Python points-to: Assorted tweaks to get nore tests passing.

markshannon · markshannon · commit ec080419ba79 · 2019-04-26T16:21:46.000+01:00
diff --git a/python/ql/src/Exceptions/UnguardedNextInGenerator.ql b/python/ql/src/Exceptions/UnguardedNextInGenerator.ql
@@ -16,7 +16,7 @@ FunctionObject iter() {
     result = Object::builtin("iter")
 }
 
-FunctionObject next() {
+BuiltinFunctionObject next() {
     result = Object::builtin("next")
 }
 
diff --git a/python/ql/src/analysis/CallGraphEfficiency.ql b/python/ql/src/analysis/CallGraphEfficiency.ql
@@ -9,15 +9,15 @@ import semmle.python.pointsto.PointsToContext
 
 from int total_facts, int total_size, int depth, float efficiency
 where 
-total_facts = strictcount(ControlFlowNode call, FunctionObject func |
+total_facts = strictcount(ControlFlowNode call, CallableValue func |
     exists(PointsToContext ctx |
-        call = PointsTo::get_a_call(func, ctx) and
+        call = func.getACall(ctx) and
         depth = ctx.getDepth()
     )
 )
 and
-total_size = strictcount(ControlFlowNode call, FunctionObject func, PointsToContext ctx |
-    call = PointsTo::get_a_call(func, ctx) and
+total_size = strictcount(ControlFlowNode call, CallableValue func, PointsToContext ctx |
+    call = func.getACall(ctx) and
     depth = ctx.getDepth()
 )
 and
diff --git a/python/ql/src/analysis/CallGraphMarginalEfficiency.ql b/python/ql/src/analysis/CallGraphMarginalEfficiency.ql
@@ -8,20 +8,20 @@ import semmle.python.pointsto.PointsToContext
 
 from int total_facts, int total_size, int depth, float efficiency
 where 
-total_facts = strictcount(ControlFlowNode call, FunctionObject func |
+total_facts = strictcount(ControlFlowNode call, CallableValue func |
     exists(PointsToContext ctx |
-        call = PointsTo::get_a_call(func, ctx) and
+        call = func.getACall(ctx) and
         depth = ctx.getDepth()
         and not
         exists(PointsToContext shallower |
-            call = PointsTo::get_a_call(func, shallower) and
+        call = func.getACall(shallower) and
             shallower.getDepth() < depth
         )
     )
 )
 and
-total_size = strictcount(ControlFlowNode call, FunctionObject func, PointsToContext ctx |
-    call = PointsTo::get_a_call(func, ctx) and
+total_size = strictcount(ControlFlowNode call, CallableValue func, PointsToContext ctx |
+    call = func.getACall(ctx) and
     depth = ctx.getDepth()
 )
 and
diff --git a/python/ql/src/analysis/KeyPointsToFailure.ql b/python/ql/src/analysis/KeyPointsToFailure.ql
@@ -12,7 +12,7 @@ import python
 predicate points_to_failure(Expr e) {
     exists(ControlFlowNode f | 
         f = e.getAFlowNode() |
-        not f.refersTo(_)
+        not exists(f.pointsTo())
     )
 }
 
diff --git a/python/ql/src/analysis/Pruned.ql b/python/ql/src/analysis/Pruned.ql
@@ -6,7 +6,7 @@ from int size
 
 where
 size = count(ControlFlowNode f |
-    not PointsTo::Test::reachableBlock(f.getBasicBlock(), _)
+    not PointsToInternal::reachableBlock(f.getBasicBlock(), _)
 )
 
 
diff --git a/python/ql/src/semmle/python/pointsto/Filters.qll b/python/ql/src/semmle/python/pointsto/Filters.qll
@@ -31,3 +31,16 @@ predicate issubclass(CallNode fc, ControlFlowNode cls, ControlFlowNode use) {
     fc.getArg(0) = use and cls = fc.getArg(1)
 }
 
+/** Holds if `c` is a test comparing `x` and `y`. `is` is true if the operator is `is` or `==`, it is false if the operator is `is not` or `!=`. */
+predicate equality_test(CompareNode c, ControlFlowNode x, boolean is, ControlFlowNode y) {
+    exists(Cmpop op |
+        c.operands(x, op, y) or
+        c.operands(y, op, x)
+        |
+        (is = true and op instanceof Is or
+         is = false and op instanceof IsNot or
+         is = true and op instanceof Eq or
+         is = false and op instanceof NotEq
+        )
+    )
+}
diff --git a/python/ql/src/semmle/python/pointsto/PointsTo.qll b/python/ql/src/semmle/python/pointsto/PointsTo.qll
@@ -1145,20 +1145,6 @@ module Expressions {
         )
     }
 
-    /** Holds if `c` is a test comparing `x` and `y`. `is` is true if the operator is `is` or `==`, it is false if the operator is `is not` or `!=`. */
-    private predicate equality_test(CompareNode c, ControlFlowNode x, boolean is, ControlFlowNode y) {
-        exists(Cmpop op |
-            c.operands(x, op, y) or
-            c.operands(y, op, x)
-            |
-            (is = true and op instanceof Is or
-             is = false and op instanceof IsNot or
-             is = true and op instanceof Eq or
-             is = false and op instanceof NotEq
-            )
-        )
-    }
-
     pragma [noinline]
     private boolean inequalityEvaluatesTo(ControlFlowNode expr, PointsToContext context, ControlFlowNode use, ObjectInternal val) {
         exists(ControlFlowNode r, boolean sense |
diff --git a/python/ql/src/semmle/python/types/FunctionObject.qll b/python/ql/src/semmle/python/types/FunctionObject.qll
@@ -257,6 +257,10 @@ abstract class BuiltinCallable extends FunctionObject {
 
     abstract override string getQualifiedName();
 
+    override ControlFlowNode getArgumentForCall(CallNode call, int n) {
+        call = this.getACall() and result = call.getArg(n)
+    }
+
 }
 
 class BuiltinMethodObject extends BuiltinCallable {
diff --git a/python/ql/src/semmle/python/types/Object.qll b/python/ql/src/semmle/python/types/Object.qll
@@ -515,6 +515,15 @@ class SuperBoundMethod extends Object {
         result = "super()." + name
     }
 
+    Object getFunction(string fname) {
+        fname = name and
+        exists(SuperInstance sup, BoundMethodObjectInternal m |
+            sup = this.(AttrNode).getObject(name).pointsTo() and
+            sup.attribute(name, m, _) and
+            result = m.getFunction().getSource()
+        )
+    }
+
 }
 
 

Original file line number	Diff line number	Diff line change
`@@ -16,7 +16,7 @@ FunctionObject iter() {`
`16`	`16`	`result = Object::builtin("iter")`
`17`	`17`	`}`
`18`	`18`
`19`		`-FunctionObject next() {`
	`19`	`+BuiltinFunctionObject next() {`
`20`	`20`	`result = Object::builtin("next")`
`21`	`21`	`}`
`22`	`22`
Original file line number	Diff line number	Diff line change
`@@ -9,15 +9,15 @@ import semmle.python.pointsto.PointsToContext`
`9`	`9`
`10`	`10`	`from int total_facts, int total_size, int depth, float efficiency`
`11`	`11`	`where`
`12`		`-total_facts = strictcount(ControlFlowNode call, FunctionObject func \|`
	`12`	`+total_facts = strictcount(ControlFlowNode call, CallableValue func \|`
`13`	`13`	`exists(PointsToContext ctx \|`
`14`		`- call = PointsTo::get_a_call(func, ctx) and`
	`14`	`+ call = func.getACall(ctx) and`
`15`	`15`	`depth = ctx.getDepth()`
`16`	`16`	`)`
`17`	`17`	`)`
`18`	`18`	`and`
`19`		`-total_size = strictcount(ControlFlowNode call, FunctionObject func, PointsToContext ctx \|`
`20`		`- call = PointsTo::get_a_call(func, ctx) and`
	`19`	`+total_size = strictcount(ControlFlowNode call, CallableValue func, PointsToContext ctx \|`
	`20`	`+ call = func.getACall(ctx) and`
`21`	`21`	`depth = ctx.getDepth()`
`22`	`22`	`)`
`23`	`23`	`and`
Original file line number	Diff line number	Diff line change
`@@ -12,7 +12,7 @@ import python`
`12`	`12`	`predicate points_to_failure(Expr e) {`
`13`	`13`	`exists(ControlFlowNode f \|`
`14`	`14`	`f = e.getAFlowNode() \|`
`15`		`- not f.refersTo(_)`
	`15`	`+ not exists(f.pointsTo())`
`16`	`16`	`)`
`17`	`17`	`}`
`18`	`18`
Original file line number	Diff line number	Diff line change
`@@ -6,7 +6,7 @@ from int size`
`6`	`6`
`7`	`7`	`where`
`8`	`8`	`size = count(ControlFlowNode f \|`
`9`		`- not PointsTo::Test::reachableBlock(f.getBasicBlock(), _)`
	`9`	`+ not PointsToInternal::reachableBlock(f.getBasicBlock(), _)`
`10`	`10`	`)`
`11`	`11`
`12`	`12`
Original file line number	Diff line number	Diff line change
`@@ -257,6 +257,10 @@ abstract class BuiltinCallable extends FunctionObject {`
`257`	`257`
`258`	`258`	`abstract override string getQualifiedName();`
`259`	`259`
	`260`	`+ override ControlFlowNode getArgumentForCall(CallNode call, int n) {`
	`261`	`+ call = this.getACall() and result = call.getArg(n)`
	`262`	`+ }`
	`263`	`+`
`260`	`264`	`}`
`261`	`265`
`262`	`266`	`class BuiltinMethodObject extends BuiltinCallable {`
Original file line number	Diff line number	Diff line change
`@@ -515,6 +515,15 @@ class SuperBoundMethod extends Object {`
`515`	`515`	`result = "super()." + name`
`516`	`516`	`}`
`517`	`517`
	`518`	`+ Object getFunction(string fname) {`
	`519`	`+ fname = name and`
	`520`	`+ exists(SuperInstance sup, BoundMethodObjectInternal m \|`
	`521`	`+ sup = this.(AttrNode).getObject(name).pointsTo() and`
	`522`	`+ sup.attribute(name, m, _) and`
	`523`	`+ result = m.getFunction().getSource()`
	`524`	`+ )`
	`525`	`+ }`
	`526`	`+`
`518`	`527`	`}`
`519`	`528`
`520`	`529`