/**

* Provides classes modeling security-relevant aspects of the standard libraries.

* Note: some modeling is done internally in the dataflow/taint tracking implementation.

*/

overlay[local?]

module;

private import python

private import semmle.python.dataflow.new.DataFlow

private import semmle.python.dataflow.new.TaintTracking

private import semmle.python.dataflow.new.RemoteFlowSources

private import semmle.python.Concepts

private import semmle.python.ApiGraphs

private import semmle.python.dataflow.new.FlowSummary

private import semmle.python.frameworks.PEP249

private import semmle.python.frameworks.internal.PoorMansFunctionResolution

private import semmle.python.frameworks.internal.SelfRefMixin

private import semmle.python.frameworks.internal.InstanceTaintStepsHelper

// modeling split over multiple files to keep this file from becoming too big

private import semmle.python.frameworks.Stdlib.Urllib

private import semmle.python.frameworks.Stdlib.Urllib2

private import semmle.python.frameworks.data.ModelsAsData

/** Provides models for the Python standard library. */

module Stdlib {

/**

* Provides models for file-like objects,

* mostly to define standard set of extra taint-steps.

*

* See

* - https://docs.python.org/3.9/glossary.html#term-file-like-object

* - https://docs.python.org/3.9/library/io.html#io.IOBase

*/

module FileLikeObject {

/**

* A source of a file-like object, extend this class to model new instances.

*

* This can include instantiations of the class, return values from function

* calls, or a special parameter that will be set when functions are called by an external

* library.

*

* Use the predicate `like::instance()` to get references to instances of `file.like`.

*/

abstract class InstanceSource extends DataFlow::LocalSourceNode { }

/** Gets a reference to a file-like object. */

private DataFlow::TypeTrackingNode instance(DataFlow::TypeTracker t) {

t.start() and

result instanceof InstanceSource

or

exists(DataFlow::TypeTracker t2 | result = instance(t2).track(t2, t))

}

/** Gets a reference to a file-like object. */

DataFlow::Node instance() { instance(DataFlow::TypeTracker::end()).flowsTo(result) }

/**

* Taint propagation for file-like objects.

*/

private class InstanceTaintSteps extends InstanceTaintStepsHelper {

InstanceTaintSteps() { this = "<file-like object>" }

override DataFlow::Node getInstance() { result = instance() }

override string getAttributeName() { none() }

override string getMethodName() { result in ["read", "readline", "readlines"] }

override string getAsyncMethodName() { none() }

}

/**

* Extra taint propagation for file-like objects, not covered by `InstanceTaintSteps`.",

*/

private class AdditionalTaintStep extends TaintTracking::AdditionalTaintStep {

override predicate step(DataFlow::Node nodeFrom, DataFlow::Node nodeTo) {

// taint-propagation back to instance from `foo.write(tainted_data)`

exists(DataFlow::AttrRead write, DataFlow::CallCfgNode call, DataFlow::Node instance_ |

instance_ = instance() and

write.accesses(instance_, "write")

|

nodeTo.(DataFlow::PostUpdateNode).getPreUpdateNode() = instance_ and

call.getFunction() = write and

nodeFrom = call.getArg(0)

)

}

}

}

/**

* Provides models for the `http.client.HTTPMessage` class

*

* Has no official docs, but see

* https://github.com/python/cpython/blob/64f54b7ccd49764b0304e076bfd79b5482988f53/Lib/http/client.py#L175

* and https://docs.python.org/3.9/library/email.compat32-message.html#email.message.Message

*/

module HttpMessage {

/**

* A source of instances of `http.client.HTTPMessage`, extend this class to model new instances.

*

* This can include instantiations of the class, return values from function

* calls, or a special parameter that will be set when functions are called by an external

* library.

*

* Use the predicate `HTTPMessage::instance()` to get references to instances of `http.client.HTTPMessage`.

*/

abstract class InstanceSource extends DataFlow::LocalSourceNode { }

/** Gets a reference to an instance of `http.client.HttpMessage`. */

private DataFlow::TypeTrackingNode instance(DataFlow::TypeTracker t) {

t.start() and

result instanceof InstanceSource

or

exists(DataFlow::TypeTracker t2 | result = instance(t2).track(t2, t))

}

/** Gets a reference to an instance of `http.client.HttpMessage`. */

DataFlow::Node instance() { instance(DataFlow::TypeTracker::end()).flowsTo(result) }

/**

* Taint propagation for `http.client.HTTPMessage`.

*/

private class InstanceTaintSteps extends InstanceTaintStepsHelper {

InstanceTaintSteps() { this = "http.client.HTTPMessage" }

override DataFlow::Node getInstance() { result = instance() }

override string getAttributeName() { none() }

override string getMethodName() { result in ["get_all", "as_bytes", "as_string", "keys"] }

override string getAsyncMethodName() { none() }

}

}

/**

* Provides models for the `http.cookies.Morsel` class

*

* See https://docs.python.org/3.9/library/http.cookies.html#http.cookies.Morsel.

*/

module Morsel {

/**

* A source of instances of `http.cookies.Morsel`, extend this class to model new instances.

*

* This can include instantiations of the class, return values from function

* calls, or a special parameter that will be set when functions are called by an external

* library.

*

* Use the predicate `Morsel::instance()` to get references to instances of `http.cookies.Morsel`.

*/

abstract class InstanceSource extends DataFlow::LocalSourceNode { }

/** Gets a reference to an instance of `http.cookies.Morsel`. */

private DataFlow::TypeTrackingNode instance(DataFlow::TypeTracker t) {

t.start() and

result instanceof InstanceSource

or

exists(DataFlow::TypeTracker t2 | result = instance(t2).track(t2, t))

}

/** Gets a reference to an instance of `http.cookies.Morsel`. */

DataFlow::Node instance() { instance(DataFlow::TypeTracker::end()).flowsTo(result) }

/**

* Taint propagation for `http.cookies.Morsel`.

*/

private class InstanceTaintSteps extends InstanceTaintStepsHelper {

InstanceTaintSteps() { this = "http.cookies.Morsel" }

override DataFlow::Node getInstance() { result = instance() }

override string getAttributeName() { result in ["key", "value", "coded_value"] }

override string getMethodName() { result in ["output", "js_output"] }

override string getAsyncMethodName() { none() }

}

}

/**

* Provides models for the `urllib.parse.SplitResult` class

*

* See https://docs.python.org/3.9/library/urllib.parse.html#urllib.parse.SplitResult.

*/

module SplitResult {

/** Gets a reference to the `urllib.parse.SplitResult` class. */

API::Node classRef() {

result = API::moduleImport("urllib").getMember("parse").getMember("SplitResult")

or

result = ModelOutput::getATypeNode("urllib.parse.SplitResult~Subclass").getASubclass*()

}

/**

* A source of instances of `urllib.parse.SplitResult`, extend this class to model new instances.

*

* This can include instantiations of the class, return values from function

* calls, or a special parameter that will be set when functions are called by an external

* library.

*

* Use the predicate `SplitResult::instance()` to get references to instances of `urllib.parse.SplitResult`.

*/

abstract class InstanceSource extends DataFlow::LocalSourceNode { }

/** A direct instantiation of `urllib.parse.SplitResult`. */

private class ClassInstantiation extends InstanceSource, DataFlow::CallCfgNode {

ClassInstantiation() { this = classRef().getACall() }

}

/** Gets a reference to an instance of `urllib.parse.SplitResult`. */

private DataFlow::TypeTrackingNode instance(DataFlow::TypeTracker t) {

t.start() and

result instanceof InstanceSource

or

exists(DataFlow::TypeTracker t2 | result = instance(t2).track(t2, t))

}

/** Gets a reference to an instance of `urllib.parse.SplitResult`. */

DataFlow::Node instance() { instance(DataFlow::TypeTracker::end()).flowsTo(result) }

/**

* Taint propagation for `urllib.parse.SplitResult`.

*/

private class InstanceTaintSteps extends InstanceTaintStepsHelper {

InstanceTaintSteps() { this = "urllib.parse.SplitResult" }

override DataFlow::Node getInstance() { result = instance() }

override string getAttributeName() {

result in [

"netloc", "path", "query", "fragment", "username", "password", "hostname", "port"

]

}

override string getMethodName() { none() }

override string getAsyncMethodName() { none() }

}

/**

* Extra taint propagation for `urllib.parse.SplitResult`, not covered by `InstanceTaintSteps`.

*/

private class AdditionalTaintStep extends TaintTracking::AdditionalTaintStep {

override predicate step(DataFlow::Node nodeFrom, DataFlow::Node nodeTo) {

// TODO

none()

}

}

}

/**

* Provides models for the `urllib.parse.ParseResult` class

*

* See https://docs.python.org/3.9/library/urllib.parse.html#urllib.parse.ParseResult.

*/

module ParseResult {

/** Gets a reference to the `urllib.parse.ParseResult` class. */

API::Node classRef() {

result = API::moduleImport("urllib").getMember("parse").getMember("ParseResult")

or

result = ModelOutput::getATypeNode("urllib.parse.ParseResult~Subclass").getASubclass*()

}

/**

* A source of instances of `urllib.parse.ParseResult`, extend this class to model new instances.

*

* This can include instantiations of the class, return values from function

* calls, or a special parameter that will be set when functions are called by an external

* library.

*

* Use the predicate `ParseResult::instance()` to get references to instances of `urllib.parse.ParseResult`.

*/

abstract class InstanceSource extends DataFlow::LocalSourceNode { }

/** A direct instantiation of `urllib.parse.ParseResult`. */

private class ClassInstantiation extends InstanceSource, DataFlow::CallCfgNode {

ClassInstantiation() { this = classRef().getACall() }

}

/** Gets a reference to an instance of `urllib.parse.ParseResult`. */

private DataFlow::TypeTrackingNode instance(DataFlow::TypeTracker t) {

t.start() and

result instanceof InstanceSource

or

exists(DataFlow::TypeTracker t2 | result = instance(t2).track(t2, t))

}

/** Gets a reference to an instance of `urllib.parse.ParseResult`. */

DataFlow::Node instance() { instance(DataFlow::TypeTracker::end()).flowsTo(result) }

/**

* Taint propagation for `urllib.parse.ParseResult`.

*/

private class InstanceTaintSteps extends InstanceTaintStepsHelper {

InstanceTaintSteps() { this = "urllib.parse.ParseResult" }

override DataFlow::Node getInstance() { result = instance() }

override string getAttributeName() {

result in [

"netloc", "path", "params", "query", "fragment", "username", "password", "hostname",

"port"

]

}

override string getMethodName() { none() }

override string getAsyncMethodName() { none() }

}

}

// ---------------------------------------------------------------------------

// logging

// ---------------------------------------------------------------------------

/**

* Provides models for the `logging.Logger` class and subclasses.

*

* See https://docs.python.org/3.9/library/logging.html#logging.Logger.

*/

module Logger {

private import semmle.python.dataflow.new.internal.DataFlowDispatch as DD

/** Gets a reference to the `logging.Logger` class or any subclass. */

API::Node subclassRef() {

result = API::moduleImport("logging").getMember("Logger").getASubclass*()

or

result = API::moduleImport("logging").getMember("getLoggerClass").getReturn().getASubclass*()

or

result = ModelOutput::getATypeNode("logging.Logger~Subclass").getASubclass*()

}

/**

* A source of instances of `logging.Logger`, extend this class to model new instances.

*

* This can include instantiations of the class, return values from function

* calls, or a special parameter that will be set when functions are called by an external

* library.

*

* Use the predicate `Logger::instance()` to get references to instances of `logging.Logger`.

*/

abstract class InstanceSource extends DataFlow::LocalSourceNode { }

/** A direct instantiation of `logging.Logger`. */

private class ClassInstantiation extends InstanceSource, DataFlow::CfgNode {

ClassInstantiation() {

this = subclassRef().getACall()

or

this =

DD::selfTracker(subclassRef()

.getAValueReachableFromSource()

.asExpr()

.(ClassExpr)

.getInnerScope())

or

this = API::moduleImport("logging").getMember("root").asSource()

or

this = API::moduleImport("logging").getMember("getLogger").getACall()

}

}

/** Gets a reference to an instance of `logging.Logger`. */

private DataFlow::TypeTrackingNode instance(DataFlow::TypeTracker t) {

t.start() and

result instanceof InstanceSource

or

exists(DataFlow::TypeTracker t2 | result = instance(t2).track(t2, t))

}

/** Gets a reference to an instance of `logging.Logger`. */

DataFlow::Node instance() { instance(DataFlow::TypeTracker::end()).flowsTo(result) }

}

}

/**

* INTERNAL: Do not use.

*

* Provides models for the Python standard library.

*

* This module is marked private as exposing it means committing to 1-year deprecation

* policy, and the code is not in a polished enough state that we want to do so -- at

* least not without having convincing use-cases for it :)

*/

module StdlibPrivate {

// ---------------------------------------------------------------------------

// os

// ---------------------------------------------------------------------------

/** Gets a reference to the `os` module. */

API::Node os() { result = API::moduleImport("os") }

/** Provides models for the `os` module. */

module OS {

/** Gets a reference to the `os.path` module. */

API::Node path() {

result = os().getMember("path")

or

// although the following modules should not be used directly, they certainly can.

// Each one doesn't expose the full `os.path` API, so this is an overapproximation

// that made implementation easy. See

// - https://github.com/python/cpython/blob/b567b9d74bd9e476a3027335873bb0508d6e450f/Lib/posixpath.py#L31-L38

// - https://github.com/python/cpython/blob/b567b9d74bd9e476a3027335873bb0508d6e450f/Lib/ntpath.py#L26-L32

// - https://github.com/python/cpython/blob/b567b9d74bd9e476a3027335873bb0508d6e450f/Lib/genericpath.py#L9-L11

result = API::moduleImport(["posixpath", "ntpath", "genericpath"])

}

/** Provides models for the `os.path` module */

module OsPath {

/** Gets a reference to the `os.path.join` function. */

API::Node join() { result = path().getMember("join") }

}

}

/**

* Modeling of path related functions in the `os` module.

* Wrapped in QL module to make it easy to fold/unfold.

*/

module OsFileSystemAccessModeling {

/**

* A call to the `os.fsencode` function.

*

* See https://docs.python.org/3/library/os.html#os.fsencode

*/

private class OsFsencodeCall extends Encoding::Range, DataFlow::CallCfgNode {

OsFsencodeCall() { this = os().getMember("fsencode").getACall() }

override DataFlow::Node getAnInput() {

result in [this.getArg(0), this.getArgByName("filename")]

}

override DataFlow::Node getOutput() { result = this }

override string getFormat() { result = "filesystem" }

}

/**

* A call to the `os.fsdecode` function.

*

* See https://docs.python.org/3/library/os.html#os.fsdecode

*/

private class OsFsdecodeCall extends Decoding::Range, DataFlow::CallCfgNode {

OsFsdecodeCall() { this = os().getMember("fsdecode").getACall() }

override DataFlow::Node getAnInput() {

result in [this.getArg(0), this.getArgByName("filename")]

}

override DataFlow::Node getOutput() { result = this }

override string getFormat() { result = "filesystem" }

override predicate mayExecuteInput() { none() }

}

/**

* Additional taint step from a call to the `os.fspath` function.

*

* See https://docs.python.org/3/library/os.html#os.fspath

*/

private class OsFspathCallAdditionalTaintStep extends TaintTracking::AdditionalTaintStep {

override predicate step(DataFlow::Node nodeFrom, DataFlow::Node nodeTo) {

exists(DataFlow::CallCfgNode call |

call = os().getMember("fspath").getACall() and

nodeFrom in [call.getArg(0), call.getArgByName("path")] and

nodeTo = call

)

}

}

/**

* A call to the `os.open` function.

*

* See https://docs.python.org/3/library/os.html#os.open

*/

class OsOpenCall extends FileSystemAccess::Range, DataFlow::CallCfgNode {

OsOpenCall() { this = os().getMember("open").getACall() }

override DataFlow::Node getAPathArgument() {

result in [this.getArg(0), this.getArgByName("path")]

}

}

/**

* A call to the `os.access` function.

*

* See https://docs.python.org/3/library/os.html#os.access

*/

private class OsAccessCall extends FileSystemAccess::Range, DataFlow::CallCfgNode {

OsAccessCall() { this = os().getMember("access").getACall() }

override DataFlow::Node getAPathArgument() {

result in [this.getArg(0), this.getArgByName("path")]

}

}

/**

* A call to the `os.chdir` function.

*

* See https://docs.python.org/3/library/os.html#os.chdir

*/

private class OsChdirCall extends FileSystemAccess::Range, DataFlow::CallCfgNode {

OsChdirCall() { this = os().getMember("chdir").getACall() }

override DataFlow::Node getAPathArgument() {

result in [this.getArg(0), this.getArgByName("path")]

}

}

/**

* A call to the `os.chflags` function.

*

* See https://docs.python.org/3/library/os.html#os.chflags

*/

private class OsChflagsCall extends FileSystemAccess::Range, DataFlow::CallCfgNode {

OsChflagsCall() { this = os().getMember("chflags").getACall() }

override DataFlow::Node getAPathArgument() {

result in [this.getArg(0), this.getArgByName("path")]

}

}

/**

* A call to the `os.chmod` function.

*

* See https://docs.python.org/3/library/os.html#os.chmod

*/

private class OsChmodCall extends FileSystemAccess::Range, DataFlow::CallCfgNode {

OsChmodCall() { this = os().getMember("chmod").getACall() }

override DataFlow::Node getAPathArgument() {

result in [this.getArg(0), this.getArgByName("path")]

}

}

/**

* A call to the `os.chown` function.

*

* See https://docs.python.org/3/library/os.html#os.chown

*/

private class OsChownCall extends FileSystemAccess::Range, DataFlow::CallCfgNode {

OsChownCall() { this = os().getMember("chown").getACall() }

override DataFlow::Node getAPathArgument() {

result in [this.getArg(0), this.getArgByName("path")]

}

}

/**

* A call to the `os.chroot` function.

*

* See https://docs.python.org/3/library/os.html#os.chroot

*/

private class OsChrootCall extends FileSystemAccess::Range, DataFlow::CallCfgNode {

OsChrootCall() { this = os().getMember("chroot").getACall() }

override DataFlow::Node getAPathArgument() {

result in [this.getArg(0), this.getArgByName("path")]

}

}

/**

* A call to the `os.lchflags` function.

*

* See https://docs.python.org/3/library/os.html#os.lchflags

*/

private class OsLchflagsCall extends FileSystemAccess::Range, DataFlow::CallCfgNode {

OsLchflagsCall() { this = os().getMember("lchflags").getACall() }

override DataFlow::Node getAPathArgument() {

result in [this.getArg(0), this.getArgByName("path")]

}

}

/**

* A call to the `os.lchmod` function.

*

* See https://docs.python.org/3/library/os.html#os.lchmod

*/

private class OsLchmodCall extends FileSystemAccess::Range, DataFlow::CallCfgNode {

OsLchmodCall() { this = os().getMember("lchmod").getACall() }

override DataFlow::Node getAPathArgument() {

result in [this.getArg(0), this.getArgByName("path")]

}

}

/**

* A call to the `os.lchown` function.

*

* See https://docs.python.org/3/library/os.html#os.lchown

*/

private class OsLchownCall extends FileSystemAccess::Range, DataFlow::CallCfgNode {

OsLchownCall() { this = os().getMember("lchown").getACall() }

override DataFlow::Node getAPathArgument() {

result in [this.getArg(0), this.getArgByName("path")]

}

}

/**

* A call to the `os.link` function.

*

* See https://docs.python.org/3/library/os.html#os.link

*/

private class OsLinkCall extends FileSystemAccess::Range, DataFlow::CallCfgNode {

OsLinkCall() { this = os().getMember("link").getACall() }

override DataFlow::Node getAPathArgument() {

result in [

this.getArg(0), this.getArgByName("src"), this.getArg(1), this.getArgByName("dst")

]

}

}

/**

* A call to the `os.listdir` function.

*

* See https://docs.python.org/3/library/os.html#os.listdir

*/

private class OsListdirCall extends FileSystemAccess::Range, DataFlow::CallCfgNode {

OsListdirCall() { this = os().getMember("listdir").getACall() }

override DataFlow::Node getAPathArgument() {

result in [this.getArg(0), this.getArgByName("path")]

}

}

/**

* A call to the `os.lstat` function.

*

* See https://docs.python.org/3/library/os.html#os.lstat

*/

private class OsLstatCall extends FileSystemAccess::Range, DataFlow::CallCfgNode {

OsLstatCall() { this = os().getMember("lstat").getACall() }

override DataFlow::Node getAPathArgument() {

result in [this.getArg(0), this.getArgByName("path")]

}

}

/**

* A call to the `os.mkdir` function.

*

* See https://docs.python.org/3/library/os.html#os.mkdir

*/

private class OsMkdirCall extends FileSystemAccess::Range, DataFlow::CallCfgNode {

OsMkdirCall() { this = os().getMember("mkdir").getACall() }

override DataFlow::Node getAPathArgument() {

result in [this.getArg(0), this.getArgByName("path")]

}

}

/**

* A call to the `os.makedirs` function.

*

* See https://docs.python.org/3/library/os.html#os.makedirs

*/

private class OsMakedirsCall extends FileSystemAccess::Range, DataFlow::CallCfgNode {

OsMakedirsCall() { this = os().getMember("makedirs").getACall() }

override DataFlow::Node getAPathArgument() {

result in [this.getArg(0), this.getArgByName("name")]

}

}

/**

* A call to the `os.mkfifo` function.

*

* See https://docs.python.org/3/library/os.html#os.mkfifo

*/

private class OsMkfifoCall extends FileSystemAccess::Range, DataFlow::CallCfgNode {

OsMkfifoCall() { this = os().getMember("mkfifo").getACall() }

override DataFlow::Node getAPathArgument() {

result in [this.getArg(0), this.getArgByName("path")]

}

}

/**

* A call to the `os.mknod` function.

*

* See https://docs.python.org/3/library/os.html#os.mknod

*/

private class OsMknodCall extends FileSystemAccess::Range, DataFlow::CallCfgNode {

OsMknodCall() { this = os().getMember("mknod").getACall() }

override DataFlow::Node getAPathArgument() {

result in [this.getArg(0), this.getArgByName("path")]

}

}

/**

* A call to the `os.pathconf` function.

*

* See https://docs.python.org/3/library/os.html#os.pathconf

*/

private class OsPathconfCall extends FileSystemAccess::Range, DataFlow::CallCfgNode {

OsPathconfCall() { this = os().getMember("pathconf").getACall() }

override DataFlow::Node getAPathArgument() {

result in [this.getArg(0), this.getArgByName("path")]

}

}

/**

* A call to the `os.readlink` function.

*

* See https://docs.python.org/3/library/os.html#os.readlink

*/

private class OsReadlinkCall extends FileSystemAccess::Range, DataFlow::CallCfgNode {

OsReadlinkCall() { this = os().getMember("readlink").getACall() }

override DataFlow::Node getAPathArgument() {

result in [this.getArg(0), this.getArgByName("path")]

}

}

/**

* A call to the `os.remove` function.

*

* See https://docs.python.org/3/library/os.html#os.remove

*/

private class OsRemoveCall extends FileSystemAccess::Range, DataFlow::CallCfgNode {

OsRemoveCall() { this = os().getMember("remove").getACall() }

override DataFlow::Node getAPathArgument() {

result in [this.getArg(0), this.getArgByName("path")]

}

}

/**

* A call to the `os.removedirs` function.

*

* See https://docs.python.org/3/library/os.html#os.removedirs

*/

private class OsRemovedirsCall extends FileSystemAccess::Range, DataFlow::CallCfgNode {

OsRemovedirsCall() { this = os().getMember("removedirs").getACall() }

override DataFlow::Node getAPathArgument() {

result in [this.getArg(0), this.getArgByName("name")]

}

}

/**

* A call to the `os.rename` function.

*

* See https://docs.python.org/3/library/os.html#os.rename

*/

private class OsRenameCall extends FileSystemAccess::Range, DataFlow::CallCfgNode {

OsRenameCall() { this = os().getMember("rename").getACall() }

override DataFlow::Node getAPathArgument() {

result in [

this.getArg(0), this.getArgByName("src"), this.getArg(1), this.getArgByName("dst")

]

}

}

/**

* A call to the `os.renames` function.

*

* See https://docs.python.org/3/library/os.html#os.renames

*/

private class OsRenamesCall extends FileSystemAccess::Range, DataFlow::CallCfgNode {

OsRenamesCall() { this = os().getMember("renames").getACall() }

override DataFlow::Node getAPathArgument() {

result in [

this.getArg(0), this.getArgByName("old"), this.getArg(1), this.getArgByName("new")

]

}

}

/**

* A call to the `os.replace` function.

*

* See https://docs.python.org/3/library/os.html#os.replace

*/

private class OsReplaceCall extends FileSystemAccess::Range, DataFlow::CallCfgNode {

OsReplaceCall() { this = os().getMember("replace").getACall() }

override DataFlow::Node getAPathArgument() {

result in [

this.getArg(0), this.getArgByName("src"), this.getArg(1), this.getArgByName("dst")

]

}

}

/**

* A call to the `os.rmdir` function.

*

* See https://docs.python.org/3/library/os.html#os.rmdir

*/

private class OsRmdirCall extends FileSystemAccess::Range, DataFlow::CallCfgNode {

OsRmdirCall() { this = os().getMember("rmdir").getACall() }

override DataFlow::Node getAPathArgument() {

result in [this.getArg(0), this.getArgByName("path")]

}

}

/**

* A call to the `os.scandir` function.

*

* See https://docs.python.org/3/library/os.html#os.scandir

*/

private class OsScandirCall extends FileSystemAccess::Range, DataFlow::CallCfgNode {

OsScandirCall() { this = os().getMember("scandir").getACall() }

override DataFlow::Node getAPathArgument() {

result in [this.getArg(0), this.getArgByName("path")]

}

}

/**

* A call to the `os.stat` function.

*

* See https://docs.python.org/3/library/os.html#os.stat

*/

private class OsStatCall extends FileSystemAccess::Range, DataFlow::CallCfgNode {

OsStatCall() { this = os().getMember("stat").getACall() }

override DataFlow::Node getAPathArgument() {

result in [this.getArg(0), this.getArgByName("path")]

}

}

/**

* A call to the `os.statvfs` function.

*

* See https://docs.python.org/3/library/os.html#os.statvfs

*/

private class OsStatvfsCall extends FileSystemAccess::Range, DataFlow::CallCfgNode {

OsStatvfsCall() { this = os().getMember("statvfs").getACall() }

override DataFlow::Node getAPathArgument() {

result in [this.getArg(0), this.getArgByName("path")]

}

}

/**

* A call to the `os.symlink` function.

*

* See https://docs.python.org/3/library/os.html#os.symlink

*/

private class OsSymlinkCall extends FileSystemAccess::Range, DataFlow::CallCfgNode {

OsSymlinkCall() { this = os().getMember("symlink").getACall() }

override DataFlow::Node getAPathArgument() {

result in [

this.getArg(0), this.getArgByName("src"), this.getArg(1), this.getArgByName("dst")

]

}

}

/**

* A call to the `os.truncate` function.

*

* See https://docs.python.org/3/library/os.html#os.truncate

*/

private class OsTruncateCall extends FileSystemAccess::Range, DataFlow::CallCfgNode {

OsTruncateCall() { this = os().getMember("truncate").getACall() }

override DataFlow::Node getAPathArgument() {

result in [this.getArg(0), this.getArgByName("path")]

}

}

/**

* A call to the `os.unlink` function.

*

* See https://docs.python.org/3/library/os.html#os.unlink

*/

private class OsUnlinkCall extends FileSystemAccess::Range, DataFlow::CallCfgNode {

OsUnlinkCall() { this = os().getMember("unlink").getACall() }

override DataFlow::Node getAPathArgument() {

result in [this.getArg(0), this.getArgByName("path")]

}

}

/**

* A call to the `os.utime` function.

*

* See https://docs.python.org/3/library/os.html#os.utime

*/

private class OsUtimeCall extends FileSystemAccess::Range, DataFlow::CallCfgNode {

OsUtimeCall() { this = os().getMember("utime").getACall() }

override DataFlow::Node getAPathArgument() {

result in [this.getArg(0), this.getArgByName("path")]

}

}

/**

* A call to the `os.walk` function.

*

* See https://docs.python.org/3/library/os.html#os.walk

*/

private class OsWalkCall extends FileSystemAccess::Range, DataFlow::CallCfgNode {

OsWalkCall() { this = os().getMember("walk").getACall() }

override DataFlow::Node getAPathArgument() {

result in [this.getArg(0), this.getArgByName("top")]

}

}

/**

* A call to the `os.fwalk` function.

*

* See https://docs.python.org/3/library/os.html#os.fwalk

*/

private class OsFwalkCall extends FileSystemAccess::Range, DataFlow::CallCfgNode {

OsFwalkCall() { this = os().getMember("fwalk").getACall() }

override DataFlow::Node getAPathArgument() {

result in [this.getArg(0), this.getArgByName("top")]

}

}

/**

* A call to the `os.getxattr` function.

*

* See https://docs.python.org/3/library/os.html#os.getxattr

*/

private class OsGetxattrCall extends FileSystemAccess::Range, DataFlow::CallCfgNode {

OsGetxattrCall() { this = os().getMember("getxattr").getACall() }

override DataFlow::Node getAPathArgument() {

result in [this.getArg(0), this.getArgByName("path")]

}

}

/**

* A call to the `os.listxattr` function.

*

* See https://docs.python.org/3/library/os.html#os.listxattr

*/

private class OsListxattrCall extends FileSystemAccess::Range, DataFlow::CallCfgNode {

OsListxattrCall() { this = os().getMember("listxattr").getACall() }

override DataFlow::Node getAPathArgument() {

result in [this.getArg(0), this.getArgByName("path")]

}

}

/**

* A call to the `os.removexattr` function.

*

* See https://docs.python.org/3/library/os.html#os.removexattr

*/

private class OsRemovexattrCall extends FileSystemAccess::Range, DataFlow::CallCfgNode {

OsRemovexattrCall() { this = os().getMember("removexattr").getACall() }

override DataFlow::Node getAPathArgument() {

result in [this.getArg(0), this.getArgByName("path")]

}

}

/**

* A call to the `os.setxattr` function.

*

* See https://docs.python.org/3/library/os.html#os.setxattr

*/

private class OsSetxattrCall extends FileSystemAccess::Range, DataFlow::CallCfgNode {

OsSetxattrCall() { this = os().getMember("setxattr").getACall() }

override DataFlow::Node getAPathArgument() {

result in [this.getArg(0), this.getArgByName("path")]

}

}

/**

* A call to the `os.add_dll_directory` function.

*

* See https://docs.python.org/3/library/os.html#os.add_dll_directory

*/

private class OsAdd_dll_directoryCall extends FileSystemAccess::Range, DataFlow::CallCfgNode {

OsAdd_dll_directoryCall() { this = os().getMember("add_dll_directory").getACall() }

override DataFlow::Node getAPathArgument() {

result in [this.getArg(0), this.getArgByName("path")]

}

}

/**

* A call to the `os.startfile` function.

*

* See https://docs.python.org/3/library/os.html#os.startfile

*/

private class OsStartfileCall extends FileSystemAccess::Range, DataFlow::CallCfgNode {

OsStartfileCall() { this = os().getMember("startfile").getACall() }

override DataFlow::Node getAPathArgument() {

result in [this.getArg(0), this.getArgByName("path")]

}

}

}

/**

* The `os.path` module offers a number of methods for checking if a file exists and/or has certain

* properties, leading to a file system access.