Python: Add BoundMethodValue

Author: RasmusWL

python/ql/src/semmle/python/objects/Callables.qll

@@ -448,6 +448,8 @@ class BoundMethodObjectInternal extends CallableObjectInternal, TBoundMethod {
 
     override predicate functionAndOffset(CallableObjectInternal function, int offset) {
         function = this.getFunction() and offset = 1
+        or
+        function = this and offset = 0
     }
 
     override predicate useOriginAsLegacyObject() { any() }

python/ql/src/semmle/python/objects/ObjectAPI.qll

@@ -363,7 +363,11 @@ class CallableValue extends Value {
             or
             exists(string name |
                 call.getArgByName(name) = result and
-                this.(PythonFunctionObjectInternal).getScope().getArg(n).getName() = name
+                (
+                    this.(PythonFunctionObjectInternal).getScope().getArg(n).getName() = name
+                    or
+                    this.(BoundMethodObjectInternal).getFunction().getScope().getArg(n+1).getName() = name
+                )
             )
             or
             called instanceof BoundMethodObjectInternal and
@@ -382,11 +386,19 @@ class CallableValue extends Value {
         |
             exists(int n |
                 call.getArg(n) = result and
-                this.(PythonFunctionObjectInternal).getScope().getArg(n + offset).getName() = name
+                exists(PythonFunctionObjectInternal py |
+                    py = this or py = this.(BoundMethodObjectInternal).getFunction()
+                |
+                    py.getScope().getArg(n + offset).getName() = name
+                )
             )
             or
             call.getArgByName(name) = result and
-            exists(this.(PythonFunctionObjectInternal).getScope().getArgByName(name))
+            exists(PythonFunctionObjectInternal py |
+                py = this or py = this.(BoundMethodObjectInternal).getFunction()
+            |
+                exists(py.getScope().getArgByName(name))
+            )
             or
             called instanceof BoundMethodObjectInternal and
             offset = 1 and
@@ -396,6 +408,26 @@ class CallableValue extends Value {
     }
 }
 
+/**
+ * Class representing bound-methods, such as `o.func`, where `o` is an instance
+ * of a class that has a callable attribute `func`.
+ */
+class BoundMethodValue extends CallableValue {
+    BoundMethodValue() { this instanceof BoundMethodObjectInternal }
+
+    /**
+     * Gets the callable that will be used when `this` called.
+     * The actual callable for `func` in `o.func`.
+     */
+    CallableValue getFunction() { result = this.(BoundMethodObjectInternal).getFunction() }
+
+    /**
+     * Gets the value that will be used for the `self` parameter when `this` is called.
+     * The value for `o` in `o.func`.
+     */
+    Value getSelf() { result = this.(BoundMethodObjectInternal).getSelf() }
+}
+
 /**
  * Class representing classes in the Python program, both Python and built-in.
  */

python/ql/test/library-tests/PointsTo/calls/getArgumentForCall.expected

@@ -7,12 +7,16 @@
 | 23 | ControlFlowNode for Attribute() | Function f | 0 | ControlFlowNode for c |
 | 23 | ControlFlowNode for Attribute() | Function f | 1 | ControlFlowNode for w |
 | 23 | ControlFlowNode for Attribute() | Function f | 2 | ControlFlowNode for z |
+| 23 | ControlFlowNode for Attribute() | Method(Function f, C()) | 0 | ControlFlowNode for w |
+| 23 | ControlFlowNode for Attribute() | Method(Function f, C()) | 1 | ControlFlowNode for z |
 | 24 | ControlFlowNode for Attribute() | Function C.n | 0 | ControlFlowNode for c |
 | 24 | ControlFlowNode for Attribute() | Function C.n | 1 | ControlFlowNode for x |
+| 24 | ControlFlowNode for Attribute() | Method(Function C.n, C()) | 0 | ControlFlowNode for x |
 | 25 | ControlFlowNode for Attribute() | Function C.n | 0 | ControlFlowNode for y |
 | 25 | ControlFlowNode for Attribute() | Function C.n | 1 | ControlFlowNode for z |
 | 33 | ControlFlowNode for Attribute() | Function D.foo | 0 | ControlFlowNode for IntegerLiteral |
 | 34 | ControlFlowNode for Attribute() | Function D.foo | 0 | ControlFlowNode for IntegerLiteral |
+| 37 | ControlFlowNode for Attribute() | Method(builtin method append, List) | 0 | ControlFlowNode for IntegerLiteral |
 | 37 | ControlFlowNode for Attribute() | builtin method append | 0 | ControlFlowNode for l |
 | 37 | ControlFlowNode for Attribute() | builtin method append | 1 | ControlFlowNode for IntegerLiteral |
 | 38 | ControlFlowNode for len() | Builtin-function len | 0 | ControlFlowNode for l |
@@ -21,3 +25,4 @@
 | 40 | ControlFlowNode for f() | Function f | 2 | ControlFlowNode for IntegerLiteral |
 | 42 | ControlFlowNode for Attribute() | Function C.n | 0 | ControlFlowNode for c |
 | 42 | ControlFlowNode for Attribute() | Function C.n | 1 | ControlFlowNode for IntegerLiteral |
+| 42 | ControlFlowNode for Attribute() | Method(Function C.n, C()) | 0 | ControlFlowNode for IntegerLiteral |

python/ql/test/library-tests/PointsTo/calls/getNamedArgumentForCall.expected

@@ -7,8 +7,11 @@
 | 23 | ControlFlowNode for Attribute() | Function f | arg1 | ControlFlowNode for w |
 | 23 | ControlFlowNode for Attribute() | Function f | arg2 | ControlFlowNode for z |
 | 23 | ControlFlowNode for Attribute() | Function f | self | ControlFlowNode for c |
+| 23 | ControlFlowNode for Attribute() | Method(Function f, C()) | arg0 | ControlFlowNode for w |
+| 23 | ControlFlowNode for Attribute() | Method(Function f, C()) | arg1 | ControlFlowNode for z |
 | 24 | ControlFlowNode for Attribute() | Function C.n | arg1 | ControlFlowNode for x |
 | 24 | ControlFlowNode for Attribute() | Function C.n | self | ControlFlowNode for c |
+| 24 | ControlFlowNode for Attribute() | Method(Function C.n, C()) | self | ControlFlowNode for x |
 | 25 | ControlFlowNode for Attribute() | Function C.n | arg1 | ControlFlowNode for z |
 | 25 | ControlFlowNode for Attribute() | Function C.n | self | ControlFlowNode for y |
 | 33 | ControlFlowNode for Attribute() | Function D.foo | arg | ControlFlowNode for IntegerLiteral |
@@ -19,3 +22,4 @@
 | 40 | ControlFlowNode for f() | Function f | arg2 | ControlFlowNode for IntegerLiteral |
 | 42 | ControlFlowNode for Attribute() | Function C.n | arg1 | ControlFlowNode for IntegerLiteral |
 | 42 | ControlFlowNode for Attribute() | Function C.n | self | ControlFlowNode for c |
+| 42 | ControlFlowNode for Attribute() | Method(Function C.n, C()) | arg1 | ControlFlowNode for IntegerLiteral |