Merge pull request #15755 from RasmusWL/it-fix

Python: Fix module level flow for iterable unpacking

Author: yoff

python/ql/lib/change-notes/2024-02-28-iterable-unpacking-module-scope.md

@@ -0,0 +1,4 @@
+---
+category: minorAnalysis
+---
+* Fixed flow for iterable unpacking (`a,b = my_tuple`) when it occurs on top-level (module) scope.

python/ql/lib/semmle/python/dataflow/new/internal/DataFlowPublic.qll

@@ -467,7 +467,7 @@ class IterableSequenceNode extends Node, TIterableSequenceNode {
 
   override string toString() { result = "IterableSequence" }
 
-  override DataFlowCallable getEnclosingCallable() { result = consumer.getEnclosingCallable() }
+  override Scope getScope() { result = consumer.getScope() }
 
   override Location getLocation() { result = consumer.getLocation() }
 }
@@ -484,7 +484,7 @@ class IterableElementNode extends Node, TIterableElementNode {
 
   override string toString() { result = "IterableElement" }
 
-  override DataFlowCallable getEnclosingCallable() { result = consumer.getEnclosingCallable() }
+  override Scope getScope() { result = consumer.getScope() }
 
   override Location getLocation() { result = consumer.getLocation() }
 }
@@ -499,7 +499,7 @@ class StarPatternElementNode extends Node, TStarPatternElementNode {
 
   override string toString() { result = "StarPatternElement" }
 
-  override DataFlowCallable getEnclosingCallable() { result = consumer.getEnclosingCallable() }
+  override Scope getScope() { result = consumer.getScope() }
 
   override Location getLocation() { result = consumer.getLocation() }
 }

python/ql/test/experimental/dataflow/coverage/module_level.py

@@ -0,0 +1,7 @@
+# this test has code on module level, which works in slightly different ways than when
+# inside a function
+
+t = (SOURCE, NONSOURCE)
+a, b = t
+SINK(a) #$ flow="SOURCE, l:-2 -> a"
+SINK_F(b)