Skip to content

Commit d5e2026

Browse files
codeql-cicodeql-ci
authored
Merge pull request #6934 from erik-krogh/more-instanceof
Approved by MathiasVP, esbena, yoff
2 parents 5d62aa5 + e117659 commit d5e2026

File tree

11 files changed

+60
-101
lines changed

11 files changed

+60
-101
lines changed

‎cpp/ql/src/Security/CWE/CWE-497/ExposedSystemData.ql

Lines changed: 2 additions & 4 deletions
Original file line numberDiff line numberDiff line change
@@ -324,10 +324,8 @@ abstract class DataOutput extends Element {
324324
/**
325325
* Data that is output via standard output or standard error.
326326
*/
327-
class StandardOutput extends DataOutput {
328-
StandardOutput() { this instanceof OutputWrite }
329-
330-
override Expr getASource() { result = this.(OutputWrite).getASource() }
327+
class StandardOutput extends DataOutput instanceof OutputWrite {
328+
override Expr getASource() { result = OutputWrite.super.getASource() }
331329
}
332330

333331
private predicate socketCallOrIndirect(FunctionCall call) {

‎javascript/ql/lib/semmle/javascript/DOM.qll

Lines changed: 12 additions & 18 deletions
Original file line numberDiff line numberDiff line change
@@ -63,29 +63,25 @@ module DOM {
6363
/**
6464
* An HTML element, viewed as an `ElementDefinition`.
6565
*/
66-
private class HtmlElementDefinition extends ElementDefinition, @xmlelement {
67-
HtmlElementDefinition() { this instanceof HTML::Element }
68-
69-
override string getName() { result = this.(HTML::Element).getName() }
66+
private class HtmlElementDefinition extends ElementDefinition, @xmlelement instanceof HTML::Element {
67+
override string getName() { result = HTML::Element.super.getName() }
7068

7169
override AttributeDefinition getAttribute(int i) {
72-
result = this.(HTML::Element).getAttribute(i)
70+
result = HTML::Element.super.getAttribute(i)
7371
}
7472

75-
override ElementDefinition getParent() { result = this.(HTML::Element).getParent() }
73+
override ElementDefinition getParent() { result = HTML::Element.super.getParent() }
7674
}
7775

7876
/**
7977
* A JSX element, viewed as an `ElementDefinition`.
8078
*/
81-
private class JsxElementDefinition extends ElementDefinition, @jsx_element {
82-
JsxElementDefinition() { this instanceof JSXElement }
83-
84-
override string getName() { result = this.(JSXElement).getName() }
79+
private class JsxElementDefinition extends ElementDefinition, @jsx_element instanceof JSXElement {
80+
override string getName() { result = JSXElement.super.getName() }
8581

86-
override AttributeDefinition getAttribute(int i) { result = this.(JSXElement).getAttribute(i) }
82+
override AttributeDefinition getAttribute(int i) { result = JSXElement.super.getAttribute(i) }
8783

88-
override ElementDefinition getParent() { result = this.(JSXElement).getJsxParent() }
84+
override ElementDefinition getParent() { result = super.getJsxParent() }
8985
}
9086

9187
/**
@@ -131,14 +127,12 @@ module DOM {
131127
/**
132128
* An HTML attribute, viewed as an `AttributeDefinition`.
133129
*/
134-
private class HtmlAttributeDefinition extends AttributeDefinition, @xmlattribute {
135-
HtmlAttributeDefinition() { this instanceof HTML::Attribute }
136-
137-
override string getName() { result = this.(HTML::Attribute).getName() }
130+
private class HtmlAttributeDefinition extends AttributeDefinition, @xmlattribute instanceof HTML::Attribute {
131+
override string getName() { result = HTML::Attribute.super.getName() }
138132

139-
override string getStringValue() { result = this.(HTML::Attribute).getValue() }
133+
override string getStringValue() { result = super.getValue() }
140134

141-
override ElementDefinition getElement() { result = this.(HTML::Attribute).getElement() }
135+
override ElementDefinition getElement() { result = HTML::Attribute.super.getElement() }
142136
}
143137

144138
/**

‎javascript/ql/lib/semmle/javascript/dataflow/Nodes.qll

Lines changed: 12 additions & 20 deletions
Original file line numberDiff line numberDiff line change
@@ -61,17 +61,15 @@ class ParameterNode extends DataFlow::SourceNode {
6161
* new Array(16)
6262
* ```
6363
*/
64-
class InvokeNode extends DataFlow::SourceNode {
65-
InvokeNode() { this instanceof DataFlow::Impl::InvokeNodeDef }
66-
64+
class InvokeNode extends DataFlow::SourceNode instanceof DataFlow::Impl::InvokeNodeDef {
6765
/** Gets the syntactic invoke expression underlying this function invocation. */
68-
InvokeExpr getInvokeExpr() { result = this.(DataFlow::Impl::InvokeNodeDef).getInvokeExpr() }
66+
InvokeExpr getInvokeExpr() { result = super.getInvokeExpr() }
6967

7068
/** Gets the name of the function or method being invoked, if it can be determined. */
71-
string getCalleeName() { result = this.(DataFlow::Impl::InvokeNodeDef).getCalleeName() }
69+
string getCalleeName() { result = super.getCalleeName() }
7270

7371
/** Gets the data flow node specifying the function to be called. */
74-
DataFlow::Node getCalleeNode() { result = this.(DataFlow::Impl::InvokeNodeDef).getCalleeNode() }
72+
DataFlow::Node getCalleeNode() { result = super.getCalleeNode() }
7573

7674
/**
7775
* Gets the data flow node corresponding to the `i`th argument of this invocation.
@@ -92,10 +90,10 @@ class InvokeNode extends DataFlow::SourceNode {
9290
* but the position of `z` cannot be determined, hence there are no first and second
9391
* argument nodes.
9492
*/
95-
DataFlow::Node getArgument(int i) { result = this.(DataFlow::Impl::InvokeNodeDef).getArgument(i) }
93+
DataFlow::Node getArgument(int i) { result = super.getArgument(i) }
9694

9795
/** Gets the data flow node corresponding to an argument of this invocation. */
98-
DataFlow::Node getAnArgument() { result = this.(DataFlow::Impl::InvokeNodeDef).getAnArgument() }
96+
DataFlow::Node getAnArgument() { result = super.getAnArgument() }
9997

10098
/** Gets the data flow node corresponding to the last argument of this invocation. */
10199
DataFlow::Node getLastArgument() { result = getArgument(getNumArgument() - 1) }
@@ -112,12 +110,10 @@ class InvokeNode extends DataFlow::SourceNode {
112110
* ```
113111
* .
114112
*/
115-
DataFlow::Node getASpreadArgument() {
116-
result = this.(DataFlow::Impl::InvokeNodeDef).getASpreadArgument()
117-
}
113+
DataFlow::Node getASpreadArgument() { result = super.getASpreadArgument() }
118114

119115
/** Gets the number of arguments of this invocation, if it can be determined. */
120-
int getNumArgument() { result = this.(DataFlow::Impl::InvokeNodeDef).getNumArgument() }
116+
int getNumArgument() { result = super.getNumArgument() }
121117

122118
Function getEnclosingFunction() { result = getBasicBlock().getContainer() }
123119

@@ -258,15 +254,13 @@ class InvokeNode extends DataFlow::SourceNode {
258254
* Math.abs(x)
259255
* ```
260256
*/
261-
class CallNode extends InvokeNode {
262-
CallNode() { this instanceof DataFlow::Impl::CallNodeDef }
263-
257+
class CallNode extends InvokeNode instanceof DataFlow::Impl::CallNodeDef {
264258
/**
265259
* Gets the data flow node corresponding to the receiver expression of this method call.
266260
*
267261
* For example, the receiver of `x.m()` is `x`.
268262
*/
269-
DataFlow::Node getReceiver() { result = this.(DataFlow::Impl::CallNodeDef).getReceiver() }
263+
DataFlow::Node getReceiver() { result = super.getReceiver() }
270264
}
271265

272266
/**
@@ -279,11 +273,9 @@ class CallNode extends InvokeNode {
279273
* Math.abs(x)
280274
* ```
281275
*/
282-
class MethodCallNode extends CallNode {
283-
MethodCallNode() { this instanceof DataFlow::Impl::MethodCallNodeDef }
284-
276+
class MethodCallNode extends CallNode instanceof DataFlow::Impl::MethodCallNodeDef {
285277
/** Gets the name of the invoked method, if it can be determined. */
286-
string getMethodName() { result = this.(DataFlow::Impl::MethodCallNodeDef).getMethodName() }
278+
string getMethodName() { result = super.getMethodName() }
287279

288280
/**
289281
* Holds if this data flow node calls method `methodName` on receiver node `receiver`.

‎javascript/ql/lib/semmle/javascript/dataflow/Refinements.qll

Lines changed: 4 additions & 7 deletions
Original file line numberDiff line numberDiff line change
@@ -53,21 +53,18 @@ abstract class RefinementCandidate extends Expr {
5353
* A refinement candidate that references at most one variable, and hence
5454
* can be used to refine the abstract values inferred for that variable.
5555
*/
56-
class Refinement extends Expr {
57-
Refinement() {
58-
this instanceof RefinementCandidate and
59-
count(this.(RefinementCandidate).getARefinedVar()) <= 1
60-
}
56+
class Refinement extends Expr instanceof RefinementCandidate {
57+
Refinement() { count(this.(RefinementCandidate).getARefinedVar()) <= 1 }
6158

6259
/**
6360
* Gets the variable refined by this expression, if any.
6461
*/
65-
SsaSourceVariable getRefinedVar() { result = this.(RefinementCandidate).getARefinedVar() }
62+
SsaSourceVariable getRefinedVar() { result = super.getARefinedVar() }
6663

6764
/**
6865
* Gets a refinement value inferred for this expression in context `ctxt`.
6966
*/
70-
RefinementValue eval(RefinementContext ctxt) { result = this.(RefinementCandidate).eval(ctxt) }
67+
RefinementValue eval(RefinementContext ctxt) { result = super.eval(ctxt) }
7168
}
7269

7370
/** A literal, viewed as a refinement expression. */

‎javascript/ql/lib/semmle/javascript/security/performance/PolynomialReDoSCustomizations.qll

Lines changed: 2 additions & 4 deletions
Original file line numberDiff line numberDiff line change
@@ -47,10 +47,8 @@ module PolynomialReDoS {
4747
* A remote input to a server, seen as a source for polynomial
4848
* regular expression denial-of-service vulnerabilities.
4949
*/
50-
class RequestInputAccessAsSource extends Source {
51-
RequestInputAccessAsSource() { this instanceof HTTP::RequestInputAccess }
52-
53-
override string getKind() { result = this.(HTTP::RequestInputAccess).getKind() }
50+
class RequestInputAccessAsSource extends Source instanceof HTTP::RequestInputAccess {
51+
override string getKind() { result = HTTP::RequestInputAccess.super.getKind() }
5452
}
5553

5654
/**

‎javascript/ql/src/experimental/Security/CWE-090/LdapInjectionCustomizations.qll

Lines changed: 4 additions & 8 deletions
Original file line numberDiff line numberDiff line change
@@ -39,21 +39,17 @@ module LdapInjection {
3939
/**
4040
* An LDAP filter for an API call that executes an operation against the LDAP server.
4141
*/
42-
class LdapjsSearchFilterAsSink extends Sink {
43-
LdapjsSearchFilterAsSink() { this instanceof LdapjsSearchFilter }
44-
42+
class LdapjsSearchFilterAsSink extends Sink instanceof LdapjsSearchFilter {
4543
override DataFlow::InvokeNode getQueryCall() {
46-
result = this.(LdapjsSearchFilter).getQueryCall()
44+
result = LdapjsSearchFilter.super.getQueryCall()
4745
}
4846
}
4947

5048
/**
5149
* An LDAP DN argument for an API call that executes an operation against the LDAP server.
5250
*/
53-
class LdapjsDNArgumentAsSink extends Sink {
54-
LdapjsDNArgumentAsSink() { this instanceof LdapjsDNArgument }
55-
56-
override DataFlow::InvokeNode getQueryCall() { result = this.(LdapjsDNArgument).getQueryCall() }
51+
class LdapjsDNArgumentAsSink extends Sink instanceof LdapjsDNArgument {
52+
override DataFlow::InvokeNode getQueryCall() { result = LdapjsDNArgument.super.getQueryCall() }
5753
}
5854

5955
/**

‎python/ql/lib/semmle/python/dataflow/new/internal/DataFlowPrivate.qll

Lines changed: 2 additions & 4 deletions
Original file line numberDiff line numberDiff line change
@@ -1365,10 +1365,8 @@ module IterableUnpacking {
13651365
}
13661366

13671367
/** A (possibly recursive) target of an unpacking assignment which is also a sequence. */
1368-
class UnpackingAssignmentSequenceTarget extends UnpackingAssignmentTarget {
1369-
UnpackingAssignmentSequenceTarget() { this instanceof SequenceNode }
1370-
1371-
ControlFlowNode getElement(int i) { result = this.(SequenceNode).getElement(i) }
1368+
class UnpackingAssignmentSequenceTarget extends UnpackingAssignmentTarget instanceof SequenceNode {
1369+
ControlFlowNode getElement(int i) { result = super.getElement(i) }
13721370

13731371
ControlFlowNode getAnElement() { result = this.getElement(_) }
13741372
}

‎python/ql/lib/semmle/python/dataflow/old/TaintTracking.qll

Lines changed: 3 additions & 5 deletions
Original file line numberDiff line numberDiff line change
@@ -639,16 +639,14 @@ module DataFlow {
639639
}
640640
}
641641

642-
deprecated private class ConfigurationAdapter extends TaintTracking::Configuration {
643-
ConfigurationAdapter() { this instanceof Configuration }
644-
642+
deprecated private class ConfigurationAdapter extends TaintTracking::Configuration instanceof Configuration {
645643
override predicate isSource(DataFlow::Node node, TaintKind kind) {
646-
this.(Configuration).isSource(node.asCfgNode()) and
644+
Configuration.super.isSource(node.asCfgNode()) and
647645
kind instanceof DataFlowType
648646
}
649647

650648
override predicate isSink(DataFlow::Node node, TaintKind kind) {
651-
this.(Configuration).isSink(node.asCfgNode()) and
649+
Configuration.super.isSink(node.asCfgNode()) and
652650
kind instanceof DataFlowType
653651
}
654652
}

‎python/ql/lib/semmle/python/dependencies/TechInventory.qll

Lines changed: 3 additions & 5 deletions
Original file line numberDiff line numberDiff line change
@@ -14,16 +14,14 @@ string munge(File sourceFile, ExternalPackage package) {
1414
result = "/" + sourceFile.getRelativePath() + "<|>" + package.getName() + "<|>unknown"
1515
}
1616

17-
abstract class ExternalPackage extends Object {
18-
ExternalPackage() { this instanceof ModuleObject }
19-
17+
abstract class ExternalPackage extends Object instanceof ModuleObject {
2018
abstract string getName();
2119

2220
abstract string getVersion();
2321

24-
Object getAttribute(string name) { result = this.(ModuleObject).attr(name) }
22+
Object getAttribute(string name) { result = super.attr(name) }
2523

26-
PackageObject getPackage() { result = this.(ModuleObject).getPackage() }
24+
PackageObject getPackage() { result = super.getPackage() }
2725
}
2826

2927
bindingset[text]

‎python/ql/lib/semmle/python/objects/ObjectAPI.qll

Lines changed: 14 additions & 22 deletions
Original file line numberDiff line numberDiff line change
@@ -147,9 +147,7 @@ class Value extends TObject {
147147
* Class representing modules in the Python program
148148
* Each `ModuleValue` represents a module object in the Python program.
149149
*/
150-
class ModuleValue extends Value {
151-
ModuleValue() { this instanceof ModuleObjectInternal }
152-
150+
class ModuleValue extends Value instanceof ModuleObjectInternal {
153151
/**
154152
* Holds if this module "exports" name.
155153
* That is, does it define `name` in `__all__` or is
@@ -159,7 +157,7 @@ class ModuleValue extends Value {
159157
predicate exports(string name) { PointsTo::moduleExports(this, name) }
160158

161159
/** Gets the scope for this module, provided that it is a Python module. */
162-
ModuleScope getScope() { result = this.(ModuleObjectInternal).getSourceModule() }
160+
ModuleScope getScope() { result = super.getSourceModule() }
163161

164162
/**
165163
* Gets the container path for this module. Will be the file for a Python module,
@@ -181,7 +179,7 @@ class ModuleValue extends Value {
181179
predicate isPackage() { this instanceof PackageObjectInternal }
182180

183181
/** Whether the complete set of names "exported" by this module can be accurately determined */
184-
predicate hasCompleteExportInfo() { this.(ModuleObjectInternal).hasCompleteExportInfo() }
182+
predicate hasCompleteExportInfo() { super.hasCompleteExportInfo() }
185183

186184
/** Get a module that this module imports */
187185
ModuleValue getAnImportedModule() { result.importedAs(this.getScope().getAnImportedModuleName()) }
@@ -452,23 +450,21 @@ class CallableValue extends Value {
452450
* Class representing bound-methods, such as `o.func`, where `o` is an instance
453451
* of a class that has a callable attribute `func`.
454452
*/
455-
class BoundMethodValue extends CallableValue {
456-
BoundMethodValue() { this instanceof BoundMethodObjectInternal }
457-
453+
class BoundMethodValue extends CallableValue instanceof BoundMethodObjectInternal {
458454
/**
459455
* Gets the callable that will be used when `this` is called.
460456
* The actual callable for `func` in `o.func`.
461457
*/
462-
CallableValue getFunction() { result = this.(BoundMethodObjectInternal).getFunction() }
458+
CallableValue getFunction() { result = super.getFunction() }
463459

464460
/**
465461
* Gets the value that will be used for the `self` parameter when `this` is called.
466462
* The value for `o` in `o.func`.
467463
*/
468-
Value getSelf() { result = this.(BoundMethodObjectInternal).getSelf() }
464+
Value getSelf() { result = super.getSelf() }
469465

470466
/** Gets the parameter node that will be used for `self`. */
471-
NameNode getSelfParameter() { result = this.(BoundMethodObjectInternal).getSelfParameter() }
467+
NameNode getSelfParameter() { result = super.getSelfParameter() }
472468
}
473469

474470
/**
@@ -831,12 +827,10 @@ class BuiltinMethodValue extends FunctionValue {
831827
/**
832828
* A class representing sequence objects with a length and tracked items.
833829
*/
834-
class SequenceValue extends Value {
835-
SequenceValue() { this instanceof SequenceObjectInternal }
830+
class SequenceValue extends Value instanceof SequenceObjectInternal {
831+
Value getItem(int n) { result = super.getItem(n) }
836832

837-
Value getItem(int n) { result = this.(SequenceObjectInternal).getItem(n) }
838-
839-
int length() { result = this.(SequenceObjectInternal).length() }
833+
int length() { result = super.length() }
840834
}
841835

842836
/** A class representing tuple objects */
@@ -887,14 +881,12 @@ class NumericValue extends Value {
887881
* https://docs.python.org/3/howto/descriptor.html#properties
888882
* https://docs.python.org/3/library/functions.html#property
889883
*/
890-
class PropertyValue extends Value {
891-
PropertyValue() { this instanceof PropertyInternal }
892-
893-
CallableValue getGetter() { result = this.(PropertyInternal).getGetter() }
884+
class PropertyValue extends Value instanceof PropertyInternal {
885+
CallableValue getGetter() { result = super.getGetter() }
894886

895-
CallableValue getSetter() { result = this.(PropertyInternal).getSetter() }
887+
CallableValue getSetter() { result = super.getSetter() }
896888

897-
CallableValue getDeleter() { result = this.(PropertyInternal).getDeleter() }
889+
CallableValue getDeleter() { result = super.getDeleter() }
898890
}
899891

900892
/** A method-resolution-order sequence of classes */

0 commit comments

Comments
 (0)