Skip to content

Python: Add exception, reachability, and other kinds of modelling #21668

New issue

Have a question about this project? Sign up for a free GitHub account to open an issue and contact its maintainers and the community.

Sign up for GitHub

By clicking “Sign up for GitHub”, you agree to our terms of service and privacy statement. We’ll occasionally send you account related emails.

Already on GitHub? Sign in to your account

Open
tausbn wants to merge 7 commits into
base: main
Choose a base branch
from
+444 −68
Open

Python: Add exception, reachability, and other kinds of modelling #21668

Changes from 1 commit
Commits
Show all changes
7 commits
Select commit Hold shift + click to select a range
e14d493
Python: Move exception modelling to DataFlowDispatch.qll
tausbn Mar 23, 2026
993311e
Python: Add Reachability module
tausbn Feb 24, 2026
6efedb7
Python: Extend ExceptionTypes API
tausbn Feb 24, 2026
ec9e72e
Python: Add `getClassName` for immutable literals
tausbn Mar 23, 2026
3e7986a
Python: Extend reachability analysis with common guards
tausbn Feb 25, 2026
205466d
Python: Model undefinedness
tausbn Feb 27, 2026
ca59ca0
Python: Add globallyDefinedName and extend monkeyPatchedBuiltin
tausbn Mar 23, 2026
File filter

Filter by extension

Filter by extension
Conversations
Failed to load comments.
Loading
Jump to
Jump to file
Failed to load files.
Loading
Diff view
Diff view
Prev Previous commit
Next Next commit
Python: Extend reachability analysis with common guards 
Adds `if False: ...` and `if typing.TYPE_CHECKING: ...` to the set of
nodes that are unlikely to be reachable.
  • Loading branch information
@tausbn
tausbn committed Apr 8, 2026
commit 3e7986a14a61147239653e036d18d7de055457ef
18 changes: 18 additions & 0 deletions python/ql/lib/semmle/python/dataflow/new/internal/DataFlowDispatch.qll
View file
Open in desktop
Original file line number Diff line number Diff line change
Expand Up @@ -2446,6 +2446,24 @@ module Reachability {
// Exception edge from a node that is unlikely to raise
unlikelyToRaise(node) and
succ = node.getAnExceptionalSuccessor()
or
// True branch of `if False:` or `if TYPE_CHECKING:`
isAlwaysFalseGuard(node) and
succ = node.getATrueSuccessor()
Comment on lines +2483 to +2484
Copy link
Copy Markdown
Contributor

@yoff yoff Apr 14, 2026

Choose a reason for hiding this comment

The reason will be displayed to describe this comment to others. Learn more.

This seems a bit specific and ad-hoc. Do we happen to know that this is the prevalent pattern? I guess if false is a quick way to comment out stuff. Did the extractor prune these at some point?

Copy link
Copy Markdown
Contributor Author

@tausbn tausbn Apr 14, 2026

Choose a reason for hiding this comment

The reason will be displayed to describe this comment to others. Learn more.

This was indeed added to remove a bunch of false positives. I think these were implicitly pruned by the reachability check inherent to points-to (i.e. the fact that unreachable branches simply have no points-to information available).

}

/**
* Holds if `node` is a condition that is always `False` at runtime.
* This covers `if False:` and `if typing.TYPE_CHECKING:`.
*/
private predicate isAlwaysFalseGuard(ControlFlowNode node) {
node.getNode() instanceof False
or
node =
API::moduleImport("typing")
.getMember("TYPE_CHECKING")
.getAValueReachableFromSource()
.asCfgNode()
}

private predicate startBbLikelyReachable(BasicBlock b) {
Expand Down