How to check if a method exists in a Python coebase

[timh1975]

Hello!

I'm trying to write a custom CodeQL query for Python that finds and outputs that the method x.insert is found. X refers to an array.

a = []
for x in range(1, 1000000):
random_number = random.randint(0,255)
a.insert(x,random_number)

However, I'm not able to find out how do this.

[mbg]

Hi @timh1975 👋🏻

It would be good to know what you have tried so far and have a bit more information about what you are trying to accomplish?

In any case, you may find the documentation about API graphs useful. E.g. the following should find you calls to insert:

import python
import semmle.python.ApiGraphs

select API::builtin("insert").getACall()

[timh1975]

Thank you for your quick response. The example I included isnt in a function. I've tried your example and I am getting no responses back from the query. These are the libaries that I have in .lock.yml file

lockVersion: 1.0.0
dependencies:
codeql/dataflow:
version: 2.0.1
codeql/mad:
version: 1.0.17
codeql/python-all:
version: 4.0.1
codeql/regex:
version: 1.0.17
codeql/ssa:
version: 1.0.17
codeql/threat-models:
version: 1.0.17
codeql/tutorial:
version: 1.0.17
codeql/typetracking:
version: 2.0.1
codeql/util:
version: 2.0.4
codeql/xml:
version: 1.0.17
codeql/yaml:
version: 1.0.17
compiled: false

I'm am also using custom build queries. I've a;readu tried a basic function that looks for a function called hello that works.

/**

• This is an automatically generated file
• @name Hello world
• @kind problem
• @problem.severity warning
• @id python/example/hello-world
  */

import python

from Function f
where f.getName() = "hello"
select f, "hello found" as message

thanks again in advance

[timh1975]

I've managed to figure out a way of doing this

/**

• @id py/examples/insert
• @name Find inserts
• @description Find calls to the builtin function 'insert'
• @tags print, builtin
  */

import semmle.python.dataflow.new.internal.DataFlowPublic
import python

from MethodCallNode insertCall, File file
where insertCall.getMethodName() = "insert"
select insertCall, "Call to insert found",
file.getAbsolutePath(),
insertCall.getLocation().getStartLine(),
insertCall.getLocation().getStartColumn()