Skip to content

Commit 5b4f98d

Browse files
yoffyoff
committed
python: Add summaries for container constructors
Also: - turn on flow summaries for taint - do not restrict node type (as now we need summary nodes)
1 parent 145eaf3 commit 5b4f98d

File tree

16 files changed

+303
-31
lines changed

16 files changed

+303
-31
lines changed

‎python/ql/lib/semmle/python/dataflow/new/internal/TaintTrackingPrivate.qll

Lines changed: 4 additions & 1 deletion
Original file line numberDiff line numberDiff line change
@@ -1,6 +1,7 @@
11
private import python
22
private import semmle.python.dataflow.new.DataFlow
33
private import semmle.python.dataflow.new.internal.DataFlowPrivate as DataFlowPrivate
4+
private import FlowSummaryImpl as FlowSummaryImpl
45
private import semmle.python.dataflow.new.internal.TaintTrackingPublic
56
private import semmle.python.ApiGraphs
67

@@ -55,6 +56,8 @@ private module Cached {
5556
awaitStep(nodeFrom, nodeTo)
5657
or
5758
asyncWithStep(nodeFrom, nodeTo)
59+
or
60+
FlowSummaryImpl::Private::Steps::summaryLocalStep(nodeFrom, nodeTo, false)
5861
}
5962
}
6063

@@ -159,7 +162,7 @@ predicate stringManipulation(DataFlow::CfgNode nodeFrom, DataFlow::CfgNode nodeT
159162
* is currently very imprecise, as an example, since we model `dict.get`, we treat any
160163
* `<tainted object>.get(<arg>)` will be tainted, whether it's true or not.
161164
*/
162-
predicate containerStep(DataFlow::CfgNode nodeFrom, DataFlow::Node nodeTo) {
165+
predicate containerStep(DataFlow::Node nodeFrom, DataFlow::Node nodeTo) {
163166
// construction by literal
164167
//
165168
// TODO: once we have proper flow-summary modeling, we might not need this step any

‎python/ql/lib/semmle/python/frameworks/Stdlib.qll

Lines changed: 132 additions & 0 deletions
Original file line numberDiff line numberDiff line change
@@ -3790,6 +3790,138 @@ private module StdlibPrivate {
37903790
override DataFlow::Node getAPathArgument() { result = this.getAnInput() }
37913791
}
37923792

3793+
// ---------------------------------------------------------------------------
3794+
// Flow summaries for functions contructing containers
3795+
// ---------------------------------------------------------------------------
3796+
/** A flow summary for `dict`. */
3797+
class DictSummary extends SummarizedCallable {
3798+
DictSummary() { this = "builtins.dict" }
3799+
3800+
override DataFlow::CallCfgNode getACall() { result = API::builtin("dict").getACall() }
3801+
3802+
override DataFlow::ArgumentNode getACallback() {
3803+
result = API::builtin("dict").getAValueReachableFromSource()
3804+
}
3805+
3806+
override predicate propagatesFlowExt(string input, string output, boolean preservesValue) {
3807+
exists(DataFlow::DictionaryElementContent dc, string key | key = dc.getKey() |
3808+
input = "Argument[0].DictionaryElement[" + key + "]" and
3809+
output = "ReturnValue.DictionaryElement[" + key + "]" and
3810+
preservesValue = true
3811+
)
3812+
or
3813+
exists(DataFlow::DictionaryElementContent dc, string key | key = dc.getKey() |
3814+
input = "Argument[" + key + ":]" and
3815+
output = "ReturnValue.DictionaryElement[" + key + "]" and
3816+
preservesValue = true
3817+
)
3818+
or
3819+
input = "Argument[0]" and
3820+
output = "ReturnValue" and
3821+
preservesValue = false
3822+
}
3823+
}
3824+
3825+
/** A flow summary for `list`. */
3826+
class ListSummary extends SummarizedCallable {
3827+
ListSummary() { this = "builtins.list" }
3828+
3829+
override DataFlow::CallCfgNode getACall() { result = API::builtin("list").getACall() }
3830+
3831+
override DataFlow::ArgumentNode getACallback() {
3832+
result = API::builtin("list").getAValueReachableFromSource()
3833+
}
3834+
3835+
override predicate propagatesFlowExt(string input, string output, boolean preservesValue) {
3836+
(
3837+
input = "Argument[0].ListElement"
3838+
or
3839+
input = "Argument[0].SetElement"
3840+
or
3841+
exists(DataFlow::TupleElementContent tc, int i | i = tc.getIndex() |
3842+
input = "Argument[0].TupleElement[" + i.toString() + "]"
3843+
)
3844+
// TODO: Once we have DictKeyContent, we need to transform that into ListElementContent
3845+
) and
3846+
output = "ReturnValue.ListElement" and
3847+
preservesValue = true
3848+
or
3849+
input = "Argument[0]" and
3850+
output = "ReturnValue" and
3851+
preservesValue = false
3852+
}
3853+
}
3854+
3855+
/** A flow summary for tuple */
3856+
class TupleSummary extends SummarizedCallable {
3857+
TupleSummary() { this = "builtins.tuple" }
3858+
3859+
override DataFlow::CallCfgNode getACall() { result = API::builtin("tuple").getACall() }
3860+
3861+
override DataFlow::ArgumentNode getACallback() {
3862+
result = API::builtin("tuple").getAValueReachableFromSource()
3863+
}
3864+
3865+
override predicate propagatesFlowExt(string input, string output, boolean preservesValue) {
3866+
exists(DataFlow::TupleElementContent tc, int i | i = tc.getIndex() |
3867+
input = "Argument[0].TupleElement[" + i.toString() + "]" and
3868+
output = "ReturnValue.TupleElement[" + i.toString() + "]" and
3869+
preservesValue = true
3870+
)
3871+
or
3872+
// TODO: We need to also translate iterable content such as list element
3873+
// but we currently lack TupleElementAny
3874+
input = "Argument[0]" and
3875+
output = "ReturnValue" and
3876+
preservesValue = false
3877+
}
3878+
}
3879+
3880+
/** A flow summary for set */
3881+
class SetSummary extends SummarizedCallable {
3882+
SetSummary() { this = "builtins.set" }
3883+
3884+
override DataFlow::CallCfgNode getACall() { result = API::builtin("set").getACall() }
3885+
3886+
override DataFlow::ArgumentNode getACallback() {
3887+
result = API::builtin("set").getAValueReachableFromSource()
3888+
}
3889+
3890+
override predicate propagatesFlowExt(string input, string output, boolean preservesValue) {
3891+
(
3892+
input = "Argument[0].ListElement"
3893+
or
3894+
input = "Argument[0].SetElement"
3895+
or
3896+
exists(DataFlow::TupleElementContent tc, int i | i = tc.getIndex() |
3897+
input = "Argument[0].TupleElement[" + i.toString() + "]"
3898+
)
3899+
// TODO: Once we have DictKeyContent, we need to transform that into ListElementContent
3900+
) and
3901+
output = "ReturnValue.SetElement" and
3902+
preservesValue = true
3903+
or
3904+
input = "Argument[0]" and
3905+
output = "ReturnValue" and
3906+
preservesValue = false
3907+
}
3908+
}
3909+
3910+
/** A flow summary for frozenset */
3911+
class FrozensetSummary extends SummarizedCallable {
3912+
FrozensetSummary() { this = "builtins.frozenset" }
3913+
3914+
override DataFlow::CallCfgNode getACall() { result = API::builtin("frozenset").getACall() }
3915+
3916+
override DataFlow::ArgumentNode getACallback() {
3917+
result = API::builtin("frozenset").getAValueReachableFromSource()
3918+
}
3919+
3920+
override predicate propagatesFlowExt(string input, string output, boolean preservesValue) {
3921+
any(SetSummary s).propagatesFlowExt(input, output, preservesValue)
3922+
}
3923+
}
3924+
37933925
/** A flow summary for `reversed`. */
37943926
class ReversedSummary extends SummarizedCallable {
37953927
ReversedSummary() { this = "builtins.reversed" }

‎python/ql/test/experimental/dataflow/basic/callGraphSinks.expected

Lines changed: 5 additions & 0 deletions
Original file line numberDiff line numberDiff line change
@@ -1,4 +1,9 @@
1+
| file://:0:0:0:0 | parameter position 0 of builtins.dict |
2+
| file://:0:0:0:0 | parameter position 0 of builtins.frozenset |
3+
| file://:0:0:0:0 | parameter position 0 of builtins.list |
14
| file://:0:0:0:0 | parameter position 0 of builtins.reversed |
5+
| file://:0:0:0:0 | parameter position 0 of builtins.set |
6+
| file://:0:0:0:0 | parameter position 0 of builtins.tuple |
27
| file://:0:0:0:0 | parameter position 1 of dict.setdefault |
38
| test.py:1:1:1:21 | SynthDictSplatParameterNode |
49
| test.py:1:19:1:19 | ControlFlowNode for x |

‎python/ql/test/experimental/dataflow/basic/callGraphSources.expected

Lines changed: 5 additions & 0 deletions
Original file line numberDiff line numberDiff line change
@@ -1,4 +1,9 @@
1+
| file://:0:0:0:0 | [summary] to write: return (return) in builtins.dict |
2+
| file://:0:0:0:0 | [summary] to write: return (return) in builtins.frozenset |
3+
| file://:0:0:0:0 | [summary] to write: return (return) in builtins.list |
14
| file://:0:0:0:0 | [summary] to write: return (return) in builtins.reversed |
5+
| file://:0:0:0:0 | [summary] to write: return (return) in builtins.set |
6+
| file://:0:0:0:0 | [summary] to write: return (return) in builtins.tuple |
27
| file://:0:0:0:0 | [summary] to write: return (return) in dict.setdefault |
38
| test.py:4:10:4:10 | ControlFlowNode for z |
49
| test.py:7:19:7:19 | ControlFlowNode for a |

‎python/ql/test/experimental/dataflow/basic/global.expected

Lines changed: 10 additions & 0 deletions
Original file line numberDiff line numberDiff line change
@@ -1,4 +1,14 @@
1+
| file://:0:0:0:0 | [summary] read: argument position 0.List element in builtins.frozenset | file://:0:0:0:0 | [summary] to write: return (return).Set element in builtins.frozenset |
2+
| file://:0:0:0:0 | [summary] read: argument position 0.List element in builtins.list | file://:0:0:0:0 | [summary] to write: return (return).List element in builtins.list |
13
| file://:0:0:0:0 | [summary] read: argument position 0.List element in builtins.reversed | file://:0:0:0:0 | [summary] to write: return (return).List element in builtins.reversed |
4+
| file://:0:0:0:0 | [summary] read: argument position 0.List element in builtins.set | file://:0:0:0:0 | [summary] to write: return (return).Set element in builtins.set |
5+
| file://:0:0:0:0 | [summary] read: argument position 0.Set element in builtins.frozenset | file://:0:0:0:0 | [summary] to write: return (return).Set element in builtins.frozenset |
6+
| file://:0:0:0:0 | [summary] read: argument position 0.Set element in builtins.list | file://:0:0:0:0 | [summary] to write: return (return).List element in builtins.list |
7+
| file://:0:0:0:0 | [summary] read: argument position 0.Set element in builtins.set | file://:0:0:0:0 | [summary] to write: return (return).Set element in builtins.set |
8+
| file://:0:0:0:0 | [summary] read: argument position 0.Tuple element at index 0 in builtins.frozenset | file://:0:0:0:0 | [summary] to write: return (return).Set element in builtins.frozenset |
9+
| file://:0:0:0:0 | [summary] read: argument position 0.Tuple element at index 0 in builtins.list | file://:0:0:0:0 | [summary] to write: return (return).List element in builtins.list |
10+
| file://:0:0:0:0 | [summary] read: argument position 0.Tuple element at index 0 in builtins.set | file://:0:0:0:0 | [summary] to write: return (return).Set element in builtins.set |
11+
| file://:0:0:0:0 | [summary] read: argument position 0.Tuple element at index 0 in builtins.tuple | file://:0:0:0:0 | [summary] to write: return (return).Tuple element at index 0 in builtins.tuple |
212
| file://:0:0:0:0 | parameter position 1 of dict.setdefault | file://:0:0:0:0 | [summary] to write: return (return) in dict.setdefault |
313
| test.py:1:1:1:21 | ControlFlowNode for FunctionExpr | test.py:1:5:1:17 | GSSA Variable obfuscated_id |
414
| test.py:1:1:1:21 | ControlFlowNode for FunctionExpr | test.py:7:5:7:17 | ControlFlowNode for obfuscated_id |

‎python/ql/test/experimental/dataflow/basic/globalStep.expected

Lines changed: 10 additions & 0 deletions
Original file line numberDiff line numberDiff line change
@@ -1,4 +1,14 @@
1+
| file://:0:0:0:0 | [summary] read: argument position 0.List element in builtins.frozenset | file://:0:0:0:0 | [summary] to write: return (return).Set element in builtins.frozenset |
2+
| file://:0:0:0:0 | [summary] read: argument position 0.List element in builtins.list | file://:0:0:0:0 | [summary] to write: return (return).List element in builtins.list |
13
| file://:0:0:0:0 | [summary] read: argument position 0.List element in builtins.reversed | file://:0:0:0:0 | [summary] to write: return (return).List element in builtins.reversed |
4+
| file://:0:0:0:0 | [summary] read: argument position 0.List element in builtins.set | file://:0:0:0:0 | [summary] to write: return (return).Set element in builtins.set |
5+
| file://:0:0:0:0 | [summary] read: argument position 0.Set element in builtins.frozenset | file://:0:0:0:0 | [summary] to write: return (return).Set element in builtins.frozenset |
6+
| file://:0:0:0:0 | [summary] read: argument position 0.Set element in builtins.list | file://:0:0:0:0 | [summary] to write: return (return).List element in builtins.list |
7+
| file://:0:0:0:0 | [summary] read: argument position 0.Set element in builtins.set | file://:0:0:0:0 | [summary] to write: return (return).Set element in builtins.set |
8+
| file://:0:0:0:0 | [summary] read: argument position 0.Tuple element at index 0 in builtins.frozenset | file://:0:0:0:0 | [summary] to write: return (return).Set element in builtins.frozenset |
9+
| file://:0:0:0:0 | [summary] read: argument position 0.Tuple element at index 0 in builtins.list | file://:0:0:0:0 | [summary] to write: return (return).List element in builtins.list |
10+
| file://:0:0:0:0 | [summary] read: argument position 0.Tuple element at index 0 in builtins.set | file://:0:0:0:0 | [summary] to write: return (return).Set element in builtins.set |
11+
| file://:0:0:0:0 | [summary] read: argument position 0.Tuple element at index 0 in builtins.tuple | file://:0:0:0:0 | [summary] to write: return (return).Tuple element at index 0 in builtins.tuple |
212
| file://:0:0:0:0 | parameter position 1 of dict.setdefault | file://:0:0:0:0 | [summary] to write: return (return) in dict.setdefault |
313
| test.py:1:1:1:21 | ControlFlowNode for FunctionExpr | test.py:1:5:1:17 | GSSA Variable obfuscated_id |
414
| test.py:1:1:1:21 | ControlFlowNode for FunctionExpr | test.py:1:5:1:17 | GSSA Variable obfuscated_id |

‎python/ql/test/experimental/dataflow/basic/local.expected

Lines changed: 34 additions & 0 deletions
Original file line numberDiff line numberDiff line change
@@ -1,9 +1,43 @@
1+
| file://:0:0:0:0 | [summary] read: argument position 0.List element in builtins.frozenset | file://:0:0:0:0 | [summary] read: argument position 0.List element in builtins.frozenset |
2+
| file://:0:0:0:0 | [summary] read: argument position 0.List element in builtins.frozenset | file://:0:0:0:0 | [summary] to write: return (return).Set element in builtins.frozenset |
3+
| file://:0:0:0:0 | [summary] read: argument position 0.List element in builtins.list | file://:0:0:0:0 | [summary] read: argument position 0.List element in builtins.list |
4+
| file://:0:0:0:0 | [summary] read: argument position 0.List element in builtins.list | file://:0:0:0:0 | [summary] to write: return (return).List element in builtins.list |
15
| file://:0:0:0:0 | [summary] read: argument position 0.List element in builtins.reversed | file://:0:0:0:0 | [summary] read: argument position 0.List element in builtins.reversed |
26
| file://:0:0:0:0 | [summary] read: argument position 0.List element in builtins.reversed | file://:0:0:0:0 | [summary] to write: return (return).List element in builtins.reversed |
7+
| file://:0:0:0:0 | [summary] read: argument position 0.List element in builtins.set | file://:0:0:0:0 | [summary] read: argument position 0.List element in builtins.set |
8+
| file://:0:0:0:0 | [summary] read: argument position 0.List element in builtins.set | file://:0:0:0:0 | [summary] to write: return (return).Set element in builtins.set |
9+
| file://:0:0:0:0 | [summary] read: argument position 0.Set element in builtins.frozenset | file://:0:0:0:0 | [summary] read: argument position 0.Set element in builtins.frozenset |
10+
| file://:0:0:0:0 | [summary] read: argument position 0.Set element in builtins.frozenset | file://:0:0:0:0 | [summary] to write: return (return).Set element in builtins.frozenset |
11+
| file://:0:0:0:0 | [summary] read: argument position 0.Set element in builtins.list | file://:0:0:0:0 | [summary] read: argument position 0.Set element in builtins.list |
12+
| file://:0:0:0:0 | [summary] read: argument position 0.Set element in builtins.list | file://:0:0:0:0 | [summary] to write: return (return).List element in builtins.list |
13+
| file://:0:0:0:0 | [summary] read: argument position 0.Set element in builtins.set | file://:0:0:0:0 | [summary] read: argument position 0.Set element in builtins.set |
14+
| file://:0:0:0:0 | [summary] read: argument position 0.Set element in builtins.set | file://:0:0:0:0 | [summary] to write: return (return).Set element in builtins.set |
15+
| file://:0:0:0:0 | [summary] read: argument position 0.Tuple element at index 0 in builtins.frozenset | file://:0:0:0:0 | [summary] read: argument position 0.Tuple element at index 0 in builtins.frozenset |
16+
| file://:0:0:0:0 | [summary] read: argument position 0.Tuple element at index 0 in builtins.frozenset | file://:0:0:0:0 | [summary] to write: return (return).Set element in builtins.frozenset |
17+
| file://:0:0:0:0 | [summary] read: argument position 0.Tuple element at index 0 in builtins.list | file://:0:0:0:0 | [summary] read: argument position 0.Tuple element at index 0 in builtins.list |
18+
| file://:0:0:0:0 | [summary] read: argument position 0.Tuple element at index 0 in builtins.list | file://:0:0:0:0 | [summary] to write: return (return).List element in builtins.list |
19+
| file://:0:0:0:0 | [summary] read: argument position 0.Tuple element at index 0 in builtins.set | file://:0:0:0:0 | [summary] read: argument position 0.Tuple element at index 0 in builtins.set |
20+
| file://:0:0:0:0 | [summary] read: argument position 0.Tuple element at index 0 in builtins.set | file://:0:0:0:0 | [summary] to write: return (return).Set element in builtins.set |
21+
| file://:0:0:0:0 | [summary] read: argument position 0.Tuple element at index 0 in builtins.tuple | file://:0:0:0:0 | [summary] read: argument position 0.Tuple element at index 0 in builtins.tuple |
22+
| file://:0:0:0:0 | [summary] read: argument position 0.Tuple element at index 0 in builtins.tuple | file://:0:0:0:0 | [summary] to write: return (return).Tuple element at index 0 in builtins.tuple |
23+
| file://:0:0:0:0 | [summary] to write: return (return) in builtins.dict | file://:0:0:0:0 | [summary] to write: return (return) in builtins.dict |
24+
| file://:0:0:0:0 | [summary] to write: return (return) in builtins.frozenset | file://:0:0:0:0 | [summary] to write: return (return) in builtins.frozenset |
25+
| file://:0:0:0:0 | [summary] to write: return (return) in builtins.list | file://:0:0:0:0 | [summary] to write: return (return) in builtins.list |
326
| file://:0:0:0:0 | [summary] to write: return (return) in builtins.reversed | file://:0:0:0:0 | [summary] to write: return (return) in builtins.reversed |
27+
| file://:0:0:0:0 | [summary] to write: return (return) in builtins.set | file://:0:0:0:0 | [summary] to write: return (return) in builtins.set |
28+
| file://:0:0:0:0 | [summary] to write: return (return) in builtins.tuple | file://:0:0:0:0 | [summary] to write: return (return) in builtins.tuple |
429
| file://:0:0:0:0 | [summary] to write: return (return) in dict.setdefault | file://:0:0:0:0 | [summary] to write: return (return) in dict.setdefault |
30+
| file://:0:0:0:0 | [summary] to write: return (return).List element in builtins.list | file://:0:0:0:0 | [summary] to write: return (return).List element in builtins.list |
531
| file://:0:0:0:0 | [summary] to write: return (return).List element in builtins.reversed | file://:0:0:0:0 | [summary] to write: return (return).List element in builtins.reversed |
32+
| file://:0:0:0:0 | [summary] to write: return (return).Set element in builtins.frozenset | file://:0:0:0:0 | [summary] to write: return (return).Set element in builtins.frozenset |
33+
| file://:0:0:0:0 | [summary] to write: return (return).Set element in builtins.set | file://:0:0:0:0 | [summary] to write: return (return).Set element in builtins.set |
34+
| file://:0:0:0:0 | [summary] to write: return (return).Tuple element at index 0 in builtins.tuple | file://:0:0:0:0 | [summary] to write: return (return).Tuple element at index 0 in builtins.tuple |
35+
| file://:0:0:0:0 | parameter position 0 of builtins.dict | file://:0:0:0:0 | parameter position 0 of builtins.dict |
36+
| file://:0:0:0:0 | parameter position 0 of builtins.frozenset | file://:0:0:0:0 | parameter position 0 of builtins.frozenset |
37+
| file://:0:0:0:0 | parameter position 0 of builtins.list | file://:0:0:0:0 | parameter position 0 of builtins.list |
638
| file://:0:0:0:0 | parameter position 0 of builtins.reversed | file://:0:0:0:0 | parameter position 0 of builtins.reversed |
39+
| file://:0:0:0:0 | parameter position 0 of builtins.set | file://:0:0:0:0 | parameter position 0 of builtins.set |
40+
| file://:0:0:0:0 | parameter position 0 of builtins.tuple | file://:0:0:0:0 | parameter position 0 of builtins.tuple |
741
| file://:0:0:0:0 | parameter position 1 of dict.setdefault | file://:0:0:0:0 | [summary] to write: return (return) in dict.setdefault |
842
| file://:0:0:0:0 | parameter position 1 of dict.setdefault | file://:0:0:0:0 | parameter position 1 of dict.setdefault |
943
| test.py:0:0:0:0 | GSSA Variable __name__ | test.py:0:0:0:0 | GSSA Variable __name__ |

0 commit comments

Comments
 (0)