Python: Local/Global dataflow analysis not tracing class field?
- Lenguaje dominante
- CodeQL
- Estrellas
- 10.1k
- Forks
- 2.1k
- Merge medio
- 2 d 15 h
- PR fusionados (30 d)
- 141
Descripción
## Python
```python
class Cls:
def __init__(self) -> None:
self.field = 1
def __init__(self, num) -> None:
self.field = num
def print(self) -> None:
print(self.field)
if __name__ == '__main__':
var1 = Cls(2)
var2 = var1
var2.field = 3
var1.print()
var1.field2 = 4
print(var2.field2)
```
## CodeQL
```codeql
import python
import semmle.python.ApiGraphs
import semmle.python.dataflow.new.DataFlow
import semmle.python.dataflow.new.TaintTracking
module MyConf implements DataFlow::ConfigSig {
predicate isSource(DataFlow::Node source) {
source.asExpr() instanceof IntegerLiteral
}
predicate isSink(DataFlow::Node sink) {
sink = API::builtin("print").getACall().getArg(0)
}
}
module MyFlow = DataFlow::Global;
from DataFlow::Node source, DataFlow::Node sink
where MyFlow::flow(source, sink)
select source, sink
```
## Output
|source|sink|
|-|-|
|1|`self.field` in line 7|
|2|`self.field` in line 7|
## Expected result
|source|sink|
|-|-|
|1|`self.field` in line 7|
|2|`self.field` in line 7|
|3|`self.field` in line 7|
|4|`self.field` in line 16|
Guía de contribución
Línea de trabajo
Start with the Python local/global dataflow implementation and the DataFlow::Global configuration in the issue's CodeQL example. Reproduce the query against the provided Python program, then trace how assignments to self.field and self.field2 are modeled. Done means the output includes sources 3 and 4 at the expected sinks.
Escrito por el modelo de indexación a partir del texto del issue.
Evaluación
- Stack tecnológico
- python
- Área
- devtools, security
- Tipo de issue
- Error
- Dificultad
- 4/5
- Tiempo estimado
- 3-5 días
- Estado de actividad
- Estancado
- Claridad
- Bastante claro
- Aptitud para principiantes
- 35/100