How to retrieve this knowing it is a parameter and it has an attribute

[Sim4n6]

my code source is:

import os 
....
os.abc(eee.name)
....

How to get the eee please? I give it a try here 👍🏾

import python

from DataFlow::Node eee
where eee = API::moduleImport("os").getMember("abc").getACall().getParameter(0).getMember("name").getSelfParameter()
select eee

but I seem to miss something please?

[tausbn]

If that is your entire source code, then one issue here is that os isn't defined anywhere. In order for something to be picked up as an API::moduleImport, it must be imported. So, at the very least you need import os as well (assuming this is Python).

[aibaars]

Is this what you are after:

from DataFlow::Node eee, DataFlow::Node arg
where arg = API::moduleImport("os").getMember("abc").getACall().getArg(0)
  and eee.asCfgNode() = arg.asCfgNode().(AttrNode).getObject("name")
select eee

A run of a slightly modified version of the above can be found at https://lgtm.com/query/8767541591049826472/

[tausbn]

You could also do

from DataFlow::Node eee, DataFlow::Node arg
where arg = API::moduleImport("os").getMember("abc").getACall().getArg(0)
  and arg.(DataFlow::AttrRead).accesses(eee, "name")
select eee

(with corresponding run: https://lgtm.com/query/1968868920308852744/)

[Sim4n6]

@aibaars : it is working thx, but could you explain more, please ?

@tausbn : is this a type casting .(DataFlow::AttrRead) , please?

[tausbn]

@tausbn : is this a type casting .(DataFlow::AttrRead) , please?

That is correct! We're saying that the argument arg must be an attribute read (something like foo.bar), and that it accesses the attribute named name on the node that we're interested in.

The solution presented by aibaars does the same thing, just using the control-flow graph instead (hence the asCfgNode calls).

[Sim4n6]

Coool 😎 thx guys