mirror of
https://github.com/github/codeql.git
synced 2025-12-27 22:26:31 +01:00
f07a7bf8cf
Will need subsequent PRs fixing up test failures (due to deprecated methods moving around), but other than that everything should be straight-forward.
35 lines
1.2 KiB
Plaintext
35 lines
1.2 KiB
Plaintext
/**
|
|
* @name Membership test with a non-container
|
|
* @description A membership test, such as 'item in sequence', with a non-container on the right hand side will raise a 'TypeError'.
|
|
* @kind problem
|
|
* @tags reliability
|
|
* correctness
|
|
* @problem.severity error
|
|
* @sub-severity high
|
|
* @precision high
|
|
* @id py/member-test-non-container
|
|
*/
|
|
|
|
import python
|
|
import semmle.python.pointsto.PointsTo
|
|
|
|
predicate rhs_in_expr(ControlFlowNode rhs, Compare cmp) {
|
|
exists(Cmpop op, int i | cmp.getOp(i) = op and cmp.getComparator(i) = rhs.getNode() |
|
|
op instanceof In or op instanceof NotIn
|
|
)
|
|
}
|
|
|
|
from ControlFlowNode non_seq, Compare cmp, Value v, ClassValue cls, ControlFlowNode origin
|
|
where
|
|
rhs_in_expr(non_seq, cmp) and
|
|
non_seq.pointsTo(_, v, origin) and
|
|
v.getClass() = cls and
|
|
not Types::failedInference(cls, _) and
|
|
not cls.hasAttribute("__contains__") and
|
|
not cls.hasAttribute("__iter__") and
|
|
not cls.hasAttribute("__getitem__") and
|
|
not cls = ClassValue::nonetype() and
|
|
not cls = Value::named("types.MappingProxyType")
|
|
select cmp, "This test may raise an Exception as the $@ may be of non-container class $@.", origin,
|
|
"target", cls, cls.getName()
|