Skip to content
This repository was archived by the owner on Jun 26, 2026. It is now read-only.
This repository was archived by the owner on Jun 26, 2026. It is now read-only.

[pysa question] Can't model __setitem__ on object of unknown type #981

Description

@diogotcorreia

Hey,

I'm trying to model the obj[key] = value construct on an obj of possibly unknown type. I don't care about the type of obj and want to mark all calls to __setitem__ as a sink.

Example code:

text: str = input()
text1: str = input()
text2: str = input()

class A:
    pass

a = A()

def my_func():
    foo = getattr(a, text)
    foo[text1] = text2

my_func()

I've tried adding the sink to dict.__setitem__, and creating the models using the DSL. This is my .pysa file:

@SkipObscure
def getattr(
    __o: TaintInTaintOut[Via[customgetattr]],
    __name,
    __default: TaintInTaintOut[LocalReturn],
) -> TaintSource[CustomGetAttr, ViaValueOf[__name, WithTag["get-name"]]]: ...

@SkipOverrides
@SkipObscure
def dict.__setitem__(
    __o: TaintSink[CustomSetItem, ViaValueOf[__name, WithTag["set-name"]], ViaValueOf[__value, WithTag["set-value"]]],
    __name,
    __value,
): ...

ModelQuery(
  name = "get_setitem_calls_funcs",
  find = "functions",
  where = [name.matches("__setitem__")],
  model = [
    Parameters(
      TaintSink[CustomSetItem],
      where=[
        index.equals(0)
      ]
    ),
  ],
)

ModelQuery(
  name = "get_setitem_calls_methods",
  find = "methods",
  where = [name.matches("__setitem__")],
  model = [
    Parameters(
      TaintSink[CustomSetItem],
      where=[
        index.equals(0)
      ]
    ),
  ],
)

I've ran pysa with some debugging and got this, which I think is the cause of the issue; pysa cannot figure out what the function call refers to:

19:4-19:24 -> {"__setitem__" -> { call =
                                  (Some { call_targets = [];
                                          new_targets = [];
                                          init_targets = [];
                                          decorated_targets = [];
                                          higher_order_parameters = {};
                                          unresolved =
                                          (CallGraph.Unresolved.True
                                             (CallGraph.Unresolved.BypassingDecorators
                                                CallGraph.Unresolved.UnknownBaseType));
                                          recognized_call = False });
                                  attribute_access = None;
                                  identifier = None; string_format = None
                                  }}

Is there any way to get pysa to use one of the models, even if the base type is unknown?

Thanks in advance

Activity

Sign up for free to join this conversation on GitHub. Already have an account? Sign in to comment

Metadata

Metadata

Assignees

No one assigned

    Labels

    No labels
    No labels

    Type

    No type

    Projects

    No projects

      Milestone

      No milestone

      Relationships

      None yet

      Development

      No branches or pull requests

      Issue actions