Skip to content

Conversation

@bcaller
Copy link
Collaborator

@bcaller bcaller commented Aug 3, 2018

Fixed so that it doesn't crash and so the result will be [ret_g, b, c] as per @KevinHock's suggestion. The solution I've done is a bit ugly so feel free to suggest changes.

First commit fixes a small bug with keyword arguments not being treated correctly.

Fixes #157

bcaller added 2 commits August 3, 2018 12:19
ast.Call.args is [argument node]

ast.Call.keywords however is [ast.keyword]

You need to do isinstance(keyword_node.value, X) otherwise handling of
args and kwargs will be different.
It's rare, but a curried function call can appear within a function
call. It was raising a RuntimeError in VarsVisitor.

We don't build a cfg properly for curried functions which is fine for
now, but we don't need to crash.

At least there is now defined behaviour.
Copy link
Collaborator

@KevinHock KevinHock left a comment

Choose a reason for hiding this comment

The reason will be displayed to describe this comment to others. Learn more.

LGTM

@KevinHock KevinHock merged commit ca78b68 into python-security:master Aug 7, 2018
Sign up for free to join this conversation on GitHub. Already have an account? Sign in to comment

Labels

None yet

Projects

None yet

Development

Successfully merging this pull request may close these issues.

VarsVisitor RuntimeError on code like f(g(a)(b))

2 participants