Python: add consistency exclusions

yoff · yoff · commit b513871b9b64 · 2023-12-14T10:27:15.000+01:00
diff --git a/python/ql/consistency-queries/DataFlowConsistency.ql b/python/ql/consistency-queries/DataFlowConsistency.ql
@@ -44,6 +44,24 @@ private module Input implements InputSig<PythonDataFlow> {
     )
   }
 
+  predicate uniqueEnclosingCallableExclude(Node n) {
+    // `CaptureNode`s miss enclosing calables in some cases.
+    exists(Function func |
+      func = n.(CaptureNode).getSynthesizedCaptureNode().getEnclosingCallable()
+    |
+      // This can happen if `func` is a comprehension.
+      // In that case, there is no associated DataFlowCallable.
+      not exists(func.getDefinition())
+      or
+      func.getADecorator().(Name).getId() = "property"
+    )
+    or
+    // We only have a selection of valid callables.
+    // For instance, we do not have classes as `DataFlowCallable`s.
+    not n.(CaptureNode).getSynthesizedCaptureNode().getEnclosingCallable() instanceof Function and
+    not n.(CaptureNode).getSynthesizedCaptureNode().getEnclosingCallable() instanceof Module
+  }
+
   predicate uniqueCallEnclosingCallableExclude(DataFlowCall call) {
     not exists(call.getLocation().getFile().getRelativePath())
   }
diff --git a/python/ql/lib/semmle/python/dataflow/new/internal/DataFlowImplConsistency.qll b/python/ql/lib/semmle/python/dataflow/new/internal/DataFlowImplConsistency.qll
@@ -40,6 +40,20 @@ private module Input implements InputSig<PythonDataFlow> {
     )
   }
 
+  predicate uniqueEnclosingCallableExclude(Node n) {
+    // `CaptureNode`s miss enclosing calables in some cases.
+    exists(Function func |
+      func = n.(CaptureNode).getSynthesizedCaptureNode().getEnclosingCallable()
+    |
+      // This can happen if `func` is a comprehension.
+      // In that case, there is no associated DataFlowCallable.
+      not exists(func.getDefinition())
+    )
+    or
+    // We do not have classes as `DataFlowCallable`s.
+    n.(CaptureNode).getSynthesizedCaptureNode().getEnclosingCallable() instanceof Class
+  }
+
   predicate uniqueCallEnclosingCallableExclude(DataFlowCall call) {
     not exists(call.getLocation().getFile().getRelativePath())
   }
