Python: add a flow summary

yoff · yoff · commit b2fbbc6ac5f8 · 2022-09-06T21:29:58.000+02:00
we could consider adding non-value-preserving flow from input to output
diff --git a/python/ql/lib/semmle/python/frameworks/Builtins.qll b/python/ql/lib/semmle/python/frameworks/Builtins.qll
@@ -0,0 +1,24 @@
+/**
+ * Provides classes modeling security-relevant aspects of built-ins.
+ */
+
+import python
+private import semmle.python.dataflow.new.FlowSummary
+private import semmle.python.ApiGraphs
+
+/** A flow summary for `reversed`. */
+class ReversedSummary extends SummarizedCallable {
+  ReversedSummary() { this = "builtins.reversed" }
+
+  override CallNode getACall() { result = API::builtin("reversed").getACall().getNode() }
+
+  override DataFlow::ArgumentNode getACallback() {
+    result = API::builtin("reversed").getAValueReachableFromSource()
+  }
+
+  override predicate propagatesFlowExt(string input, string output, boolean preservesValue) {
+    input = "Argument[0].ListElement" and
+    output = "ReturnValue.ListElement" and
+    preservesValue = true
+  }
+}
