Python: Fix kwarg modeling for os.path.isdir

RasmusWL · RasmusWL · commit a91208fd2c77 · 2021-11-29T14:54:02.000+01:00
diff --git a/python/ql/lib/semmle/python/frameworks/Stdlib.qll b/python/ql/lib/semmle/python/frameworks/Stdlib.qll
@@ -318,20 +318,26 @@ private module StdlibPrivate {
    * - https://docs.python.org/3/library/os.path.html#os.path.realpath
    */
   private class OsPathProbingCall extends FileSystemAccess::Range, DataFlow::CallCfgNode {
+    string name;
+
     OsPathProbingCall() {
-      this =
-        os::path()
-            .getMember([
-                // these check if the file exists
-                "exists", "lexists", "isfile", "isdir", "islink", "ismount",
-                // these raise errors if the file does not exist
-                "getatime", "getmtime", "getctime", "getsize"
-              ])
-            .getACall()
+      name in [
+          // these check if the file exists
+          "exists", "lexists", "isfile", "isdir", "islink", "ismount",
+          // these raise errors if the file does not exist
+          "getatime", "getmtime", "getctime", "getsize"
+        ] and
+      this = os::path().getMember(name).getACall()
     }
 
     override DataFlow::Node getAPathArgument() {
+      not name = "isdir" and
       result in [this.getArg(0), this.getArgByName("path")]
+      or
+      // although the Python docs say the parameter is called `path`, the implementation
+      // actually uses `s`.
+      name = "isdir" and
+      result in [this.getArg(0), this.getArgByName("s")]
     }
   }
 
diff --git a/python/ql/test/library-tests/frameworks/stdlib/FileSystemAccess.py b/python/ql/test/library-tests/frameworks/stdlib/FileSystemAccess.py
@@ -37,7 +37,7 @@ def through_function(open_file):
 os.path.isfile(path="path")  # $ getAPathArgument="path"
 
 os.path.isdir("s")  # $ getAPathArgument="s"
-os.path.isdir(s="s")  # $ MISSING: getAPathArgument="s"
+os.path.isdir(s="s")  # $ getAPathArgument="s"
 
 os.path.islink("path")  # $ getAPathArgument="path"
 os.path.islink(path="path")  # $ getAPathArgument="path"
