Python: add new shared-CFG-backed control flow graph (additive) #21921
There are no files selected for viewing
This file contains hidden or bidirectional Unicode text that may be interpreted or compiled differently than what appears below. To review, open the file in an editor that reveals hidden Unicode characters.
Learn more about bidirectional Unicode characters
| Original file line number | Diff line number | Diff line change |
|---|---|---|
| @@ -0,0 +1,2 @@ | ||
| import semmle.python.controlflow.internal.AstNodeImpl | ||
| import ControlFlow::Consistency |
This file contains hidden or bidirectional Unicode text that may be interpreted or compiled differently than what appears below. To review, open the file in an editor that reveals hidden Unicode characters.
Learn more about bidirectional Unicode characters
| Original file line number | Diff line number | Diff line change |
|---|---|---|
| @@ -0,0 +1,4 @@ | ||
| --- | ||
| category: minorAnalysis | ||
| --- | ||
| * A new Python control flow graph implementation has been added under `semmle.python.controlflow.internal.Cfg` (backed by `AstNodeImpl.qll`), built on the shared `codeql.controlflow.ControlFlowGraph` library. It is not yet used by the dataflow library or any production query; the legacy CFG in `semmle/python/Flow.qll` remains the default. The new library is exposed for tests and for upcoming migrations. | ||
This file contains hidden or bidirectional Unicode text that may be interpreted or compiled differently than what appears below. To review, open the file in an editor that reveals hidden Unicode characters.
Learn more about bidirectional Unicode characters
| Original file line number | Diff line number | Diff line change |
|---|---|---|
| @@ -0,0 +1,4 @@ | ||
| --- | ||
| category: minorAnalysis | ||
| --- | ||
| * The new (shared-CFG-based) Python control flow graph now visits parameter and return type annotations as CFG nodes for function definitions, matching the legacy CFG. This restores annotation-based type tracking through framework models such as FastAPI's `Depends()`, Pydantic request models, Starlette `WebSocket` handlers, and any other models that flow a class reference through `Parameter.getAnnotation()` to identify instances of the annotated class. | ||
|
|
||
This file contains hidden or bidirectional Unicode text that may be interpreted or compiled differently than what appears below. To review, open the file in an editor that reveals hidden Unicode characters.
Learn more about bidirectional Unicode characters
| Original file line number | Diff line number | Diff line change |
|---|---|---|
| @@ -0,0 +1,42 @@ | ||
| /** | ||
| * @name Print CFG | ||
| * @description Produces a representation of a file's Control Flow Graph. | ||
| * This query is used by the VS Code extension. | ||
| * @id py/print-cfg | ||
| * @kind graph | ||
| * @tags ide-contextual-queries/print-cfg | ||
| */ | ||
|
|
||
| import semmle.python.Files as Files | ||
| // import semmle.python.Scope | ||
|
yoff marked this conversation as resolved.
Outdated
|
||
| import semmle.python.controlflow.internal.AstNodeImpl | ||
|
|
||
| external string selectedSourceFile(); | ||
|
|
||
| private predicate selectedSourceFileAlias = selectedSourceFile/0; | ||
|
|
||
| external int selectedSourceLine(); | ||
|
|
||
| private predicate selectedSourceLineAlias = selectedSourceLine/0; | ||
|
|
||
| external int selectedSourceColumn(); | ||
|
|
||
| private predicate selectedSourceColumnAlias = selectedSourceColumn/0; | ||
|
|
||
| module ViewCfgQueryInput implements ControlFlow::ViewCfgQueryInputSig<Files::File> { | ||
| predicate selectedSourceFile = selectedSourceFileAlias/0; | ||
|
|
||
| predicate selectedSourceLine = selectedSourceLineAlias/0; | ||
|
|
||
| predicate selectedSourceColumn = selectedSourceColumnAlias/0; | ||
|
|
||
| predicate cfgScopeSpan( | ||
| Ast::Callable scope, Files::File file, int startLine, int startColumn, int endLine, | ||
| int endColumn | ||
| ) { | ||
| file = scope.getLocation().getFile() and | ||
| scope.getLocation().hasLocationInfo(_, startLine, startColumn, endLine, endColumn) | ||
| } | ||
| } | ||
|
|
||
| import ControlFlow::ViewCfgQuery<Files::File, ViewCfgQueryInput> | ||
Oops, something went wrong.
Oops, something went wrong.
Add this suggestion to a batch that can be applied as a single commit.
This suggestion is invalid because no changes were made to the code.
Suggestions cannot be applied while the pull request is closed.
Suggestions cannot be applied while viewing a subset of changes.
Only one suggestion per line can be applied in a batch.
Add this suggestion to a batch that can be applied as a single commit.
Applying suggestions on deleted lines is not supported.
You must change the existing code in this line in order to create a valid suggestion.
Outdated suggestions cannot be applied.
This suggestion has been applied or marked resolved.
Suggestions cannot be applied from pending reviews.
Suggestions cannot be applied on multi-line comments.
Suggestions cannot be applied while the pull request is queued to merge.
Suggestion cannot be applied right now. Please check back later.
There was a problem hiding this comment.
Choose a reason for hiding this comment
The reason will be displayed to describe this comment to others. Learn more.
Rhetorical question: Do any of our change-note consumers care about or need this information? I think the only two things we need to communicate in change notes are expected query result changes, and information for custom query writers if they need to adapt their QL code somehow. I.e. I don't think this PR should have a change note.