Skip to content

Commit 69c27c5

Browse files
yoffCopilot
yoff
and
Copilot
committed
Python: rebless second round after shared-CFG dataflow migration
Second batch of test reblessings, capturing changes in result content (not just toString labels): - Framework taint/concept tests (fastapi, sqlalchemy, aiohttp, lxml, stdlib, django-orm): mostly gained MISSING-tainted annotations where the new dataflow no longer reaches sinks. Some are real taint regressions; left as documented failures for follow-up. - Exception-handler tests (CWE-209-StackTraceExposure, EmptyExcept, CatchingBaseException, IncorrectExceptOrder, FileNotAlwaysClosed, FindSubclass/Find, Statements/exit/UseOfExit): the no-raise shared CFG abstraction does not emit ExceptionSuccessor abrupt-completion edges from arbitrary expressions, so except-handler bodies (and their exception target Names) are statically dead. Tracked separately under cfg-modelling-exceptions. - Dataflow-path / control-flow node toString polish across the security query suite (PathInjection, CodeInjection, UnsafeUnpacking, UnsafeUsageOfClientSideEncryptionVersion, RequestWithoutValidation, ReflectedXss, CallGraph): simple-leaf nodes now stringify as their AST text instead of 'After X'. - SSA / call-graph improvements (CmpTest, CallGraph/InlineCallGraphTest): fewer SSA mismatches between new and old; two previously-MISSING tt= annotations resolved. Co-authored-by: Copilot <223556219+Copilot@users.noreply.github.com>
1 parent 66d7e7c commit 69c27c5

32 files changed

Lines changed: 1173 additions & 969 deletions

File tree

‎python/ql/test/2/extractor-tests/hidden/test.expected‎

Lines changed: 2 additions & 0 deletions
Original file line numberDiff line numberDiff line change
@@ -1,5 +1,7 @@
1+
| .hidden/inner |
12
| .hidden/inner/test.py |
23
| .hidden/module.py |
4+
| folder |
35
| folder/module.py |
46
| package |
57
| package/__init__.py |

‎python/ql/test/2/query-tests/Exceptions/generators/UnguardedNextInGenerator.expected‎

Lines changed: 3 additions & 0 deletions
Original file line numberDiff line numberDiff line change
@@ -1,2 +1,5 @@
11
| test.py:5:15:5:22 | ControlFlowNode for next() | Call to 'next()' in a generator. |
22
| test.py:10:20:10:27 | ControlFlowNode for next() | Call to 'next()' in a generator. |
3+
| test.py:34:15:34:24 | ControlFlowNode for next() | Call to 'next()' in a generator. |
4+
| test.py:41:19:41:28 | ControlFlowNode for next() | Call to 'next()' in a generator. |
5+
| test.py:62:19:62:28 | ControlFlowNode for next() | Call to 'next()' in a generator. |

‎python/ql/test/experimental/library-tests/CallGraph-type-annotations/InlineCallGraphTest.expected‎

Lines changed: 4 additions & 2 deletions
Original file line numberDiff line numberDiff line change
@@ -1,6 +1,8 @@
11
testFailures
2+
| type_annotations.py:6:16:6:32 | Comment # $ tt=Foo.method | Missing result: tt=Foo.method |
3+
| type_annotations.py:16:16:16:32 | Comment # $ tt=Foo.method | Missing result: tt=Foo.method |
4+
| type_annotations.py:29:5:29:14 | Attribute() | Fixed missing result: tt=Foo.method |
25
debug_callableNotUnique
36
pointsTo_found_typeTracker_notFound
47
typeTracker_found_pointsTo_notFound
5-
| type_annotations.py:6:5:6:14 | ControlFlowNode for Attribute() | Foo.method |
6-
| type_annotations.py:16:5:16:14 | ControlFlowNode for Attribute() | Foo.method |
8+
| type_annotations.py:29:5:29:14 | Attribute() | Foo.method |

‎python/ql/test/experimental/library-tests/CallGraph/InlineCallGraphTest.expected‎

Lines changed: 50 additions & 50 deletions
Original file line numberDiff line numberDiff line change
@@ -1,54 +1,54 @@
11
testFailures
2+
| code/conditional_in_argument.py:18:5:18:11 | Attribute() | Fixed missing result: tt=X.bar |
3+
| code/funky_regression.py:15:9:15:17 | Attribute() | Fixed missing result: tt=Wat.f2 |
24
debug_callableNotUnique
35
pointsTo_found_typeTracker_notFound
4-
| code/class_attr_assign.py:10:9:10:27 | ControlFlowNode for Attribute() | my_func |
5-
| code/class_attr_assign.py:11:9:11:25 | ControlFlowNode for Attribute() | my_func |
6-
| code/class_attr_assign.py:26:9:26:25 | ControlFlowNode for Attribute() | DummyObject.method |
7-
| code/class_super.py:50:1:50:6 | ControlFlowNode for Attribute() | outside_def |
8-
| code/conditional_in_argument.py:18:5:18:11 | ControlFlowNode for Attribute() | X.bar |
9-
| code/func_defined_outside_class.py:21:1:21:11 | ControlFlowNode for Attribute() | A.foo |
10-
| code/func_defined_outside_class.py:22:1:22:15 | ControlFlowNode for Attribute() | outside |
11-
| code/func_defined_outside_class.py:24:1:24:14 | ControlFlowNode for Attribute() | outside_sm |
12-
| code/func_defined_outside_class.py:25:1:25:14 | ControlFlowNode for Attribute() | outside_cm |
13-
| code/func_defined_outside_class.py:38:11:38:21 | ControlFlowNode for _gen() | B._gen |
14-
| code/func_defined_outside_class.py:39:11:39:21 | ControlFlowNode for _gen() | B._gen |
15-
| code/func_defined_outside_class.py:42:1:42:7 | ControlFlowNode for Attribute() | B._gen.func |
16-
| code/func_defined_outside_class.py:43:1:43:7 | ControlFlowNode for Attribute() | B._gen.func |
17-
| code/funky_regression.py:15:9:15:17 | ControlFlowNode for Attribute() | Wat.f2 |
18-
| code/type_tracking_limitation.py:8:1:8:3 | ControlFlowNode for x() | my_func |
6+
| code/class_attr_assign.py:10:9:10:27 | Attribute() | my_func |
7+
| code/class_attr_assign.py:11:9:11:25 | Attribute() | my_func |
8+
| code/class_attr_assign.py:26:9:26:25 | Attribute() | DummyObject.method |
9+
| code/class_super.py:50:1:50:6 | Attribute() | outside_def |
10+
| code/func_defined_outside_class.py:21:1:21:11 | Attribute() | A.foo |
11+
| code/func_defined_outside_class.py:22:1:22:15 | Attribute() | outside |
12+
| code/func_defined_outside_class.py:24:1:24:14 | Attribute() | outside_sm |
13+
| code/func_defined_outside_class.py:25:1:25:14 | Attribute() | outside_cm |
14+
| code/func_defined_outside_class.py:38:11:38:21 | _gen() | B._gen |
15+
| code/func_defined_outside_class.py:39:11:39:21 | _gen() | B._gen |
16+
| code/func_defined_outside_class.py:42:1:42:7 | Attribute() | B._gen.func |
17+
| code/func_defined_outside_class.py:43:1:43:7 | Attribute() | B._gen.func |
18+
| code/type_tracking_limitation.py:8:1:8:3 | x() | my_func |
1919
typeTracker_found_pointsTo_notFound
20-
| code/callable_as_argument.py:29:5:29:12 | ControlFlowNode for Attribute() | test_class.InsideTestFunc.sm |
21-
| code/class_construction.py:44:9:44:26 | ControlFlowNode for Attribute() | WithNew.some_method |
22-
| code/class_construction.py:61:9:61:26 | ControlFlowNode for Attribute() | WithNew.some_method |
23-
| code/class_construction.py:75:9:75:27 | ControlFlowNode for Attribute() | ExtraCallToInit.__init__ |
24-
| code/class_special_methods.py:22:9:22:16 | ControlFlowNode for self() | Base.__call__ |
25-
| code/class_special_methods.py:22:9:22:16 | ControlFlowNode for self() | Sub.__call__ |
26-
| code/class_special_methods.py:33:1:33:5 | ControlFlowNode for b() | Base.__call__ |
27-
| code/class_special_methods.py:59:1:59:7 | ControlFlowNode for sub() | Sub.__call__ |
28-
| code/class_super.py:43:9:43:21 | ControlFlowNode for Attribute() | A.bar |
29-
| code/class_super.py:44:9:44:27 | ControlFlowNode for Attribute() | A.bar |
30-
| code/class_super.py:63:1:63:18 | ControlFlowNode for Attribute() | A.foo |
31-
| code/class_super.py:78:9:78:28 | ControlFlowNode for Attribute() | A.foo |
32-
| code/class_super.py:81:1:81:12 | ControlFlowNode for Attribute() | C.foo_on_A |
33-
| code/class_super.py:92:9:92:21 | ControlFlowNode for Attribute() | X.foo |
34-
| code/class_super.py:97:9:97:21 | ControlFlowNode for Attribute() | X.foo |
35-
| code/class_super.py:97:9:97:21 | ControlFlowNode for Attribute() | Y.foo |
36-
| code/class_super.py:101:1:101:7 | ControlFlowNode for Attribute() | Z.foo |
37-
| code/class_super.py:108:1:108:8 | ControlFlowNode for Attribute() | Z.foo |
38-
| code/def_in_function.py:22:5:22:11 | ControlFlowNode for Attribute() | test.A.foo |
39-
| code/func_ref_in_content.py:32:1:32:4 | ControlFlowNode for f4() | func |
40-
| code/func_ref_in_content.py:46:1:46:4 | ControlFlowNode for f5() | func |
41-
| code/func_ref_in_content.py:48:1:48:15 | ControlFlowNode for Subscript() | func2 |
42-
| code/func_ref_in_content.py:50:1:50:19 | ControlFlowNode for Subscript() | func2 |
43-
| code/isinstance.py:9:13:9:22 | ControlFlowNode for Attribute() | A.foo |
44-
| code/isinstance.py:9:13:9:22 | ControlFlowNode for Attribute() | ASub.foo |
45-
| code/isinstance.py:14:13:14:22 | ControlFlowNode for Attribute() | A.foo |
46-
| code/isinstance.py:14:13:14:22 | ControlFlowNode for Attribute() | ASub.foo |
47-
| code/isinstance.py:14:13:14:22 | ControlFlowNode for Attribute() | B.foo |
48-
| code/isinstance.py:17:13:17:22 | ControlFlowNode for Attribute() | A.foo |
49-
| code/nested_class.py:83:9:83:16 | ControlFlowNode for Attribute() | X.class_def_in_func.Y.meth |
50-
| code/self_passing.py:16:9:16:18 | ControlFlowNode for Attribute() | A.foo |
51-
| code/self_passing.py:16:9:16:18 | ControlFlowNode for Attribute() | B.foo |
52-
| code/self_passing.py:67:9:67:16 | ControlFlowNode for Attribute() | Y.cm |
53-
| code/self_passing.py:69:9:69:17 | ControlFlowNode for Attribute() | X.foo |
54-
| code/underscore_prefix_func_name.py:14:5:14:19 | ControlFlowNode for some_function() | some_function |
20+
| code/callable_as_argument.py:29:5:29:12 | Attribute() | test_class.InsideTestFunc.sm |
21+
| code/class_construction.py:44:9:44:26 | Attribute() | WithNew.some_method |
22+
| code/class_construction.py:61:9:61:26 | Attribute() | WithNew.some_method |
23+
| code/class_construction.py:75:9:75:27 | Attribute() | ExtraCallToInit.__init__ |
24+
| code/class_special_methods.py:22:9:22:16 | self() | Base.__call__ |
25+
| code/class_special_methods.py:22:9:22:16 | self() | Sub.__call__ |
26+
| code/class_special_methods.py:33:1:33:5 | b() | Base.__call__ |
27+
| code/class_special_methods.py:59:1:59:7 | sub() | Sub.__call__ |
28+
| code/class_super.py:43:9:43:21 | Attribute() | A.bar |
29+
| code/class_super.py:44:9:44:27 | Attribute() | A.bar |
30+
| code/class_super.py:63:1:63:18 | Attribute() | A.foo |
31+
| code/class_super.py:78:9:78:28 | Attribute() | A.foo |
32+
| code/class_super.py:81:1:81:12 | Attribute() | C.foo_on_A |
33+
| code/class_super.py:92:9:92:21 | Attribute() | X.foo |
34+
| code/class_super.py:97:9:97:21 | Attribute() | X.foo |
35+
| code/class_super.py:97:9:97:21 | Attribute() | Y.foo |
36+
| code/class_super.py:101:1:101:7 | Attribute() | Z.foo |
37+
| code/class_super.py:108:1:108:8 | Attribute() | Z.foo |
38+
| code/def_in_function.py:22:5:22:11 | Attribute() | test.A.foo |
39+
| code/func_ref_in_content.py:32:1:32:4 | f4() | func |
40+
| code/func_ref_in_content.py:46:1:46:4 | f5() | func |
41+
| code/func_ref_in_content.py:48:1:48:15 | Subscript() | func2 |
42+
| code/func_ref_in_content.py:50:1:50:19 | Subscript() | func2 |
43+
| code/isinstance.py:9:13:9:22 | Attribute() | A.foo |
44+
| code/isinstance.py:9:13:9:22 | Attribute() | ASub.foo |
45+
| code/isinstance.py:14:13:14:22 | Attribute() | A.foo |
46+
| code/isinstance.py:14:13:14:22 | Attribute() | ASub.foo |
47+
| code/isinstance.py:14:13:14:22 | Attribute() | B.foo |
48+
| code/isinstance.py:17:13:17:22 | Attribute() | A.foo |
49+
| code/nested_class.py:83:9:83:16 | Attribute() | X.class_def_in_func.Y.meth |
50+
| code/self_passing.py:16:9:16:18 | Attribute() | A.foo |
51+
| code/self_passing.py:16:9:16:18 | Attribute() | B.foo |
52+
| code/self_passing.py:67:9:67:16 | Attribute() | Y.cm |
53+
| code/self_passing.py:69:9:69:17 | Attribute() | X.foo |
54+
| code/underscore_prefix_func_name.py:14:5:14:19 | some_function() | some_function |

‎python/ql/test/experimental/library-tests/FindSubclass/Find.expected‎

Lines changed: 0 additions & 1 deletion
Original file line numberDiff line numberDiff line change
@@ -4,7 +4,6 @@
44
| flask.MethodView~Subclass | find_subclass_test | Member[C] |
55
| flask.View~Subclass | find_subclass_test | Member[A] |
66
| flask.View~Subclass | find_subclass_test | Member[B] |
7-
| flask.View~Subclass | find_subclass_test | Member[ViewAliasInExcept] |
87
| flask.View~Subclass | find_subclass_test | Member[ViewAliasInTry] |
98
| flask.View~Subclass | find_subclass_test | Member[ViewAlias] |
109
| flask.View~Subclass | find_subclass_test | Member[ViewAlias_no_use] |

0 commit comments

Comments
 (0)