Merge pull request #5535 from tausbn/python-prevent-bad-TCs

codeql-ci · web-flow · commit 3613ceb07faa · 2021-03-29T12:03:08.000+01:00
Approved by yoff
diff --git a/python/ql/src/semmle/python/dataflow/new/internal/DataFlowPrivate.qll b/python/ql/src/semmle/python/dataflow/new/internal/DataFlowPrivate.qll
@@ -1517,10 +1517,13 @@ predicate forReadStep(CfgNode nodeFrom, Content c, Node nodeTo) {
     or
     c instanceof SetElementContent
     or
-    c instanceof TupleElementContent
+    c = small_tuple()
   )
 }
 
+pragma[noinline]
+TupleElementContent small_tuple() { result.getIndex() <= 7 }
+
 /**
  * Holds if `nodeTo` is a read of an attribute (corresponding to `c`) of the object in `nodeFrom`.
  *
diff --git a/python/ql/src/semmle/python/dataflow/new/internal/DataFlowPublic.qll b/python/ql/src/semmle/python/dataflow/new/internal/DataFlowPublic.qll
@@ -467,14 +467,22 @@ class BarrierGuard extends GuardNode {
   }
 }
 
+private predicate comes_from_cfgnode(Node node) {
+  exists(CfgNode first, Node second |
+    simpleLocalFlowStep(first, second) and
+    simpleLocalFlowStep*(second, node)
+  )
+}
+
 /**
  * A data flow node that is a source of local flow. This includes things like
  * - Expressions
  * - Function parameters
  */
 class LocalSourceNode extends Node {
+  cached
   LocalSourceNode() {
-    not simpleLocalFlowStep+(any(CfgNode n), this) and
+    not comes_from_cfgnode(this) and
     not this instanceof ModuleVariableNode
     or
     this = any(ModuleVariableNode mvn).getARead()
@@ -522,15 +530,12 @@ private module Cached {
    * The slightly backwards parametering ordering is to force correct indexing.
    */
   cached
-  predicate hasLocalSource(Node sink, Node source) {
-    // Declaring `source` to be a `SourceNode` currently causes a redundant check in the
-    // recursive case, so instead we check it explicitly here.
-    source = sink and
-    source instanceof LocalSourceNode
+  predicate hasLocalSource(Node sink, LocalSourceNode source) {
+    source = sink
     or
-    exists(Node mid |
-      hasLocalSource(mid, source) and
-      simpleLocalFlowStep(mid, sink)
+    exists(Node second |
+      simpleLocalFlowStep(source, second) and
+      simpleLocalFlowStep*(second, sink)
     )
   }
 

Original file line number	Diff line number	Diff line change
`@@ -1517,10 +1517,13 @@ predicate forReadStep(CfgNode nodeFrom, Content c, Node nodeTo) {`
`1517`	`1517`	`or`
`1518`	`1518`	`c instanceof SetElementContent`
`1519`	`1519`	`or`
`1520`		`- c instanceof TupleElementContent`
	`1520`	`+ c = small_tuple()`
`1521`	`1521`	`)`
`1522`	`1522`	`}`
`1523`	`1523`
	`1524`	`+pragma[noinline]`
	`1525`	`+TupleElementContent small_tuple() { result.getIndex() <= 7 }`
	`1526`	`+`
`1524`	`1527`	`/**`
`1525`	`1528`	* Holds if `nodeTo` is a read of an attribute (corresponding to `c`) of the object in `nodeFrom`.
`1526`	`1529`	`*`