Merge pull request #1624 from markshannon/python-fix-pruning-for-constants

Python: Fix up pruning in QL to better handle constraints from constants.
This commit is contained in:
Taus 2019-07-26 16:05:14 +02:00 коммит произвёл GitHub
Родитель 0258f799df 05e498dfdc
Коммит 8443f68a33
Не найден ключ, соответствующий данной подписи
Идентификатор ключа GPG: 4AEE18F83AFDEB23
8 изменённых файлов: 202 добавлений и 161 удалений

Просмотреть файл

@ -346,7 +346,6 @@ abstract class ImmutableLiteral extends Expr {
abstract Object getLiteralObject(); abstract Object getLiteralObject();
abstract boolean booleanValue(); abstract boolean booleanValue();
} }
/** A numerical constant expression, such as `7` or `4.2` */ /** A numerical constant expression, such as `7` or `4.2` */
@ -422,7 +421,6 @@ class FloatLiteral extends Num {
or or
this.getValue() != 0.0 and this.getValue() != -0.0 and result = true this.getValue() != 0.0 and this.getValue() != -0.0 and result = true
} }
} }
/** An imaginary numeric constant, such as `3j` */ /** An imaginary numeric constant, such as `3j` */
@ -474,6 +472,10 @@ class NegativeIntegerLiteral extends ImmutableLiteral, UnaryExpr {
py_cobjectnames(result, "-" + this.getOperand().(IntegerLiteral).getN()) py_cobjectnames(result, "-" + this.getOperand().(IntegerLiteral).getN())
} }
int getValue() {
result = -this.getOperand().(IntegerLiteral).getValue()
}
} }
/** A unicode string expression, such as `u"\u20ac"`. Note that unadorned string constants such as /** A unicode string expression, such as `u"\u20ac"`. Note that unadorned string constants such as
@ -802,7 +804,6 @@ class None extends NameConstant {
override boolean booleanValue() { override boolean booleanValue() {
result = false result = false
} }
} }
/** An await expression such as `await coro`. */ /** An await expression such as `await coro`. */

Просмотреть файл

@ -156,6 +156,12 @@ module Pruner {
private import Comparisons private import Comparisons
private import SSA private import SSA
private int intValue(ImmutableLiteral lit) {
result = lit.(IntegerLiteral).getValue()
or
result = lit.(NegativeIntegerLiteral).getValue()
}
newtype TConstraint = newtype TConstraint =
TTruthy(boolean b) { b = true or b = false } TTruthy(boolean b) { b = true or b = false }
or or
@ -164,7 +170,7 @@ module Pruner {
TConstrainedByConstant(CompareOp op, int k) { TConstrainedByConstant(CompareOp op, int k) {
int_test(_, _, op, k) int_test(_, _, op, k)
or or
exists(Assign a | a.getValue().(IntegerLiteral).getValue() = k) and op = eq() exists(Assign a | intValue(a.getValue()) = k) and op = eq()
} }
/** A constraint that may be applied to an SSA variable. /** A constraint that may be applied to an SSA variable.
@ -417,7 +423,7 @@ module Pruner {
reachableEdge(_, bb) reachableEdge(_, bb)
} }
Constraint constraintFromTest(SsaVariable var, UnprunedCfgNode node) { Constraint constraintFromExpr(SsaVariable var, UnprunedCfgNode node) {
py_ssa_use(node, var) and result = TTruthy(true) py_ssa_use(node, var) and result = TTruthy(true)
or or
exists(boolean b | exists(boolean b |
@ -429,7 +435,11 @@ module Pruner {
result = TConstrainedByConstant(op, k) result = TConstrainedByConstant(op, k)
) )
or or
result = constraintFromTest(var, node.(UnprunedNot).getOperand()).invert() result = constraintFromExpr(var, node.(UnprunedNot).getOperand()).invert()
}
Constraint constraintFromTest(SsaVariable var, UnprunedCfgNode node) {
result = constraintFromExpr(var, node) and node.isBranch()
} }
predicate none_test(UnprunedCompareNode test, SsaVariable var, boolean is) { predicate none_test(UnprunedCompareNode test, SsaVariable var, boolean is) {
@ -450,56 +460,46 @@ module Pruner {
| |
op.forOp(cop) and op.forOp(cop) and
py_ssa_use(left, var) and py_ssa_use(left, var) and
right.getNode().(IntegerLiteral).getValue() = k intValue(right.getNode()) = k
or or
op.reverse().forOp(cop) and op.reverse().forOp(cop) and
py_ssa_use(right, var) and py_ssa_use(right, var) and
left.getNode().(IntegerLiteral).getValue() = k intValue(left.getNode()) = k
)
}
private predicate constrainingValue(Expr e) {
exists(Assign a, UnprunedCfgNode asgn |
a.getValue() = e and a.getATarget() = asgn.getNode() and py_ssa_defn(_, asgn)
) )
or or
int_test(test.(UnprunedNot).getOperand(), var, op.invert(), k) exists(UnaryExpr n | constrainingValue(n) and n.getOp() instanceof Not and e = n.getOperand())
} }
predicate int_assignment(UnprunedCfgNode asgn, SsaVariable var, CompareOp op, int k) { private Constraint constraintFromValue(Expr e) {
exists(Assign a | constrainingValue(e) and
a.getATarget() = asgn.getNode() and (
py_ssa_use(asgn, var) and result = TConstrainedByConstant(eq(), intValue(e))
k = a.getValue().(IntegerLiteral).getValue() and
op = eq()
)
}
predicate none_assignment(UnprunedCfgNode asgn, SsaVariable var) {
exists(Assign a |
a.getATarget() = asgn.getNode() and
py_ssa_use(asgn, var) and
a.getValue() instanceof None
)
}
boolean truthy_assignment(UnprunedCfgNode asgn, SsaVariable var) {
exists(Assign a |
a.getATarget() = asgn.getNode() and
py_ssa_use(asgn, var)
|
a.getValue() instanceof True and result = true
or or
a.getValue() instanceof False and result = false e instanceof True and result = TTruthy(true)
or
e instanceof False and result = TTruthy(false)
or
e instanceof None and result = TIsNone(true)
or
result = constraintFromValue(e.(UnaryExpr).getOperand()).invert()
) )
or
module_import(asgn, var) and result = true
} }
/** Gets the constraint on `var` resulting from the assignment in `asgn` */ /** Gets the constraint on `var` resulting from the assignment in `asgn` */
Constraint constraintFromAssignment(SsaVariable var, UnprunedBasicBlock asgn) { Constraint constraintFromAssignment(SsaVariable var, UnprunedCfgNode asgn) {
exists(CompareOp op, int k | exists(Assign a |
int_assignment(asgn.getANode(), var, op, k) and a.getATarget() = asgn.getNode() and
result = TConstrainedByConstant(op, k) py_ssa_defn(var, asgn) and
result = constraintFromValue(a.getValue())
) )
or or
none_assignment(asgn.getANode(), var) and result = TIsNone(true) module_import(asgn, var) and result = TTruthy(true)
or
result = TTruthy(truthy_assignment(asgn.getANode(), var))
} }
/** Holds if the constraint `preval` holds for `var` on edge `pred` -> `succ` as a result of a prior test or assignment */ /** Holds if the constraint `preval` holds for `var` on edge `pred` -> `succ` as a result of a prior test or assignment */
@ -518,7 +518,7 @@ module Pruner {
first.(UnprunedConditionBlock).controlsEdge(pred, succ, false) and first.(UnprunedConditionBlock).controlsEdge(pred, succ, false) and
preval = constraintFromTest(var, first.last()).invert() preval = constraintFromTest(var, first.last()).invert()
or or
preval = constraintFromAssignment(var, first) and preval = constraintFromAssignment(var, first.getANode()) and
first.dominates(pred) and first.dominates(pred) and
(succ = pred.getAFalseSuccessor() or succ = pred.getATrueSuccessor()) (succ = pred.getAFalseSuccessor() or succ = pred.getATrueSuccessor())
) )

Просмотреть файл

@ -1,114 +1,80 @@
| 8 | test | test | Truthy | | 8 | test | test | Truthy | test |
| 10 | test | test | Truthy | | 10 | test | test | Truthy | test |
| 14 | seq | seq | Truthy | | 14 | seq | seq | Truthy | test |
| 16 | seq | seq | Truthy | | 17 | seq | seq | Truthy | test |
| 17 | seq | seq | Truthy | | 21 | UnaryExpr | t1 | Falsey | test |
| 21 | UnaryExpr | t1 | Falsey | | 24 | t1 | t1 | Truthy | test |
| 21 | t1 | t1 | Truthy | | 25 | t1 | t1 | Truthy | test |
| 24 | t1 | t1 | Truthy | | 26 | t2 | t2 | Truthy | test |
| 25 | t1 | t1 | Truthy | | 29 | t2 | t2 | Truthy | test |
| 26 | t2 | t2 | Truthy | | 30 | t2 | t2 | Truthy | test |
| 29 | t2 | t2 | Truthy | | 31 | t3 | t3 | Truthy | test |
| 30 | t2 | t2 | Truthy | | 31 | t4 | t4 | Truthy | test |
| 31 | t3 | t3 | Truthy | | 32 | t3 | t3 | Truthy | test |
| 31 | t4 | t4 | Truthy | | 33 | t3 | t3 | Truthy | test |
| 32 | t3 | t3 | Truthy | | 34 | t3 | t3 | Truthy | test |
| 33 | t3 | t3 | Truthy | | 35 | t4 | t4 | Truthy | test |
| 34 | t3 | t3 | Truthy | | 36 | t5 | t5 | Truthy | test |
| 35 | t4 | t4 | Truthy | | 36 | t6 | t6 | Truthy | test |
| 36 | t5 | t5 | Truthy | | 37 | t5 | t5 | Truthy | test |
| 36 | t6 | t6 | Truthy | | 38 | t5 | t5 | Truthy | test |
| 37 | t5 | t5 | Truthy | | 39 | t6 | t6 | Truthy | test |
| 38 | t5 | t5 | Truthy | | 40 | t6 | t6 | Truthy | test |
| 39 | t6 | t6 | Truthy | | 43 | t1 | t1 | Truthy | test |
| 40 | t6 | t6 | Truthy | | 44 | UnaryExpr | t2 | Falsey | test |
| 43 | t1 | t1 | Truthy | | 47 | t1 | t1 | Truthy | test |
| 44 | UnaryExpr | t2 | Falsey | | 48 | t2 | t2 | Truthy | test |
| 44 | t2 | t2 | Truthy | | 49 | t2 | t2 | Truthy | test |
| 47 | t1 | t1 | Truthy | | 51 | t2 | t2 | Truthy | test |
| 48 | t2 | t2 | Truthy | | 52 | t2 | t2 | Truthy | test |
| 49 | t2 | t2 | Truthy | | 55 | seq1 | seq1 | Truthy | test |
| 51 | t2 | t2 | Truthy | | 57 | UnaryExpr | seq2 | Falsey | test |
| 52 | t2 | t2 | Truthy | | 60 | seq1 | seq1 | Truthy | test |
| 55 | seq1 | seq1 | Truthy | | 63 | seq2 | seq2 | Truthy | test |
| 57 | UnaryExpr | seq2 | Falsey | | 66 | seq3 | seq3 | Truthy | test |
| 57 | seq2 | seq2 | Truthy | | 68 | UnaryExpr | seq4 | Falsey | test |
| 60 | seq1 | seq1 | Truthy | | 78 | seq5 | seq5 | Truthy | test |
| 62 | seq1 | seq1 | Truthy | | 88 | UnaryExpr | x | Falsey | test |
| 63 | seq2 | seq2 | Truthy | | 90 | y | y | Truthy | test |
| 65 | seq2 | seq2 | Truthy | | 93 | UnaryExpr | x | Falsey | test |
| 66 | seq3 | seq3 | Truthy | | 95 | y | y | Truthy | test |
| 68 | UnaryExpr | seq4 | Falsey | | 99 | another_module | another_module | Truthy | assign |
| 68 | seq4 | seq4 | Truthy | | 102 | UnaryExpr | another_module | Falsey | test |
| 71 | seq3 | seq3 | Truthy | | 107 | UnaryExpr | t1 | Falsey | test |
| 73 | var | var | Truthy | | 109 | t2 | t2 | Truthy | test |
| 74 | seq4 | seq4 | Truthy | | 111 | t1 | t1 | Truthy | test |
| 76 | var | var | Truthy | | 113 | UnaryExpr | t2 | Falsey | test |
| 78 | seq5 | seq5 | Truthy | | 117 | UnaryExpr | test | Falsey | test |
| 80 | seq5 | seq5 | Truthy | | 119 | UnaryExpr | test | Falsey | test |
| 81 | seq5 | seq5 | Truthy | | 123 | m | m | Truthy | test |
| 83 | var | var | Truthy | | 126 | m | m | Truthy | test |
| 88 | UnaryExpr | x | Falsey | | 158 | Compare | ps | Is not None | test |
| 88 | x | x | Truthy | | 160 | Compare | ps | Is None | test |
| 89 | Exception | Exception | Truthy | | 172 | escapes | escapes | Is None | assign |
| 90 | y | y | Truthy | | 177 | Compare | escapes | Is None | test |
| 91 | Exception | Exception | Truthy | | 191 | true12 | true12 | == 0 | assign |
| 92 | make_a_call | make_a_call | Truthy | | 195 | Compare | x | < 4 | test |
| 93 | UnaryExpr | x | Falsey | | 197 | Compare | x | < 4 | test |
| 93 | x | x | Truthy | | 201 | Compare | x | < 4 | test |
| 94 | count | count | Truthy | | 203 | UnaryExpr | x | < 4 | test |
| 95 | y | y | Truthy | | 207 | Compare | x | < 4 | test |
| 96 | count | count | Truthy | | 209 | Compare | x | < 4 | test |
| 101 | make_a_call | make_a_call | Truthy | | 215 | x | x | Truthy | test |
| 102 | UnaryExpr | another_module | Falsey | | 215 | y | y | Truthy | test |
| 102 | another_module | another_module | Truthy | | 217 | x | x | Truthy | test |
| 103 | count | count | Truthy | | 217 | y | y | Truthy | test |
| 107 | UnaryExpr | t1 | Falsey | | 219 | x | x | Truthy | test |
| 107 | t1 | t1 | Truthy | | 223 | y | y | Truthy | test |
| 109 | t2 | t2 | Truthy | | 229 | k | k | Falsey | assign |
| 111 | t1 | t1 | Truthy | | 230 | k | k | Truthy | test |
| 113 | UnaryExpr | t2 | Falsey | | 237 | k | k | == 3 | assign |
| 113 | t2 | t2 | Truthy | | 238 | k | k | Truthy | test |
| 117 | UnaryExpr | test | Falsey | | 245 | k | k | Is None | assign |
| 117 | test | test | Truthy | | 246 | k | k | Truthy | test |
| 119 | UnaryExpr | test | Falsey | | 253 | a | a | Truthy | test |
| 119 | test | test | Truthy | | 254 | k | k | Truthy | assign |
| 123 | m | m | Truthy | | 256 | k | k | Falsey | assign |
| 125 | m | m | Truthy | | 257 | k | k | Truthy | test |
| 126 | m | m | Truthy | | 264 | var | var | Truthy | assign |
| 158 | Compare | ps | Is not None | | 266 | var | var | Falsey | assign |
| 158 | ps | ps | Truthy | | 267 | var | var | Truthy | test |
| 159 | ps | ps | Truthy |
| 160 | Compare | ps | Is None |
| 160 | ps | ps | Truthy |
| 171 | __name__ | __name__ | Truthy |
| 172 | None | None | Truthy |
| 174 | func | func | Truthy |
| 175 | Exception | Exception | Truthy |
| 176 | count | count | Truthy |
| 177 | Compare | escapes | Is None |
| 177 | None | None | Truthy |
| 177 | escapes | escapes | Truthy |
| 178 | count | count | Truthy |
| 180 | count | count | Truthy |
| 188 | true12 | true12 | Truthy |
| 195 | Compare | x | < 4 |
| 195 | x | x | Truthy |
| 197 | Compare | x | < 4 |
| 197 | x | x | Truthy |
| 201 | Compare | x | < 4 |
| 201 | x | x | Truthy |
| 203 | Compare | x | >= 4 |
| 203 | UnaryExpr | x | < 4 |
| 203 | x | x | Truthy |
| 207 | Compare | x | < 4 |
| 207 | x | x | Truthy |
| 209 | Compare | x | < 4 |
| 209 | x | x | Truthy |
| 214 | None | None | Truthy |
| 215 | x | x | Truthy |
| 215 | y | y | Truthy |
| 217 | x | x | Truthy |
| 217 | y | y | Truthy |
| 219 | x | x | Truthy |
| 223 | y | y | Truthy |

Просмотреть файл

@ -3,8 +3,12 @@ import python
import semmle.python.Pruning import semmle.python.Pruning
from Pruner::Constraint c, SsaVariable var, Pruner::UnprunedCfgNode node, int line from Pruner::Constraint c, SsaVariable var, Pruner::UnprunedCfgNode node, int line, string kind
where c = Pruner::constraintFromTest(var, node) and line = node.getNode().getLocation().getStartLine() and where line = node.getNode().getLocation().getStartLine() and line > 0 and
line > 0 (
select line, node.getNode().toString(), var.getId(), c c = Pruner::constraintFromTest(var, node) and kind = "test"
or
c = Pruner::constraintFromAssignment(var, node) and kind = "assign"
)
select line, node.getNode().toString(), var.getId(), c, kind

Просмотреть файл

@ -31,3 +31,10 @@
| 219 | x | 222 | count | | 219 | x | 222 | count |
| 223 | y | 224 | count | | 223 | y | 224 | count |
| 223 | y | 226 | count | | 223 | y | 226 | count |
| 230 | k | 231 | count |
| 238 | k | 241 | count |
| 246 | k | 247 | count |
| 257 | k | 258 | count |
| 257 | k | 259 | Pass |
| 267 | var | 268 | count |
| 267 | var | 269 | Pass |

Просмотреть файл

@ -81,3 +81,15 @@
| 223 | y | 226 | count | | 223 | y | 226 | count |
| 224 | count | 214 | Function split_bool1 | | 224 | count | 214 | Function split_bool1 |
| 226 | count | 214 | Function split_bool1 | | 226 | count | 214 | Function split_bool1 |
| 230 | k | 231 | count |
| 231 | count | 234 | Pass |
| 238 | k | 241 | count |
| 241 | count | 242 | Pass |
| 246 | k | 247 | count |
| 247 | count | 250 | Pass |
| 257 | k | 258 | count |
| 257 | k | 259 | Pass |
| 258 | count | 259 | Pass |
| 267 | var | 268 | count |
| 267 | var | 269 | Pass |
| 268 | count | 269 | Pass |

Просмотреть файл

@ -57,3 +57,11 @@
| 222 | 1 | | 222 | 1 |
| 224 | 1 | | 224 | 1 |
| 226 | 1 | | 226 | 1 |
| 231 | 0 |
| 233 | 1 |
| 239 | 1 |
| 241 | 0 |
| 247 | 0 |
| 249 | 1 |
| 258 | 1 |
| 268 | 1 |

Просмотреть файл

@ -224,3 +224,46 @@ def split_bool1(x=None,y=None):
count count
else: else:
count count
def prune_on_constant1():
k = False
if k:
count
else:
count
pass
def prune_on_constant2():
k = 3
if k:
count
else:
count
pass
def prune_on_constant3():
k = None
if k:
count
else:
count
pass
def prune_on_constant_in_test(a, b):
if a:
k = True
else:
k = False
if k:
count
pass
def prune_on_constant_in_try():
try:
import foo
var = True
except:
var = False
if var:
count
pass