FazBrowse GitHub Viewer
|
Trending
|
URL:
|
Home
Tools:
[Download Repo ZIP]
[View Raw Code]
[Original HTTPS Page]
codeql/python/ql/src/Classes/ClassAttributes.qll at codeql-cli/v2.15.4 · github/codeql · GitHub
Uh oh!
There was an error while loading.
Please reload this page
.
github
/
codeql
Public
Notifications
You must be signed in to change notification settings
Fork
2.1k
Star
10k
Code
Issues
998
Pull requests
460
Discussions
Actions
Projects
Security and quality
0
Insights
Additional navigation options
Code
Issues
Pull requests
Discussions
Actions
Projects
Security and quality
Insights
Expand file tree
Breadcrumbs
codeql
/
python
/
ql
/
src
/
Classes
/
ClassAttributes.qll
Copy path
More file actions
More file actions
Latest commit
History
History
History
142 lines (129 loc) · 4.53 KB
Breadcrumbs
codeql
/
python
/
ql
/
src
/
Classes
/
ClassAttributes.qll
Copy path
File metadata and controls
142 lines (129 loc) · 4.53 KB
Raw
Copy raw file
Download raw file
Open symbols panel
Edit and raw actions
1
2
3
4
5
6
7
8
9
10
11
12
13
14
15
16
17
18
19
20
21
22
23
24
25
26
27
28
29
30
31
32
33
34
35
36
37
38
39
40
41
42
43
44
45
46
47
48
49
50
51
52
53
54
55
56
57
58
59
60
61
62
63
64
65
66
67
68
69
70
71
72
73
74
75
76
77
78
79
80
81
82
83
84
85
86
87
88
89
90
91
92
93
94
95
96
97
98
99
100
101
102
103
104
105
106
107
108
109
110
111
112
113
114
115
116
117
118
119
120
121
122
123
124
125
126
127
128
129
130
131
132
133
134
135
136
137
138
139
140
141
142
import
python
private
import
semmle.python.pointsto.PointsTo
/** A helper class for UndefinedClassAttribute.ql and MaybeUndefinedClassAttribute.ql */
class
CheckClass
extends
ClassObject
{
private
predicate
ofInterest
(
)
{
not
this
.
unknowableAttributes
(
)
and
not
this
.
getPyClass
(
)
.
isProbableMixin
(
)
and
this
.
getPyClass
(
)
.
isPublic
(
)
and
not
this
.
getPyClass
(
)
.
getScope
(
)
instanceof
Function
and
not
this
.
probablyAbstract
(
)
and
not
this
.
declaresAttribute
(
"__new__"
)
and
not
this
.
selfDictAssigns
(
)
and
not
this
.
lookupAttribute
(
"__getattribute__"
)
!=
object_getattribute
(
)
and
not
this
.
hasAttribute
(
"__getattr__"
)
and
not
this
.
selfSetattr
(
)
and
/* If class overrides object.__init__, but we can't resolve it to a Python function then give up */
forall
(
ClassObject
sup
|
sup
=
this
.
getAnImproperSuperType
(
)
and
sup
.
declaresAttribute
(
"__init__"
)
and
not
sup
=
theObjectType
(
)
|
sup
.
declaredAttribute
(
"__init__"
)
instanceof
PyFunctionObject
)
}
predicate
alwaysDefines
(
string
name
)
{
auto_name
(
name
)
or
this
.
hasAttribute
(
name
)
or
this
.
getAnImproperSuperType
(
)
.
assignedInInit
(
name
)
or
this
.
getMetaClass
(
)
.
assignedInInit
(
name
)
}
predicate
sometimesDefines
(
string
name
)
{
this
.
alwaysDefines
(
name
)
or
exists
(
SelfAttributeStore
sa
|
sa
.
getScope
(
)
.
getScope
+
(
)
=
this
.
getAnImproperSuperType
(
)
.
getPyClass
(
)
|
name
=
sa
.
getName
(
)
)
}
private
predicate
selfDictAssigns
(
)
{
exists
(
Assign
a
,
SelfAttributeRead
self_dict
,
Subscript
sub
|
self_dict
.
getName
(
)
=
"__dict__"
and
(
self_dict
=
sub
.
getObject
(
)
or
/* Indirect assignment via temporary variable */
exists
(
SsaVariable
v
|
v
.
getAUse
(
)
=
sub
.
getObject
(
)
.
getAFlowNode
(
)
and
v
.
getDefinition
(
)
.
(
DefinitionNode
)
.
getValue
(
)
=
self_dict
.
getAFlowNode
(
)
)
)
and
a
.
getATarget
(
)
=
sub
and
exists
(
FunctionObject
meth
|
meth
=
this
.
lookupAttribute
(
_
)
and
a
.
getScope
(
)
=
meth
.
getFunction
(
)
)
)
}
pragma
[
nomagic
]
private
predicate
monkeyPatched
(
string
name
)
{
exists
(
Attribute
a
|
a
.
getCtx
(
)
instanceof
Store
and
PointsTo
::
points_to
(
a
.
getObject
(
)
.
getAFlowNode
(
)
,
_
,
this
,
_
,
_
)
and
a
.
getName
(
)
=
name
)
}
private
predicate
selfSetattr
(
)
{
exists
(
Call
c
,
Name
setattr
,
Name
self
,
Function
method
|
(
method
.
getScope
(
)
=
this
.
getPyClass
(
)
or
method
.
getScope
(
)
=
this
.
getASuperType
(
)
.
getPyClass
(
)
)
and
c
.
getScope
(
)
=
method
and
c
.
getFunc
(
)
=
setattr
and
setattr
.
getId
(
)
=
"setattr"
and
c
.
getArg
(
0
)
=
self
and
self
.
getId
(
)
=
"self"
)
}
predicate
interestingUndefined
(
SelfAttributeRead
a
)
{
exists
(
string
name
|
name
=
a
.
getName
(
)
|
this
.
interestingContext
(
a
,
name
)
and
not
this
.
definedInBlock
(
a
.
getAFlowNode
(
)
.
getBasicBlock
(
)
,
name
)
)
}
private
predicate
interestingContext
(
SelfAttributeRead
a
,
string
name
)
{
name
=
a
.
getName
(
)
and
this
.
ofInterest
(
)
and
this
.
getPyClass
(
)
=
a
.
getScope
(
)
.
getScope
(
)
and
not
a
.
locallyDefined
(
)
and
not
a
.
guardedByHasattr
(
)
and
a
.
getScope
(
)
.
isPublic
(
)
and
not
this
.
monkeyPatched
(
name
)
and
not
attribute_assigned_in_method
(
this
.
lookupAttribute
(
"setUp"
)
,
name
)
}
private
predicate
probablyAbstract
(
)
{
this
.
getName
(
)
.
matches
(
"Abstract%"
)
or
this
.
isAbstract
(
)
}
pragma
[
nomagic
]
private
predicate
definitionInBlock
(
BasicBlock
b
,
string
name
)
{
exists
(
SelfAttributeStore
sa
|
sa
.
getAFlowNode
(
)
.
getBasicBlock
(
)
=
b
and
sa
.
getName
(
)
=
name
and
sa
.
getClass
(
)
=
this
.
getPyClass
(
)
)
or
exists
(
FunctionObject
method
|
this
.
lookupAttribute
(
_
)
=
method
|
attribute_assigned_in_method
(
method
,
name
)
and
b
=
method
.
getACall
(
)
.
getBasicBlock
(
)
)
}
pragma
[
nomagic
]
private
predicate
definedInBlock
(
BasicBlock
b
,
string
name
)
{
// manual specialisation: this is only called from interestingUndefined,
// so we can push the context in from there, which must apply to a
// SelfAttributeRead in the same scope
exists
(
SelfAttributeRead
a
|
a
.
getScope
(
)
=
b
.
getScope
(
)
and
name
=
a
.
getName
(
)
|
this
.
interestingContext
(
a
,
name
)
)
and
this
.
definitionInBlock
(
b
,
name
)
or
exists
(
BasicBlock
prev
|
this
.
definedInBlock
(
prev
,
name
)
and
prev
.
getASuccessor
(
)
=
b
)
}
}
private
Object
object_getattribute
(
)
{
result
.
asBuiltin
(
)
=
theObjectType
(
)
.
asBuiltin
(
)
.
getMember
(
"__getattribute__"
)
}
private
predicate
auto_name
(
string
name
)
{
name
=
"__class__"
or
name
=
"__dict__"
}
Back
|
FazBrowse Home
|
New Git URL