Skip to content

Python: Support integer subscripts in the API graph - #15497

Draft
yoff wants to merge 2 commits into
github:mainfrom
yoff:python/test-subscript-int
Draft

Python: Support integer subscripts in the API graph#15497
yoff wants to merge 2 commits into
github:mainfrom
yoff:python/test-subscript-int

Conversation

@yoff

@yoff yoff commented Jan 31, 2024

Copy link
Copy Markdown
Contributor

Recall that for

foo.f(data = d)

we can find d as moduleImport("foo").getMember("f").getKeywordParameter("data"). We will call this API path D.

We were already able to find value in

 d = {"key": value}
foo.f(d)

and

d["key"] = value
foo.f(d)

via D.getSubscript("key").

But we could not find 'value' in

 d = [value]
foo.f(d)

and

d[0] = value
foo.f(d)

at all. We can now find these via D.getIntSubscript(0).

Inspired by https://github.slack.com/archives/CPGHLR8DD/p1706707895922829

@yoff yoff added the Awaiting evaluation Do not merge yet, this PR is waiting for an evaluation to finish label Jan 31, 2024

predicate entryPoint(
DataFlow::Node argument, string parameterName, string functionName, DataFlow::Node outNode,
string alreadyModelled

Check warning

Code scanning / CodeQL

Misspelling

This variable name contains the non-US spelling 'modelled', which should instead be 'modeled'.

from
EntryPointsByQuery e, DataFlow::Node argument, string parameter, string functionName,
DataFlow::Node outNode, string alreadyModelled

Check warning

Code scanning / CodeQL

Misspelling

This variable name contains the non-US spelling 'modelled', which should instead be 'modeled'.
Sign up for free to join this conversation on GitHub. Already have an account? Sign in to comment

Labels

Awaiting evaluation Do not merge yet, this PR is waiting for an evaluation to finish Python

Projects

None yet

Development

Successfully merging this pull request may close these issues.

2 participants