apisec-code-bolt 0.1.0__py3-none-any.whl

apisec_code_bolt/analysis/hof_catalog.py

@@ -0,0 +1,61 @@
+"""
+Catalog of higher-order functions for taint propagation through callbacks.
+
+When we see map(f, data) and data is tainted, the callback f receives
+tainted elements. This module defines known HOFs and their data/callback
+argument positions.
+"""
+
+from __future__ import annotations
+
+# (module, name) -> (callback_arg_index, data_arg_index)
+# callback_arg_index: which argument is the callable (0-based)
+# data_arg_index: which argument carries the iterable data (0-based)
+# When data at data_arg_index is tainted, callback receives tainted elements
+HOF_PATTERNS: dict[tuple[str, str], tuple[int, int]] = {
+    # map(function, iterable, ...)
+    ("builtins", "map"): (0, 1),
+    # filter(function, iterable)
+    ("builtins", "filter"): (0, 1),
+    # sorted(iterable, key=function, ...) - key receives elements
+    ("builtins", "sorted"): (1, 0),
+    # max/min(iterable, key=function)
+    ("builtins", "max"): (1, 0),
+    ("builtins", "min"): (1, 0),
+    # functools.reduce(function, iterable, ...)
+    ("functools", "reduce"): (0, 1),
+    # any(iterable) - not a HOF but receives iterable
+    # all(iterable) - same
+    # For map/filter the callback is first arg, data is second
+}
+
+
+def get_hof_data_position(callee: str) -> int | None:
+    """
+    Get the argument index for the data/iterable in a known HOF.
+
+    Returns None if not a known HOF.
+    """
+    parts = callee.rsplit(".", 1)
+    if len(parts) == 2:
+        module, name = parts
+    else:
+        module = "builtins"
+        name = parts[0]
+    return HOF_PATTERNS.get((module, name), (None, None))[1]
+
+
+def get_hof_callback_position(callee: str) -> int | None:
+    """Get the argument index for the callback in a known HOF."""
+    parts = callee.rsplit(".", 1)
+    if len(parts) == 2:
+        module, name = parts
+    else:
+        module = "builtins"
+        name = parts[0]
+    return HOF_PATTERNS.get((module, name), (None, None))[0]
+
+
+def is_known_hof(callee: str) -> bool:
+    """Check if callee is a known higher-order function."""
+    return get_hof_data_position(callee) is not None