cobraphp 0.1.0.dev1__py3-none-any.whl

cobraphp/analysis/rules/user_input_taint.yaml

@@ -0,0 +1,186 @@
+rules:
+  - id: user-input-pollution-reachability
+    message: "User input pollution reachability analysis"
+    severity: WARNING
+    languages: [php]
+    mode: taint
+    pattern-sources: &user_input_sources
+      # ── PHP superglobals ──
+      - pattern: $_GET[...]
+      - pattern: $_POST[...]
+      - pattern: $_REQUEST[...]
+      - pattern: $_COOKIE[...]
+      - pattern: $_SESSION[...]
+      - pattern: $_SERVER[...]
+      - pattern: $_ENV[...]
+      - pattern: $_FILES[...]
+      - pattern: $_GET
+      - pattern: $_POST
+      - pattern: $_REQUEST
+      - pattern: $_COOKIE
+      - pattern: $_SESSION
+      # ── Standard PHP input ──
+      - pattern: file_get_contents("php://input")
+      # ── CodeIgniter input ──
+      - pattern: $this->input->post(...)
+      - pattern: $this->input->get(...)
+      - pattern: $this->input->get_post(...)
+      - pattern: $this->input->cookie(...)
+      - pattern: $this->input->server(...)
+      - pattern: $this->input->input_stream(...)
+      # ── Laravel request ──
+      - pattern: $request->input(...)
+      - pattern: $request->get(...)
+      - pattern: $request->post(...)
+      - pattern: $request->query(...)
+      - pattern: $request->all()
+      - pattern: $request->only(...)
+      - pattern: $request->except(...)
+      - pattern: $request->cookie(...)
+      - pattern: $request->file(...)
+      - pattern: $request->validated(...)
+      - pattern: $request->safe(...)
+      - pattern: $request->integer(...)
+      - pattern: $request->boolean(...)
+      - pattern: $request->string(...)
+      - pattern: $request->float(...)
+      - pattern: $request->date(...)
+      - pattern: $request->enum(...)
+      - pattern: request()->input(...)
+      - pattern: request()->get(...)
+      - pattern: request($KEY)
+      # ── WordPress input ──
+      - pattern: get_query_var(...)
+      - pattern: $wp_query->get(...)
+      # ── Yii2 request ──
+      - pattern: Yii::$app->request->post(...)
+      - pattern: Yii::$app->request->get(...)
+      - pattern: Yii::$app->request->getBodyParam(...)
+      - pattern: Yii::$app->request->getBodyParams()
+      - pattern: Yii::$app->request->getQueryParam(...)
+      - pattern: Yii::$app->request->getQueryParams()
+      - pattern: $this->request->post(...)
+      - pattern: $this->request->get(...)
+      - pattern: $this->request->getBodyParam(...)
+      - pattern: $this->request->getQueryParam(...)
+      # ── Yii1 request ──
+      - pattern: Yii::app()->request->getParam(...)
+      - pattern: Yii::app()->request->getPost(...)
+      - pattern: Yii::app()->request->getQuery(...)
+      # ── Symfony HttpFoundation ──
+      - pattern: $request->request->get(...)
+      - pattern: $request->request->all()
+      - pattern: $request->query->get(...)
+      - pattern: $request->query->all()
+      - pattern: $request->cookies->get(...)
+      - pattern: $request->attributes->get(...)
+      - pattern: $request->headers->get(...)
+      - pattern: $request->files->get(...)
+      - pattern: $request->getContent()
+      # ── PSR-7 (Slim, Symfony bridge, Mezzio) ──
+      - pattern: $request->getParsedBody()
+      - pattern: $request->getQueryParams()
+      - pattern: $request->getAttribute(...)
+      - pattern: $request->getUploadedFiles()
+      # ── CakePHP request ──
+      - pattern: $this->request->getData(...)
+      - pattern: $this->request->getQuery(...)
+      - pattern: $this->request->getParam(...)
+      - pattern: $this->request->getCookie(...)
+      # ── Magento ──
+      - pattern: $this->getRequest()->getParam(...)
+      - pattern: $this->getRequest()->getParams()
+      - pattern: $this->getRequest()->getPost(...)
+      - pattern: $this->getRequest()->getPostValue(...)
+      - pattern: $this->getRequest()->getQuery(...)
+      - pattern: $request->getParam(...)
+      - pattern: $request->getPost(...)
+      # ── OpenCart (array access on request object) ──
+      - pattern: $this->request->post[...]
+      - pattern: $this->request->get[...]
+      - pattern: $this->request->request[...]
+      - pattern: $this->request->cookie[...]
+      - pattern: $this->request->files[...]
+      - pattern: $this->request->server[...]
+    pattern-propagators: &user_input_propagators
+      # Yii2 / Eloquent massive assignment: tainted source array flows into
+      # the model instance, tainting every later property read on it.
+      - pattern: $OBJ->load($FROM, ...)
+        from: $FROM
+        to: $OBJ
+      - pattern: $OBJ->setAttributes($FROM, ...)
+        from: $FROM
+        to: $OBJ
+      - pattern: $OBJ->fill($FROM, ...)
+        from: $FROM
+        to: $OBJ
+      # Laravel Eloquent in-place mass update: $model->update($request->all())
+      - pattern: $OBJ->update($FROM, ...)
+        from: $FROM
+        to: $OBJ
+    pattern-sinks:
+      - pattern: return $X;
+        exact: false
+      - pattern: echo $X;
+        exact: false
+      - pattern: print $X;
+        exact: false
+      - pattern: $X = $Y;
+        exact: false
+
+  - id: user-input-call-argument-reachability
+    message: "User input reaches a call argument"
+    severity: WARNING
+    languages: [php]
+    mode: taint
+    metadata:
+      seed_from_source_trace: true
+    pattern-sources:
+      - pattern-either: *user_input_sources
+      - &typed_request_property
+        patterns:
+          - pattern-either:
+              - patterns:
+                  - pattern: $REQ->$FIELD
+                  - metavariable-type:
+                      metavariable: $REQ
+                      type: Illuminate\Http\Request
+              - patterns:
+                  - pattern: $REQ->$FIELD
+                  - metavariable-type:
+                      metavariable: $REQ
+                      type: \Illuminate\Http\Request
+          - metavariable-regex:
+              metavariable: $FIELD
+              regex: '^[A-Za-z_][A-Za-z0-9_]*$'
+          - pattern-not-inside: $REQ->$FIELD(...)
+          - pattern-not-inside: |
+              function $FUNC(...) { ... $REQ = $VALUE; ... }
+          - pattern-not-inside: |
+              function $FUNC(...) { ... $ALIAS =& $REQ; ... }
+          - pattern-not-inside: |
+              function $FUNC(...) { ... $CALL(..., $REQ, ...); ... }
+        exact: true
+    pattern-propagators: *user_input_propagators
+    pattern-sinks:
+      - patterns:
+          - pattern: $FUNCTION(..., $ARG, ...)
+          - focus-metavariable: $ARG
+        exact: false
+      - patterns:
+          - pattern: $OBJECT->$METHOD(..., $ARG, ...)
+          - focus-metavariable: $ARG
+        exact: false
+      - patterns:
+          - pattern: $CLASS::$METHOD(..., $ARG, ...)
+          - focus-metavariable: $ARG
+        exact: false
+      - patterns:
+          - pattern: $OBJECT?->$METHOD(..., $ARG, ...)
+          - focus-metavariable: $ARG
+        exact: false
+      - patterns:
+          - pattern: new $CLASS(..., $ARG, ...)
+          - focus-metavariable: $ARG
+        exact: false
+      - *typed_request_property

cobraphp/config.py

@@ -0,0 +1,50 @@
+"""Analysis configuration: one flat, immutable `AnalysisConfig` (docs/design.md, Configuration)."""
+
+from dataclasses import dataclass, field
+from enum import Enum
+from pathlib import Path
+
+DEFAULT_MAX_CONCURRENT_FILES = 4
+DEFAULT_CONTEXT_DEPTH = 2
+# Provisional in the Kotlin library (`AnalysisSettings.kt`).
+DEFAULT_CANDIDATE_SET_BOUND = 3
+DEFAULT_EXTRA_PATHS_PER_SINK = 1
+
+
+class TargetFileSystem(Enum):
+    """How an include finds a file whose name differs in case."""
+
+    CASE_SENSITIVE = "CASE_SENSITIVE"
+    CASE_INSENSITIVE = "CASE_INSENSITIVE"
+
+
+class StorageImplementation(Enum):
+    """The construction-time storage choice; report semantics do not change."""
+
+    INTEGRATED = "INTEGRATED"
+    CAPABILITIES = "CAPABILITIES"
+
+
+@dataclass(frozen=True, slots=True, kw_only=True)
+class AnalysisConfig:
+    """Configuration of `analyze_project` and `build_project`.
+
+    Fields marked `build` are read when the project is built; fields marked `analyze` are read by each analysis.
+    Replace fields with `dataclasses.replace(config, context_depth=3)`.
+    """
+
+    # build
+    document_sets: tuple[Path, ...] = ()
+    libraries: tuple[str, ...] = ()
+    should_skip_unparsable_files: bool = True
+    php_executable: Path | None = None
+    storage_implementation: StorageImplementation = StorageImplementation.INTEGRATED
+    max_concurrent_files: int = DEFAULT_MAX_CONCURRENT_FILES
+    target_file_system: TargetFileSystem = TargetFileSystem.CASE_SENSITIVE
+    context_depth: int = DEFAULT_CONTEXT_DEPTH
+    candidate_set_bound: int = DEFAULT_CANDIDATE_SET_BOUND
+    should_call_zend_error: bool = False
+    should_fail_fast: bool = False
+    # analyze; `None` means the same as `context_depth`
+    off_path_depth_limit: int | None = None
+    extra_paths_per_sink: int = field(default=DEFAULT_EXTRA_PATHS_PER_SINK)

cobraphp/entries.py

@@ -0,0 +1,39 @@
+"""The entry functions; each blocks until its task ends. Names follow the Kotlin entries in snake case."""
+
+from collections.abc import Sequence
+from pathlib import Path
+
+from cobraphp._placeholder import not_implemented
+from cobraphp.config import AnalysisConfig
+from cobraphp.project import BuiltProject
+from cobraphp.results import DiffReport, Output, ValidationReport
+
+
+def analyze_project(project_dir: Path, config: AnalysisConfig | None = None) -> list[Output]:
+    """Parse, interpret and analyze a project, and release everything before returning.
+
+    `config=None` means `AnalysisConfig()`. Returns every `Finding` and `Unanalyzed`, ordered by file, line
+    (`None` first), output kind, then vulnerability type for findings or function and reason for unanalyzed parts.
+
+    Raises `ProjectNotFoundError`, `ParsingFailedError`, `DependencyUnavailableError`, `DocumentSetInvalidError`,
+    `ValueError` for a bad argument or setting, `RuntimeError` for an invariant breach.
+    """
+    not_implemented()
+
+
+def build_project(project_dir: Path, config: AnalysisConfig | None = None) -> BuiltProject:
+    """Build and freeze a project and return a handle the caller closes.
+
+    Raises what `analyze_project` raises before its analysis stage.
+    """
+    not_implemented()
+
+
+def validate_document_sets(document_sets: Sequence[Path]) -> ValidationReport:
+    """Verify Document Sets and report their problems and the Source kinds and Vulnerability types they use."""
+    not_implemented()
+
+
+def diff_results(before: Sequence[Output], after: Sequence[Output]) -> DiffReport:
+    """Compare the findings of two output lists, matched by `Finding.id`."""
+    not_implemented()

cobraphp/errors.py

@@ -0,0 +1,25 @@
+"""Errors of the public interface, one per Kotlin `*Exception` (see docs/design.md, Exception / Error Types)."""
+
+
+class CobraPhpError(Exception):
+    """Root of the run failures a caller can fix. Never raised directly; only its subclasses are."""
+
+
+class ProjectNotFoundError(CobraPhpError):
+    """The project directory does not exist."""
+
+
+class ParsingFailedError(CobraPhpError):
+    """A file failed to parse while `AnalysisConfig.should_skip_unparsable_files` is false."""
+
+
+class DependencyUnavailableError(CobraPhpError):
+    """A required external program, the PHP interpreter that runs the parser, is missing."""
+
+
+class GraphExportError(CobraPhpError):
+    """The export target of `BuiltProject.export_graphs` is invalid or not writable."""
+
+
+class DocumentSetInvalidError(CobraPhpError):
+    """A Document Set fails verification. It carries the `Diagnostic` list; the attribute name is undecided."""

cobraphp/graphs.py

@@ -0,0 +1,63 @@
+"""Graph access, provisional: plain-data view of the graph export file (docs/design.md, Graph Access).
+
+`BuiltProject.export_graphs` writes the export; `read_graph_export` reads it. Both are proposed, not decided.
+"""
+
+from collections.abc import Mapping
+from dataclasses import dataclass
+from pathlib import Path
+from typing import TypeAlias
+
+from cobraphp._placeholder import not_implemented
+
+JsonValue: TypeAlias = str | int | float | bool | None | list["JsonValue"] | dict[str, "JsonValue"]
+
+
+@dataclass(frozen=True, slots=True, kw_only=True)
+class GraphNode:
+    """One node record: `graph` is the graph name (AST, ADG, PDG or CCG); `state` and `path` occur on ADG nodes."""
+
+    id: str
+    graph: str
+    type: str
+    state: str | None
+    path: str | None
+    props: Mapping[str, JsonValue]
+
+
+@dataclass(frozen=True, slots=True, kw_only=True)
+class GraphEdge:
+    """One edge record; `labels` are the label ids of the contexts the edge is recorded under."""
+
+    source: str
+    target: str
+    type: str
+    labels: tuple[str, ...]
+    props: Mapping[str, JsonValue]
+
+
+@dataclass(frozen=True, slots=True, kw_only=True)
+class LabelOrder:
+    """One label-order record: the parent and name of a label id."""
+
+    label: str
+    parent: str
+    name: str
+
+
+@dataclass(frozen=True, slots=True, kw_only=True)
+class GraphExport:
+    """The content of one graph export file: header, nodes, edges and label-order records, in file order."""
+
+    header: Mapping[str, JsonValue]
+    nodes: tuple[GraphNode, ...]
+    edges: tuple[GraphEdge, ...]
+    label_order: tuple[LabelOrder, ...]
+
+
+def read_graph_export(export_file: Path) -> GraphExport:
+    """Read the file `BuiltProject.export_graphs` wrote.
+
+    Raises `ValueError` when the file is not a graph export.
+    """
+    not_implemented()

cobraphp/project.py

@@ -0,0 +1,49 @@
+"""The handle of a built project."""
+
+from pathlib import Path
+from types import TracebackType
+from typing import Self
+
+from cobraphp._placeholder import not_implemented
+from cobraphp.config import AnalysisConfig
+from cobraphp.results import Output
+
+
+class BuiltProject:
+    """A parsed and frozen project that stays open until `close`; use it as a context manager.
+
+    Concurrent `analyze` calls on one handle run one at a time.
+    """
+
+    def __init__(self, *, project_dir: Path, config: AnalysisConfig) -> None:
+        self.project_dir = project_dir
+        self.config = config
+
+    def analyze(self, config: AnalysisConfig | None = None) -> list[Output]:
+        """Analyze the project; `None` means `self.config`.
+
+        Raises `ValueError` naming the field when a `build` field of `config` differs from `self.config`.
+        """
+        not_implemented()
+
+    def export_graphs(self, output_file: Path) -> None:
+        """Write the graph export (provisional, see docs/design.md, Graph Access).
+
+        Raises `GraphExportError` when the target is invalid or not writable.
+        """
+        not_implemented()
+
+    def close(self) -> None:
+        """Release the project; a second call has no effect."""
+        not_implemented()
+
+    def __enter__(self) -> Self:
+        return self
+
+    def __exit__(
+        self,
+        exc_type: type[BaseException] | None,
+        exc_value: BaseException | None,
+        traceback: TracebackType | None,
+    ) -> None:
+        self.close()

cobraphp/results.py

@@ -0,0 +1,116 @@
+"""Result types: plain, immutable values (docs/design.md, Results)."""
+
+from dataclasses import dataclass
+from enum import Enum
+from pathlib import Path
+from typing import TypeAlias
+
+
+@dataclass(frozen=True, slots=True, kw_only=True)
+class Location:
+    """A project-relative file and an optional line; `line` is `None` when unknown."""
+
+    file: Path
+    line: int | None
+
+
+@dataclass(frozen=True, slots=True, kw_only=True)
+class TaintSource:
+    """A Taint source of a `Finding`."""
+
+    location: Location
+    subject: str
+    source_kinds: tuple[str, ...]
+
+
+@dataclass(frozen=True, slots=True, kw_only=True)
+class CallSite:
+    """A Call site and the name of its callee."""
+
+    location: Location
+    callee: str
+
+
+@dataclass(frozen=True, slots=True, kw_only=True)
+class VulnerableCallPath:
+    """A Vulnerable call path from an entry point to the Sink call site."""
+
+    id: str
+    entry_point: Path
+    call_sites: tuple[CallSite, ...]
+
+
+@dataclass(frozen=True, slots=True, kw_only=True)
+class Finding:
+    """A taint flow from a Taint source to a Sink without the required Sanitizer.
+
+    One `Finding` appears per sink call and Vulnerability type.
+    """
+
+    id: str
+    vulnerability_type: str
+    sink: CallSite
+    port: str
+    sources: tuple[TaintSource, ...]
+    sanitizers: tuple[CallSite, ...]
+    paths: tuple[VulnerableCallPath, ...]
+    slice_node_ids: tuple[str, ...]
+
+    @property
+    def file(self) -> Path:
+        """The file of the sink."""
+        return self.sink.location.file
+
+    @property
+    def line(self) -> int | None:
+        """The line of the sink, or `None`."""
+        return self.sink.location.line
+
+
+class UnanalyzedReason(Enum):
+    """Why a part of the project is Unanalyzed."""
+
+    PARSE_FAILURE = "parse failure"
+    INTERNAL_ERROR = "internal error"
+    TIME_LIMIT = "time limit expired"
+
+
+@dataclass(frozen=True, slots=True, kw_only=True)
+class Unanalyzed:
+    """A part of the project the analysis did not cover."""
+
+    file: Path
+    line: int | None
+    function: str | None
+    reason: UnanalyzedReason
+
+    def __str__(self) -> str:
+        """Render `file:line function(): reason`, omitting an absent line and function."""
+        head = f"{self.file}" if self.line is None else f"{self.file}:{self.line}"
+        name = "" if self.function is None else f" {self.function}()"
+        return f"{head}{name}: {self.reason.value}"
+
+
+Output: TypeAlias = Finding | Unanalyzed
+
+
+@dataclass(frozen=True, slots=True, kw_only=True)
+class Diagnostic:
+    """One problem of a Document Set. Its fields are undecided in the Kotlin design."""
+
+
+@dataclass(frozen=True, slots=True, kw_only=True)
+class ValidationReport:
+    """The result of `validate_document_sets`."""
+
+    problems: tuple[Diagnostic, ...]
+    source_kinds_used: tuple[str, ...]
+    vulnerability_types_used: tuple[str, ...]
+
+
+@dataclass(frozen=True, slots=True, kw_only=True)
+class DiffReport:
+    """Findings added and removed between two output lists, matched by `Finding.id`.
+
+    Its fields are undecided in the Kotlin design.
+    """

cobraphp-0.1.0.dev1.dist-info/METADATA

@@ -0,0 +1,105 @@
+Metadata-Version: 2.4
+Name: cobraphp
+Version: 0.1.0.dev1
+Summary: Placeholder for the Python interface of CobraPHP, a static taint analyzer for PHP projects, and a pure-Python static analysis over php-parser-py and Semgrep.
+License-Expression: GPL-2.0-only
+Requires-Python: >=3.11
+Description-Content-Type: text/markdown
+License-File: LICENSE
+Requires-Dist: cpg2py>=1.2.0
+Requires-Dist: php-parser-py>=2.0.3
+Requires-Dist: semgrep==1.85.0
+Requires-Dist: setuptools<82
+Dynamic: license-file
+
+# bindings-python-cobraphp
+
+Python interface of [CobraPHP](https://github.com/jhu-seclab-cobra/CobraPHP), the Cobra static taint analyzer for PHP web applications. The package `cobraphp` returns plain Python data: dataclasses, enums, `pathlib.Path` and built-in containers.
+
+## Status
+
+**Placeholder.** This package is a placeholder for the CobraPHP Python interface. The jar interface is not implemented, and `cobraphp.analysis` is an interim pure-Python implementation that the CobraPHP implementation will replace in a later version. Interfaces and results may change between versions.
+
+Two parts. The jar interface is declared only: its types, functions and errors are typed, and every entry raises `NotImplementedError` ("implementation waits for the CobraPHP jar"). The implementation will run the CobraPHP jar in the Python process through JPype; JPype is planned and not yet a dependency. The subpackage `cobraphp.analysis` is implemented: a pure-Python static analysis over [php-parser-py](https://pypi.org/project/php-parser-py/) and [Semgrep](https://semgrep.dev) that builds a call graph and Semgrep-seeded data flow from a parsed PHP project. The version is a pre-release, `0.1.0.dev1`. The name follows the pattern `bindings-<language>-<analyzer>`.
+
+## Install
+
+From a checkout, with [uv](https://docs.astral.sh/uv/):
+
+```
+uv sync
+```
+
+`uv sync` installs the package, its dependencies at the versions of `uv.lock` and the check tools. `cobraphp.analysis` runs the `semgrep` program, which the Semgrep dependency installs into the environment; it must be on `PATH`, for example by running commands through `uv run`. The subpackage's Semgrep run sends no version-check request.
+
+The planned release wheel will bundle the CobraPHP jar. Which Java runtime it uses is undecided ([open gaps](docs/design.md#open-gaps)). Python 3.11 or later.
+
+## Examples
+
+Analyze a project and read the result:
+
+```python
+from pathlib import Path
+from cobraphp import AnalysisConfig, Finding, Unanalyzed, analyze_project
+
+outputs = analyze_project(Path("/srv/project"), AnalysisConfig(context_depth=3))
+for output in outputs:
+    print(output)  # a Finding prints its dataclass; an Unanalyzed prints `file:line function(): reason`
+complete = not any(isinstance(o, Unanalyzed) for o in outputs)
+findings = [o for o in outputs if isinstance(o, Finding)]
+```
+
+Build once, analyze several times, and export the graphs:
+
+```python
+from dataclasses import replace
+from cobraphp import build_project
+
+with build_project(Path("/srv/project")) as built:
+    more = built.analyze(replace(built.config, extra_paths_per_sink=3))
+    built.export_graphs(Path("graphs.jsonl"))
+```
+
+Build the call graph and the data flow of a project with `cobraphp.analysis`:
+
+```python
+from pathlib import Path
+from php_parser_py import PHPVersion, parse_project
+from cobraphp.analysis import USER_INPUT, backward_slice, build_call_graph, build_data_flow, make_app_file_filter
+
+root = Path("/srv/project")
+ast = parse_project(str(root), target_php=PHPVersion(8, 5), file_filter=make_app_file_filter(root))
+calls = [e for e in build_call_graph(ast).edges if e.type == "CCG_SITE_CALL"]
+flow = build_data_flow(ast, timeout_seconds=600)
+for node_id in flow.tainted[USER_INPUT]:
+    print(node_id, backward_slice(flow, node_id, max_depth=3))
+```
+
+Handle a failure:
+
+```python
+from cobraphp import ProjectNotFoundError
+
+try:
+    analyze_project(Path("/missing"))
+except ProjectNotFoundError as error:
+    print(error)
+```
+
+## Design
+
+[docs/design.md](docs/design.md) states the types, functions, errors, lifecycle and open items. Companions: [mapping to Kotlin](docs/design-mapping.md), [backend boundary](docs/design-backend.md), [graph access](docs/design-graphs.md), [extension points](docs/design-extension.md), [query languages](docs/design-queries.md) and [analysis interface](docs/design-analysis-interface.md), the last four proposed, and [static analysis subpackage](docs/design-analysis-subpackage.md). The implementation plan is [docs/todo.md](docs/todo.md). Terms are those of the [glossary](docs/glossary.md).
+
+## Checks
+
+```
+python -m compileall src
+python -m pytest
+python -m mypy
+```
+
+Run them inside the environment, for example as `uv run python -m pytest`. The tests marked `integration` run the `semgrep` program; `python -m pytest -m "not integration"` skips them.
+
+## License
+
+GPL-2.0-only, the licence of CobraPHP; see [LICENSE](LICENSE).

cobraphp-0.1.0.dev1.dist-info/RECORD

@@ -0,0 +1,35 @@
+cobraphp/__init__.py,sha256=rDu9Dt2Wk7ounQRML_kEgd1q5alC_Dquc6QTCZDfdu4,1496
+cobraphp/_backend.py,sha256=2C5kx4EUJjlwP2YGd6sT50y7uOionEKIZS9DEOEAFBE,1851
+cobraphp/_placeholder.py,sha256=zdWzLNcbWG_B4iiU2vYm_S61zaV3pBuksort176S0R8,371
+cobraphp/config.py,sha256=kcZZq8wjkZuc4tpB401JD4TMtBtwpr9YsLQjhEC-_LI,1821
+cobraphp/entries.py,sha256=z4FAnYjwBL1Kgi9dv31KKmFf2nzP5157EWxtRrQ1jZk,1678
+cobraphp/errors.py,sha256=oNVyF0Ld5PwLBkpxmCj--CSw9xfg11m2y2tJkWN8wSY,912
+cobraphp/graphs.py,sha256=5f4ZbC4mouxlkeGTEhivDbhyK2ZwdO87KPWCnCnaXLI,1793
+cobraphp/project.py,sha256=LL4RhwIB-eInyIqD30Us948bDFizDZzK31YhgZOOug0,1497
+cobraphp/py.typed,sha256=47DEQpj8HBSa-_TImW-5JCeuQeRkm5NMpJWZG3hSuFU,0
+cobraphp/results.py,sha256=fc5CUVPZ__SDdKyxQ1UyQJt3FSM6yfzOfaBCGL1Wtss,3055
+cobraphp/analysis/__init__.py,sha256=Wzkrw6mkSHT3RjiyENA-r1lFNR0a3awu3ej8XTwJb1Q,2373
+cobraphp/analysis/_ast_types.py,sha256=4_7ga_CcAbRxLTKuXCn-Bhn7Elprnq13r561hxJTtSw,661
+cobraphp/analysis/_call_builder.py,sha256=TAQAxBSLwgrVzBFaU9QNLcDtHwbLNRSYg-kZlb3-ptw,6189
+cobraphp/analysis/_call_graph.py,sha256=nlo_8VCvc5JzVTrH7MMicbT49Rgwd-EuAewLrJoALx8,8081
+cobraphp/analysis/_call_graph_nodes.py,sha256=MuXtGdNe4iNals-0yPeLhykdxEr1JEjk1h_YypLLIaA,6205
+cobraphp/analysis/_callee_index.py,sha256=ieDh75i4Wqbi2eJ5aghUHhGqBINB2CXDS07qtUbepAk,5230
+cobraphp/analysis/_defuse_builder.py,sha256=2MZvzFqqGMYS4HRIEoC_wuXT3_tFDZnJ584tox0jJ5s,14662
+cobraphp/analysis/_errors.py,sha256=cn71QQpesqbkitJdkg9bMIcvXlPixRxol7CjOMZM0i0,531
+cobraphp/analysis/_file_filter.py,sha256=V5QY8iskS0wx7nyaqya_LWGRqkAorUTDWUdEEyUtpqU,6014
+cobraphp/analysis/_project_root.py,sha256=cuS_sOGZBqDp5H6HWn_xLaxAyVlsfxwADgc0MheC-fY,1050
+cobraphp/analysis/_records.py,sha256=GcafhC4iaJS2U-idCe5l3VM-AawBAMSmikiKAHaOQMA,5937
+cobraphp/analysis/_semgrep_runner.py,sha256=t8E9SVEgIw-yCiG5rOdAo-N2gHSd60vrE1WwwntTWfk,12452
+cobraphp/analysis/_source_kinds.py,sha256=0LH0kkSQ13c7Ys2kf4QhwuCpyKKC3rn6c9ZXadkr47Q,144
+cobraphp/analysis/_taint_graph.py,sha256=HXd_g-yuzItyWQ9pj_p1M91UHKpoLOBwlBPqmwbnUuQ,7661
+cobraphp/analysis/_taint_propagator.py,sha256=byfvZj1xdnngpf57rBS6esd3dTLqy6CZfusqOvZVx7I,10400
+cobraphp/analysis/_taint_rules.py,sha256=b77hFwh6zURdqfx6jWZwTbS24hE03t7wtlYEckgaO5I,4822
+cobraphp/analysis/frameworks.toml,sha256=MUGFYwMC6P7h-cj2_WUMGytYHWA9ZCTuGg_7LTkmy1k,1885
+cobraphp/analysis/php_ast_types.toml,sha256=fvh3SfjGm1IyJvRkBAhnOLnxCdT5ejowxDBRuOIxOcg,1032
+cobraphp/analysis/rules/database_taint.yaml,sha256=xCx64v2RjponPfEYZOQUqSqP_ltV8YB-t5NldjOstcI,3495
+cobraphp/analysis/rules/user_input_taint.yaml,sha256=47nknffSg_wIKGPg8Ya-r4POa4nWswopju2IEkcFvtc,6998
+cobraphp-0.1.0.dev1.dist-info/licenses/LICENSE,sha256=-cN1ob5KQfe3AwHdg8kcuJ5BVnR4hZt37vN1pS14JQU,18091
+cobraphp-0.1.0.dev1.dist-info/METADATA,sha256=8Cj5ahaqteGDm30ccpJbsX385XE6_0F8LFpH5Uo7Ndo,4910
+cobraphp-0.1.0.dev1.dist-info/WHEEL,sha256=mOdXR9C3wMVov7cSY8PY-XCzo3SmmWCHvGQr5csJoao,91
+cobraphp-0.1.0.dev1.dist-info/top_level.txt,sha256=55CayiaOZMnPngJQf8IqO50E-l0BQONI8DTpnn-gtJk,9
+cobraphp-0.1.0.dev1.dist-info/RECORD,,

cobraphp-0.1.0.dev1.dist-info/WHEEL

@@ -0,0 +1,5 @@
+Wheel-Version: 1.0
+Generator: setuptools (84.2.1)
+Root-Is-Purelib: true
+Tag: py3-none-any
+