Python: Clean up taint steps for attributes

Author: RasmusWL

python/ql/lib/semmle/python/dataflow/new/internal/TaintTrackingPrivate.qll

@@ -167,8 +167,25 @@ predicate stringManipulation(DataFlow::CfgNode nodeFrom, DataFlow::CfgNode nodeT
  */
 predicate containerStep(DataFlow::CfgNode nodeFrom, DataFlow::Node nodeTo) {
   // construction by literal
-  // TODO: Not limiting the content argument here feels like a BIG hack, but we currently get nothing for free :|
-  DataFlowPrivate::storeStep(nodeFrom, _, nodeTo)
+  //
+  // TODO: once we have proper flow-summary modeling, we might not need this step any
+  // longer -- but there needs to be a matching read-step for the store-step, and we
+  // don't provide that right now.
+  DataFlowPrivate::listStoreStep(nodeFrom, _, nodeTo)
+  or
+  DataFlowPrivate::setStoreStep(nodeFrom, _, nodeTo)
+  or
+  DataFlowPrivate::tupleStoreStep(nodeFrom, _, nodeTo)
+  or
+  DataFlowPrivate::dictStoreStep(nodeFrom, _, nodeTo)
+  or
+  // comprehension, so there is taint-flow from `x` in `[x for x in xs]` to the
+  // resulting list of the list-comprehension.
+  //
+  // TODO: once we have proper flow-summary modeling, we might not need this step any
+  // longer -- but there needs to be a matching read-step for the store-step, and we
+  // don't provide that right now.
+  DataFlowPrivate::comprehensionStoreStep(nodeFrom, _, nodeTo)
   or
   // constructor call
   exists(DataFlow::CallCfgNode call | call = nodeTo |

python/ql/test/experimental/dataflow/tainttracking/defaultAdditionalTaintStep/test_attr.py

@@ -25,7 +25,7 @@ def test_tainted_attr():
     # https://github.com/github/codeql/issues/7786
 
     f = Foo(TAINTED_STRING)
-    ensure_not_tainted(f) # $ SPURIOUS: tainted
+    ensure_not_tainted(f)
     ensure_tainted(f.arg) # $ tainted
     ensure_not_tainted(f.other_arg)
 
@@ -34,7 +34,7 @@ def test_tainted_attr():
     ensure_not_tainted(x, x.arg, x.other_arg)
 
     x.arg = TAINTED_STRING
-    ensure_not_tainted(x) # $ SPURIOUS: tainted
+    ensure_not_tainted(x)
     ensure_tainted(x.arg) # $ tainted
     ensure_not_tainted(f.other_arg)
 

python/ql/test/experimental/dataflow/tainttracking/defaultAdditionalTaintStep/test_with.py

@@ -49,7 +49,7 @@ def __exit__(self, exc_type, exc, tb):
 def test_with_arg():
     ctx = Context_arg(TAINTED_STRING)
     with ctx as tainted:
-        ensure_tainted(tainted) # $ tainted
+        ensure_tainted(tainted) # $ MISSING: tainted