yoff bf1220463c Python: unpin legacy CFG/ESSA from the AST cached stage ...

The legacy CFG (`Flow.qll`) and legacy ESSA (`Essa`/`SsaCompute`/
`SsaDefinitions`) were pinned into the always-on `Stages::AST` cached stage
via `Stages::AST::ref()` and the matching `backref()` disjuncts. Because a
cached stage is materialized as a unit once any of its predicates is demanded
(and every query demands e.g. `Expr.toString()`), this forced the legacy
CFG/ESSA to be computed for *every* query -- including the security/dataflow
queries, which after the shared-CFG dataflow flip no longer depend on the
legacy CFG at all.

Since `Stages::AST::ref()` is `1 = 1`, removing it is result-preserving; it
only changes stage scheduling. After this change the legacy CFG/ESSA is no
longer materialised for queries that do not genuinely reference it. Verified
on the full `python-security-extended` suite and on django: legacy CFG/ESSA
families materialised drop from ~165 to 0 with byte-identical results.

Co-authored-by: Copilot <223556219+Copilot@users.noreply.github.com>

2026-07-02 22:48:25 +00:00

..

consistency-queries

Python: switch dataflow library to new (shared) CFG + SSA

2026-07-02 08:59:20 +00:00

examples

Python: Fix example snippets

2025-11-26 12:30:30 +00:00

integration-tests/query-suite

python: Add query for prompt injection

2026-01-29 23:47:52 +01:00

lib

Python: unpin legacy CFG/ESSA from the AST cached stage

2026-07-02 22:48:25 +00:00

src

Python: switch dataflow library to new (shared) CFG + SSA

2026-07-02 08:59:20 +00:00

test

Python: switch dataflow library to new (shared) CFG + SSA

2026-07-02 08:59:20 +00:00