/**

class Node extends Impl::TApiNode {

/**

DataFlow::Node getAValueReachableFromSource() {

exists(DataFlow::LocalSourceNode src | Impl::use(this, src) |

Impl::trackUseNode(src).flowsTo(result)

)

}

/**

DataFlow::Node asSink() { Impl::rhs(this, result) }

/**

DataFlow::Node getAValueReachingSink() { result = Impl::trackDefNode(this.asSink()) }

/**

DataFlow::LocalSourceNode asSource() { Impl::use(this, result) }

/**

CallNode getACall() { result = this.getReturn().asSource() }

/**

bindingset[m]

bindingset[result]

Node getMember(string m) { result = this.getASuccessor(Label::member(m)) }

/**

Node getUnknownMember() { result = this.getASuccessor(Label::unknownMember()) }

/**

Node getAMember() {

result = this.getASuccessor(Label::member(_)) or

result = this.getUnknownMember()

}

/**

Node getReturn() { result = this.getASuccessor(Label::return()) }

/**

Node getInstanceFromAnnotation() { result = this.getASuccessor(Label::annotation()) }

/**

Node getParameter(int i) { result = this.getASuccessor(Label::parameter(i)) }

/**

Node getKeywordParameter(string name) {

result = this.getASuccessor(Label::keywordParameter(name))

}

/** Gets the node representing the self parameter */

Node getSelfParameter() { result = this.getASuccessor(Label::selfParameter()) }

/**

int getNumParameter() { result = max(int s | exists(this.getParameter(s))) + 1 }

/**

Node getASubclass() { result = this.getASuccessor(Label::subclass()) }

/**

Node getAnInstance() {

result in [this.getASubclass*().getReturn(), this.getASubclass*().getInstanceFromAnnotation()]

}

/**

Node getAwaited() { result = this.getASuccessor(Label::await()) }

/**

Node getASubscript() { result = this.getASuccessor(Label::subscript()) }

/**

Node getIndex() { result = this.getASuccessor(Label::index()) }

/**

Node getSubscript(string key) {

exists(API::Node index | result = this.getSubscriptAt(index) |

key = index.getAValueReachingSink().asExpr().(PY::StringLiteral).getText()

)

}

/**

Node getSubscriptAt(API::Node index) {

result = this.getASubscript() and

index = this.getIndex() and

(

// subscripting

exists(PY::SubscriptNode subscript |

subscript.getObject() = this.getAValueReachableFromSource().asCfgNode() and

subscript.getIndex() = index.asSink().asCfgNode()

|

// reading

subscript = result.asSource().asCfgNode()

or

// writing

subscript.(PY::DefinitionNode).getValue() = result.asSink().asCfgNode()

)

or

// dictionary literals

exists(PY::Dict dict, PY::KeyValuePair item |

dict = this.getAValueReachingSink().asExpr() and

dict.getItem(_) = item and

item.getKey() = index.asSink().asExpr()

|

item.getValue() = result.asSink().asExpr()

)

)

}

/**

string getPath() {

result = min(string p | p = this.getAPath(Impl::distanceFromRoot(this)) | p)

}

/**

Node getASuccessor(Label::ApiLabel lbl) { Impl::edge(this, lbl, result) }

/**

Node getAPredecessor(Label::ApiLabel lbl) { this = result.getASuccessor(lbl) }

/**

Node getAPredecessor() { result = this.getAPredecessor(_) }

/**

Node getASuccessor() { result = this.getASuccessor(_) }

/**

DataFlow::Node getInducingNode() { this = Impl::MkUse(result) or this = Impl::MkDef(result) }

/** Gets the location of this node */

PY::Location getLocation() { result = this.getInducingNode().getLocation() }

/**

deprecated predicate hasLocationInfo(

string filepath, int startline, int startcolumn, int endline, int endcolumn

) {

this.getInducingNode().hasLocationInfo(filepath, startline, startcolumn, endline, endcolumn)

or

// For nodes that do not have a meaningful location, `path` is the empty string and all other

// parameters are zero.

not exists(this.getInducingNode()) and

filepath = "" and

startline = 0 and

startcolumn = 0 and

endline = 0 and

endcolumn = 0

}

/**

abstract string toString();

/**

private string getAPath(int length) {

this instanceof Impl::MkRoot and

length = 0 and

result = ""

or

exists(Node pred, Label::ApiLabel lbl, string predpath |

Impl::edge(pred, lbl, this) and

predpath = pred.getAPath(length - 1) and

exists(string dot | if length = 1 then dot = "" else dot = "." |

result = predpath + dot + lbl and

// avoid producing strings longer than 1MB

result.length() < 1000 * 1000

)

) and

length in [1 .. Impl::distanceFromRoot(this)]

}

/** Gets the shortest distance from the root to this node in the API graph. */

int getDepth() { result = Impl::distanceFromRoot(this) }

}

/** The root node of an API graph. */

class Root extends Node, Impl::MkRoot {

override string toString() { result = "root" }

}

/** A node corresponding to the use of an API component. */

class Use extends Node, Impl::TUse {

override string toString() {

exists(string type |

this = Impl::MkUse(_) and type = "Use "

or

this = Impl::MkModuleImport(_) and type = "ModuleImport "

|

result = type + this.getPath()

or

not exists(this.getPath()) and result = type + "with no path"

)

}

}

/** A node corresponding to the rhs of an API component. */

class Def extends Node, Impl::TDef {

override string toString() {

exists(string type | this = Impl::MkDef(_) and type = "Def " |

result = type + this.getPath()

or

not exists(this.getPath()) and result = type + "with no path"

)

}

}

/** Gets the root node. */

Root root() { any() }

/**

Node moduleImport(string m) {

result = Impl::MkModuleImport(m) and

// restrict `moduleImport` so it will never give results for a dotted name. Note

// that we cannot move this logic to the `MkModuleImport` construction, since we

// need the intermediate API graph nodes for the prefixes in `import foo.bar.baz`.

not m.matches("%.%")

}

/**

overlay[local]

predicate moduleImportExists(string m) {

Impl::isImported(m) and

// restrict `moduleImport` so it will never give results for a dotted name. Note

// that we cannot move this logic to the `MkModuleImport` construction, since we

// need the intermediate API graph nodes for the prefixes in `import foo.bar.baz`.

not m.matches("%.%")

}

/** Gets a node corresponding to the built-in with the given name, if any. */

Node builtin(string n) { result = moduleImport("builtins").getMember(n) }

/**

class CallNode extends DataFlow::CallCfgNode {

API::Node callee;

CallNode() { this = callee.getReturn().asSource() }

/** Gets the API node for the `i`th parameter of this invocation. */

pragma[nomagic]

Node getParameter(int i) {

result = callee.getParameter(i) and

result = this.getAParameterCandidate(i)

}

/**

pragma[noinline]

private Node getAParameterCandidate(int i) { result.asSink() = this.getArg(i) }

/** Gets the API node for a parameter of this invocation. */

Node getAParameter() { result = this.getParameter(_) }

/** Gets the object that this method-call is being called on, if this is a method-call */

Node getSelfParameter() {

result.asSink() = this.(DataFlow::MethodCallNode).getObject() and

result = callee.getSelfParameter()

}

/** Gets the API node for the keyword parameter `name` of this invocation. */

Node getKeywordParameter(string name) {

result = callee.getKeywordParameter(name) and

result = this.getAKeywordParameterCandidate(name)

}

/** Gets the API node for the parameter that has index `i` or has keyword `name`. */

bindingset[i, name]

Node getParameter(int i, string name) {

result = this.getParameter(i)

or

result = this.getKeywordParameter(name)

}

pragma[noinline]

private Node getAKeywordParameterCandidate(string name) {

result.asSink() = this.getArgByName(name)

}

/** Gets the API node for the return value of this call. */

Node getReturn() {

result = callee.getReturn() and

result.asSource() = this

}

/**

int getNumArgument() { result = count(this.getArg(_)) }

}

/**

abstract class EntryPoint extends string {

bindingset[this]

EntryPoint() { any() }

/** Gets a data-flow node corresponding to a use-node for this entry point. */

DataFlow::LocalSourceNode getASource() { none() }

/** Gets a data-flow node corresponding to a def-node for this entry point. */

DataFlow::Node getASink() { none() }

/** Gets an API-node for this entry point. */

API::Node getANode() { result = root().getASuccessor(Label::entryPoint(this)) }

}

/**

cached

private module Impl {

/*

cached

newtype TApiNode =

/** The root of the API graph. */

MkRoot() or

/** An abstract representative for imports of the module called `name`. */

MkModuleImport(string name) {

// Ignore the following module name for Python 2, as we alias `__builtin__` to `builtins` elsewhere

(name != "__builtin__" or PY::major_version() = 3) and

(

imports(_, name)

or

// When we `import foo.bar.baz` we want to create API graph nodes also for the prefixes

// `foo` and `foo.bar`:

name = any(PY::ImportExpr e | not e.isRelative()).getAnImportedModuleName()

)

or

// The `builtins` module should always be implicitly available

name = "builtins"

} or

/** A use of an API member at the node `nd`. */

MkUse(DataFlow::Node nd) { use(_, _, nd) } or

MkDef(DataFlow::Node nd) { rhs(_, _, nd) }

class TUse = MkModuleImport or MkUse;

class TDef = MkDef;

/**

cached

predicate prefix_member(TApiNode base, string member, TApiNode sub) {

exists(string sub_str, string regexp |

regexp = "(.+)[.]([^.]+)" and

base = MkModuleImport(sub_str.regexpCapture(regexp, 1)) and

member = sub_str.regexpCapture(regexp, 2) and

sub = MkModuleImport(sub_str)

)

}

/**

private predicate imports(DataFlow::CfgNode imp, string name) {

exists(PY::ImportExprNode iexpr |

imp.getNode() = iexpr and

not iexpr.getNode().isRelative() and

name = iexpr.getNode().getImportedModuleName()

)

}

/**

overlay[local]

cached

predicate isImported(string name) {

// Ignore the following module name for Python 2, as we alias `__builtin__` to `builtins` elsewhere

(name != "__builtin__" or PY::major_version() = 3) and

(

exists(PY::ImportExpr iexpr |

not iexpr.isRelative() and

name = iexpr.getImportedModuleName()

)

or

// When we `import foo.bar.baz` we want to create API graph nodes also for the prefixes

// `foo` and `foo.bar`:

name = any(PY::ImportExpr e | not e.isRelative()).getAnImportedModuleName()

)

or

// The `builtins` module should always be implicitly available

name = "builtins"

}

private import semmle.python.dataflow.new.internal.Builtins

private import semmle.python.dataflow.new.internal.ImportStar

/**

private TApiNode potential_import_star_base(PY::Scope s) {

exists(DataFlow::Node n |

n.(DataFlow::CfgNode).getNode() = ImportStar::potentialImportStarBase(s) and

use(result, n)

)

}

/**

cached

predicate rhs(TApiNode base, Label::ApiLabel lbl, DataFlow::Node rhs) {

exists(DataFlow::Node def, DataFlow::LocalSourceNode pred |

rhs(base, def) and pred = trackDefNode(def)

|

// from `x` to a definition of `x.prop`

exists(DataFlow::AttrWrite aw | aw = pred.getAnAttributeWrite() |

lbl = Label::memberFromRef(aw) and

rhs = aw.getValue()

)

or

// dictionary literals

exists(PY::Dict dict, PY::KeyValuePair item |

dict = pred.(DataFlow::ExprNode).getNode().getNode() and

dict.getItem(_) = item

|

// from `x` to `{ "key": x }`

// TODO: once convenient, this should be done at a higher level than the AST,

// at least at the CFG layer, to take splitting into account.

rhs.(DataFlow::ExprNode).getNode().getNode() = item.getValue() and

lbl = Label::subscript()

or

// from `"key"` to `{ "key": x }`

// TODO: once convenient, this should be done at a higher level than the AST,

// at least at the CFG layer, to take splitting into account.

rhs.(DataFlow::ExprNode).getNode().getNode() = item.getKey() and

lbl = Label::index()

)

or

// list literals, from `x` to `[x]`

// TODO: once convenient, this should be done at a higher level than the AST,

// at least at the CFG layer, to take splitting into account.

// Also consider `SequenceNode for generality.

exists(PY::List list | list = pred.(DataFlow::ExprNode).getNode().getNode() |

rhs.(DataFlow::ExprNode).getNode().getNode() = list.getAnElt() and

lbl = Label::subscript()

)

or

exists(PY::CallableExpr fn | fn = pred.(DataFlow::ExprNode).getNode().getNode() |

not fn.getInnerScope().isAsync() and

lbl = Label::return() and

exists(PY::Return ret |

rhs.(DataFlow::ExprNode).getNode().getNode() = ret.getValue() and

ret.getScope() = fn.getInnerScope()

)

)

)

or

argumentPassing(base, lbl, rhs)

or

exists(DataFlow::LocalSourceNode src, DataFlow::AttrWrite aw |

use(base, src) and aw = trackUseNode(src).getAnAttributeWrite() and rhs = aw.getValue()

|

lbl = Label::memberFromRef(aw)

)

or

// subscripting

exists(DataFlow::LocalSourceNode src, DataFlow::Node subscript, DataFlow::Node index |

use(base, src) and

subscript = trackUseNode(src).getSubscript(index)

|

// from `x` to a definition of `x[...]`

rhs.asCfgNode() = subscript.asCfgNode().(PY::DefinitionNode).getValue() and

lbl = Label::subscript()

or

// from `x` to `"key"` in `x["key"]`

rhs = index and

lbl = Label::index()

)

or

exists(EntryPoint entry |

base = root() and

lbl = Label::entryPoint(entry) and

rhs = entry.getASink()

)

}

/**

cached

predicate use(TApiNode base, Label::ApiLabel lbl, DataFlow::Node ref) {

exists(DataFlow::LocalSourceNode src, DataFlow::LocalSourceNode pred |

// First, we find a predecessor of the node `ref` that we want to determine. The predecessor

// is any node that is a type-tracked use of a data flow node (`src`), which is itself a

// reference to the API node `base`. Thus, `pred` and `src` both represent uses of `base`.

//

// Once we have identified the predecessor, we define its relation to the successor `ref` as

// well as the label on the edge from `pred` to `ref`. This label describes the nature of

// the relationship between `pred` and `ref`.

use(base, src) and pred = trackUseNode(src)

|

// Referring to an attribute on a node that is a use of `base`:

lbl = Label::memberFromRef(ref) and

ref = pred.getAnAttributeRead()

or

// Calling a node that is a use of `base`

lbl = Label::return() and

ref = pred.getACall()

or

// Getting an instance via a type annotation

lbl = Label::annotation() and

ref = pred.getAnAnnotatedInstance()

or

// Awaiting a node that is a use of `base`

lbl = Label::await() and

ref = pred.getAnAwaited()

or

// Subscripting a node that is a use of `base`

lbl = Label::subscript() and

ref = pred.getSubscript(_) and

ref.asCfgNode().isLoad()

or

// Subscript via comprehension

lbl = Label::subscript() and

exists(PY::Comp comp |

pred.asExpr() = comp.getIterable() and

ref.asExpr() = comp.getNthInnerLoop(0).getTarget()

)

or

// Subclassing a node

lbl = Label::subclass() and

exists(PY::ClassExpr clsExpr, DataFlow::Node superclass | pred.flowsTo(superclass) |

clsExpr.getABase() = superclass.asExpr() and

// Potentially a class decorator could do anything, but we assume they are

// "benign" and let subclasses edges flow through anyway.

// see example in https://github.com/django/django/blob/c2250cfb80e27cdf8d098428824da2800a18cadf/tests/auth_tests/test_views.py#L40-L46

(

ref.(DataFlow::ExprNode).getNode().getNode() = clsExpr

or

ref.(DataFlow::ExprNode).getNode().getNode() = clsExpr.getADecoratorCall()

)

)

)

or

exists(DataFlow::Node def, PY::CallableExpr fn |

rhs(base, def) and fn = trackDefNode(def).(DataFlow::ExprNode).getNode().getNode()

|

exists(int i, int offset |

if exists(PY::Parameter p | p = fn.getInnerScope().getAnArg() and p.isSelf())

then offset = 1

else offset = 0

|

lbl = Label::parameter(i - offset) and

ref.(DataFlow::ExprNode).getNode().getNode() = fn.getInnerScope().getArg(i)

)

or

exists(string name, PY::Parameter param |

lbl = Label::keywordParameter(name) and

param = fn.getInnerScope().getArgByName(name) and

not param.isSelf() and

ref.(DataFlow::ExprNode).getNode().getNode() = param

)

or

lbl = Label::selfParameter() and

ref.(DataFlow::ExprNode).getNode().getNode() =

any(PY::Parameter p | p = fn.getInnerScope().getAnArg() and p.isSelf())

)

or

// Built-ins, treated as members of the module `builtins`

base = MkModuleImport("builtins") and

lbl = Label::member(any(string name | ref = Builtins::likelyBuiltin(name)))

or

// Unknown variables that may belong to a module imported with `import *`

exists(PY::Scope s |

base = potential_import_star_base(s) and

lbl =

Label::member(any(string name |

ImportStar::namePossiblyDefinedInImportStar(ref.(DataFlow::CfgNode).getNode(), name, s)

))

)

or

exists(EntryPoint entry |

base = root() and

lbl = Label::entryPoint(entry) and

ref = entry.getASource()

)

}

/**

cached

predicate use(TApiNode nd, DataFlow::Node ref) {

exists(string name |

nd = MkModuleImport(name) and

imports(ref, name)

)

or

// Ensure the Python 2 `__builtin__` module gets the name of the Python 3 `builtins` module.

PY::major_version() = 2 and

nd = MkModuleImport("builtins") and

imports(ref, "__builtin__")

or

nd = MkUse(ref)

}

/**

private DataFlow::TypeTrackingNode trackUseNode(

DataFlow::LocalSourceNode src, DataFlow::TypeTracker t

) {

t.start() and

use(_, src) and

result = src

or

exists(DataFlow::TypeTracker t2 | result = trackUseNode(src, t2).track(t2, t))

}

/**

private predicate argumentPassing(TApiNode base, Label::ApiLabel lbl, DataFlow::Node arg) {

exists(DataFlow::Node use, DataFlow::LocalSourceNode pred |

use(base, use) and pred = trackUseNode(use)

|

exists(int i |

lbl = Label::parameter(i) and

arg = pred.getACall().getArg(i)

)

or

exists(string name | lbl = Label::keywordParameter(name) |

arg = pred.getACall().getArgByName(name)

)

or

lbl = Label::selfParameter() and

arg = pred.getACall().(DataFlow::MethodCallNode).getObject()

)

}

/**

cached

DataFlow::LocalSourceNode trackDefNode(DataFlow::Node nd) {

result = trackDefNode(nd, DataFlow::TypeBackTracker::end())

}

private DataFlow::LocalSourceNode trackDefNode(DataFlow::Node nd, DataFlow::TypeBackTracker t) {

t.start() and

rhs(_, nd) and

result = nd.getALocalSource()

or

exists(DataFlow::TypeBackTracker t2 | result = trackDefNode(nd, t2).backtrack(t2, t))

}

/**