FazBrowse GitHub Viewer
|
Trending
|
URL:
|
Home
Tools:
[Download Repo ZIP]
[View Raw Code]
[Original HTTPS Page]
codeql/python/ql/src/Expressions/IsComparisons.qll at codeql-cli-2.19.2 · github/codeql · GitHub
github
/
codeql
Public
Notifications
You must be signed in to change notification settings
Fork
2.1k
Star
10.1k
Code
Issues
1k
Pull requests
470
Discussions
Actions
Projects
Security and quality
0
Insights
Additional navigation options
Code
Issues
Pull requests
Discussions
Actions
Projects
Security and quality
Insights
Expand file tree
Breadcrumbs
codeql
/
python
/
ql
/
src
/
Expressions
/
IsComparisons.qll
Copy path
More file actions
More file actions
Latest commit
History
History
History
148 lines (134 loc) · 5.32 KB
Breadcrumbs
codeql
/
python
/
ql
/
src
/
Expressions
/
IsComparisons.qll
Copy path
File metadata and controls
148 lines (134 loc) · 5.32 KB
Raw
Copy raw file
Download raw file
Open symbols panel
Edit and raw actions
1
2
3
4
5
6
7
8
9
10
11
12
13
14
15
16
17
18
19
20
21
22
23
24
25
26
27
28
29
30
31
32
33
34
35
36
37
38
39
40
41
42
43
44
45
46
47
48
49
50
51
52
53
54
55
56
57
58
59
60
61
62
63
64
65
66
67
68
69
70
71
72
73
74
75
76
77
78
79
80
81
82
83
84
85
86
87
88
89
90
91
92
93
94
95
96
97
98
99
100
101
102
103
104
105
106
107
108
109
110
111
112
113
114
115
116
117
118
119
120
121
122
123
124
125
126
127
128
129
130
131
132
133
134
135
136
137
138
139
140
141
142
143
144
145
146
147
148
/** INTERNAL - Helper predicates for queries that inspect the comparison of objects using `is`. */
import
python
/** Holds if the comparison `comp` uses `is` or `is not` (represented as `op`) to compare its `left` and `right` arguments. */
predicate
comparison_using_is
(
Compare
comp
,
ControlFlowNode
left
,
Cmpop
op
,
ControlFlowNode
right
)
{
exists
(
CompareNode
fcomp
|
fcomp
=
comp
.
getAFlowNode
(
)
|
fcomp
.
operands
(
left
,
op
,
right
)
and
(
op
instanceof
Is
or
op
instanceof
IsNot
)
)
}
/** Holds if the class `c` overrides the default notion of equality or comparison. */
predicate
overrides_eq_or_cmp
(
ClassValue
c
)
{
major_version
(
)
=
2
and
c
.
hasAttribute
(
"__eq__"
)
or
c
.
declaresAttribute
(
"__eq__"
)
and
not
c
=
Value
::
named
(
"object"
)
or
exists
(
ClassValue
sup
|
sup
=
c
.
getASuperType
(
)
and
not
sup
=
Value
::
named
(
"object"
)
|
sup
.
declaresAttribute
(
"__eq__"
)
)
or
major_version
(
)
=
2
and
c
.
hasAttribute
(
"__cmp__"
)
}
/** Holds if the class `cls` is likely to only have a single instance throughout the program. */
predicate
probablySingleton
(
ClassValue
cls
)
{
strictcount
(
Value
inst
|
inst
.
getClass
(
)
=
cls
)
=
1
or
cls
=
Value
::
named
(
"None"
)
.
getClass
(
)
}
/** Holds if using `is` to compare instances of the class `c` is likely to cause unexpected behavior. */
predicate
invalid_to_use_is_portably
(
ClassValue
c
)
{
overrides_eq_or_cmp
(
c
)
and
// Exclude type/builtin-function/bool as it is legitimate to compare them using 'is' but they implement __eq__
not
c
=
Value
::
named
(
"type"
)
and
not
c
=
ClassValue
::
builtinFunction
(
)
and
not
c
=
Value
::
named
(
"bool"
)
and
// OK to compare with 'is' if a singleton
not
probablySingleton
(
c
)
}
/** Holds if the control flow node `f` points to either `True`, `False`, or `None`. */
predicate
simple_constant
(
ControlFlowNode
f
)
{
exists
(
Value
val
|
f
.
pointsTo
(
val
)
|
val
=
Value
::
named
(
"True"
)
or
val
=
Value
::
named
(
"False"
)
or
val
=
Value
::
named
(
"None"
)
)
}
private
predicate
cpython_interned_value
(
Expr
e
)
{
exists
(
string
text
|
text
=
e
.
(
StringLiteral
)
.
getText
(
)
|
text
.
length
(
)
=
0
or
text
.
length
(
)
=
1
and
text
.
regexpMatch
(
"[U+0000-U+00ff]"
)
)
or
exists
(
int
i
|
i
=
e
.
(
IntegerLiteral
)
.
getN
(
)
.
toInt
(
)
|
-
5
<=
i
and
i
<=
256
)
or
exists
(
Tuple
t
|
t
=
e
and
not
exists
(
t
.
getAnElt
(
)
)
)
}
/**
* The set of values that can be expected to be interned across
* the main implementations of Python. PyPy, Jython, etc tend to
* follow CPython, but it varies, so this is a best guess.
*/
private
predicate
universally_interned_value
(
Expr
e
)
{
e
.
(
IntegerLiteral
)
.
getN
(
)
.
toInt
(
)
=
0
or
exists
(
Tuple
t
|
t
=
e
and
not
exists
(
t
.
getAnElt
(
)
)
)
or
e
.
(
StringLiteral
)
.
getText
(
)
=
""
}
/** Holds if the expression `e` points to an interned constant in CPython. */
predicate
cpython_interned_constant
(
Expr
e
)
{
exists
(
Expr
const
|
e
.
pointsTo
(
_
,
const
)
|
cpython_interned_value
(
const
)
)
}
/** Holds if the expression `e` points to a value that can be reasonably expected to be interned across all implementations of Python. */
predicate
universally_interned_constant
(
Expr
e
)
{
exists
(
Expr
const
|
e
.
pointsTo
(
_
,
const
)
|
universally_interned_value
(
const
)
)
}
private
predicate
comparison_both_types
(
Compare
comp
,
Cmpop
op
,
ClassValue
cls1
,
ClassValue
cls2
)
{
exists
(
ControlFlowNode
op1
,
ControlFlowNode
op2
|
comparison_using_is
(
comp
,
op1
,
op
,
op2
)
or
comparison_using_is
(
comp
,
op2
,
op
,
op1
)
|
op1
.
inferredValue
(
)
.
getClass
(
)
=
cls1
and
op2
.
inferredValue
(
)
.
getClass
(
)
=
cls2
)
}
private
predicate
comparison_one_type
(
Compare
comp
,
Cmpop
op
,
ClassValue
cls
)
{
not
comparison_both_types
(
comp
,
_
,
_
,
_
)
and
exists
(
ControlFlowNode
operand
|
comparison_using_is
(
comp
,
operand
,
op
,
_
)
or
comparison_using_is
(
comp
,
_
,
op
,
operand
)
|
operand
.
inferredValue
(
)
.
getClass
(
)
=
cls
)
}
/**
* Holds if using `is` or `is not` as the operator `op` in the comparison `comp` would be invalid when applied to the class `cls`.
*/
predicate
invalid_portable_is_comparison
(
Compare
comp
,
Cmpop
op
,
ClassValue
cls
)
{
// OK to use 'is' when defining '__eq__'
not
exists
(
Function
eq
|
eq
.
getName
(
)
=
"__eq__"
or
eq
.
getName
(
)
=
"__ne__"
|
eq
=
comp
.
getScope
(
)
.
getScope
*
(
)
)
and
(
comparison_one_type
(
comp
,
op
,
cls
)
and
invalid_to_use_is_portably
(
cls
)
or
exists
(
ClassValue
other
|
comparison_both_types
(
comp
,
op
,
cls
,
other
)
|
invalid_to_use_is_portably
(
cls
)
and
invalid_to_use_is_portably
(
other
)
)
)
and
// OK to use 'is' when comparing items from a known set of objects
not
exists
(
Expr
left
,
Expr
right
,
Value
val
|
comp
.
compares
(
left
,
op
,
right
)
and
exists
(
ImmutableLiteral
il
|
il
.
getLiteralValue
(
)
=
val
)
|
left
.
pointsTo
(
val
)
and
right
.
pointsTo
(
val
)
or
// Simple constant in module, probably some sort of sentinel
exists
(
AstNode
origin
|
not
left
.
pointsTo
(
_
)
and
right
.
pointsTo
(
val
,
origin
)
and
origin
.
getScope
(
)
.
getEnclosingModule
(
)
=
comp
.
getScope
(
)
.
getEnclosingModule
(
)
)
)
and
// OK to use 'is' when comparing with a member of an enum
not
exists
(
Expr
left
,
Expr
right
,
AstNode
origin
|
comp
.
compares
(
left
,
op
,
right
)
and
enum_member
(
origin
)
|
left
.
pointsTo
(
_
,
origin
)
or
right
.
pointsTo
(
_
,
origin
)
)
}
private
predicate
enum_member
(
AstNode
obj
)
{
exists
(
ClassValue
cls
,
AssignStmt
asgn
|
cls
.
getASuperType
(
)
.
getName
(
)
=
"Enum"
|
cls
.
getScope
(
)
=
asgn
.
getScope
(
)
and
asgn
.
getValue
(
)
=
obj
)
}
Back
|
FazBrowse Home
|
New Git URL