Python points-to: Make sure reachability can skip over if-statements.

markshannon · markshannon · commit 0afcb11a1384 · 2019-05-14T11:52:33.000+01:00
diff --git a/python/ql/src/semmle/python/Flow.qll b/python/ql/src/semmle/python/Flow.qll
@@ -1077,6 +1077,22 @@ class BasicBlock extends @py_flow_node {
         not result.(ConditionBlock).controls(this, _)
     }
 
+    /** Holds if flow from this BasicBlock always reaches `succ`
+     */
+    predicate alwaysReaches(BasicBlock succ) {
+        succ = this
+        or
+        strictcount(this.getASuccessor()) = 1
+        and succ = this.getASuccessor()
+        or
+        forex(BasicBlock immsucc |
+            immsucc = this.getASuccessor()
+            |
+            immsucc.alwaysReaches(succ)
+        )
+
+    }
+
 }
 
 private predicate start_bb_likely_reachable(BasicBlock b) {
diff --git a/python/ql/src/semmle/python/pointsto/PointsTo.qll b/python/ql/src/semmle/python/pointsto/PointsTo.qll
@@ -220,6 +220,11 @@ cached module PointsToInternal {
         )
         or
         reachableEdge(_, b, context)
+        or
+        exists(BasicBlock pred |
+            reachableBlock(pred, context) and
+            pred.alwaysReaches(b)
+        )
     }
 
     private predicate reachableEdge(BasicBlock pred, BasicBlock succ, PointsToContext context) {
diff --git a/python/ql/test/query-tests/analysis/pointsto/Pruned.expected b/python/ql/test/query-tests/analysis/pointsto/Pruned.expected
@@ -1 +1 @@
-| 1304 |
+| 1284 |

Original file line number	Diff line number	Diff line change
`@@ -220,6 +220,11 @@ cached module PointsToInternal {`
`220`	`220`	`)`
`221`	`221`	`or`
`222`	`222`	`reachableEdge(_, b, context)`
	`223`	`+ or`
	`224`	`+ exists(BasicBlock pred \|`
	`225`	`+ reachableBlock(pred, context) and`
	`226`	`+ pred.alwaysReaches(b)`
	`227`	`+ )`
`223`	`228`	`}`
`224`	`229`
`225`	`230`	`private predicate reachableEdge(BasicBlock pred, BasicBlock succ, PointsToContext context) {`