support import * in ApiGraphs

erik-krogh · erik-krogh · commit ef5818e243ca · 2022-02-03T23:10:38.000+01:00
diff --git a/python/ql/lib/semmle/python/ApiGraphs.qll b/python/ql/lib/semmle/python/ApiGraphs.qll
@@ -908,6 +908,13 @@ private predicate exports(Module mod, string prop, DataFlow::Node rhs) {
     rhs.asExpr() = assign.getValue() and
     exists(Variable v | assign.defines(v) and prop = v.getId())
   )
-  // TODO: Re-exports.
+  or
+  // `from foo import *`, just forward directly.
+  exists(ImportStar star, Module subMod |
+    star.getEnclosingModule() = mod and
+    mod.getPackage().getName() + "." + star.getImportedModuleName() = subMod.getName() and
+    exports(subMod, prop, rhs)
+  )
+  // TODO: named imports (somehow)
   // TODO: use this predicate with __init__.py?
 }
diff --git a/python/ql/test/library-tests/ApiGraphs/py3/mypkg/bar.py b/python/ql/test/library-tests/ApiGraphs/py3/mypkg/bar.py
@@ -1 +1 @@
-pass
+from foo import *
diff --git a/python/ql/test/library-tests/ApiGraphs/py3/mypkg/foo.py b/python/ql/test/library-tests/ApiGraphs/py3/mypkg/foo.py
@@ -3,4 +3,10 @@
 class MyClass: #$ def=moduleImport("mypkg").getMember("foo").getMember("MyClass")
     def myFunc(self, x): #$ def=moduleImport("mypkg").getMember("foo").getMember("MyClass").getMember("myFunc") use=moduleImport("mypkg").getMember("foo").getMember("MyClass").getMember("myFunc").getParameter(1)
         self.selfThing() #$ use=moduleImport("mypkg").getMember("foo").getMember("MyClass").getMember("myFunc").getParameter(0).getMember("selfThing").getReturn()
-        x.xThing() #$ use=moduleImport("mypkg").getMember("foo").getMember("MyClass").getMember("myFunc").getParameter(1).getMember("xThing").getReturn()
+        x.xThing() #$ use=moduleImport("mypkg").getMember("foo").getMember("MyClass").getMember("myFunc").getParameter(1).getMember("xThing").getReturn()
+
+value2 = 3 #$ def=moduleImport("mypkg").getMember("foo").getMember("value2")
+
+# this entire file is imported from bar.py
+
+value3 = 3 #$ def=moduleImport("mypkg").getMember("bar").getMember("value3")
