Python: py/import-deprecated-module handle backwards compatible code

Author: RasmusWL

python/ql/src/Imports/DeprecatedModule.ql

@@ -73,8 +73,13 @@ string replacement_message(string mod) {
     )
 }
 
-from ImportExpr imp, string name
+from ImportExpr imp, string name, string instead
 where
     name = imp.getName() and
-    deprecated_module(name, _, _, _)
+    deprecated_module(name, instead, _, _) and
+    not exists(Try try, ExceptStmt except | except = try.getAHandler()
+    |
+        except.getType().pointsTo(ClassValue::importError()) and
+        except.containsInScope(imp)
+    )
 select imp, deprecation_message(name) + replacement_message(name)

python/ql/src/semmle/python/objects/ObjectAPI.qll

@@ -714,4 +714,9 @@ module ClassValue {
         result = TBuiltinClassObject(Builtin::builtin("NameError"))
     }
 
+    /** Get the `ClassValue` for the `ImportError` class. */
+    ClassValue importError() {
+        result = TBuiltinClassObject(Builtin::builtin("ImportError"))
+    }
+
 }

python/ql/test/query-tests/Imports/deprecated/DeprecatedModule.expected

@@ -1,4 +1,3 @@
 | test.py:2:8:2:13 | ImportExpr | The rfc822 module was deprecated in version 2.3. Use email module instead. |
 | test.py:3:8:3:16 | ImportExpr | The posixfile module was deprecated in version 1.5. Use email module instead. |
 | test.py:8:16:8:18 | ImportExpr | The md5 module was deprecated in version 2.5. Use hashlib module instead. |
-| test.py:14:10:14:12 | ImportExpr | The md5 module was deprecated in version 2.5. Use hashlib module instead. |

python/ql/test/query-tests/Imports/deprecated/test.py

@@ -7,7 +7,7 @@ class Foo(object):
     def foo(self):
         import md5
 
-# TODO: Backwards compatible code, should not report
+# Backwards compatible code, should not report
 try:
     from hashlib import md5
 except ImportError: