Merge pull request #6843 from RasmusWL/dataflow-bool-expr

Python: Add data-flow for `x or y` and `x and y`

Author: yoff

python/change-notes/2021-10-08-add-dataflow-for-boolean-expressions.md

@@ -0,0 +1,3 @@
+lgtm,codescanning
+* Added data-flow from both `x` and `y` to `x or y` and `x and y`, as a slight over-approximation of what is described in the
+  [Python Language Reference](https://docs.python.org/3/reference/expressions.html#boolean-operations).

python/ql/lib/semmle/python/dataflow/new/internal/DataFlowPrivate.qll

@@ -200,6 +200,9 @@ module EssaFlow {
     // If expressions
     nodeFrom.asCfgNode() = nodeTo.asCfgNode().(IfExprNode).getAnOperand()
     or
+    // boolean inline expressions such as `x or y` or `x and y`
+    nodeFrom.asCfgNode() = nodeTo.asCfgNode().(BoolExprNode).getAnOperand()
+    or
     // Flow inside an unpacking assignment
     iterableUnpackingFlowStep(nodeFrom, nodeTo)
     or