hohn/codeql
1
0
Fork 0
mirror of https://github.com/github/codeql.git synced 2026-08-03 17:03:02 +02:00
Code Issues Packages Projects Releases Wiki Activity
Files
yoff/python-shared-cfg-dataflow-flip
codeql/python/ql/test/query-tests/Security/CWE-090-LdapInjection/LdapInjection.expected
yoff 265a31dc1d Python: switch dataflow library to new (shared) CFG + SSA 
Flips the Python dataflow trunk from the legacy CFG (semmle/python/Flow.qll)
and legacy ESSA SSA (semmle/python/essa/*) to the new shared CFG facade
(semmle.python.controlflow.internal.Cfg) and the new SSA adapter
(semmle.python.dataflow.new.internal.SsaImpl), both introduced
additively in the preceding PRs in this stack.

This is the trunk-flip equivalent of the original draft PR #21894 (kept
around as documentation), rebased on top of the four preparatory PRs:

  P1: Remove AstNode.getAFlowNode() and rewrite callers (#21919).
  P2: Qualify Flow.qll's AST references with Py:: prefix (#21920).
  P3: Add new shared-CFG-backed control flow graph (#21921).
  P4: Add new shared-SSA-backed SSA adapter (#21923).

The Python dataflow library (semmle/python/dataflow/new/) now imports
the new CFG facade and SSA adapter. All CFG-typed predicates
(ControlFlowNode, CallNode, BasicBlock, NameNode, AttrNode, ...) are
qualified with the Cfg:: prefix; SSA references switch from
EssaVariable/EssaDefinition to SsaImpl::Definition/SourceVariable.

GuardNode is redesigned to use the new CFG's outcome-node model
(isAfterTrue / isAfterFalse) instead of the legacy ConditionBlock +
flipped indirection. Only BarrierGuard<...> is preserved as public
API.

Framework files (Bottle, FastApi, Django, Tornado, Pyramid, Stdlib,
...) are updated to take CFG nodes from the new facade.

A handful of dataflow consistency tweaks for the new CFG:
- Augmented-assignment targets are treated as both load and store.
- 'from X import *' produces uncertain SSA writes for unknown names.
- CFG nodes are canonicalised so dataflow does not see equivalent
  pre/post-order pairs as distinct nodes.

Two AST tweaks for the new CFG:
- AstNodeImpl: omit PEP 695 type-parameter names from
  FunctionDefExpr / ClassDefExpr children.
- ImportResolution: drop the legacy essa import.

Test churn (~175 files): reblessed library- and query-test .expected
files reflect slightly different CFG granularity, different toString
output, and a handful of true alert deltas in security queries.

Verification: all 367 lib + src + consistency-queries compile clean.

Co-authored-by: Copilot <223556219+Copilot@users.noreply.github.com>
2026-07-30 15:30:47 +00:00

122 lines
11 KiB
Plaintext
Raw Permalink Blame History

#select
| ldap3_bad.py:21:17:21:18 | dn | ldap3_bad.py:1:19:1:25 | ImportMember | ldap3_bad.py:21:17:21:18 | dn | LDAP query parameter (DN) depends on a $@. | ldap3_bad.py:1:19:1:25 | ImportMember | user-provided value |
| ldap3_bad.py:21:21:21:33 | search_filter | ldap3_bad.py:1:19:1:25 | ImportMember | ldap3_bad.py:21:21:21:33 | search_filter | LDAP query parameter (filter) depends on a $@. | ldap3_bad.py:1:19:1:25 | ImportMember | user-provided value |
| ldap3_bad.py:38:9:38:10 | dn | ldap3_bad.py:1:19:1:25 | ImportMember | ldap3_bad.py:38:9:38:10 | dn | LDAP query parameter (DN) depends on a $@. | ldap3_bad.py:1:19:1:25 | ImportMember | user-provided value |
| ldap3_bad.py:38:13:38:25 | search_filter | ldap3_bad.py:1:19:1:25 | ImportMember | ldap3_bad.py:38:13:38:25 | search_filter | LDAP query parameter (filter) depends on a $@. | ldap3_bad.py:1:19:1:25 | ImportMember | user-provided value |
| ldap_bad.py:21:9:21:10 | dn | ldap_bad.py:1:19:1:25 | ImportMember | ldap_bad.py:21:9:21:10 | dn | LDAP query parameter (DN) depends on a $@. | ldap_bad.py:1:19:1:25 | ImportMember | user-provided value |
| ldap_bad.py:21:33:21:45 | search_filter | ldap_bad.py:1:19:1:25 | ImportMember | ldap_bad.py:21:33:21:45 | search_filter | LDAP query parameter (filter) depends on a $@. | ldap_bad.py:1:19:1:25 | ImportMember | user-provided value |
| ldap_bad.py:37:9:37:10 | dn | ldap_bad.py:1:19:1:25 | ImportMember | ldap_bad.py:37:9:37:10 | dn | LDAP query parameter (DN) depends on a $@. | ldap_bad.py:1:19:1:25 | ImportMember | user-provided value |
| ldap_bad.py:37:33:37:45 | search_filter | ldap_bad.py:1:19:1:25 | ImportMember | ldap_bad.py:37:33:37:45 | search_filter | LDAP query parameter (filter) depends on a $@. | ldap_bad.py:1:19:1:25 | ImportMember | user-provided value |
| ldap_bad.py:55:9:55:10 | dn | ldap_bad.py:1:19:1:25 | ImportMember | ldap_bad.py:55:9:55:10 | dn | LDAP query parameter (DN) depends on a $@. | ldap_bad.py:1:19:1:25 | ImportMember | user-provided value |
| ldap_bad.py:55:43:55:55 | search_filter | ldap_bad.py:1:19:1:25 | ImportMember | ldap_bad.py:55:43:55:55 | search_filter | LDAP query parameter (filter) depends on a $@. | ldap_bad.py:1:19:1:25 | ImportMember | user-provided value |
edges
| ldap3_bad.py:1:19:1:25 | ImportMember | ldap3_bad.py:1:19:1:25 | request | provenance | |
| ldap3_bad.py:1:19:1:25 | ImportMember | ldap3_bad.py:1:19:1:25 | request | provenance | |
| ldap3_bad.py:1:19:1:25 | request | ldap3_bad.py:13:17:13:23 | request | provenance | |
| ldap3_bad.py:1:19:1:25 | request | ldap3_bad.py:13:17:13:23 | request | provenance | |
| ldap3_bad.py:1:19:1:25 | request | ldap3_bad.py:14:21:14:27 | request | provenance | |
| ldap3_bad.py:1:19:1:25 | request | ldap3_bad.py:30:17:30:23 | request | provenance | |
| ldap3_bad.py:1:19:1:25 | request | ldap3_bad.py:30:17:30:23 | request | provenance | |
| ldap3_bad.py:1:19:1:25 | request | ldap3_bad.py:31:21:31:27 | request | provenance | |
| ldap3_bad.py:13:5:13:13 | unsafe_dc | ldap3_bad.py:16:5:16:6 | dn | provenance | |
| ldap3_bad.py:13:17:13:23 | request | ldap3_bad.py:13:5:13:13 | unsafe_dc | provenance | AdditionalTaintStep |
| ldap3_bad.py:13:17:13:23 | request | ldap3_bad.py:14:5:14:17 | unsafe_filter | provenance | AdditionalTaintStep |
| ldap3_bad.py:14:5:14:17 | unsafe_filter | ldap3_bad.py:17:5:17:17 | search_filter | provenance | |
| ldap3_bad.py:14:21:14:27 | request | ldap3_bad.py:14:5:14:17 | unsafe_filter | provenance | AdditionalTaintStep |
| ldap3_bad.py:16:5:16:6 | dn | ldap3_bad.py:21:17:21:18 | dn | provenance | |
| ldap3_bad.py:17:5:17:17 | search_filter | ldap3_bad.py:21:21:21:33 | search_filter | provenance | |
| ldap3_bad.py:30:5:30:13 | unsafe_dc | ldap3_bad.py:33:5:33:6 | dn | provenance | |
| ldap3_bad.py:30:17:30:23 | request | ldap3_bad.py:30:5:30:13 | unsafe_dc | provenance | AdditionalTaintStep |
| ldap3_bad.py:30:17:30:23 | request | ldap3_bad.py:31:5:31:17 | unsafe_filter | provenance | AdditionalTaintStep |
| ldap3_bad.py:31:5:31:17 | unsafe_filter | ldap3_bad.py:34:5:34:17 | search_filter | provenance | |
| ldap3_bad.py:31:21:31:27 | request | ldap3_bad.py:31:5:31:17 | unsafe_filter | provenance | AdditionalTaintStep |
| ldap3_bad.py:33:5:33:6 | dn | ldap3_bad.py:38:9:38:10 | dn | provenance | |
| ldap3_bad.py:34:5:34:17 | search_filter | ldap3_bad.py:38:13:38:25 | search_filter | provenance | |
| ldap_bad.py:1:19:1:25 | ImportMember | ldap_bad.py:1:19:1:25 | request | provenance | |
| ldap_bad.py:1:19:1:25 | ImportMember | ldap_bad.py:1:19:1:25 | request | provenance | |
| ldap_bad.py:1:19:1:25 | request | ldap_bad.py:13:17:13:23 | request | provenance | |
| ldap_bad.py:1:19:1:25 | request | ldap_bad.py:13:17:13:23 | request | provenance | |
| ldap_bad.py:1:19:1:25 | request | ldap_bad.py:14:21:14:27 | request | provenance | |
| ldap_bad.py:1:19:1:25 | request | ldap_bad.py:30:17:30:23 | request | provenance | |
| ldap_bad.py:1:19:1:25 | request | ldap_bad.py:30:17:30:23 | request | provenance | |
| ldap_bad.py:1:19:1:25 | request | ldap_bad.py:31:21:31:27 | request | provenance | |
| ldap_bad.py:1:19:1:25 | request | ldap_bad.py:47:17:47:23 | request | provenance | |
| ldap_bad.py:1:19:1:25 | request | ldap_bad.py:47:17:47:23 | request | provenance | |
| ldap_bad.py:1:19:1:25 | request | ldap_bad.py:48:21:48:27 | request | provenance | |
| ldap_bad.py:13:5:13:13 | unsafe_dc | ldap_bad.py:16:5:16:6 | dn | provenance | |
| ldap_bad.py:13:17:13:23 | request | ldap_bad.py:13:5:13:13 | unsafe_dc | provenance | AdditionalTaintStep |
| ldap_bad.py:13:17:13:23 | request | ldap_bad.py:14:5:14:17 | unsafe_filter | provenance | AdditionalTaintStep |
| ldap_bad.py:14:5:14:17 | unsafe_filter | ldap_bad.py:17:5:17:17 | search_filter | provenance | |
| ldap_bad.py:14:21:14:27 | request | ldap_bad.py:14:5:14:17 | unsafe_filter | provenance | AdditionalTaintStep |
| ldap_bad.py:16:5:16:6 | dn | ldap_bad.py:21:9:21:10 | dn | provenance | |
| ldap_bad.py:17:5:17:17 | search_filter | ldap_bad.py:21:33:21:45 | search_filter | provenance | |
| ldap_bad.py:30:5:30:13 | unsafe_dc | ldap_bad.py:33:5:33:6 | dn | provenance | |
| ldap_bad.py:30:17:30:23 | request | ldap_bad.py:30:5:30:13 | unsafe_dc | provenance | AdditionalTaintStep |
| ldap_bad.py:30:17:30:23 | request | ldap_bad.py:31:5:31:17 | unsafe_filter | provenance | AdditionalTaintStep |
| ldap_bad.py:31:5:31:17 | unsafe_filter | ldap_bad.py:34:5:34:17 | search_filter | provenance | |
| ldap_bad.py:31:21:31:27 | request | ldap_bad.py:31:5:31:17 | unsafe_filter | provenance | AdditionalTaintStep |
| ldap_bad.py:33:5:33:6 | dn | ldap_bad.py:37:9:37:10 | dn | provenance | |
| ldap_bad.py:34:5:34:17 | search_filter | ldap_bad.py:37:33:37:45 | search_filter | provenance | |
| ldap_bad.py:47:5:47:13 | unsafe_dc | ldap_bad.py:50:5:50:6 | dn | provenance | |
| ldap_bad.py:47:17:47:23 | request | ldap_bad.py:47:5:47:13 | unsafe_dc | provenance | AdditionalTaintStep |
| ldap_bad.py:47:17:47:23 | request | ldap_bad.py:48:5:48:17 | unsafe_filter | provenance | AdditionalTaintStep |
| ldap_bad.py:48:5:48:17 | unsafe_filter | ldap_bad.py:51:5:51:17 | search_filter | provenance | |
| ldap_bad.py:48:21:48:27 | request | ldap_bad.py:48:5:48:17 | unsafe_filter | provenance | AdditionalTaintStep |
| ldap_bad.py:50:5:50:6 | dn | ldap_bad.py:55:9:55:10 | dn | provenance | |
| ldap_bad.py:51:5:51:17 | search_filter | ldap_bad.py:55:43:55:55 | search_filter | provenance | |
nodes
| ldap3_bad.py:1:19:1:25 | ImportMember | semmle.label | ImportMember |
| ldap3_bad.py:1:19:1:25 | ImportMember | semmle.label | ImportMember |
| ldap3_bad.py:1:19:1:25 | request | semmle.label | request |
| ldap3_bad.py:1:19:1:25 | request | semmle.label | request |
| ldap3_bad.py:13:5:13:13 | unsafe_dc | semmle.label | unsafe_dc |
| ldap3_bad.py:13:17:13:23 | request | semmle.label | request |
| ldap3_bad.py:13:17:13:23 | request | semmle.label | request |
| ldap3_bad.py:14:5:14:17 | unsafe_filter | semmle.label | unsafe_filter |
| ldap3_bad.py:14:21:14:27 | request | semmle.label | request |
| ldap3_bad.py:16:5:16:6 | dn | semmle.label | dn |
| ldap3_bad.py:17:5:17:17 | search_filter | semmle.label | search_filter |
| ldap3_bad.py:21:17:21:18 | dn | semmle.label | dn |
| ldap3_bad.py:21:21:21:33 | search_filter | semmle.label | search_filter |
| ldap3_bad.py:30:5:30:13 | unsafe_dc | semmle.label | unsafe_dc |
| ldap3_bad.py:30:17:30:23 | request | semmle.label | request |
| ldap3_bad.py:30:17:30:23 | request | semmle.label | request |
| ldap3_bad.py:31:5:31:17 | unsafe_filter | semmle.label | unsafe_filter |
| ldap3_bad.py:31:21:31:27 | request | semmle.label | request |
| ldap3_bad.py:33:5:33:6 | dn | semmle.label | dn |
| ldap3_bad.py:34:5:34:17 | search_filter | semmle.label | search_filter |
| ldap3_bad.py:38:9:38:10 | dn | semmle.label | dn |
| ldap3_bad.py:38:13:38:25 | search_filter | semmle.label | search_filter |
| ldap_bad.py:1:19:1:25 | ImportMember | semmle.label | ImportMember |
| ldap_bad.py:1:19:1:25 | ImportMember | semmle.label | ImportMember |
| ldap_bad.py:1:19:1:25 | request | semmle.label | request |
| ldap_bad.py:1:19:1:25 | request | semmle.label | request |
| ldap_bad.py:13:5:13:13 | unsafe_dc | semmle.label | unsafe_dc |
| ldap_bad.py:13:17:13:23 | request | semmle.label | request |
| ldap_bad.py:13:17:13:23 | request | semmle.label | request |
| ldap_bad.py:14:5:14:17 | unsafe_filter | semmle.label | unsafe_filter |
| ldap_bad.py:14:21:14:27 | request | semmle.label | request |
| ldap_bad.py:16:5:16:6 | dn | semmle.label | dn |
| ldap_bad.py:17:5:17:17 | search_filter | semmle.label | search_filter |
| ldap_bad.py:21:9:21:10 | dn | semmle.label | dn |
| ldap_bad.py:21:33:21:45 | search_filter | semmle.label | search_filter |
| ldap_bad.py:30:5:30:13 | unsafe_dc | semmle.label | unsafe_dc |
| ldap_bad.py:30:17:30:23 | request | semmle.label | request |
| ldap_bad.py:30:17:30:23 | request | semmle.label | request |
| ldap_bad.py:31:5:31:17 | unsafe_filter | semmle.label | unsafe_filter |
| ldap_bad.py:31:21:31:27 | request | semmle.label | request |
| ldap_bad.py:33:5:33:6 | dn | semmle.label | dn |
| ldap_bad.py:34:5:34:17 | search_filter | semmle.label | search_filter |
| ldap_bad.py:37:9:37:10 | dn | semmle.label | dn |
| ldap_bad.py:37:33:37:45 | search_filter | semmle.label | search_filter |
| ldap_bad.py:47:5:47:13 | unsafe_dc | semmle.label | unsafe_dc |
| ldap_bad.py:47:17:47:23 | request | semmle.label | request |
| ldap_bad.py:47:17:47:23 | request | semmle.label | request |
| ldap_bad.py:48:5:48:17 | unsafe_filter | semmle.label | unsafe_filter |
| ldap_bad.py:48:21:48:27 | request | semmle.label | request |
| ldap_bad.py:50:5:50:6 | dn | semmle.label | dn |
| ldap_bad.py:51:5:51:17 | search_filter | semmle.label | search_filter |
| ldap_bad.py:55:9:55:10 | dn | semmle.label | dn |
| ldap_bad.py:55:43:55:55 | search_filter | semmle.label | search_filter |
subpaths
Reference in New Issue View Git Blame Copy Permalink