mirror of
https://github.com/github/codeql.git
synced 2026-08-03 00:43:00 +02:00
8f6c24678f
Test-side changes accompanying the dataflow migration:
* Test queries (.ql) and shared test harness (TestSummaries,
TestTaintLib) qualify CFG / SSA types with Cfg:: / SsaImpl::,
bridge via AST (Name, Call, ...) instead of legacy NameNode /
CallNode, and switch GlobalSsaVariable / EssaVariable usages
to the new adapter API.
* .expected files updated for legitimate precision and toString
changes:
- phi-node def-use edges newly exposed in def_use_counts.
- scope-exit synthetic use surfaces one extra implicit use
in use-use-counts.
- For [empty]/[non-empty] outcome rows added in
EnclosingCallable.
- SsaSourceVariable / Global Variable label cosmetics
normalised throughout.
* Inline annotations:
- typetracking/test.py: removed MISSING:tracked on lines
93/95 (now found), added SPURIOUS:tracked on line 108
(decorator over-reach).
- global-flow/test.py: added SPURIOUS writes=g_mod on line
20 (correctly reports immediately-overwritten write).
- tainttracking/customSanitizer/test.py: marked
try/except: ensure_tainted(s) cases as MISSING: tainted
(no-raise CFG abstraction does not connect try body to
except body).
- coverage/test.py: marked
SINK(return_from_inner_scope([])) as
MISSING: flow=... pending closer investigation.
* regression/{dataflow,custom_dataflow}.expected: accept two
if/else cond-correlation over-reaches (documented limitation;
same imprecision applies under legacy semantics by design).
After this change the dataflow library-tests stand at 62 of 64
passing; the two remaining failures are tracked under the
ImportStarRefinement workstream.
Co-authored-by: Copilot <223556219+Copilot@users.noreply.github.com>
39 lines
1.3 KiB
Plaintext
39 lines
1.3 KiB
Plaintext
import python
|
|
import semmle.python.dataflow.new.DataFlow
|
|
private import semmle.python.dataflow.new.internal.DataFlowPrivate as DataFlowPrivate
|
|
private import semmle.python.dataflow.new.internal.SsaImpl as SsaImpl
|
|
|
|
/** Gets the `CfgNode` that holds the module imported by the fully qualified module name `name`. */
|
|
DataFlow::CfgNode module_import(string name) {
|
|
exists(Variable var, SsaImpl::AssignmentDefinition def, Import imp, Alias alias |
|
|
var = def.getSourceVariable().getVariable() and
|
|
result.getNode() = def.getDefiningNode() and
|
|
alias = imp.getAName() and
|
|
alias.getAsname() = var.getAStore()
|
|
|
|
|
name = alias.getValue().(ImportMember).getImportedModuleName()
|
|
or
|
|
name = alias.getValue().(ImportExpr).getImportedModuleName()
|
|
)
|
|
}
|
|
|
|
query predicate os_import(DataFlow::Node node) {
|
|
node = module_import("os") and
|
|
exists(node.getLocation().getFile().getRelativePath())
|
|
}
|
|
|
|
query predicate flowstep(DataFlow::Node nodeFrom, DataFlow::Node nodeTo) {
|
|
os_import(nodeFrom) and
|
|
DataFlow::localFlowStep(nodeFrom, nodeTo)
|
|
}
|
|
|
|
query predicate jumpStep(DataFlow::Node nodeFrom, DataFlow::Node nodeTo) {
|
|
os_import(nodeFrom) and
|
|
DataFlowPrivate::jumpStep(nodeFrom, nodeTo)
|
|
}
|
|
|
|
query predicate essaFlowStep(DataFlow::Node nodeFrom, DataFlow::Node nodeTo) {
|
|
os_import(nodeFrom) and
|
|
DataFlowPrivate::LocalFlow::localFlowStep(nodeFrom, nodeTo)
|
|
}
|