hohn/codeql
1
0
Fork 0
mirror of https://github.com/github/codeql.git synced 2026-08-03 00:43:00 +02:00
Code Issues Packages Projects Releases Wiki Activity
Files
yoff/python-cfg-modelling-exceptions
codeql/python/ql/test/experimental/query-tests/Security/CWE-409/DecompressionBombs.expected
yoff 408ba6218f Python: switch dataflow library to new (shared) CFG + SSA 
Flips the Python dataflow trunk from the legacy CFG (semmle/python/Flow.qll)
and legacy ESSA SSA (semmle/python/essa/*) to the new shared CFG facade
(semmle.python.controlflow.internal.Cfg) and the new SSA adapter
(semmle.python.dataflow.new.internal.SsaImpl), both introduced
additively in the preceding PRs in this stack.

This is the trunk-flip equivalent of the original draft PR #21894 (kept
around as documentation), rebased on top of the four preparatory PRs:

  P1: Remove AstNode.getAFlowNode() and rewrite callers (#21919).
  P2: Qualify Flow.qll's AST references with Py:: prefix (#21920).
  P3: Add new shared-CFG-backed control flow graph (#21921).
  P4: Add new shared-SSA-backed SSA adapter (#21923).

The Python dataflow library (semmle/python/dataflow/new/) now imports
the new CFG facade and SSA adapter. All CFG-typed predicates
(ControlFlowNode, CallNode, BasicBlock, NameNode, AttrNode, ...) are
qualified with the Cfg:: prefix; SSA references switch from
EssaVariable/EssaDefinition to SsaImpl::Definition/SourceVariable.

GuardNode is redesigned to use the new CFG's outcome-node model
(isAfterTrue / isAfterFalse) instead of the legacy ConditionBlock +
flipped indirection. Only BarrierGuard<...> is preserved as public
API.

Framework files (Bottle, FastApi, Django, Tornado, Pyramid, Stdlib,
...) are updated to take CFG nodes from the new facade.

A handful of dataflow consistency tweaks for the new CFG:
- Augmented-assignment targets are treated as both load and store.
- 'from X import *' produces uncertain SSA writes for unknown names.
- CFG nodes are canonicalised so dataflow does not see equivalent
  pre/post-order pairs as distinct nodes.

Two AST tweaks for the new CFG:
- AstNodeImpl: omit PEP 695 type-parameter names from
  FunctionDefExpr / ClassDefExpr children.
- ImportResolution: drop the legacy essa import.

Test churn (~175 files): reblessed library- and query-test .expected
files reflect slightly different CFG granularity, different toString
output, and a handful of true alert deltas in security queries.

Verification: all 367 lib + src + consistency-queries compile clean.

Co-authored-by: Copilot <223556219+Copilot@users.noreply.github.com>
2026-06-22 13:46:43 +00:00

127 lines
14 KiB
Plaintext
Raw Permalink Blame History

#select
| test.py:11:5:11:52 | After Attribute() | test.py:10:16:10:24 | file_path | test.py:11:5:11:52 | After Attribute() | This uncontrolled file extraction is $@. | test.py:10:16:10:24 | file_path | depends on this user controlled data |
| test.py:12:5:12:48 | After Attribute() | test.py:10:16:10:24 | file_path | test.py:12:5:12:48 | After Attribute() | This uncontrolled file extraction is $@. | test.py:10:16:10:24 | file_path | depends on this user controlled data |
| test.py:15:14:15:29 | After Attribute() | test.py:10:16:10:24 | file_path | test.py:15:14:15:29 | After Attribute() | This uncontrolled file extraction is $@. | test.py:10:16:10:24 | file_path | depends on this user controlled data |
| test.py:19:14:19:39 | After Attribute() | test.py:10:16:10:24 | file_path | test.py:19:14:19:39 | After Attribute() | This uncontrolled file extraction is $@. | test.py:10:16:10:24 | file_path | depends on this user controlled data |
| test.py:22:5:22:60 | After Attribute() | test.py:10:16:10:24 | file_path | test.py:22:5:22:60 | After Attribute() | This uncontrolled file extraction is $@. | test.py:10:16:10:24 | file_path | depends on this user controlled data |
| test.py:24:5:24:52 | After Attribute() | test.py:10:16:10:24 | file_path | test.py:24:5:24:52 | After Attribute() | This uncontrolled file extraction is $@. | test.py:10:16:10:24 | file_path | depends on this user controlled data |
| test.py:25:5:25:55 | After Attribute() | test.py:10:16:10:24 | file_path | test.py:25:5:25:55 | After Attribute() | This uncontrolled file extraction is $@. | test.py:10:16:10:24 | file_path | depends on this user controlled data |
| test.py:26:5:26:57 | After Attribute() | test.py:10:16:10:24 | file_path | test.py:26:5:26:57 | After Attribute() | This uncontrolled file extraction is $@. | test.py:10:16:10:24 | file_path | depends on this user controlled data |
| test.py:27:5:27:50 | After Attribute() | test.py:10:16:10:24 | file_path | test.py:27:5:27:50 | After Attribute() | This uncontrolled file extraction is $@. | test.py:10:16:10:24 | file_path | depends on this user controlled data |
| test.py:28:5:28:60 | After Attribute() | test.py:10:16:10:24 | file_path | test.py:28:5:28:60 | After Attribute() | This uncontrolled file extraction is $@. | test.py:10:16:10:24 | file_path | depends on this user controlled data |
| test.py:35:27:35:35 | file_path | test.py:10:16:10:24 | file_path | test.py:35:27:35:35 | file_path | This uncontrolled file extraction is $@. | test.py:10:16:10:24 | file_path | depends on this user controlled data |
| test.py:39:15:39:23 | file_path | test.py:10:16:10:24 | file_path | test.py:39:15:39:23 | file_path | This uncontrolled file extraction is $@. | test.py:10:16:10:24 | file_path | depends on this user controlled data |
| test.py:40:19:40:27 | file_path | test.py:10:16:10:24 | file_path | test.py:40:19:40:27 | file_path | This uncontrolled file extraction is $@. | test.py:10:16:10:24 | file_path | depends on this user controlled data |
| test.py:44:14:44:22 | file_path | test.py:10:16:10:24 | file_path | test.py:44:14:44:22 | file_path | This uncontrolled file extraction is $@. | test.py:10:16:10:24 | file_path | depends on this user controlled data |
| test.py:45:17:45:25 | file_path | test.py:10:16:10:24 | file_path | test.py:45:17:45:25 | file_path | This uncontrolled file extraction is $@. | test.py:10:16:10:24 | file_path | depends on this user controlled data |
| test.py:49:15:49:23 | file_path | test.py:10:16:10:24 | file_path | test.py:49:15:49:23 | file_path | This uncontrolled file extraction is $@. | test.py:10:16:10:24 | file_path | depends on this user controlled data |
| test.py:50:19:50:27 | file_path | test.py:10:16:10:24 | file_path | test.py:50:19:50:27 | file_path | This uncontrolled file extraction is $@. | test.py:10:16:10:24 | file_path | depends on this user controlled data |
| test.py:54:15:54:23 | file_path | test.py:10:16:10:24 | file_path | test.py:54:15:54:23 | file_path | This uncontrolled file extraction is $@. | test.py:10:16:10:24 | file_path | depends on this user controlled data |
| test.py:55:19:55:27 | file_path | test.py:10:16:10:24 | file_path | test.py:55:19:55:27 | file_path | This uncontrolled file extraction is $@. | test.py:10:16:10:24 | file_path | depends on this user controlled data |
| test.py:59:40:59:48 | file_path | test.py:10:16:10:24 | file_path | test.py:59:40:59:48 | file_path | This uncontrolled file extraction is $@. | test.py:10:16:10:24 | file_path | depends on this user controlled data |
| test.py:61:23:61:31 | file_path | test.py:10:16:10:24 | file_path | test.py:61:23:61:31 | file_path | This uncontrolled file extraction is $@. | test.py:10:16:10:24 | file_path | depends on this user controlled data |
| test.py:62:21:62:29 | file_path | test.py:10:16:10:24 | file_path | test.py:62:21:62:29 | file_path | This uncontrolled file extraction is $@. | test.py:10:16:10:24 | file_path | depends on this user controlled data |
| test.py:64:40:64:48 | file_path | test.py:10:16:10:24 | file_path | test.py:64:40:64:48 | file_path | This uncontrolled file extraction is $@. | test.py:10:16:10:24 | file_path | depends on this user controlled data |
| test.py:65:22:65:30 | file_path | test.py:10:16:10:24 | file_path | test.py:65:22:65:30 | file_path | This uncontrolled file extraction is $@. | test.py:10:16:10:24 | file_path | depends on this user controlled data |
| test.py:66:21:66:29 | file_path | test.py:10:16:10:24 | file_path | test.py:66:21:66:29 | file_path | This uncontrolled file extraction is $@. | test.py:10:16:10:24 | file_path | depends on this user controlled data |
| test.py:67:42:67:50 | file_path | test.py:10:16:10:24 | file_path | test.py:67:42:67:50 | file_path | This uncontrolled file extraction is $@. | test.py:10:16:10:24 | file_path | depends on this user controlled data |
| test.py:68:23:68:31 | file_path | test.py:10:16:10:24 | file_path | test.py:68:23:68:31 | file_path | This uncontrolled file extraction is $@. | test.py:10:16:10:24 | file_path | depends on this user controlled data |
| test.py:69:36:69:44 | file_path | test.py:10:16:10:24 | file_path | test.py:69:36:69:44 | file_path | This uncontrolled file extraction is $@. | test.py:10:16:10:24 | file_path | depends on this user controlled data |
edges
| test.py:10:16:10:24 | file_path | test.py:11:21:11:29 | file_path | provenance | |
| test.py:11:5:11:35 | After Attribute() | test.py:11:5:11:52 | After Attribute() | provenance | Config |
| test.py:11:21:11:29 | file_path | test.py:11:5:11:35 | After Attribute() | provenance | MaD:1 |
| test.py:11:21:11:29 | file_path | test.py:11:5:11:52 | After Attribute() | provenance | Config |
| test.py:11:21:11:29 | file_path | test.py:12:21:12:29 | file_path | provenance | |
| test.py:12:5:12:35 | After Attribute() | test.py:12:5:12:48 | After Attribute() | provenance | Config |
| test.py:12:21:12:29 | file_path | test.py:12:5:12:35 | After Attribute() | provenance | MaD:1 |
| test.py:12:21:12:29 | file_path | test.py:12:5:12:48 | After Attribute() | provenance | Config |
| test.py:12:21:12:29 | file_path | test.py:14:26:14:34 | file_path | provenance | |
| test.py:14:10:14:35 | After Attribute() | test.py:15:14:15:29 | After Attribute() | provenance | Config |
| test.py:14:26:14:34 | file_path | test.py:14:10:14:35 | After Attribute() | provenance | MaD:1 |
| test.py:14:26:14:34 | file_path | test.py:15:14:15:29 | After Attribute() | provenance | Config |
| test.py:14:26:14:34 | file_path | test.py:18:26:18:34 | file_path | provenance | |
| test.py:18:10:18:35 | After Attribute() | test.py:19:14:19:39 | After Attribute() | provenance | Config |
| test.py:18:26:18:34 | file_path | test.py:18:10:18:35 | After Attribute() | provenance | MaD:1 |
| test.py:18:26:18:34 | file_path | test.py:19:14:19:39 | After Attribute() | provenance | Config |
| test.py:18:26:18:34 | file_path | test.py:22:21:22:29 | file_path | provenance | |
| test.py:22:5:22:30 | After Attribute() | test.py:22:5:22:60 | After Attribute() | provenance | Config |
| test.py:22:21:22:29 | file_path | test.py:22:5:22:30 | After Attribute() | provenance | MaD:1 |
| test.py:22:21:22:29 | file_path | test.py:22:5:22:60 | After Attribute() | provenance | Config |
| test.py:22:21:22:29 | file_path | test.py:24:18:24:26 | file_path | provenance | |
| test.py:24:18:24:26 | file_path | test.py:24:5:24:52 | After Attribute() | provenance | Config |
| test.py:24:18:24:26 | file_path | test.py:25:26:25:34 | file_path | provenance | |
| test.py:25:26:25:34 | file_path | test.py:25:5:25:55 | After Attribute() | provenance | Config |
| test.py:25:26:25:34 | file_path | test.py:26:28:26:36 | file_path | provenance | |
| test.py:26:28:26:36 | file_path | test.py:26:5:26:57 | After Attribute() | provenance | Config |
| test.py:26:28:26:36 | file_path | test.py:27:28:27:36 | file_path | provenance | |
| test.py:27:28:27:36 | file_path | test.py:27:5:27:50 | After Attribute() | provenance | Config |
| test.py:27:28:27:36 | file_path | test.py:28:26:28:34 | file_path | provenance | |
| test.py:28:26:28:34 | file_path | test.py:28:5:28:60 | After Attribute() | provenance | Config |
| test.py:28:26:28:34 | file_path | test.py:35:27:35:35 | file_path | provenance | |
| test.py:28:26:28:34 | file_path | test.py:39:15:39:23 | file_path | provenance | |
| test.py:28:26:28:34 | file_path | test.py:40:19:40:27 | file_path | provenance | |
| test.py:28:26:28:34 | file_path | test.py:44:14:44:22 | file_path | provenance | |
| test.py:28:26:28:34 | file_path | test.py:45:17:45:25 | file_path | provenance | |
| test.py:28:26:28:34 | file_path | test.py:49:15:49:23 | file_path | provenance | |
| test.py:28:26:28:34 | file_path | test.py:50:19:50:27 | file_path | provenance | |
| test.py:28:26:28:34 | file_path | test.py:54:15:54:23 | file_path | provenance | |
| test.py:28:26:28:34 | file_path | test.py:55:19:55:27 | file_path | provenance | |
| test.py:28:26:28:34 | file_path | test.py:59:40:59:48 | file_path | provenance | |
| test.py:28:26:28:34 | file_path | test.py:61:23:61:31 | file_path | provenance | |
| test.py:28:26:28:34 | file_path | test.py:62:21:62:29 | file_path | provenance | |
| test.py:28:26:28:34 | file_path | test.py:64:40:64:48 | file_path | provenance | |
| test.py:28:26:28:34 | file_path | test.py:65:22:65:30 | file_path | provenance | |
| test.py:28:26:28:34 | file_path | test.py:66:21:66:29 | file_path | provenance | |
| test.py:28:26:28:34 | file_path | test.py:67:42:67:50 | file_path | provenance | |
| test.py:28:26:28:34 | file_path | test.py:68:23:68:31 | file_path | provenance | |
| test.py:28:26:28:34 | file_path | test.py:69:36:69:44 | file_path | provenance | |
models
| 1 | Summary: zipfile.ZipFile!; Subclass.Call; Argument[0,file:]; ReturnValue; taint |
nodes
| test.py:10:16:10:24 | file_path | semmle.label | file_path |
| test.py:11:5:11:35 | After Attribute() | semmle.label | After Attribute() |
| test.py:11:5:11:52 | After Attribute() | semmle.label | After Attribute() |
| test.py:11:21:11:29 | file_path | semmle.label | file_path |
| test.py:12:5:12:35 | After Attribute() | semmle.label | After Attribute() |
| test.py:12:5:12:48 | After Attribute() | semmle.label | After Attribute() |
| test.py:12:21:12:29 | file_path | semmle.label | file_path |
| test.py:14:10:14:35 | After Attribute() | semmle.label | After Attribute() |
| test.py:14:26:14:34 | file_path | semmle.label | file_path |
| test.py:15:14:15:29 | After Attribute() | semmle.label | After Attribute() |
| test.py:18:10:18:35 | After Attribute() | semmle.label | After Attribute() |
| test.py:18:26:18:34 | file_path | semmle.label | file_path |
| test.py:19:14:19:39 | After Attribute() | semmle.label | After Attribute() |
| test.py:22:5:22:30 | After Attribute() | semmle.label | After Attribute() |
| test.py:22:5:22:60 | After Attribute() | semmle.label | After Attribute() |
| test.py:22:21:22:29 | file_path | semmle.label | file_path |
| test.py:24:5:24:52 | After Attribute() | semmle.label | After Attribute() |
| test.py:24:18:24:26 | file_path | semmle.label | file_path |
| test.py:25:5:25:55 | After Attribute() | semmle.label | After Attribute() |
| test.py:25:26:25:34 | file_path | semmle.label | file_path |
| test.py:26:5:26:57 | After Attribute() | semmle.label | After Attribute() |
| test.py:26:28:26:36 | file_path | semmle.label | file_path |
| test.py:27:5:27:50 | After Attribute() | semmle.label | After Attribute() |
| test.py:27:28:27:36 | file_path | semmle.label | file_path |
| test.py:28:5:28:60 | After Attribute() | semmle.label | After Attribute() |
| test.py:28:26:28:34 | file_path | semmle.label | file_path |
| test.py:35:27:35:35 | file_path | semmle.label | file_path |
| test.py:39:15:39:23 | file_path | semmle.label | file_path |
| test.py:40:19:40:27 | file_path | semmle.label | file_path |
| test.py:44:14:44:22 | file_path | semmle.label | file_path |
| test.py:45:17:45:25 | file_path | semmle.label | file_path |
| test.py:49:15:49:23 | file_path | semmle.label | file_path |
| test.py:50:19:50:27 | file_path | semmle.label | file_path |
| test.py:54:15:54:23 | file_path | semmle.label | file_path |
| test.py:55:19:55:27 | file_path | semmle.label | file_path |
| test.py:59:40:59:48 | file_path | semmle.label | file_path |
| test.py:61:23:61:31 | file_path | semmle.label | file_path |
| test.py:62:21:62:29 | file_path | semmle.label | file_path |
| test.py:64:40:64:48 | file_path | semmle.label | file_path |
| test.py:65:22:65:30 | file_path | semmle.label | file_path |
| test.py:66:21:66:29 | file_path | semmle.label | file_path |
| test.py:67:42:67:50 | file_path | semmle.label | file_path |
| test.py:68:23:68:31 | file_path | semmle.label | file_path |
| test.py:69:36:69:44 | file_path | semmle.label | file_path |
subpaths
Reference in New Issue View Git Blame Copy Permalink