Merge pull request #2401 from tausbn/python-fix-non-iterable-class-confusion-fp

Python: Fix false positive in `py/non-iterator-in-for-loop`

Author: RasmusWL

python/ql/src/semmle/python/objects/TObject.qll

@@ -367,9 +367,10 @@ predicate receiver(AttrNode instantiation, PointsToContext context, ObjectIntern
 pragma [noinline]
 private predicate self_parameter(ParameterDefinition def, PointsToContext context, PythonClassObjectInternal cls) {
     def.isSelf() and
+    /* Exclude the special parameter name `.0` which is used for unfolded comprehensions. */
+    def.getName() != ".0" and
     exists(Function scope |
         def.getScope() = scope and
-        def.isSelf() and
         context.isRuntime() and context.appliesToScope(scope) and
         scope.getScope() = cls.getScope() and
         concrete_class(cls) and

python/ql/test/query-tests/Statements/general/NonIteratorInForLoop.expected

@@ -1,2 +1 @@
 | test.py:50:1:50:23 | For | $@ of class '$@' may be used in for-loop. | test.py:50:10:50:22 | ControlFlowNode for NonIterator() | Non-iterator | test.py:45:1:45:26 | class NonIterator | NonIterator |
-| test.py:170:10:170:22 | For | $@ of class '$@' may be used in for-loop. | test.py:170:10:170:22 | ControlFlowNode for .0 | Non-iterator | test.py:169:1:169:21 | class false_positive | false_positive |

python/ql/test/query-tests/Statements/general/test.py

@@ -165,7 +165,7 @@ def no_with():
 def assert_ok(seq):
     assert all(isinstance(element, (str, unicode)) for element in seq)
 
-# False positive. ODASA-8042
+# False positive. ODASA-8042. Fixed in PR #2401.
 class false_positive:
     e = (x for x in [])