mirror of
https://github.com/github/codeql.git
synced 2026-05-30 02:51:24 +02:00
1a2be46cb5
Test-side changes accompanying the dataflow migration:
* Test queries (.ql) and shared test harness (TestSummaries,
TestTaintLib) qualify CFG / SSA types with Cfg:: / SsaImpl::,
bridge via AST (Name, Call, ...) instead of legacy NameNode /
CallNode, and switch GlobalSsaVariable / EssaVariable usages
to the new adapter API.
* .expected files updated for legitimate precision and toString
changes:
- phi-node def-use edges newly exposed in def_use_counts.
- scope-exit synthetic use surfaces one extra implicit use
in use-use-counts.
- For [empty]/[non-empty] outcome rows added in
EnclosingCallable.
- SsaSourceVariable / Global Variable label cosmetics
normalised throughout.
* Inline annotations:
- typetracking/test.py: removed MISSING:tracked on lines
93/95 (now found), added SPURIOUS:tracked on line 108
(decorator over-reach).
- global-flow/test.py: added SPURIOUS writes=g_mod on line
20 (correctly reports immediately-overwritten write).
- tainttracking/customSanitizer/test.py: marked
try/except: ensure_tainted(s) cases as MISSING: tainted
(no-raise CFG abstraction does not connect try body to
except body).
- coverage/test.py: marked
SINK(return_from_inner_scope([])) as
MISSING: flow=... pending closer investigation.
* regression/{dataflow,custom_dataflow}.expected: accept two
if/else cond-correlation over-reaches (documented limitation;
same imprecision applies under legacy semantics by design).
After this change the dataflow library-tests stand at 62 of 64
passing; the two remaining failures are tracked under the
ImportStarRefinement workstream.
Co-authored-by: Copilot <223556219+Copilot@users.noreply.github.com>
24 lines
757 B
Plaintext
24 lines
757 B
Plaintext
import python
|
|
private import semmle.python.controlflow.internal.Cfg as Cfg
|
|
import semmle.python.dataflow.new.TaintTracking
|
|
import semmle.python.dataflow.new.DataFlow
|
|
|
|
module TestTaintTrackingConfig implements DataFlow::ConfigSig {
|
|
predicate isSource(DataFlow::Node source) {
|
|
source.(DataFlow::CfgNode).getNode().(Cfg::NameNode).getId() = "SOURCE"
|
|
}
|
|
|
|
predicate isSink(DataFlow::Node sink) {
|
|
exists(Cfg::CallNode call |
|
|
call.getFunction().(Cfg::NameNode).getId() = "SINK" and
|
|
sink.(DataFlow::CfgNode).getNode() = call.getAnArg()
|
|
)
|
|
}
|
|
}
|
|
|
|
module TestTaintTrackingFlow = DataFlow::Global<TestTaintTrackingConfig>;
|
|
|
|
from DataFlow::Node source, DataFlow::Node sink
|
|
where TestTaintTrackingFlow::flow(source, sink)
|
|
select source, sink
|