mirror of
https://github.com/github/codeql.git
synced 2026-08-02 16:32:58 +02:00
265a31dc1d
Flips the Python dataflow trunk from the legacy CFG (semmle/python/Flow.qll) and legacy ESSA SSA (semmle/python/essa/*) to the new shared CFG facade (semmle.python.controlflow.internal.Cfg) and the new SSA adapter (semmle.python.dataflow.new.internal.SsaImpl), both introduced additively in the preceding PRs in this stack. This is the trunk-flip equivalent of the original draft PR #21894 (kept around as documentation), rebased on top of the four preparatory PRs: P1: Remove AstNode.getAFlowNode() and rewrite callers (#21919). P2: Qualify Flow.qll's AST references with Py:: prefix (#21920). P3: Add new shared-CFG-backed control flow graph (#21921). P4: Add new shared-SSA-backed SSA adapter (#21923). The Python dataflow library (semmle/python/dataflow/new/) now imports the new CFG facade and SSA adapter. All CFG-typed predicates (ControlFlowNode, CallNode, BasicBlock, NameNode, AttrNode, ...) are qualified with the Cfg:: prefix; SSA references switch from EssaVariable/EssaDefinition to SsaImpl::Definition/SourceVariable. GuardNode is redesigned to use the new CFG's outcome-node model (isAfterTrue / isAfterFalse) instead of the legacy ConditionBlock + flipped indirection. Only BarrierGuard<...> is preserved as public API. Framework files (Bottle, FastApi, Django, Tornado, Pyramid, Stdlib, ...) are updated to take CFG nodes from the new facade. A handful of dataflow consistency tweaks for the new CFG: - Augmented-assignment targets are treated as both load and store. - 'from X import *' produces uncertain SSA writes for unknown names. - CFG nodes are canonicalised so dataflow does not see equivalent pre/post-order pairs as distinct nodes. Two AST tweaks for the new CFG: - AstNodeImpl: omit PEP 695 type-parameter names from FunctionDefExpr / ClassDefExpr children. - ImportResolution: drop the legacy essa import. Test churn (~175 files): reblessed library- and query-test .expected files reflect slightly different CFG granularity, different toString output, and a handful of true alert deltas in security queries. Verification: all 367 lib + src + consistency-queries compile clean. Co-authored-by: Copilot <223556219+Copilot@users.noreply.github.com>
109 lines
11 KiB
Plaintext
109 lines
11 KiB
Plaintext
edges
|
|
| summaries.py:32:1:32:7 | tainted | summaries.py:33:6:33:12 | tainted | provenance | |
|
|
| summaries.py:32:11:32:26 | identity() | summaries.py:32:1:32:7 | tainted | provenance | |
|
|
| summaries.py:32:20:32:25 | SOURCE | summaries.py:32:11:32:26 | identity() | provenance | identity |
|
|
| summaries.py:36:1:36:14 | tainted_lambda | summaries.py:37:6:37:19 | tainted_lambda | provenance | |
|
|
| summaries.py:36:18:36:54 | apply_lambda() | summaries.py:36:1:36:14 | tainted_lambda | provenance | |
|
|
| summaries.py:36:38:36:38 | x | summaries.py:36:41:36:45 | BinaryExpr | provenance | |
|
|
| summaries.py:36:48:36:53 | SOURCE | summaries.py:36:18:36:54 | apply_lambda() | provenance | apply_lambda |
|
|
| summaries.py:36:48:36:53 | SOURCE | summaries.py:36:38:36:38 | x | provenance | apply_lambda |
|
|
| summaries.py:44:1:44:12 | tainted_list [List element] | summaries.py:45:6:45:17 | tainted_list [List element] | provenance | |
|
|
| summaries.py:44:16:44:33 | reversed() [List element] | summaries.py:44:1:44:12 | tainted_list [List element] | provenance | |
|
|
| summaries.py:44:25:44:32 | List [List element] | summaries.py:44:16:44:33 | reversed() [List element] | provenance | builtins.reversed |
|
|
| summaries.py:44:26:44:31 | SOURCE | summaries.py:44:25:44:32 | List [List element] | provenance | |
|
|
| summaries.py:45:6:45:17 | tainted_list [List element] | summaries.py:45:6:45:20 | Subscript | provenance | |
|
|
| summaries.py:48:15:48:15 | x | summaries.py:49:12:49:18 | BinaryExpr | provenance | |
|
|
| summaries.py:51:1:51:14 | tainted_mapped [List element] | summaries.py:52:6:52:19 | tainted_mapped [List element] | provenance | |
|
|
| summaries.py:51:18:51:46 | list_map() [List element] | summaries.py:51:1:51:14 | tainted_mapped [List element] | provenance | |
|
|
| summaries.py:51:38:51:45 | List [List element] | summaries.py:48:15:48:15 | x | provenance | list_map |
|
|
| summaries.py:51:38:51:45 | List [List element] | summaries.py:51:18:51:46 | list_map() [List element] | provenance | list_map |
|
|
| summaries.py:51:39:51:44 | SOURCE | summaries.py:51:38:51:45 | List [List element] | provenance | |
|
|
| summaries.py:52:6:52:19 | tainted_mapped [List element] | summaries.py:52:6:52:22 | Subscript | provenance | |
|
|
| summaries.py:54:23:54:23 | x | summaries.py:55:12:55:12 | x | provenance | |
|
|
| summaries.py:57:1:57:23 | tainted_mapped_explicit [List element] | summaries.py:58:6:58:28 | tainted_mapped_explicit [List element] | provenance | |
|
|
| summaries.py:57:27:57:63 | list_map() [List element] | summaries.py:57:1:57:23 | tainted_mapped_explicit [List element] | provenance | |
|
|
| summaries.py:57:55:57:62 | List [List element] | summaries.py:54:23:54:23 | x | provenance | list_map |
|
|
| summaries.py:57:55:57:62 | List [List element] | summaries.py:57:27:57:63 | list_map() [List element] | provenance | list_map |
|
|
| summaries.py:57:56:57:61 | SOURCE | summaries.py:57:55:57:62 | List [List element] | provenance | |
|
|
| summaries.py:58:6:58:28 | tainted_mapped_explicit [List element] | summaries.py:58:6:58:31 | Subscript | provenance | |
|
|
| summaries.py:60:1:60:22 | tainted_mapped_summary [List element] | summaries.py:61:6:61:27 | tainted_mapped_summary [List element] | provenance | |
|
|
| summaries.py:60:26:60:53 | list_map() [List element] | summaries.py:60:1:60:22 | tainted_mapped_summary [List element] | provenance | |
|
|
| summaries.py:60:45:60:52 | List [List element] | summaries.py:60:26:60:53 | list_map() [List element] | provenance | list_map |
|
|
| summaries.py:60:46:60:51 | SOURCE | summaries.py:60:45:60:52 | List [List element] | provenance | |
|
|
| summaries.py:61:6:61:27 | tainted_mapped_summary [List element] | summaries.py:61:6:61:30 | Subscript | provenance | |
|
|
| summaries.py:63:1:63:12 | tainted_list [List element] | summaries.py:64:6:64:17 | tainted_list [List element] | provenance | |
|
|
| summaries.py:63:16:63:41 | append_to_list() [List element] | summaries.py:63:1:63:12 | tainted_list [List element] | provenance | |
|
|
| summaries.py:63:35:63:40 | SOURCE | summaries.py:63:16:63:41 | append_to_list() [List element] | provenance | append_to_list |
|
|
| summaries.py:64:6:64:17 | tainted_list [List element] | summaries.py:64:6:64:20 | Subscript | provenance | |
|
|
| summaries.py:67:1:67:18 | tainted_resultlist | summaries.py:68:6:68:26 | Subscript | provenance | |
|
|
| summaries.py:67:1:67:18 | tainted_resultlist [List element] | summaries.py:68:6:68:23 | tainted_resultlist [List element] | provenance | |
|
|
| summaries.py:67:22:67:39 | json_loads() [List element] | summaries.py:67:1:67:18 | tainted_resultlist [List element] | provenance | |
|
|
| summaries.py:67:33:67:38 | SOURCE | summaries.py:67:1:67:18 | tainted_resultlist | provenance | |
|
|
| summaries.py:67:33:67:38 | SOURCE | summaries.py:67:1:67:18 | tainted_resultlist | provenance | Decoding-JSON |
|
|
| summaries.py:67:33:67:38 | SOURCE | summaries.py:67:22:67:39 | json_loads() [List element] | provenance | json.loads |
|
|
| summaries.py:68:6:68:23 | tainted_resultlist [List element] | summaries.py:68:6:68:26 | Subscript | provenance | |
|
|
nodes
|
|
| summaries.py:32:1:32:7 | tainted | semmle.label | tainted |
|
|
| summaries.py:32:11:32:26 | identity() | semmle.label | identity() |
|
|
| summaries.py:32:20:32:25 | SOURCE | semmle.label | SOURCE |
|
|
| summaries.py:33:6:33:12 | tainted | semmle.label | tainted |
|
|
| summaries.py:36:1:36:14 | tainted_lambda | semmle.label | tainted_lambda |
|
|
| summaries.py:36:18:36:54 | apply_lambda() | semmle.label | apply_lambda() |
|
|
| summaries.py:36:38:36:38 | x | semmle.label | x |
|
|
| summaries.py:36:41:36:45 | BinaryExpr | semmle.label | BinaryExpr |
|
|
| summaries.py:36:48:36:53 | SOURCE | semmle.label | SOURCE |
|
|
| summaries.py:37:6:37:19 | tainted_lambda | semmle.label | tainted_lambda |
|
|
| summaries.py:44:1:44:12 | tainted_list [List element] | semmle.label | tainted_list [List element] |
|
|
| summaries.py:44:16:44:33 | reversed() [List element] | semmle.label | reversed() [List element] |
|
|
| summaries.py:44:25:44:32 | List [List element] | semmle.label | List [List element] |
|
|
| summaries.py:44:26:44:31 | SOURCE | semmle.label | SOURCE |
|
|
| summaries.py:45:6:45:17 | tainted_list [List element] | semmle.label | tainted_list [List element] |
|
|
| summaries.py:45:6:45:20 | Subscript | semmle.label | Subscript |
|
|
| summaries.py:48:15:48:15 | x | semmle.label | x |
|
|
| summaries.py:49:12:49:18 | BinaryExpr | semmle.label | BinaryExpr |
|
|
| summaries.py:51:1:51:14 | tainted_mapped [List element] | semmle.label | tainted_mapped [List element] |
|
|
| summaries.py:51:18:51:46 | list_map() [List element] | semmle.label | list_map() [List element] |
|
|
| summaries.py:51:38:51:45 | List [List element] | semmle.label | List [List element] |
|
|
| summaries.py:51:39:51:44 | SOURCE | semmle.label | SOURCE |
|
|
| summaries.py:52:6:52:19 | tainted_mapped [List element] | semmle.label | tainted_mapped [List element] |
|
|
| summaries.py:52:6:52:22 | Subscript | semmle.label | Subscript |
|
|
| summaries.py:54:23:54:23 | x | semmle.label | x |
|
|
| summaries.py:55:12:55:12 | x | semmle.label | x |
|
|
| summaries.py:57:1:57:23 | tainted_mapped_explicit [List element] | semmle.label | tainted_mapped_explicit [List element] |
|
|
| summaries.py:57:27:57:63 | list_map() [List element] | semmle.label | list_map() [List element] |
|
|
| summaries.py:57:55:57:62 | List [List element] | semmle.label | List [List element] |
|
|
| summaries.py:57:56:57:61 | SOURCE | semmle.label | SOURCE |
|
|
| summaries.py:58:6:58:28 | tainted_mapped_explicit [List element] | semmle.label | tainted_mapped_explicit [List element] |
|
|
| summaries.py:58:6:58:31 | Subscript | semmle.label | Subscript |
|
|
| summaries.py:60:1:60:22 | tainted_mapped_summary [List element] | semmle.label | tainted_mapped_summary [List element] |
|
|
| summaries.py:60:26:60:53 | list_map() [List element] | semmle.label | list_map() [List element] |
|
|
| summaries.py:60:45:60:52 | List [List element] | semmle.label | List [List element] |
|
|
| summaries.py:60:46:60:51 | SOURCE | semmle.label | SOURCE |
|
|
| summaries.py:61:6:61:27 | tainted_mapped_summary [List element] | semmle.label | tainted_mapped_summary [List element] |
|
|
| summaries.py:61:6:61:30 | Subscript | semmle.label | Subscript |
|
|
| summaries.py:63:1:63:12 | tainted_list [List element] | semmle.label | tainted_list [List element] |
|
|
| summaries.py:63:16:63:41 | append_to_list() [List element] | semmle.label | append_to_list() [List element] |
|
|
| summaries.py:63:35:63:40 | SOURCE | semmle.label | SOURCE |
|
|
| summaries.py:64:6:64:17 | tainted_list [List element] | semmle.label | tainted_list [List element] |
|
|
| summaries.py:64:6:64:20 | Subscript | semmle.label | Subscript |
|
|
| summaries.py:67:1:67:18 | tainted_resultlist | semmle.label | tainted_resultlist |
|
|
| summaries.py:67:1:67:18 | tainted_resultlist [List element] | semmle.label | tainted_resultlist [List element] |
|
|
| summaries.py:67:22:67:39 | json_loads() [List element] | semmle.label | json_loads() [List element] |
|
|
| summaries.py:67:33:67:38 | SOURCE | semmle.label | SOURCE |
|
|
| summaries.py:68:6:68:23 | tainted_resultlist [List element] | semmle.label | tainted_resultlist [List element] |
|
|
| summaries.py:68:6:68:26 | Subscript | semmle.label | Subscript |
|
|
subpaths
|
|
| summaries.py:36:48:36:53 | SOURCE | summaries.py:36:38:36:38 | x | summaries.py:36:41:36:45 | BinaryExpr | summaries.py:36:18:36:54 | apply_lambda() |
|
|
| summaries.py:51:38:51:45 | List [List element] | summaries.py:48:15:48:15 | x | summaries.py:49:12:49:18 | BinaryExpr | summaries.py:51:18:51:46 | list_map() [List element] |
|
|
| summaries.py:57:55:57:62 | List [List element] | summaries.py:54:23:54:23 | x | summaries.py:55:12:55:12 | x | summaries.py:57:27:57:63 | list_map() [List element] |
|
|
invalidSpecComponent
|
|
#select
|
|
| summaries.py:33:6:33:12 | tainted | summaries.py:32:20:32:25 | SOURCE | summaries.py:33:6:33:12 | tainted | $@ | summaries.py:32:20:32:25 | SOURCE | SOURCE |
|
|
| summaries.py:37:6:37:19 | tainted_lambda | summaries.py:36:48:36:53 | SOURCE | summaries.py:37:6:37:19 | tainted_lambda | $@ | summaries.py:36:48:36:53 | SOURCE | SOURCE |
|
|
| summaries.py:45:6:45:20 | Subscript | summaries.py:44:26:44:31 | SOURCE | summaries.py:45:6:45:20 | Subscript | $@ | summaries.py:44:26:44:31 | SOURCE | SOURCE |
|
|
| summaries.py:52:6:52:22 | Subscript | summaries.py:51:39:51:44 | SOURCE | summaries.py:52:6:52:22 | Subscript | $@ | summaries.py:51:39:51:44 | SOURCE | SOURCE |
|
|
| summaries.py:58:6:58:31 | Subscript | summaries.py:57:56:57:61 | SOURCE | summaries.py:58:6:58:31 | Subscript | $@ | summaries.py:57:56:57:61 | SOURCE | SOURCE |
|
|
| summaries.py:61:6:61:30 | Subscript | summaries.py:60:46:60:51 | SOURCE | summaries.py:61:6:61:30 | Subscript | $@ | summaries.py:60:46:60:51 | SOURCE | SOURCE |
|
|
| summaries.py:64:6:64:20 | Subscript | summaries.py:63:35:63:40 | SOURCE | summaries.py:64:6:64:20 | Subscript | $@ | summaries.py:63:35:63:40 | SOURCE | SOURCE |
|
|
| summaries.py:68:6:68:26 | Subscript | summaries.py:67:33:67:38 | SOURCE | summaries.py:68:6:68:26 | Subscript | $@ | summaries.py:67:33:67:38 | SOURCE | SOURCE |
|