codeql
codeql copied to clipboard
Python: Local/Global dataflow analysis not tracing class field?
trafficstars
Python
class Cls:
def __init__(self) -> None:
self.field = 1
def __init__(self, num) -> None:
self.field = num
def print(self) -> None:
print(self.field)
if __name__ == '__main__':
var1 = Cls(2)
var2 = var1
var2.field = 3
var1.print()
var1.field2 = 4
print(var2.field2)
CodeQL
import python
import semmle.python.ApiGraphs
import semmle.python.dataflow.new.DataFlow
import semmle.python.dataflow.new.TaintTracking
module MyConf implements DataFlow::ConfigSig {
predicate isSource(DataFlow::Node source) {
source.asExpr() instanceof IntegerLiteral
}
predicate isSink(DataFlow::Node sink) {
sink = API::builtin("print").getACall().getArg(0)
}
}
module MyFlow = DataFlow::Global<MyConf>;
from DataFlow::Node source, DataFlow::Node sink
where MyFlow::flow(source, sink)
select source, sink
Output
| source | sink |
|---|---|
| 1 | self.field in line 7 |
| 2 | self.field in line 7 |
Expected result
| source | sink |
|---|---|
| 1 | self.field in line 7 |
| 2 | self.field in line 7 |
| 3 | self.field in line 7 |
| 4 | self.field in line 16 |
Perhaps the problem is that CodeQL does not "see" that var1 and var2 are references to the same object. What happens if you don't write var1 = var2 and use var1 in all the places where it says var2 ?
That's the problem. CodeQL does not "see" that var1 and var2 are references to the same object.
So, is there any plan to fix this bug?