import python

private import semmle.python.objects.TObject

private import semmle.python.objects.ObjectInternal

private import semmle.python.pointsto.Filters

private import semmle.python.pointsto.PointsToContext

private import semmle.python.pointsto.MRO

private import semmle.python.types.Builtins

private import semmle.python.types.Extensions

private import semmle.python.pointsto.Context

private import semmle.python.internal.CachedStages

private import semmle.python.types.Object

private import semmle.python.types.FunctionObject

private import semmle.python.types.ClassObject

private import semmle.python.pointsto.Base

private import semmle.python.types.ImportTime

/* Use this version for speed */

class CfgOrigin extends @py_object {

/** Gets a textual representation of this element. */

string toString() {

/* Not to be displayed */

result = "CfgOrigin"

}

/**

* Get a `ControlFlowNode` from `this` or `here`.

* If `this` is a ControlFlowNode then use that, otherwise fall back on `here`

*/

pragma[inline]

ControlFlowNode asCfgNodeOrHere(ControlFlowNode here) {

result = this

or

not this instanceof ControlFlowNode and result = here

}

ControlFlowNode toCfgNode() { result = this }

pragma[inline]

CfgOrigin fix(ControlFlowNode here) {

if this = Builtin::unknown() then result = here else result = this

}

}

module CfgOrigin {

CfgOrigin fromCfgNode(ControlFlowNode f) { result = f }

CfgOrigin unknown() { result = Builtin::unknown() }

CfgOrigin fromObject(ObjectInternal obj) {

obj.isBuiltin() and result = unknown()

or

result = obj.getOrigin()

}

}

/* Use this version for stronger type-checking */

//private newtype TCfgOrigin =

// TUnknownOrigin()

// or

// TFlowNodeOrigin(ControlFlowNode f)

//

//library class CfgOrigin extends TCfgOrigin {

//

// string toString() {

// /* Not to be displayed */

// result = "CfgOrigin"

// }

//

// /** Get a `ControlFlowNode` from `this` or `here`.

// * If `this` is a ControlFlowNode then use that, otherwise fall back on `here`

// */

// pragma[inline]

// ControlFlowNode asCfgNodeOrHere(ControlFlowNode here) {

// this = TUnknownOrigin() and result = here

// or

// this = TFlowNodeOrigin(result)

// }

//

// ControlFlowNode toCfgNode() {

// this = TFlowNodeOrigin(result)

// }

//

// pragma[inline]

// CfgOrigin fix(ControlFlowNode here) {

// this = TUnknownOrigin() and result = TFlowNodeOrigin(here)

// or

// not this = TUnknownOrigin() and result = this

// }

//

//}

//

//module CfgOrigin {

//

// CfgOrigin fromCfgNode(ControlFlowNode f) {

// result = TFlowNodeOrigin(f)

// }

//

// CfgOrigin unknown() {

// result = TUnknownOrigin()

// }

//

// CfgOrigin fromObject(ObjectInternal obj) {

// obj.isBuiltin() and result = unknown()

// or

// result = fromCfgNode(obj.getOrigin())

// }

//

//}

/* The API */

module PointsTo {

predicate pointsTo(

ControlFlowNode f, PointsToContext context, ObjectInternal value, ControlFlowNode origin

) {

PointsToInternal::pointsTo(f, context, value, origin)

}

predicate variablePointsTo(

EssaVariable var, PointsToContext context, ObjectInternal value, CfgOrigin origin

) {

PointsToInternal::variablePointsTo(var, context, value, origin)

}

/* Backwards compatibility */

cached

predicate points_to(

ControlFlowNode f, PointsToContext context, Object obj, ClassObject cls, ControlFlowNode origin

) {

exists(ObjectInternal value |

PointsToInternal::pointsTo(f, context, value, origin) and

cls = value.getClass().getSource()

|

obj = value.getSource()

or

value.useOriginAsLegacyObject() and obj = origin

)

or

/* Backwards compatibility for *args and **kwargs */

exists(Function func | obj = f and origin = f and context.isRuntime() |

func.getVararg() = f.getNode() and cls = theTupleType()

or

func.getKwarg() = f.getNode() and cls = theDictType()

)

or

not f.isParameter() and

exists(ObjectInternal value |

PointsToInternal::pointsTo(f.(DefinitionNode).getValue(), context, value, origin) and

cls = value.getClass().getSource()

|

obj = value.getSource()

or

value.useOriginAsLegacyObject() and obj = origin

)

}

cached

predicate moduleExports(ModuleObjectInternal mod, string name) {

InterModulePointsTo::moduleExportsBoolean(mod, name) = true

}

}

cached

module PointsToInternal {

pragma[noinline]

cached

predicate importCtxPointsTo(ControlFlowNode f, ObjectInternal value, ControlFlowNode origin) {

PointsToInternal::pointsTo(f, any(Context ctx | ctx.isImport()), value, origin)

}

/** INTERNAL -- Use `f.refersTo(value, origin)` instead. */

cached

predicate pointsTo(

ControlFlowNode f, PointsToContext context, ObjectInternal value, ControlFlowNode origin

) {

points_to_candidate(f, context, value, origin) and

reachableBlock(f.getBasicBlock(), context)

}

cached

predicate pointsToString(ControlFlowNode f, PointsToContext context, string value) {

exists(ObjectInternal str |

PointsToInternal::pointsTo(f, context, str, _) and

str.strValue() = value

)

}

private predicate points_to_candidate(

ControlFlowNode f, PointsToContext context, ObjectInternal value, ControlFlowNode origin

) {

use_points_to(f, context, value, origin)

or

attribute_load_points_to(f, context, value, origin)

or

Expressions::pointsTo(f, context, value, origin, _, _)

or

if_exp_points_to(f, context, value, origin)

or

origin = f and value.introducedAt(f, context)

or

InterModulePointsTo::import_points_to(f, context, value, origin)

or

InterModulePointsTo::from_import_points_to(f, context, value, origin)

or

InterProceduralPointsTo::call_points_to(f, context, value, origin)

or

AttributePointsTo::pointsTo(f, context, value, origin)

or

f.(PointsToExtension).pointsTo(context, value, origin)

or

iteration_points_to(f, context, value, origin)

}

/**

* Holds if the attribute `name` is required for `obj`

* For object `x` and attribute `name` it means that there exists somewhere in the code

* `x.name` or `getattr(x, "name")`.

*/

cached

predicate attributeRequired(ObjectInternal obj, string name) {

pointsTo(any(AttrNode a).getObject(name), _, obj, _)

or

Expressions::getattr_call(_, _, _, obj, name)

}

/* Holds if BasicBlock `b` is reachable, given the context `context`. */

cached

predicate reachableBlock(BasicBlock b, PointsToContext context) {

exists(Scope scope |

context.appliesToScope(scope) and

scope.getEntryNode().getBasicBlock() = b

)

or

reachableEdge(_, b, context)

or

exists(BasicBlock pred |

reachableBlock(pred, context) and

pred.alwaysReaches(b)

)

}

private predicate reachableEdge(BasicBlock pred, BasicBlock succ, PointsToContext context) {

reachableBlock(pred, context) and

(

pred.getAnUnconditionalSuccessor() = succ

or

exists(ObjectInternal value, boolean sense, ControlFlowNode test |

test = pred.getLastNode() and

pointsTo(test, context, value, _) and

sense = value.booleanValue()

|

sense = true and succ = pred.getATrueSuccessor()

or

sense = false and succ = pred.getAFalseSuccessor()

)

)

}

/** Gets an object pointed to by a use (of a variable). */

pragma[noinline]

private predicate use_points_to(

NameNode f, PointsToContext context, ObjectInternal value, ControlFlowNode origin

) {

exists(CfgOrigin origin_or_obj |

value != ObjectInternal::undefined() and

use_points_to_maybe_origin(f, context, value, origin_or_obj)

|

origin = origin_or_obj.asCfgNodeOrHere(f)

)

}

pragma[noinline]

private predicate use_points_to_maybe_origin(

NameNode f, PointsToContext context, ObjectInternal value, CfgOrigin origin_or_obj

) {

variablePointsTo(fast_local_variable(f), context, value, origin_or_obj)

or

name_lookup_points_to_maybe_origin(f, context, value, origin_or_obj)

or

not exists(fast_local_variable(f)) and

not exists(name_local_variable(f)) and

global_lookup_points_to_maybe_origin(f, context, value, origin_or_obj)

}

/** Holds if `var` refers to `(value, origin)` given the context `context`. */

cached

predicate variablePointsTo(

EssaVariable var, PointsToContext context, ObjectInternal value, CfgOrigin origin

) {

ssa_definition_points_to(var.getDefinition(), context, value, origin)

or

exists(EssaVariable prev |

ssaShortCut(prev, var) and

variablePointsTo(prev, context, value, origin)

)

}

private predicate ssaShortCut(EssaVariable start, EssaVariable end) {

end.getDefinition().(PhiFunction).getShortCircuitInput() = start

or

/* Attribute assignments have no effect as far as value tracking is concerned, except for `__class__`. */

exists(AttributeAssignment def |

not def.getName() = "__class__" and

start = def.getInput() and

end.getDefinition() = def

)

or

/*

* Ignore the effects of calls on their arguments. PointsTo is an approximation,

* but attempting to improve accuracy would be very expensive for very little gain.

*/

exists(ArgumentRefinement def |

start = def.getInput() and

end.getDefinition() = def

)

}

pragma[noinline]

private predicate name_lookup_points_to_maybe_origin(

NameNode f, PointsToContext context, ObjectInternal value, CfgOrigin origin_or_obj

) {

exists(EssaVariable var | var = name_local_variable(f) |

variablePointsTo(var, context, value, origin_or_obj)

)

or

local_variable_undefined(f, context) and

global_lookup_points_to_maybe_origin(f, context, value, origin_or_obj)

}

pragma[noinline]

private predicate local_variable_undefined(NameNode f, PointsToContext context) {

variablePointsTo(name_local_variable(f), context, ObjectInternal::undefined(), _)

}

pragma[noinline]

private predicate global_lookup_points_to_maybe_origin(

NameNode f, PointsToContext context, ObjectInternal value, CfgOrigin origin_or_obj

) {

variablePointsTo(global_variable(f), context, value, origin_or_obj)

or

exists(ControlFlowNode origin | origin_or_obj = CfgOrigin::fromCfgNode(origin) |

variablePointsTo(global_variable(f), context, ObjectInternal::undefined(), _) and

potential_builtin_points_to(f, value, origin)

or

not exists(global_variable(f)) and

context.appliesToScope(f.getScope()) and

potential_builtin_points_to(f, value, origin)

)

}

/** The ESSA variable with fast-local lookup (LOAD_FAST bytecode). */

private EssaVariable fast_local_variable(NameNode n) {

n.isLoad() and

result.getASourceUse() = n and

result.getSourceVariable() instanceof FastLocalVariable

}

/** The ESSA variable with name-local lookup (LOAD_NAME bytecode). */

private EssaVariable name_local_variable(NameNode n) {

n.isLoad() and

result.getASourceUse() = n and

result.getSourceVariable() instanceof NameLocalVariable

}

/** The ESSA variable for the global variable lookup. */

private EssaVariable global_variable(NameNode n) {

n.isLoad() and

result.getASourceUse() = n and

result.getSourceVariable() instanceof GlobalVariable

}

/** Holds if `f` is an attribute `x.attr` and points to `(value, cls, origin)`. */

pragma[noinline]

private predicate attribute_load_points_to(

AttrNode f, PointsToContext context, ObjectInternal value, ControlFlowNode origin

) {

none()

// TO DO -- Support CustomPointsToAttribute

//or

//exists(CustomPointsToAttribute object, string name |

// pointsTo(f.getObject(name), context, object, _, _) and

// object.attributePointsTo(name, value, cls, origin)

//)

}

/*

* Treat `ForNode` as intermediate step between sequence and iteration variable.

* In otherwords treat `for i in x:` as being equivalent to `i = next(iter(x))`

* attaching the value of `next(iter(x))` to the `ForNode`.

*/

pragma[noinline]

private predicate iteration_points_to(

ForNode for, PointsToContext context, ObjectInternal value, ControlFlowNode origin

) {

exists(ControlFlowNode seqNode, ObjectInternal seq |

for.iterates(_, seqNode) and

pointsTo(seqNode, context, seq, _) and

value = seq.getIterNext() and

origin = for

)

}

/** Holds if the ESSA definition `def` refers to `(value, origin)` given the context `context`. */

private predicate ssa_definition_points_to(

EssaDefinition def, PointsToContext context, ObjectInternal value, CfgOrigin origin

) {

ssa_phi_points_to(def, context, value, origin)

or

exists(ControlFlowNode orig |

ssa_node_definition_points_to(def, context, value, orig) and

origin = CfgOrigin::fromCfgNode(orig)

)

or

ssa_filter_definition_points_to(def, context, value, origin)

or

ssa_node_refinement_points_to(def, context, value, origin)

}

pragma[noinline]

private predicate ssa_node_definition_points_to(

EssaNodeDefinition def, PointsToContext context, ObjectInternal value, ControlFlowNode origin

) {

reachableBlock(def.getDefiningNode().getBasicBlock(), context) and

ssa_node_definition_points_to_unpruned(def, context, value, origin)

}

pragma[nomagic]

private predicate ssa_node_definition_points_to_unpruned(

EssaNodeDefinition def, PointsToContext context, ObjectInternal value, ControlFlowNode origin

) {

InterProceduralPointsTo::parameter_points_to(def, context, value, origin)

or

assignment_points_to(def, context, value, origin)

or

multi_assignment_points_to(def, context, value, origin)

or

self_parameter_points_to(def, context, value, origin)

or

delete_points_to(def, context, value, origin)

or

module_name_points_to(def, context, value, origin)

or

scope_entry_points_to(def, context, value, origin)

or

InterModulePointsTo::implicit_submodule_points_to(def, value, origin) and context.isImport()

/*

* No points-to for non-local function entry definitions yet.

*/

}

pragma[noinline]

private predicate ssa_node_refinement_points_to(

EssaNodeRefinement def, PointsToContext context, ObjectInternal value, CfgOrigin origin

) {

method_callsite_points_to(def, context, value, origin)

or

InterModulePointsTo::import_star_points_to(def, context, value, origin)

or

attribute_assignment_points_to(def, context, value, origin)

or

InterProceduralPointsTo::callsite_points_to(def, context, value, origin)

or

attribute_delete_points_to(def, context, value, origin)

or

uni_edged_pi_points_to(def, context, value, origin)

}

/** Pass through for `self` for the implicit re-definition of `self` in `self.foo()`. */

private predicate method_callsite_points_to(

MethodCallsiteRefinement def, PointsToContext context, ObjectInternal value, CfgOrigin origin

) {

/* The value of self remains the same, only the attributes may change */

variablePointsTo(def.getInput(), context, value, origin)

}

/** Attribute deletions have no effect as far as value tracking is concerned. */

pragma[noinline]

private predicate attribute_delete_points_to(

EssaAttributeDeletion def, PointsToContext context, ObjectInternal value, CfgOrigin origin

) {

variablePointsTo(def.getInput(), context, value, origin)

}

/** Attribute assignments have no effect as far as value tracking is concerned, except for `__class__`. */

pragma[noinline]

private predicate attribute_assignment_points_to(

AttributeAssignment def, PointsToContext context, ObjectInternal value, CfgOrigin origin

) {

def.getName() = "__class__" and

exists(ObjectInternal cls |

pointsTo(def.getValue(), context, cls, _) and

value = TUnknownInstance(cls) and

origin = CfgOrigin::fromCfgNode(def.getDefiningNode())

)

}

private predicate self_parameter_points_to(

ParameterDefinition def, PointsToContext context, ObjectInternal value, ControlFlowNode origin

) {

origin = def.getDefiningNode() and

value.(SelfInstanceInternal).parameterAndContext(def, context)

}

/** Holds if ESSA edge refinement, `def`, refers to `(value, cls, origin)`. */

private predicate ssa_filter_definition_points_to(

PyEdgeRefinement def, PointsToContext context, ObjectInternal value, CfgOrigin origin

) {

exists(ControlFlowNode orig |

def.getSense() = ssa_filter_definition_bool(def, context, value, orig) and

origin = CfgOrigin::fromCfgNode(orig)

)

}

pragma[noinline]

private boolean ssa_filter_definition_bool(

PyEdgeRefinement def, PointsToContext context, ObjectInternal value, ControlFlowNode origin

) {

result =

Conditionals::testEvaluates(def.getTest(), def.getInput().getASourceUse(), context, value,

origin)

}

/** Holds if ESSA definition, `unipi`, refers to `(value, origin)`. */

pragma[noinline]

private predicate uni_edged_pi_points_to(

SingleSuccessorGuard unipi, PointsToContext context, ObjectInternal value, CfgOrigin origin

) {

exists(ControlFlowNode test, ControlFlowNode use, ControlFlowNode orig |

/*

* Because calls such as `len` may create a new variable, we need to go via the source variable

* That is perfectly safe as we are only dealing with calls that do not mutate their arguments.

*/

unipi.useAndTest(use, test) and

unipi.getSense() = Conditionals::testEvaluates(test, use, context, value, orig) and

origin = CfgOrigin::fromCfgNode(orig)

)

}

/** Points-to for normal assignments `def = ...`. */

pragma[noinline]

private predicate assignment_points_to(

AssignmentDefinition def, PointsToContext context, ObjectInternal value, ControlFlowNode origin

) {

pointsTo(def.getValue(), context, value, origin)

}

pragma[nomagic]

private predicate sequence_index_points_to(

ControlFlowNode f, PointsToContext context, SequenceObjectInternal sequence,

ObjectInternal value, int index

) {

pointsTo(f, context, sequence, _) and

value = sequence.getItem(index)

}

pragma[noinline]

private predicate multi_assignment_points_to(

MultiAssignmentDefinition def, PointsToContext context, ObjectInternal value,

ControlFlowNode origin

) {

exists(int index, ControlFlowNode lhs, ControlFlowNode rhs, ObjectInternal sequence |

def.indexOf(index, lhs) and

lhs.(DefinitionNode).getValue() = rhs and

origin = def.getDefiningNode()

|

sequence_index_points_to(rhs, context, sequence, value, index)

or

pointsTo(rhs, context, sequence, _) and

sequence.subscriptUnknown() and

value = TUnknown()

)

}

/** Points-to for deletion: `del name`. */

pragma[noinline]

private predicate delete_points_to(

DeletionDefinition def, PointsToContext context, ObjectInternal value, ControlFlowNode origin

) {

value = ObjectInternal::undefined() and

origin = def.getDefiningNode() and

context.appliesToScope(def.getScope())

}

/** Implicit "definition" of `__name__` at the start of a module. */

pragma[noinline]

private predicate module_name_points_to(

ScopeEntryDefinition def, PointsToContext context, ObjectInternal value, ControlFlowNode origin

) {

def.getVariable().getName() = "__name__" and

exists(Module m | m = def.getScope() |

value = module_dunder_name(m) and context.isImport()

or

value.strValue() = "__main__" and context.isMain() and context.appliesToScope(m)

) and

origin = def.getDefiningNode()

}

private ObjectInternal module_dunder_name(Module m) {

exists(string name | result.strValue() = name |

if m.isPackageInit() then name = m.getPackage().getName() else name = m.getName()

)

}

/** Holds if the phi-function `phi` refers to `(value, origin)` given the context `context`. */

pragma[nomagic]

private predicate ssa_phi_points_to(

PhiFunction phi, PointsToContext context, ObjectInternal value, CfgOrigin origin

) {

exists(EssaVariable input |

ssa_phi_reachable_from_input(phi, context, input) and

variablePointsTo(input, context, value, origin)

)

}

/* Helper for ssa_phi_points_to */

cached

predicate ssa_phi_reachable_from_input(

PhiFunction phi, PointsToContext context, EssaVariable input

) {

exists(BasicBlock pred |

input = phi.getInput(pred) and

reachableEdge(pred, phi.getBasicBlock(), context)

)

}

/** Points-to for implicit variable declarations at scope-entry. */

pragma[noinline]

private predicate scope_entry_points_to(

ScopeEntryDefinition def, PointsToContext context, ObjectInternal value, ControlFlowNode origin

) {

/* Transfer from another scope */

exists(EssaVariable var, PointsToContext outer, CfgOrigin orig |

InterProceduralPointsTo::scope_entry_value_transfer(var, outer, def, context) and

variablePointsTo(var, outer, value, orig) and

origin = orig.asCfgNodeOrHere(def.getDefiningNode())

)

or

/* Undefined variable */

undefined_variable(def, context, value, origin)

or

/* Builtin not defined in outer scope */

builtin_not_in_outer_scope(def, context, value, origin)

}

pragma[nomagic]

private predicate undefined_variable(

ScopeEntryDefinition def, PointsToContext context, ObjectInternal value, ControlFlowNode origin

) {

exists(Scope scope |

not def.getVariable().getName() = "__name__" and

not def.getVariable().isMetaVariable() and

def.getScope() = scope and

context.appliesToScope(scope)

|

def.getSourceVariable() instanceof GlobalVariable and scope instanceof Module

or

def.getSourceVariable() instanceof LocalVariable and

(context.isImport() or context.isRuntime() or context.isMain())

) and

value = ObjectInternal::undefined() and

origin = def.getDefiningNode()

}

pragma[nomagic]

private predicate builtin_not_in_outer_scope(

ScopeEntryDefinition def, PointsToContext context, ObjectInternal value, ControlFlowNode origin

) {

exists(Module mod, GlobalVariable var |

var = def.getSourceVariable() and

mod = def.getScope().getEnclosingModule() and

context.appliesToScope(def.getScope()) and

not exists(EssaVariable v | v.getSourceVariable() = var and v.getScope() = mod) and

value = ObjectInternal::builtin(var.getId()) and

origin = def.getDefiningNode()

)

}

/** Holds if `f` is an expression node `tval if cond else fval` and points to `(value, origin)`. */

private predicate if_exp_points_to(

IfExprNode f, PointsToContext context, ObjectInternal value, ControlFlowNode origin

) {

pointsTo(f.getAnOperand(), context, value, origin)

}

/* Holds if `import name` will import the module `m`. */

cached

predicate module_imported_as(ModuleObjectInternal m, string name) {

/* Normal imports */

m.getName() = name

or

/* sys.modules['name'] = m */

exists(ControlFlowNode sys_modules_flow, ControlFlowNode n, ControlFlowNode mod |

/* Use previous points-to here to avoid slowing down the recursion too much */

exists(SubscriptNode sub |

sub.getObject() = sys_modules_flow and

pointsTo(sys_modules_flow, _, ObjectInternal::sysModules(), _) and

sub.getIndex() = n and

n.getNode().(StringLiteral).getText() = name and

sub.(DefinitionNode).getValue() = mod and

pointsTo(mod, _, m, _)

)

)

}

}

private module InterModulePointsTo {

pragma[noinline]

predicate import_points_to(

ControlFlowNode f, PointsToContext context, ObjectInternal value, ControlFlowNode origin

) {

exists(string name, ImportExpr i |

i.getAFlowNode() = f and

i.getImportedModuleName() = name and

PointsToInternal::module_imported_as(value, name) and

origin = f and

context.appliesTo(pragma[only_bind_into](f))

)

}

predicate from_import_points_to(

ImportMemberNode f, PointsToContext context, ObjectInternal value, ControlFlowNode origin

) {

from_self_import_points_to(f, context, value, origin)

or

from_other_import_points_to(f, context, value, origin)

}

pragma[noinline]

predicate from_self_import_points_to(

ImportMemberNode f, PointsToContext context, ObjectInternal value, ControlFlowNode origin

) {

exists(EssaVariable var, CfgOrigin orig |

var = ssa_variable_for_module_attribute(f, context) and

PointsToInternal::variablePointsTo(var, context, value, orig) and

origin = orig.asCfgNodeOrHere(f)

)

}

pragma[noinline]

predicate from_other_import_points_to(

ImportMemberNode f, PointsToContext context, ObjectInternal value, ControlFlowNode origin

) {

exists(string name, ModuleObjectInternal mod, CfgOrigin orig |

from_import_imports(f, context, mod, name) and

(mod.getSourceModule() != f.getEnclosingModule() or mod.isBuiltin()) and

mod.attribute(name, value, orig) and

origin = orig.asCfgNodeOrHere(f)

)

or

PointsToInternal::pointsTo(f.getModule(_), context, ObjectInternal::unknown(), _) and

value = ObjectInternal::unknown() and

origin = f

}

private predicate from_import_imports(

ImportMemberNode f, PointsToContext context, ModuleObjectInternal mod, string name

) {

PointsToInternal::pointsTo(f.getModule(name), context, mod, _)

}

pragma[noinline]

private EssaVariable ssa_variable_for_module_attribute(ImportMemberNode f, PointsToContext context) {

exists(string name, ModuleObjectInternal mod, Module m |

mod.getSourceModule() = m and

m = result.getScope() and

PointsToInternal::pointsTo(f.getModule(name), context, mod, _) and

result = ssa_variable_for_module_attribute_helper(f, name, m)

)

}

pragma[noinline]

private EssaVariable ssa_variable_for_module_attribute_helper(

ImportMemberNode f, string name, Module m

) {

result.getSourceVariable().getName() = name and

result.getAUse() = f and

m = f.getEnclosingModule()

}

/* Helper for implicit_submodule_points_to */

private ModuleObjectInternal getModule(ImplicitSubModuleDefinition def) {

exists(PackageObjectInternal package |

package.getSourceModule() = def.getDefiningNode().getScope() and

result = package.submodule(def.getSourceVariable().getName())

)

}

/**

* Implicit "definition" of the names of submodules at the start of an `__init__.py` file.

*

* PointsTo isn't exactly how the interpreter works, but is the best approximation we can manage statically.

*/

pragma[noinline]

predicate implicit_submodule_points_to(

ImplicitSubModuleDefinition def, ModuleObjectInternal value, ControlFlowNode origin

) {

value = getModule(def) and

origin = CfgOrigin::fromObject(value).asCfgNodeOrHere(def.getDefiningNode())

}

/** Points-to for `from ... import *`. */

predicate import_star_points_to(

ImportStarRefinement def, PointsToContext context, ObjectInternal value, CfgOrigin origin

) {

/* Attribute from imported module */

exists(CfgOrigin orig, ImportStarNode imp, ModuleObjectInternal mod, string name |

imp = def.getDefiningNode() and

PointsToInternal::pointsTo(imp.getModule(), context, mod, _) and

name = def.getSourceVariable().getName() and

moduleExportsBoolean(mod, name) = true and

mod.attribute(name, value, orig) and

origin = orig.fix(imp)

)

or

/* Retain value held before import */

exists(EssaVariable var |

variable_not_redefined_by_import_star(var, context, def) and

PointsToInternal::variablePointsTo(var, context, value, origin)

)

}

/** Holds if `def` is technically a definition of `var`, but the `from ... import *` does not in fact define `var`. */

cached

predicate variable_not_redefined_by_import_star(

EssaVariable var, PointsToContext context, ImportStarRefinement def

) {

var = def.getInput() and

exists(ModuleObjectInternal mod |

PointsToInternal::pointsTo(def.getDefiningNode().(ImportStarNode).getModule(), context, mod, _)

|

moduleExportsBoolean(mod, var.getSourceVariable().getName()) = false

or

var.getSourceVariable().getName().charAt(0) = "_"

or

exists(Module m, string name |

m = mod.getSourceModule() and name = var.getSourceVariable().getName()

|

not m.declaredInAll(_) and name.charAt(0) = "_"

)

)

}

predicate ofInterestInExports(ModuleObjectInternal mod, string name) {

exists(ImportStarNode imp, ImportStarRefinement def, EssaVariable var |

imp = def.getDefiningNode() and

PointsToInternal::importCtxPointsTo(imp.getModule(), mod, _) and

var = def.getVariable()

|

if var.isMetaVariable()

then ModuleAttributes::attributePointsTo(def.getInput().getDefinition(), name, _, _)

else def.getVariable().getName() = name

)

or

exists(PackageObjectInternal package |

ofInterestInExports(package, name) and

package.getInitModule() = mod

)

}

private boolean pythonModuleExportsBoolean(PythonModuleObjectInternal mod, string name) {

exists(Module src | src = mod.getSourceModule() |

src.declaredInAll(name) and result = true

or

declared_all_is_simple(src) and

not src.declaredInAll(name) and

ofInterestInExports(mod, name) and

result = false

or

(not src.declaredInAll(name) and not declared_all_is_simple(src)) and

exists(ObjectInternal val | ModuleAttributes::pointsToAtExit(src, name, val, _) |

val = ObjectInternal::undefined() and result = false

or

val != ObjectInternal::undefined() and result = true

)

)

}

/** Holds if __all__ is declared and not mutated */

private predicate declared_all_is_simple(Module m) {

exists(AssignStmt a, GlobalVariable all |

a.defines(all) and

a.getScope() = m and

all.getId() = "__all__" and

not exists(Attribute attr | all.getALoad() = attr.getObject())

)

}

private boolean packageExportsBoolean(PackageObjectInternal mod, string name) {

exists(Folder folder | folder = mod.getFolder() |

exportsSubmodule(folder, name) and result = true

or

not exportsSubmodule(folder, name) and

result = moduleExportsBoolean(mod.getInitModule(), name)

or

mod.hasNoInitModule() and

not exportsSubmodule(folder, name) and

ofInterestInExports(mod, name) and

result = false

)

}

private predicate exportsSubmodule(Folder folder, string name) {

name.regexpMatch("\\p{L}(\\p{L}|\\d|_)*") and

(

folder.getChildContainer(name) instanceof Folder

or

exists(folder.getFile(name + ".py"))

)

}

boolean builtinModuleExportsBoolean(BuiltinModuleObjectInternal mod, string name) {

exists(Builtin bltn | bltn = mod.getBuiltin() |

exists(bltn.getMember(name)) and result = true

or

ofInterestInExports(mod, name) and not exists(bltn.getMember(name)) and result = false

)

}

boolean moduleExportsBoolean(ModuleObjectInternal mod, string name) {

not name.charAt(0) = "_" and

(

result = pythonModuleExportsBoolean(mod, name)

or

result = packageExportsBoolean(mod, name)

or

result = builtinModuleExportsBoolean(mod, name)

)

}

}

cached

module InterProceduralPointsTo {

cached

predicate call(CallNode call, PointsToContext caller, ObjectInternal value) {

PointsToInternal::pointsTo(call.getFunction(), caller, value, _)

}

cached

predicate callWithContext(

CallNode call, PointsToContext caller, ObjectInternal value, PointsToContext callee

) {

callee.fromCall(call, caller) and

PointsToInternal::pointsTo(call.getFunction(), caller, value, _)

}

cached

predicate call_points_to(

CallNode f, PointsToContext context, ObjectInternal value, ControlFlowNode origin

) {

/* Either not a decorator, or we understand the return value */

(value != ObjectInternal::unknown() or not f.isDecoratorCall()) and

call_points_to_from_callee(f, context, value, origin)

or

f.isFunctionDecoratorCall() and

call_points_to_from_callee(f, context, ObjectInternal::unknown(), _) and

value = TDecoratedFunction(f) and

origin = f

or

f.isClassDecoratorCall() and

call_points_to_from_callee(f, context, ObjectInternal::unknown(), _) and

PointsToInternal::pointsTo(f.getArg(0), context, value, origin)

or

Types::six_add_metaclass(f, context, _, _) and

PointsToInternal::pointsTo(f.getArg(0), context, value, origin)

or

Expressions::typeCallPointsTo(f, context, value, origin, _, _)

}

/** Helper for call_points_to to improve join-order */

pragma[noinline]

private predicate call_points_to_from_callee(

CallNode f, PointsToContext context, ObjectInternal value, ControlFlowNode origin

) {

exists(ObjectInternal func | call(f, context, func) |

exists(CfgOrigin orig, PointsToContext callee |

callee.fromCall(f, context) and

func.callResult(callee, value, orig) and

origin = orig.asCfgNodeOrHere(f)

)

or

context.untrackableCall(f) and

func.contextSensitiveCallee() and

value = ObjectInternal::unknown() and

origin = f

or

exists(CfgOrigin orig |

func.callResult(value, orig) and

origin = orig.asCfgNodeOrHere(f)

) and

context.appliesTo(f)

)

}

/** Points-to for parameter. `def foo(param): ...`. */

cached

predicate parameter_points_to(

ParameterDefinition def, PointsToContext context, ObjectInternal value, ControlFlowNode origin

) {