mirror of
https://github.com/github/codeql.git
synced 2025-12-18 18:10:39 +01:00
55d822cc56
Splits `ModuleVariableNode` away from `LocalSourceNode`, instead creating a class `TypeTrackingNode` that encapsulates both of these. This means we no longer have module variable nodes as part of `LocalSourceNode` (which is good, since they have no "local" aspect to them), and hence we can have `LocalSourceNode` inherit directly from `ExprNode` (which makes the API a bit nicer). Unfortunately these are breaking changes, so we can't actually fulfil the above two desiderata until the `track` and `backtrack` methods on `LocalSourceNode` have been fully deprecated. For this reason, we preserve the present implementation of `LocalSourceNode`, and instead lay the foundation for switching over in the future, by deprecating `track` and `backtrack` on `LocalSourceNode`.
37 lines
1.2 KiB
Plaintext
37 lines
1.2 KiB
Plaintext
private import python
|
|
private import semmle.python.dataflow.new.DataFlow
|
|
private import semmle.python.dataflow.new.TaintTracking
|
|
|
|
// Helpers modeling MyClass
|
|
/** A data-flow Node representing an instance of MyClass. */
|
|
abstract class MyClass extends DataFlow::Node { }
|
|
|
|
private DataFlow::TypeTrackingNode myClassGetValue(MyClass qualifier, DataFlow::TypeTracker t) {
|
|
t.startInAttr("get_value") and
|
|
result = qualifier
|
|
or
|
|
exists(DataFlow::TypeTracker t2 | result = myClassGetValue(qualifier, t2).track(t2, t))
|
|
}
|
|
|
|
DataFlow::Node myClassGetValue(MyClass qualifier) {
|
|
myClassGetValue(qualifier, DataFlow::TypeTracker::end()).flowsTo(result)
|
|
}
|
|
|
|
// Config
|
|
class SourceCall extends DataFlow::Node, MyClass {
|
|
SourceCall() { this.asCfgNode().(CallNode).getFunction().(NameNode).getId() = "source" }
|
|
}
|
|
|
|
class SharedConfig extends TaintTracking::Configuration {
|
|
SharedConfig() { this = "SharedConfig" }
|
|
|
|
override predicate isSource(DataFlow::Node source) { source instanceof SourceCall }
|
|
|
|
override predicate isSink(DataFlow::Node sink) {
|
|
exists(CallNode call |
|
|
call.getFunction().(NameNode).getId() = "sink" and
|
|
call.getArg(0) = sink.asCfgNode()
|
|
)
|
|
}
|
|
}
|