CodeQL library for Python
codeql/python-all 1.0.1 (changelog, source)

Class SynthDictSplatParameterNode

A synthetic data-flow node to allow flow to keyword parameters from a **kwargs argument.

Take the code snippet below as an example. Since the call only has a **kwargs argument, with a ** argument position, we add this synthetic parameter node with ** parameter position, and a read step to the p1 parameter.

def foo(p1, p2): ...

kwargs = {"p1": 42, "p2": 43}

Note that this will introduce a bit of redundancy in cases like

foo(p1=taint(1), p2=taint(2))

where direct keyword matching is possible, since we construct a synthesized dict splat argument (SynthDictSplatArgumentNode) at the call site, which means that taint(1) will flow into p1 both via normal keyword matching and via the synthesized nodes (and similarly for p2). However, this redundancy is OK since (a) it means that type-tracking through keyword arguments also works in most cases, (b) read/store steps can be avoided when direct keyword matching is possible, and hence access path limits are not a concern, and (c) since the synthesized nodes are hidden, the reported data-flow paths will be collapsed anyway.

Import path


Direct supertypes

Indirect supertypes




Gets the location of this node


Gets the Parameter this ParameterNode represents.


Gets the scope of this node.


Gets a textual representation of this element.

Inherited predicates


Gets the control-flow node corresponding to this node, if any.

from Node

Gets the expression corresponding to this node, if any.

from Node

Gets a local source node from which data may flow to this node in zero or more local data-flow steps.

from Node

Gets the enclosing callable of this node.

from Node

Holds if this element is at the specified location. The location spans column startcolumn of line startline to column endcolumn of line endline in file filepath. For more information, see Locations.

from Node

Holds if this node is the parameter of callable c at the position ppos.

from ParameterNodeImpl