Python: limit capturing scopes

Author: yoff

python/ql/lib/semmle/python/dataflow/new/internal/DataFlowPrivate.qll

@@ -417,18 +417,18 @@ module VariableCapture {
       Function f;
 
       CapturedVariable() {
-        //  exists(this.getScopeEntryDefinition())
         this.getScope() = f and
-        (
-          this.getALoad().getScope() != f
-          or
-          this.getAStore().getScope() != f
-        )
+        this.getAnAccess().getScope() != f
       }
 
       Callable getCallable() { result = f }
 
       Location getLocation() { result = f.getLocation() }
+
+      Scope getACapturingScope() {
+        result = this.getAnAccess().getScope().getScope*() and
+        result.getScope+() = f
+      }
     }
 
     class CapturedParameter extends CapturedVariable {

python/ql/lib/semmle/python/dataflow/new/internal/DataFlowPublic.qll

@@ -119,7 +119,9 @@ newtype TNode =
   /** A synthetic node representing a captured variable. */
   TCaptureNode(VariableCapture::Flow::SynthesizedCaptureNode cn) or
   /** TODO: extende to also cover lambdas */
-  TLambdaSelfReferenceNode(Function f)
+  TLambdaSelfReferenceNode(Function f) {
+    f = any(VariableCapture::CapturedVariable v).getACapturingScope()
+  }
 
 private import semmle.python.internal.CachedStages