Skip to content

Python: Add jump steps for global variable nested field access #20162

New issue

Have a question about this project? Sign up for a free GitHub account to open an issue and contact its maintainers and the community.

Sign up for GitHub

By clicking “Sign up for GitHub”, you agree to our terms of service and privacy statement. We’ll occasionally send you account related emails.

Already on GitHub? Sign in to your account

Open
wants to merge 11 commits into
base: main
Choose a base branch
from
Open

Python: Add jump steps for global variable nested field access #20162

Changes from 1 commit
Commits
Show all changes
11 commits
Select commit Hold shift + click to select a range
4ab9283
Python: Updated PathInjection tests to use inline test expectations
Napalys Aug 4, 2025
104e20e
Python: Added extra test cases for path injection with FastAPI
Napalys Aug 4, 2025
a1b1021
Python: Added extra test for global variable nested attribute reads/w…
Napalys Aug 4, 2025
1c4a48e
Python: Add global variable nested field jump steps
Napalys Aug 4, 2025
8617ba2
Python: Keep track of access path
tausbn Aug 6, 2025
11185c3
Python: Rewrite access path computation
tausbn Aug 7, 2025
7fa224c
Python: Update `globalVariableAttrPathAtDepth` base case
Napalys Aug 7, 2025
2a0431f
Python: Add `AttrWrite.writes` and `AttrRead.reads`
tausbn Aug 8, 2025
485f397
Python: Use `AttrWrite.writes`
tausbn Aug 8, 2025
c9f495e
Python: Updated doc string and removed redundant predicate.
Napalys Aug 11, 2025
a2edf10
Python: Add change note
Napalys Aug 11, 2025
File filter

Filter by extension

Filter by extension
Conversations
Failed to load comments.
Loading
Jump to
Jump to file
Failed to load files.
Loading
Diff view
Diff view
Prev Previous commit
Next Next commit
Python: Added extra test for global variable nested attribute reads/w… 
…rites.
  • Loading branch information
@Napalys
Napalys committed Aug 4, 2025
commit a1b102117667997d1aaf0ace4e3815d92378c1d7
15 changes: 15 additions & 0 deletions python/ql/test/library-tests/dataflow/fieldflow/test_global.py
View file
Open in desktop
Original file line number Diff line number Diff line change
Expand Up @@ -146,6 +146,7 @@ def fields_with_local_flow(x):
class NestedObj(object):
def __init__(self):
self.obj = MyObj("OK")
self.obj.foo = "default"

def getObj(self):
return self.obj
Expand All @@ -163,6 +164,20 @@ def getObj(self):
a2 = NestedObj()
a2.getObj().foo = x2
SINK(a2.obj.foo) # $ flow="SOURCE, l:-3 -> a2.obj.foo"

# Global variable
app = NestedObj()

def init_global():
app.obj.foo = SOURCE

def read_global():
return app.obj.foo

def test_global_nested_attributes():
init_global()
result = read_global()
SINK(result) # $ MISSING: flow="SOURCE, l:-8 -> result"

# ------------------------------------------------------------------------------
# Global scope interaction
Expand Down