Skip to content

Commit 94190e7

Browse files
markshannonmarkshannon
committed
Python: Update py/modification-of-default-value to account for truthiness of default value.
1 parent ebd9bc3 commit 94190e7

File tree

3 files changed

+63
-36
lines changed

3 files changed

+63
-36
lines changed

‎python/ql/src/Functions/ModificationOfParameterWithDefault.ql‎

Lines changed: 38 additions & 19 deletions
Original file line numberDiff line numberDiff line change
@@ -19,40 +19,57 @@ predicate safe_method(string name) {
1919
name = "items" or name = "keys" or name = "values" or name = "iteritems" or name = "iterkeys" or name = "itervalues"
2020
}
2121

22-
predicate maybe_parameter(SsaVariable var, Function f, Parameter p) {
23-
p = var.getAnUltimateDefinition().getDefinition().getNode() and
24-
f.getAnArg() = p
22+
/** Gets the truthiness (non emptyness) of the default of `p` if that value is mutable */
23+
private boolean mutableDefaultValue(Parameter p) {
24+
exists(Dict d |
25+
p.getDefault() = d |
26+
exists(d.getAKey()) and result = true
27+
or
28+
not exists(d.getAKey()) and result = false
29+
)
30+
or
31+
exists(List l |
32+
p.getDefault() = l |
33+
exists(l.getAnElt()) and result = true
34+
or
35+
not exists(l.getAnElt()) and result = false
36+
)
2537
}
2638

27-
predicate has_mutable_default(Parameter p) {
28-
exists(SsaVariable v, FunctionExpr f | maybe_parameter(v, f.getInnerScope(), p) and
29-
exists(int i, int def_cnt, int arg_cnt |
30-
def_cnt = count(f.getArgs().getADefault()) and
31-
arg_cnt = count(f.getInnerScope().getAnArg()) and
32-
i in [1 .. arg_cnt] and
33-
(f.getArgs().getDefault(def_cnt - i) instanceof Dict or f.getArgs().getDefault(def_cnt - i) instanceof List) and
34-
f.getInnerScope().getArgName(arg_cnt - i) = v.getId()
35-
)
36-
)
39+
40+
class NonEmptyMutableValue extends TaintKind {
41+
NonEmptyMutableValue() {
42+
this = "non-empty mutable value"
43+
}
3744
}
3845

39-
class MutableValue extends TaintKind {
40-
MutableValue() {
41-
this = "mutable value"
46+
class EmptyMutableValue extends TaintKind {
47+
EmptyMutableValue() {
48+
this = "empty mutable value"
4249
}
50+
51+
override boolean booleanValue() {
52+
result = false
53+
}
54+
4355
}
4456

4557
class MutableDefaultValue extends TaintSource {
58+
59+
boolean nonEmpty;
60+
4661
MutableDefaultValue() {
47-
has_mutable_default(this.(NameNode).getNode())
62+
nonEmpty = mutableDefaultValue(this.(NameNode).getNode())
4863
}
4964

5065
override string toString() {
5166
result = "mutable default value"
5267
}
5368

5469
override predicate isSourceOf(TaintKind kind) {
55-
kind instanceof MutableValue
70+
nonEmpty = false and kind instanceof EmptyMutableValue
71+
or
72+
nonEmpty = true and kind instanceof NonEmptyMutableValue
5673
}
5774
}
5875

@@ -68,7 +85,9 @@ class Mutation extends TaintSink {
6885
}
6986

7087
override predicate sinks(TaintKind kind) {
71-
kind instanceof MutableValue
88+
kind instanceof EmptyMutableValue
89+
or
90+
kind instanceof NonEmptyMutableValue
7291
}
7392
}
7493

‎python/ql/test/query-tests/Functions/general/ModificationOfParameterWithDefault.expected‎

Lines changed: 19 additions & 17 deletions
Original file line numberDiff line numberDiff line change
@@ -1,20 +1,22 @@
11
edges
2-
| functions_test.py:36:9:36:9 | mutable value | functions_test.py:37:16:37:16 | mutable value |
3-
| functions_test.py:39:9:39:9 | mutable value | functions_test.py:40:5:40:5 | mutable value |
4-
| functions_test.py:238:15:238:15 | mutable value | functions_test.py:239:5:239:5 | mutable value |
5-
| functions_test.py:290:25:290:25 | mutable value | functions_test.py:291:5:291:5 | mutable value |
6-
| functions_test.py:293:21:293:21 | mutable value | functions_test.py:294:5:294:5 | mutable value |
7-
| functions_test.py:296:27:296:27 | mutable value | functions_test.py:297:25:297:25 | mutable value |
8-
| functions_test.py:296:27:296:27 | mutable value | functions_test.py:298:21:298:21 | mutable value |
9-
| functions_test.py:297:25:297:25 | mutable value | functions_test.py:290:25:290:25 | mutable value |
10-
| functions_test.py:298:21:298:21 | mutable value | functions_test.py:293:21:293:21 | mutable value |
2+
| functions_test.py:36:9:36:9 | empty mutable value | functions_test.py:37:16:37:16 | empty mutable value |
3+
| functions_test.py:39:9:39:9 | empty mutable value | functions_test.py:40:5:40:5 | empty mutable value |
4+
| functions_test.py:238:15:238:15 | empty mutable value | functions_test.py:239:5:239:5 | empty mutable value |
5+
| functions_test.py:290:25:290:25 | empty mutable value | functions_test.py:291:5:291:5 | empty mutable value |
6+
| functions_test.py:293:21:293:21 | empty mutable value | functions_test.py:294:5:294:5 | empty mutable value |
7+
| functions_test.py:296:27:296:27 | empty mutable value | functions_test.py:297:25:297:25 | empty mutable value |
8+
| functions_test.py:296:27:296:27 | empty mutable value | functions_test.py:298:21:298:21 | empty mutable value |
9+
| functions_test.py:297:25:297:25 | empty mutable value | functions_test.py:290:25:290:25 | empty mutable value |
10+
| functions_test.py:298:21:298:21 | empty mutable value | functions_test.py:293:21:293:21 | empty mutable value |
11+
| functions_test.py:300:26:300:26 | empty mutable value | functions_test.py:301:8:301:8 | empty mutable value |
12+
| functions_test.py:300:26:300:26 | empty mutable value | functions_test.py:303:12:303:12 | empty mutable value |
1113
parents
12-
| functions_test.py:290:25:290:25 | mutable value | functions_test.py:297:25:297:25 | mutable value |
13-
| functions_test.py:291:5:291:5 | mutable value | functions_test.py:297:25:297:25 | mutable value |
14-
| functions_test.py:293:21:293:21 | mutable value | functions_test.py:298:21:298:21 | mutable value |
15-
| functions_test.py:294:5:294:5 | mutable value | functions_test.py:298:21:298:21 | mutable value |
14+
| functions_test.py:290:25:290:25 | empty mutable value | functions_test.py:297:25:297:25 | empty mutable value |
15+
| functions_test.py:291:5:291:5 | empty mutable value | functions_test.py:297:25:297:25 | empty mutable value |
16+
| functions_test.py:293:21:293:21 | empty mutable value | functions_test.py:298:21:298:21 | empty mutable value |
17+
| functions_test.py:294:5:294:5 | empty mutable value | functions_test.py:298:21:298:21 | empty mutable value |
1618
#select
17-
| functions_test.py:40:5:40:5 | Taint sink | functions_test.py:39:9:39:9 | mutable value | functions_test.py:40:5:40:5 | mutable value | $@ flows to here and is mutated. | functions_test.py:39:9:39:9 | mutable default value | Default value |
18-
| functions_test.py:239:5:239:5 | Taint sink | functions_test.py:238:15:238:15 | mutable value | functions_test.py:239:5:239:5 | mutable value | $@ flows to here and is mutated. | functions_test.py:238:15:238:15 | mutable default value | Default value |
19-
| functions_test.py:291:5:291:5 | Taint sink | functions_test.py:296:27:296:27 | mutable value | functions_test.py:291:5:291:5 | mutable value | $@ flows to here and is mutated. | functions_test.py:296:27:296:27 | mutable default value | Default value |
20-
| functions_test.py:294:5:294:5 | Taint sink | functions_test.py:296:27:296:27 | mutable value | functions_test.py:294:5:294:5 | mutable value | $@ flows to here and is mutated. | functions_test.py:296:27:296:27 | mutable default value | Default value |
19+
| functions_test.py:40:5:40:5 | Taint sink | functions_test.py:39:9:39:9 | empty mutable value | functions_test.py:40:5:40:5 | empty mutable value | $@ flows to here and is mutated. | functions_test.py:39:9:39:9 | mutable default value | Default value |
20+
| functions_test.py:239:5:239:5 | Taint sink | functions_test.py:238:15:238:15 | empty mutable value | functions_test.py:239:5:239:5 | empty mutable value | $@ flows to here and is mutated. | functions_test.py:238:15:238:15 | mutable default value | Default value |
21+
| functions_test.py:291:5:291:5 | Taint sink | functions_test.py:296:27:296:27 | empty mutable value | functions_test.py:291:5:291:5 | empty mutable value | $@ flows to here and is mutated. | functions_test.py:296:27:296:27 | mutable default value | Default value |
22+
| functions_test.py:294:5:294:5 | Taint sink | functions_test.py:296:27:296:27 | empty mutable value | functions_test.py:294:5:294:5 | empty mutable value | $@ flows to here and is mutated. | functions_test.py:296:27:296:27 | mutable default value | Default value |

‎python/ql/test/query-tests/Functions/general/functions_test.py‎

Lines changed: 6 additions & 0 deletions
Original file line numberDiff line numberDiff line change
@@ -296,3 +296,9 @@ def mutate_argument(x):
296296
def indirect_modification(y = []):
297297
aug_assign_argument(y)
298298
mutate_argument(y)
299+
300+
def guarded_modification(z=[]):
301+
if z:
302+
z.append(0)
303+
return z
304+

0 commit comments

Comments
 (0)