Skip to content

Commit caf73e4

Browse files
RasmusWLRasmusWL
committed
Python: Wrap all Stdlib modeling consistently
Some of these predicates had fallen outside the `private module Stdlib`
1 parent aa4345a commit caf73e4

File tree

1 file changed

+136
-136
lines changed

1 file changed

+136
-136
lines changed

‎python/ql/src/semmle/python/frameworks/Stdlib.qll‎

Lines changed: 136 additions & 136 deletions
Original file line numberDiff line numberDiff line change
@@ -728,165 +728,165 @@ private module Stdlib {
728728
)
729729
}
730730
}
731-
}
732731

733-
/**
734-
* An exec statement (only Python 2).
735-
* Se ehttps://docs.python.org/2/reference/simple_stmts.html#the-exec-statement.
736-
*/
737-
private class ExecStatement extends CodeExecution::Range {
738-
ExecStatement() {
739-
// since there are no DataFlow::Nodes for a Statement, we can't do anything like
740-
// `this = any(Exec exec)`
741-
this.asExpr() = any(Exec exec).getBody()
742-
}
732+
/**
733+
* An exec statement (only Python 2).
734+
* Se ehttps://docs.python.org/2/reference/simple_stmts.html#the-exec-statement.
735+
*/
736+
private class ExecStatement extends CodeExecution::Range {
737+
ExecStatement() {
738+
// since there are no DataFlow::Nodes for a Statement, we can't do anything like
739+
// `this = any(Exec exec)`
740+
this.asExpr() = any(Exec exec).getBody()
741+
}
743742

744-
override DataFlow::Node getCode() { result = this }
745-
}
743+
override DataFlow::Node getCode() { result = this }
744+
}
746745

747-
/**
748-
* A call to the builtin `open` function.
749-
* See https://docs.python.org/3/library/functions.html#open
750-
*/
751-
private class OpenCall extends FileSystemAccess::Range, DataFlow::CfgNode {
752-
override CallNode node;
746+
/**
747+
* A call to the builtin `open` function.
748+
* See https://docs.python.org/3/library/functions.html#open
749+
*/
750+
private class OpenCall extends FileSystemAccess::Range, DataFlow::CfgNode {
751+
override CallNode node;
753752

754-
OpenCall() { node.getFunction().(NameNode).getId() = "open" }
753+
OpenCall() { node.getFunction().(NameNode).getId() = "open" }
755754

756-
override DataFlow::Node getAPathArgument() {
757-
result.asCfgNode() in [node.getArg(0), node.getArgByName("file")]
755+
override DataFlow::Node getAPathArgument() {
756+
result.asCfgNode() in [node.getArg(0), node.getArgByName("file")]
757+
}
758758
}
759-
}
760759

761-
// ---------------------------------------------------------------------------
762-
// base64
763-
// ---------------------------------------------------------------------------
764-
/** Gets a reference to the `base64` module. */
765-
private DataFlow::Node base64(DataFlow::TypeTracker t) {
766-
t.start() and
767-
result = DataFlow::importNode("base64")
768-
or
769-
exists(DataFlow::TypeTracker t2 | result = base64(t2).track(t2, t))
770-
}
760+
// ---------------------------------------------------------------------------
761+
// base64
762+
// ---------------------------------------------------------------------------
763+
/** Gets a reference to the `base64` module. */
764+
private DataFlow::Node base64(DataFlow::TypeTracker t) {
765+
t.start() and
766+
result = DataFlow::importNode("base64")
767+
or
768+
exists(DataFlow::TypeTracker t2 | result = base64(t2).track(t2, t))
769+
}
771770

772-
/** Gets a reference to the `base64` module. */
773-
DataFlow::Node base64() { result = base64(DataFlow::TypeTracker::end()) }
771+
/** Gets a reference to the `base64` module. */
772+
DataFlow::Node base64() { result = base64(DataFlow::TypeTracker::end()) }
774773

775-
/**
776-
* Gets a reference to the attribute `attr_name` of the `base64` module.
777-
* WARNING: Only holds for a few predefined attributes.
778-
*/
779-
private DataFlow::Node base64_attr(DataFlow::TypeTracker t, string attr_name) {
780-
attr_name in [
781-
"b64encode", "b64decode", "standard_b64encode", "standard_b64decode", "urlsafe_b64encode",
782-
"urlsafe_b64decode", "b32encode", "b32decode", "b16encode", "b16decode", "encodestring",
783-
"decodestring", "a85encode", "a85decode", "b85encode", "b85decode", "encodebytes",
784-
"decodebytes"
785-
] and
786-
(
787-
t.start() and
788-
result = DataFlow::importNode("base64" + "." + attr_name)
774+
/**
775+
* Gets a reference to the attribute `attr_name` of the `base64` module.
776+
* WARNING: Only holds for a few predefined attributes.
777+
*/
778+
private DataFlow::Node base64_attr(DataFlow::TypeTracker t, string attr_name) {
779+
attr_name in [
780+
"b64encode", "b64decode", "standard_b64encode", "standard_b64decode", "urlsafe_b64encode",
781+
"urlsafe_b64decode", "b32encode", "b32decode", "b16encode", "b16decode", "encodestring",
782+
"decodestring", "a85encode", "a85decode", "b85encode", "b85decode", "encodebytes",
783+
"decodebytes"
784+
] and
785+
(
786+
t.start() and
787+
result = DataFlow::importNode("base64" + "." + attr_name)
788+
or
789+
t.startInAttr(attr_name) and
790+
result = base64()
791+
)
789792
or
790-
t.startInAttr(attr_name) and
791-
result = base64()
792-
)
793-
or
794-
// Due to bad performance when using normal setup with `base64_attr(t2, attr_name).track(t2, t)`
795-
// we have inlined that code and forced a join
796-
exists(DataFlow::TypeTracker t2 |
797-
exists(DataFlow::StepSummary summary |
798-
base64_attr_first_join(t2, attr_name, result, summary) and
799-
t = t2.append(summary)
793+
// Due to bad performance when using normal setup with `base64_attr(t2, attr_name).track(t2, t)`
794+
// we have inlined that code and forced a join
795+
exists(DataFlow::TypeTracker t2 |
796+
exists(DataFlow::StepSummary summary |
797+
base64_attr_first_join(t2, attr_name, result, summary) and
798+
t = t2.append(summary)
799+
)
800800
)
801-
)
802-
}
803-
804-
pragma[nomagic]
805-
private predicate base64_attr_first_join(
806-
DataFlow::TypeTracker t2, string attr_name, DataFlow::Node res, DataFlow::StepSummary summary
807-
) {
808-
DataFlow::StepSummary::step(base64_attr(t2, attr_name), res, summary)
809-
}
801+
}
810802

811-
/**
812-
* Gets a reference to the attribute `attr_name` of the `base64` module.
813-
* WARNING: Only holds for a few predefined attributes.
814-
*/
815-
private DataFlow::Node base64_attr(string attr_name) {
816-
result = base64_attr(DataFlow::TypeTracker::end(), attr_name)
817-
}
803+
pragma[nomagic]
804+
private predicate base64_attr_first_join(
805+
DataFlow::TypeTracker t2, string attr_name, DataFlow::Node res, DataFlow::StepSummary summary
806+
) {
807+
DataFlow::StepSummary::step(base64_attr(t2, attr_name), res, summary)
808+
}
818809

819-
/** A call to any of the encode functions in the `base64` module. */
820-
private class Base64EncodeCall extends Encoding::Range, DataFlow::CfgNode {
821-
override CallNode node;
822-
823-
Base64EncodeCall() {
824-
exists(string name |
825-
name in [
826-
"b64encode", "standard_b64encode", "urlsafe_b64encode", "b32encode", "b16encode",
827-
"encodestring", "a85encode", "b85encode", "encodebytes"
828-
] and
829-
node.getFunction() = base64_attr(name).asCfgNode()
830-
)
810+
/**
811+
* Gets a reference to the attribute `attr_name` of the `base64` module.
812+
* WARNING: Only holds for a few predefined attributes.
813+
*/
814+
private DataFlow::Node base64_attr(string attr_name) {
815+
result = base64_attr(DataFlow::TypeTracker::end(), attr_name)
831816
}
832817

833-
override DataFlow::Node getAnInput() { result.asCfgNode() = node.getArg(0) }
818+
/** A call to any of the encode functions in the `base64` module. */
819+
private class Base64EncodeCall extends Encoding::Range, DataFlow::CfgNode {
820+
override CallNode node;
834821

835-
override DataFlow::Node getOutput() { result = this }
822+
Base64EncodeCall() {
823+
exists(string name |
824+
name in [
825+
"b64encode", "standard_b64encode", "urlsafe_b64encode", "b32encode", "b16encode",
826+
"encodestring", "a85encode", "b85encode", "encodebytes"
827+
] and
828+
node.getFunction() = base64_attr(name).asCfgNode()
829+
)
830+
}
836831

837-
override string getFormat() {
838-
exists(string name | node.getFunction() = base64_attr(name).asCfgNode() |
839-
name in [
840-
"b64encode", "standard_b64encode", "urlsafe_b64encode", "encodestring", "encodebytes"
841-
] and
842-
result = "Base64"
843-
or
844-
name = "b32encode" and result = "Base32"
845-
or
846-
name = "b16encode" and result = "Base16"
847-
or
848-
name = "a85encode" and result = "Ascii85"
849-
or
850-
name = "b85encode" and result = "Base85"
851-
)
852-
}
853-
}
832+
override DataFlow::Node getAnInput() { result.asCfgNode() = node.getArg(0) }
854833

855-
/** A call to any of the decode functions in the `base64` module. */
856-
private class Base64DecodeCall extends Decoding::Range, DataFlow::CfgNode {
857-
override CallNode node;
858-
859-
Base64DecodeCall() {
860-
exists(string name |
861-
name in [
862-
"b64decode", "standard_b64decode", "urlsafe_b64decode", "b32decode", "b16decode",
863-
"decodestring", "a85decode", "b85decode", "decodebytes"
864-
] and
865-
node.getFunction() = base64_attr(name).asCfgNode()
866-
)
834+
override DataFlow::Node getOutput() { result = this }
835+
836+
override string getFormat() {
837+
exists(string name | node.getFunction() = base64_attr(name).asCfgNode() |
838+
name in [
839+
"b64encode", "standard_b64encode", "urlsafe_b64encode", "encodestring", "encodebytes"
840+
] and
841+
result = "Base64"
842+
or
843+
name = "b32encode" and result = "Base32"
844+
or
845+
name = "b16encode" and result = "Base16"
846+
or
847+
name = "a85encode" and result = "Ascii85"
848+
or
849+
name = "b85encode" and result = "Base85"
850+
)
851+
}
867852
}
868853

869-
override predicate mayExecuteInput() { none() }
854+
/** A call to any of the decode functions in the `base64` module. */
855+
private class Base64DecodeCall extends Decoding::Range, DataFlow::CfgNode {
856+
override CallNode node;
870857

871-
override DataFlow::Node getAnInput() { result.asCfgNode() = node.getArg(0) }
858+
Base64DecodeCall() {
859+
exists(string name |
860+
name in [
861+
"b64decode", "standard_b64decode", "urlsafe_b64decode", "b32decode", "b16decode",
862+
"decodestring", "a85decode", "b85decode", "decodebytes"
863+
] and
864+
node.getFunction() = base64_attr(name).asCfgNode()
865+
)
866+
}
872867

873-
override DataFlow::Node getOutput() { result = this }
868+
override predicate mayExecuteInput() { none() }
874869

875-
override string getFormat() {
876-
exists(string name | node.getFunction() = base64_attr(name).asCfgNode() |
877-
name in [
878-
"b64decode", "standard_b64decode", "urlsafe_b64decode", "decodestring", "decodebytes"
879-
] and
880-
result = "Base64"
881-
or
882-
name = "b32decode" and result = "Base32"
883-
or
884-
name = "b16decode" and result = "Base16"
885-
or
886-
name = "a85decode" and result = "Ascii85"
887-
or
888-
name = "b85decode" and result = "Base85"
889-
)
870+
override DataFlow::Node getAnInput() { result.asCfgNode() = node.getArg(0) }
871+
872+
override DataFlow::Node getOutput() { result = this }
873+
874+
override string getFormat() {
875+
exists(string name | node.getFunction() = base64_attr(name).asCfgNode() |
876+
name in [
877+
"b64decode", "standard_b64decode", "urlsafe_b64decode", "decodestring", "decodebytes"
878+
] and
879+
result = "Base64"
880+
or
881+
name = "b32decode" and result = "Base32"
882+
or
883+
name = "b16decode" and result = "Base16"
884+
or
885+
name = "a85decode" and result = "Ascii85"
886+
or
887+
name = "b85decode" and result = "Base85"
888+
)
889+
}
890890
}
891891
}
892892

0 commit comments

Comments
 (0)