[python] incoherent flow when using a literal vs identifier argument

[xavierpinho]

Setup

Query

def source = cpg.literal("20")
def sink = cpg.call("sink").argument
sink.reachableByFlows(source)

Sample 1

x = foo(20)
sink(x)

Sample 2

y = 20
x = foo(y)
sink(x)

Results

For Sample 1, we obtain the following 2 flows:

1. LITERAL 20
2. CALL foo(20)
3. IDENTIFIER x (the assignment)
4. IDENTIFIER x (the argument)

and

1. LITERAL 20
2. IDENTIFIER x (the assignment)
3. IDENTIFIER x (the argument)

For Sample 2, we obtain a single flow:

1. LITERAL 20
2. IDENTIFIER y (the assignment)
3. IDENTIFIER y (the argument)
4. CALL foo(y)
5. IDENTIFIER x (the assignment)
6. IDENTIFIER x (the argument)

Discussion

Sample 1 should not contain its second flow -- the one that jumps over the foo call directly to the assigned variable.

Interestingly:

• in Sample 2 foo has methodFullName __builtin.int.foo
• in Sample 1 foo has methodFullName <unknownFullName>