iframe-proxy | Sunbelt Computer Software

87 lines (80 loc) · 2.61 KB

 * @name Ignored return value
 * @description Ignoring return values may result in discarding errors or loss of information.
 * @kind problem
 * @tags quality
 *       reliability
 *       correctness
 *       readability
 *       external/cwe/cwe-252
 * @problem.severity recommendation
 * @sub-severity high
 * @precision medium
 * @id py/ignored-return-value
import python
private import LegacyPointsTo
predicate meaningful_return_value(Expr val) {
  val instanceof Name
  val instanceof BooleanLiteral
  exists(FunctionValue callee |
    val = callee.getACall().getNode() and returns_meaningful_value(callee)
  not exists(FunctionValue callee | val = callee.getACall().getNode()) and not val instanceof Name
/* Value is used before returning, and thus its value is not lost if ignored */
predicate used_value(Expr val) {
  exists(LocalVariable var, Expr other |
    var.getAnAccess() = val and other = var.getAnAccess() and not other = val
predicate returns_meaningful_value(FunctionValue f) {
  not exists(f.getScope().getFallthroughNode()) and
    exists(Return ret, Expr val | ret.getScope() = f.getScope() and val = ret.getValue() |
      meaningful_return_value(val) and
      not used_value(val)
     * Is f a builtin function that returns something other than None?
     * Ignore __import__ as it is often called purely for side effects
    f.isBuiltin() and
    f.getAnInferredReturnType() != ClassValue::nonetype() and
    not f.getName() = "__import__"
/* If a call is wrapped tightly in a try-except then we assume it is being executed for the exception. */
predicate wrapped_in_try_except(ExprStmt call) {
  exists(Try t |
    exists(t.getAHandler()) and
    strictcount(Call c | t.getBody().contains(c)) = 1 and
    call = t.getAStmt()
from ExprStmt call, FunctionValue callee, float percentage_used, int total
  call.getValue() = callee.getACall().getNode() and
  returns_meaningful_value(callee) and
  not wrapped_in_try_except(call) and
  exists(int unused |
    unused =
      count(ExprStmt e |
        exists(ControlFlowNode eValCfg | eValCfg.getNode() = e.getValue() |
          eValCfg = callee.getACall()
      ) and
    total = count(callee.getACall())
    percentage_used = (100.0 * (total - unused) / total).floor()
  /* Report an alert if we see at least 5 calls and the return value is used in at least 3/4 of those calls. */
  percentage_used >= 75 and
  total >= 5
select call,
  "Call discards return value of function $@. The result is used in " + percentage_used.toString() +
    "% of calls.", callee, callee.getName()

Sunbelt Computer Software

PL/B Language Development and Support

Provide feedback

Saved searches

Use saved searches to filter your results more quickly

Uh oh!

Sunbelt Computer Software

PL/B Language Development and Support

Uh oh!

FilesExpand file tree

ReturnValueIgnored.ql

Latest commit

History

ReturnValueIgnored.ql

File metadata and controls