Python: keep the Python 2 reading of except A, e:

The previous commit read a comma-separated fourth child as a tuple of exception
types unconditionally. That is right for Python 3, but the default parser is
version-agnostic and also runs when extracting Python 2
(`CODEQL_EXTRACTOR_PYTHON_ANALYSIS_VERSION=2`, `--lang=2`), where
`except Exception, e:` really is the alias binding and the canonical idiom. In
that mode the change flipped `e` from a `Store` to a `Load` of an undefined
name and dropped the binding altogether.

So the separator token alone is not enough to decide: `as` binds an alias in
every version, a comma binds an alias under Python 2 and builds a tuple
otherwise. Chains of three or more are unaffected either way -- they are not
valid Python 2, and the default grammar rejects them, so `Module.py_ast` falls
back to tree-sitter.

The file-driven parser tests cannot express this; they run at the default
analysis version and there is no per-fixture way to change it. So
`tests/test_except_clause.py` drives `parser.parse` directly with the version
flipped, and pins all four combinations -- comma and `as`, Python 2 and 3, plus
the parenthesized form that must bind no alias in either. Removing the version
gate fails the Python 2 case.

Co-Authored-By: Claude Opus 5 (1M context) <noreply@anthropic.com>

Author: aausch

python/extractor/semmle/python/parser/ast.py

@@ -1,6 +1,7 @@
 from blib2to3.pgen2 import token
 from ast import literal_eval
 from semmle.python import ast
+from semmle.util import get_analysis_major_version
 from blib2to3.pgen2.parse import ParseError
 import sys
 
@@ -981,13 +982,17 @@ def visit_except_clause(self, node):
         if len(node.children) > 1:
             type = self.visit(node.children[1], LOAD)
         if len(node.children) > 3:
-            if is_token(node.children[2], "as"):
+            # The grammar rule `'except' [test [(',' | 'as') test]]` is shared
+            # between two incompatible readings of a fourth child, so the
+            # separator token and the analysis version together decide:
+            #   `except A as e:`  binds an alias, in every version;
+            #   `except A, e:`    binds an alias when extracting Python 2, where
+            #                     that is the canonical idiom;
+            #   `except A, B:`    is an unparenthesized tuple of exception types
+            #                     otherwise -- PEP 758, Python 3.14+.
+            if is_token(node.children[2], "as") or get_analysis_major_version() == 2:
                 name = self.visit(node.children[3], STORE)
             else:
-                # PEP 758 (Python 3.14+): `except A, B:` is an unparenthesized
-                # tuple of exception types, not a Python 2 alias binding. The
-                # grammar rule `'except' [test [(',' | 'as') test]]` is shared
-                # between both readings, so the separator token decides.
                 elts = [type, self.visit(node.children[3], LOAD)]
                 type = ast.Tuple(elts, LOAD)
                 set_location(type, node.children[1].start, node.children[3].end)

python/extractor/tests/test_except_clause.py

@@ -0,0 +1,71 @@
+import unittest
+from contextlib import contextmanager
+
+from semmle import util
+from semmle.python import ast
+from semmle.python import parser
+from semmle.python.parser.dump_ast import StdoutLogger
+from semmle.python.parser.tokenizer import Tokenizer
+
+
+@contextmanager
+def analysis_version(version):
+    'Extract as if `CODEQL_EXTRACTOR_PYTHON_ANALYSIS_VERSION` were `version`.'
+    previous = util.get_analysis_version()
+    util.update_analysis_version(version)
+    try:
+        yield
+    finally:
+        util.update_analysis_version(previous)
+
+
+class ExceptClauseTest(unittest.TestCase):
+    '''`except_clause: 'except' [test [(',' | 'as') test]]` is one grammar rule
+    covering two incompatible readings of `except A, B:` -- a Python 2 alias
+    binding and a PEP 758 tuple of exception types. Which one the default parser
+    picks depends on the version being extracted, so these tests pin both.
+    '''
+
+    def handler(self, source):
+        'The first `except` handler of the first statement of `source`.'
+        with StdoutLogger() as logger:
+            module = parser.parse(Tokenizer(source).tokens(), logger)
+        return module.body[0].handlers[0]
+
+    def test_comma_is_a_tuple_of_types_in_python_3(self):
+        with analysis_version("3.11"):
+            handler = self.handler("try:\n    a\nexcept b, c:\n    d\n")
+        self.assertIsNone(handler.name)
+        self.assertIsInstance(handler.type, ast.Tuple)
+        self.assertIsInstance(handler.type.ctx, ast.Load)
+        self.assertEqual(["b", "c"], [elt.id for elt in handler.type.elts])
+        for elt in handler.type.elts:
+            self.assertIsInstance(elt.ctx, ast.Load)
+
+    def test_comma_is_an_alias_binding_in_python_2(self):
+        with analysis_version("2.7.18"):
+            handler = self.handler("try:\n    a\nexcept b, c:\n    d\n")
+        self.assertIsInstance(handler.type, ast.Name)
+        self.assertEqual("b", handler.type.id)
+        self.assertIsInstance(handler.type.ctx, ast.Load)
+        self.assertIsInstance(handler.name, ast.Name)
+        self.assertEqual("c", handler.name.id)
+        self.assertIsInstance(handler.name.ctx, ast.Store)
+
+    def test_as_is_an_alias_binding_in_both_versions(self):
+        for version in ("3.11", "2.7.18"):
+            with analysis_version(version):
+                handler = self.handler("try:\n    a\nexcept b as c:\n    d\n")
+            self.assertIsInstance(handler.type, ast.Name, version)
+            self.assertEqual("b", handler.type.id, version)
+            self.assertIsInstance(handler.name, ast.Name, version)
+            self.assertEqual("c", handler.name.id, version)
+            self.assertIsInstance(handler.name.ctx, ast.Store, version)
+
+    def test_parenthesised_types_bind_no_alias_in_either_version(self):
+        for version in ("3.11", "2.7.18"):
+            with analysis_version(version):
+                handler = self.handler("try:\n    a\nexcept (b, c):\n    d\n")
+            self.assertIsNone(handler.name, version)
+            self.assertIsInstance(handler.type, ast.Tuple, version)
+            self.assertEqual(["b", "c"], [elt.id for elt in handler.type.elts], version)

python/ql/lib/change-notes/2026-08-19-legacy-parser-relaxed-except.md

@@ -1,4 +1,4 @@
 ---
 category: fix
 ---
-* Fixed the extraction of PEP 758 `except A, B:` clauses by the default (non-tree-sitter) Python parser. Previously the second exception type was extracted as a Python 2 style alias binding, so it was recorded as a `Store` rather than a use. This caused false positives from queries that reason about whether a name is used, such as `py/unused-import`.
+* Fixed the extraction of PEP 758 `except A, B:` clauses by the default (non-tree-sitter) Python parser. Previously the second exception type was extracted as a Python 2 style alias binding, so it was recorded as a `Store` rather than a use. This caused false positives from queries that reason about whether a name is used, such as `py/unused-import`. When extracting Python 2 (`--lang=2`), `except A, e:` continues to bind `e` as an alias, since that is what the syntax means in that version.