Sandbox::https://github.com/github/codeql/blob/main/python/ql/src/Imports/UnintentionalImport.ql

Repository navigation

35 lines (31 loc) · 1.08 KB

/**

* @name 'import *' may pollute namespace

* @description Importing a module using 'import *' may unintentionally pollute the global

* namespace if the module does not define `__all__`

* @kind problem

* @tags quality

* maintainability

* readability

* @problem.severity recommendation

* @sub-severity high

* @precision very-high

* @id py/polluting-import

import python

private import LegacyPointsTo

private import semmle.python.types.ImportTime

predicate import_star(ImportStar imp, ModuleValue exporter) {

exporter.importedAs(imp.getImportedModuleName())

}

predicate all_defined(ModuleValue exporter) {

exporter.isBuiltin()

exporter.getScope().(ImportTimeScope).definesName("__all__")

exporter.getScope().getInitModule().(ImportTimeScope).definesName("__all__")

}

from ImportStar imp, ModuleValue exporter

where import_star(imp, exporter) and not all_defined(exporter) and not exporter.isAbsent()

select imp,

"Import pollutes the enclosing namespace, as the imported module $@ does not define '__all__'.",

exporter, exporter.getName()