Skip to content

Commit f5bc8b5

Browse files
taus-semmletaus-semmle
authored
Merge pull request #1728 from markshannon/python-points-to-support-type-checking
Python: Enhance points-to to support type-hint analysis.
2 parents 3fab514 + 902871b commit f5bc8b5

File tree

17 files changed

+189
-4
lines changed

17 files changed

+189
-4
lines changed

‎python/ql/src/semmle/python/objects/Classes.qll‎

Lines changed: 78 additions & 0 deletions
Original file line numberDiff line numberDiff line change
@@ -365,3 +365,81 @@ class DynamicallyCreatedClass extends ClassObjectInternal, TDynamicClass {
365365

366366
}
367367

368+
class SubscriptedTypeInternal extends ObjectInternal, TSubscriptedType {
369+
370+
ObjectInternal getGeneric() {
371+
this = TSubscriptedType(result, _)
372+
}
373+
374+
ObjectInternal getSpecializer() {
375+
this = TSubscriptedType(_, result)
376+
}
377+
378+
override string getName() { result = this.getGeneric().getName() }
379+
380+
override string toString() { result = this.getGeneric().toString() + "[" + this.getSpecializer().toString() + "]" }
381+
382+
override predicate introducedAt(ControlFlowNode node, PointsToContext context) {
383+
exists(ObjectInternal generic, ObjectInternal index |
384+
this = TSubscriptedType(generic, index) and
385+
Expressions::subscriptPartsPointsTo(node, context, generic, index)
386+
)
387+
}
388+
389+
/** Gets the class declaration for this object, if it is a class with a declaration. */
390+
override ClassDecl getClassDeclaration() {
391+
result = this.getGeneric().getClassDeclaration()
392+
}
393+
394+
/** True if this "object" is a class. That is, its class inherits from `type` */
395+
override boolean isClass() { result = true }
396+
397+
override ObjectInternal getClass() {
398+
result = this.getGeneric().getClass()
399+
}
400+
401+
override predicate notTestableForEquality() { none() }
402+
403+
override Builtin getBuiltin() { none() }
404+
405+
override ControlFlowNode getOrigin() { none() }
406+
407+
override predicate callResult(ObjectInternal obj, CfgOrigin origin) { none() }
408+
409+
override predicate callResult(PointsToContext callee, ObjectInternal obj, CfgOrigin origin) { none() }
410+
411+
override predicate calleeAndOffset(Function scope, int paramOffset){ none() }
412+
413+
override predicate attribute(string name, ObjectInternal value, CfgOrigin origin) { none() }
414+
415+
override predicate attributesUnknown() { none() }
416+
417+
override boolean isDescriptor() { result = false }
418+
419+
override predicate descriptorGetClass(ObjectInternal cls, ObjectInternal value, CfgOrigin origin) { none() }
420+
421+
override predicate descriptorGetInstance(ObjectInternal instance, ObjectInternal value, CfgOrigin origin) { none() }
422+
423+
override predicate binds(ObjectInternal instance, string name, ObjectInternal descriptor) { none() }
424+
425+
override int length() { none() }
426+
427+
override boolean booleanValue() { result = true }
428+
429+
override int intValue() { none()}
430+
431+
override string strValue() { none() }
432+
433+
override predicate subscriptUnknown() { none() }
434+
435+
override predicate contextSensitiveCallee() { none() }
436+
437+
override predicate useOriginAsLegacyObject() { none() }
438+
439+
/* Classes aren't usually iterable, but can e.g. Enums */
440+
override ObjectInternal getIterNext() { result = ObjectInternal::unknown() }
441+
442+
}
443+
444+
445+

‎python/ql/src/semmle/python/objects/Instances.qll‎

Lines changed: 8 additions & 1 deletion
Original file line numberDiff line numberDiff line change
@@ -91,7 +91,14 @@ class SpecificInstanceInternal extends TSpecificInstance, InstanceObject {
9191
override predicate notTestableForEquality() { none() }
9292

9393
override ObjectInternal getClass() {
94-
this = TSpecificInstance(_, result, _)
94+
exists(ClassObjectInternal cls, ClassDecl decl |
95+
this = TSpecificInstance(_, cls, _) and
96+
decl = cls.getClassDeclaration() |
97+
if decl.callReturnsInstance() then
98+
result = cls
99+
else
100+
result = TUnknownClass()
101+
)
95102
}
96103

97104
/** Gets the `Builtin` for this object, if any.

‎python/ql/src/semmle/python/objects/ObjectAPI.qll‎

Lines changed: 6 additions & 1 deletion
Original file line numberDiff line numberDiff line change
@@ -322,7 +322,7 @@ class ClassValue extends Value {
322322

323323
/** Gets an improper super type of this class. */
324324
ClassValue getASuperType() {
325-
result = Types::getMro(this).getAnItem()
325+
result = this.getABaseType*()
326326
}
327327

328328
/** Looks up the attribute `name` on this class.
@@ -367,6 +367,11 @@ class ClassValue extends Value {
367367
result = Types::getBase(this, n)
368368
}
369369

370+
/** Gets a base class of this class */
371+
ClassValue getABaseType() {
372+
result = Types::getBase(this, _)
373+
}
374+
370375
/** Holds if this class is a new style class.
371376
A new style class is one that implicitly or explicitly inherits from `object`. */
372377
predicate isNewStyle() {

‎python/ql/src/semmle/python/objects/ObjectInternal.qll‎

Lines changed: 2 additions & 0 deletions
Original file line numberDiff line numberDiff line change
@@ -557,6 +557,8 @@ class DecoratedFunction extends ObjectInternal, TDecoratedFunction {
557557

558558
override string toString() {
559559
result = "Decorated " + this.decoratedObject().toString()
560+
or
561+
not exists(this.decoratedObject()) and result = "Decorated function"
560562
}
561563

562564
override boolean booleanValue() { result = true }

‎python/ql/src/semmle/python/objects/Sequences.qll‎

Lines changed: 8 additions & 1 deletion
Original file line numberDiff line numberDiff line change
@@ -49,7 +49,14 @@ abstract class TupleObjectInternal extends SequenceObjectInternal {
4949
or
5050
n = 3 and this.length() > 3 and result = (this.length()-3).toString() + " more..."
5151
or
52-
result = this.getItem(n).toString() + ", " + this.contents(n+1)
52+
result = this.item(n) + ", " + this.contents(n+1)
53+
}
54+
55+
private string item(int n) {
56+
result = this.getItem(n).toString()
57+
or
58+
n in [0..this.length()-1] and
59+
not exists(this.getItem(n)) and result = "?"
5360
}
5461

5562
/** Gets the class declaration for this object, if it is a declared class. */

‎python/ql/src/semmle/python/objects/TObject.qll‎

Lines changed: 13 additions & 1 deletion
Original file line numberDiff line numberDiff line change
@@ -132,7 +132,7 @@ cached newtype TObject =
132132
/* An instance of `cls`, instantiated at `instantiation` given the `context`. */
133133
TSpecificInstance(ControlFlowNode instantiation, ClassObjectInternal cls, PointsToContext context) {
134134
PointsToInternal::pointsTo(instantiation.(CallNode).getFunction(), context, cls, _) and
135-
cls.isSpecial() = false and cls.getClassDeclaration().callReturnsInstance()
135+
cls.isSpecial() = false
136136
or
137137
literal_instantiation(instantiation, cls, context)
138138
}
@@ -236,6 +236,18 @@ cached newtype TObject =
236236
TDecoratedFunction(CallNode call) {
237237
call.isFunctionDecoratorCall()
238238
}
239+
or
240+
/* Represents a subscript operation applied to a type. For type-hint analysis */
241+
TSubscriptedType(ObjectInternal generic, ObjectInternal index) {
242+
isType(generic) and
243+
Expressions::subscriptPartsPointsTo(_, _, generic, index)
244+
}
245+
246+
predicate isType(ObjectInternal t) {
247+
t.isClass() = true
248+
or
249+
t.getOrigin().getEnclosingModule().getName().matches("%typing")
250+
}
239251

240252
private predicate is_power_2(int n) {
241253
n = 1 or

‎python/ql/src/semmle/python/pointsto/PointsTo.qll‎

Lines changed: 7 additions & 0 deletions
Original file line numberDiff line numberDiff line change
@@ -1229,6 +1229,13 @@ module Expressions {
12291229
origin = subscr
12301230
}
12311231

1232+
predicate subscriptPartsPointsTo(SubscriptNode subscr, PointsToContext context, ObjectInternal objvalue, ObjectInternal indexvalue) {
1233+
exists(ControlFlowNode index |
1234+
subscriptObjectAndIndex(subscr, context, _, objvalue, index) and
1235+
PointsToInternal::pointsTo(index, context, indexvalue, _)
1236+
)
1237+
}
1238+
12321239
pragma [noinline]
12331240
private predicate subscriptObjectAndIndex(SubscriptNode subscr, PointsToContext context, ControlFlowNode obj, ObjectInternal objvalue, ControlFlowNode index) {
12341241
subscr.isLoad() and

‎python/ql/test/3/library-tests/PointsTo/typehints/Values.expected‎

Lines changed: 12 additions & 0 deletions
Original file line numberDiff line numberDiff line change
@@ -0,0 +1,12 @@
1+
| test.py:1:6:1:11 | test.py:1 | ControlFlowNode for ImportExpr | import | ../../lib/typing.py:0:0:0:0 | Module typing |
2+
| test.py:1:6:1:11 | test.py:1 | ControlFlowNode for ImportExpr | import | ../../lib/typing.py:0:0:0:0 | Module typing |
3+
| test.py:1:20:1:27 | test.py:1 | ControlFlowNode for ImportMember | import | ../../lib/typing.py:18:12:18:32 | _Optional() |
4+
| test.py:1:30:1:32 | test.py:1 | ControlFlowNode for ImportMember | import | ../../lib/typing.py:23:1:23:23 | class Set |
5+
| test.py:3:1:3:32 | test.py:3 | ControlFlowNode for FunctionExpr | import | test.py:3:1:3:32 | Function foo |
6+
| test.py:3:11:3:18 | test.py:3 | ControlFlowNode for Optional | import | ../../lib/typing.py:18:12:18:32 | _Optional() |
7+
| test.py:3:11:3:23 | test.py:3 | ControlFlowNode for Subscript | import | file://:0:0:0:0 | _Optional()[builtin-class int] |
8+
| test.py:3:20:3:22 | test.py:3 | ControlFlowNode for int | import | file://:0:0:0:0 | builtin-class int |
9+
| test.py:3:29:3:31 | test.py:3 | ControlFlowNode for int | import | file://:0:0:0:0 | builtin-class int |
10+
| test.py:6:1:6:20 | test.py:6 | ControlFlowNode for FunctionExpr | import | test.py:6:1:6:20 | Function bar |
11+
| test.py:6:11:6:13 | test.py:6 | ControlFlowNode for set | import | file://:0:0:0:0 | builtin-class set |
12+
| test.py:6:17:6:19 | test.py:6 | ControlFlowNode for Set | import | ../../lib/typing.py:23:1:23:23 | class Set |

‎python/ql/test/3/library-tests/PointsTo/typehints/Values.ql‎

Lines changed: 8 additions & 0 deletions
Original file line numberDiff line numberDiff line change
@@ -0,0 +1,8 @@
1+
2+
import python
3+
4+
from ControlFlowNode f, Context ctx, Value v, ControlFlowNode origin
5+
where
6+
f.pointsTo(ctx, v, origin) and
7+
f.getLocation().getFile().getBaseName() = "test.py"
8+
select f.getLocation(), f.toString(), ctx, v

‎python/ql/test/3/library-tests/PointsTo/typehints/options‎

Lines changed: 2 additions & 0 deletions
Original file line numberDiff line numberDiff line change
@@ -0,0 +1,2 @@
1+
semmle-extractor-options: -p ../../lib/ --max-import-depth=3
2+
optimize: true

0 commit comments

Comments
 (0)