[Python] tsg-parser fails to extract generic base class relations
Nobody has claimed this yet.
Assessment
- Difficulty
- 3/5
- Estimated time
- 1-2 days
- Newbie friendliness
- 55/100
Research direction
Start by reproducing the v2.26.2 tsg-python output for class Bar(list[int]): pass, then trace how the parser handles the Subscript node when constructing class bases. Done means the generic base produces a bases edge and CodeQL recognizes the Bar -> list[int] relation, while the existing non-generic case remains intact.
Written by the indexing model from the issue text.
Description
Working with typed base classes in Python (see #22291) I realised that the toolchain seems to drop generic base classes (e.g. list[int] in class Bar(list[int]):) at some point. That is, in the example code
class Foo(list): pass
class Bar(list[int]): pass
CodeQL knows the Foo -> list relation but not the Bar -> list[int] relation.
As far as I could trace it, the relation is already lost in the tsg-python parser. Using the v2.26.2 toolchain, the source code class Bar(list): pass produces the following tsg-python output (assignment nodes removed for brevity):
node 4
_kind: "Name"
_location: [0, 10, 0, 14]
ctx: "load"
variable: "list"
node 5
_kind: "ClassExpr"
_location: [0, 0, 0, 21]
_location_end: [0, 16]
inner_scope: [graph node 6]
name: "Bar"
edge 5 -> 4
bases: 0
node 6
_kind: "Class"
_location: [0, 0, 0, 21]
_location_end: [0, 16]
name: "Bar"
edge 6 -> 1
body: 0
Now if the code is extended for a generic subscription as class Bar(list[int]): pass produces the following tsg-python output (assignment nodes removed for brevity):
node 4
_kind: "Name"
_location: [0, 10, 0, 14]
ctx: "load"
variable: "list"
node 5
_kind: "Name"
_location: [0, 15, 0, 18]
ctx: "load"
variable: "int"
node 6
_kind: "Subscript"
_location: [0, 10, 0, 19]
ctx: "load"
index: [graph node 5]
value: [graph node 4]
node 7
_kind: "ClassExpr"
_location: [0, 0, 0, 26]
_location_end: [0, 21]
inner_scope: [graph node 8]
name: "Bar"
node 8
_kind: "Class"
_location: [0, 0, 0, 26]
_location_end: [0, 21]
name: "Bar"
edge 8 -> 1
body: 0
Notice that the type subscription is parsed (nodes 4, 5, 6) but the edge n -> m node for the bases: 0 relation is absent.
- Dominant language
- CodeQL
- Stars
- 10.1k
- Forks
- 2.1k
- Avg merge
- 2d 16h
- Merged PRs (30d)
- 143
Contributor guide
First steps
- Read the whole issue, then the project's contributing guide.
- Comment on the issue to say you are picking it up — it saves two people doing the same work.
- Fork the repository and make your change on a branch.
- Open a pull request that references the issue number.
More from github/codeql
-
agentic-workflows
Difficulty 2/5 1-3 hours Newbie friendliness 70/100
-
false-positive javascript
Difficulty 2/5 1-3 hours Newbie friendliness 84/100
-
C#: cs/simplifiable-boolean-expression false positive on Nullable<bool> compared with a literal Open
Difficulty 2/5 1-3 hours Newbie friendliness 82/100
-
Difficulty 2/5 1-3 hours Newbie friendliness 78/100
-
false-positive
Difficulty 2/5 1-3 hours Newbie friendliness 70/100
Similar issues
-
Difficulty 2/5 1-3 hours Newbie friendliness 88/100
oxc-project/oxc#26944 ·
-
todo:perf
Difficulty 2/5 1-3 hours Newbie friendliness 84/100
-
bug
Difficulty 2/5 Half a day Newbie friendliness 82/100
-
Difficulty 2/5 1-3 hours Newbie friendliness 68/100
tenstorrent/tt-metal#57393 · 1 comment ·
-
Difficulty 2/5 1-3 hours Newbie friendliness 86/100
objectionary/eo#8894 ·