Skip to content

Commit e0437b6

Browse files
committed
Python: Make ExtractedArgumentNode local
Explicitly adds a bunch of nodes that were previously (using a global analysis) identified as `ExtractedArgumentNode`s.
1 parent b0e94e8 commit e0437b6

File tree

1 file changed

+34
-11
lines changed

1 file changed

+34
-11
lines changed

python/ql/lib/semmle/python/dataflow/new/internal/DataFlowPublic.qll

Lines changed: 34 additions & 11 deletions
Original file line numberDiff line numberDiff line change
@@ -339,27 +339,50 @@ abstract class ArgumentNode extends Node {
339339
final ExtractedDataFlowCall getCall() { this.argumentOf(result, _) }
340340
}
341341

342+
/** Gets an overapproximation of the argument nodes that are included in `getCallArg` */
343+
Node getCallArgApproximation() {
344+
// pre-update nodes for calls
345+
result = any(CallCfgNode c).(PostUpdateNode).getPreUpdateNode()
346+
or
347+
// self parameters in methods
348+
exists(Class c | result.asExpr() = c.getAMethod().getArg(0))
349+
or
350+
// the object part of an attribute expression (which might be a bound method)
351+
result.asCfgNode() = any(AttrNode a).getObject()
352+
or
353+
// the function part of any call
354+
result.asCfgNode() = any(CallNode c).getFunction()
355+
}
356+
357+
private Node otherArgs() {
358+
// for potential summaries we allow all normal call arguments
359+
normalCallArg(_, result, _)
360+
or
361+
// and self arguments
362+
result.asCfgNode() = any(CallNode c).getFunction().(AttrNode).getObject()
363+
or
364+
// for comprehensions, we allow the synthetic `iterable` argument
365+
result.asExpr() = any(Comp c).getIterable()
366+
}
367+
342368
/**
343369
* A data flow node that represents a call argument found in the source code.
344370
*/
345371
class ExtractedArgumentNode extends ArgumentNode {
346372
ExtractedArgumentNode() {
347-
// for resolved calls, we need to allow all argument nodes
348-
getCallArg(_, _, _, this, _)
349-
or
350-
// for potential summaries we allow all normal call arguments
351-
normalCallArg(_, this, _)
373+
this = getCallArgApproximation()
352374
or
353-
// and self arguments
354-
this.asCfgNode() = any(CallNode c).getFunction().(AttrNode).getObject()
355-
or
356-
// for comprehensions, we allow the synthetic `iterable` argument
357-
this.asExpr() = any(Comp c).getIterable()
375+
this = otherArgs()
358376
}
359377

360378
final override predicate argumentOf(DataFlowCall call, ArgumentPosition pos) {
361379
this = call.getArgument(pos) and
362-
call instanceof ExtractedDataFlowCall
380+
call instanceof ExtractedDataFlowCall and
381+
(
382+
this = otherArgs()
383+
or
384+
this = getCallArgApproximation() and getCallArg(_, _, _, this, _)
385+
)
363386
}
364387
}
365388

0 commit comments

Comments
 (0)