mirror of
https://github.com/github/codeql.git
synced 2026-05-27 01:21:23 +02:00
cccd207ae7
Option 2: eliminates the AST→CFG bridge from the AST layer. Previously
'AstNode.getAFlowNode()' returned a 'ControlFlowNode' from the legacy
'Flow.qll' CFG via 'py_flow_bb_node' — this hardcoded the AST to know
about the legacy CFG, preventing files from cleanly switching to the
new shared CFG.
Removes:
* 'AstNode.getAFlowNode()' from 'AstExtended.qll'
* Type-narrowing overrides on 'Attribute' / 'Subscript' / 'Call' /
'IfExp' / 'Name' / 'NameConstant' / 'ImportMember' (in Exprs.qll
and Import.qll)
Rewrites ~130 call sites across 'python/ql/lib/' and 'python/ql/src/'
to bridge from the CFG side instead:
Before: node = expr.getAFlowNode()
After: node.getNode() = expr
Before: expr.getAFlowNode().(DefinitionNode).getValue()
After: exists(DefinitionNode d | d.getNode() = expr | d.getValue())
Before: cn.operands(const.getAFlowNode(), op, x)
After: exists(ControlFlowNode c | c.getNode() = const | cn.operands(c, op, x))
This is semantically a no-op — both forms are duals of the same predicate.
Verified by passing all library tests:
* 64 dataflow tests
* 28 ControlFlow + dataflow-new-ssa tests
* 1 essa SSA-compute test
* 93 tests total in the focused suite
Once committed, files that want to switch from the legacy 'Flow' CFG
to the new 'Cfg' facade only need to change their imports — the
bridge sites are CFG-side and respect whichever ControlFlowNode is in
scope.
Co-authored-by: Copilot <223556219+Copilot@users.noreply.github.com>
70 lines
1.8 KiB
Plaintext
70 lines
1.8 KiB
Plaintext
/**
|
|
* @name Comparison using is when operands support `__eq__`
|
|
* @description Comparison using `is` when equivalence is not the same as identity
|
|
* @kind problem
|
|
* @tags quality
|
|
* reliability
|
|
* correctness
|
|
* @problem.severity warning
|
|
* @sub-severity low
|
|
* @precision high
|
|
* @id py/comparison-using-is
|
|
*/
|
|
|
|
import python
|
|
|
|
/** Holds if the comparison `comp` uses `is` or `is not` (represented as `op`) to compare its `left` and `right` arguments. */
|
|
predicate comparison_using_is(Compare comp, ControlFlowNode left, Cmpop op, ControlFlowNode right) {
|
|
exists(CompareNode fcomp | fcomp.getNode() = comp |
|
|
fcomp.operands(left, op, right) and
|
|
(op instanceof Is or op instanceof IsNot)
|
|
)
|
|
}
|
|
|
|
private predicate cpython_interned_value(Expr e) {
|
|
exists(string text | text = e.(StringLiteral).getText() |
|
|
text.length() = 0
|
|
or
|
|
text.length() = 1 and text.regexpMatch("[U+0000-U+00ff]")
|
|
)
|
|
or
|
|
exists(int i | i = e.(IntegerLiteral).getN().toInt() | -5 <= i and i <= 256)
|
|
or
|
|
exists(Tuple t | t = e and not exists(t.getAnElt()))
|
|
}
|
|
|
|
predicate uninterned_literal(Expr e) {
|
|
(
|
|
e instanceof StringLiteral
|
|
or
|
|
e instanceof IntegerLiteral
|
|
or
|
|
e instanceof FloatLiteral
|
|
or
|
|
e instanceof Dict
|
|
or
|
|
e instanceof List
|
|
or
|
|
e instanceof Tuple
|
|
) and
|
|
not cpython_interned_value(e)
|
|
}
|
|
|
|
from Compare comp, Cmpop op, string alt
|
|
where
|
|
exists(ControlFlowNode left, ControlFlowNode right |
|
|
comparison_using_is(comp, left, op, right) and
|
|
(
|
|
op instanceof Is and alt = "=="
|
|
or
|
|
op instanceof IsNot and alt = "!="
|
|
)
|
|
|
|
|
uninterned_literal(left.getNode())
|
|
or
|
|
uninterned_literal(right.getNode())
|
|
)
|
|
select comp,
|
|
"Values compared using '" + op.getSymbol() +
|
|
"' when equivalence is not the same as identity. Use '" + alt + "' instead."
|