Python: Fix underlying problem of not using Alias

RasmusWL · RasmusWL · commit f1fd9b4c7a9b · 2023-12-08T11:27:52.000+01:00
diff --git a/python/ql/lib/semmle/python/frameworks/internal/SubclassFinder.qll b/python/ql/lib/semmle/python/frameworks/internal/SubclassFinder.qll
@@ -163,12 +163,13 @@ module NotExposed {
       newOrExistingModeling(spec).getASubclass*().getAValueReachableFromSource().asExpr() and
     importMember.getScope() = mod and
     loc = importMember.getLocation() and
-    (
-      mod.isPackageInit() and
-      newAliasFullyQualified = mod.getPackageName() + "." + importMember.getName()
+    exists(Alias alias, string base |
+      mod.isPackageInit() and base = mod.getPackageName()
       or
-      not mod.isPackageInit() and
-      newAliasFullyQualified = mod.getName() + "." + importMember.getName()
+      not mod.isPackageInit() and base = mod.getName()
+    |
+      alias.getValue() = importMember and
+      newAliasFullyQualified = base + "." + alias.getAsname()
     ) and
     (
       not hasAllStatement(mod)
diff --git a/python/ql/test/experimental/library-tests/FindSubclass/Find.expected b/python/ql/test/experimental/library-tests/FindSubclass/Find.expected
@@ -1,4 +1,5 @@
-| Django.Views.View~Subclass | find_subclass_test | Member[View] |
+| Django.Views.View~Subclass | find_subclass_test | Member[clash2] |
+| Django.Views.View~Subclass | find_subclass_test | Member[clash3] |
 | Django.Views.View~Subclass | find_subclass_test | Member[clash] |
 | flask.MethodView~Subclass | find_subclass_test | Member[C] |
 | flask.View~Subclass | find_subclass_test | Member[A] |
@@ -7,6 +8,7 @@
 | flask.View~Subclass | find_subclass_test | Member[ViewAliasInTry] |
 | flask.View~Subclass | find_subclass_test | Member[ViewAlias] |
 | flask.View~Subclass | find_subclass_test | Member[View] |
+| flask.View~Subclass | find_subclass_test | Member[clash2] |
 | flask.View~Subclass | find_subclass_test | Member[clash3] |
 | flask.View~Subclass | find_subclass_test | Member[clash] |
 | flask.View~Subclass | find_subclass_test | Member[complete_module_alias] |
diff --git a/python/ql/test/experimental/library-tests/FindSubclass/find_subclass_test.py b/python/ql/test/experimental/library-tests/FindSubclass/find_subclass_test.py
@@ -21,18 +21,18 @@ class C(flask.views.MethodView):
 if cond:
     from flask.views import View as clash
 else:
-    from django.views.generic import View as clash # $ SPURIOUS: View=Django.Views.View~Subclass
+    from django.views.generic import View as clash
 
 if cond:
-    from flask.views import View as clash2 # $ MISSING
+    from flask.views import View as clash2
 else:
-    from django.views.generic import View as clash2 # $ MISSING
+    from django.views.generic import View as clash2
 print(clash2)
 
 if cond:
     from flask.views import View as clash3
 else:
-    from django.views.generic import View as clash3 # $ MISSING
+    from django.views.generic import View as clash3
     print(clash3)
 
 import flask.views as containing_module_alias # $ MISSING
