Python: Minor performance enhancements.

markshannon · markshannon · commit a5fbbdeaf137 · 2019-06-14T16:16:06.000+01:00
diff --git a/python/ql/src/semmle/python/objects/Instances.qll b/python/ql/src/semmle/python/objects/Instances.qll
@@ -440,16 +440,21 @@ class SuperInstance extends TSuperInstance, ObjectInternal {
     pragma [noinline] override predicate descriptorGetInstance(ObjectInternal instance, ObjectInternal value, CfgOrigin origin) { none() }
 
     pragma [noinline] override predicate attribute(string name, ObjectInternal value, CfgOrigin origin) {
-        PointsToInternal::attributeRequired(this, name) and
         exists(ObjectInternal cls_attr, CfgOrigin attr_orig |
-            this.lookup(name, cls_attr, attr_orig)
+            this.attribute_descriptor(name, cls_attr, attr_orig)
             |
             cls_attr.isDescriptor() = false and value = cls_attr and origin = attr_orig
             or
             cls_attr.isDescriptor() = true and cls_attr.descriptorGetInstance(this.getSelf(), value, origin)
         )
     }
 
+    /* Helper for `attribute` */
+    pragma [noinline] private predicate attribute_descriptor(string name, ObjectInternal cls_attr, CfgOrigin attr_orig) {
+        PointsToInternal::attributeRequired(this, name) and
+        this.lookup(name, cls_attr, attr_orig)
+    }
+
     private predicate lookup(string name, ObjectInternal value, CfgOrigin origin) {
         Types::getMro(this.getSelf().getClass()).startingAt(this.getStartClass()).getTail().lookup(name, value, origin)
     }
diff --git a/python/ql/src/semmle/python/pointsto/PointsTo.qll b/python/ql/src/semmle/python/pointsto/PointsTo.qll
@@ -1856,9 +1856,13 @@ cached module Types {
         result = getInheritedMetaclass(cls, 0)
         or
         // Best guess if base is not a known class
+        hasUnknownBase(cls) and result = ObjectInternal::unknownClass()
+    }
+
+    /* Helper for getInheritedMetaclass */
+    private predicate hasUnknownBase(ClassObjectInternal cls) {
         exists(ObjectInternal base |
-            base = getBase(cls, _) and
-            result = ObjectInternal::unknownClass() |
+            base = getBase(cls, _) |
             base.isClass() = false
             or
             base = ObjectInternal::unknownClass()
@@ -1868,14 +1872,18 @@ cached module Types {
     private ClassObjectInternal getInheritedMetaclass(ClassObjectInternal cls, int n) {
         exists(Class c |
             c = cls.(PythonClassObjectInternal).getScope() and
-            n = count(c.getABase())
+            n = count(c.getABase()) and n != 1
             |
             result = ObjectInternal::type() and major_version() = 3
             or
             result = ObjectInternal::classType() and major_version() = 2
         )
         or
+        base_count(cls) = 1 and n = 0 and
+        result = getBase(cls, 0).getClass()
+        or
         exists(ClassObjectInternal meta1, ClassObjectInternal meta2 |
+            base_count(cls) > 1 and
             meta1 = getBase(cls, n).getClass() and
             meta2 = getInheritedMetaclass(cls, n+1)
             |
diff --git a/python/ql/src/semmle/python/pointsto/PointsToContext.qll b/python/ql/src/semmle/python/pointsto/PointsToContext.qll
@@ -182,7 +182,7 @@ class PointsToContext extends TPointsToContext {
         this = TRuntimeContext() and executes_in_runtime_context(s)
         or
         /* Called functions, regardless of their name */
-        exists(CallableObjectInternal callable, ControlFlowNode call, TPointsToContext outerContext |
+        exists(PythonFunctionObjectInternal callable, ControlFlowNode call, TPointsToContext outerContext |
             call = callable.getACall(outerContext) and
             this = TCallContext(call, outerContext, _) |
             s = callable.getScope()
diff --git a/python/ql/src/semmle/python/security/TaintTracking.qll b/python/ql/src/semmle/python/security/TaintTracking.qll
@@ -1512,7 +1512,7 @@ class CallContext extends TCallContext {
             f.getFunction() = s and f.getACall() = call
         )
         or
-        exists(ClassValue cls,CallNode call |
+        exists(ClassValue cls, CallNode call |
             this = TCalleeContext(call, _, _) and
             call.getFunction().pointsTo(cls) and
             s = cls.lookup("__init__").(CallableValue).getScope() and

Original file line number	Diff line number	Diff line change
`@@ -440,16 +440,21 @@ class SuperInstance extends TSuperInstance, ObjectInternal {`
`440`	`440`	`pragma [noinline] override predicate descriptorGetInstance(ObjectInternal instance, ObjectInternal value, CfgOrigin origin) { none() }`
`441`	`441`
`442`	`442`	`pragma [noinline] override predicate attribute(string name, ObjectInternal value, CfgOrigin origin) {`
`443`		`- PointsToInternal::attributeRequired(this, name) and`
`444`	`443`	`exists(ObjectInternal cls_attr, CfgOrigin attr_orig \|`
`445`		`- this.lookup(name, cls_attr, attr_orig)`
	`444`	`+ this.attribute_descriptor(name, cls_attr, attr_orig)`
`446`	`445`	`\|`
`447`	`446`	`cls_attr.isDescriptor() = false and value = cls_attr and origin = attr_orig`
`448`	`447`	`or`
`449`	`448`	`cls_attr.isDescriptor() = true and cls_attr.descriptorGetInstance(this.getSelf(), value, origin)`
`450`	`449`	`)`
`451`	`450`	`}`
`452`	`451`
	`452`	+ /* Helper for `attribute` */
	`453`	`+ pragma [noinline] private predicate attribute_descriptor(string name, ObjectInternal cls_attr, CfgOrigin attr_orig) {`
	`454`	`+ PointsToInternal::attributeRequired(this, name) and`
	`455`	`+ this.lookup(name, cls_attr, attr_orig)`
	`456`	`+ }`
	`457`	`+`
`453`	`458`	`private predicate lookup(string name, ObjectInternal value, CfgOrigin origin) {`
`454`	`459`	`Types::getMro(this.getSelf().getClass()).startingAt(this.getStartClass()).getTail().lookup(name, value, origin)`
`455`	`460`	`}`
Original file line number	Diff line number	Diff line change
`@@ -1512,7 +1512,7 @@ class CallContext extends TCallContext {`
`1512`	`1512`	`f.getFunction() = s and f.getACall() = call`
`1513`	`1513`	`)`
`1514`	`1514`	`or`
`1515`		`- exists(ClassValue cls,CallNode call \|`
	`1515`	`+ exists(ClassValue cls, CallNode call \|`
`1516`	`1516`	`this = TCalleeContext(call, _, _) and`
`1517`	`1517`	`call.getFunction().pointsTo(cls) and`
`1518`	`1518`	`s = cls.lookup("__init__").(CallableValue).getScope() and`