@@ -339,27 +339,50 @@ abstract class ArgumentNode extends Node {
339339 final ExtractedDataFlowCall getCall ( ) { this .argumentOf ( result , _) }
340340}
341341
342+ /** Gets an overapproximation of the argument nodes that are included in `getCallArg` */
343+ Node getCallArgApproximation ( ) {
344+ // pre-update nodes for calls
345+ result = any ( CallCfgNode c ) .( PostUpdateNode ) .getPreUpdateNode ( )
346+ or
347+ // self parameters in methods
348+ exists ( Class c | result .asExpr ( ) = c .getAMethod ( ) .getArg ( 0 ) )
349+ or
350+ // the object part of an attribute expression (which might be a bound method)
351+ result .asCfgNode ( ) = any ( AttrNode a ) .getObject ( )
352+ or
353+ // the function part of any call
354+ result .asCfgNode ( ) = any ( CallNode c ) .getFunction ( )
355+ }
356+
357+ private Node otherArgs ( ) {
358+ // for potential summaries we allow all normal call arguments
359+ normalCallArg ( _, result , _)
360+ or
361+ // and self arguments
362+ result .asCfgNode ( ) = any ( CallNode c ) .getFunction ( ) .( AttrNode ) .getObject ( )
363+ or
364+ // for comprehensions, we allow the synthetic `iterable` argument
365+ result .asExpr ( ) = any ( Comp c ) .getIterable ( )
366+ }
367+
342368/**
343369 * A data flow node that represents a call argument found in the source code.
344370 */
345371class ExtractedArgumentNode extends ArgumentNode {
346372 ExtractedArgumentNode ( ) {
347- // for resolved calls, we need to allow all argument nodes
348- getCallArg ( _, _, _, this , _)
349- or
350- // for potential summaries we allow all normal call arguments
351- normalCallArg ( _, this , _)
373+ this = getCallArgApproximation ( )
352374 or
353- // and self arguments
354- this .asCfgNode ( ) = any ( CallNode c ) .getFunction ( ) .( AttrNode ) .getObject ( )
355- or
356- // for comprehensions, we allow the synthetic `iterable` argument
357- this .asExpr ( ) = any ( Comp c ) .getIterable ( )
375+ this = otherArgs ( )
358376 }
359377
360378 final override predicate argumentOf ( DataFlowCall call , ArgumentPosition pos ) {
361379 this = call .getArgument ( pos ) and
362- call instanceof ExtractedDataFlowCall
380+ call instanceof ExtractedDataFlowCall and
381+ (
382+ this = otherArgs ( )
383+ or
384+ this = getCallArgApproximation ( ) and getCallArg ( _, _, _, this , _)
385+ )
363386 }
364387}
365388
0 commit comments