Open
Description
Python
class Cls:
def __init__(self) -> None:
self.field = 1
def __init__(self, num) -> None:
self.field = num
def print(self) -> None:
print(self.field)
if __name__ == '__main__':
var1 = Cls(2)
var2 = var1
var2.field = 3
var1.print()
var1.field2 = 4
print(var2.field2)
CodeQL
import python
import semmle.python.ApiGraphs
import semmle.python.dataflow.new.DataFlow
import semmle.python.dataflow.new.TaintTracking
module MyConf implements DataFlow::ConfigSig {
predicate isSource(DataFlow::Node source) {
source.asExpr() instanceof IntegerLiteral
}
predicate isSink(DataFlow::Node sink) {
sink = API::builtin("print").getACall().getArg(0)
}
}
module MyFlow = DataFlow::Global<MyConf>;
from DataFlow::Node source, DataFlow::Node sink
where MyFlow::flow(source, sink)
select source, sink
Output
source | sink |
---|---|
1 | self.field in line 7 |
2 | self.field in line 7 |
Expected result
source | sink |
---|---|
1 | self.field in line 7 |
2 | self.field in line 7 |
3 | self.field in line 7 |
4 | self.field in line 16 |