mirror of
https://github.com/github/codeql.git
synced 2026-05-27 17:41:24 +02:00
1a2be46cb5
Test-side changes accompanying the dataflow migration:
* Test queries (.ql) and shared test harness (TestSummaries,
TestTaintLib) qualify CFG / SSA types with Cfg:: / SsaImpl::,
bridge via AST (Name, Call, ...) instead of legacy NameNode /
CallNode, and switch GlobalSsaVariable / EssaVariable usages
to the new adapter API.
* .expected files updated for legitimate precision and toString
changes:
- phi-node def-use edges newly exposed in def_use_counts.
- scope-exit synthetic use surfaces one extra implicit use
in use-use-counts.
- For [empty]/[non-empty] outcome rows added in
EnclosingCallable.
- SsaSourceVariable / Global Variable label cosmetics
normalised throughout.
* Inline annotations:
- typetracking/test.py: removed MISSING:tracked on lines
93/95 (now found), added SPURIOUS:tracked on line 108
(decorator over-reach).
- global-flow/test.py: added SPURIOUS writes=g_mod on line
20 (correctly reports immediately-overwritten write).
- tainttracking/customSanitizer/test.py: marked
try/except: ensure_tainted(s) cases as MISSING: tainted
(no-raise CFG abstraction does not connect try body to
except body).
- coverage/test.py: marked
SINK(return_from_inner_scope([])) as
MISSING: flow=... pending closer investigation.
* regression/{dataflow,custom_dataflow}.expected: accept two
if/else cond-correlation over-reaches (documented limitation;
same imprecision applies under legacy semantics by design).
After this change the dataflow library-tests stand at 62 of 64
passing; the two remaining failures are tracked under the
ImportStarRefinement workstream.
Co-authored-by: Copilot <223556219+Copilot@users.noreply.github.com>
30 lines
949 B
Plaintext
30 lines
949 B
Plaintext
/**
|
|
* This query is meant to catch the flows from `CUSTOM_SOURCE` to `CUSTOM_SINK`.
|
|
*
|
|
* This should be compared to
|
|
* python/ql/test/library-tests/taint/dataflow/Dataflow.ql
|
|
* A first goal is to have identical results; after that we
|
|
* hope to remove the false positive.
|
|
*/
|
|
|
|
import python
|
|
private import semmle.python.controlflow.internal.Cfg as Cfg
|
|
import semmle.python.dataflow.new.DataFlow
|
|
|
|
module CustomTestConfig implements DataFlow::ConfigSig {
|
|
predicate isSource(DataFlow::Node node) { node.asCfgNode().(Cfg::NameNode).getId() = "CUSTOM_SOURCE" }
|
|
|
|
predicate isSink(DataFlow::Node node) {
|
|
exists(Cfg::CallNode call |
|
|
call.getFunction().(Cfg::NameNode).getId() in ["CUSTOM_SINK", "CUSTOM_SINK_F"] and
|
|
node.asCfgNode() = call.getAnArg()
|
|
)
|
|
}
|
|
}
|
|
|
|
module CustomTestFlow = DataFlow::Global<CustomTestConfig>;
|
|
|
|
from DataFlow::Node source, DataFlow::Node sink
|
|
where CustomTestFlow::flow(source, sink)
|
|
select source, sink
|