KeyPointsToFailure.ql

/**
 * @name Key points-to fails for expression.
 * @description Expression does not "point-to" an object which prevents further points-to analysis.
 * @kind problem
 * @problem.severity info
 * @id py/key-points-to-failure
 * @deprecated
 */

import python

predicate points_to_failure(Expr e) {
    exists(ControlFlowNode f | 
        f = e.getAFlowNode() |
        not f.refersTo(_)
    )
}

predicate key_points_to_failure(Expr e) {
    points_to_failure(e) and not points_to_failure(e.getASubExpression())
    and
    not exists(SsaVariable ssa |
        ssa.getAUse() = e.getAFlowNode() |
        points_to_failure(ssa.getAnUltimateDefinition().getDefinition().getNode())
    )
    and
    not exists(Assign a | a.getATarget() = e)
}

from Attribute e
where key_points_to_failure(e) and not exists(Call c | c.getFunc() = e)
select e, "Expression does not 'point-to' any object, but all its sources do."