-
Notifications
You must be signed in to change notification settings - Fork 1.9k
Expand file tree
/
Copy pathModificationOfLocals.ql
More file actions
41 lines (37 loc) · 1.24 KB
/
ModificationOfLocals.ql
File metadata and controls
41 lines (37 loc) · 1.24 KB
1
2
3
4
5
6
7
8
9
10
11
12
13
14
15
16
17
18
19
20
21
22
23
24
25
26
27
28
29
30
31
32
33
34
35
36
37
38
39
40
41
/**
* @name Modification of dictionary returned by locals()
* @description Modifications of the dictionary returned by locals() are not propagated to the local variables of a function.
* @kind problem
* @tags quality
* reliability
* correctness
* @problem.severity warning
* @sub-severity low
* @precision very-high
* @id py/modification-of-locals
*/
import python
private import LegacyPointsTo
predicate originIsLocals(ControlFlowNodeWithPointsTo n) {
n.pointsTo(_, _, Value::named("locals").getACall())
}
predicate modification_of_locals(ControlFlowNode f) {
originIsLocals(f.(SubscriptNode).getObject()) and
(f.isStore() or f.isDelete())
or
exists(string mname, AttrNode attr |
attr = f.(CallNode).getFunction() and
originIsLocals(attr.getObject(mname))
|
mname in ["pop", "popitem", "update", "clear"]
)
}
from AstNode a, ControlFlowNode f
where
modification_of_locals(f) and
a = f.getNode() and
// in module level scope `locals() == globals()`
// see https://docs.python.org/3/library/functions.html#locals
// FP report in https://github.com/github/codeql/issues/6674
not a.getScope() instanceof ModuleScope
select a, "Modification of the locals() dictionary will have no effect on the local variables."