Python: Fix bad QL-rewriting

RasmusWL · RasmusWL · commit 5d01cb7c28da · 2020-01-06T13:30:37.000+01:00
Original code:

exists(Expr e, For forloop | forloop = loop and e.pointsTo(_, _, capturing) |
    not loop.contains(e)
)

The new version will preserve the same semantics. The problem with the first
rewrite was that `not loop.(For).somethingMore` would hold for any AstNode that
was not a For
diff --git a/python/ql/src/Variables/LoopVariableCapture.ql b/python/ql/src/Variables/LoopVariableCapture.ql
@@ -33,9 +33,8 @@ predicate escaping_capturing_looping_construct(CallableExpr capturing, AstNode l
     capturing_looping_construct(capturing, loop, var) and
     // Escapes if used out side of for loop or is a lambda in a comprehension
     (
-        exists(Expr e | e.pointsTo(_, _, capturing) |
-            not loop.(For).contains(e)
-        )
+        loop instanceof For and
+        exists(Expr e | e.pointsTo(_, _, capturing) | not loop.contains(e))
         or
         loop.(Comp).getElt() = capturing
         or
