Python: Model parameter with default value as `DefinitionNode` #13685

RasmusWL · 2023-07-07T09:04:03Z

This PR took a series of unexpected events (some could have been avoided with better planning), so the commits end up taking a few twists and turns. I think everything should be very straightforward if reading commit-by-commit 😊

They look pretty safe to me, but haven't given them a whole lot of thought.

RasmusWL · 2023-07-07T10:27:58Z

There might also be an option to fix this problem by using EssaNodeDefinition instead, since we have this

codeql/python/ql/lib/semmle/python/essa/Essa.qll

Line 612 in d87c8c7

class ParameterDefinition extends EssaNodeDefinition {

But just rewriting the code to be the following didn't work as I wanted. Even though it fixes the missing flow to x added in bea0700, it also loses flow to x_alias 😞

predicate capturedJumpStep(Node nodeFrom, Node nodeTo) {
  exists(SsaSourceVariable var, EssaNodeDefinition essaDef, ControlFlowNode val |
    essaDef.definedBy(var, val)
  |
    nodeTo.asVar().(ScopeEntryDefinition).getSourceVariable() = var and
    nodeFrom.asCfgNode() = val and
    var.getScope().getScope*() = nodeFrom.getScope()
  )
}

I pursued this approach a bit since I wasn't 100% happy about the .getScope() checks added to DataFlowPrivate.

I should have added some tests to highlight what the state of dataflow from default values were before this change, since I expect that it's handled to some degree, I just haven't found the logic yet.

tests added in github#5238 functionality added in github#6640

…finition`

RasmusWL · 2023-07-07T12:34:37Z

Clearly I was a bit to eager to just accept changes in 70994b9, and now had to fix things up. Keeping that history, since otherwise the changes in 43b0250 might seem strange.

The additions to ImpliesDataflow.expected should actually be considered bad, since it selects things that have points-to flow, but no dataflow. However, the tests highlighted below shows that we still have the flow that we want! (so no problem after all)

codeql/python/ql/test/experimental/dataflow/coverage/test.py

Lines 856 to 860 in 4b4b9bf

    
           @expects(3) 
        
           def test_with_default_param_value(x=SOURCE, /, y=SOURCE, *, z=SOURCE): 
        
               SINK(x) #$ flow="SOURCE, l:-1 -> x" 
        
               SINK(y) #$ flow="SOURCE, l:-2 -> y" 
        
               SINK(z) #$ flow="SOURCE, l:-3 -> z"

RasmusWL · 2023-07-07T12:36:30Z

I pursued this approach a bit since I wasn't 100% happy about the .getScope() checks added to DataFlowPrivate.

I think with the current code I'm quite happy. The change below doesn't feel entirely good, but currently I don't see a better approach 😐

   AssignmentDefinition() {
     SsaSource::assignment_definition(this.getSourceVariable(), this.getDefiningNode(), value) and
+    not this instanceof ParameterDefinition
   }

I should have added some tests to highlight what the state of dataflow from default values were before this change, since I expect that it's handled to some degree, I just haven't found the logic yet.

Found the original implementation which I eliminated in 4e8a114

Somehow the previous fix didn't work :O

RasmusWL · 2023-07-07T14:18:33Z

I'm flabbergasted that the previous code did not work.

   exists(ParameterDefinition param |
     nodeFrom.asCfgNode() = param.getDefault() and
-    nodeTo.asCfgNode() = param.getDefiningNode()
+    nodeTo.asVar() = param.getVariable()
   )

How does making the change above make us not find the proper flow??? In the code below, with the fix of this commit we have

tracked --jumpstep--> CFN param x --local--> ESSA X --local--> CFN first-use x

With the change before (and outlined in the diff above) we would have the steps, so CLEARLY that should just work!

CFN param x --local--> ESSA X
tracked --jumpstep--> ESSA X
ESSA X --local--> CFN first-use x

def foo(x=tracked):
    print(x)

it just doesn't make sense to me

RasmusWL · 2023-07-10T15:48:59Z

Performance looks fine, and results indicate that we've found new ways to find the same alerts as before.

yoff · 2023-07-10T22:01:26Z

I'm flabbergasted that the previous code did not work.
   exists(ParameterDefinition param |
     nodeFrom.asCfgNode() = param.getDefault() and
-    nodeTo.asCfgNode() = param.getDefiningNode()
+    nodeTo.asVar() = param.getVariable()
   )
How does making the change above make us not find the proper flow??? In the code below, with the fix of this commit we have

tracked --jumpstep--> CFN param x --local--> ESSA X --local--> CFN first-use x

With the change before (and outlined in the diff above) we would have the steps, so CLEARLY that should just work!

CFN param x --local--> ESSA X

tracked --jumpstep--> ESSA X

ESSA X --local--> CFN first-use x
def foo(x=tracked):
    print(x)
it just doesn't make sense to me

Took me a bit to understand this. The reason is that in your second chain, the link

tracked --jumpstep--> ESSA X

is neither followed in the local flowsTo part, because it is not a local step (as it is a jump step), nor is it followed in the type tracking part because ESSA X is not a local source node. So it is not a valid chain of steps for type tracking. It should be for dataflow, though, but that is not what the test is concerned with.

(In the first case above, CFN param x is a local source node and so the chain is valid for type tracking.

yoff

So, as I understand it, in the following program

def f(x, y=5):
  pass

we have two EssaDefinitions, namely for ESSA x and ESSA y, and their defining nodes (via getDefiningNode) are CFG x and CFG y respectively. This makes sense, since these may receive flow from outside during invocation of f.

Additionally, we have a DefinitionNode, namely CFG y, and its defining node (via getValue) is Expr 5. This quite nicely represents additional possible flow "from outside" (at definition time, at least) and is mirrored in the newly added jump step.

We do not consider y = 5 an assignment because it does not happen locally; we would have to split y into two or something like that to make it local flow. Did you consider moving this restriction up into SsaSource::assignment_definition?

Apart from this one thing, I think it hangs together quite nicely 🙂

I also checked that

predicate test(Node node) {
  jumpStepSharedWithTypeTracker(_, node) and
  not node instanceof LocalSourceNode
}

is currently empty on two large databases I had lying around.

yoff · 2023-07-11T10:01:56Z

python/ql/lib/semmle/python/essa/Essa.qll

@@ -501,7 +501,8 @@ class AssignmentDefinition extends EssaNodeDefinition {
  ControlFlowNode value;

  AssignmentDefinition() {
-    SsaSource::assignment_definition(this.getSourceVariable(), this.getDefiningNode(), value)
+    SsaSource::assignment_definition(this.getSourceVariable(), this.getDefiningNode(), value) and
+    not this instanceof ParameterDefinition


Consider moving this restriction into assignment_definition.

yes, that's better 👍 Done in 98ed5cf

RasmusWL added 2 commits July 6, 2023 17:21

Python: Expand captured-variable test with default param

bea0700

Python: Add test for DefinitionNode default parameter value

cfd2d09

github-actions bot added the Python label Jul 7, 2023

RasmusWL added 3 commits July 7, 2023 11:54

Python: Model parameter with default value as DefinitionNode

6f3cb67

Python: Fix dataflow consistencies for default parameter values

c5e8e23

Python: Accept points-to .expected changes

70994b9

They look pretty safe to me, but haven't given them a whole lot of thought.

RasmusWL force-pushed the captured-variables-default-param-value branch from d3e4dc7 to 70994b9 Compare July 7, 2023 10:14

RasmusWL added 2 commits July 7, 2023 14:24

Python: Remove explicit jumpStep for default parameter values

4e8a114

tests added in github#5238 functionality added in github#6640

Python: Avoid overlap between AssignmentDefinition and `ParameterDe 1�7

43b0250

…finition`

Python: Fix default parameter value flow

44c6717

Somehow the previous fix didn't work :O

RasmusWL marked this pull request as ready for review July 10, 2023 08:41

RasmusWL requested a review from a team as a code owner July 10, 2023 08:41

calumgrant requested a review from yoff July 10, 2023 09:13

RasmusWL added 2 commits July 11, 2023 11:32

Python: Add implementation note about why not targeting ESSA node

a122567

Python: Add change-note

83ca47f

github-actions bot added the documentation label Jul 11, 2023

yoff reviewed Jul 11, 2023

View reviewed changes

Python: Move not this instanceof ParameterDefinition logic

98ed5cf

RasmusWL requested a review from yoff July 12, 2023 09:33

Python: Model parameter with default value as `DefinitionNode` #13685

Python: Model parameter with default value as `DefinitionNode` #13685

RasmusWL commented Jul 7, 2023 •

edited

RasmusWL commented Jul 7, 2023

RasmusWL commented Jul 7, 2023

RasmusWL commented Jul 7, 2023

RasmusWL commented Jul 7, 2023 •

edited

RasmusWL commented Jul 10, 2023

yoff commented Jul 10, 2023

yoff left a comment

yoff Jul 11, 2023

RasmusWL Jul 12, 2023

Python: Model parameter with default value as DefinitionNode #13685

Are you sure you want to change the base?

Python: Model parameter with default value as DefinitionNode #13685

Conversation

RasmusWL commented Jul 7, 2023 • edited

RasmusWL commented Jul 7, 2023

RasmusWL commented Jul 7, 2023

RasmusWL commented Jul 7, 2023

RasmusWL commented Jul 7, 2023 • edited

RasmusWL commented Jul 10, 2023

yoff commented Jul 10, 2023

yoff left a comment

Choose a reason for hiding this comment

yoff Jul 11, 2023

Choose a reason for hiding this comment

RasmusWL Jul 12, 2023

Choose a reason for hiding this comment

Python: Model parameter with default value as `DefinitionNode` #13685

Python: Model parameter with default value as `DefinitionNode` #13685

RasmusWL commented Jul 7, 2023 •

edited

RasmusWL commented Jul 7, 2023 •

edited