Python: test the Python 2 except reading through extraction, not a unit test

Replaces `tests/test_except_clause.py` with an extractor test, as suggested in
review. `python/ql/test/2/extractor-tests/relaxed_except` extracts a Python 2
file with `--lang=2` and pins, per handler, the types and whether the bound name
is a definition -- so it asserts the consequence a query sees, not the shape of
the AST. Removing the version gate from `visit_except_clause` makes it fail.

Doing it that way needed one extractor fix first. `populator.main` honours
`--lang` by calling `update_analysis_version`, but that only rebinds a global in
the process that parses the options; the extraction itself runs in an
`ExtractorPool`, and on macOS those workers are spawned rather than forked, so
they re-read `CODEQL_EXTRACTOR_PYTHON_ANALYSIS_VERSION` from the environment and
saw the default of 3. `--lang=2` therefore meant Python 2 on Linux and Python 3
on macOS. Setting the variable as well as the global makes the flag mean the
same thing on both, which is what lets the new test pin the Python 2 reading
anywhere. Real Python 2 extraction was never affected: the CodeQL action sets
that variable itself, and children inherit it.

Bumps the extractor version, which the fix in the first commit should have done.

Verified with codeql 2.26.3 and this branch's extractor patched into it:
`python/ql/test/2/extractor-tests` 10 passed (`hidden` fails identically on the
unpatched extractor, so it is not from this branch), and the py3 side is
unchanged -- `python/ql/test/query-tests/Imports` all 17 passed, which also
confirms the `relaxed_except*.py` query tests added earlier.

Co-Authored-By: Claude Opus 5 (1M context) <noreply@anthropic.com>

Author: aausch

python/extractor/semmle/populator.py

@@ -65,6 +65,11 @@ def main(sys_path = sys.path[:]):
     if options.language_version:
         last_version = options.language_version[-1]
         update_analysis_version(last_version)
+        # Worker processes are spawned rather than forked on macOS, so they do
+        # not inherit the value set above; they re-read it from the environment
+        # as this module did on import. Set it there too, or `--lang` would take
+        # effect in this process only, and on one platform only.
+        os.environ["CODEQL_EXTRACTOR_PYTHON_ANALYSIS_VERSION"] = last_version
 
     found_py2 = False
     if get_analysis_major_version() == 2 and options.extract_stdlib:

python/extractor/semmle/util.py

@@ -10,7 +10,7 @@
 
 #Semantic version of extractor.
 #Update this if any changes are made
-VERSION = "7.1.8"
+VERSION = "7.1.9"
 
 PY_EXTENSIONS = ".py", ".pyw"
 

python/extractor/tests/test_except_clause.py

@@ -0,0 +1 @@
+semmle-extractor-options: --lang=2

python/ql/test/2/extractor-tests/relaxed_except/options

@@ -0,0 +1,3 @@
+| 6 | ValueError | err (definition) |
+| 12 | ValueError | other (definition) |
+| 18 | ValueError, TypeError | none |

python/ql/test/2/extractor-tests/relaxed_except/relaxed_except.expected

@@ -0,0 +1,26 @@
+/**
+ * The types of each `except` clause, and the name it binds. In Python 2 the
+ * comma form binds a name and has a single type; reading it as a PEP 758 tuple
+ * instead would give two types and no name.
+ */
+
+import python
+
+from ExceptStmt handler, string types, string name
+where
+  types =
+    concat(Expr type |
+      type = handler.getType()
+    |
+      type.toString(), ", " order by type.getLocation().getStartColumn()
+    ) and
+  (
+    exists(Name bound | bound = handler.getName() |
+      bound.isDefinition() and name = bound.getId() + " (definition)"
+      or
+      not bound.isDefinition() and name = bound.getId() + " (use)"
+    )
+    or
+    not exists(handler.getName()) and name = "none"
+  )
+select handler.getLocation().getStartLine(), types, name

python/ql/test/2/extractor-tests/relaxed_except/relaxed_except.ql

@@ -0,0 +1,19 @@
+# When extracting Python 2, `except A, e:` binds `e`. It is not a PEP 758
+# unparenthesized tuple of exception types, which is what the same syntax means
+# from Python 3.14 on.
+try:
+    unlikely()
+except ValueError, err:
+    print err
+
+# `as` means the same thing in every version.
+try:
+    unlikely()
+except ValueError as other:
+    print other
+
+# A parenthesized tuple is several types, and binds nothing.
+try:
+    unlikely()
+except (ValueError, TypeError):
+    pass