FilesExpand file tree

codeql-cli-2.27.3

/

ClassAttributes.qll

Copy path

Blame

More file actions

Blame

More file actions

Latest commit

 

History

History

History

146 lines (133 loc) · 4.74 KB

codeql-cli-2.27.3

/

ClassAttributes.qll

Copy path

Top

File metadata and controls

• Code
• Blame

146 lines (133 loc) · 4.74 KB

Raw

Copy raw file

Download raw file

Open symbols panel

Edit and raw actions

1

2

3

4

5

6

7

8

9

10

11

12

13

14

15

16

17

18

19

20

21

22

23

24

25

26

27

28

29

30

31

32

33

34

35

36

37

38

39

40

41

42

43

44

45

46

47

48

49

50

51

52

53

54

55

56

57

58

59

60

61

62

63

64

65

66

67

68

69

70

71

72

73

74

75

76

77

78

79

80

81

82

83

84

85

86

87

88

89

90

91

92

93

94

95

96

97

98

99

100

101

102

103

104

105

106

107

108

109

110

111

112

113

114

115

116

117

118

119

120

121

122

123

124

125

126

127

128

129

130

131

132

133

134

135

136

137

138

139

140

141

142

143

144

145

146

import python

private import LegacyPointsTo

/** A helper class for UndefinedClassAttribute.ql and MaybeUndefinedClassAttribute.ql */

class CheckClass extends ClassObject {

private predicate ofInterest() {

not this.unknowableAttributes() and

not this.getPyClass().isProbableMixin() and

this.getPyClass().isPublic() and

not this.getPyClass().getScope() instanceof Function and

not this.probablyAbstract() and

not this.declaresAttribute("__new__") and

not this.selfDictAssigns() and

not this.lookupAttribute("__getattribute__") != object_getattribute() and

not this.hasAttribute("__getattr__") and

not this.selfSetattr() and

/* If class overrides object.__init__, but we can't resolve it to a Python function then give up */

forall(ClassObject sup |

sup = this.getAnImproperSuperType() and

sup.declaresAttribute("__init__") and

not sup = theObjectType()

|

sup.declaredAttribute("__init__") instanceof PyFunctionObject

)

}

predicate alwaysDefines(string name) {

auto_name(name) or

this.hasAttribute(name) or

this.getAnImproperSuperType().assignedInInit(name) or

this.getMetaClass().assignedInInit(name)

}

predicate sometimesDefines(string name) {

this.alwaysDefines(name)

or

exists(SelfAttributeStore sa |

sa.getScope().getScope+() = this.getAnImproperSuperType().getPyClass()

|

name = sa.getName()

)

}

private predicate selfDictAssigns() {

exists(Assign a, SelfAttributeRead self_dict, Subscript sub |

self_dict.getName() = "__dict__" and

(

self_dict = sub.getObject()

or

/* Indirect assignment via temporary variable */

exists(SsaVariable v, ControlFlowNode subObjCfg, ControlFlowNode selfDictCfg |

subObjCfg.getNode() = sub.getObject() and selfDictCfg.getNode() = self_dict

|

v.getAUse() = subObjCfg and

v.getDefinition().(DefinitionNode).getValue() = selfDictCfg

)

) and

a.getATarget() = sub and

exists(FunctionObject meth |

meth = this.lookupAttribute(_) and a.getScope() = meth.getFunction()

)

)

}

pragma[nomagic]

private predicate monkeyPatched(string name) {

exists(Attribute a, ControlFlowNode objCfg |

objCfg.getNode() = a.getObject() and

a.getCtx() instanceof Store and

PointsTo::points_to(objCfg, _, this, _, _) and

a.getName() = name

)

}

private predicate selfSetattr() {

exists(Call c, Name setattr, Name self, Function method |

(

method.getScope() = this.getPyClass() or

method.getScope() = this.getASuperType().getPyClass()

) and

c.getScope() = method and

c.getFunc() = setattr and

setattr.getId() = "setattr" and

c.getArg(0) = self and

self.getId() = "self"

)

}

predicate interestingUndefined(SelfAttributeRead a) {

exists(string name, ControlFlowNode aCfg | name = a.getName() and aCfg.getNode() = a |

this.interestingContext(a, name) and

not this.definedInBlock(aCfg.getBasicBlock(), name)

)

}

private predicate interestingContext(SelfAttributeRead a, string name) {

name = a.getName() and

this.ofInterest() and

this.getPyClass() = a.getScope().getScope() and

not a.locallyDefined() and

not a.guardedByHasattr() and

a.getScope().isPublic() and

not this.monkeyPatched(name) and

not attribute_assigned_in_method(this.lookupAttribute("setUp"), name)

}

private predicate probablyAbstract() {

this.getName().matches("Abstract%")

or

this.isAbstract()

}

pragma[nomagic]

private predicate definitionInBlock(BasicBlock b, string name) {

exists(SelfAttributeStore sa, ControlFlowNode saCfg |

saCfg.getNode() = sa and

saCfg.getBasicBlock() = b and

sa.getName() = name and

sa.getClass() = this.getPyClass()

)

or

exists(FunctionObject method | this.lookupAttribute(_) = method |

attribute_assigned_in_method(method, name) and

b = method.getACall().getBasicBlock()

)

}

pragma[nomagic]

private predicate definedInBlock(BasicBlock b, string name) {

// manual specialisation: this is only called from interestingUndefined,

// so we can push the context in from there, which must apply to a

// SelfAttributeRead in the same scope

exists(SelfAttributeRead a | a.getScope() = b.getScope() and name = a.getName() |

this.interestingContext(a, name)

) and

this.definitionInBlock(b, name)

or

exists(BasicBlock prev | this.definedInBlock(prev, name) and prev.getASuccessor() = b)

}

}

private Object object_getattribute() {

result.asBuiltin() = theObjectType().asBuiltin().getMember("__getattribute__")

}

private predicate auto_name(string name) { name = "__class__" or name = "__dict__" }