Skip to content
New issue

Have a question about this project? Sign up for a free GitHub account to open an issue and contact its maintainers and the community.

Sign up for GitHub

By clicking “Sign up for GitHub”, you agree to our terms of service and privacy statement. We’ll occasionally send you account related emails.

Already on GitHub? Sign in to your account

Jump to bottom

Python: Allow type tracking through comprehensions #17653

Open
wants to merge 3 commits into
base: main
Choose a base branch
from
+14 −3
Open

Python: Allow type tracking through comprehensions #17653

Show file tree
Hide file tree
Changes from all commits
Commits
Show all changes
3 commits
Select commit Hold shift + click to select a range
0dc036a
Python: Allow type tracking through comprehensions
yoff Oct 3, 2024
9e808c1
Python: add change note
yoff Oct 3, 2024
6d486f9
Python: move change note to the right place
yoff Oct 3, 2024
File filter

Filter by extension

Filter by extension
Conversations
Failed to load comments.
Loading
Jump to
Jump to file
Failed to load files.
Loading
Diff view
Diff view
4 changes: 4 additions & 0 deletions python/ql/lib/change-notes/2024-10-03-typetracking-through-comprehensions.md
View file
Open in desktop
Original file line number Diff line number Diff line change
@@ -0,0 +1,4 @@
---
category: minorAnalysis
---
* Type tracking, and hence the API graph, is now able to correctly trace trough comprehensions.
7 changes: 7 additions & 0 deletions python/ql/lib/semmle/python/ApiGraphs.qll
View file
Open in desktop
Original file line number Diff line number Diff line change
Expand Up @@ -843,6 +843,13 @@ module API {
ref = pred.getSubscript(_) and
ref.asCfgNode().isLoad()
or
// Subscript via comprehension
lbl = Label::subscript() and
exists(PY::Comp comp |
pred.asExpr() = comp.getIterable() and
ref.asExpr() = comp.getNthInnerLoop(0).getTarget()
)
or
// Subclassing a node
lbl = Label::subclass() and
exists(PY::ClassExpr clsExpr, DataFlow::Node superclass | pred.flowsTo(superclass) |
Expand Down
2 changes: 1 addition & 1 deletion python/ql/lib/semmle/python/dataflow/new/internal/TypeTrackingImpl.qll
View file
Open in desktop
Original file line number Diff line number Diff line change
Expand Up @@ -304,7 +304,7 @@ module TypeTrackingInput implements Shared::TypeTrackingInput {
var.hasDefiningNode(def)
|
nodeTo.(DataFlowPublic::ScopeEntryDefinitionNode).getDefinition() = e and
nodeFrom.asCfgNode() = def.getValue() and
nodeFrom.asCfgNode() = def and
var.getScope().getScope*() = nodeFrom.getScope()
)
}
Expand Down
4 changes: 2 additions & 2 deletions python/ql/test/library-tests/frameworks/stdlib/http_server.py
View file
Open in desktop
Original file line number Diff line number Diff line change
Expand Up @@ -30,7 +30,7 @@ def test_cgi_FieldStorage_taint():
form['key'][0].value, # $ tainted
form['key'][0].file, # $ tainted
form['key'][0].filename, # $ tainted
[field.value for field in form['key']], # $ MISSING: tainted
[field.value for field in form['key']], # $ tainted

# `form.getvalue('key')` will be a list, if multiple fields named "key" are provided
form.getvalue('key'), # $ tainted
Expand All @@ -40,7 +40,7 @@ def test_cgi_FieldStorage_taint():

form.getlist('key'), # $ tainted
form.getlist('key')[0], # $ tainted
[field.value for field in form.getlist('key')], # $ MISSING: tainted
[field.value for field in form.getlist('key')], # $ tainted
)


Expand Down
Loading