** Gets the attribute name of the attribute expression corresponding to this flow node */ /** Gets the attribute name of the attribute expression corresponding to this flow node */
string getName() { exists(Attribute a | this.getNode() = a and a.getName() = result) } string getName() { exists(Py::Attribute a | this.getNode() = a and a.getName() = result) }
override Attribute getNode() { result = super.getNode() } override Py::Attribute getNode() { result = super.getNode() }
} }
/** A control flow node corresponding to a `from ... import ...` expression */ /** A control flow node corresponding to a `from ... import ...` expression */
class ImportMemberNode extends ControlFlowNode { class ImportMemberNode extends ControlFlowNode {
ImportMemberNode() { toAst(this) instanceof ImportMember } ImportMemberNode() { toAst(this) instanceof Py::ImportMember }
/** /**
* Gets the flow node corresponding to the module in the import-member expression corresponding to this flow node, * Gets the flow node corresponding to the module in the import-member expression corresponding to this flow node,
* with the matching name * with the matching name
*/ */
ControlFlowNode getModule(string name) { ControlFlowNode getModule(string name) {
exists(ImportMember i | this.getNode() = i and i.getModule() = result.getNode() | exists(Py::ImportMember i | this.getNode() = i and i.getModule() = result.getNode() |
i.getName() = name and i.getName() = name and
result.getBasicBlock().dominates(this.getBasicBlock()) result.getBasicBlock().dominates(this.getBasicBlock())
) )
} }
override ImportMember getNode() { result = super.getNode() } override Py::ImportMember getNode() { result = super.getNode() }
} }
/** A control flow node corresponding to an artificial expression representing an import */ /** A control flow node corresponding to an artificial expression representing an import */
class ImportExprNode extends ControlFlowNode { class ImportExprNode extends ControlFlowNode {
ImportExprNode() { toAst(this) instanceof ImportExpr } ImportExprNode() { toAst(this) instanceof Py::ImportExpr }
override ImportExpr getNode() { result = super.getNode() } override Py::ImportExpr getNode() { result = super.getNode() }
} }
/** A control flow node corresponding to a `from ... import *` statement */ /** A control flow node corresponding to a `from ... import *` statement */
class ImportStarNode extends ControlFlowNode { class ImportStarNode extends ControlFlowNode {
ImportStarNode() { toAst(this) instanceof ImportStar } ImportStarNode() { toAst(this) instanceof Py::ImportStar }
/** Gets the flow node corresponding to the module in the import-star corresponding to this flow node */ /** Gets the flow node corresponding to the module in the import-star corresponding to this flow node */
ControlFlowNode getModule() { ControlFlowNode getModule() {
exists(ImportStar i | this.getNode() = i and i.getModuleExpr() = result.getNode() | exists(Py::ImportStar i | this.getNode() = i and i.getModuleExpr() = result.getNode() |
result.getBasicBlock().dominates(this.getBasicBlock()) result.getBasicBlock().dominates(this.getBasicBlock())
) )
} }
override ImportStar getNode() { result = super.getNode() } override Py::ImportStar getNode() { result = super.getNode() }
} }
/** A control flow node corresponding to a subscript expression, such as `value[slice]` */ /** A control flow node corresponding to a subscript expression, such as `value[slice]` */
class SubscriptNode extends ControlFlowNode { class SubscriptNode extends ControlFlowNode {
SubscriptNode() { toAst(this) instanceof Subscript } SubscriptNode() { toAst(this) instanceof Py::Subscript }
/** flow node corresponding to the value of the sequence in a subscript operation */ /** flow node corresponding to the value of the sequence in a subscript operation */
ControlFlowNode getObject() { ControlFlowNode getObject() {
exists(Subscript s | exists(Py::Subscript s |
this.getNode() = s and this.getNode() = s and
s.getObject() = result.getNode() and s.getObject() = result.getNode() and
result.getBasicBlock().dominates(this.getBasicBlock()) result.getBasicBlock().dominates(this.getBasicBlock())
@@ -407,23 +407,23 @@ class SubscriptNode extends ControlFlowNode {
/** flow node corresponding to the index in a subscript operation */ /** flow node corresponding to the index in a subscript operation */
ControlFlowNode getIndex() { ControlFlowNode getIndex() {
exists(Subscript s | exists(Py::Subscript s |
this.getNode() = s and this.getNode() = s and
s.getIndex() = result.getNode() and s.getIndex() = result.getNode() and
result.getBasicBlock().dominates(this.getBasicBlock()) result.getBasicBlock().dominates(this.getBasicBlock())
) )
} }
override Subscript getNode() { result = super.getNode() } override Py::Subscript getNode() { result = super.getNode() }
} }
/** A control flow node corresponding to a comparison operation, such as `x<y` */ /** A control flow node corresponding to a comparison operation, such as `x<y` */
class CompareNode extends ControlFlowNode { class CompareNode extends ControlFlowNode {
CompareNode() { toAst(this) instanceof Compare } CompareNode() { toAst(this) instanceof Py::Compare }
/** Whether left and right are a pair of operands for this comparison */ /** Whether left and right are a pair of operands for this comparison */
predicate operands(ControlFlowNode left, Cmpop op, ControlFlowNode right) { predicate operands(ControlFlowNode left, Py::Cmpop op, ControlFlowNode right) {
exists(Compare c, Expr eleft, Expr eright | exists(Py::Compare c, Py::Expr eleft, Py::Expr eright |
this.getNode() = c and left.getNode() = eleft and right.getNode() = eright this.getNode() = c and left.getNode() = eleft and right.getNode() = eright
| |
eleft = c.getLeft() and eright = c.getComparator(0) and op = c.getOp(0) eleft = c.getLeft() and eright = c.getComparator(0) and op = c.getOp(0)
@@ -436,26 +436,26 @@ class CompareNode extends ControlFlowNode {
right.getBasicBlock().dominates(this.getBasicBlock()) right.getBasicBlock().dominates(this.getBasicBlock())
} }
override Compare getNode() { result = super.getNode() } override Py::Compare getNode() { result = super.getNode() }
} }
/** A control flow node corresponding to a conditional expression such as, `body if test else orelse` */ /** A control flow node corresponding to a conditional expression such as, `body if test else orelse` */
class IfExprNode extends ControlFlowNode { class IfExprNode extends ControlFlowNode {
IfExprNode() { toAst(this) instanceof IfExp } IfExprNode() { toAst(this) instanceof Py::IfExp }
/** flow node corresponding to one of the operands of an if-expression */ /** flow node corresponding to one of the operands of an if-expression */
ControlFlowNode getAnOperand() { result = this.getAPredecessor() } ControlFlowNode getAnOperand() { result = this.getAPredecessor() }
override IfExp getNode() { result = super.getNode() } override Py::IfExp getNode() { result = super.getNode() }
} }
/** A control flow node corresponding to an assignment expression such as `lhs := rhs`. */ /** A control flow node corresponding to an assignment expression such as `lhs := rhs`. */
class AssignmentExprNode extends ControlFlowNode { class AssignmentExprNode extends ControlFlowNode {
AssignmentExprNode() { toAst(this) instanceof AssignExpr } AssignmentExprNode() { toAst(this) instanceof Py::AssignExpr }
/** Gets the flow node corresponding to the left-hand side of the assignment expression */ /** Gets the flow node corresponding to the left-hand side of the assignment expression */
ControlFlowNode getTarget() { ControlFlowNode getTarget() {
exists(AssignExpr a | exists(Py::AssignExpr a |
this.getNode() = a and this.getNode() = a and
a.getTarget() = result.getNode() and a.getTarget() = result.getNode() and
result.getBasicBlock().dominates(this.getBasicBlock()) result.getBasicBlock().dominates(this.getBasicBlock())
@@ -464,27 +464,27 @@ class AssignmentExprNode extends ControlFlowNode {
/** Gets the flow node corresponding to the right-hand side of the assignment expression */ /** Gets the flow node corresponding to the right-hand side of the assignment expression */
ControlFlowNode getValue() { ControlFlowNode getValue() {
exists(AssignExpr a | exists(Py::AssignExpr a |
this.getNode() = a and this.getNode() = a and
a.getValue() = result.getNode() and a.getValue() = result.getNode() and
result.getBasicBlock().dominates(this.getBasicBlock()) result.getBasicBlock().dominates(this.getBasicBlock())
) )
} }
override AssignExpr getNode() { result = super.getNode() } override Py::AssignExpr getNode() { result = super.getNode() }
} }
/** A control flow node corresponding to a binary expression, such as `x + y` */ /** A control flow node corresponding to a binary expression, such as `x + y` */
class BinaryExprNode extends ControlFlowNode { class BinaryExprNode extends ControlFlowNode {
BinaryExprNode() { toAst(this) instanceof BinaryExpr } BinaryExprNode() { toAst(this) instanceof Py::BinaryExpr }
/** flow node corresponding to one of the operands of a binary expression */ /** flow node corresponding to one of the operands of a binary expression */
ControlFlowNode getAnOperand() { result = this.getLeft() or result = this.getRight() } ControlFlowNode getAnOperand() { result = this.getLeft() or result = this.getRight() }
override BinaryExpr getNode() { result = super.getNode() } override Py::BinaryExpr getNode() { result = super.getNode() }
ControlFlowNode getLeft() { ControlFlowNode getLeft() {
exists(BinaryExpr b | exists(Py::BinaryExpr b |
this.getNode() = b and this.getNode() = b and
result.getNode() = b.getLeft() and result.getNode() = b.getLeft() and
result.getBasicBlock().dominates(this.getBasicBlock()) result.getBasicBlock().dominates(this.getBasicBlock())
@@ -492,7 +492,7 @@ class BinaryExprNode extends ControlFlowNode {
} }
ControlFlowNode getRight() { ControlFlowNode getRight() {
exists(BinaryExpr b | exists(Py::BinaryExpr b |
this.getNode() = b and this.getNode() = b and
result.getNode() = b.getRight() and result.getNode() = b.getRight() and
result.getBasicBlock().dominates(this.getBasicBlock()) result.getBasicBlock().dominates(this.getBasicBlock())
@@ -500,11 +500,11 @@ class BinaryExprNode extends ControlFlowNode {
} }
/** Gets the operator of this binary expression node. */ /** Gets the operator of this binary expression node. */
Operator getOp() { result = this.getNode().getOp() } Py::Operator getOp() { result = this.getNode().getOp() }
/** Whether left and right are a pair of operands for this binary expression */ /** Whether left and right are a pair of operands for this binary expression */
predicate operands(ControlFlowNode left, Operator op, ControlFlowNode right) { predicate operands(ControlFlowNode left, Py::Operator op, ControlFlowNode right) {
exists(BinaryExpr b, Expr eleft, Expr eright | exists(Py::BinaryExpr b, Py::Expr eleft, Py::Expr eright |
this.getNode() = b and left.getNode() = eleft and right.getNode() = eright this.getNode() = b and left.getNode() = eleft and right.getNode() = eright
| |
eleft = b.getLeft() and eright = b.getRight() and op = b.getOp() eleft = b.getLeft() and eright = b.getRight() and op = b.getOp()
@@ -516,20 +516,20 @@ class BinaryExprNode extends ControlFlowNode {
/** A control flow node corresponding to a boolean shortcut (and/or) operation */ /** A control flow node corresponding to a boolean shortcut (and/or) operation */
class BoolExprNode extends ControlFlowNode { class BoolExprNode extends ControlFlowNode {
BoolExprNode() { toAst(this) instanceof BoolExpr } BoolExprNode() { toAst(this) instanceof Py::BoolExpr }
/** flow node corresponding to one of the operands of a boolean expression */ /** flow node corresponding to one of the operands of a boolean expression */
ControlFlowNode getAnOperand() { ControlFlowNode getAnOperand() {
exists(BoolExpr b | this.getNode() = b and result.getNode() = b.getAValue()) and exists(Py::BoolExpr b | this.getNode() = b and result.getNode() = b.getAValue()) and
this.getBasicBlock().dominates(result.getBasicBlock()) this.getBasicBlock().dominates(result.getBasicBlock())
} }
override BoolExpr getNode() { result = super.getNode() } override Py::BoolExpr getNode() { result = super.getNode() }
} }
/** A control flow node corresponding to a unary expression: (`+x`), (`-x`) or (`~x`) */ /** A control flow node corresponding to a unary expression: (`+x`), (`-x`) or (`~x`) */
class UnaryExprNode extends ControlFlowNode { class UnaryExprNode extends ControlFlowNode {
UnaryExprNode() { toAst(this) instanceof UnaryExpr } UnaryExprNode() { toAst(this) instanceof Py::UnaryExpr }
/** /**
* Gets flow node corresponding to the operand of a unary expression. * Gets flow node corresponding to the operand of a unary expression.
@@ -540,7 +540,7 @@ class UnaryExprNode extends ControlFlowNode {
*/ */
ControlFlowNode getOperand() { result = this.getAPredecessor() } ControlFlowNode getOperand() { result = this.getAPredecessor() }
override UnaryExpr getNode() { result = super.getNode() } override Py::UnaryExpr getNode() { result = super.getNode() }
override ControlFlowNode getAChild() { result = this.getAPredecessor() } override ControlFlowNode getAChild() { result = this.getAPredecessor() }
} }
@@ -555,22 +555,22 @@ class DefinitionNode extends ControlFlowNode {
cached cached
DefinitionNode() { DefinitionNode() {
Stages::AST::ref() and Stages::AST::ref() and
exists(Assign a | this.getNode() = a.getATarget()) exists(Py::Assign a | this.getNode() = a.getATarget())
or or
exists(AssignExpr a | this.getNode() = a.getTarget()) exists(Py::AssignExpr a | this.getNode() = a.getTarget())
or or
exists(AnnAssign a | this.getNode() = a.getTarget() and exists(a.getValue())) exists(Py::AnnAssign a | this.getNode() = a.getTarget() and exists(a.getValue()))
or or
exists(Alias a | this.getNode() = a.getAsname()) exists(Py::Alias a | this.getNode() = a.getAsname())
or or
augstore(_, this) augstore(_, this)
or or
// `x, y = 1, 2` where LHS is a combination of list or tuples // `x, y = 1, 2` where LHS is a combination of list or tuples
exists(Assign a | this.getNode() = list_or_tuple_nested_element(a.getATarget())) exists(Py::Assign a | this.getNode() = list_or_tuple_nested_element(a.getATarget()))
or or
exists(For for | this.getNode() = for.getTarget()) exists(Py::For for | this.getNode() = for.getTarget())
or or
exists(Parameter param | this.getNode() = param.asName() and exists(param.getDefault())) exists(Py::Parameter param | this.getNode() = param.asName() and exists(param.getDefault()))
} }
/** flow node corresponding to the value assigned for the definition corresponding to this flow node */ /** flow node corresponding to the value assigned for the definition corresponding to this flow node */
@@ -584,16 +584,16 @@ class DefinitionNode extends ControlFlowNode {
// since the default value for a parameter is evaluated in the same basic block as // since the default value for a parameter is evaluated in the same basic block as
// the function definition, but the parameter belongs to the basic block of the function, // the function definition, but the parameter belongs to the basic block of the function,
// there is no dominance relationship between the two. // there is no dominance relationship between the two.
exists(Parameter param | this.getNode() = param.asName()) exists(Py::Parameter param | this.getNode() = param.asName())
) )
} }
} }
private Expr list_or_tuple_nested_element(Expr list_or_tuple) { private Py::Expr list_or_tuple_nested_element(Py::Expr list_or_tuple) {
exists(Expr elt | exists(Py::Expr elt |
elt = list_or_tuple.(Tuple).getAnElt() elt = list_or_tuple.(Py::Tuple).getAnElt()
or or
elt = list_or_tuple.(List).getAnElt() elt = list_or_tuple.(Py::List).getAnElt()
| |
result = elt result = elt
or or
@@ -603,12 +603,12 @@ private Expr list_or_tuple_nested_element(Expr list_or_tuple) {
/** /**
* A control flow node corresponding to a deletion statement, such as `del x`. * A control flow node corresponding to a deletion statement, such as `del x`.
* There can be multiple `DeletionNode`s for each `Delete` such that each * There can be multiple `DeletionNode`s for each `Py::Delete` such that each
* target has own `DeletionNode`. The CFG for `del a, x.y` looks like: * target has own `DeletionNode`. The CFG for `del a, x.y` looks like:
* `NameNode('a') -> DeletionNode -> NameNode('b') -> AttrNode('y') -> DeletionNode`. * `NameNode('a') -> DeletionNode -> NameNode('b') -> AttrNode('y') -> DeletionNode`.
*/ */
class DeletionNode extends ControlFlowNode { class DeletionNode extends ControlFlowNode {
DeletionNode() { toAst(this) instanceof Delete } DeletionNode() { toAst(this) instanceof Py::Delete }
/** Gets the unique target of this deletion node. */ /** Gets the unique target of this deletion node. */
ControlFlowNode getTarget() { result.getASuccessor() = this } ControlFlowNode getTarget() { result.getASuccessor() = this }
@@ -617,9 +617,9 @@ class DeletionNode extends ControlFlowNode {
/** A control flow node corresponding to a sequence (tuple or list) literal */ /** A control flow node corresponding to a sequence (tuple or list) literal */
abstract class SequenceNode extends ControlFlowNode { abstract class SequenceNode extends ControlFlowNode {
SequenceNode() { SequenceNode() {
toAst(this) instanceof Tuple toAst(this) instanceof Py::Tuple
or or
toAst(this) instanceof List toAst(this) instanceof Py::List
} }
/** Gets the control flow node for an element of this sequence */ /** Gets the control flow node for an element of this sequence */
@@ -632,11 +632,11 @@ abstract class SequenceNode extends ControlFlowNode {
/** A control flow node corresponding to a tuple expression such as `( 1, 3, 5, 7, 9 )` */ /** A control flow node corresponding to a tuple expression such as `( 1, 3, 5, 7, 9 )` */
class TupleNode extends SequenceNode { class TupleNode extends SequenceNode {
TupleNode() { toAst(this) instanceof Tuple } TupleNode() { toAst(this) instanceof Py::Tuple }
override ControlFlowNode getElement(int n) { override ControlFlowNode getElement(int n) {
Stages::AST::ref() and Stages::AST::ref() and
exists(Tuple t | this.getNode() = t and result.getNode() = t.getElt(n)) and exists(Py::Tuple t | this.getNode() = t and result.getNode() = t.getElt(n)) and
( (
result.getBasicBlock().dominates(this.getBasicBlock()) result.getBasicBlock().dominates(this.getBasicBlock())
or or
@@ -647,10 +647,10 @@ class TupleNode extends SequenceNode {
/** A control flow node corresponding to a list expression, such as `[ 1, 3, 5, 7, 9 ]` */ /** A control flow node corresponding to a list expression, such as `[ 1, 3, 5, 7, 9 ]` */
class ListNode extends SequenceNode { class ListNode extends SequenceNode {
ListNode() { toAst(this) instanceof List } ListNode() { toAst(this) instanceof Py::List }
override ControlFlowNode getElement(int n) { override ControlFlowNode getElement(int n) {
exists(List l | this.getNode() = l and result.getNode() = l.getElt(n)) and exists(Py::List l | this.getNode() = l and result.getNode() = l.getElt(n)) and
( (
result.getBasicBlock().dominates(this.getBasicBlock()) result.getBasicBlock().dominates(this.getBasicBlock())
or or
@@ -661,10 +661,10 @@ class ListNode extends SequenceNode {
/** A control flow node corresponding to a set expression, such as `{ 1, 3, 5, 7, 9 }` */ /** A control flow node corresponding to a set expression, such as `{ 1, 3, 5, 7, 9 }` */
class SetNode extends ControlFlowNode { class SetNode extends ControlFlowNode {
SetNode() { toAst(this) instanceof Set } SetNode() { toAst(this) instanceof Py::Set }
ControlFlowNode getAnElement() { ControlFlowNode getAnElement() {
exists(Set s | this.getNode() = s and result.getNode() = s.getElt(_)) and exists(Py::Set s | this.getNode() = s and result.getNode() = s.getElt(_)) and
( (
result.getBasicBlock().dominates(this.getBasicBlock()) result.getBasicBlock().dominates(this.getBasicBlock())
or or
@@ -675,20 +675,20 @@ class SetNode extends ControlFlowNode {
/** A control flow node corresponding to a dictionary literal, such as `{ 'a': 1, 'b': 2 }` */ /** A control flow node corresponding to a dictionary literal, such as `{ 'a': 1, 'b': 2 }` */
class DictNode extends ControlFlowNode { class DictNode extends ControlFlowNode {
DictNode() { toAst(this) instanceof Dict } DictNode() { toAst(this) instanceof Py::Dict }
/** /**
* Gets a key of this dictionary literal node, for those items that have keys * Gets a key of this dictionary literal node, for those items that have keys
* E.g, in {'a':1, **b} this returns only 'a' * E.g, in {'a':1, **b} this returns only 'a'
*/ */
ControlFlowNode getAKey() { ControlFlowNode getAKey() {
exists(Dict d | this.getNode() = d and result.getNode() = d.getAKey()) and exists(Py::Dict d | this.getNode() = d and result.getNode() = d.getAKey()) and
result.getBasicBlock().dominates(this.getBasicBlock()) result.getBasicBlock().dominates(this.getBasicBlock())
} }
/** Gets a value of this dictionary literal node */ /** Gets a value of this dictionary literal node */
ControlFlowNode getAValue() { ControlFlowNode getAValue() {
exists(Dict d | this.getNode() = d and result.getNode() = d.getAValue()) and exists(Py::Dict d | this.getNode() = d and result.getNode() = d.getAValue()) and
result.getBasicBlock().dominates(this.getBasicBlock()) result.getBasicBlock().dominates(this.getBasicBlock())
} }
} }
@@ -712,21 +712,23 @@ class IterableNode extends ControlFlowNode {
} }
} }
private AstNode assigned_value(Expr lhs) { private Py::AstNode assigned_value(Py::Expr lhs) {
/* lhs = result */ /* lhs = result */
exists(Assign a | a.getATarget() = lhs and result = a.getValue()) exists(Py::Assign a | a.getATarget() = lhs and result = a.getValue())
or or
/* lhs := result */ /* lhs := result */
exists(AssignExpr a | a.getTarget() = lhs and result = a.getValue()) exists(Py::AssignExpr a | a.getTarget() = lhs and result = a.getValue())
or or
/* lhs : annotation = result */ /* lhs : annotation = result */
exists(AnnAssign a | a.getTarget() = lhs and result = a.getValue()) exists(Py::AnnAssign a | a.getTarget() = lhs and result = a.getValue())
or or
/* import result as lhs */ /* import result as lhs */
exists(Alias a | a.getAsname() = lhs and result = a.getValue()) exists(Py::Alias a | a.getAsname() = lhs and result = a.getValue())
or or
/* lhs += x => result = (lhs + x) */ /* lhs += x => result = (lhs + x) */
exists(AugAssign a, BinaryExpr b | b = a.getOperation() and result = b and lhs = b.getLeft()) exists(Py::AugAssign a, Py::BinaryExpr b |
b = a.getOperation() and result = b and lhs = b.getLeft()
)
or or
/* /*
* ..., lhs, ... = ..., result, ... * ..., lhs, ... = ..., result, ...
@@ -734,31 +736,31 @@ private AstNode assigned_value(Expr lhs) {
* ..., (..., lhs, ...), ... = ..., (..., result, ...), ... * ..., (..., lhs, ...), ... = ..., (..., result, ...), ...
*/ */
exists(Assign a | nested_sequence_assign(a.getATarget(), a.getValue(), lhs, result)) exists(Py::Assign a | nested_sequence_assign(a.getATarget(), a.getValue(), lhs, result))
or or
/* for lhs in seq: => `result` is the `for` node, representing the `iter(next(seq))` operation. */ /* for lhs in seq: => `result` is the `for` node, representing the `iter(next(seq))` operation. */
result.(For).getTarget() = lhs result.(Py::For).getTarget() = lhs
or or
exists(Parameter param | lhs = param.asName() and result = param.getDefault()) exists(Py::Parameter param | lhs = param.asName() and result = param.getDefault())
} }
predicate nested_sequence_assign( predicate nested_sequence_assign(
Expr left_parent, Expr right_parent, Expr left_result, Expr right_result Py::Expr left_parent, Py::Expr right_parent, Py::Expr left_result, Py::Expr right_result
) { ) {
exists(Assign a | exists(Py::Assign a |
a.getATarget().getASubExpression*() = left_parent and a.getATarget().getASubExpression*() = left_parent and
a.getValue().getASubExpression*() = right_parent a.getValue().getASubExpression*() = right_parent
) and ) and
exists(int i, Expr left_elem, Expr right_elem | exists(int i, Py::Expr left_elem, Py::Expr right_elem |
( (
left_elem = left_parent.(Tuple).getElt(i) left_elem = left_parent.(Py::Tuple).getElt(i)
or or
left_elem = left_parent.(List).getElt(i) left_elem = left_parent.(Py::List).getElt(i)
) and ) and
( (
right_elem = right_parent.(Tuple).getElt(i) right_elem = right_parent.(Py::Tuple).getElt(i)
or or
right_elem = right_parent.(List).getElt(i) right_elem = right_parent.(Py::List).getElt(i)
) )
| |
left_result = left_elem and right_result = right_elem left_result = left_elem and right_result = right_elem
@@ -769,9 +771,9 @@ predicate nested_sequence_assign(
/** A flow node for a `for` statement. */ /** A flow node for a `for` statement. */
class ForNode extends ControlFlowNode { class ForNode extends ControlFlowNode {
ForNode() { toAst(this) instanceof For } ForNode() { toAst(this) instanceof Py::For }
override For getNode() { result = super.getNode() } override Py::For getNode() { result = super.getNode() }
/** Holds if this `for` statement causes iteration over `sequence` storing each step of the iteration in `target` */ /** Holds if this `for` statement causes iteration over `sequence` storing each step of the iteration in `target` */
predicate iterates(ControlFlowNode target, ControlFlowNode sequence) { predicate iterates(ControlFlowNode target, ControlFlowNode sequence) {
@@ -782,7 +784,7 @@ class ForNode extends ControlFlowNode {
/** Gets the sequence node for this `for` statement. */ /** Gets the sequence node for this `for` statement. */
ControlFlowNode getSequence() { ControlFlowNode getSequence() {
exists(For for | exists(Py::For for |
toAst(this) = for and toAst(this) = for and
for.getIter() = result.getNode() for.getIter() = result.getNode()
| |
@@ -792,7 +794,7 @@ class ForNode extends ControlFlowNode {
/** A possible `target` for this `for` statement, not accounting for loop unrolling */ /** A possible `target` for this `for` statement, not accounting for loop unrolling */
private ControlFlowNode possibleTarget() { private ControlFlowNode possibleTarget() {
exists(For for | exists(Py::For for |
toAst(this) = for and toAst(this) = for and
for.getTarget() = result.getNode() and for.getTarget() = result.getNode() and
this.getBasicBlock().dominates(result.getBasicBlock()) this.getBasicBlock().dominates(result.getBasicBlock())
@@ -809,11 +811,11 @@ class ForNode extends ControlFlowNode {
/** A flow node for a `raise` statement */ /** A flow node for a `raise` statement */
class RaiseStmtNode extends ControlFlowNode { class RaiseStmtNode extends ControlFlowNode {
RaiseStmtNode() { toAst(this) instanceof Raise } RaiseStmtNode() { toAst(this) instanceof Py::Raise }
/** Gets the control flow node for the exception raised by this raise statement */ /** Gets the control flow node for the exception raised by this raise statement */
ControlFlowNode getException() { ControlFlowNode getException() {
exists(Raise r | exists(Py::Raise r |
r = toAst(this) and r = toAst(this) and
r.getException() = toAst(result) and r.getException() = toAst(result) and
result.getBasicBlock().dominates(this.getBasicBlock()) result.getBasicBlock().dominates(this.getBasicBlock())
@@ -827,36 +829,36 @@ class RaiseStmtNode extends ControlFlowNode {
*/ */
class NameNode extends ControlFlowNode { class NameNode extends ControlFlowNode {
NameNode() { NameNode() {
exists(Name n | py_flow_bb_node(this, n, _, _)) exists(Py::Name n | py_flow_bb_node(this, n, _, _))
or or
exists(PlaceHolder p | py_flow_bb_node(this, p, _, _)) exists(Py::PlaceHolder p | py_flow_bb_node(this, p, _, _))
} }
/** Whether this flow node defines the variable `v`. */ /** Whether this flow node defines the variable `v`. */
predicate defines(Variable v) { predicate defines(Py::Variable v) {
exists(Name d | this.getNode() = d and d.defines(v)) and exists(Py::Name d | this.getNode() = d and d.defines(v)) and
not this.isLoad() not this.isLoad()
} }
/** Whether this flow node deletes the variable `v`. */ /** Whether this flow node deletes the variable `v`. */
predicate deletes(Variable v) { exists(Name d | this.getNode() = d and d.deletes(v)) } predicate deletes(Py::Variable v) { exists(Py::Name d | this.getNode() = d and d.deletes(v)) }
/** Whether this flow node uses the variable `v`. */ /** Whether this flow node uses the variable `v`. */
predicate uses(Variable v) { predicate uses(Py::Variable v) {
this.isLoad() and this.isLoad() and
exists(Name u | this.getNode() = u and u.uses(v)) exists(Py::Name u | this.getNode() = u and u.uses(v))
or or
exists(PlaceHolder u | exists(Py::PlaceHolder u |
this.getNode() = u and u.getVariable() = v and u.getCtx() instanceof Load this.getNode() = u and u.getVariable() = v and u.getCtx() instanceof Py::Load
) )
or or
Scopes::use_of_global_variable(this, v.getScope(), v.getId()) Scopes::use_of_global_variable(this, v.getScope(), v.getId())
} }
string getId() { string getId() {
result = this.getNode().(Name).getId() result = this.getNode().(Py::Name).getId()
or or
result = this.getNode().(PlaceHolder).getId() result = this.getNode().(Py::PlaceHolder).getId()
} }
/** Whether this is a use of a local variable. */ /** Whether this is a use of a local variable. */
@@ -868,37 +870,39 @@ class NameNode extends ControlFlowNode {
/** Whether this is a use of a global (including builtin) variable. */ /** Whether this is a use of a global (including builtin) variable. */
predicate isGlobal() { Scopes::use_of_global_variable(this, _, _) } predicate isGlobal() { Scopes::use_of_global_variable(this, _, _) }
predicate isSelf() { exists(SsaVariable selfvar | selfvar.isSelf() and selfvar.getAUse() = this) } predicate isSelf() {
exists(Py::SsaVariable selfvar | selfvar.isSelf() and selfvar.getAUse() = this)
}
} }
/** A control flow node corresponding to a named constant, one of `None`, `True` or `False`. */ /** A control flow node corresponding to a named constant, one of `None`, `True` or `False`. */
class NameConstantNode extends NameNode { class NameConstantNode extends NameNode {
NameConstantNode() { exists(NameConstant n | py_flow_bb_node(this, n, _, _)) } NameConstantNode() { exists(Py::NameConstant n | py_flow_bb_node(this, n, _, _)) }
/* /*
* We ought to override uses as well, but that has * We ought to override uses as well, but that has
* a serious performance impact. * a serious performance impact.
* deprecated predicate uses(Variable v) { none() } * deprecated predicate uses(Py::Variable v) { none() }
*/ */
} }
/** A control flow node corresponding to a starred expression, `*a`. */ /** A control flow node corresponding to a starred expression, `*a`. */
class StarredNode extends ControlFlowNode { class StarredNode extends ControlFlowNode {
StarredNode() { toAst(this) instanceof Starred } StarredNode() { toAst(this) instanceof Py::Starred }
ControlFlowNode getValue() { toAst(result) = toAst(this).(Starred).getValue() } ControlFlowNode getValue() { toAst(result) = toAst(this).(Py::Starred).getValue() }
} }
/** The ControlFlowNode for an 'except' statement. */ /** The ControlFlowNode for an 'except' statement. */
class ExceptFlowNode extends ControlFlowNode { class ExceptFlowNode extends ControlFlowNode {
ExceptFlowNode() { this.getNode() instanceof ExceptStmt } ExceptFlowNode() { this.getNode() instanceof Py::ExceptStmt }
/** /**
* Gets the type handled by this exception handler. * Gets the type handled by this exception handler.
* `ExceptionType` in `except ExceptionType as e:` * `Py::ExceptionType` in `except Py::ExceptionType as e:`
*/ */
ControlFlowNode getType() { ControlFlowNode getType() {
exists(ExceptStmt ex | exists(Py::ExceptStmt ex |
this.getBasicBlock().dominates(result.getBasicBlock()) and this.getBasicBlock().dominates(result.getBasicBlock()) and
ex = this.getNode() and ex = this.getNode() and
result.getNode() = ex.getType() result.getNode() = ex.getType()
@@ -907,10 +911,10 @@ class ExceptFlowNode extends ControlFlowNode {
/** /**
* Gets the name assigned to the handled exception, if any. * Gets the name assigned to the handled exception, if any.
* `e` in `except ExceptionType as e:` * `e` in `except Py::ExceptionType as e:`
*/ */
ControlFlowNode getName() { ControlFlowNode getName() {
exists(ExceptStmt ex | exists(Py::ExceptStmt ex |
this.getBasicBlock().dominates(result.getBasicBlock()) and this.getBasicBlock().dominates(result.getBasicBlock()) and
ex = this.getNode() and ex = this.getNode() and
result.getNode() = ex.getName() result.getNode() = ex.getName()
@@ -920,30 +924,30 @@ class ExceptFlowNode extends ControlFlowNode {
/** The ControlFlowNode for an 'except*' statement. */ /** The ControlFlowNode for an 'except*' statement. */
class ExceptGroupFlowNode extends ControlFlowNode { class ExceptGroupFlowNode extends ControlFlowNode {
ExceptGroupFlowNode() { this.getNode() instanceof ExceptGroupStmt } ExceptGroupFlowNode() { this.getNode() instanceof Py::ExceptGroupStmt }
/** /**
* Gets the type handled by this exception handler. * Gets the type handled by this exception handler.
* `ExceptionType` in `except* ExceptionType as e:` * `Py::ExceptionType` in `except* Py::ExceptionType as e:`
*/ */
ControlFlowNode getType() { ControlFlowNode getType() {
this.getBasicBlock().dominates(result.getBasicBlock()) and this.getBasicBlock().dominates(result.getBasicBlock()) and
result.getNode() = this.getNode().(ExceptGroupStmt).getType() result.getNode() = this.getNode().(Py::ExceptGroupStmt).getType()
} }
/** /**
* Gets the name assigned to the handled exception, if any. * Gets the name assigned to the handled exception, if any.
* `e` in `except* ExceptionType as e:` * `e` in `except* Py::ExceptionType as e:`
*/ */
ControlFlowNode getName() { ControlFlowNode getName() {
this.getBasicBlock().dominates(result.getBasicBlock()) and this.getBasicBlock().dominates(result.getBasicBlock()) and
result.getNode() = this.getNode().(ExceptGroupStmt).getName() result.getNode() = this.getNode().(Py::ExceptGroupStmt).getName()
} }
} }
private module Scopes { private module Scopes {
private predicate fast_local(NameNode n) { private predicate fast_local(NameNode n) {
exists(FastLocalVariable v | exists(Py::FastLocalVariable v |
n.uses(v) and n.uses(v) and
v.getScope() = n.getScope() v.getScope() = n.getScope()
) )
@@ -952,15 +956,15 @@ private module Scopes {
predicate local(NameNode n) { predicate local(NameNode n) {
fast_local(n) fast_local(n)
or or
exists(SsaVariable var | exists(Py::SsaVariable var |
var.getAUse() = n and var.getAUse() = n and
n.getScope() instanceof Class and n.getScope() instanceof Py::Class and
exists(var.getDefinition()) exists(var.getDefinition())
) )
} }
predicate non_local(NameNode n) { predicate non_local(NameNode n) {
exists(FastLocalVariable flv | exists(Py::FastLocalVariable flv |
flv.getALoad() = n.getNode() and flv.getALoad() = n.getNode() and
not flv.getScope() = n.getScope() not flv.getScope() = n.getScope()
) )
@@ -968,20 +972,20 @@ private module Scopes {
// magic is fine, but we get questionable join-ordering of it // magic is fine, but we get questionable join-ordering of it
pragma[nomagic] pragma[nomagic]
predicate use_of_global_variable(NameNode n, Module scope, string name) { predicate use_of_global_variable(NameNode n, Py::Module scope, string name) {
n.isLoad() and n.isLoad() and
not non_local(n) and not non_local(n) and
not exists(SsaVariable var | var.getAUse() = n | not exists(Py::SsaVariable var | var.getAUse() = n |
var.getVariable() instanceof FastLocalVariable var.getVariable() instanceof Py::FastLocalVariable
or or
n.getScope() instanceof Class and n.getScope() instanceof Py::Class and
not maybe_undefined(var) not maybe_undefined(var)
) and ) and
name = n.getId() and name = n.getId() and
scope = n.getEnclosingModule() scope = n.getEnclosingModule()
} }
private predicate maybe_undefined(SsaVariable var) { private predicate maybe_undefined(Py::SsaVariable var) {
not exists(var.getDefinition()) and not py_ssa_phi(var, _) not exists(var.getDefinition()) and not py_ssa_phi(var, _)
or or
var.getDefinition().isDelete() var.getDefinition().isDelete()
@@ -1058,13 +1062,13 @@ class BasicBlock extends @py_flow_node {
private predicate oneNodeBlock() { this.firstNode() = this.getLastNode() } private predicate oneNodeBlock() { this.firstNode() = this.getLastNode() }
private predicate startLocationInfo(string file, int line, int col) { private predicate startLocationInfo(string file, int line, int col) {
if this.firstNode().getNode() instanceof Scope if this.firstNode().getNode() instanceof Py::Scope
then this.firstNode().getASuccessor().getLocation().hasLocationInfo(file, line, col, _, _) then this.firstNode().getASuccessor().getLocation().hasLocationInfo(file, line, col, _, _)
else this.firstNode().getLocation().hasLocationInfo(file, line, col, _, _) else this.firstNode().getLocation().hasLocationInfo(file, line, col, _, _)
} }
private predicate endLocationInfo(int endl, int endc) { private predicate endLocationInfo(int endl, int endc) {
if this.getLastNode().getNode() instanceof Scope and not this.oneNodeBlock() if this.getLastNode().getNode() instanceof Py::Scope and not this.oneNodeBlock()
then this.getLastNode().getAPredecessor().getLocation().hasLocationInfo(_, _, _, endl, endc) then this.getLastNode().getAPredecessor().getLocation().hasLocationInfo(_, _, _, endl, endc)
else this.getLastNode().getLocation().hasLocationInfo(_, _, _, endl, endc) else this.getLastNode().getLocation().hasLocationInfo(_, _, _, endl, endc)
} }
@@ -1081,7 +1085,7 @@ class BasicBlock extends @py_flow_node {
/** Whether flow from this basic block reaches a normal exit from its scope */ /** Whether flow from this basic block reaches a normal exit from its scope */
predicate reachesExit() { predicate reachesExit() {
exists(Scope s | s.getANormalExit().getBasicBlock() = this) exists(Py::Scope s | s.getANormalExit().getBasicBlock() = this)
or or
this.getASuccessor().reachesExit() this.getASuccessor().reachesExit()
} }
@@ -1122,7 +1126,7 @@ class BasicBlock extends @py_flow_node {
/** Gets the scope of this block */ /** Gets the scope of this block */
pragma[nomagic] pragma[nomagic]
Scope getScope() { Py::Scope getScope() {
exists(ControlFlowNode n | n.getBasicBlock() = this | exists(ControlFlowNode n | n.getBasicBlock() = this |
/* Take care not to use an entry or exit node as that node's scope will be the outer scope */ /* Take care not to use an entry or exit node as that node's scope will be the outer scope */
not py_scope_flow(n, _, -1) and not py_scope_flow(n, _, -1) and
@@ -1145,17 +1149,17 @@ class BasicBlock extends @py_flow_node {
predicate reaches(BasicBlock other) { this = other or this.strictlyReaches(other) } predicate reaches(BasicBlock other) { this = other or this.strictlyReaches(other) }
/** /**
* Gets the `ConditionBlock`, if any, that controls this block and * Gets the `Py::ConditionBlock`, if any, that controls this block and
* does not control any other `ConditionBlock`s that control this block. * does not control any other `Py::ConditionBlock`s that control this block.
* That is the `ConditionBlock` that is closest dominator. * That is the `Py::ConditionBlock` that is closest dominator.
*/ */
ConditionBlock getImmediatelyControllingBlock() { Py::ConditionBlock getImmediatelyControllingBlock() {
result = this.nonControllingImmediateDominator*().getImmediateDominator() result = this.nonControllingImmediateDominator*().getImmediateDominator()
} }
private BasicBlock nonControllingImmediateDominator() { private BasicBlock nonControllingImmediateDominator() {
result = this.getImmediateDominator() and result = this.getImmediateDominator() and
not result.(ConditionBlock).controls(this, _) not result.(Py::ConditionBlock).controls(this, _)
} }
/** /**
@@ -1175,7 +1179,7 @@ private class ControlFlowNodeAlias = ControlFlowNode;
final private class FinalBasicBlock = BasicBlock; final private class FinalBasicBlock = BasicBlock;
module Cfg implements BB::CfgSig<Location> { module Cfg implements BB::CfgSig<Py::Location> {
private import codeql.controlflow.SuccessorType private import codeql.controlflow.SuccessorType
class ControlFlowNode = ControlFlowNodeAlias; class ControlFlowNode = ControlFlowNodeAlias;
@@ -1186,7 +1190,7 @@ module Cfg implements BB::CfgSig<Location> {
// Using the location of the first node is simple // Using the location of the first node is simple
// and we just need a way to identify the basic block // and we just need a way to identify the basic block
// during debugging, so this will be serviceable. // during debugging, so this will be serviceable.
Location getLocation() { result = super.getNode(0).getLocation() } Py::Location getLocation() { result = super.getNode(0).getLocation() }
int length() { result = count(int i | exists(this.getNode(i))) } int length() { result = count(int i | exists(this.getNode(i))) }