Python: delete old deprecations

Author: erik-krogh

python/ql/lib/change-notes/2022-11-17-deleted-deps.md

@@ -0,0 +1,7 @@
+---
+category: minorAnalysis
+---
+* Deleted the deprecated `importNode` predicate from the `DataFlowUtil.qll` file.
+* Deleted the deprecated features from `PEP249.qll` that were not inside the `PEP249` module.
+* Deleted the deprecated `werkzeug` from the `Werkzeug` module in `Werkzeug.qll`.
+* Deleted the deprecated `methodResult` predicate from `PEP249::Cursor`.

python/ql/lib/semmle/python/dataflow/new/internal/DataFlowUtil.qll

@@ -26,67 +26,3 @@ predicate localFlowStep(Node nodeFrom, Node nodeTo) {
  */
 pragma[inline]
 predicate localFlow(Node source, Node sink) { localFlowStep*(source, sink) }
-
-/**
- * DEPRECATED. Use the API graphs library (`semmle.python.ApiGraphs`) instead.
- *
- * For a drop-in replacement, use `API::moduleImport(name).getAUse()`.
- *
- * Gets a `Node` that refers to the module referenced by `name`.
- * Note that for the statement `import pkg.mod`, the new variable introduced is `pkg` that is a
- * reference to the module `pkg`.
- *
- * This predicate handles (with optional `... as <new-name>`):
- * 1. `import <name>`
- * 2. `from <package> import <module>` when `<name> = <package> + "." + <module>`
- * 3. `from <module> import <member>` when `<name> = <module> + "." + <member>`
- *
- * Finally, in `from <module> import <member>` we consider the `ImportExpr` corresponding to
- * `<module>` to be a reference to that module.
- *
- * Note:
- * While it is technically possible that `import mypkg.foo` and `from mypkg import foo` can give different values,
- * it's highly unlikely that this will be a problem in production level code.
- *   Example: If `mypkg/__init__.py` contains `foo = 42`, then `from mypkg import foo` will not import the module
- *   `mypkg/foo.py` but the variable `foo` containing `42` -- however, `import mypkg.foo` will always cause `mypkg.foo`
- *   to refer to the module.
- */
-deprecated Node importNode(string name) {
-  exists(Variable var, Import imp, Alias alias |
-    alias = imp.getAName() and
-    alias.getAsname() = var.getAStore() and
-    (
-      name = alias.getValue().(ImportMember).getImportedModuleName()
-      or
-      name = alias.getValue().(ImportExpr).getImportedModuleName()
-    ) and
-    result.asExpr() = alias.getValue()
-  )
-  or
-  // Although it may seem superfluous to consider the `foo` part of `from foo import bar as baz` to
-  // be a reference to a module (since that reference only makes sense locally within the `import`
-  // statement), it's important for our use of type trackers to consider this local reference to
-  // also refer to the `foo` module. That way, if one wants to track references to the `bar`
-  // attribute using a type tracker, one can simply write
-  //
-  // ```ql
-  // DataFlow::Node bar_attr_tracker(TypeTracker t) {
-  //   t.startInAttr("bar") and
-  //   result = foo_module_tracker()
-  //   or
-  //   exists(TypeTracker t2 | result = bar_attr_tracker(t2).track(t2, t))
-  // }
-  // ```
-  //
-  // Where `foo_module_tracker` is a type tracker that tracks references to the `foo` module.
-  // Because named imports are modeled as `AttrRead`s, the statement `from foo import bar as baz`
-  // is interpreted as if it was an assignment `baz = foo.bar`, which means `baz` gets tracked as a
-  // reference to `foo.bar`, as desired.
-  exists(ImportExpr imp_expr |
-    imp_expr.getName() = name and
-    result.asCfgNode().getNode() = imp_expr and
-    // in `import foo.bar` we DON'T want to give a result for `importNode("foo.bar")`,
-    // only for `importNode("foo")`. We exclude those cases with the following clause.
-    not exists(Import imp | imp.getAName().getValue() = imp_expr)
-  )
-}

python/ql/lib/semmle/python/frameworks/PEP249.qll

@@ -9,28 +9,3 @@ private import semmle.python.dataflow.new.RemoteFlowSources
 private import semmle.python.Concepts
 private import semmle.python.ApiGraphs
 import semmle.python.frameworks.internal.PEP249Impl
-
-/**
- * DEPRECATED: Use `PEP249::PEP249ModuleApiNode` instead.
- */
-deprecated class PEP249ModuleApiNode = PEP249::PEP249ModuleApiNode;
-
-/**
- * DEPRECATED: Use `PEP249::Connection` instead.
- */
-deprecated module Connection = PEP249::Connection;
-
-/**
- * DEPRECATED: Use `PEP249::Cursor` instead.
- */
-deprecated module cursor = PEP249::Cursor;
-
-/**
- * DEPRECATED: Use `PEP249::execute` instead.
- */
-deprecated predicate execute = PEP249::execute/0;
-
-/**
- * DEPRECATED: Use `PEP249::connect` instead.
- */
-deprecated predicate connect = PEP249::connect/0;

python/ql/lib/semmle/python/frameworks/Werkzeug.qll

@@ -231,119 +231,4 @@ module Werkzeug {
       override string getAsyncMethodName() { none() }
     }
   }
-
-  import WerkzeugOld
-}
-
-/**
- * Old version that contains the deprecated modules.
- */
-private module WerkzeugOld {
-  /**
-   * DEPRECATED: Use the modeling available directly in the `Werkzeug` module instead.
-   *
-   * Provides models for the `werkzeug` module.
-   */
-  deprecated module werkzeug {
-    /**
-     * DEPRECATED: Use the modeling available directly in the `Werkzeug` module instead.
-     *
-     * Provides models for the `werkzeug.datastructures` module.
-     */
-    deprecated module datastructures {
-      /**
-       * DEPRECATED: Use `Werkzeug::MultiDict` instead.
-       *
-       * Provides models for the `werkzeug.datastructures.MultiDict` class
-       *
-       * See https://werkzeug.palletsprojects.com/en/1.0.x/datastructures/#werkzeug.datastructures.MultiDict.
-       */
-      deprecated module MultiDict {
-        /**
-         * DEPRECATED. Use `Werkzeug::MultiDict::InstanceSource` instead.
-         *
-         * A source of instances of `werkzeug.datastructures.MultiDict`, extend this class to model new instances.
-         *
-         * This can include instantiations of the class, return values from function
-         * calls, or a special parameter that will be set when functions are called by an external
-         * library.
-         *
-         * Use the predicate `MultiDict::instance()` to get references to instances of `werkzeug.datastructures.MultiDict`.
-         */
-        abstract deprecated class InstanceSourceApiNode extends API::Node { }
-
-        /**
-         * DEPRECATED
-         *
-         * Gets a reference to the `getlist` method on an instance of `werkzeug.datastructures.MultiDict`.
-         *
-         * See https://werkzeug.palletsprojects.com/en/1.0.x/datastructures/#werkzeug.datastructures.Headers.getlist
-         */
-        deprecated DataFlow::Node getlist() {
-          result = any(InstanceSourceApiNode a).getMember("getlist").getAValueReachableFromSource()
-        }
-
-        private class MultiDictAdditionalTaintStep extends TaintTracking::AdditionalTaintStep {
-          override predicate step(DataFlow::Node nodeFrom, DataFlow::Node nodeTo) {
-            // obj -> obj.getlist
-            exists(DataFlow::AttrRead read |
-              read.getObject() = nodeFrom and
-              nodeTo = read and
-              nodeTo = getlist()
-            )
-            or
-            // getlist -> getlist()
-            nodeFrom = getlist() and
-            nodeTo.(DataFlow::CallCfgNode).getFunction() = nodeFrom
-          }
-        }
-      }
-
-      /**
-       * DEPRECATED: Use `Werkzeug::FileStorage` instead.
-       *
-       * Provides models for the `werkzeug.datastructures.FileStorage` class
-       *
-       * See https://werkzeug.palletsprojects.com/en/1.0.x/datastructures/#werkzeug.datastructures.FileStorage.
-       */
-      deprecated module FileStorage {
-        /**
-         * DEPRECATED. Use `Werkzeug::FileStorage::InstanceSource` instead.
-         *
-         * A source of instances of `werkzeug.datastructures.FileStorage`, extend this class to model new instances.
-         *
-         * This can include instantiations of the class, return values from function
-         * calls, or a special parameter that will be set when functions are called by an external
-         * library.
-         *
-         * Use the predicate `FileStorage::instance()` to get references to instances of `werkzeug.datastructures.FileStorage`.
-         */
-        abstract deprecated class InstanceSourceApiNode extends API::Node { }
-
-        /** Gets a reference to an instance of `werkzeug.datastructures.FileStorage`. */
-        deprecated DataFlow::Node instance() {
-          result = any(InstanceSourceApiNode a).getAValueReachableFromSource()
-        }
-
-        private class FileStorageAdditionalTaintStep extends TaintTracking::AdditionalTaintStep {
-          override predicate step(DataFlow::Node nodeFrom, DataFlow::Node nodeTo) {
-            nodeFrom = instance() and
-            exists(DataFlow::AttrRead read | nodeTo = read |
-              read.getAttributeName() in [
-                  // str
-                  "filename", "name", "content_type", "mimetype",
-                  // file-like
-                  "stream",
-                  // TODO: werkzeug.datastructures.Headers
-                  "headers",
-                  // dict[str, str]
-                  "mimetype_params"
-                ] and
-              read.getObject() = nodeFrom
-            )
-          }
-        }
-      }
-    }
-  }
 }

python/ql/lib/semmle/python/frameworks/internal/PEP249Impl.qll

@@ -129,15 +129,6 @@ module PEP249 {
       or
       exists(DataFlow::TypeTracker t2 | result = methodResult(t2).track(t2, t))
     }
-
-    /**
-     * DEPRECATED: Use `Cursor::instance()` to get references to database cursors instead.
-     *
-     * Gets a reference to a result of calling the `cursor` method on a database connection.
-     */
-    deprecated DataFlow::Node methodResult() {
-      methodResult(DataFlow::TypeTracker::end()).flowsTo(result)
-    }
   }
 
   /**