mirror of
https://github.com/github/codeql.git
synced 2026-05-28 18:11:25 +02:00
7bb9aebe97
Library-test compile fixes after the shared-CFG migration: - PointsTo/global, PointsTo/local: use `f.getNode() = s.getValue()` instead of `s.getValue().getAFlowNode() = f` (the new CFG does not surface getAFlowNode on AST nodes). - PointsTo/new/ImpliesDataflow: bridge new Cfg::ControlFlowNode to the legacy ControlFlowNodeWithPointsTo via AST identity. - frameworks/aiohttp + frameworks/modeling-example: qualify CallNode / NameNode / AttrNode casts with Cfg:: now that those names live in the new CFG facade. Rebless 4 expected files for toString-only differences (renamed CFG positions like 'CFG node for foo' vs 'foo' — no semantic change): ImpliesDataflow, EnclosingCallable, NaiveModel, ProperModel. Co-authored-by: Copilot <223556219+Copilot@users.noreply.github.com>
26 lines
862 B
Plaintext
26 lines
862 B
Plaintext
/**
|
|
* @kind path-problem
|
|
*/
|
|
|
|
private import python
|
|
private import semmle.python.controlflow.internal.Cfg as Cfg
|
|
private import semmle.python.dataflow.new.DataFlow
|
|
private import semmle.python.dataflow.new.TaintTracking
|
|
import SharedFlow::PathGraph
|
|
import SharedCode
|
|
|
|
class MyClassGetValueAdditionalTaintStep extends TaintTracking::AdditionalTaintStep {
|
|
override predicate step(DataFlow::Node nodeFrom, DataFlow::Node nodeTo) {
|
|
// obj -> obj.get_value()
|
|
exists(DataFlow::Node bound_method |
|
|
bound_method = myClassGetValue(nodeFrom) and
|
|
nodeTo.asCfgNode().(Cfg::CallNode).getFunction() = bound_method.asCfgNode()
|
|
)
|
|
}
|
|
}
|
|
|
|
from SharedFlow::PathNode source, SharedFlow::PathNode sink
|
|
where SharedFlow::flowPath(source, sink)
|
|
select sink.getNode(), source, sink,
|
|
"test flow (naive): " + source.getNode().asCfgNode().getScope().getName()
|