/**

class Node extends Impl::TApiNode {

/**

DataFlow::Node getAUse() {

exists(DataFlow::LocalSourceNode src | Impl::use(this, src) |

Impl::trackUseNode(src).flowsTo(result)

)

}

/**

DataFlow::LocalSourceNode getAnImmediateUse() { Impl::use(this, result) }

/**

DataFlow::CallCfgNode getACall() { result = this.getReturn().getAnImmediateUse() }

/**

bindingset[m]

bindingset[result]

Node getMember(string m) { result = this.getASuccessor(Label::member(m)) }

/**

Node getUnknownMember() { result = this.getASuccessor(Label::unknownMember()) }

/**

Node getAMember() {

result = this.getASuccessor(Label::member(_)) or

result = this.getUnknownMember()

}

/**

Node getReturn() { result = this.getASuccessor(Label::return()) }

/**

Node getASubclass() { result = this.getASuccessor(Label::subclass()) }

/**

Node getAwaited() { result = this.getASuccessor(Label::await()) }

/**

string getPath() {

result = min(string p | p = this.getAPath(Impl::distanceFromRoot(this)) | p)

}

/**

Node getASuccessor(string lbl) { Impl::edge(this, lbl, result) }

/**

Node getAPredecessor(string lbl) { this = result.getASuccessor(lbl) }

/**

Node getAPredecessor() { result = this.getAPredecessor(_) }

/**

Node getASuccessor() { result = this.getASuccessor(_) }

/**

DataFlow::Node getInducingNode() { this = Impl::MkUse(result) }

/**

predicate hasLocationInfo(

string filepath, int startline, int startcolumn, int endline, int endcolumn

) {

this.getInducingNode().hasLocationInfo(filepath, startline, startcolumn, endline, endcolumn)

or

// For nodes that do not have a meaningful location, `path` is the empty string and all other

// parameters are zero.

not exists(this.getInducingNode()) and

filepath = "" and

startline = 0 and

startcolumn = 0 and

endline = 0 and

endcolumn = 0

}

/**

abstract string toString();

/**

private string getAPath(int length) {

this instanceof Impl::MkRoot and

length = 0 and

result = ""

or

exists(Node pred, string lbl, string predpath |

Impl::edge(pred, lbl, this) and

lbl != "" and

predpath = pred.getAPath(length - 1) and

exists(string dot | if length = 1 then dot = "" else dot = "." |

result = predpath + dot + lbl and

// avoid producing strings longer than 1MB

result.length() < 1000 * 1000

)

) and

length in [1 .. Impl::distanceFromRoot(this)]

}

/** Gets the shortest distance from the root to this node in the API graph. */

int getDepth() { result = Impl::distanceFromRoot(this) }

}

/** The root node of an API graph. */

class Root extends Node, Impl::MkRoot {

override string toString() { result = "root" }

}

/** A node corresponding to the use of an API component. */

class Use extends Node, Impl::TUse {

override string toString() {

exists(string type |

this = Impl::MkUse(_) and type = "Use "

or

this = Impl::MkModuleImport(_) and type = "ModuleImport "

|

result = type + this.getPath()

or

not exists(this.getPath()) and result = type + "with no path"

)

}

}

/** Gets the root node. */

Root root() { any() }

/**

Node moduleImport(string m) { result = Impl::MkModuleImport(m) }

/** Gets a node corresponding to the built-in with the given name, if any. */

Node builtin(string n) { result = moduleImport("builtins").getMember(n) }

/**

cached

private module Impl {

/*

private import semmle.python.internal.Awaited

cached

newtype TApiNode =

/** The root of the API graph. */

MkRoot() or

/** An abstract representative for imports of the module called `name`. */

MkModuleImport(string name) {

// Ignore the following module name for Python 2, as we alias `__builtin__` to `builtins` elsewhere

(name != "__builtin__" or major_version() = 3) and

(

imports(_, name)

or

// When we `import foo.bar.baz` we want to create API graph nodes also for the prefixes

// `foo` and `foo.bar`:

name = any(ImportExpr e | not e.isRelative()).getAnImportedModuleName()

)

or

// The `builtins` module should always be implicitly available

name = "builtins"

} or

/** A use of an API member at the node `nd`. */

MkUse(DataFlow::Node nd) { use(_, _, nd) }

class TUse = MkModuleImport or MkUse;

/**

private predicate prefix_member(TApiNode base, string member, TApiNode sub) {

exists(string sub_str, string regexp |

regexp = "(.+)[.]([^.]+)" and

base = MkModuleImport(sub_str.regexpCapture(regexp, 1)) and

member = sub_str.regexpCapture(regexp, 2) and

sub = MkModuleImport(sub_str)

)

}

/**

private predicate imports(DataFlow::Node imp, string name) {

exists(ImportExprNode iexpr |

imp.asCfgNode() = iexpr and

not iexpr.getNode().isRelative() and

name = iexpr.getNode().getImportedModuleName()

)

}

private import semmle.python.dataflow.new.internal.Builtins

private import semmle.python.dataflow.new.internal.ImportStar

/**

private TApiNode potential_import_star_base(Scope s) {

exists(DataFlow::Node n |

n.asCfgNode() = ImportStar::potentialImportStarBase(s) and

use(result, n)

)

}

/**

cached

predicate use(TApiNode base, string lbl, DataFlow::Node ref) {

exists(DataFlow::LocalSourceNode src, DataFlow::LocalSourceNode pred |

// First, we find a predecessor of the node `ref` that we want to determine. The predecessor

// is any node that is a type-tracked use of a data flow node (`src`), which is itself a

// reference to the API node `base`. Thus, `pred` and `src` both represent uses of `base`.

//

// Once we have identified the predecessor, we define its relation to the successor `ref` as

// well as the label on the edge from `pred` to `ref`. This label describes the nature of

// the relationship between `pred` and `ref`.

use(base, src) and pred = trackUseNode(src)

|

// Referring to an attribute on a node that is a use of `base`:

lbl = Label::memberFromRef(ref) and

ref = pred.getAnAttributeReference()

or

// Calling a node that is a use of `base`

lbl = Label::return() and

ref = pred.getACall()

or

// Subclassing a node

lbl = Label::subclass() and

exists(DataFlow::Node superclass | pred.flowsTo(superclass) |

ref.asExpr().(ClassExpr).getABase() = superclass.asExpr()

)

or

// awaiting

exists(DataFlow::Node awaitedValue |

lbl = Label::await() and

ref = awaited(awaitedValue) and

pred.flowsTo(awaitedValue)

)

)

or

// Built-ins, treated as members of the module `builtins`

base = MkModuleImport("builtins") and

lbl = Label::member(any(string name | ref = Builtins::likelyBuiltin(name)))

or

// Unknown variables that may belong to a module imported with `import *`

exists(Scope s |

base = potential_import_star_base(s) and

lbl =

Label::member(any(string name |

ImportStar::namePossiblyDefinedInImportStar(ref.asCfgNode(), name, s)

))

)

}

/**

cached

predicate use(TApiNode nd, DataFlow::Node ref) {

exists(string name |

nd = MkModuleImport(name) and

imports(ref, name)

)

or

// Ensure the Python 2 `__builtin__` module gets the name of the Python 3 `builtins` module.

major_version() = 2 and

nd = MkModuleImport("builtins") and

imports(ref, "__builtin__")

or

nd = MkUse(ref)

}

/**

private DataFlow::TypeTrackingNode trackUseNode(

DataFlow::LocalSourceNode src, DataFlow::TypeTracker t

) {

t.start() and

use(_, src) and

result = src

or

exists(DataFlow::TypeTracker t2 | result = trackUseNode(src, t2).track(t2, t))

}

/**

cached

DataFlow::LocalSourceNode trackUseNode(DataFlow::LocalSourceNode src) {

result = trackUseNode(src, DataFlow::TypeTracker::end()) and

not result instanceof DataFlow::ModuleVariableNode

}

/**

cached

predicate edge(TApiNode pred, string lbl, TApiNode succ) {

/* There's an edge from the root node for each imported module. */

exists(string m |

pred = MkRoot() and

lbl = Label::mod(m)

|

succ = MkModuleImport(m) and

// Only allow undotted names to count as base modules.

not m.matches("%.%")

)

or

/* Step from the dotted module name `foo.bar` to `foo.bar.baz` along an edge labeled `baz` */

exists(string member |

prefix_member(pred, member, succ) and

lbl = Label::member(member)

)

or

/* Every node that is a use of an API component is itself added to the API graph. */

exists(DataFlow::LocalSourceNode ref |

use(pred, lbl, ref) and

succ = MkUse(ref)

)

}

/**

private predicate edge(TApiNode pred, TApiNode succ) { edge(pred, _, succ) }

/** Gets the shortest distance from the root to `nd` in the API graph. */

cached

int distanceFromRoot(TApiNode nd) = shortestDistances(MkRoot/0, edge/2)(_, nd, result)

}

/** Gets the edge label for the module `m`. */

bindingset[m]

bindingset[result]

string mod(string m) { result = "moduleImport(\"" + m + "\")" }

/** Gets the `member` edge label for member `m`. */

bindingset[m]

bindingset[result]

string member(string m) { result = "getMember(\"" + m + "\")" }

/** Gets the `member` edge label for the unknown member. */

string unknownMember() { result = "getUnknownMember()" }

/** Gets the `member` edge label for the given attribute reference. */

string memberFromRef(DataFlow::AttrRef pr) {

result = member(pr.getAttributeName())

or

not exists(pr.getAttributeName()) and

result = unknownMember()

}

/** Gets the `return` edge label. */

string return() { result = "getReturn()" }

/** Gets the `subclass` edge label. */

string subclass() { result = "getASubclass()" }

/** Gets the `await` edge label. */

string await() { result = "getAwaited()" }