iframe-proxy | Sunbelt Computer Software

Repository navigation

History

100

101

102

103

104

105

106

107

108

109

110

111

112

113

114

115

116

117

118

119

120

121

122

123

124

125

126

127

128

129

130

131

132

133

134

135

136

137

138

139

140

141

142

143

144

145

146

147

148

149

150

151

152

153

154

155

156

157

158

159

160

161

162

163

164

165

166

167

168

169

170

171

172

173

174

175

176

177

178

179

180

181

182

183

184

185

186

187

188

/** Definitions for reasoning about whether files are closed. */

import python

import semmle.python.dataflow.new.internal.DataFlowDispatch

import semmle.python.ApiGraphs

private import semmle.python.dataflow.new.internal.ReExposedInstance

/** A CFG node where a file is opened. */

abstract class FileOpenSource extends DataFlow::CfgNode { }

/** A call to the builtin `open` or `os.open`. */

class FileOpenCall extends FileOpenSource {

FileOpenCall() {

this = [API::builtin("open").getACall(), API::moduleImport("os").getMember("open").getACall()]

}

private DataFlow::TypeTrackingNode fileOpenInstance(DataFlow::TypeTracker t) {

t.start() and

result instanceof FileOpenSource

exists(DataFlow::TypeTracker t2 | result = fileOpenInstance(t2).track(t2, t))

}

/**

* Holds if `node` is tracked to be an instance of an open file object.

private predicate fileInstanceNode(DataFlow::Node node) {

fileOpenInstance(DataFlow::TypeTracker::end()).flowsTo(node)

}

private module FileReExposed = ReExposedInstance<fileInstanceNode/1>;

/**

* A call that returns an instance of an open file object.

* This includes calls to methods that transitively call `open` or similar.

class FileOpen extends DataFlow::CallCfgNode {

FileOpen() {

fileOpenInstance(DataFlow::TypeTracker::end()).flowsTo(this) and

// Don't treat an accessor that merely re-exposes a file held in an instance attribute

// (e.g. `FileIO.fileno` returning `self._fd`) as opening a new file. Such flow is

// introduced by instance-attribute type tracking; the underlying open is tracked at its

// real creation site.

not FileReExposed::isReExposed(this)

}

/** A call that may wrap a file object in a wrapper class or `os.fdopen`. */

class FileWrapperCall extends DataFlow::CallCfgNode {

DataFlow::Node wrapped;

FileWrapperCall() {

// Approximation: Treat any passing of a file object to a class constructor as potentially a wrapper

// This could be made more precise by checking that the constructor writes the file to a field.

wrapped = this.getArg(_).getALocalSource() and

this.getFunction() = classTracker(_)

wrapped = this.getArg(0) and

this = API::moduleImport("os").getMember("fdopen").getACall()

wrapped = this.getArg(0) and

this = API::moduleImport("django").getMember("http").getMember("FileResponse").getACall()

}

/** Gets the file that this call wraps. */

DataFlow::Node getWrapped() { result = wrapped }

}

/** A node where a file is closed. */

abstract class FileClose extends DataFlow::CfgNode {

/** Holds if this file close will occur if an exception is raised at `fileRaises`. */

predicate guardsExceptions(DataFlow::CfgNode fileRaises) {

// The close call occurs after an exception edge in the cfg (a catch or finally)

bbReachableRefl(fileRaises.asCfgNode().getBasicBlock().getAnExceptionalSuccessor(),

this.asCfgNode().getBasicBlock())

// The exception is after the close call.

// A full cfg reachability check is not feasible for performance, instead we use local dataflow

fileLocalFlow(this, fileRaises)

}

private predicate bbSuccessor(BasicBlock src, BasicBlock sink) { sink = src.getASuccessor() }

private predicate bbReachableStrict(BasicBlock src, BasicBlock sink) =

fastTC(bbSuccessor/2)(src, sink)

private predicate bbReachableRefl(BasicBlock src, BasicBlock sink) {

bbReachableStrict(src, sink) or src = sink

}

/** A call to the `.close()` method of a file object. */

class FileCloseCall extends FileClose {

FileCloseCall() { exists(DataFlow::MethodCallNode mc | mc.calls(this, "close")) }

}

/** A call to `os.close`. */

class OsCloseCall extends FileClose {

OsCloseCall() { this = API::moduleImport("os").getMember("close").getACall().getArg(0) }

}

/** A `with` statement. */

class WithStatement extends FileClose {

With w;

WithStatement() { this.asExpr() = w.getContextExpr() }

override predicate guardsExceptions(DataFlow::CfgNode fileRaises) {

super.guardsExceptions(fileRaises)

w.getBody().contains(fileRaises.asExpr())

}

/** Holds if an exception may be raised at `raises` if `file` is a file object. */

private predicate mayRaiseWithFile(DataFlow::CfgNode file, DataFlow::CfgNode raises) {

// Currently just consider any method called on `file`; e.g. `file.write()`; as potentially raising an exception

raises.(DataFlow::MethodCallNode).getObject() = file and

not file instanceof FileOpen and

not file instanceof FileClose

}

/** Holds if data flows from `nodeFrom` to `nodeTo` in one step that also includes file wrapper classes. */

private predicate fileAdditionalLocalFlowStep(DataFlow::Node nodeFrom, DataFlow::Node nodeTo) {

exists(FileWrapperCall fw | nodeFrom = fw.getWrapped() and nodeTo = fw)

}

private predicate fileLocalFlowHelper0(

DataFlow::LocalSourceNode nodeFrom, DataFlow::LocalSourceNode nodeTo

) {

exists(DataFlow::Node nodeMid |

nodeFrom.flowsTo(nodeMid) and fileAdditionalLocalFlowStep(nodeMid, nodeTo)

)

}

private predicate fileLocalFlowHelper1(

DataFlow::LocalSourceNode nodeFrom, DataFlow::LocalSourceNode nodeTo

) {

fileLocalFlowHelper0*(nodeFrom, nodeTo)

}

/** Holds if data flows from `source` to `sink`, including file wrapper classes. */

pragma[inline]

private predicate fileLocalFlow(DataFlow::Node source, DataFlow::Node sink) {

exists(DataFlow::LocalSourceNode mid | fileLocalFlowHelper1(source, mid) and mid.flowsTo(sink))

}

/** Holds if the file opened at `fo` is closed. */

predicate fileIsClosed(FileOpen fo) { exists(FileClose fc | fileLocalFlow(fo, fc)) }

/** Holds if the file opened at `fo` is returned to the caller. This makes the caller responsible for closing the file. */

predicate fileIsReturned(FileOpen fo) {

exists(Return ret, Expr retVal |

(

retVal = ret.getValue()

retVal = ret.getValue().(List).getAnElt()

retVal = ret.getValue().(Tuple).getAnElt()

) and

fileLocalFlow(fo, DataFlow::exprNode(retVal))

)

}

/** Holds if the file opened at `fo` is stored in a field. We assume that another method is then responsible for closing the file. */

predicate fileIsStoredInField(FileOpen fo) {

exists(DataFlow::AttrWrite aw | fileLocalFlow(fo, aw.getValue()))

}

/** Holds if the file opened at `fo` is not closed, and is expected to be closed. */

predicate fileNotClosed(FileOpen fo) {

not fileIsClosed(fo) and

not fileIsReturned(fo) and

not fileIsStoredInField(fo)

}

predicate fileMayNotBeClosedOnException(FileOpen fo, DataFlow::Node raises) {

fileIsClosed(fo) and

exists(DataFlow::CfgNode fileRaised |

mayRaiseWithFile(fileRaised, raises) and

fileLocalFlow(fo, fileRaised) and

not exists(FileClose fc |

fileLocalFlow(fo, fc) and

fc.guardsExceptions(fileRaised)

)

}

Sunbelt Computer Software

PL/B Language Development and Support

Navigation Menu

Repository navigation

FileNotAlwaysClosedQuery.qll

FileNotAlwaysClosedQuery.qll

Sunbelt Computer Software

PL/B Language Development and Support

FilesExpand file tree

FileNotAlwaysClosedQuery.qll

Latest commit

History

FileNotAlwaysClosedQuery.qll

File metadata and controls