Start off by reading the README added for explanation :)

The tests included here is by no means complete yet. I wanted to get the approval from the rest of the team before investing more time into it. Please let me know @tausbn and @yoff 😊

I have made sure that all the added Python files are runnable, so we can manually inspect that the annotations are correct.

I would at least like to port all call related cases from https://github.com/github/codeql/tree/master/python/ql/test/library-tests/PointsTo/regressions, although not all of them are critical to handle right away, I think this should the right place to track such instances going forwards.

I also want to point out that I added tests that show the error handling works in a good way. I moved this out of the regular tests because it polluted everything. However, getting the error reporting right was not easy, so I wanted to keep it in there to show it actually works 😄

For further discussion:

Going forwards (if you all agree that this is nice), we need to figure out how to handle these 2 cases

1) "magic" methods in Python

How to handle special methods in Python. For example, if we have obj = MyClass(), then str(obj) would call __str__ if that is defined on MyClass. This can also happen for accessing/assigning/deleting object properties with @property, and many other cases, such as obj + 1 using __add__.

Our current setup of Value.getACall() returning a CallNode doesn't fully support this (since these aren't calls), so although I have included a test file for this in class_advanced.py, I have not annotated anything (so nothing is tested).

2) Class construction

Currently the edges I consider that points-to can resolve is very simple:

class PointsToResolver extends CallGraphResolver, TPointsToResolver {
    override predicate callEdge(Call call, Function callable) {
        exists(PythonFunctionValue func_value |
            func_value.getScope() = callable and
            call = func_value.getACall().getNode()
        )
    }

    override string toString() { result = "PointsToResolver" }
}

so it doesn't report there being an from A() -> A.__init__ (see class_simple.py). I thought about adding support for this with the code in the following snippet, but I kinda feel like that is cheating ("if you need to write custom code to make it work, then it's not supported"). I want to know whether you agree.

exists(ClassValue cls |
    call = cls.getACall().getNode() and
    cls.lookup("__init__").(PythonFunctionValue).getScope() = callable
)