ruby/python: Shared module for typetracking through flow summaries #13178

yoff · 2023-05-16T12:23:45Z

Shared module provides predicates for

levelStepNoCall
basicLoadStep
basicStoreStep
basicLoadStoreStep
basicWithoutContentStep
basicWithContentStep

see the output signature.

It is shared via identicalFiles.json and used in ruby and python.

Will require performance testing to ensure we did not break ruby performance.

TODO:

We will not get full benefit of this in Python until type tracking uses dataflow content (rather than just strings representing attributes, as it does now).

ruby/ql/lib/codeql/ruby/typetracking/TypeTracker.qll

- add `getACallSimple` to `SummarizedCallable` (by adding it to `LibraryCallable`)

ruby: - create new shared file `SummaryTypeTracker.qll` - move much logic into the module - instantiate the module - remove old logic, now provided by module python: - clone shared file - instantiate module - use (some of the) steps provided by the module

python/ql/test/experimental/dataflow/typetracking-summaries/TestSummaries.qll

yoff · 2023-05-30T11:50:04Z

Force-pushed to resolve conflict. (Also added change note.)

yoff · 2023-06-07T09:25:16Z

It was suggested off-line to also include Java as a user, but it turns out that Java uses type tracking differently and already has flow through summaries.

asgerf

Thanks for doing this! The signature does end up being rather verbose but I guess that's just the way it is. A few minor things otherwise LGTM.

ruby/ql/lib/codeql/ruby/typetracking/SummaryTypeTracker.qll

Co-authored-by: Asger F <asgerf@github.com>

yoff · 2023-06-07T11:55:28Z

Thanks for the review, indeed it looks like we can remove those two predicates from the interface. Nice! 💪

…uby/track-through-summaries-pm

yoff · 2023-06-09T12:18:29Z

The merge includes the results of https://github.com/github/codeql/pull/12964/files#diff-9547dcadaf57e980b53a87f8f1f5124c65ca46cfe537c69cda27d142078663c1

to not use the call graph.

yoff · 2023-06-09T14:09:13Z

So now this PR is ready for review again :-)

python/ql/test/experimental/dataflow/typetracking-summaries/TestSummaries.qll

asgerf · 2023-06-12T18:43:23Z

python/ql/lib/semmle/python/dataflow/new/internal/TypeTrackerSpecific.qll

+  )
+}
+
+module SummaryTypeTrackerInput implements SummaryTypeTracker::Input {


Shouldn't this be private?

Ah, yes, that would be nicer.

asgerf · 2023-06-12T18:43:31Z

python/ql/lib/semmle/python/dataflow/new/internal/TypeTrackerSpecific.qll

+  Node callTo(SummarizedCallable callable) { result = callable.getACallSimple() }
+}
+
+module TypeTrackerSummaryFlow = SummaryTypeTracker::SummaryFlow<SummaryTypeTrackerInput>;


Also private?

Actually, yes, the outside does not need this, I think.

asgerf · 2023-06-12T18:43:55Z

ruby/ql/lib/codeql/ruby/typetracking/TypeTrackerSpecific.qll

-  or
-  dependsOnSummaryComponentStackCons(callable, _, stack)
-}
+module SummaryTypeTrackerInput implements SummaryTypeTracker::Input {


Should be private?

asgerf · 2023-06-12T18:44:13Z

ruby/ql/lib/codeql/ruby/typetracking/TypeTrackerSpecific.qll

+  Node callTo(SummarizedCallable callable) { result.asExpr().getExpr() = callable.getACallSimple() }
 }
+
+module TypeTrackerSummaryFlow = SummaryTypeTracker::SummaryFlow<SummaryTypeTrackerInput>;


Also private?

hvitved

Looks great, thanks for making this code shared. I have a few trivial comments. We should also do final DCA runs before merging.

ruby/ql/lib/codeql/ruby/typetracking/SummaryTypeTracker.qll

hvitved · 2023-06-13T06:44:09Z

ruby/ql/lib/codeql/ruby/typetracking/SummaryTypeTracker.qll

+ * These are meant to be used in `TypeTrackerSpecific.qll`
+ * inside the predicates of the same names.
+ */
+signature module Output<Input I> {


I don't think there is any need to provide an explicit output signature, when the output is not used itself as input to another parameterized module.

Might it be in the future, though? If we get type tracking as a parameterised module (as started by Java).

I mean, it is easy enough to add when needed (so we could take it out now), but I actually like how it codifies the intention of the module...

ruby/ql/lib/codeql/ruby/typetracking/SummaryTypeTracker.qll

ruby/ql/lib/codeql/ruby/typetracking/TypeTrackerSpecific.qll

…stSummaries.qll Co-authored-by: Asger F <asgerf@github.com>

- move `isNonLocal` to the top - missing backtics

hvitved

LGTM. Let's do a final DCA run before merging.

yoff · 2023-06-13T11:11:49Z

LGTM. Let's do a final DCA run before merging.

Agreed, I have kept the Awaiting evaluation label. See running experiments in backlinks.

yoff · 2023-06-13T12:58:02Z

Evaluation looks safe, removing the label (but feel free to disagree).

python/ql/test/experimental/dataflow/typetracking-summaries/TestSummaries.qll

python/ql/lib/semmle/python/dataflow/new/internal/SummaryTypeTracker.qll

RasmusWL · 2023-06-14T12:47:29Z

python/ql/lib/semmle/python/dataflow/new/internal/SummaryTypeTracker.qll

+  // Content
+  class TypeTrackerContent;
+
+  class TypeTrackerContentFilter;


After reading the input signature and QLDocs, I have absolutely no idea what the content filters are supposed to do. I guess it'll make sense once I start reading the implementation 🤷

RasmusWL · 2023-06-14T13:02:38Z

python/ql/lib/semmle/python/dataflow/new/internal/TypeTrackerSpecific.qll

+  // Relating nodes to summaries
+  Node argumentOf(Node call, SummaryComponent arg) {
+    exists(DataFlowDispatch::ParameterPosition pos |
+      arg = FlowSummary::SummaryComponent::argument(pos) and
+      argumentPositionMatch(call, result, pos)
+    )
+  }
+
+  Node parameterOf(Node callable, SummaryComponent param) {
+    exists(
+      DataFlowDispatch::ArgumentPosition apos, DataFlowDispatch::ParameterPosition ppos, Parameter p
+    |
+      param = FlowSummary::SummaryComponent::parameter(apos) and
+      DataFlowDispatch::parameterMatch(ppos, apos) and
+      // pick the SsaNode rather than the CfgNode
+      result.asVar().getDefinition().(ParameterDefinition).getParameter() = p and
+      (
+        exists(int i | ppos.isPositional(i) |
+          p = callable.getALocalSource().asExpr().(CallableExpr).getInnerScope().getArg(i)
+        )
+        or
+        exists(string name | ppos.isKeyword(name) |
+          p = callable.getALocalSource().asExpr().(CallableExpr).getInnerScope().getArgByName(name)
+        )
+      )
+    )
+  }


Let's talk about these two offline. I would like to understand the interaction with the call-graph a bit better 😊

python/ql/lib/semmle/python/dataflow/new/internal/TypeTrackerSpecific.qll

Co-authored-by: Rasmus Wriedt Larsen <rasmuswriedtlarsen@gmail.com>

…pecific.qll Co-authored-by: Rasmus Wriedt Larsen <rasmuswriedtlarsen@gmail.com>

github-actions bot added the Ruby label May 16, 2023

github-advanced-security bot found potential problems May 16, 2023

View reviewed changes

github-actions bot added the Python label May 17, 2023

yoff force-pushed the python-ruby/track-through-summaries-pm branch from ae32ca9 to a602abf Compare May 22, 2023 13:15

yoff added the Awaiting evaluation Do not merge yet, this PR is waiting for an evaluation to finish label May 22, 2023

yoff marked this pull request as ready for review May 22, 2023 14:35

yoff requested review from a team as code owners May 22, 2023 14:35

yoff added 3 commits May 30, 2023 13:16

python: add tests

47b2d48

- add `getACallSimple` to `SummarizedCallable` (by adding it to `LibraryCallable`)

python: add change note

820b5f2

yoff force-pushed the python-ruby/track-through-summaries-pm branch from a602abf to 820b5f2 Compare May 30, 2023 11:36

github-actions bot added the documentation label May 30, 2023

yoff mentioned this pull request May 30, 2023

python: Container summaries, part 2 #13209

Merged

github-advanced-security bot found potential problems May 30, 2023

View reviewed changes

calumgrant requested a review from asgerf June 6, 2023 08:21

asgerf reviewed Jun 7, 2023

View reviewed changes

Apply suggestions from code review

7ab3cde

Co-authored-by: Asger F <asgerf@github.com>

ruby/python: remove predicates from interface

6ddf1f7

yoff requested a review from asgerf June 7, 2023 12:09

Merge branch 'main' of https://github.com/github/codeql into python-r…

b294f48

…uby/track-through-summaries-pm

python: rewrite argumentPositionMatch

7e87a7c

to not use the call graph.

calumgrant requested a review from RasmusWL June 12, 2023 09:11

asgerf reviewed Jun 12, 2023

View reviewed changes

hvitved reviewed Jun 13, 2023

View reviewed changes

yoff and others added 5 commits June 13, 2023 11:22

Update python/ql/test/experimental/dataflow/typetracking-summaries/Te…

8cae151

…stSummaries.qll Co-authored-by: Asger F <asgerf@github.com>

ruby/python: make SummaryTypeTracker private

203f822

ruby: move to internal folder

b5961c7

ruby/python: adjust shared file

e11f6b5

- move `isNonLocal` to the top - missing backtics

ruby: use aliases

33ad15e

yoff requested review from asgerf and hvitved June 13, 2023 09:56

hvitved previously approved these changes Jun 13, 2023

View reviewed changes

yoff removed the Awaiting evaluation Do not merge yet, this PR is waiting for an evaluation to finish label Jun 13, 2023

RasmusWL requested changes Jun 14, 2023

View reviewed changes

Apply suggestions from code review

2ae5dae

Co-authored-by: Rasmus Wriedt Larsen <rasmuswriedtlarsen@gmail.com>

yoff dismissed hvitved’s stale review via 2ae5dae June 14, 2023 18:55

yoff and others added 7 commits June 14, 2023 20:57

Update python/ql/lib/semmle/python/dataflow/new/internal/TypeTrackerS…

af72509

…pecific.qll Co-authored-by: Rasmus Wriedt Larsen <rasmuswriedtlarsen@gmail.com>

ruby/python: more consistent naming of parameters

0e713e6

python: unique strings in tests

6521a51

python: update comment

2491fda

fix eol

0267b32

python: implement missing predicates

4fded84

python: use updated names in test

b7bf750

yoff requested a review from RasmusWL June 14, 2023 21:31

RasmusWL added 2 commits June 16, 2023 14:41

Python: Fix typo

afafaac

Python: Add tests of methods in summaries

fb6955e

RasmusWL approved these changes Jun 16, 2023

View reviewed changes

hvitved approved these changes Jun 16, 2023

View reviewed changes

yoff mentioned this pull request Jun 20, 2023

Python: type track through flow summaries #12795

Closed

asgerf approved these changes Jun 20, 2023

View reviewed changes

yoff merged commit 579c56c into github:main Jun 20, 2023

ruby/python: Shared module for typetracking through flow summaries #13178

ruby/python: Shared module for typetracking through flow summaries #13178

Uh oh!

Conversation

yoff commented May 16, 2023 • edited Loading Uh oh! There was an error while loading. Please reload this page.

Uh oh!

Uh oh!

Uh oh!

Uh oh!

Uh oh!

Uh oh!

Uh oh!

Uh oh!

Uh oh!

Uh oh!

Uh oh!

Uh oh!

Uh oh!

Uh oh!

Uh oh!

yoff commented May 30, 2023

Uh oh!

yoff commented Jun 7, 2023

Uh oh!

asgerf left a comment

Choose a reason for hiding this comment

Uh oh!

Uh oh!

Uh oh!

Uh oh!

Uh oh!

yoff commented Jun 7, 2023

Uh oh!

yoff commented Jun 9, 2023

Uh oh!

yoff commented Jun 9, 2023

Uh oh!

Uh oh!

Choose a reason for hiding this comment

Uh oh!

Choose a reason for hiding this comment

Uh oh!

Choose a reason for hiding this comment

Uh oh!

Choose a reason for hiding this comment

Uh oh!

Choose a reason for hiding this comment

Uh oh!

Choose a reason for hiding this comment

Uh oh!

Choose a reason for hiding this comment

Uh oh!

Choose a reason for hiding this comment

Uh oh!

hvitved left a comment

Choose a reason for hiding this comment

Uh oh!

Uh oh!

Choose a reason for hiding this comment

Uh oh!

Choose a reason for hiding this comment

Uh oh!

Choose a reason for hiding this comment

Uh oh!

Uh oh!

Uh oh!

Uh oh!

Uh oh!

Uh oh!

Uh oh!

Uh oh!

Uh oh!

hvitved left a comment

Choose a reason for hiding this comment

Uh oh!

yoff commented Jun 13, 2023

Uh oh!

yoff commented Jun 13, 2023

Uh oh!

Uh oh!

yoff commented May 16, 2023 •

edited

Loading