Skip to content

fix(ast_provenance): resolve duplicate function definitions by usage line span - #71

Open
Adityakk9031 wants to merge 3 commits into
Corgea:mainfrom
Adityakk9031:fix/ast-provenance-class-method-qualification
Open

fix(ast_provenance): resolve duplicate function definitions by usage line span#71
Adityakk9031 wants to merge 3 commits into
Corgea:mainfrom
Adityakk9031:fix/ast-provenance-class-method-qualification

Conversation

@Adityakk9031

Copy link
Copy Markdown
Contributor

Summary

  • Stores all definitions for a given function name along with their AST line spans in \PythonAstProvenance.
  • Updates
    esolve_variable_reaching\ to match the sink's \usage_line\ against each definition's line span when multiple methods in a file share the same bare name (e.g. \get, \post,
    un, \handle\ across multiple classes).
  • Resolves false-negative vulnerability drops where class methods previously collided in \�mbiguous\ and were ignored by \DataFlowTracer.
  • Adds regression unit tests in \src/scanner/ast_provenance.rs.

@Adityakk9031

Copy link
Copy Markdown
Contributor Author

@juangaitanv and @Ibrahimrahhal have a look

@juangaitanv
juangaitanv self-requested a review August 17, 2026 08:32
Comment on lines +123 to +141
let function = match function_list.len() {
0 => return None,
1 => &function_list[0],
_ => {
if let Some(line) = usage_line {
let matching: Vec<&FunctionFacts> = function_list
.iter()
.filter(|f| line >= f.span.0 && line <= f.span.1)
.collect();
if matching.len() == 1 {
matching[0]
} else {
return Some(AstResolution::Ambiguous);
}
} else {
return Some(AstResolution::Ambiguous);
}
}
};

Copy link
Copy Markdown
Contributor

Choose a reason for hiding this comment

The reason will be displayed to describe this comment to others. Learn more.

when the selected definition has no local facts, the text fallback can resolve a different same-named definition; could we return AstResolution::Ambiguous instead?

Copy link
Copy Markdown
Contributor Author

Choose a reason for hiding this comment

The reason will be displayed to describe this comment to others. Learn more.

@juangaitanv Thanks for the feedback! Updated resolve_variable_reaching in src/scanner/ast_provenance.rs so that when function_list.len() > 1 (duplicate function definitions exist in the file) and the selected definition lacks local facts (no matching assignments or parameters for the variable), it returns Some(AstResolution::Ambiguous). This prevents the text fallback from incorrectly attributing another same-named definition's facts. Added regression test duplicate_function_names_without_local_facts_resolve_as_ambiguous.

Sign up for free to join this conversation on GitHub. Already have an account? Sign in to comment

Labels

None yet

Projects

None yet

Development

Successfully merging this pull request may close these issues.

2 participants