dhscanner-kbgen 1.0.15 → 1.0.16

raw patch · 2 files changed

+124/−32 lines, 2 filesdep ~dhscanner-bitcodePVP: major bump suggested

API removals or changes: PVP suggests a major version bump

Dependency ranges changed: dhscanner-bitcode

API changes (from Hackage documentation)

Files

• dhscanner-kbgen.cabal +2/−2
• src/Kbgen.hs +122/−30

@@ -33,7 +33,7 @@         * explain in plain English your query's purpose
         * et voilà !
 
-version:            1.0.15
+version:            1.0.16
 license:            GPL-3.0-only
 license-file:       LICENSE
 author:             OrenGitHub
@@ -60,7 +60,7 @@         base >= 4.18 && < 4.19,
         containers < 0.7,
         dhscanner-ast >= 1.1.4,
-        dhscanner-bitcode >= 1.0.13
+        dhscanner-bitcode >= 1.0.14
 
     hs-source-dirs:
         src

@@ -54,13 +54,14 @@ module Kbgen (
     KeywordArgForCall(..),
     ParamResolvedType(..),
-    ClassName(..),
+    ClassDef(..),
     ParamName(..),
     CallMethodOfClass(..),
     ConstString(..),
     ArgForCall(..),
     MethodOfClass(..),
-    ClassResolvedSuper(..),
+    ClassHas1stPartySuper(..),
+    ClassHas3rdPartySuper(..),
     ClassNamedSuper(..),
     ArgiForCall(..),
     ConstBoolTrue(..),
@@ -183,7 +184,7 @@ -- This is how the fact will look inside the Prolog file
 --
 -- @
--- kb_class_name( Class, Name ).
+-- kb_class_def( Class, Name, DefinedInFile ).
 -- @
 --
 -- __When should I use this fact__ ( motivation: [CVE-2024-53995](https://nvd.nist.gov/vuln/detail/CVE-2024-53995) )
@@ -205,19 +206,21 @@ --
 -- @
 -- skip_level_subclass_of( Subclass, \'tornado.web.RequestHandler\' ) :-
---     kb_class_name( Class, ClassName ),
---     kb_class_named_super( Subclass, ClassName ),
---     kb_class_resolved_super( Class, \'tornado.web.RequestHandler\' ).
+--     kb_class_def( Subclass, _, _ ),
+--     kb_class_has_1st_party_super( Subclass, ClassName, ClassDefinedInFile ),
+--     kb_class_def( Class, ClassName, ClassDefinedInFile )
+--     kb_class_has_3rd_party_super( Class, _, \'tornado.web.RequestHandler\' ).
 -- @
 --
 -- Other facts combined in this predicate:
 --
---     * 'ClassNamedSuper'
---     * 'ClassResolvedSuper'
+--     * 'ClassHas1stPartySuper'
+--     * 'ClassHas3rdPartySuper'
 --
-data ClassName = ClassName
+data ClassDef = ClassDef
     Class -- ^
     Token.ClassName -- ^
+    ClassDefinedInFile -- ^
     deriving ( Show, Eq, Ord, Generic, ToJSON, FromJSON )
 
 -- |
@@ -322,14 +325,14 @@ -- @
 -- user_controlled_query_argument( Call ) :-
 --     kb_call_method_of_class( Call, \'get_query_argument\', Class ),
---     kb_class_has_resolved_super( Class, \'tornado.web.RequestHandler\'),
+--     kb_class_has_3rd_party_super( Class, \'tornado.web.RequestHandler\'),
 --     kb_arg_i_for_call( QueryParamName, 0, Call),
 --     kb_const_string( QueryParamName, _ ).
 -- @
 --
 -- Other facts combined in this predicate:
 --
---     * 'ClassResolvedSuper'
+--     * 'ClassHas3rdPartySuper'
 --     * 'ArgiForCall'
 --     * 'ConstString'
 --
@@ -363,21 +366,97 @@ 
 -- |
 --
--- * usually used with 'ClassNamedSuper'
--- * for bounded inheritance of third party classes
+-- __Name__
 --
--- ==== __Example:__
+-- This is how the fact will look inside the Prolog file
 --
 -- @
--- kb_class_super_name(Class,SuperFqsdfsdfsdfn).
+-- kb_class_has_1st_party_super( Class, SuperName, SuperDefinedInFile ).
 -- @
 --
-data ClassResolvedSuper = ClassResolvedSuper
+-- __When should I use this fact__ ( motivation: [CVE-2024-53995](https://nvd.nist.gov/vuln/detail/CVE-2024-53995) )
+--
+-- @
+-- # authentication.py
+-- class LoginHandler(BaseHandler): ...
+--
+-- # index.py
+-- from tornado.web import RequestHandler
+-- class BaseHandler(RequestHandler): ...
+-- @
+--
+-- See complete source example [here](https://github.com/SickChill/sickchill/blob/846adafdfab579281353ea08a27bbb813f9a9872/sickchill/views/authentication.py#L10),
+-- [here](https://github.com/SickChill/sickchill/blob/846adafdfab579281353ea08a27bbb813f9a9872/sickchill/views/index.py#L35)
+-- and [here](https://github.com/SickChill/sickchill/blob/846adafdfab579281353ea08a27bbb813f9a9872/sickchill/views/index.py#L15)
+--
+-- __Writing a predicate with this fact and others__ ( motivation: [CVE-2024-53995](https://nvd.nist.gov/vuln/detail/CVE-2024-53995) )
+--
+-- @
+-- skip_level_subclass_of( Subclass, \'tornado.web.RequestHandler\' ) :-
+--     kb_class_def( Subclass, _, _ ),
+--     kb_class_has_1st_party_super( Subclass, ClassName, ClassDefinedInFile ),
+--     kb_class_def( Class, ClassName, ClassDefinedInFile )
+--     kb_class_has_3rd_party_super( Class, _, \'tornado.web.RequestHandler\' ).
+-- @
+--
+-- Other facts combined in this predicate:
+--
+--     * 'ClassDef'
+--     * 'ClassHas3rdPartySuper'
+--
+data ClassHas1stPartySuper = ClassHas1stPartySuper
     Class -- ^
-    ResolvedSuper -- ^ ( 1 fact per super class )
+    Token.SuperName -- ^
+    SuperDefinedInFile -- ^
     deriving ( Show, Eq, Ord, Generic, ToJSON, FromJSON )
 
 -- |
+--
+-- __Name__
+--
+-- This is how the fact will look inside the Prolog file
+--
+-- @
+-- kb_class_has_3rd_party_super( Class, SuperName, SuperQualifiedName ).
+-- @
+--
+-- __When should I use this fact__ ( motivation: [CVE-2024-53995](https://nvd.nist.gov/vuln/detail/CVE-2024-53995) )
+--
+-- @
+-- # authentication.py
+-- class LoginHandler(BaseHandler): ...
+--
+-- # index.py
+-- from tornado.web import RequestHandler
+-- class BaseHandler(RequestHandler): ...
+-- @
+--
+-- See complete source example [here](https://github.com/SickChill/sickchill/blob/846adafdfab579281353ea08a27bbb813f9a9872/sickchill/views/authentication.py#L10),
+-- [here](https://github.com/SickChill/sickchill/blob/846adafdfab579281353ea08a27bbb813f9a9872/sickchill/views/index.py#L35)
+-- and [here](https://github.com/SickChill/sickchill/blob/846adafdfab579281353ea08a27bbb813f9a9872/sickchill/views/index.py#L15)
+--
+-- __Writing a predicate with this fact and others__ ( motivation: [CVE-2024-53995](https://nvd.nist.gov/vuln/detail/CVE-2024-53995) )
+--
+-- @
+-- skip_level_subclass_of( Subclass, \'tornado.web.RequestHandler\' ) :-
+--     kb_class_def( Subclass, _, _ ),
+--     kb_class_has_1st_party_super( Subclass, ClassName, ClassDefinedInFile ),
+--     kb_class_def( Class, ClassName, ClassDefinedInFile )
+--     kb_class_has_3rd_party_super( Class, _, \'tornado.web.RequestHandler\' ).
+-- @
+--
+-- Other facts combined in this predicate:
+--
+--     * 'ClassDef'
+--     * 'ClassHas1stPartySuper'
+--
+data ClassHas3rdPartySuper = ClassHas3rdPartySuper
+    Class -- ^
+    Token.SuperName -- ^
+    SuperQualifiedName -- ^
+    deriving ( Show, Eq, Ord, Generic, ToJSON, FromJSON )
+
+-- |
 -- capture inheritance from third party classes
 data ClassAnnotation = ClassAnnotation
     Class -- ^
@@ -488,7 +567,11 @@ data ParamIndex = ParamIndex Word deriving ( Show, Eq, Ord, Generic, ToJSON, FromJSON )
 data MethodName = MethodName String deriving ( Show, Eq, Ord, Generic, ToJSON, FromJSON )
 data ConstStrValue = ConstStrValue String deriving ( Show, Eq, Ord, Generic, ToJSON, FromJSON )
+data SuperQualifiedName = SuperQualifiedName Fqn.Fqn deriving ( Show, Eq, Ord, Generic, ToJSON, FromJSON )
 
+data ClassDefinedInFile = ClassDefinedInFile FilePath deriving ( Show, Eq, Ord, Generic, ToJSON, FromJSON )
+data SuperDefinedInFile = SuperDefinedInFile FilePath deriving ( Show, Eq, Ord, Generic, ToJSON, FromJSON )
+
 -- |
 data ResolvedType = ResolvedType
     Fqn.Fqn -- ^
@@ -502,8 +585,8 @@ -- * often, a single bitcode instruction will yield /more/ than one fact
 --
 data Fact
-   = ParamNameCtor ParamName
-   | ClassNameCtor ClassName
+   = ClassDefCtor ClassDef
+   | ParamNameCtor ParamName
    | ArgForCallCtor ArgForCall
    | ArgiForCallCtor ArgiForCall
    | ConstStringCtor ConstString
@@ -516,8 +599,9 @@    | KeywordArgForCallCtor KeywordArgForCall
    | ParamResolvedTypeCtor ParamResolvedType
    | CallMethodOfClassCtor CallMethodOfClass
-   | ClassResolvedSuperCtor ClassResolvedSuper
    | CallableAnnotationCtor CallableAnnotation
+   | ClassHas1stPartySuperCtor ClassHas1stPartySuper
+   | ClassHas3rdPartySuperCtor ClassHas3rdPartySuper
    deriving ( Show, Eq, Ord, Generic, ToJSON, FromJSON )
 
 -- |
@@ -531,7 +615,7 @@ --
 prologify :: Fact -> String
 prologify (ParamNameCtor content) = prologify_ParamName content
-prologify (ClassNameCtor content) = prologify_ClassName content
+prologify (ClassDefCtor content) = prologify_ClassDef content
 prologify (ArgForCallCtor content) = prologifyArgForCall content
 prologify (ArgiForCallCtor content) = prologifyArgiForCall content
 prologify (ConstStringCtor content) = prologify_ConstString content
@@ -544,8 +628,9 @@ prologify (ParamResolvedTypeCtor content) = prologify_ParamResolvedType content
 prologify (CallMethodOfClassCtor content) = prologify_CallMethodOfClass content
 prologify (KeywordArgForCallCtor content) = prologify_KeywordArgForCall content
-prologify (ClassResolvedSuperCtor content) = prologifyClassResolvedSuper content
 prologify (CallableAnnotationCtor content) = prologify_CallableAnnotation content
+prologify (ClassHas1stPartySuperCtor content) = prologify_ClassHas1stPartySuper content
+prologify (ClassHas3rdPartySuperCtor content) = prologify_ClassHas3rdPartySuper content
 
 prologify_ParamResolvedType' :: Location -> String -> String
 prologify_ParamResolvedType' l fqn = printf "kb_param_has_type( %s, \'%s\' )." (locationify l) fqn
@@ -565,11 +650,11 @@ prologify_ParamName :: ParamName -> String
 prologify_ParamName (ParamName (Param loc) (Token.ParamName (Token.Named name _))) = prologify_ParamName' loc name
 
-prologify_ClassName' :: Location -> String -> String
-prologify_ClassName' l name = printf "kb_class_name( %s, \'%s\' )." (locationify l) name
+prologify_ClassDef' :: Location -> String -> FilePath-> String
+prologify_ClassDef' l name f = printf "kb_class_def( %s, \'%s\', \'%s\' )." (locationify l) name (show f)
 
-prologify_ClassName :: ClassName -> String
-prologify_ClassName (ClassName (Class loc) (Token.ClassName (Token.Named name _))) = prologify_ClassName' loc name
+prologify_ClassDef :: ClassDef -> String
+prologify_ClassDef (ClassDef (Class loc) (Token.ClassName (Token.Named name _)) (ClassDefinedInFile f)) = prologify_ClassDef' loc name f
 
 unquote :: String -> String
 unquote = filter (/= '\'')
@@ -608,11 +693,18 @@ prologify_MethodOfClass :: MethodOfClass -> String
 prologify_MethodOfClass (MethodOfClass (Method m) (Class c)) = prologify_MethodOfClass' m c
 
-prologifyClassResolvedSuper' :: Location -> String -> String
-prologifyClassResolvedSuper' l s = printf "kb_class_has_resolved_super( %s, \'%s\' )." (locationify l) s
+prologify_ClassHas1stPartySuper' :: Location -> String -> FilePath -> String
+prologify_ClassHas1stPartySuper' c s f = printf "kb_class_has_1st_party_super( %s, \'%s\', \'%s\' )." (locationify c) s (show f)
  
-prologifyClassResolvedSuper :: ClassResolvedSuper -> String
-prologifyClassResolvedSuper (ClassResolvedSuper (Class c) (ResolvedSuper fqn)) = prologifyClassResolvedSuper' c (show fqn)
+prologify_ClassHas1stPartySuper :: ClassHas1stPartySuper -> String
+prologify_ClassHas1stPartySuper (ClassHas1stPartySuper (Class c) (Token.SuperName (Token.Named s _)) (SuperDefinedInFile f)) = prologify_ClassHas1stPartySuper' c s f
+
+prologify_ClassHas3rdPartySuper' :: Location -> String -> Fqn.Fqn -> String
+prologify_ClassHas3rdPartySuper' c s f = printf "kb_class_has_3rd_party_super( %s, \'%s\', \'%s\' )." (locationify c) s (show f)
+ 
+prologify_ClassHas3rdPartySuper :: ClassHas3rdPartySuper -> String
+prologify_ClassHas3rdPartySuper (ClassHas3rdPartySuper (Class c) (Token.SuperName (Token.Named s _)) (SuperQualifiedName f)) = prologify_ClassHas3rdPartySuper' c s f
+
 
 prologifyClassNamedSuper' :: Location -> String -> String
 prologifyClassNamedSuper' l s = printf "kb_class_has_named_super( %s, \'%s\' )." (locationify l) s