mirror of
https://github.com/github/codeql.git
synced 2026-05-28 18:11:25 +02:00
7bb9aebe97
Library-test compile fixes after the shared-CFG migration: - PointsTo/global, PointsTo/local: use `f.getNode() = s.getValue()` instead of `s.getValue().getAFlowNode() = f` (the new CFG does not surface getAFlowNode on AST nodes). - PointsTo/new/ImpliesDataflow: bridge new Cfg::ControlFlowNode to the legacy ControlFlowNodeWithPointsTo via AST identity. - frameworks/aiohttp + frameworks/modeling-example: qualify CallNode / NameNode / AttrNode casts with Cfg:: now that those names live in the new CFG facade. Rebless 4 expected files for toString-only differences (renamed CFG positions like 'CFG node for foo' vs 'foo' — no semantic change): ImpliesDataflow, EnclosingCallable, NaiveModel, ProperModel. Co-authored-by: Copilot <223556219+Copilot@users.noreply.github.com>
38 lines
1.2 KiB
Plaintext
38 lines
1.2 KiB
Plaintext
private import python
|
|
private import semmle.python.controlflow.internal.Cfg as Cfg
|
|
private import semmle.python.dataflow.new.DataFlow
|
|
private import semmle.python.dataflow.new.TaintTracking
|
|
|
|
// Helpers modeling MyClass
|
|
/** A data-flow Node representing an instance of MyClass. */
|
|
abstract class MyClass extends DataFlow::Node { }
|
|
|
|
private DataFlow::TypeTrackingNode myClassGetValue(MyClass qualifier, DataFlow::TypeTracker t) {
|
|
t.startInAttr("get_value") and
|
|
result = qualifier
|
|
or
|
|
exists(DataFlow::TypeTracker t2 | result = myClassGetValue(qualifier, t2).track(t2, t))
|
|
}
|
|
|
|
DataFlow::Node myClassGetValue(MyClass qualifier) {
|
|
myClassGetValue(qualifier, DataFlow::TypeTracker::end()).flowsTo(result)
|
|
}
|
|
|
|
// Config
|
|
class SourceCall extends DataFlow::Node, MyClass {
|
|
SourceCall() { this.asCfgNode().(Cfg::CallNode).getFunction().(Cfg::NameNode).getId() = "source" }
|
|
}
|
|
|
|
private module SharedConfig implements DataFlow::ConfigSig {
|
|
predicate isSource(DataFlow::Node source) { source instanceof SourceCall }
|
|
|
|
predicate isSink(DataFlow::Node sink) {
|
|
exists(Cfg::CallNode call |
|
|
call.getFunction().(Cfg::NameNode).getId() = "sink" and
|
|
call.getArg(0) = sink.asCfgNode()
|
|
)
|
|
}
|
|
}
|
|
|
|
module SharedFlow = TaintTracking::Global<SharedConfig>;
|