FilesExpand file tree

 main

/

UndefinedGlobal.ql

Copy path

Blame

More file actions

Blame

More file actions

Latest commit

 

History

History

History

121 lines (111 loc) · 4.04 KB

 main

/

UndefinedGlobal.ql

Copy path

Top

File metadata and controls

• Code
• Blame

121 lines (111 loc) · 4.04 KB

Raw

Copy raw file

Download raw file

Open symbols panel

Edit and raw actions

1

2

3

4

5

6

7

8

9

10

11

12

13

14

15

16

17

18

19

20

21

22

23

24

25

26

27

28

29

30

31

32

33

34

35

36

37

38

39

40

41

42

43

44

45

46

47

48

49

50

51

52

53

54

55

56

57

58

59

60

61

62

63

64

65

66

67

68

69

70

71

72

73

74

75

76

77

78

79

80

81

82

83

84

85

86

87

88

89

90

91

92

93

94

95

96

97

98

99

100

101

102

103

104

105

106

107

108

109

110

111

112

113

114

115

116

117

118

119

120

121

/**

* @name Use of an undefined global variable

* @description Using a global variable before it is initialized causes an exception.

* @kind problem

* @tags reliability

* correctness

* @problem.severity error

* @sub-severity low

* @precision low

* @id py/undefined-global-variable

*/

import python

import Variables.MonkeyPatched

import Loop

import semmle.python.pointsto.PointsTo

predicate guarded_against_name_error(Name u) {

exists(Try t | t.getBody().getAnItem().contains(u) |

t.getAHandler().getType().(Name).getId() = "NameError"

)

or

exists(ConditionBlock guard, BasicBlock controlled, Call globals |

guard.getLastNode().getNode().contains(globals) or

guard.getLastNode().getNode() = globals

|

globals.getFunc().(Name).getId() = "globals" and

guard.controls(controlled, _) and

controlled.contains(u.getAFlowNode())

)

}

predicate contains_unknown_import_star(Module m) {

exists(ImportStar imp | imp.getScope() = m |

exists(ModuleValue imported | imported.importedAs(imp.getImportedModuleName()) |

not imported.hasCompleteExportInfo()

)

)

}

predicate undefined_use_in_function(Name u) {

exists(Function f |

u.getScope().getScope*() = f and

// Either function is a method or inner function or it is live at the end of the module scope

(

not f.getScope() = u.getEnclosingModule() or

u.getEnclosingModule().(ImportTimeScope).definesName(f.getName())

) and

// There is a use, but not a definition of this global variable in the function or enclosing scope

exists(GlobalVariable v | u.uses(v) |

not exists(Assign a, Scope defnScope |

a.getATarget() = v.getAnAccess() and a.getScope() = defnScope

|

defnScope = f

or

// Exclude modules as that case is handled more precisely below.

defnScope = f.getScope().getScope*() and not defnScope instanceof Module

)

)

) and

not u.getEnclosingModule().(ImportTimeScope).definesName(u.getId()) and

not exists(ModuleValue m | m.getScope() = u.getEnclosingModule() | m.hasAttribute(u.getId())) and

not globallyDefinedName(u.getId()) and

not exists(SsaVariable var | var.getAUse().getNode() = u and not var.maybeUndefined()) and

not guarded_against_name_error(u) and

not (u.getEnclosingModule().isPackageInit() and u.getId() = "__path__")

}

predicate undefined_use_in_class_or_module(Name u) {

exists(GlobalVariable v | u.uses(v)) and

not u.getScope().getScope*() instanceof Function and

exists(SsaVariable var | var.getAUse().getNode() = u | var.maybeUndefined()) and

not guarded_against_name_error(u) and

not exists(ModuleValue m | m.getScope() = u.getEnclosingModule() | m.hasAttribute(u.getId())) and

not (u.getEnclosingModule().isPackageInit() and u.getId() = "__path__") and

not globallyDefinedName(u.getId())

}

predicate use_of_exec(Module m) {

exists(Exec exec | exec.getScope() = m)

or

exists(CallNode call, FunctionValue exec | exec.getACall() = call and call.getScope() = m |

exec = Value::named("exec") or

exec = Value::named("execfile")

)

}

predicate undefined_use(Name u) {

(

undefined_use_in_class_or_module(u)

or

undefined_use_in_function(u)

) and

not monkey_patched_builtin(u.getId()) and

not contains_unknown_import_star(u.getEnclosingModule()) and

not use_of_exec(u.getEnclosingModule()) and

not exists(u.getVariable().getAStore()) and

not u.pointsTo(_) and

not probably_defined_in_loop(u)

}

private predicate first_use_in_a_block(Name use) {

exists(GlobalVariable v, BasicBlock b, int i |

i = min(int j | b.getNode(j).getNode() = v.getALoad()) and b.getNode(i) = use.getAFlowNode()

)

}

predicate first_undefined_use(Name use) {

undefined_use(use) and

exists(GlobalVariable v | v.getALoad() = use |

first_use_in_a_block(use) and

not exists(ControlFlowNode other |

other.getNode() = v.getALoad() and

other.getBasicBlock().strictlyDominates(use.getAFlowNode().getBasicBlock())

)

)

}

from Name u

where first_undefined_use(u)

select u, "This use of global variable '" + u.getId() + "' may be undefined."