Python points-to. Don't let unknown values escape refersTo().

markshannon · markshannon · commit 55511430cba0 · 2019-04-29T12:22:17.000+01:00
diff --git a/python/ql/src/semmle/python/Flow.qll b/python/ql/src/semmle/python/Flow.qll
@@ -244,6 +244,8 @@ class ControlFlowNode extends @py_flow_node {
     /** Gets what this expression might "refer-to" in the given `context`.
      */
     predicate refersTo(Context context, Object obj, ClassObject cls, ControlFlowNode origin) {
+        not obj = unknownValue() and
+        not cls = theUnknownType() and
         PointsTo::points_to(this, context, obj, cls, origin)
     }
 
@@ -252,6 +254,7 @@ class ControlFlowNode extends @py_flow_node {
      * where the class cannot be inferred. 
      */
     predicate refersTo(Object obj, ControlFlowNode origin) {
+        not obj = unknownValue() and
         PointsTo::points_to(this, _, obj, _, origin)
     }
 

Original file line number	Diff line number	Diff line change
`@@ -244,6 +244,8 @@ class ControlFlowNode extends @py_flow_node {`
`244`	`244`	/** Gets what this expression might "refer-to" in the given `context`.
`245`	`245`	`*/`
`246`	`246`	`predicate refersTo(Context context, Object obj, ClassObject cls, ControlFlowNode origin) {`
	`247`	`+ not obj = unknownValue() and`
	`248`	`+ not cls = theUnknownType() and`
`247`	`249`	`PointsTo::points_to(this, context, obj, cls, origin)`
`248`	`250`	`}`
`249`	`251`
`@@ -252,6 +254,7 @@ class ControlFlowNode extends @py_flow_node {`
`252`	`254`	`* where the class cannot be inferred.`
`253`	`255`	`*/`
`254`	`256`	`predicate refersTo(Object obj, ControlFlowNode origin) {`
	`257`	`+ not obj = unknownValue() and`
`255`	`258`	`PointsTo::points_to(this, _, obj, _, origin)`
`256`	`259`	`}`
`257`	`260`