CodeQL query to get attribute and corresponding object

[kakashiUc]

I am trying to run form a query which will return all the attributes of a class with corresponding class name/object. For example

1.class A:
2.    x = 1
3.    y = 2
4.    def funcA(): <funcA_body>
5.    def funcB(): <funcB_body>
6.class B(A):
7.    x=4
8.    z = funcB()
9. 
10. obj = B()
11. obj.funcB()
12. print(obj.x)
13. 
14. def test(a):
15.    return a+2
16. v = test(2)

Here I want the output to have details about line 11 and 12. The query should be able to tell funcB() called in line 11 and the attribute x in line 12 are from class B, and the test() function called in line 16 is not from any class.

I have written the following, which doesn't do the required.

import python

from ClassObject c, string name, Object o, Attribute a
where
	not c.isBuiltin()
	and o = c.lookupAttribute(name)
	and name = a.getAttr()
select c, name + " : "  + o.getAnInferredType().toString() + " : "  +  o.toString()

Can anyone help with the query?

[hvitved]

Hi

Are you asking for all the functions/attributes defined in a given class, or are you interested in knowing which function/attribute a given call/access may refer to (like the call obj.funcB() on line 11 and the access obj.x on line 12)?

[RasmusWL]

@github/codeql-python : Can you help out, please?

sure 👍

If we have this Python code

class A:

    x = 1
    y = 2

    def func_a(self):
        print("func_a")

    def func_b(self):
        print("func_b")

class B(A):
    x = 4


obj = B()
obj.func_b()
print(obj.x)

the following CodeQL query will produce the results it seems you're after.

import python

from
  ClassValue cls, ControlFlowNode node, AttrNode attr, string name, Value val, ClassValue originCls
where
  cls.getName() = "B" and
  node.pointsTo().getClass() = cls and
  attr.getObject(name) = node and
  val = cls.lookup(name) and
  originCls.declaredAttribute(name) = val
select cls, attr, name, val, originCls

[kakashiUc]

@hvitved @RasmusWL thanks for the help.

Although this query seems to be correct for this specific code, this doesn't solve what I am trying to do. I think my question was not clear. I asked the question regarding attribute because my understanding of what an attribute mean in CodeQL context.

But I want to - Get the corresponding class or no class(when function/attribute is not defined in any class), whenever a function is called or attribute is used
So in this scenario the object creation of B() also should be returned. Also class method calls should be also returned. Consider the modified code -

class A:
    x = 1
    y = 2

    def func_a(self):
        print("func_a")

    def func_b(self):
        print("func_b")

def get_nth_even(n):
    return 2*n

class B(A):
    def __init__(self):
        obja = A()
        obja.func_a()   ----> 1

    x = 4

    @classmethod
    def greetings(cls, arg1):
        return "hello, " + arg1

str_a = B.greetings('CodeQL')   ----> 2
print(str_a)
print(get_nth_even(4))   ----> 3

obj = B()   ----> 4
obj.func_b()   ----> 5
print(obj.x)   ----> 6

So the suggested query doesn't get the position(denoted with arrow) 2, 3 and 4. I tried a query with Call to get all call which includes the constructor also, but that fetches other inbuilt calls too. Also I haven't used Attr construct there. The query I am trying to improve now is this -

from Call c, Value v, ClassValue t, Expr f, AstNode origin
where
  f = c.getFunc() and
  f.pointsTo(v, origin) and
  t = v.getClass() and
  not v = Value::named("None")
select c, f, t.getABaseType(), f, origin

So is this the right direction? Or should I be working with Attr ?

[kakashiUc]

@RasmusWL Any thoughts?

[RasmusWL]

@kakashiUc sorry, been a bit too busy. Will take a look later today or tomorrow. Sorry for the delay.

[RasmusWL]

But I want to - Get the corresponding class or no class(when function/attribute is not defined in any class), whenever a function is called or attribute is used
So in this scenario the object creation of B() also should be returned. Also class method calls should be also returned. Consider the modified code -

Would you be able to provide an example where an attribute is used, but there is no class? (I'm having a hard time imagining such an example).

To solve the other problem, which I will phrase as: For each function call, is it a method of a class?

Updated example code:

class A:

    x = 1
    y = 2

    def func_a(self):
        print("func_a")

    def func_b(self):
        print("func_b")

class B(A):
    x = 4

    def __init__(self):
        obja = A()
        obja.func_a()

    @classmethod
    def greetings(cls, arg1):
        return "hello, " + arg1

def get_nth_even(n):
    return 2*n

str_a = B.greetings('CodeQL')
print(str_a)
print(get_nth_even(4))

obj = B()
obj.func_b()
print(obj.x)

And with this CodeQL query:

import python

ClassValue getClassForCallable(Value callable) {
  // constructors
  result = callable
  or
  // methods
  not callable instanceof BoundMethodValue and
  (
    result.getScope() = callable.(FunctionValue).getScope().getEnclosingScope()
    or
    not callable instanceof FunctionValue and
    result.declaredAttribute(_) = callable
  )
  or
  // also methods, but exposed as BoundMethodValue
  result = getClassForCallable(callable.(BoundMethodValue).getFunction())
}

from CallNode call, Value callable, string whichClass
where
  callable.getACall() = call and
  not callable.isBuiltin() and
  if exists(getClassForCallable(callable))
  then whichClass = getClassForCallable(callable).toString()
  else whichClass = "no class"
select call.getLocation().getStartLine() as startLine, call, whichClass

gives these results

(if you also select the callable, you will see duplicated results due to the underlying way we represent method calls in our points-to analysis)

HOWEVER, resolving this in practice is a bit more difficult. Consider this additional tricky case:

def tricky(_ignored=None):
    print("tricky")

tricky()

class Tricky:
    also_tricky = tricky
    also_tricky2 = staticmethod(tricky)

t = Tricky()
t.also_tricky()
Tricky.also_tricky2()

so what should we report for t.also_tricky()? The method is called on a class, but the actual function definition is defined outside a class.

You will need to solve this in a suitable way, depending on what you're trying to achieve with this.