Python: Make multipleArgumentCallExclude more specific

RasmusWL · RasmusWL · commit f9d7becd04fd · 2023-11-21T15:57:12.000+01:00
diff --git a/python/ql/consistency-queries/DataFlowConsistency.ql b/python/ql/consistency-queries/DataFlowConsistency.ql
@@ -50,7 +50,16 @@ private module Input implements InputSig<PythonDataFlow> {
   }
 
   predicate multipleArgumentCallExclude(ArgumentNode arg, DataFlowCall call) {
-    isArgumentNode(arg, call, _)
+    // since we can have multiple DataFlowCall for a CallNode (for example if can
+    // resolve to multiple functions), but we only make _one_ ArgumentNode for each
+    // argument in the CallNode, we end up violating this consistency check in those
+    // cases. (see `getCallArg` in DataFlowDispatch.qll)
+    exists(DataFlowCall other, CallNode cfgCall | other != call |
+      call.getNode() = cfgCall and
+      other.getNode() = cfgCall and
+      isArgumentNode(arg, call, _) and
+      isArgumentNode(arg, other, _)
+    )
   }
 }
 

Original file line number	Diff line number	Diff line change
`@@ -50,7 +50,16 @@ private module Input implements InputSig<PythonDataFlow> {`
`50`	`50`	`}`
`51`	`51`
`52`	`52`	`predicate multipleArgumentCallExclude(ArgumentNode arg, DataFlowCall call) {`
`53`		`- isArgumentNode(arg, call, _)`
	`53`	`+ // since we can have multiple DataFlowCall for a CallNode (for example if can`
	`54`	`+ // resolve to multiple functions), but we only make _one_ ArgumentNode for each`
	`55`	`+ // argument in the CallNode, we end up violating this consistency check in those`
	`56`	+ // cases. (see `getCallArg` in DataFlowDispatch.qll)
	`57`	`+ exists(DataFlowCall other, CallNode cfgCall \| other != call \|`
	`58`	`+ call.getNode() = cfgCall and`
	`59`	`+ other.getNode() = cfgCall and`
	`60`	`+ isArgumentNode(arg, call, _) and`
	`61`	`+ isArgumentNode(arg, other, _)`
	`62`	`+ )`
`54`	`63`	`}`
`55`	`64`	`}`
`56`	`65`