codeql/python/ql/src/Classes/MethodCallOrder.qll

import python

// Helper predicates for multiple call to __init__/__del__ queries.

pragma [noinline]
private predicate multiple_invocation_paths_helper(FunctionInvocation top, FunctionInvocation i1, FunctionInvocation i2, FunctionObject multi) {
    i1 != i2 and
    i1 = top.getACallee+() and
    i2 = top.getACallee+() and
    i1.getFunction() = multi
}

pragma [noinline]
private predicate multiple_invocation_paths(FunctionInvocation top, FunctionInvocation i1, FunctionInvocation i2, FunctionObject multi) {
    multiple_invocation_paths_helper(top, i1, i2, multi) and
    i2.getFunction() = multi
}

/** Holds if `self.name` calls `multi` by multiple paths, and thus calls it more than once. */
predicate multiple_calls_to_superclass_method(ClassObject self, FunctionObject multi, string name) {
    exists(FunctionInvocation top, FunctionInvocation i1, FunctionInvocation i2 |
        multiple_invocation_paths(top, i1, i2, multi) and
        top.runtime(self.declaredAttribute(name)) and
        self.getASuperType().declaredAttribute(name) = multi |
        /* Only called twice if called from different functions,
         * or if one call-site can reach the other */
        i1.getCall().getScope() != i2.getCall().getScope()
        or
        i1.getCall().strictlyReaches(i2.getCall())
    )
}

/** Holds if all attributes called `name` can be inferred to be methods. */
private predicate named_attributes_not_method(ClassObject cls, string name) {
    cls.declaresAttribute(name) and not cls.declaredAttribute(name) instanceof FunctionObject
}

/** Holds if `f` actually does something. */
private predicate does_something(FunctionObject f) {
    f.isBuiltin() and not f = theObjectType().lookupAttribute("__init__")
    or
    exists(Stmt s | s = f.getFunction().getAStmt() and not s instanceof Pass)
}

/** Holds if `meth` looks like it should have a call to `name`, but does not */
private predicate missing_call(FunctionObject meth, string name) {
    exists(CallNode call, AttrNode attr |
        call.getScope() = meth.getFunction() and
        call.getFunction() = attr and
        attr.getName() = name and
        not exists(FunctionObject f | f.getACall() = call)
    )
}

/** Holds if `self.name` does not call `missing`, even though it is expected to. */
predicate missing_call_to_superclass_method(ClassObject self, FunctionObject top, FunctionObject missing, string name) {
    missing = self.getASuperType().declaredAttribute(name) and
    top = self.lookupAttribute(name) and
    /* There is no call to missing originating from top */
    not top.getACallee*() = missing and
    /* Make sure that all named 'methods' are objects that we can understand. */
    not exists(ClassObject sup |
        sup = self.getAnImproperSuperType() and
        named_attributes_not_method(sup, name)
    ) and
    not self.isAbstract()
    and
    does_something(missing)
    and
    not missing_call(top, name)
}