hohn/codeql
1
0
Fork 0
mirror of https://github.com/github/codeql.git synced 2026-08-03 00:43:00 +02:00
Code Issues Packages Projects Releases Wiki Activity
Files
yoff/python-shared-cfg-dataflow-flip
codeql/python/ql/test/query-tests/Security/CWE-089-SqlInjection/SqlInjection.expected
yoff 265a31dc1d Python: switch dataflow library to new (shared) CFG + SSA 
Flips the Python dataflow trunk from the legacy CFG (semmle/python/Flow.qll)
and legacy ESSA SSA (semmle/python/essa/*) to the new shared CFG facade
(semmle.python.controlflow.internal.Cfg) and the new SSA adapter
(semmle.python.dataflow.new.internal.SsaImpl), both introduced
additively in the preceding PRs in this stack.

This is the trunk-flip equivalent of the original draft PR #21894 (kept
around as documentation), rebased on top of the four preparatory PRs:

  P1: Remove AstNode.getAFlowNode() and rewrite callers (#21919).
  P2: Qualify Flow.qll's AST references with Py:: prefix (#21920).
  P3: Add new shared-CFG-backed control flow graph (#21921).
  P4: Add new shared-SSA-backed SSA adapter (#21923).

The Python dataflow library (semmle/python/dataflow/new/) now imports
the new CFG facade and SSA adapter. All CFG-typed predicates
(ControlFlowNode, CallNode, BasicBlock, NameNode, AttrNode, ...) are
qualified with the Cfg:: prefix; SSA references switch from
EssaVariable/EssaDefinition to SsaImpl::Definition/SourceVariable.

GuardNode is redesigned to use the new CFG's outcome-node model
(isAfterTrue / isAfterFalse) instead of the legacy ConditionBlock +
flipped indirection. Only BarrierGuard<...> is preserved as public
API.

Framework files (Bottle, FastApi, Django, Tornado, Pyramid, Stdlib,
...) are updated to take CFG nodes from the new facade.

A handful of dataflow consistency tweaks for the new CFG:
- Augmented-assignment targets are treated as both load and store.
- 'from X import *' produces uncertain SSA writes for unknown names.
- CFG nodes are canonicalised so dataflow does not see equivalent
  pre/post-order pairs as distinct nodes.

Two AST tweaks for the new CFG:
- AstNodeImpl: omit PEP 695 type-parameter names from
  FunctionDefExpr / ClassDefExpr children.
- ImportResolution: drop the legacy essa import.

Test churn (~175 files): reblessed library- and query-test .expected
files reflect slightly different CFG granularity, different toString
output, and a handful of true alert deltas in security queries.

Verification: all 367 lib + src + consistency-queries compile clean.

Co-authored-by: Copilot <223556219+Copilot@users.noreply.github.com>
2026-07-30 15:30:47 +00:00

79 lines
9.0 KiB
Plaintext
Raw Permalink Blame History

#select
| app.py:23:20:23:24 | query | app.py:20:18:20:21 | name | app.py:23:20:23:24 | query | This SQL query depends on a $@. | app.py:20:18:20:21 | name | user-provided value |
| app.py:30:20:30:24 | query | app.py:27:19:27:22 | name | app.py:30:20:30:24 | query | This SQL query depends on a $@. | app.py:27:19:27:22 | name | user-provided value |
| app.py:44:20:44:24 | query | app.py:41:19:41:22 | name | app.py:44:20:44:24 | query | This SQL query depends on a $@. | app.py:41:19:41:22 | name | user-provided value |
| app.py:51:20:51:24 | query | app.py:48:19:48:22 | name | app.py:51:20:51:24 | query | This SQL query depends on a $@. | app.py:48:19:48:22 | name | user-provided value |
| sql_injection.py:21:24:21:77 | BinaryExpr | sql_injection.py:14:15:14:22 | username | sql_injection.py:21:24:21:77 | BinaryExpr | This SQL query depends on a $@. | sql_injection.py:14:15:14:22 | username | user-provided value |
| sql_injection.py:24:38:24:95 | BinaryExpr | sql_injection.py:14:15:14:22 | username | sql_injection.py:24:38:24:95 | BinaryExpr | This SQL query depends on a $@. | sql_injection.py:14:15:14:22 | username | user-provided value |
| sql_injection.py:25:26:25:83 | BinaryExpr | sql_injection.py:14:15:14:22 | username | sql_injection.py:25:26:25:83 | BinaryExpr | This SQL query depends on a $@. | sql_injection.py:14:15:14:22 | username | user-provided value |
| sql_injection.py:26:28:26:85 | BinaryExpr | sql_injection.py:14:15:14:22 | username | sql_injection.py:26:28:26:85 | BinaryExpr | This SQL query depends on a $@. | sql_injection.py:14:15:14:22 | username | user-provided value |
| sqlalchemy_textclause.py:27:28:27:87 | Attribute() | sqlalchemy_textclause.py:23:15:23:22 | username | sqlalchemy_textclause.py:27:28:27:87 | Attribute() | This SQL query depends on a $@. | sqlalchemy_textclause.py:23:15:23:22 | username | user-provided value |
| sqlalchemy_textclause.py:31:50:31:72 | Attribute() | sqlalchemy_textclause.py:23:15:23:22 | username | sqlalchemy_textclause.py:31:50:31:72 | Attribute() | This SQL query depends on a $@. | sqlalchemy_textclause.py:23:15:23:22 | username | user-provided value |
| sqlalchemy_textclause.py:41:26:41:33 | username | sqlalchemy_textclause.py:23:15:23:22 | username | sqlalchemy_textclause.py:41:26:41:33 | username | This SQL query depends on a $@. | sqlalchemy_textclause.py:23:15:23:22 | username | user-provided value |
| sqlalchemy_textclause.py:42:31:42:38 | username | sqlalchemy_textclause.py:23:15:23:22 | username | sqlalchemy_textclause.py:42:31:42:38 | username | This SQL query depends on a $@. | sqlalchemy_textclause.py:23:15:23:22 | username | user-provided value |
| sqlalchemy_textclause.py:43:30:43:37 | username | sqlalchemy_textclause.py:23:15:23:22 | username | sqlalchemy_textclause.py:43:30:43:37 | username | This SQL query depends on a $@. | sqlalchemy_textclause.py:23:15:23:22 | username | user-provided value |
| sqlalchemy_textclause.py:44:35:44:42 | username | sqlalchemy_textclause.py:23:15:23:22 | username | sqlalchemy_textclause.py:44:35:44:42 | username | This SQL query depends on a $@. | sqlalchemy_textclause.py:23:15:23:22 | username | user-provided value |
| sqlalchemy_textclause.py:45:41:45:48 | username | sqlalchemy_textclause.py:23:15:23:22 | username | sqlalchemy_textclause.py:45:41:45:48 | username | This SQL query depends on a $@. | sqlalchemy_textclause.py:23:15:23:22 | username | user-provided value |
| sqlalchemy_textclause.py:46:46:46:53 | username | sqlalchemy_textclause.py:23:15:23:22 | username | sqlalchemy_textclause.py:46:46:46:53 | username | This SQL query depends on a $@. | sqlalchemy_textclause.py:23:15:23:22 | username | user-provided value |
| sqlalchemy_textclause.py:47:47:47:54 | username | sqlalchemy_textclause.py:23:15:23:22 | username | sqlalchemy_textclause.py:47:47:47:54 | username | This SQL query depends on a $@. | sqlalchemy_textclause.py:23:15:23:22 | username | user-provided value |
| sqlalchemy_textclause.py:48:52:48:59 | username | sqlalchemy_textclause.py:23:15:23:22 | username | sqlalchemy_textclause.py:48:52:48:59 | username | This SQL query depends on a $@. | sqlalchemy_textclause.py:23:15:23:22 | username | user-provided value |
| sqlalchemy_textclause.py:50:18:50:25 | username | sqlalchemy_textclause.py:23:15:23:22 | username | sqlalchemy_textclause.py:50:18:50:25 | username | This SQL query depends on a $@. | sqlalchemy_textclause.py:23:15:23:22 | username | user-provided value |
| sqlalchemy_textclause.py:51:24:51:31 | username | sqlalchemy_textclause.py:23:15:23:22 | username | sqlalchemy_textclause.py:51:24:51:31 | username | This SQL query depends on a $@. | sqlalchemy_textclause.py:23:15:23:22 | username | user-provided value |
edges
| app.py:20:18:20:21 | name | app.py:21:5:21:9 | query | provenance | |
| app.py:21:5:21:9 | query | app.py:23:20:23:24 | query | provenance | |
| app.py:27:19:27:22 | name | app.py:28:5:28:9 | query | provenance | |
| app.py:28:5:28:9 | query | app.py:30:20:30:24 | query | provenance | |
| app.py:41:19:41:22 | name | app.py:42:5:42:9 | query | provenance | |
| app.py:42:5:42:9 | query | app.py:44:20:44:24 | query | provenance | |
| app.py:48:19:48:22 | name | app.py:49:5:49:9 | query | provenance | |
| app.py:49:5:49:9 | query | app.py:51:20:51:24 | query | provenance | |
| sql_injection.py:14:15:14:22 | username | sql_injection.py:21:24:21:77 | BinaryExpr | provenance | |
| sql_injection.py:14:15:14:22 | username | sql_injection.py:24:38:24:95 | BinaryExpr | provenance | |
| sql_injection.py:14:15:14:22 | username | sql_injection.py:25:26:25:83 | BinaryExpr | provenance | |
| sql_injection.py:14:15:14:22 | username | sql_injection.py:26:28:26:85 | BinaryExpr | provenance | |
| sqlalchemy_textclause.py:23:15:23:22 | username | sqlalchemy_textclause.py:27:28:27:87 | Attribute() | provenance | |
| sqlalchemy_textclause.py:23:15:23:22 | username | sqlalchemy_textclause.py:31:50:31:72 | Attribute() | provenance | |
| sqlalchemy_textclause.py:23:15:23:22 | username | sqlalchemy_textclause.py:41:26:41:33 | username | provenance | |
| sqlalchemy_textclause.py:23:15:23:22 | username | sqlalchemy_textclause.py:42:31:42:38 | username | provenance | |
| sqlalchemy_textclause.py:23:15:23:22 | username | sqlalchemy_textclause.py:43:30:43:37 | username | provenance | |
| sqlalchemy_textclause.py:23:15:23:22 | username | sqlalchemy_textclause.py:44:35:44:42 | username | provenance | |
| sqlalchemy_textclause.py:23:15:23:22 | username | sqlalchemy_textclause.py:45:41:45:48 | username | provenance | |
| sqlalchemy_textclause.py:23:15:23:22 | username | sqlalchemy_textclause.py:46:46:46:53 | username | provenance | |
| sqlalchemy_textclause.py:23:15:23:22 | username | sqlalchemy_textclause.py:47:47:47:54 | username | provenance | |
| sqlalchemy_textclause.py:23:15:23:22 | username | sqlalchemy_textclause.py:48:52:48:59 | username | provenance | |
| sqlalchemy_textclause.py:23:15:23:22 | username | sqlalchemy_textclause.py:50:18:50:25 | username | provenance | |
| sqlalchemy_textclause.py:23:15:23:22 | username | sqlalchemy_textclause.py:51:24:51:31 | username | provenance | |
nodes
| app.py:20:18:20:21 | name | semmle.label | name |
| app.py:21:5:21:9 | query | semmle.label | query |
| app.py:23:20:23:24 | query | semmle.label | query |
| app.py:27:19:27:22 | name | semmle.label | name |
| app.py:28:5:28:9 | query | semmle.label | query |
| app.py:30:20:30:24 | query | semmle.label | query |
| app.py:41:19:41:22 | name | semmle.label | name |
| app.py:42:5:42:9 | query | semmle.label | query |
| app.py:44:20:44:24 | query | semmle.label | query |
| app.py:48:19:48:22 | name | semmle.label | name |
| app.py:49:5:49:9 | query | semmle.label | query |
| app.py:51:20:51:24 | query | semmle.label | query |
| sql_injection.py:14:15:14:22 | username | semmle.label | username |
| sql_injection.py:21:24:21:77 | BinaryExpr | semmle.label | BinaryExpr |
| sql_injection.py:24:38:24:95 | BinaryExpr | semmle.label | BinaryExpr |
| sql_injection.py:25:26:25:83 | BinaryExpr | semmle.label | BinaryExpr |
| sql_injection.py:26:28:26:85 | BinaryExpr | semmle.label | BinaryExpr |
| sqlalchemy_textclause.py:23:15:23:22 | username | semmle.label | username |
| sqlalchemy_textclause.py:27:28:27:87 | Attribute() | semmle.label | Attribute() |
| sqlalchemy_textclause.py:31:50:31:72 | Attribute() | semmle.label | Attribute() |
| sqlalchemy_textclause.py:41:26:41:33 | username | semmle.label | username |
| sqlalchemy_textclause.py:42:31:42:38 | username | semmle.label | username |
| sqlalchemy_textclause.py:43:30:43:37 | username | semmle.label | username |
| sqlalchemy_textclause.py:44:35:44:42 | username | semmle.label | username |
| sqlalchemy_textclause.py:45:41:45:48 | username | semmle.label | username |
| sqlalchemy_textclause.py:46:46:46:53 | username | semmle.label | username |
| sqlalchemy_textclause.py:47:47:47:54 | username | semmle.label | username |
| sqlalchemy_textclause.py:48:52:48:59 | username | semmle.label | username |
| sqlalchemy_textclause.py:50:18:50:25 | username | semmle.label | username |
| sqlalchemy_textclause.py:51:24:51:31 | username | semmle.label | username |
subpaths
Reference in New Issue View Git Blame Copy Permalink