hohn/codeql
1
0
Fork 0
mirror of https://github.com/github/codeql.git synced 2026-08-03 00:43:00 +02:00
Code Issues Packages Projects Releases Wiki Activity
Files
yoff/python-shared-cfg-dataflow-flip
codeql/python/ql/test/query-tests/Security/CVE-2018-1281/BindToAllInterfaces.expected
yoff 265a31dc1d Python: switch dataflow library to new (shared) CFG + SSA 
Flips the Python dataflow trunk from the legacy CFG (semmle/python/Flow.qll)
and legacy ESSA SSA (semmle/python/essa/*) to the new shared CFG facade
(semmle.python.controlflow.internal.Cfg) and the new SSA adapter
(semmle.python.dataflow.new.internal.SsaImpl), both introduced
additively in the preceding PRs in this stack.

This is the trunk-flip equivalent of the original draft PR #21894 (kept
around as documentation), rebased on top of the four preparatory PRs:

  P1: Remove AstNode.getAFlowNode() and rewrite callers (#21919).
  P2: Qualify Flow.qll's AST references with Py:: prefix (#21920).
  P3: Add new shared-CFG-backed control flow graph (#21921).
  P4: Add new shared-SSA-backed SSA adapter (#21923).

The Python dataflow library (semmle/python/dataflow/new/) now imports
the new CFG facade and SSA adapter. All CFG-typed predicates
(ControlFlowNode, CallNode, BasicBlock, NameNode, AttrNode, ...) are
qualified with the Cfg:: prefix; SSA references switch from
EssaVariable/EssaDefinition to SsaImpl::Definition/SourceVariable.

GuardNode is redesigned to use the new CFG's outcome-node model
(isAfterTrue / isAfterFalse) instead of the legacy ConditionBlock +
flipped indirection. Only BarrierGuard<...> is preserved as public
API.

Framework files (Bottle, FastApi, Django, Tornado, Pyramid, Stdlib,
...) are updated to take CFG nodes from the new facade.

A handful of dataflow consistency tweaks for the new CFG:
- Augmented-assignment targets are treated as both load and store.
- 'from X import *' produces uncertain SSA writes for unknown names.
- CFG nodes are canonicalised so dataflow does not see equivalent
  pre/post-order pairs as distinct nodes.

Two AST tweaks for the new CFG:
- AstNodeImpl: omit PEP 695 type-parameter names from
  FunctionDefExpr / ClassDefExpr children.
- ImportResolution: drop the legacy essa import.

Test churn (~175 files): reblessed library- and query-test .expected
files reflect slightly different CFG granularity, different toString
output, and a handful of true alert deltas in security queries.

Verification: all 367 lib + src + consistency-queries compile clean.

Co-authored-by: Copilot <223556219+Copilot@users.noreply.github.com>
2026-07-30 15:30:47 +00:00

72 lines
9.1 KiB
Plaintext
Raw Permalink Blame History

#select
| BindToAllInterfaces_test.py:5:9:5:24 | Tuple | BindToAllInterfaces_test.py:5:9:5:17 | StringLiteral | BindToAllInterfaces_test.py:5:9:5:24 | Tuple | Binding a socket to all interfaces (using $@) is a security risk. | BindToAllInterfaces_test.py:5:9:5:17 | StringLiteral | '0.0.0.0' |
| BindToAllInterfaces_test.py:9:9:9:16 | Tuple | BindToAllInterfaces_test.py:9:9:9:10 | StringLiteral | BindToAllInterfaces_test.py:9:9:9:16 | Tuple | Binding a socket to all interfaces (using $@) is a security risk. | BindToAllInterfaces_test.py:9:9:9:10 | StringLiteral | '' |
| BindToAllInterfaces_test.py:17:9:17:24 | Tuple | BindToAllInterfaces_test.py:16:14:16:22 | StringLiteral | BindToAllInterfaces_test.py:17:9:17:24 | Tuple | Binding a socket to all interfaces (using $@) is a security risk. | BindToAllInterfaces_test.py:16:14:16:22 | StringLiteral | '0.0.0.0' |
| BindToAllInterfaces_test.py:21:8:21:10 | tup | BindToAllInterfaces_test.py:16:14:16:22 | StringLiteral | BindToAllInterfaces_test.py:21:8:21:10 | tup | Binding a socket to all interfaces (using $@) is a security risk. | BindToAllInterfaces_test.py:16:14:16:22 | StringLiteral | '0.0.0.0' |
| BindToAllInterfaces_test.py:26:9:26:18 | Tuple | BindToAllInterfaces_test.py:26:9:26:12 | StringLiteral | BindToAllInterfaces_test.py:26:9:26:18 | Tuple | Binding a socket to all interfaces (using $@) is a security risk. | BindToAllInterfaces_test.py:26:9:26:12 | StringLiteral | '::' |
| BindToAllInterfaces_test.py:39:17:39:41 | Tuple | BindToAllInterfaces_test.py:34:26:34:34 | StringLiteral | BindToAllInterfaces_test.py:39:17:39:41 | Tuple | Binding a socket to all interfaces (using $@) is a security risk. | BindToAllInterfaces_test.py:34:26:34:34 | StringLiteral | '0.0.0.0' |
| BindToAllInterfaces_test.py:48:9:48:18 | Tuple | BindToAllInterfaces_test.py:46:35:46:43 | StringLiteral | BindToAllInterfaces_test.py:48:9:48:18 | Tuple | Binding a socket to all interfaces (using $@) is a security risk. | BindToAllInterfaces_test.py:46:35:46:43 | StringLiteral | '0.0.0.0' |
| BindToAllInterfaces_test.py:53:10:53:25 | Tuple | BindToAllInterfaces_test.py:53:10:53:18 | StringLiteral | BindToAllInterfaces_test.py:53:10:53:25 | Tuple | Binding a socket to all interfaces (using $@) is a security risk. | BindToAllInterfaces_test.py:53:10:53:18 | StringLiteral | '0.0.0.0' |
| BindToAllInterfaces_test.py:58:10:58:25 | Tuple | BindToAllInterfaces_test.py:58:10:58:18 | StringLiteral | BindToAllInterfaces_test.py:58:10:58:25 | Tuple | Binding a socket to all interfaces (using $@) is a security risk. | BindToAllInterfaces_test.py:58:10:58:18 | StringLiteral | '0.0.0.0' |
edges
| BindToAllInterfaces_test.py:5:9:5:17 | StringLiteral | BindToAllInterfaces_test.py:5:9:5:24 | Tuple | provenance | Sink:MaD:63 |
| BindToAllInterfaces_test.py:9:9:9:10 | StringLiteral | BindToAllInterfaces_test.py:9:9:9:16 | Tuple | provenance | Sink:MaD:63 |
| BindToAllInterfaces_test.py:16:1:16:10 | ALL_LOCALS | BindToAllInterfaces_test.py:17:9:17:18 | ALL_LOCALS | provenance | |
| BindToAllInterfaces_test.py:16:1:16:10 | ALL_LOCALS | BindToAllInterfaces_test.py:20:8:20:17 | ALL_LOCALS | provenance | |
| BindToAllInterfaces_test.py:16:14:16:22 | StringLiteral | BindToAllInterfaces_test.py:16:1:16:10 | ALL_LOCALS | provenance | |
| BindToAllInterfaces_test.py:17:9:17:18 | ALL_LOCALS | BindToAllInterfaces_test.py:17:9:17:24 | Tuple | provenance | Sink:MaD:63 |
| BindToAllInterfaces_test.py:20:1:20:3 | tup [Tuple element at index 0] | BindToAllInterfaces_test.py:21:8:21:10 | tup | provenance | Sink:MaD:63 |
| BindToAllInterfaces_test.py:20:8:20:17 | ALL_LOCALS | BindToAllInterfaces_test.py:20:8:20:23 | Tuple [Tuple element at index 0] | provenance | |
| BindToAllInterfaces_test.py:20:8:20:23 | Tuple [Tuple element at index 0] | BindToAllInterfaces_test.py:20:1:20:3 | tup [Tuple element at index 0] | provenance | |
| BindToAllInterfaces_test.py:26:9:26:12 | StringLiteral | BindToAllInterfaces_test.py:26:9:26:18 | Tuple | provenance | Sink:MaD:63 |
| BindToAllInterfaces_test.py:33:18:33:21 | self [Return] [Attribute bind_addr] | BindToAllInterfaces_test.py:41:10:41:17 | Server() [Attribute bind_addr] | provenance | |
| BindToAllInterfaces_test.py:34:9:34:12 | [post] self [Attribute bind_addr] | BindToAllInterfaces_test.py:33:18:33:21 | self [Return] [Attribute bind_addr] | provenance | |
| BindToAllInterfaces_test.py:34:26:34:34 | StringLiteral | BindToAllInterfaces_test.py:34:9:34:12 | [post] self [Attribute bind_addr] | provenance | |
| BindToAllInterfaces_test.py:37:15:37:18 | self [Attribute bind_addr] | BindToAllInterfaces_test.py:39:17:39:20 | self [Attribute bind_addr] | provenance | |
| BindToAllInterfaces_test.py:39:17:39:20 | self [Attribute bind_addr] | BindToAllInterfaces_test.py:39:17:39:30 | Attribute | provenance | |
| BindToAllInterfaces_test.py:39:17:39:30 | Attribute | BindToAllInterfaces_test.py:39:17:39:41 | Tuple | provenance | Sink:MaD:63 |
| BindToAllInterfaces_test.py:41:1:41:6 | server [Attribute bind_addr] | BindToAllInterfaces_test.py:42:1:42:6 | server [Attribute bind_addr] | provenance | |
| BindToAllInterfaces_test.py:41:10:41:17 | Server() [Attribute bind_addr] | BindToAllInterfaces_test.py:41:1:41:6 | server [Attribute bind_addr] | provenance | |
| BindToAllInterfaces_test.py:42:1:42:6 | server [Attribute bind_addr] | BindToAllInterfaces_test.py:37:15:37:18 | self [Attribute bind_addr] | provenance | |
| BindToAllInterfaces_test.py:46:1:46:4 | host | BindToAllInterfaces_test.py:48:9:48:12 | host | provenance | |
| BindToAllInterfaces_test.py:46:8:46:44 | Attribute() | BindToAllInterfaces_test.py:46:1:46:4 | host | provenance | |
| BindToAllInterfaces_test.py:46:35:46:43 | StringLiteral | BindToAllInterfaces_test.py:46:8:46:44 | Attribute() | provenance | dict.get |
| BindToAllInterfaces_test.py:48:9:48:12 | host | BindToAllInterfaces_test.py:48:9:48:18 | Tuple | provenance | Sink:MaD:63 |
| BindToAllInterfaces_test.py:53:10:53:18 | StringLiteral | BindToAllInterfaces_test.py:53:10:53:25 | Tuple | provenance | Sink:MaD:63 |
| BindToAllInterfaces_test.py:58:10:58:18 | StringLiteral | BindToAllInterfaces_test.py:58:10:58:25 | Tuple | provenance | Sink:MaD:63 |
nodes
| BindToAllInterfaces_test.py:5:9:5:17 | StringLiteral | semmle.label | StringLiteral |
| BindToAllInterfaces_test.py:5:9:5:24 | Tuple | semmle.label | Tuple |
| BindToAllInterfaces_test.py:9:9:9:10 | StringLiteral | semmle.label | StringLiteral |
| BindToAllInterfaces_test.py:9:9:9:16 | Tuple | semmle.label | Tuple |
| BindToAllInterfaces_test.py:16:1:16:10 | ALL_LOCALS | semmle.label | ALL_LOCALS |
| BindToAllInterfaces_test.py:16:14:16:22 | StringLiteral | semmle.label | StringLiteral |
| BindToAllInterfaces_test.py:17:9:17:18 | ALL_LOCALS | semmle.label | ALL_LOCALS |
| BindToAllInterfaces_test.py:17:9:17:24 | Tuple | semmle.label | Tuple |
| BindToAllInterfaces_test.py:20:1:20:3 | tup [Tuple element at index 0] | semmle.label | tup [Tuple element at index 0] |
| BindToAllInterfaces_test.py:20:8:20:17 | ALL_LOCALS | semmle.label | ALL_LOCALS |
| BindToAllInterfaces_test.py:20:8:20:23 | Tuple [Tuple element at index 0] | semmle.label | Tuple [Tuple element at index 0] |
| BindToAllInterfaces_test.py:21:8:21:10 | tup | semmle.label | tup |
| BindToAllInterfaces_test.py:26:9:26:12 | StringLiteral | semmle.label | StringLiteral |
| BindToAllInterfaces_test.py:26:9:26:18 | Tuple | semmle.label | Tuple |
| BindToAllInterfaces_test.py:33:18:33:21 | self [Return] [Attribute bind_addr] | semmle.label | self [Return] [Attribute bind_addr] |
| BindToAllInterfaces_test.py:34:9:34:12 | [post] self [Attribute bind_addr] | semmle.label | [post] self [Attribute bind_addr] |
| BindToAllInterfaces_test.py:34:26:34:34 | StringLiteral | semmle.label | StringLiteral |
| BindToAllInterfaces_test.py:37:15:37:18 | self [Attribute bind_addr] | semmle.label | self [Attribute bind_addr] |
| BindToAllInterfaces_test.py:39:17:39:20 | self [Attribute bind_addr] | semmle.label | self [Attribute bind_addr] |
| BindToAllInterfaces_test.py:39:17:39:30 | Attribute | semmle.label | Attribute |
| BindToAllInterfaces_test.py:39:17:39:41 | Tuple | semmle.label | Tuple |
| BindToAllInterfaces_test.py:41:1:41:6 | server [Attribute bind_addr] | semmle.label | server [Attribute bind_addr] |
| BindToAllInterfaces_test.py:41:10:41:17 | Server() [Attribute bind_addr] | semmle.label | Server() [Attribute bind_addr] |
| BindToAllInterfaces_test.py:42:1:42:6 | server [Attribute bind_addr] | semmle.label | server [Attribute bind_addr] |
| BindToAllInterfaces_test.py:46:1:46:4 | host | semmle.label | host |
| BindToAllInterfaces_test.py:46:8:46:44 | Attribute() | semmle.label | Attribute() |
| BindToAllInterfaces_test.py:46:35:46:43 | StringLiteral | semmle.label | StringLiteral |
| BindToAllInterfaces_test.py:48:9:48:12 | host | semmle.label | host |
| BindToAllInterfaces_test.py:48:9:48:18 | Tuple | semmle.label | Tuple |
| BindToAllInterfaces_test.py:53:10:53:18 | StringLiteral | semmle.label | StringLiteral |
| BindToAllInterfaces_test.py:53:10:53:25 | Tuple | semmle.label | Tuple |
| BindToAllInterfaces_test.py:58:10:58:18 | StringLiteral | semmle.label | StringLiteral |
| BindToAllInterfaces_test.py:58:10:58:25 | Tuple | semmle.label | Tuple |
subpaths
Reference in New Issue View Git Blame Copy Permalink