Python: mass enable diff-informed data flow none() location overrides

d10c · d10c · commit b79ce6d30b03 · 2025-06-17T15:36:52.000+02:00
An auto-generated patch that enables diff-informed data flow in the obvious cases. Builds on github#18346 and github/codeql-patch#88
diff --git a/python/ql/src/experimental/Security/CWE-327/Azure/UnsafeUsageOfClientSideEncryptionVersion.ql b/python/ql/src/experimental/Security/CWE-327/Azure/UnsafeUsageOfClientSideEncryptionVersion.ql
@@ -147,6 +147,8 @@ private module AzureBlobClientConfig implements DataFlow::StateConfigSig {
   }
 
   predicate observeDiffInformedIncrementalMode() { any() }
+
+  Location getASelectedSourceLocation(DataFlow::Node sink) { none() }
 }
 
 module AzureBlobClientFlow = DataFlow::GlobalWithState<AzureBlobClientConfig>;
diff --git a/python/ql/src/experimental/Security/CWE-346/CorsBypass.ql b/python/ql/src/experimental/Security/CWE-346/CorsBypass.ql
@@ -81,6 +81,8 @@ module CorsBypassConfig implements DataFlow::ConfigSig {
   }
 
   predicate observeDiffInformedIncrementalMode() { any() }
+
+  Location getASelectedSourceLocation(DataFlow::Node sink) { none() }
 }
 
 module CorsFlow = TaintTracking::Global<CorsBypassConfig>;
diff --git a/python/ql/src/experimental/Security/UnsafeUnpackQuery.qll b/python/ql/src/experimental/Security/UnsafeUnpackQuery.qll
@@ -210,6 +210,8 @@ module UnsafeUnpackConfig implements DataFlow::ConfigSig {
   }
 
   predicate observeDiffInformedIncrementalMode() { any() }
+
+  Location getASelectedSourceLocation(DataFlow::Node sink) { none() }
 }
 
 /** Global taint-tracking for detecting "UnsafeUnpacking" vulnerabilities. */
diff --git a/python/ql/src/experimental/semmle/python/security/LdapInsecureAuth.qll b/python/ql/src/experimental/semmle/python/security/LdapInsecureAuth.qll
@@ -103,6 +103,8 @@ private module LdapInsecureAuthConfig implements DataFlow::ConfigSig {
   }
 
   predicate observeDiffInformedIncrementalMode() { any() }
+
+  Location getASelectedSourceLocation(DataFlow::Node sink) { none() }
 }
 
 /** Global taint-tracking for detecting "LDAP insecure authentications" vulnerabilities. */

Original file line number	Diff line number	Diff line change
`@@ -147,6 +147,8 @@ private module AzureBlobClientConfig implements DataFlow::StateConfigSig {`
`147`	`147`	`}`
`148`	`148`
`149`	`149`	`predicate observeDiffInformedIncrementalMode() { any() }`
	`150`	`+`
	`151`	`+ Location getASelectedSourceLocation(DataFlow::Node sink) { none() }`
`150`	`152`	`}`
`151`	`153`
`152`	`154`	`module AzureBlobClientFlow = DataFlow::GlobalWithState<AzureBlobClientConfig>;`
Original file line number	Diff line number	Diff line change
`@@ -81,6 +81,8 @@ module CorsBypassConfig implements DataFlow::ConfigSig {`
`81`	`81`	`}`
`82`	`82`
`83`	`83`	`predicate observeDiffInformedIncrementalMode() { any() }`
	`84`	`+`
	`85`	`+ Location getASelectedSourceLocation(DataFlow::Node sink) { none() }`
`84`	`86`	`}`
`85`	`87`
`86`	`88`	`module CorsFlow = TaintTracking::Global<CorsBypassConfig>;`
Original file line number	Diff line number	Diff line change
`@@ -210,6 +210,8 @@ module UnsafeUnpackConfig implements DataFlow::ConfigSig {`
`210`	`210`	`}`
`211`	`211`
`212`	`212`	`predicate observeDiffInformedIncrementalMode() { any() }`
	`213`	`+`
	`214`	`+ Location getASelectedSourceLocation(DataFlow::Node sink) { none() }`
`213`	`215`	`}`
`214`	`216`
`215`	`217`	`/** Global taint-tracking for detecting "UnsafeUnpacking" vulnerabilities. */`
Original file line number	Diff line number	Diff line change
`@@ -103,6 +103,8 @@ private module LdapInsecureAuthConfig implements DataFlow::ConfigSig {`
`103`	`103`	`}`
`104`	`104`
`105`	`105`	`predicate observeDiffInformedIncrementalMode() { any() }`
	`106`	`+`
	`107`	`+ Location getASelectedSourceLocation(DataFlow::Node sink) { none() }`
`106`	`108`	`}`
`107`	`109`
`108`	`110`	`/** Global taint-tracking for detecting "LDAP insecure authentications" vulnerabilities. */`