hohn/codeql
1
0
Fork 0
mirror of https://github.com/github/codeql.git synced 2026-06-20 20:31:09 +02:00
Code Issues Packages Projects Releases Wiki Activity
Files
08e2f3775791abc2279e458d9880ff52bddade07
codeql/python/ql/test/query-tests/Security/CWE-643-XPathInjection/XpathInjection.expected
yoff 3c9b0f770b Python: switch dataflow library to new (shared) CFG + SSA 
Flips the Python dataflow trunk from the legacy CFG (semmle/python/Flow.qll)
and legacy ESSA SSA (semmle/python/essa/*) to the new shared CFG facade
(semmle.python.controlflow.internal.Cfg) and the new SSA adapter
(semmle.python.dataflow.new.internal.SsaImpl), both introduced
additively in the preceding PRs in this stack.

This is the trunk-flip equivalent of the original draft PR #21894 (kept
around as documentation), rebased on top of the four preparatory PRs:

  P1: Remove AstNode.getAFlowNode() and rewrite callers (#21919).
  P2: Qualify Flow.qll's AST references with Py:: prefix (#21920).
  P3: Add new shared-CFG-backed control flow graph (#21921).
  P4: Add new shared-SSA-backed SSA adapter (#21923).

The Python dataflow library (semmle/python/dataflow/new/) now imports
the new CFG facade and SSA adapter. All CFG-typed predicates
(ControlFlowNode, CallNode, BasicBlock, NameNode, AttrNode, ...) are
qualified with the Cfg:: prefix; SSA references switch from
EssaVariable/EssaDefinition to SsaImpl::Definition/SourceVariable.

GuardNode is redesigned to use the new CFG's outcome-node model
(isAfterTrue / isAfterFalse) instead of the legacy ConditionBlock +
flipped indirection. Only BarrierGuard<...> is preserved as public
API.

Framework files (Bottle, FastApi, Django, Tornado, Pyramid, Stdlib,
...) are updated to take CFG nodes from the new facade.

A handful of dataflow consistency tweaks for the new CFG:
- Augmented-assignment targets are treated as both load and store.
- 'from X import *' produces uncertain SSA writes for unknown names.
- CFG nodes are canonicalised so dataflow does not see equivalent
  pre/post-order pairs as distinct nodes.

Two AST tweaks for the new CFG:
- AstNodeImpl: omit PEP 695 type-parameter names from
  FunctionDefExpr / ClassDefExpr children.
- ImportResolution: drop the legacy essa import.

Test churn (~175 files): reblessed library- and query-test .expected
files reflect slightly different CFG granularity, different toString
output, and a handful of true alert deltas in security queries.

Verification: all 367 lib + src + consistency-queries compile clean.

Co-authored-by: Copilot <223556219+Copilot@users.noreply.github.com>
2026-06-18 15:17:35 +00:00

69 lines
6.4 KiB
Plaintext
Raw Blame History

edges
| xpathBad.py:9:7:9:13 | request | xpathBad.py:10:5:10:9 | value | provenance | AdditionalTaintStep |
| xpathBad.py:10:5:10:9 | value | xpathBad.py:13:20:13:43 | After BinaryExpr | provenance | |
| xpathFlow.py:2:26:2:32 | After ImportMember | xpathFlow.py:2:26:2:32 | request | provenance | |
| xpathFlow.py:2:26:2:32 | request | xpathFlow.py:11:18:11:24 | request | provenance | |
| xpathFlow.py:2:26:2:32 | request | xpathFlow.py:20:18:20:24 | request | provenance | |
| xpathFlow.py:2:26:2:32 | request | xpathFlow.py:30:18:30:24 | request | provenance | |
| xpathFlow.py:2:26:2:32 | request | xpathFlow.py:39:18:39:24 | request | provenance | |
| xpathFlow.py:2:26:2:32 | request | xpathFlow.py:47:18:47:24 | request | provenance | |
| xpathFlow.py:11:5:11:14 | xpathQuery | xpathFlow.py:14:20:14:29 | xpathQuery | provenance | |
| xpathFlow.py:11:18:11:24 | request | xpathFlow.py:11:18:11:29 | After Attribute | provenance | AdditionalTaintStep |
| xpathFlow.py:11:18:11:29 | After Attribute | xpathFlow.py:11:18:11:44 | After Attribute() | provenance | dict.get |
| xpathFlow.py:11:18:11:44 | After Attribute() | xpathFlow.py:11:5:11:14 | xpathQuery | provenance | |
| xpathFlow.py:20:5:20:14 | xpathQuery | xpathFlow.py:23:29:23:38 | xpathQuery | provenance | |
| xpathFlow.py:20:18:20:24 | request | xpathFlow.py:20:18:20:29 | After Attribute | provenance | AdditionalTaintStep |
| xpathFlow.py:20:18:20:29 | After Attribute | xpathFlow.py:20:18:20:44 | After Attribute() | provenance | dict.get |
| xpathFlow.py:20:18:20:44 | After Attribute() | xpathFlow.py:20:5:20:14 | xpathQuery | provenance | |
| xpathFlow.py:30:5:30:14 | xpathQuery | xpathFlow.py:32:29:32:38 | xpathQuery | provenance | |
| xpathFlow.py:30:18:30:24 | request | xpathFlow.py:30:18:30:29 | After Attribute | provenance | AdditionalTaintStep |
| xpathFlow.py:30:18:30:29 | After Attribute | xpathFlow.py:30:18:30:44 | After Attribute() | provenance | dict.get |
| xpathFlow.py:30:18:30:44 | After Attribute() | xpathFlow.py:30:5:30:14 | xpathQuery | provenance | |
| xpathFlow.py:39:5:39:14 | xpathQuery | xpathFlow.py:41:31:41:40 | xpathQuery | provenance | |
| xpathFlow.py:39:18:39:24 | request | xpathFlow.py:39:18:39:29 | After Attribute | provenance | AdditionalTaintStep |
| xpathFlow.py:39:18:39:29 | After Attribute | xpathFlow.py:39:18:39:44 | After Attribute() | provenance | dict.get |
| xpathFlow.py:39:18:39:44 | After Attribute() | xpathFlow.py:39:5:39:14 | xpathQuery | provenance | |
| xpathFlow.py:47:5:47:14 | xpathQuery | xpathFlow.py:49:29:49:38 | xpathQuery | provenance | |
| xpathFlow.py:47:18:47:24 | request | xpathFlow.py:47:18:47:29 | After Attribute | provenance | AdditionalTaintStep |
| xpathFlow.py:47:18:47:29 | After Attribute | xpathFlow.py:47:18:47:44 | After Attribute() | provenance | dict.get |
| xpathFlow.py:47:18:47:44 | After Attribute() | xpathFlow.py:47:5:47:14 | xpathQuery | provenance | |
nodes
| xpathBad.py:9:7:9:13 | request | semmle.label | request |
| xpathBad.py:10:5:10:9 | value | semmle.label | value |
| xpathBad.py:13:20:13:43 | After BinaryExpr | semmle.label | After BinaryExpr |
| xpathFlow.py:2:26:2:32 | After ImportMember | semmle.label | After ImportMember |
| xpathFlow.py:2:26:2:32 | request | semmle.label | request |
| xpathFlow.py:11:5:11:14 | xpathQuery | semmle.label | xpathQuery |
| xpathFlow.py:11:18:11:24 | request | semmle.label | request |
| xpathFlow.py:11:18:11:29 | After Attribute | semmle.label | After Attribute |
| xpathFlow.py:11:18:11:44 | After Attribute() | semmle.label | After Attribute() |
| xpathFlow.py:14:20:14:29 | xpathQuery | semmle.label | xpathQuery |
| xpathFlow.py:20:5:20:14 | xpathQuery | semmle.label | xpathQuery |
| xpathFlow.py:20:18:20:24 | request | semmle.label | request |
| xpathFlow.py:20:18:20:29 | After Attribute | semmle.label | After Attribute |
| xpathFlow.py:20:18:20:44 | After Attribute() | semmle.label | After Attribute() |
| xpathFlow.py:23:29:23:38 | xpathQuery | semmle.label | xpathQuery |
| xpathFlow.py:30:5:30:14 | xpathQuery | semmle.label | xpathQuery |
| xpathFlow.py:30:18:30:24 | request | semmle.label | request |
| xpathFlow.py:30:18:30:29 | After Attribute | semmle.label | After Attribute |
| xpathFlow.py:30:18:30:44 | After Attribute() | semmle.label | After Attribute() |
| xpathFlow.py:32:29:32:38 | xpathQuery | semmle.label | xpathQuery |
| xpathFlow.py:39:5:39:14 | xpathQuery | semmle.label | xpathQuery |
| xpathFlow.py:39:18:39:24 | request | semmle.label | request |
| xpathFlow.py:39:18:39:29 | After Attribute | semmle.label | After Attribute |
| xpathFlow.py:39:18:39:44 | After Attribute() | semmle.label | After Attribute() |
| xpathFlow.py:41:31:41:40 | xpathQuery | semmle.label | xpathQuery |
| xpathFlow.py:47:5:47:14 | xpathQuery | semmle.label | xpathQuery |
| xpathFlow.py:47:18:47:24 | request | semmle.label | request |
| xpathFlow.py:47:18:47:29 | After Attribute | semmle.label | After Attribute |
| xpathFlow.py:47:18:47:44 | After Attribute() | semmle.label | After Attribute() |
| xpathFlow.py:49:29:49:38 | xpathQuery | semmle.label | xpathQuery |
subpaths
#select
| xpathBad.py:13:20:13:43 | After BinaryExpr | xpathBad.py:9:7:9:13 | request | xpathBad.py:13:20:13:43 | After BinaryExpr | XPath expression depends on a $@. | xpathBad.py:9:7:9:13 | request | user-provided value |
| xpathFlow.py:14:20:14:29 | xpathQuery | xpathFlow.py:2:26:2:32 | After ImportMember | xpathFlow.py:14:20:14:29 | xpathQuery | XPath expression depends on a $@. | xpathFlow.py:2:26:2:32 | After ImportMember | user-provided value |
| xpathFlow.py:23:29:23:38 | xpathQuery | xpathFlow.py:2:26:2:32 | After ImportMember | xpathFlow.py:23:29:23:38 | xpathQuery | XPath expression depends on a $@. | xpathFlow.py:2:26:2:32 | After ImportMember | user-provided value |
| xpathFlow.py:32:29:32:38 | xpathQuery | xpathFlow.py:2:26:2:32 | After ImportMember | xpathFlow.py:32:29:32:38 | xpathQuery | XPath expression depends on a $@. | xpathFlow.py:2:26:2:32 | After ImportMember | user-provided value |
| xpathFlow.py:41:31:41:40 | xpathQuery | xpathFlow.py:2:26:2:32 | After ImportMember | xpathFlow.py:41:31:41:40 | xpathQuery | XPath expression depends on a $@. | xpathFlow.py:2:26:2:32 | After ImportMember | user-provided value |
| xpathFlow.py:49:29:49:38 | xpathQuery | xpathFlow.py:2:26:2:32 | After ImportMember | xpathFlow.py:49:29:49:38 | xpathQuery | XPath expression depends on a $@. | xpathFlow.py:2:26:2:32 | After ImportMember | user-provided value |
Reference in New Issue View Git Blame Copy Permalink