Skip to content

Commit ce4b192

Browse files
committed
Python: Improve usefulness of RemoteFlowSourcesReach meta query
Before, results from `dca` would look something like ## + py/meta/alerts/remote-flow-sources-reach - django/django@c2250cf_cb8f: tests/messages_tests/urls.py:38:16:38:48 reachable with taint-tracking from RemoteFlowSource - django/django@c2250cf_cb8f: tests/messages_tests/urls.py:38:9:38:12 reachable with taint-tracking from RemoteFlowSource now it should make it easier to spot _what_ it is that actually changed, since we pretty-print the node.
1 parent 6aabbf0 commit ce4b192

File tree

8 files changed

+30
-11
lines changed

8 files changed

+30
-11
lines changed

python/ql/src/meta/alerts/RemoteFlowSourcesReach.ql

Lines changed: 2 additions & 1 deletion
Original file line numberDiff line numberDiff line change
@@ -14,6 +14,7 @@ private import semmle.python.dataflow.new.DataFlow
1414
private import semmle.python.dataflow.new.TaintTracking
1515
private import semmle.python.dataflow.new.RemoteFlowSources
1616
private import meta.MetaMetrics
17+
private import semmle.python.dataflow.new.internal.PrintNode
1718

1819
class RemoteFlowSourceReach extends TaintTracking::Configuration {
1920
RemoteFlowSourceReach() { this = "RemoteFlowSourceReach" }
@@ -43,4 +44,4 @@ class RemoteFlowSourceReach extends TaintTracking::Configuration {
4344

4445
from RemoteFlowSourceReach cfg, DataFlow::Node reachable
4546
where cfg.hasFlow(_, reachable)
46-
select reachable, "reachable with taint-tracking from RemoteFlowSource"
47+
select reachable, prettyNode(reachable)

python/ql/test/experimental/dataflow/TestUtil/PrintNode.qll renamed to python/ql/src/semmle/python/dataflow/new/internal/PrintNode.qll

Lines changed: 22 additions & 4 deletions
Original file line numberDiff line numberDiff line change
@@ -1,6 +1,20 @@
1-
import python
2-
import semmle.python.dataflow.new.DataFlow
1+
/**
2+
* INTERNAL: Do not use.
3+
*
4+
* Provides helper predicates for pretty-printing `DataFlow::Node`s.
5+
*
6+
* Since these have not been performance optimized, please only use them for
7+
* debug-queries or in tests.
8+
*/
9+
10+
private import python
11+
private import semmle.python.dataflow.new.DataFlow
312

13+
/**
14+
* INTERNAL: Do not use.
15+
*
16+
* Gets the pretty-printed version of the Expr `e`.
17+
*/
418
string prettyExpr(Expr e) {
519
not e instanceof Num and
620
not e instanceof StrConst and
@@ -27,15 +41,19 @@ string prettyExpr(Expr e) {
2741
}
2842

2943
/**
30-
* Gets pretty-printed version of the DataFlow::Node `node`
44+
* INTERNAL: Do not use.
45+
*
46+
* Gets the pretty-printed version of the DataFlow::Node `node`
3147
*/
3248
bindingset[node]
3349
string prettyNode(DataFlow::Node node) {
3450
if exists(node.asExpr()) then result = prettyExpr(node.asExpr()) else result = node.toString()
3551
}
3652

3753
/**
38-
* Gets pretty-printed version of the DataFlow::Node `node`, that is suitable for use
54+
* INTERNAL: Do not use.
55+
*
56+
* Gets the pretty-printed version of the DataFlow::Node `node`, that is suitable for use
3957
* with `TestUtilities.InlineExpectationsTest` (that is, no spaces unless required).
4058
*/
4159
bindingset[node]

python/ql/test/experimental/dataflow/TestUtil/FlowTest.qll

Lines changed: 1 addition & 1 deletion
Original file line numberDiff line numberDiff line change
@@ -1,7 +1,7 @@
11
import python
22
import semmle.python.dataflow.new.DataFlow
33
import TestUtilities.InlineExpectationsTest
4-
import experimental.dataflow.TestUtil.PrintNode
4+
private import semmle.python.dataflow.new.internal.PrintNode
55

66
abstract class FlowTest extends InlineExpectationsTest {
77
bindingset[this]

python/ql/test/experimental/dataflow/TestUtil/RoutingTest.qll

Lines changed: 1 addition & 1 deletion
Original file line numberDiff line numberDiff line change
@@ -1,7 +1,7 @@
11
import python
22
import semmle.python.dataflow.new.DataFlow
33
import TestUtilities.InlineExpectationsTest
4-
import experimental.dataflow.TestUtil.PrintNode
4+
private import semmle.python.dataflow.new.internal.PrintNode
55

66
/**
77
* A routing test is designed to test that values are routed to the

python/ql/test/experimental/dataflow/method-calls/test.ql

Lines changed: 1 addition & 1 deletion
Original file line numberDiff line numberDiff line change
@@ -1,6 +1,6 @@
11
import python
22
import semmle.python.dataflow.new.DataFlow
3-
import experimental.dataflow.TestUtil.PrintNode
3+
private import semmle.python.dataflow.new.internal.PrintNode
44

55
query predicate conjunctive_lookup(
66
DataFlow::MethodCallNode methCall, string call, string object, string methodName

python/ql/test/experimental/dataflow/tainttracking/TestTaintLib.qll

Lines changed: 1 addition & 1 deletion
Original file line numberDiff line numberDiff line change
@@ -1,7 +1,7 @@
11
import python
22
import semmle.python.dataflow.new.TaintTracking
33
import semmle.python.dataflow.new.DataFlow
4-
import experimental.dataflow.TestUtil.PrintNode
4+
private import semmle.python.dataflow.new.internal.PrintNode
55

66
class TestTaintTrackingConfiguration extends TaintTracking::Configuration {
77
TestTaintTrackingConfiguration() { this = "TestTaintTrackingConfiguration" }

python/ql/test/experimental/meta/ConceptsTest.qll

Lines changed: 1 addition & 1 deletion
Original file line numberDiff line numberDiff line change
@@ -2,7 +2,7 @@ import python
22
import semmle.python.dataflow.new.DataFlow
33
import semmle.python.Concepts
44
import TestUtilities.InlineExpectationsTest
5-
import experimental.dataflow.TestUtil.PrintNode
5+
private import semmle.python.dataflow.new.internal.PrintNode
66

77
class SystemCommandExecutionTest extends InlineExpectationsTest {
88
SystemCommandExecutionTest() { this = "SystemCommandExecutionTest" }

python/ql/test/experimental/meta/InlineTaintTest.qll

Lines changed: 1 addition & 1 deletion
Original file line numberDiff line numberDiff line change
@@ -14,7 +14,7 @@ import semmle.python.dataflow.new.DataFlow
1414
import semmle.python.dataflow.new.TaintTracking
1515
import semmle.python.dataflow.new.RemoteFlowSources
1616
import TestUtilities.InlineExpectationsTest
17-
import experimental.dataflow.TestUtil.PrintNode
17+
private import semmle.python.dataflow.new.internal.PrintNode
1818

1919
DataFlow::Node shouldBeTainted() {
2020
exists(DataFlow::CallCfgNode call |

0 commit comments

Comments
 (0)