You signed in with another tab or window. Reload to refresh your session.You signed out in another tab or window. Reload to refresh your session.You switched accounts on another tab or window. Reload to refresh your session.Dismiss alert
Copy file name to clipboardExpand all lines: docs/codeql/codeql-language-guides/codeql-library-for-python.rst
-35Lines changed: 0 additions & 35 deletions
Display the source diff
Display the rich diff
Original file line number
Diff line number
Diff line change
@@ -20,7 +20,6 @@ The CodeQL library for Python incorporates a large number of classes. Each class
20
20
21
21
- **Syntactic** - classes that represent entities in the Python source code.
22
22
- **Control flow** - classes that represent entities from the control flow graphs.
23
-
- **Type inference** - classes that represent the inferred values and types of entities in the Python source code.
24
23
25
24
Syntactic classes
26
25
-----------------
@@ -290,40 +289,6 @@ The classes in the control-flow part of the library are:
290
289
- `BasicBlock <https://codeql.github.com/codeql-standard-libraries/python/semmle/python/Flow.qll/type.Flow$BasicBlock.html>`__ – A non branching list of control-flow nodes.
291
290
292
291
293
-
Type-inference classes
294
-
----------------------
295
-
296
-
The CodeQL library for Python also supplies some classes for accessing the inferred types of values. The classes ``Value`` and ``ClassValue`` allow you to query the possible classes that an expression may have at runtime.
297
-
298
-
Example
299
-
^^^^^^^
300
-
301
-
For example, which ``ClassValue``\ s are iterable can be determined using the query:
302
-
303
-
**Find iterable "ClassValue"s**
304
-
305
-
.. code-block:: ql
306
-
307
-
import python
308
-
309
-
from ClassValue cls
310
-
where cls.hasAttribute("__iter__")
311
-
select cls
312
-
313
-
➤ `See this in the query console on LGTM.com <https://lgtm.com/query/5151030165280978402/>`__ This query returns a list of classes for the projects analyzed. If you want to include the results for ``builtin`` classes, which do not have any Python source code, show the non-source results. For more information, see `builtin classes <https://docs.python.org/3/library/stdtypes.html>`__ in the Python documentation.
Copy file name to clipboardExpand all lines: docs/codeql/writing-codeql-queries/about-data-flow-analysis.rst
+4-5Lines changed: 4 additions & 5 deletions
Display the source diff
Display the rich diff
Original file line number
Diff line number
Diff line change
@@ -3,7 +3,7 @@
3
3
About data flow analysis
4
4
########################
5
5
6
-
Data flow analysis is used to compute the possible values that a variable can hold at various points in a program, determining how those values propagate through the program and where they are used.
6
+
Data flow analysis is used to compute the possible values that a variable can hold at various points in a program, determining how those values propagate through the program and where they are used.
7
7
8
8
Overview
9
9
********
@@ -20,13 +20,13 @@ See the following tutorials for more information about analyzing data flow in sp
20
20
- ":ref:`Analyzing data flow in C# <analyzing-data-flow-in-csharp>`"
21
21
- ":ref:`Analyzing data flow in Java <analyzing-data-flow-in-java>`"
22
22
- ":ref:`Analyzing data flow in JavaScript/TypeScript <analyzing-data-flow-in-javascript-and-typescript>`"
23
-
- ":ref:`Analyzing data flow and tracking tainted data in Python <analyzing-data-flow-and-tracking-tainted-data-in-python>`"
23
+
- ":ref:`Analyzing data flow in Python <analyzing-data-flow-in-python>`"
24
24
25
25
.. pull-quote::
26
26
27
27
Note
28
28
29
-
Data flow analysis is used extensively in path queries. To learn more about path queries, see ":doc:`Creating path queries <creating-path-queries>`."
29
+
Data flow analysis is used extensively in path queries. To learn more about path queries, see ":doc:`Creating path queries <creating-path-queries>`."
30
30
31
31
.. _data-flow-graph:
32
32
@@ -78,11 +78,10 @@ The normal data flow libraries are used to analyze the information flow in which
78
78
For example, if you are tracking an insecure object ``x`` (which might be some untrusted or potentially malicious data), a step in the program may 'change' its value. So, in a simple process such as ``y = x + 1``, a normal data flow analysis will highlight the use of ``x``, but not ``y``.
79
79
However, since ``y`` is derived from ``x``, it is influenced by the untrusted or 'tainted' information, and therefore it is also tainted. Analyzing the flow of the taint from ``x`` to ``y`` is known as taint tracking.
80
80
81
-
In QL, taint tracking extends data flow analysis by including steps in which the data values are not necessarily preserved, but the potentially insecure object is still propagated.
81
+
In QL, taint tracking extends data flow analysis by including steps in which the data values are not necessarily preserved, but the potentially insecure object is still propagated.
82
82
These flow steps are modeled in the taint-tracking library using predicates that hold if taint is propagated between nodes.
83
83
84
84
Further reading
85
85
***************
86
86
87
87
- ":ref:`Exploring data flow with path queries <exploring-data-flow-with-path-queries>`"
0 commit comments