mirror of
https://github.com/github/codeql.git
synced 2026-05-27 17:41:24 +02:00
f5bf8ae8dd
In the legacy CFG the same Python 'Name' that is the target of an
augmented assignment has two distinct CFG nodes — a load node (context
3) earlier in the basic block and a store node (context 5) later.
'augstore(load, store)' relates the pair via dominance.
The new (shared) CFG canonicalises each AST expression to a single
CFG node, so 'load' and 'store' collapse to one. The dominance-based
'augstore' from the legacy implementation no longer holds (it would
require 'load.strictlyDominates(load)'), so 'isAugLoad' / 'isAugStore'
never fired and 'isStore' missed the AugAssign target entirely.
Redefines 'augstore' as reflexive on the AugAssign target's canonical
CFG node. With this change:
* isAugLoad / isAugStore both fire on the single canonical node.
* isStore fires (via 'or augstore(_, this)') — matching the legacy
classification that an augmented-assignment target is a store.
* isLoad does not fire (excluded by 'not augstore(_, this)').
Adds 'python/ql/test/library-tests/ControlFlow/store-load/' covering
plain load/store/delete, parameters, augmented assignment, tuple
unpacking, attribute and subscript stores. The test asserts the
classification directly on the new-CFG facade.
Co-authored-by: Copilot <223556219+Copilot@users.noreply.github.com>
57 lines
1.6 KiB
Python
57 lines
1.6 KiB
Python
# Store/load/delete/parameter classification on the new-CFG facade.
|
|
#
|
|
# Each annotated location carries the (sorted, deduplicated) set of
|
|
# kinds the CFG facade reports there. Comparing against the legacy
|
|
# 'semmle.python.Flow' classification is done by the comparison query
|
|
# 'StoreLoadParity.ql' — annotations here are only the positive
|
|
# assertions for the new facade.
|
|
#
|
|
# Tags:
|
|
# load=<id> -- isLoad() fires on the Name
|
|
# store=<id> -- isStore() fires
|
|
# delete=<id> -- isDelete() fires
|
|
# param=<id> -- isParameter() fires
|
|
# augload=<id> -- isAugLoad() fires (the LHS of x += ... when read)
|
|
# augstore=<id> -- isAugStore() fires (the LHS of x += ... when written)
|
|
|
|
|
|
# --- plain load / store / delete ---
|
|
|
|
x = 1 # $ store=x
|
|
y = x + 1 # $ store=y load=x
|
|
print(y) # $ load=print load=y
|
|
del x # $ delete=x
|
|
|
|
|
|
# --- function definitions (parameters) ---
|
|
|
|
def f(a, b=2, *args, c, **kwargs): # $ store=f param=a param=b param=args param=c param=kwargs
|
|
return a + b + c # $ load=a load=b load=c
|
|
|
|
|
|
# --- augmented assignment splits one Name into load + store halves ---
|
|
|
|
def aug(): # $ store=aug
|
|
n = 0 # $ store=n
|
|
n += 1 # $ augload=n augstore=n
|
|
return n # $ load=n
|
|
|
|
|
|
# --- subscript / attribute stores ---
|
|
|
|
class C: # $ store=C
|
|
pass
|
|
|
|
|
|
def stores(obj, container, idx): # $ store=stores param=obj param=container param=idx
|
|
obj.attr = 1 # $ load=obj
|
|
container[idx] = 2 # $ load=container load=idx
|
|
return obj # $ load=obj
|
|
|
|
|
|
# --- tuple unpacking ---
|
|
|
|
def unpack(pair): # $ store=unpack param=pair
|
|
a, b = pair # $ store=a store=b load=pair
|
|
return a + b # $ load=a load=b
|