Python File Concept

cpg-concepts/src/integrationTest/resources/python/file/file_delete.py

@@ -0,0 +1,9 @@
+import os
+
+with open('example.txt', 'r') as file:
+    content = file.read()
+
+os.remove('example.txt')
+
+with open('example.txt', 'w') as file:
+    file.write(content)

cpg-concepts/src/integrationTest/resources/python/file/file_os_open.py

@@ -0,0 +1,5 @@
+import os
+
+flags = os.O_WRONLY | os.O_CREAT | os.O_TRUNC
+with os.open('example.txt', flags, 0o600) as fh:
+    fh.write('foo')

cpg-concepts/src/integrationTest/resources/python/file/file_os_open_bad.py

@@ -0,0 +1,6 @@
+import os
+
+flags = os.O_WRONLY | os.O_CREAT | os.O_TRUNC
+with os.open('example.txt', flags, 0o600) as fh:
+    fh.write('foo')
+    os.chmod('example.txt', 0o511)

cpg-concepts/src/integrationTest/resources/python/file/file_read.py

@@ -0,0 +1,2 @@
+with open('example.txt', 'r') as file:
+    content = file.read()

cpg-concepts/src/integrationTest/resources/python/file/file_with_branching.py

@@ -0,0 +1,6 @@
+if foo:
+  file = open("foo")
+else:
+  file = open("bar")
+
+file.read()

cpg-concepts/src/integrationTest/resources/python/file/file_write.py

@@ -0,0 +1,2 @@
+with open('example.txt', 'w') as file:
+    file.write('Hello world!')

cpg-concepts/src/integrationTest/resources/python/file/write_before_chmod.py

@@ -0,0 +1,7 @@
+import os
+
+if __name__ == '__main__':
+    file = "/tmp/foo.txt"
+    fh = open(file, "w+")
+    fh.write("Writing to the file before chmod ain't a good idea...")
+    os.chmod(file, 0o600)

cpg-concepts/src/main/kotlin/de/fraunhofer/aisec/cpg/graph/concepts/Operation.kt

@@ -25,6 +25,7 @@
  */
 package de.fraunhofer.aisec.cpg.graph.concepts
 
+import de.fraunhofer.aisec.cpg.graph.Name
 import de.fraunhofer.aisec.cpg.graph.Node
 import de.fraunhofer.aisec.cpg.graph.OverlayNode
 
@@ -43,5 +44,6 @@ abstract class Operation(
 
     init {
         this.underlyingNode = underlyingNode
+        this::class.simpleName?.let { name = Name(it) }
     }
 }

cpg-concepts/src/main/kotlin/de/fraunhofer/aisec/cpg/graph/concepts/file/File.kt

@@ -0,0 +1,158 @@
+/*
+ * Copyright (c) 2024, Fraunhofer AISEC. All rights reserved.
+ *
+ * Licensed under the Apache License, Version 2.0 (the "License");
+ * you may not use this file except in compliance with the License.
+ * You may obtain a copy of the License at
+ *
+ *      http://www.apache.org/licenses/LICENSE-2.0
+ *
+ * Unless required by applicable law or agreed to in writing, software
+ * distributed under the License is distributed on an "AS IS" BASIS,
+ * WITHOUT WARRANTIES OR CONDITIONS OF ANY KIND, either express or implied.
+ * See the License for the specific language governing permissions and
+ * limitations under the License.
+ *
+ *                    $$$$$$\  $$$$$$$\   $$$$$$\
+ *                   $$  __$$\ $$  __$$\ $$  __$$\
+ *                   $$ /  \__|$$ |  $$ |$$ /  \__|
+ *                   $$ |      $$$$$$$  |$$ |$$$$\
+ *                   $$ |      $$  ____/ $$ |\_$$ |
+ *                   $$ |  $$\ $$ |      $$ |  $$ |
+ *                   \$$$$$   |$$ |      \$$$$$   |
+ *                    \______/ \__|       \______/
+ *
+ */
+package de.fraunhofer.aisec.cpg.graph.concepts.file
+
+import de.fraunhofer.aisec.cpg.graph.Node
+import de.fraunhofer.aisec.cpg.graph.concepts.Concept
+import de.fraunhofer.aisec.cpg.graph.concepts.Operation
+
+/**
+ * This interface indicates that the corresponding node is connected to a file concept or operation.
+ */
+interface IsFile
+
+/**
+ * Represents a file access mode flag.
+ *
+ * man 0p fcntl.h
+ *
+ * ```
+ * The <fcntl.h> header shall define the following symbolic constants for use as the  file access  modes  for  open(),  openat(), and fcntl().  The values shall be unique, except that O_EXEC and O_SEARCH may have equal values. The values shall be suitable for use in #if preprocessing directives.
+ * O_EXEC      Open for execute only (non-directory files). The result is  unspecified  if this flag is applied to a directory.
+ * O_RDONLY    Open for reading only.
+ * O_RDWR      Open for reading and writing.
+ * O_SEARCH    Open  directory  for search only. The result is unspecified if this flag is applied to a non-directory file.
+ * O_WRONLY    Open for writing only.
+ * ```
+ */
+enum class FileAccessModeFlags(val value: Long) : IsFile {
+    // O_EXEC(-1), not supported
+    O_RDONLY(0),
+    O_RDWR(2),
+    // O_SEARCH(-1), not supported
+    O_WRONLY(1),
+}
+
+/** The bit-mask to be used to get the [FileAccessModeFlags] from an entire flags value. */
+const val O_ACCMODE_MODE_MASK = 3L
+
+/**
+ * Represents a file.
+ *
+ * @param underlyingNode The underlying CPG node (usually a [CallExpression]).
+ * @param fileName The name of the file e.g. `foo/bar/example.txt`
+ */
+class File(underlyingNode: Node, val fileName: String) :
+    Concept(underlyingNode = underlyingNode), IsFile
+
+/**
+ * Represents setting flags on a file. For example when opening the file.
+ *
+ * @param underlyingNode The underlying CPG node (usually a [CallExpression]).
+ * @param concept The corresponding [File] node.
+ * @param flags A set of file flags (see [FileAccessModeFlags]).
+ */
+class SetFileFlags(
+    underlyingNode: Node,
+    override val concept: File,
+    val flags: Set<FileAccessModeFlags>,
+) : FileOperation(underlyingNode = underlyingNode, file = concept), IsFile
+
+/**
+ * Represents setting the umask, for example with the `mode` parameter in a Python `os.open` call or
+ * a `chmod` call.
+ *
+ * @param underlyingNode The underlying CPG node (usually a [CallExpression]).
+ * @param concept The corresponding [File] node.
+ * @param mask The file mask in UNIX notation (i.e. 0o644)
+ */
+class SetFileMask(underlyingNode: Node, override val concept: File, val mask: Long) :
+    FileOperation(underlyingNode = underlyingNode, file = concept), IsFile
+
+/**
+ * Represents closing a file.
+ *
+ * @param underlyingNode The underlying CPG node (usually a [CallExpression]).
+ * @param concept The corresponding [File] node.
+ */
+class CloseFile(underlyingNode: Node, override val concept: File) :
+    FileOperation(underlyingNode = underlyingNode, file = concept), IsFile
+
+/**
+ * Represents deleting a file.
+ *
+ * @param underlyingNode The underlying CPG node (usually a [CallExpression]).
+ * @param concept The corresponding [File] node.
+ */
+class DeleteFile(underlyingNode: Node, override val concept: File) :
+    FileOperation(underlyingNode = underlyingNode, file = concept), IsFile
+
+/**
+ * Represents opening a file. This is usually done with the same underlying node the [concept] field
+ * is attached to.
+ *
+ * @param underlyingNode The underlying CPG node (usually a [CallExpression]).
+ * @param concept The corresponding [File] node.
+ */
+class OpenFile(underlyingNode: Node, override val concept: File) :
+    FileOperation(underlyingNode = underlyingNode, file = concept), IsFile
+
+/**
+ * Represents reading from a file.
+ *
+ * @param underlyingNode The underlying CPG node (usually a [CallExpression]).
+ * @param concept The corresponding [File] node.
+ */
+class ReadFile(underlyingNode: Node, override val concept: File) :
+    FileOperation(underlyingNode = underlyingNode, file = concept), IsFile
+
+/**
+ * Represents writing to a file.
+ *
+ * @param underlyingNode The underlying CPG node (usually a [CallExpression]).
+ * @param concept The corresponding [File] node.
+ * @param what The node being written to the file.
+ */
+class WriteFile(underlyingNode: Node, override val concept: File, val what: Node) :
+    FileOperation(underlyingNode = underlyingNode, file = concept), IsFile
+
+/**
+ * All [File] [Operation]s inherit from this class. This makes the [file] field available for
+ * [FileOperation], resulting in easier to read queries (one can use [FileOperation.file] instead of
+ * [Operation.concept]). There is no logic involved - just a simple forwarding of the field.
+ *
+ * @param underlyingNode The underlying CPG node (usually a [CallExpression]).
+ * @param file The corresponding [File] node.
+ */
+abstract class FileOperation(underlyingNode: Node, file: File) :
+    Operation(underlyingNode = underlyingNode, concept = file) {
+    /**
+     * The corresponding [File] [Concept] node. This is a convenience field and has the same effect
+     * as using [Operation.concept].
+     */
+    val file: File
+        get() = this.concept as File
+}

cpg-concepts/src/main/kotlin/de/fraunhofer/aisec/cpg/graph/concepts/file/FileBuilder.kt

@@ -0,0 +1,168 @@
+/*
+ * Copyright (c) 2024, Fraunhofer AISEC. All rights reserved.
+ *
+ * Licensed under the Apache License, Version 2.0 (the "License");
+ * you may not use this file except in compliance with the License.
+ * You may obtain a copy of the License at
+ *
+ *      http://www.apache.org/licenses/LICENSE-2.0
+ *
+ * Unless required by applicable law or agreed to in writing, software
+ * distributed under the License is distributed on an "AS IS" BASIS,
+ * WITHOUT WARRANTIES OR CONDITIONS OF ANY KIND, either express or implied.
+ * See the License for the specific language governing permissions and
+ * limitations under the License.
+ *
+ *                    $$$$$$\  $$$$$$$\   $$$$$$\
+ *                   $$  __$$\ $$  __$$\ $$  __$$\
+ *                   $$ /  \__|$$ |  $$ |$$ /  \__|
+ *                   $$ |      $$$$$$$  |$$ |$$$$\
+ *                   $$ |      $$  ____/ $$ |\_$$ |
+ *                   $$ |  $$\ $$ |      $$ |  $$ |
+ *                   \$$$$$   |$$ |      \$$$$$   |
+ *                    \______/ \__|       \______/
+ *
+ */
+package de.fraunhofer.aisec.cpg.graph.concepts.file
+
+import de.fraunhofer.aisec.cpg.graph.MetadataProvider
+import de.fraunhofer.aisec.cpg.graph.Node
+import de.fraunhofer.aisec.cpg.graph.NodeBuilder
+import de.fraunhofer.aisec.cpg.graph.codeAndLocationFrom
+
+/**
+ * Creates a new [File] node. This node represents a file on a hard-disk somewhere.
+ *
+ * @param underlyingNode The underlying CPG node (usually a [CallExpression]).
+ * @param fileName The name of the file e.g. `foo/bar/example.txt`
+ * @return The new [File] node.
+ */
+fun MetadataProvider.newFile(underlyingNode: Node, fileName: String): File {
+    val node = File(underlyingNode = underlyingNode, fileName = fileName)
+    node.codeAndLocationFrom(underlyingNode)
+
+    NodeBuilder.log(node)
+    return node
+}
+
+/**
+ * Creates a new [OpenFile] node. This node represents opening a file.
+ *
+ * @param underlyingNode The underlying CPG node (usually a [CallExpression]).
+ * @param file The [File] this operation is opening.
+ * @return The new [OpenFile] node.
+ */
+fun MetadataProvider.newFileOpen(underlyingNode: Node, file: File): OpenFile {
+    val node = OpenFile(underlyingNode = underlyingNode, concept = file)
+    node.codeAndLocationFrom(underlyingNode)
+
+    NodeBuilder.log(node)
+    return node
+}
+
+/**
+ * Creates a new [SetFileMask] node. This node represents changing a files permissions.
+ *
+ * @param underlyingNode The underlying CPG node (usually a [CallExpression]).
+ * @param file The [File] this operation is modifying.
+ * @param mask The file mask to set (in UNIX notation).
+ * @return The new [SetFileMask] node.
+ */
+fun MetadataProvider.newFileSetMask(underlyingNode: Node, file: File, mask: Long): SetFileMask {
+    val node = SetFileMask(underlyingNode = underlyingNode, concept = file, mask = mask)
+    node.codeAndLocationFrom(underlyingNode)
+
+    NodeBuilder.log(node)
+    return node
+}
+
+/**
+ * Creates a new [SetFileFlags] node.
+ *
+ * @param underlyingNode The underlying CPG node (usually a [CallExpression]).
+ * @param file The [File] this operation is working on.
+ * @param flags The file flags to set (in UNIX notation).
+ * @return The new [SetFileFlags] node.
+ */
+fun MetadataProvider.newFileSetFlags(
+    underlyingNode: Node,
+    file: File,
+    flags: Set<FileAccessModeFlags>,
+): SetFileFlags {
+    val node = SetFileFlags(underlyingNode = underlyingNode, concept = file, flags = flags)
+    node.codeAndLocationFrom(underlyingNode)
+
+    NodeBuilder.log(node)
+    return node
+}
+
+/**
+ * Creates a new [CloseFile] node.
+ *
+ * @param underlyingNode The underlying CPG node (usually a [CallExpression]).
+ * @param file The [File] this operation is closing.
+ * @return The new [CloseFile] node.
+ */
+fun MetadataProvider.newFileClose(underlyingNode: Node, file: File): CloseFile {
+    val node = CloseFile(underlyingNode = underlyingNode, concept = file)
+    node.codeAndLocationFrom(underlyingNode)
+
+    NodeBuilder.log(node)
+    return node
+}
+
+/**
+ * Creates a new [DeleteFile] node.
+ *
+ * @param underlyingNode The underlying CPG node (usually a [CallExpression]).
+ * @param file The [File] this operation is deleting.
+ * @return The new [DeleteFile] node.
+ */
+fun MetadataProvider.newFileDelete(underlyingNode: Node, file: File): DeleteFile {
+    val node = DeleteFile(underlyingNode = underlyingNode, concept = file)
+    node.codeAndLocationFrom(underlyingNode)
+
+    NodeBuilder.log(node)
+    return node
+}
+
+/**
+ * Creates a new [ReadFile] node and attaches the DFG from the corresponding [file] to the new node
+ * and then from [this] to the created node.
+ *
+ * @param underlyingNode The underlying CPG node (usually a [CallExpression]).
+ * @param file The [File] this operation is reading from.
+ * @return The new [ReadFile] node.
+ */
+fun MetadataProvider.newFileRead(underlyingNode: Node, file: File): ReadFile {
+    val node = ReadFile(underlyingNode = underlyingNode, concept = file)
+    node.codeAndLocationFrom(underlyingNode)
+
+    // add DFG
+    file.nextDFG += node
+    node.nextDFG += underlyingNode
+
+    NodeBuilder.log(node)
+    return node
+}
+
+/**
+ * Creates a new [WriteFile] node and attaches the DFG from [what] to [this] and then from the new
+ * node to the [file].
+ *
+ * @param underlyingNode The underlying CPG node (usually a [CallExpression]).
+ * @param file The [File] this operation is writing to.
+ * @param what A node being written to the [file] (usually the argument of a `write` call).
+ * @return The new [WriteFile] node.
+ */
+fun MetadataProvider.newFileWrite(underlyingNode: Node, file: File, what: Node): WriteFile {
+    val node = WriteFile(underlyingNode = underlyingNode, concept = file, what = what)
+    node.codeAndLocationFrom(underlyingNode)
+
+    // add DFG
+    what.nextDFG += node
+    node.nextDFG += file
+
+    NodeBuilder.log(node)
+    return node
+}