Python: exclude constants from being SSA variables

Author: yoff

python/ql/lib/semmle/python/dataflow/new/internal/SsaImpl.qll

@@ -45,24 +45,27 @@ private import codeql.controlflow.BasicBlock as BB
  */
 private newtype TSsaSourceVariable =
   TPyVar(Py::Variable v) {
-    // Has a use somewhere — read-relevant for SSA.
-    exists(Cfg::NameNode n | n.uses(v))
-    or
-    // Or has a deletion (treated as a write that destroys the value).
-    exists(Cfg::NameNode n | n.deletes(v))
-    or
-    // Or is a module-scope global written in this module — must be
-    // tracked even if never read locally, because importers may read
-    // it as an attribute on the module object.
-    v.getScope() instanceof Py::Module and
-    exists(Cfg::NameNode n | n.defines(v))
-    or
-    // Or is a parameter — parameters must always have a
-    // `ParameterDefinition` for dataflow argument-routing to work,
-    // even if the parameter is never read in its scope. Mirrors
-    // legacy ESSA's `ParameterDefinition` (which fired for every
-    // parameter binding regardless of liveness).
-    exists(Py::Parameter p | p.asName() = v.getAStore())
+    not v.getALoad() instanceof Py::NameConstant and
+    (
+      // Has a use somewhere — read-relevant for SSA.
+      exists(Cfg::NameNode n | n.uses(v))
+      or
+      // Or has a deletion (treated as a write that destroys the value).
+      exists(Cfg::NameNode n | n.deletes(v))
+      or
+      // Or is a module-scope global written in this module — must be
+      // tracked even if never read locally, because importers may read
+      // it as an attribute on the module object.
+      v.getScope() instanceof Py::Module and
+      exists(Cfg::NameNode n | n.defines(v))
+      or
+      // Or is a parameter — parameters must always have a
+      // `ParameterDefinition` for dataflow argument-routing to work,
+      // even if the parameter is never read in its scope. Mirrors
+      // legacy ESSA's `ParameterDefinition` (which fired for every
+      // parameter binding regardless of liveness).
+      exists(Py::Parameter p | p.asName() = v.getAStore())
+    )
   }
 
 /**

python/ql/test/library-tests/dataflow-new-ssa-vs-legacy/CmpTest.ql

@@ -52,4 +52,10 @@ where
   kind = "def-only-old" and
   sig = legacyDefSig(_) and
   not sig = newDefSig(_)
+  or
+  kind = "constant-variable" and
+  exists(NewSsa::SsaSourceVariable v |
+    v.getVariable().getALoad() instanceof NameConstant and
+    sig = v.getName()
+  )
 select kind, sig

python/ql/test/library-tests/dataflow-new-ssa-vs-legacy/test.py

@@ -51,3 +51,7 @@ def with_binding():
 
 def read_global():
     return GLOBAL
+
+
+def constants():
+    return True, False, None