Merge pull request #15695 from github/tausbn/python-add-copy-method-a…

…s-copy-step Python: Add `.copy()` method call as copy step
github · Mar 11, 2024 · 42acd9c · 42acd9c
2 parents 6485dcc + f139271
commit 42acd9c
Show file tree

Hide file tree

Showing 2 changed files with 8 additions and 0 deletions.
diff --git a/python/ql/lib/semmle/python/dataflow/new/internal/TaintTrackingPrivate.qll b/python/ql/lib/semmle/python/dataflow/new/internal/TaintTrackingPrivate.qll
@@ -195,6 +195,8 @@ predicate copyStep(DataFlow::CfgNode nodeFrom, DataFlow::CfgNode nodeTo) {
     call = API::moduleImport("copy").getMember(["copy", "deepcopy"]).getACall() and
     call.getArg(0) = nodeFrom
   )
+  or
+  nodeTo.(DataFlow::MethodCallNode).calls(nodeFrom, "copy")
 }
 
 /**

diff --git a/python/ql/test/query-tests/Functions/ModificationOfParameterWithDefault/test.py b/python/ql/test/query-tests/Functions/ModificationOfParameterWithDefault/test.py
@@ -216,3 +216,9 @@ def flow_from_within_deepcopy_fp():
 def flow_through_deepcopy_fp(x=[]):
     y = deepcopy(x)
     y.append(1)
+
+# Use of copy method:
+
+def flow_through_copy_fp(x=[]):
+    y = x.copy()
+    y.append(1)
-Original file line number
+Diff line change
@@ Expand Up @@
         call = API::moduleImport("copy").getMember(["copy", "deepcopy"]).getACall() and
         call.getArg(0) = nodeFrom
       )
+      or
+      nodeTo.(DataFlow::MethodCallNode).calls(nodeFrom, "copy")
     }
     /**
@@ Expand Down @@