@oculum/scanner 1.0.14 → 1.0.15

package/src/__tests__/taint/python-cross-file.test.ts

@@ -0,0 +1,494 @@
+/**
+ * Python Cross-File Taint Analysis Tests
+ *
+ * Tests for Python function collection, import resolution,
+ * cross-file index building, and end-to-end cross-file taint flow.
+ */
+
+import { parseFile, parseFiles, clearASTCache } from '../../parse/ast'
+import type { ParsedAST } from '../../parse/ast'
+import { collectFunctions, type FunctionNode } from '../../parse/call-graph'
+import { buildFileIndex, resolveImportPath, extractAllImports } from '../../model/import-resolver'
+import { buildModuleGraph } from '../../model/module-graph'
+import { buildCrossFileIndex } from '../../taint/cross-file-index'
+import { analyzeTaintsForProject } from '../../taint/cross-file-analyzer'
+import type { ScanFile } from '../../shared/types'
+
+// Side-effect imports to register taint flow rules
+import '../../detect/ast-rules/taint-flow-ast'
+
+function makePyFile(path: string, content: string): ScanFile {
+  return { path, content, language: 'python' as any, size: content.length }
+}
+
+function parsePython(code: string, filePath = 'app.py'): ParsedAST {
+  const ast = parseFile(code, filePath)
+  if (!ast) throw new Error('Failed to parse Python code')
+  return ast
+}
+
+beforeEach(() => {
+  clearASTCache()
+})
+
+// ============================================================================
+// A: Function Collection Tests
+// ============================================================================
+
+describe('Python Function Collection', () => {
+  it('A1: collects top-level def with correct name and params', () => {
+    const ast = parsePython(`
+def run_query(query, db_name):
+    cursor.execute(query)
+`)
+    const functions = new Map<string, FunctionNode>()
+    collectFunctions(ast.tree.rootNode, functions)
+
+    expect(functions.has('run_query')).toBe(true)
+    const fn = functions.get('run_query')!
+    expect(fn.params).toEqual(['query', 'db_name'])
+    expect(fn.isExported).toBe(true) // top-level in Python = importable
+    expect(fn.isAsync).toBe(false)
+  })
+
+  it('A2: collects class method as ClassName.method with self stripped', () => {
+    const ast = parsePython(`
+class Database:
+    def execute(self, query, params=None):
+        pass
+`)
+    const functions = new Map<string, FunctionNode>()
+    collectFunctions(ast.tree.rootNode, functions)
+
+    expect(functions.has('Database.execute')).toBe(true)
+    const fn = functions.get('Database.execute')!
+    // self should be stripped
+    expect(fn.params).toEqual(['query', 'params'])
+  })
+
+  it('A3: collects decorated function', () => {
+    const ast = parsePython(`
+@app.route('/api')
+def handler(request):
+    pass
+`)
+    const functions = new Map<string, FunctionNode>()
+    collectFunctions(ast.tree.rootNode, functions)
+
+    expect(functions.has('handler')).toBe(true)
+    const fn = functions.get('handler')!
+    expect(fn.params).toEqual(['request'])
+    expect(fn.isExported).toBe(true)
+  })
+
+  it('A4: extracts typed and default params correctly', () => {
+    const ast = parsePython(`
+def process(data: str, limit: int = 10, flag=True):
+    pass
+`)
+    const functions = new Map<string, FunctionNode>()
+    collectFunctions(ast.tree.rootNode, functions)
+
+    expect(functions.has('process')).toBe(true)
+    const fn = functions.get('process')!
+    expect(fn.params).toEqual(['data', 'limit', 'flag'])
+  })
+
+  it('A5: collects *args and **kwargs', () => {
+    const ast = parsePython(`
+def flexible(*args, **kwargs):
+    pass
+`)
+    const functions = new Map<string, FunctionNode>()
+    collectFunctions(ast.tree.rootNode, functions)
+
+    expect(functions.has('flexible')).toBe(true)
+    const fn = functions.get('flexible')!
+    expect(fn.params).toEqual(['args', 'kwargs'])
+  })
+
+  it('A6: nested functions are not marked as exported', () => {
+    const ast = parsePython(`
+def outer():
+    def inner(x):
+        pass
+`)
+    const functions = new Map<string, FunctionNode>()
+    collectFunctions(ast.tree.rootNode, functions)
+
+    expect(functions.has('outer')).toBe(true)
+    expect(functions.get('outer')!.isExported).toBe(true)
+    expect(functions.has('inner')).toBe(true)
+    expect(functions.get('inner')!.isExported).toBe(false)
+  })
+
+  it('A7: strips cls from classmethod', () => {
+    const ast = parsePython(`
+class Repo:
+    @classmethod
+    def find(cls, query):
+        pass
+`)
+    const functions = new Map<string, FunctionNode>()
+    collectFunctions(ast.tree.rootNode, functions)
+
+    expect(functions.has('Repo.find')).toBe(true)
+    expect(functions.get('Repo.find')!.params).toEqual(['query'])
+  })
+})
+
+// ============================================================================
+// B: Import Resolution Tests
+// ============================================================================
+
+describe('Python Import Resolution', () => {
+  const files: ScanFile[] = [
+    makePyFile('app/routes.py', 'from .utils import query'),
+    makePyFile('app/utils.py', 'def query(sql): pass'),
+    makePyFile('app/db/__init__.py', 'from .engine import run'),
+    makePyFile('app/db/engine.py', 'def run(q): pass'),
+    makePyFile('utils.py', 'def helper(): pass'),
+  ]
+
+  it('B1: from .utils import query resolves to sibling file', () => {
+    const index = buildFileIndex(files)
+    const result = resolveImportPath('.utils', 'app/routes.py', index)
+    expect(result).not.toBeNull()
+    expect(result!.path).toBe('app/utils.py')
+  })
+
+  it('B2: from ..utils import helper resolves to parent dir', () => {
+    const index = buildFileIndex(files)
+    const result = resolveImportPath('..utils', 'app/db/engine.py', index)
+    expect(result).not.toBeNull()
+    expect(result!.path).toBe('app/utils.py')
+  })
+
+  it('B3: from utils import helper (same-dir for root) resolves', () => {
+    const allFiles = [
+      ...files,
+      makePyFile('main.py', 'from utils import helper'),
+    ]
+    const index = buildFileIndex(allFiles)
+    const result = resolveImportPath('utils', 'main.py', index)
+    expect(result).not.toBeNull()
+    expect(result!.path).toBe('utils.py')
+  })
+
+  it('B4: third-party import (flask) does NOT resolve', () => {
+    const index = buildFileIndex(files)
+    // flask is not in the file index — isPythonModulePath matches but no file found
+    const result = resolveImportPath('flask', 'app/routes.py', index)
+    expect(result).toBeNull()
+  })
+
+  it('B5: __init__.py package resolution', () => {
+    const index = buildFileIndex(files)
+    // 'app/db' should resolve to 'app/db/__init__.py' via the __init__.py indexing
+    const result = resolveImportPath('.db', 'app/routes.py', index)
+    expect(result).not.toBeNull()
+    expect(result!.path).toBe('app/db/__init__.py')
+  })
+})
+
+// ============================================================================
+// C: Cross-File Index Tests
+// ============================================================================
+
+describe('Python Cross-File Index', () => {
+  it('C1: buildCrossFileIndex populates functionDefs for Python', () => {
+    const files = [
+      makePyFile('db.py', `
+def run_query(sql):
+    cursor.execute(sql)
+`),
+      makePyFile('routes.py', `
+from db import run_query
+from flask import request
+
+def handler():
+    name = request.form['name']
+    run_query(name)
+`),
+    ]
+
+    const asts = parseFiles(files)
+    const moduleGraph = buildModuleGraph(files)
+    const index = buildCrossFileIndex(files, asts, moduleGraph)
+
+    // Function defs should include Python functions
+    expect(index.functionDefs.has('db.py:run_query')).toBe(true)
+    expect(index.functionDefs.get('db.py:run_query')!.params).toEqual(['sql'])
+  })
+
+  it('C2: resolveImport maps Python imports to definitions', () => {
+    const files = [
+      makePyFile('db.py', `
+def run_query(sql):
+    cursor.execute(sql)
+`),
+      makePyFile('routes.py', `
+from db import run_query
+`),
+    ]
+
+    const asts = parseFiles(files)
+    const moduleGraph = buildModuleGraph(files)
+    const index = buildCrossFileIndex(files, asts, moduleGraph)
+
+    // routes.py imports run_query from db.py
+    const resolved = index.resolveImport.get('routes.py:run_query')
+    expect(resolved).toBeDefined()
+    expect(resolved!.filePath).toBe('db.py')
+    expect(resolved!.functionName).toBe('run_query')
+  })
+})
+
+// ============================================================================
+// D: End-to-End Cross-File Taint Tests
+// ============================================================================
+
+describe('Python Cross-File Taint Flow', () => {
+  jest.setTimeout(30_000)
+
+  it('D1: Flask SQL injection across files (routes.py → db.py)', () => {
+    const files = [
+      makePyFile('routes.py', `
+from flask import request
+from db import run_query
+
+def handler():
+    name = request.form['name']
+    run_query(name)
+`),
+      makePyFile('db.py', `
+import sqlite3
+
+def run_query(sql):
+    conn = sqlite3.connect('app.db')
+    cursor = conn.cursor()
+    cursor.execute(sql)
+`),
+    ]
+
+    const asts = parseFiles(files)
+    const moduleGraph = buildModuleGraph(files)
+    const findings = analyzeTaintsForProject(files, asts, moduleGraph)
+
+    const sqlFindings = findings.filter(f =>
+      [...f.matchingKinds].includes('sql')
+    )
+    expect(sqlFindings.length).toBeGreaterThanOrEqual(1)
+  })
+
+  it('D2: Django command injection across files (views.py → utils.py)', () => {
+    const files = [
+      makePyFile('views.py', `
+def view(request):
+    cmd = request.POST['command']
+    execute_cmd(cmd)
+
+from utils import execute_cmd
+`),
+      makePyFile('utils.py', `
+import subprocess
+
+def execute_cmd(command):
+    subprocess.call(command, shell=True)
+`),
+    ]
+
+    const asts = parseFiles(files)
+    const moduleGraph = buildModuleGraph(files)
+    const findings = analyzeTaintsForProject(files, asts, moduleGraph)
+
+    const cmdFindings = findings.filter(f =>
+      [...f.matchingKinds].includes('command')
+    )
+    expect(cmdFindings.length).toBeGreaterThanOrEqual(1)
+  })
+
+  it('D3: sanitization in callee prevents finding (int() cast)', () => {
+    const files = [
+      makePyFile('routes.py', `
+from flask import request
+from db import safe_query
+
+def handler():
+    user_id = request.args.get('id')
+    safe_query(user_id)
+`),
+      makePyFile('db.py', `
+import sqlite3
+
+def safe_query(raw_id):
+    clean_id = int(raw_id)
+    conn = sqlite3.connect('app.db')
+    cursor = conn.cursor()
+    cursor.execute(f"SELECT * FROM users WHERE id = {clean_id}")
+`),
+    ]
+
+    const asts = parseFiles(files)
+    const moduleGraph = buildModuleGraph(files)
+    const findings = analyzeTaintsForProject(files, asts, moduleGraph)
+
+    const sqlFindings = findings.filter(f =>
+      [...f.matchingKinds].includes('sql')
+    )
+    // int() sanitizes all taint kinds — no finding expected
+    expect(sqlFindings.length).toBe(0)
+  })
+
+  it('D4: same-directory non-relative import resolves', () => {
+    const files = [
+      makePyFile('app/routes.py', `
+from flask import request
+from db import execute
+
+def handler():
+    data = request.form['data']
+    execute(data)
+`),
+      makePyFile('app/db.py', `
+import sqlite3
+
+def execute(query):
+    conn = sqlite3.connect('app.db')
+    cursor = conn.cursor()
+    cursor.execute(query)
+`),
+    ]
+
+    const asts = parseFiles(files)
+    const moduleGraph = buildModuleGraph(files)
+    const findings = analyzeTaintsForProject(files, asts, moduleGraph)
+
+    const sqlFindings = findings.filter(f =>
+      [...f.matchingKinds].includes('sql')
+    )
+    expect(sqlFindings.length).toBeGreaterThanOrEqual(1)
+  })
+
+  it('D5: SSRF across files (routes.py → fetcher.py)', () => {
+    const files = [
+      makePyFile('routes.py', `
+from flask import request
+from fetcher import fetch_url
+
+def proxy():
+    url = request.args.get('url')
+    fetch_url(url)
+`),
+      makePyFile('fetcher.py', `
+import requests
+
+def fetch_url(target):
+    requests.get(target)
+`),
+    ]
+
+    const asts = parseFiles(files)
+    const moduleGraph = buildModuleGraph(files)
+    const findings = analyzeTaintsForProject(files, asts, moduleGraph)
+
+    const ssrfFindings = findings.filter(f =>
+      [...f.matchingKinds].includes('ssrf')
+    )
+    expect(ssrfFindings.length).toBeGreaterThanOrEqual(1)
+  })
+
+  it('D6: class method with self stripped correctly', () => {
+    const files = [
+      makePyFile('routes.py', `
+from flask import request
+from db import Database
+
+def handler():
+    data = request.form['query']
+    db = Database()
+    db.execute(data)
+`),
+      makePyFile('db.py', `
+import sqlite3
+
+class Database:
+    def execute(self, query):
+        conn = sqlite3.connect('app.db')
+        cursor = conn.cursor()
+        cursor.execute(query)
+`),
+    ]
+
+    const asts = parseFiles(files)
+    const moduleGraph = buildModuleGraph(files)
+    const index = buildCrossFileIndex(files, asts, moduleGraph)
+
+    // Verify function def has self stripped
+    const dbExec = index.functionDefs.get('db.py:Database.execute')
+    expect(dbExec).toBeDefined()
+    expect(dbExec!.params).toEqual(['query'])
+  })
+
+  it('D7: clean code — no false positive with parameterized query', () => {
+    const files = [
+      makePyFile('routes.py', `
+from flask import request
+from db import safe_lookup
+
+def handler():
+    user_id = request.args.get('id')
+    clean_id = int(user_id)
+    safe_lookup(clean_id)
+`),
+      makePyFile('db.py', `
+import sqlite3
+
+def safe_lookup(user_id):
+    conn = sqlite3.connect('app.db')
+    cursor = conn.cursor()
+    cursor.execute("SELECT * FROM users WHERE id = ?", [user_id])
+`),
+    ]
+
+    const asts = parseFiles(files)
+    const moduleGraph = buildModuleGraph(files)
+    const findings = analyzeTaintsForProject(files, asts, moduleGraph)
+
+    // int() sanitizes taint in routes.py + parameterized query in db.py
+    const sqlFindings = findings.filter(f =>
+      [...f.matchingKinds].includes('sql')
+    )
+    expect(sqlFindings.length).toBe(0)
+  })
+
+  it('D8: relative import with dots resolves (from .db import query)', () => {
+    const files = [
+      makePyFile('app/routes.py', `
+from flask import request
+from .db import run_query
+
+def handler():
+    name = request.form['name']
+    run_query(name)
+`),
+      makePyFile('app/db.py', `
+import sqlite3
+
+def run_query(sql):
+    conn = sqlite3.connect('app.db')
+    cursor = conn.cursor()
+    cursor.execute(sql)
+`),
+    ]
+
+    const asts = parseFiles(files)
+    const moduleGraph = buildModuleGraph(files)
+    const findings = analyzeTaintsForProject(files, asts, moduleGraph)
+
+    const sqlFindings = findings.filter(f =>
+      [...f.matchingKinds].includes('sql')
+    )
+    expect(sqlFindings.length).toBeGreaterThanOrEqual(1)
+  })
+})