Python: Support class variables

python/ql/lib/semmle/python/dataflow/new/internal/DataFlowPrivate.qll

@@ -340,6 +340,39 @@ predicate runtimeJumpStep(Node nodeFrom, Node nodeTo) {
     def.getDefinition() = nodeFrom.asCfgNode() and
     def.getVariable() = nodeTo.(ModuleVariableNode).getVariable()
   )
+  or
+  // Class variable read
+  readClassVarStep(nodeFrom, nodeTo)
+}
+
+/** A read of a class variable */
+predicate readClassVarStep(EssaNode nodeFrom, AttrRead nodeTo) {
+  exists(ClassDef classDef, SsaVariable c | classDef.defines(c.getVariable()) |
+    nodeFrom.getVar().getScope() = classDef.getDefinedClass() and
+    (
+      // ClassWithVar().VAR
+      nodeTo.getObject().(CallCfgNode).getFunction().(CfgNode).getNode() = c.getAUse()
+      or
+      // ClassWithVar.VAR
+      nodeTo.getObject().(CfgNode).getNode() = c.getAUse()
+    ) and
+    nodeTo.getAttributeName() = nodeFrom.getVar().getName()
+  )
+}
+
+/** A write to a class variable */
+predicate writeClassVarStep(AttrWrite nodeFrom, EssaNode nodeTo) {
+  exists(ClassDef classDef, SsaVariable c | classDef.defines(c.getVariable()) |
+    nodeTo.getVar().getScope() = classDef.getDefinedClass() and
+    (
+      // ClassWithVar().VAR
+      nodeFrom.getObject().(CallCfgNode).getFunction().(CfgNode).getNode() = c.getAUse()
+      or
+      // ClassWithVar.VAR
+      nodeFrom.getObject().(CfgNode).getNode() = c.getAUse()
+    ) and
+    nodeFrom.getAttributeName() = nodeTo.getVar().getName()
+  )
 }
 
 /**

python/ql/test/experimental/dataflow/fieldflow/module_with_class_var.py

@@ -0,0 +1,2 @@
+class WithClassVariable():
+    VAR = SOURCE

python/ql/test/experimental/dataflow/fieldflow/test.py

@@ -173,7 +173,7 @@ def test_nested_obj_method():
 # scope tests into multiple functions, since we wouldn't know which one did the initial
 # import that does all the printing :|
 
-@expects(18 + 2) # $ unresolved_call=expects(..) unresolved_call=expects(..)(..)
+@expects(22 + 2) # $ unresolved_call=expects(..) unresolved_call=expects(..)(..)
 def test_global_scope():
     import fieldflow.test_global
 

python/ql/test/experimental/dataflow/fieldflow/test_global.py

@@ -177,3 +177,21 @@ def func_defined_before():
 
 def func_defined_after():
     SINK(global_obj.foo) # $ MISSING: flow="SOURCE, l:-4 -> global_obj.foo"
+
+# ------------------------------------------------------------------------------
+# Class variable
+# ------------------------------------------------------------------------------
+
+# FP reported here: https://github.com/github/codeql/discussions/9684
+class WithClassVariable():
+    VAR = SOURCE
+
+SINK(WithClassVariable.VAR) # $ flow="SOURCE, l:-2 -> WithClassVariable.VAR"
+SINK(WithClassVariable().VAR) # $ flow="SOURCE, l:-3 -> WithClassVariable().VAR"
+
+class AlsoWithClassVariable():
+    VAR = NONSOURCE
+
+AlsoWithClassVariable.VAR = SOURCE
+SINK(AlsoWithClassVariable.VAR) # $ flow="SOURCE, l:-1 -> AlsoWithClassVariable.VAR"
+SINK(AlsoWithClassVariable().VAR) # $ MISSING: flow="SOURCE, l:-4 -> AlsoWithClassVariable().VAR"

python/ql/test/experimental/dataflow/fieldflow/using_foreign_class_var.py

@@ -0,0 +1,36 @@
+import sys
+import os
+
+sys.path.append(os.path.dirname(os.path.dirname((__file__)))) # $ unresolved_call=sys.path.append(..)
+from testlib import expects
+
+# These are defined so that we can evaluate the test code.
+NONSOURCE = "not a source"
+SOURCE = "source"
+
+
+def is_source(x):
+    return x == "source" or x == b"source" or x == 42 or x == 42.0 or x == 42j
+
+
+def SINK(x):
+    if is_source(x):
+        print("OK")
+    else:
+        print("Unexpected flow", x)
+
+
+def SINK_F(x):
+    if is_source(x):
+        print("Unexpected flow", x)
+    else:
+        print("OK")
+
+
+# ------------------------------------------------------------------------------
+# Actual tests
+# ------------------------------------------------------------------------------
+
+import fieldflow.module_with_class_var
+
+SINK(fieldflow.module_with_class_var.WithClassVariable.VAR) # $ MISSING: flow=fieldflow.module_with_class_var.WithClassVariable.VAR