mirror of
https://github.com/github/codeql.git
synced 2025-12-20 10:46:30 +01:00
4138296ec6
TL;DR: We were missing out on flow in the following situation: `mod1.py`: ```python foo = SOURCE ``` `mod2.py`: ```python from mod1 import * ``` `test.py`: ```python from mod2 import foo SINK(foo) ``` This is because there's no node at which a read of `foo` takes place within `test.py`, and so the added reads make no difference. Unfortunately, this means the previous test was a bit too simplistic, since it only looks for module variable reads and writes. Because of this, we change the test to be a more traditional "all flow" style (though restricted to `CfgNode`s).
20 lines
507 B
Plaintext
20 lines
507 B
Plaintext
import semmle.python.dataflow.new.DataFlow
|
|
|
|
/**
|
|
* A configuration to find all flows.
|
|
* To be used on tiny programs.
|
|
*/
|
|
class AllFlowsConfig extends DataFlow::Configuration {
|
|
AllFlowsConfig() { this = "AllFlowsConfig" }
|
|
|
|
override predicate isSource(DataFlow::Node node) { any() }
|
|
|
|
override predicate isSink(DataFlow::Node node) { any() }
|
|
}
|
|
|
|
from DataFlow::CfgNode source, DataFlow::CfgNode sink
|
|
where
|
|
source != sink and
|
|
exists(AllFlowsConfig cfg | cfg.hasFlow(source, sink))
|
|
select source, sink
|