apisec-code-bolt 0.1.0__py3-none-any.whl

apisec_code_bolt/query/handlers.py

@@ -0,0 +1,832 @@
+"""
+Verification query handlers.
+
+Each handler answers one type of verification question by inspecting
+the project's source code through the ASTCache.  Handlers return
+structured answers (never raw source code) to maintain zero code egress.
+"""
+
+from __future__ import annotations
+
+import ast
+import contextlib
+import logging
+import re
+import signal
+from dataclasses import dataclass, field
+from typing import Any, Protocol
+
+from .ast_cache import ASTCache
+
+logger = logging.getLogger(__name__)
+
+_REGEX_TIMEOUT_SECONDS = 2
+
+
+def _safe_re_search(
+    pattern: str,
+    text: str,
+    flags: int = 0,
+) -> re.Match[str] | None:
+    """Run re.search with a timeout guard against catastrophic backtracking."""
+    try:
+        compiled = re.compile(pattern, flags)
+    except re.error:
+        logger.warning("Invalid regex pattern rejected: %s", pattern)
+        return None
+
+    def _timeout_handler(signum: int, frame: Any) -> None:
+        raise TimeoutError("Regex execution timed out")
+
+    old_handler = None
+    try:
+        old_handler = signal.signal(signal.SIGALRM, _timeout_handler)
+        signal.alarm(_REGEX_TIMEOUT_SECONDS)
+        result = compiled.search(text)
+        signal.alarm(0)
+        return result
+    except TimeoutError:
+        logger.warning("Regex timed out (possible ReDoS): %s", pattern[:100])
+        return None
+    except (ValueError, OSError):
+        return compiled.search(text)
+    finally:
+        signal.alarm(0)
+        if old_handler is not None:
+            with contextlib.suppress(ValueError, OSError):
+                signal.signal(signal.SIGALRM, old_handler)
+
+
+def _safe_re_finditer(
+    pattern: str,
+    text: str,
+    flags: int = 0,
+) -> list[re.Match[str]]:
+    """Run re.finditer with a timeout guard against catastrophic backtracking."""
+    try:
+        compiled = re.compile(pattern, flags)
+    except re.error:
+        logger.warning("Invalid regex pattern rejected: %s", pattern)
+        return []
+
+    def _timeout_handler(signum: int, frame: Any) -> None:
+        raise TimeoutError("Regex execution timed out")
+
+    old_handler = None
+    try:
+        old_handler = signal.signal(signal.SIGALRM, _timeout_handler)
+        signal.alarm(_REGEX_TIMEOUT_SECONDS)
+        results = list(compiled.finditer(text))
+        signal.alarm(0)
+        return results
+    except TimeoutError:
+        logger.warning("Regex timed out (possible ReDoS): %s", pattern[:100])
+        return []
+    except (ValueError, OSError):
+        return list(compiled.finditer(text))
+    finally:
+        signal.alarm(0)
+        if old_handler is not None:
+            with contextlib.suppress(ValueError, OSError):
+                signal.signal(signal.SIGALRM, old_handler)
+
+
+# ------------------------------------------------------------------
+# Shared types
+# ------------------------------------------------------------------
+
+
+@dataclass
+class QuestionInput:
+    """Normalized input for a handler, built from the cloud question."""
+
+    id: str
+    type: str
+    gate_id: str
+    finding_id: str
+    target_file: str | None = None
+    target_function: str | None = None
+    target_line: int | None = None
+    params: dict[str, Any] = field(default_factory=dict)
+
+
+@dataclass
+class AnswerOutput:
+    """Structured answer to return (no raw source code leaves the probe)."""
+
+    question_id: str
+    result: str  # found | not_found | partial | error | inconclusive
+    evidence: dict[str, Any] = field(default_factory=dict)
+    confidence: float = 1.0
+    details: str | None = None
+
+
+class Handler(Protocol):
+    def handle(
+        self,
+        question: QuestionInput,
+        cache: ASTCache,
+    ) -> AnswerOutput: ...
+
+
+# ------------------------------------------------------------------
+# Handler registry
+# ------------------------------------------------------------------
+
+
+_HANDLERS: dict[str, Handler] = {}
+
+
+def get_handler(question_type: str) -> Handler | None:
+    return _HANDLERS.get(question_type)
+
+
+def _register(qtype: str):
+    def decorator(cls):
+        _HANDLERS[qtype] = cls()
+        return cls
+
+    return decorator
+
+
+# ------------------------------------------------------------------
+# GUARD_CHECK
+# ------------------------------------------------------------------
+
+
+@_register("GUARD_CHECK")
+class GuardCheckHandler:
+    """Search for auth/validation guards protecting a function or call site."""
+
+    def handle(self, question: QuestionInput, cache: ASTCache) -> AnswerOutput:
+        guard_patterns: list[str] = question.params.get("guard_patterns", [])
+        if not guard_patterns:
+            return AnswerOutput(
+                question_id=question.id,
+                result="error",
+                details="No guard_patterns provided in question params",
+            )
+
+        target_file = question.target_file
+        target_function = question.target_function
+        if not target_file:
+            return AnswerOutput(
+                question_id=question.id,
+                result="error",
+                details="No target_file specified",
+            )
+
+        source = cache.get_source(target_file)
+        if source is None:
+            return AnswerOutput(
+                question_id=question.id,
+                result="error",
+                details=f"File not found: {target_file}",
+            )
+
+        fn_node = None
+        if target_function:
+            fn_node = cache.get_function_node(target_file, target_function)
+
+        matches: list[dict[str, Any]] = []
+
+        if fn_node:
+            matches.extend(self._check_decorators(fn_node, guard_patterns))
+            matches.extend(self._check_function_body(fn_node, source, guard_patterns))
+        else:
+            matches.extend(self._check_file_region(source, question.target_line, guard_patterns))
+
+        if not matches:
+            return AnswerOutput(
+                question_id=question.id,
+                result="not_found",
+                confidence=0.8,
+                details="No guard patterns found in target scope",
+            )
+
+        all_certain = all(m.get("certainty") == "definite" for m in matches)
+        return AnswerOutput(
+            question_id=question.id,
+            result="found" if all_certain else "partial",
+            evidence={"guards": matches},
+            confidence=0.9 if all_certain else 0.6,
+            details=f"Found {len(matches)} guard indicator(s)",
+        )
+
+    @staticmethod
+    def _check_decorators(
+        fn_node: ast.FunctionDef | ast.AsyncFunctionDef,
+        patterns: list[str],
+    ) -> list[dict[str, Any]]:
+        hits: list[dict[str, Any]] = []
+        for dec in fn_node.decorator_list:
+            dec_name = _decorator_name(dec)
+            if not dec_name:
+                continue
+            for pattern in patterns:
+                if _safe_re_search(pattern, dec_name, re.IGNORECASE):
+                    hits.append(
+                        {
+                            "type": "decorator",
+                            "name": dec_name,
+                            "line": dec.lineno,
+                            "pattern": pattern,
+                            "certainty": "definite",
+                        }
+                    )
+        return hits
+
+    @staticmethod
+    def _check_function_body(
+        fn_node: ast.FunctionDef | ast.AsyncFunctionDef,
+        source: str,
+        patterns: list[str],
+    ) -> list[dict[str, Any]]:
+        hits: list[dict[str, Any]] = []
+        lines = source.splitlines()
+        start = fn_node.lineno - 1
+        end = fn_node.end_lineno or fn_node.lineno
+        body_lines = lines[start:end]
+
+        for i, line in enumerate(body_lines, start=fn_node.lineno):
+            for pattern in patterns:
+                if _safe_re_search(pattern, line, re.IGNORECASE):
+                    hits.append(
+                        {
+                            "type": "code_reference",
+                            "line": i,
+                            "pattern": pattern,
+                            "certainty": "probable",
+                        }
+                    )
+                    break
+        return hits
+
+    @staticmethod
+    def _check_file_region(
+        source: str,
+        target_line: int | None,
+        patterns: list[str],
+    ) -> list[dict[str, Any]]:
+        hits: list[dict[str, Any]] = []
+        lines = source.splitlines()
+        center = (target_line or 1) - 1
+        window_start = max(0, center - 20)
+        window_end = min(len(lines), center + 20)
+
+        for i in range(window_start, window_end):
+            for pattern in patterns:
+                if _safe_re_search(pattern, lines[i], re.IGNORECASE):
+                    hits.append(
+                        {
+                            "type": "code_reference",
+                            "line": i + 1,
+                            "pattern": pattern,
+                            "certainty": "probable",
+                        }
+                    )
+                    break
+        return hits
+
+
+# ------------------------------------------------------------------
+# CODE_PATTERN
+# ------------------------------------------------------------------
+
+
+@_register("CODE_PATTERN")
+class CodePatternHandler:
+    """Run regex patterns against a file or region."""
+
+    def handle(self, question: QuestionInput, cache: ASTCache) -> AnswerOutput:
+        pattern = question.params.get("pattern") or question.params.get("check")
+        if not pattern:
+            return AnswerOutput(
+                question_id=question.id,
+                result="error",
+                details="No pattern specified",
+            )
+
+        target_file = question.target_file
+        if not target_file:
+            return AnswerOutput(
+                question_id=question.id,
+                result="error",
+                details="No target_file specified",
+            )
+
+        source = cache.get_source(target_file)
+        if source is None:
+            return AnswerOutput(
+                question_id=question.id,
+                result="error",
+                details=f"File not found: {target_file}",
+            )
+
+        if question.target_function:
+            fn_src = cache.get_function_source(target_file, question.target_function)
+            if fn_src:
+                source = fn_src
+
+        regex = _pattern_to_regex(pattern)
+        matches = _safe_re_finditer(regex, source, re.IGNORECASE | re.MULTILINE)
+
+        if not matches:
+            return AnswerOutput(
+                question_id=question.id,
+                result="not_found",
+                confidence=0.9,
+                details=f"Pattern '{pattern}' not found",
+            )
+
+        hit_lines = []
+        source.splitlines()
+        for m in matches[:10]:
+            line_no = source[: m.start()].count("\n") + 1
+            hit_lines.append({"line": line_no, "matched_text_length": len(m.group())})
+
+        return AnswerOutput(
+            question_id=question.id,
+            result="found",
+            evidence={"match_count": len(matches), "hits": hit_lines},
+            confidence=0.9,
+            details=f"Pattern matched {len(matches)} time(s)",
+        )
+
+
+# ------------------------------------------------------------------
+# CALL_PATH
+# ------------------------------------------------------------------
+
+
+@_register("CALL_PATH")
+class CallPathHandler:
+    """Check if function A transitively calls function B via AST analysis."""
+
+    def handle(self, question: QuestionInput, cache: ASTCache) -> AnswerOutput:
+        source_fn = question.params.get("source_function")
+        target_fn = question.params.get("target_function") or question.target_function
+        if not source_fn or not target_fn:
+            return AnswerOutput(
+                question_id=question.id,
+                result="error",
+                details="source_function and target_function required",
+            )
+
+        target_file = question.target_file
+        if not target_file:
+            return AnswerOutput(
+                question_id=question.id,
+                result="error",
+                details="No target_file specified",
+            )
+
+        tree = cache.get_ast(target_file)
+        if tree is None:
+            return AnswerOutput(
+                question_id=question.id,
+                result="error",
+                details=f"Cannot parse {target_file}",
+            )
+
+        calls_map = _build_local_call_map(tree)
+        path = _find_call_path(calls_map, source_fn, target_fn, max_depth=10)
+
+        if path:
+            has_dynamic = any(calls_map.get(fn, {}).get("has_dynamic", False) for fn in path)
+            result = "partial" if has_dynamic else "found"
+            return AnswerOutput(
+                question_id=question.id,
+                result=result,
+                evidence={"path": path, "has_dynamic_dispatch": has_dynamic},
+                confidence=0.7 if has_dynamic else 0.9,
+                details=f"Call path: {' -> '.join(path)}",
+            )
+
+        return AnswerOutput(
+            question_id=question.id,
+            result="not_found",
+            confidence=0.7,
+            details=f"No call path from {source_fn} to {target_fn} within file",
+        )
+
+
+# ------------------------------------------------------------------
+# CONTEXT
+# ------------------------------------------------------------------
+
+
+@_register("CONTEXT")
+class ContextHandler:
+    """Extract structured metadata about a function (zero code egress)."""
+
+    def handle(self, question: QuestionInput, cache: ASTCache) -> AnswerOutput:
+        target_file = question.target_file
+        target_function = question.target_function
+        if not target_file or not target_function:
+            return AnswerOutput(
+                question_id=question.id,
+                result="error",
+                details="target_file and target_function required",
+            )
+
+        fn_node = cache.get_function_node(target_file, target_function)
+        if fn_node is None:
+            return AnswerOutput(
+                question_id=question.id,
+                result="not_found",
+                details=f"Function {target_function} not found in {target_file}",
+            )
+
+        decorators = [_decorator_name(d) for d in fn_node.decorator_list]
+        params = [
+            {"name": a.arg, "annotation": _annotation_str(a.annotation)} for a in fn_node.args.args
+        ]
+        return_type = _annotation_str(fn_node.returns)
+
+        called_functions: list[str] = []
+        assignments: list[dict[str, str]] = []
+        control_flow: list[str] = []
+        has_try_except = False
+
+        for node in ast.walk(fn_node):
+            if isinstance(node, ast.Call):
+                name = _call_name(node)
+                if name:
+                    called_functions.append(name)
+            elif isinstance(node, ast.Assign):
+                for target in node.targets:
+                    if isinstance(target, ast.Name):
+                        assignments.append({"name": target.id, "line": node.lineno})
+            elif isinstance(node, ast.If):
+                control_flow.append(f"if@L{node.lineno}")
+            elif isinstance(node, ast.For):
+                control_flow.append(f"for@L{node.lineno}")
+            elif isinstance(node, ast.While):
+                control_flow.append(f"while@L{node.lineno}")
+            elif isinstance(node, ast.Try):
+                has_try_except = True
+
+        return AnswerOutput(
+            question_id=question.id,
+            result="found",
+            evidence={
+                "function_name": target_function,
+                "file": target_file,
+                "line_start": fn_node.lineno,
+                "line_end": fn_node.end_lineno,
+                "decorators": [d for d in decorators if d],
+                "parameters": params,
+                "return_type": return_type,
+                "called_functions": list(dict.fromkeys(called_functions)),
+                "assignments": assignments[:20],
+                "control_flow": control_flow,
+                "has_try_except": has_try_except,
+                "is_async": isinstance(fn_node, ast.AsyncFunctionDef),
+            },
+            confidence=1.0,
+            details=f"Context for {target_function}: {len(called_functions)} calls, {len(params)} params",
+        )
+
+
+# ------------------------------------------------------------------
+# DATA_FLOW
+# ------------------------------------------------------------------
+
+
+@_register("DATA_FLOW")
+class DataFlowHandler:
+    """Trace data flow from a sink backward to find sources."""
+
+    def handle(self, question: QuestionInput, cache: ASTCache) -> AnswerOutput:
+        target_file = question.target_file
+        sink_name = question.params.get("sink_function") or question.target_function
+        if not target_file or not sink_name:
+            return AnswerOutput(
+                question_id=question.id,
+                result="error",
+                details="target_file and sink_function required",
+            )
+
+        tree = cache.get_ast(target_file)
+        if tree is None:
+            return AnswerOutput(
+                question_id=question.id,
+                result="error",
+                details=f"Cannot parse {target_file}",
+            )
+
+        sink_calls = _find_calls_to(tree, sink_name)
+        if not sink_calls:
+            return AnswerOutput(
+                question_id=question.id,
+                result="not_found",
+                confidence=0.8,
+                details=f"No calls to {sink_name} found in {target_file}",
+            )
+
+        traces: list[dict[str, Any]] = []
+        for call_node in sink_calls:
+            args = _extract_call_args(call_node)
+            for arg in args:
+                origin = _trace_backward(tree, arg["name"], call_node.lineno)
+                traces.append(
+                    {
+                        "sink": sink_name,
+                        "sink_line": call_node.lineno,
+                        "argument": arg["name"],
+                        "argument_position": arg["position"],
+                        "origin": origin,
+                    }
+                )
+
+        if not traces:
+            return AnswerOutput(
+                question_id=question.id,
+                result="not_found",
+                confidence=0.7,
+                details="Calls found but no traceable arguments",
+            )
+
+        user_controlled = any(t["origin"].get("is_parameter", False) for t in traces)
+
+        return AnswerOutput(
+            question_id=question.id,
+            result="found" if user_controlled else "partial",
+            evidence={
+                "traces": traces[:10],
+                "user_controlled_input": user_controlled,
+            },
+            confidence=0.7 if user_controlled else 0.5,
+            details=f"Traced {len(traces)} argument(s) to {sink_name}",
+        )
+
+
+# ------------------------------------------------------------------
+# TYPE_INFO
+# ------------------------------------------------------------------
+
+
+@_register("TYPE_INFO")
+class TypeInfoHandler:
+    """Infer the type of a variable from annotations and assignments."""
+
+    def handle(self, question: QuestionInput, cache: ASTCache) -> AnswerOutput:
+        target_file = question.target_file
+        variable = question.params.get("variable")
+        scope_function = question.params.get("scope_function") or question.target_function
+        if not target_file or not variable:
+            return AnswerOutput(
+                question_id=question.id,
+                result="error",
+                details="target_file and variable required",
+            )
+
+        tree = cache.get_ast(target_file)
+        if tree is None:
+            return AnswerOutput(
+                question_id=question.id,
+                result="error",
+                details=f"Cannot parse {target_file}",
+            )
+
+        scope_node: ast.AST = tree
+        if scope_function:
+            fn = cache.get_function_node(target_file, scope_function)
+            if fn:
+                scope_node = fn
+
+        annotation = self._find_annotation(scope_node, variable)
+        assignment_type = self._infer_from_assignment(scope_node, variable)
+
+        if annotation:
+            return AnswerOutput(
+                question_id=question.id,
+                result="found",
+                evidence={
+                    "variable": variable,
+                    "annotation": annotation,
+                    "inferred_from": "type_annotation",
+                },
+                confidence=0.95,
+                details=f"{variable}: {annotation}",
+            )
+
+        if assignment_type:
+            return AnswerOutput(
+                question_id=question.id,
+                result="found",
+                evidence={
+                    "variable": variable,
+                    "inferred_type": assignment_type,
+                    "inferred_from": "assignment",
+                },
+                confidence=0.6,
+                details=f"{variable} inferred as {assignment_type}",
+            )
+
+        return AnswerOutput(
+            question_id=question.id,
+            result="not_found",
+            confidence=0.5,
+            details=f"Cannot determine type of {variable}",
+        )
+
+    @staticmethod
+    def _find_annotation(scope: ast.AST, variable: str) -> str | None:
+        for node in ast.walk(scope):
+            if isinstance(node, ast.AnnAssign) and isinstance(node.target, ast.Name):
+                if node.target.id == variable:
+                    return _annotation_str(node.annotation)
+
+            if isinstance(node, (ast.FunctionDef, ast.AsyncFunctionDef)):
+                for arg in node.args.args:
+                    if arg.arg == variable and arg.annotation:
+                        return _annotation_str(arg.annotation)
+
+                if node.returns and variable == "return":
+                    return _annotation_str(node.returns)
+        return None
+
+    @staticmethod
+    def _infer_from_assignment(scope: ast.AST, variable: str) -> str | None:
+        for node in ast.walk(scope):
+            if isinstance(node, ast.Assign):
+                for target in node.targets:
+                    if isinstance(target, ast.Name) and target.id == variable:
+                        return _infer_value_type(node.value)
+        return None
+
+
+# ------------------------------------------------------------------
+# AST helpers (shared across handlers)
+# ------------------------------------------------------------------
+
+
+def _decorator_name(node: ast.expr) -> str | None:
+    if isinstance(node, ast.Name):
+        return node.id
+    if isinstance(node, ast.Attribute):
+        return (
+            f"{_decorator_name(node.value)}.{node.attr}"
+            if isinstance(node.value, (ast.Name, ast.Attribute))
+            else node.attr
+        )
+    if isinstance(node, ast.Call):
+        return _decorator_name(node.func)
+    return None
+
+
+def _annotation_str(node: ast.expr | None) -> str | None:
+    if node is None:
+        return None
+    return ast.unparse(node)
+
+
+def _call_name(node: ast.Call) -> str | None:
+    if isinstance(node.func, ast.Name):
+        return node.func.id
+    if isinstance(node.func, ast.Attribute):
+        return node.func.attr
+    return None
+
+
+def _build_local_call_map(tree: ast.Module) -> dict[str, dict[str, Any]]:
+    """Build a map of function_name -> {calls: [names], has_dynamic: bool}."""
+    result: dict[str, dict[str, Any]] = {}
+    for node in ast.walk(tree):
+        if isinstance(node, (ast.FunctionDef, ast.AsyncFunctionDef)):
+            calls: list[str] = []
+            has_dynamic = False
+            for child in ast.walk(node):
+                if isinstance(child, ast.Call):
+                    name = _call_name(child)
+                    if name:
+                        calls.append(name)
+                    else:
+                        has_dynamic = True
+            result[node.name] = {"calls": calls, "has_dynamic": has_dynamic}
+    return result
+
+
+def _find_call_path(
+    calls_map: dict[str, dict[str, Any]],
+    source: str,
+    target: str,
+    max_depth: int = 10,
+) -> list[str] | None:
+    """BFS through the local call map."""
+    if source not in calls_map:
+        return None
+
+    from collections import deque
+
+    queue: deque[list[str]] = deque([[source]])
+    visited: set[str] = {source}
+
+    while queue:
+        path = queue.popleft()
+        if len(path) > max_depth:
+            continue
+        current = path[-1]
+        for callee in calls_map.get(current, {}).get("calls", []):
+            if callee == target:
+                return path + [callee]
+            if callee not in visited and callee in calls_map:
+                visited.add(callee)
+                queue.append(path + [callee])
+    return None
+
+
+def _find_calls_to(tree: ast.Module, func_name: str) -> list[ast.Call]:
+    """Find all Call nodes that call the given function (by short name)."""
+    results = []
+    short_name = func_name.split(".")[-1]
+    for node in ast.walk(tree):
+        if isinstance(node, ast.Call):
+            name = _call_name(node)
+            if name and (name in (short_name, func_name)):
+                results.append(node)
+    return results
+
+
+def _extract_call_args(call: ast.Call) -> list[dict[str, Any]]:
+    """Extract argument names/positions from a Call node."""
+    args: list[dict[str, Any]] = []
+    for i, arg in enumerate(call.args):
+        if isinstance(arg, ast.Name):
+            args.append({"name": arg.id, "position": i})
+        elif isinstance(arg, ast.Attribute):
+            args.append({"name": ast.unparse(arg), "position": i})
+    for kw in call.keywords:
+        if kw.arg and isinstance(kw.value, ast.Name):
+            args.append({"name": kw.value.id, "position": kw.arg})
+    return args
+
+
+def _trace_backward(
+    tree: ast.Module,
+    variable: str,
+    before_line: int,
+) -> dict[str, Any]:
+    """Trace a variable backward to find its origin."""
+    for node in ast.walk(tree):
+        if isinstance(node, (ast.FunctionDef, ast.AsyncFunctionDef)):
+            for arg in node.args.args:
+                if arg.arg == variable:
+                    return {
+                        "type": "function_parameter",
+                        "name": variable,
+                        "is_parameter": True,
+                        "line": node.lineno,
+                    }
+
+    assignments: list[ast.Assign] = []
+    for node in ast.walk(tree):
+        if isinstance(node, ast.Assign) and node.lineno < before_line:
+            for target in node.targets:
+                if isinstance(target, ast.Name) and target.id == variable:
+                    assignments.append(node)
+
+    if assignments:
+        last = assignments[-1]
+        return {
+            "type": "assignment",
+            "name": variable,
+            "is_parameter": False,
+            "line": last.lineno,
+            "value_type": _infer_value_type(last.value),
+        }
+
+    return {"type": "unknown", "name": variable, "is_parameter": False}
+
+
+def _infer_value_type(node: ast.expr) -> str:
+    if isinstance(node, ast.Constant):
+        return type(node.value).__name__
+    if isinstance(node, ast.Call):
+        name = _call_name(node)
+        return f"call:{name}" if name else "call:unknown"
+    if isinstance(node, ast.List):
+        return "list"
+    if isinstance(node, ast.Dict):
+        return "dict"
+    if isinstance(node, ast.Set):
+        return "set"
+    if isinstance(node, ast.Tuple):
+        return "tuple"
+    if isinstance(node, ast.Name):
+        return f"ref:{node.id}"
+    return "unknown"
+
+
+def _pattern_to_regex(pattern: str) -> str:
+    """Convert a check name or raw regex to a proper regex.
+
+    Known check names are expanded; everything else is used as-is.
+    """
+    known = {
+        "sql_parameterized": r"(%s|\?|:\w+|\$\d+)",
+        "orm_query_builder": r"\.(filter|where|select|join|group_by|order_by)\s*\(",
+    }
+    return known.get(pattern, pattern)