Properly share ConceptsShared.qll

Author: jketema

config/identical-files.json

@@ -235,12 +235,6 @@
     "javascript/ql/src/Security/CWE-020/IncompleteUrlSubstringSanitization.qll",
     "ruby/ql/src/queries/security/cwe-020/IncompleteUrlSubstringSanitization.qll"
   ],
-  "Concepts Python/Ruby/JS": [
-    "python/ql/lib/semmle/python/internal/ConceptsShared.qll",
-    "ruby/ql/lib/codeql/ruby/internal/ConceptsShared.qll",
-    "javascript/ql/lib/semmle/javascript/internal/ConceptsShared.qll",
-    "rust/ql/lib/codeql/rust/internal/ConceptsShared.qll"
-  ],
   "ApiGraphModels": [
     "javascript/ql/lib/semmle/javascript/frameworks/data/internal/ApiGraphModels.qll",
     "ruby/ql/lib/codeql/ruby/frameworks/data/internal/ApiGraphModels.qll",

javascript/ql/lib/semmle/javascript/Concepts.qll

@@ -5,7 +5,11 @@
  */
 
 import javascript
+private import semmle.javascript.dataflow.internal.sharedlib.DataFlowArg
 private import codeql.threatmodels.ThreatModels
+private import codeql.concepts.ConceptsShared
+
+private module ConceptsShared = ConceptsMake<Location, JSDataFlow>;
 
 /**
  * A data flow source, for a specific threat-model.
@@ -206,7 +210,7 @@ abstract class PersistentWriteAccess extends DataFlow::Node {
  * Provides models for cryptographic things.
  */
 module Cryptography {
-  private import semmle.javascript.internal.ConceptsShared::Cryptography as SC
+  private import ConceptsShared::Cryptography as SC
 
   /**
    * A data-flow node that is an application of a cryptographic algorithm. For example,

javascript/ql/lib/semmle/javascript/internal/ConceptsImports.qll

@@ -6,11 +6,16 @@
 
 private import python
 private import semmle.python.dataflow.new.DataFlow
+private import semmle.python.dataflow.new.internal.DataFlowImplSpecific
 private import semmle.python.dataflow.new.RemoteFlowSources
 private import semmle.python.dataflow.new.TaintTracking
+private import semmle.python.Files
 private import semmle.python.Frameworks
 private import semmle.python.security.internal.EncryptionKeySizes
 private import codeql.threatmodels.ThreatModels
+private import codeql.concepts.ConceptsShared
+
+private module ConceptsShared = ConceptsMake<Location, PythonDataFlow>;
 
 /**
  * A data flow source, for a specific threat-model.
@@ -1617,7 +1622,7 @@ module Http {
     }
   }
 
-  import semmle.python.internal.ConceptsShared::Http::Client as Client
+  import ConceptsShared::Http::Client as Client
   // TODO: investigate whether we should treat responses to client requests as
   // remote-flow-sources in general.
 }
@@ -1725,5 +1730,5 @@ module Cryptography {
     }
   }
 
-  import semmle.python.internal.ConceptsShared::Cryptography
+  import ConceptsShared::Cryptography
 }

javascript/ql/lib/semmle/javascript/internal/ConceptsShared.qll

@@ -758,7 +758,7 @@ module AiohttpClientModel {
     private API::Node instance() { result = classRef().getReturn() }
 
     /** A method call on a ClientSession that sends off a request */
-    private class OutgoingRequestCall extends Http::Client::Request::Range, API::CallNode {
+    private class OutgoingRequestCall extends Http::Client::Request::Range instanceof API::CallNode {
       string methodName;
 
       OutgoingRequestCall() {
@@ -767,21 +767,21 @@ module AiohttpClientModel {
       }
 
       override DataFlow::Node getAUrlPart() {
-        result = this.getArgByName("url")
+        result = super.getArgByName("url")
         or
         methodName in [Http::httpVerbLower(), "ws_connect"] and
-        result = this.getArg(0)
+        result = super.getArg(0)
         or
         methodName = "request" and
-        result = this.getArg(1)
+        result = super.getArg(1)
       }
 
       override string getFramework() { result = "aiohttp.ClientSession" }
 
       override predicate disablesCertificateValidation(
         DataFlow::Node disablingNode, DataFlow::Node argumentOrigin
       ) {
-        exists(API::Node param | param = this.getKeywordParameter(["ssl", "verify_ssl"]) |
+        exists(API::Node param | param = super.getKeywordParameter(["ssl", "verify_ssl"]) |
           disablingNode = param.asSink() and
           argumentOrigin = param.getAValueReachingSink() and
           // aiohttp.client treats `None` as the default and all other "falsey" values as `False`.

python/ql/lib/semmle/python/Concepts.qll

@@ -107,8 +107,7 @@ private module CryptodomeModel {
   /**
    * A cryptographic operation on an instance from the `Cipher` subpackage of `Cryptodome`/`Crypto`.
    */
-  class CryptodomeGenericCipherOperation extends Cryptography::CryptographicOperation::Range,
-    DataFlow::CallCfgNode
+  class CryptodomeGenericCipherOperation extends Cryptography::CryptographicOperation::Range instanceof DataFlow::CallCfgNode
   {
     string methodName;
     string cipherName;
@@ -134,31 +133,31 @@ private module CryptodomeModel {
 
     override DataFlow::Node getAnInput() {
       methodName = "encrypt" and
-      result in [this.getArg(0), this.getArgByName(["message", "plaintext"])]
+      result in [super.getArg(0), super.getArgByName(["message", "plaintext"])]
       or
       methodName = "decrypt" and
-      result in [this.getArg(0), this.getArgByName("ciphertext")]
+      result in [super.getArg(0), super.getArgByName("ciphertext")]
       or
       // for the following methods, method signatures can be found in
       // https://pycryptodome.readthedocs.io/en/latest/src/cipher/modern.html
       methodName = "update" and
-      result in [this.getArg(0), this.getArgByName("data")]
+      result in [super.getArg(0), super.getArgByName("data")]
       or
       // although `mac_tag` is used as the parameter name in the spec above, some implementations use `received_mac_tag`, for an example, see
       // https://github.com/Legrandin/pycryptodome/blob/5dace638b70ac35bb5d9b565f3e75f7869c9d851/lib/Crypto/Cipher/ChaCha20_Poly1305.py#L207
       methodName = "verify" and
-      result in [this.getArg(0), this.getArgByName(["mac_tag", "received_mac_tag"])]
+      result in [super.getArg(0), super.getArgByName(["mac_tag", "received_mac_tag"])]
       or
       methodName = "hexverify" and
-      result in [this.getArg(0), this.getArgByName("mac_tag_hex")]
+      result in [super.getArg(0), super.getArgByName("mac_tag_hex")]
       or
       methodName = "encrypt_and_digest" and
-      result in [this.getArg(0), this.getArgByName("plaintext")]
+      result in [super.getArg(0), super.getArgByName("plaintext")]
       or
       methodName = "decrypt_and_verify" and
       result in [
-          this.getArg(0), this.getArgByName("ciphertext"), this.getArg(1),
-          this.getArgByName("mac_tag")
+          super.getArg(0), super.getArgByName("ciphertext"), super.getArg(1),
+          super.getArgByName("mac_tag")
         ]
     }
 
@@ -180,8 +179,7 @@ private module CryptodomeModel {
   /**
    * A cryptographic operation on an instance from the `Signature` subpackage of `Cryptodome`/`Crypto`.
    */
-  class CryptodomeGenericSignatureOperation extends Cryptography::CryptographicOperation::Range,
-    DataFlow::CallCfgNode
+  class CryptodomeGenericSignatureOperation extends Cryptography::CryptographicOperation::Range instanceof DataFlow::CallCfgNode
   {
     API::CallNode newCall;
     string methodName;
@@ -206,13 +204,13 @@ private module CryptodomeModel {
 
     override DataFlow::Node getAnInput() {
       methodName = "sign" and
-      result in [this.getArg(0), this.getArgByName("msg_hash")] // Cryptodome.Hash instance
+      result in [super.getArg(0), super.getArgByName("msg_hash")] // Cryptodome.Hash instance
       or
       methodName = "verify" and
       (
-        result in [this.getArg(0), this.getArgByName("msg_hash")] // Cryptodome.Hash instance
+        result in [super.getArg(0), super.getArgByName("msg_hash")] // Cryptodome.Hash instance
         or
-        result in [this.getArg(1), this.getArgByName("signature")]
+        result in [super.getArg(1), super.getArgByName("signature")]
       )
     }
 
@@ -222,8 +220,7 @@ private module CryptodomeModel {
   /**
    * A cryptographic operation on an instance from the `Hash` subpackage of `Cryptodome`/`Crypto`.
    */
-  class CryptodomeGenericHashOperation extends Cryptography::CryptographicOperation::Range,
-    DataFlow::CallCfgNode
+  class CryptodomeGenericHashOperation extends Cryptography::CryptographicOperation::Range instanceof DataFlow::CallCfgNode
   {
     API::CallNode newCall;
     string hashName;
@@ -244,7 +241,7 @@ private module CryptodomeModel {
 
     override Cryptography::CryptographicAlgorithm getAlgorithm() { result.matchesName(hashName) }
 
-    override DataFlow::Node getAnInput() { result in [this.getArg(0), this.getArgByName("data")] }
+    override DataFlow::Node getAnInput() { result in [super.getArg(0), super.getArgByName("data")] }
 
     override Cryptography::BlockMode getBlockMode() { none() }
   }