codeanalyzer-python 1.5.2__py3-none-any.whl → 1.5.4__py3-none-any.whl

codeanalyzer/__main__.py

@@ -39,7 +39,7 @@ def _pin_hash_seed() -> None:
 from codeanalyzer.core import Codeanalyzer
 from codeanalyzer.utils import _set_log_level, logger
 from codeanalyzer.schema import model_dump, model_dump_json, strip_internal_only
-from codeanalyzer.options import AnalysisOptions, EmitTarget
+from codeanalyzer.options import ANALYSIS_JSON, AnalysisOptions, EmitTarget
 
 
 def _version_callback(value: bool) -> None:
@@ -402,7 +402,7 @@ def main(
 
 def _write_output(artifacts, output_dir: Path):
     """Write analysis.json (the single wire format since #118)."""
-    output_file = output_dir / "analysis.json"
+    output_file = output_dir / ANALYSIS_JSON
     # Use Pydantic's model_dump_json() for compact output
     # Strip internal-only fields here rather than with a field-level Pydantic
     # `exclude`: the analysis cache shares the serializer and must keep them.

codeanalyzer/artifacts/discovery.py

@@ -3,10 +3,11 @@ from __future__ import annotations
 import fnmatch
 import hashlib
 from pathlib import Path
-from typing import Dict, List, Tuple
+from typing import Dict, Iterable, List, Tuple
 
 from codeanalyzer.schema.ids import artifact_id
 from codeanalyzer.schema.py_schema import PyArtifact
+from codeanalyzer.utils import logger
 
 # (glob pattern against the repo-relative POSIX path, format, roles).
 # First match wins; patterns are checked in order.
@@ -67,6 +68,43 @@ _IGNORED_DIRS = {
 }
 
 
+def _resolve_exclusions(project_dir: Path, exclude_paths: Iterable[Path]) -> List[Path]:
+    """Resolve the paths a run writes to, dropping any that would take the whole
+    project with them (#207).
+
+    A *directory* exclusion at or above the project root would empty the
+    inventory, which is worse than the bug it guards against, so it is refused.
+    That case is still covered, because the caller also passes the individual
+    output *files* -- excluding ``<project>/analysis.json`` costs one file
+    instead of the entire tree.
+    """
+    root = project_dir.resolve()
+    kept = []
+    for given in exclude_paths:
+        resolved = given.resolve()
+        if root.is_relative_to(resolved):
+            logger.warning(
+                f"Not excluding {resolved} from artifact discovery: it holds the "
+                f"project itself. Only this run's own output files under it are "
+                f"skipped; anything else written there is ingested as an artifact."
+            )
+            continue
+        kept.append(resolved)
+    return kept
+
+
+def _is_excluded(path: Path, excluded: List[Path]) -> bool:
+    """True when ``path`` is, or sits inside, one of ``excluded`` (a file entry
+    matches only itself). Checked on the path as walked *and* on its resolved
+    form, so an output directory reached through a symlink is caught from either
+    side."""
+    if not excluded:
+        return False
+    if any(path.is_relative_to(directory) for directory in excluded):
+        return True
+    return any(path.resolve().is_relative_to(directory) for directory in excluded)
+
+
 def _classify(rel_posix: str) -> Tuple[str, List[str]] | None:
     name = rel_posix.rsplit("/", 1)[-1]
     for pattern, fmt, roles in RULES:
@@ -81,6 +119,7 @@ def discover_artifacts(
     app_name: str,
     *,
     capture_text: bool = True,
+    exclude_paths: Iterable[Path] = (),
 ) -> Dict[str, PyArtifact]:
     """Walk the project and return every file as an artifact, sorted by path.
 
@@ -93,15 +132,28 @@ def discover_artifacts(
     deliberate exception -- it IS rule-matched (a dependency-manifest), so it
     is captured like any other manifest despite the `.py` suffix.
 
+    ``exclude_paths`` names what this run writes -- the ``--output`` and cache
+    directories, and the output files inside them (#207). Without them a run
+    whose output lands inside the project ingests the previous run's whole
+    ``analysis.json``, and each run embeds the one before it until the process is
+    killed decoding its own output. Matching is on resolved paths, so a
+    relative, `..`-laden or symlinked target excludes the same tree, and a target
+    outside the project excludes nothing. A directory that holds the project
+    itself is refused (it would empty the inventory); the file entries still
+    cover that case.
+
     ``source`` is the WHOLE file or nothing -- never a prefix (#172). A
     decodable file is captured in full; ``capture_text=False`` empties
     ``source`` everywhere (inventory otherwise identical), and an undecodable
     file gets ``""`` as ``binary``. ``sha256``/``size_bytes`` always reflect
     the full file regardless."""
     out: Dict[str, PyArtifact] = {}
+    excluded = _resolve_exclusions(project_dir, exclude_paths)
     for path in sorted(project_dir.rglob("*")):
         if not path.is_file():
             continue
+        if _is_excluded(path, excluded):
+            continue
         rel = path.relative_to(project_dir)
         if any(part in _IGNORED_DIRS for part in rel.parts):
             continue

codeanalyzer/core.py

@@ -35,7 +35,7 @@ from codeanalyzer.syntactic_analysis.exceptions import SymbolTableBuilderRayErro
 from codeanalyzer.syntactic_analysis.import_resolver import resolve_imports
 from codeanalyzer.syntactic_analysis.symbol_table_builder import SymbolTableBuilder
 from codeanalyzer.utils import ProgressBar
-from codeanalyzer.options import AnalysisOptions
+from codeanalyzer.options import ANALYSIS_JSON, GRAPH_CYPHER, AnalysisOptions, EmitTarget
 from codeanalyzer.provenance import analyzer_info, repository_info
 
 def _artifact_full_text(project_dir: Path, path: str, art) -> str:
@@ -572,6 +572,24 @@ class Codeanalyzer:
                 )
         return externals
 
+    def _own_output_paths(self) -> List[Path]:
+        """Where this run writes: the output and cache directories, plus the
+        output files themselves (#207).
+
+        Artifact discovery skips these, so a run whose ``-o``/``-c`` lands inside
+        ``-i`` does not ingest its own previous output (each run embedding the
+        last until the process is killed decoding it). The file entries carry the
+        degenerate case where the output directory *is* the project root, which
+        cannot be skipped wholesale without emptying the inventory.
+        """
+        paths: List[Path] = [self.cache_dir]
+        if self.options.output is not None:
+            paths += [self.options.output, self.options.output / ANALYSIS_JSON]
+        if self.options.emit is EmitTarget.NEO4J:
+            # No -o means the cypher snapshot lands in the working directory.
+            paths.append((self.options.output or Path.cwd()) / GRAPH_CYPHER)
+        return paths
+
     def analyze(self) -> Analysis:
         """Analyze the project and return the v2 ``Analysis`` envelope.
 
@@ -673,6 +691,7 @@ class Codeanalyzer:
         app.artifacts = discover_artifacts(
             self.project_dir, app_name,
             capture_text=self.options.artifact_text,
+            exclude_paths=self._own_output_paths(),
         )
         app.dependencies, app.unresolved_imports = build_dependency_view(
             app.artifacts,

codeanalyzer/dataflow/builder.py

@@ -35,6 +35,7 @@ the result degrades gracefully instead of crashing (contract rule).
 from __future__ import annotations
 
 import ast
+from collections import defaultdict
 from pathlib import Path
 from typing import Callable, Dict, List, Optional, Set, Tuple
 
@@ -43,7 +44,7 @@ from codeanalyzer.dataflow.alias import TypeBasedAliasOracle
 from codeanalyzer.dataflow.pdg import build_pdg
 from codeanalyzer.dataflow.sdg import ProgramGraphsIR, assemble_sdg
 from codeanalyzer.dataflow.summaries import CallSite, FunctionInfo, compute_summaries
-from codeanalyzer.schema.ids import stamp_body_ids
+from codeanalyzer.schema.ids import call_body_keys, stamp_body_ids
 from codeanalyzer.schema.py_schema import PyApplication, PyCallable, PyClass, PyModule
 from codeanalyzer.utils import logger
 
@@ -291,6 +292,11 @@ def emit_l3_body(
                     continue
                 pycallable.body[local] = BodyNode(kind=node.kind, span=span)
 
+            keys_at: Dict[str, List[str]] = defaultdict(list)
+            for key, n in pycallable.body.items():
+                if n.kind == "call":
+                    keys_at[key.split("/", 1)[0]].append(key)
+
             # #115: anchor nested call vertices to their statement. A bare-call
             # statement shares its key with its CFG node (handled above); a call
             # nested inside a larger statement (`y = f(x)`) has its own key and
@@ -301,12 +307,16 @@ def emit_l3_body(
                     continue
                 stmt_local = im.local(node.id)
                 for call in _calls_in(node.ast_node):
-                    call_key = f"{call.lineno}:{call.col_offset}"
-                    child = pycallable.body.get(call_key)
-                    if child is None or call_key == stmt_local:
-                        continue
-                    if child.kind == "call":
-                        child.parent = stmt_local
+                    # Every call node at this position, not just one: nested calls
+                    # that share a start column are keyed `line:col`, `line:col/2`,
+                    # ... and each of them needs the anchor (#215).
+                    base = f"{call.lineno}:{call.col_offset}"
+                    for call_key in keys_at.get(base, ()):
+                        child = pycallable.body.get(call_key)
+                        if child is None or call_key == stmt_local:
+                            continue
+                        if child.kind == "call":
+                            child.parent = stmt_local
 
             if want_cfg:
                 pycallable.cfg = [
@@ -378,7 +388,7 @@ def build_program_graphs(
                 calls_by_pos.setdefault(pos, (node.id, call))
                 calls_by_line.setdefault(call.lineno, (node.id, call))
 
-        for site in pycallable.call_sites or []:
+        for site_key, site in call_body_keys(pycallable.call_sites):
             # Prefer the callsite's body-backfilled callee over Jedi's own
             # callee_signature side channel: under cross-test parso/Jedi cache
             # pressure that inference can silently degrade (full-suite-only
@@ -388,7 +398,7 @@ def build_program_graphs(
             # Only a resolved INTERNAL target counts (id_to_sig misses on an
             # external/unresolved callee); falls through to callee_signature
             # exactly as before whenever the body doesn't have an answer.
-            body_node = pycallable.body.get(f"{site.start_line}:{site.start_column}")
+            body_node = pycallable.body.get(site_key)
             target = (id_to_sig.get(body_node.callee) if body_node else None) or site.callee_signature
             if not target:
                 continue

codeanalyzer/dataflow/sdg.py

@@ -142,6 +142,26 @@ class _FunctionAssembler:
 
     # ---------------------------------------------------------------- formals
 
+    def formal_for(self, var: str) -> Optional[int]:
+        """The ``formal_in`` vertex that defines ``var`` in this callable.
+
+        A parameter, a capture and a read global are all defined at a
+        ``formal_in`` port, not at the synthetic CFG ENTRY node. Reaching-def
+        analysis reports ENTRY as the source for all three, so every place that
+        consumes a raw def source has to remap it here, or the SDG loses the
+        hop from the parameter to whatever uses it. Returns ``None`` when
+        ``var`` is not one of this callable's formals, so a caller can keep the
+        original source.
+        """
+        b = base_of(var)
+        if b in self.formal_in:
+            return self.formal_in[b]
+        if CAPTURE_PREFIX + b in self.formal_in:
+            return self.formal_in[CAPTURE_PREFIX + b]
+        if "::" in b and GLOBAL_PREFIX + b in self.formal_in:
+            return self.formal_in[GLOBAL_PREFIX + b]
+        return None
+
     def build_formals(self) -> None:
         scope, summary = self.scope, self.summary
         params = list(scope.params)
@@ -168,14 +188,8 @@ class _FunctionAssembler:
         for e in self.ddg:
             if e.source != entry:
                 continue
-            b = base_of(e.var)
-            if b in self.formal_in:
-                fid = self.formal_in[b]
-            elif CAPTURE_PREFIX + b in self.formal_in:
-                fid = self.formal_in[CAPTURE_PREFIX + b]
-            elif "::" in b and GLOBAL_PREFIX + b in self.formal_in:
-                fid = self.formal_in[GLOBAL_PREFIX + b]
-            else:
+            fid = self.formal_for(e.var)
+            if fid is None:
                 continue
             self.extra.append(PDGEdge(source=fid, target=e.target, type="DDG", var=e.var))
 
@@ -268,6 +282,8 @@ class _FunctionAssembler:
                         for src, var in self._defs_reaching_call_matching(
                             cs.node_id, path
                         ):
+                            if src == self.cfg.entry_id:
+                                src = self.formal_for(var) or src
                             self.extra.append(
                                 PDGEdge(source=src, target=aid, type="DDG", var=var)
                             )
@@ -296,6 +312,8 @@ class _FunctionAssembler:
                         for src, var in self._defs_reaching_call_matching(
                             cs.node_id, g
                         ):
+                            if src == self.cfg.entry_id:
+                                src = self.formal_for(var) or src
                             self.extra.append(
                                 PDGEdge(source=src, target=aid, type="DDG", var=var)
                             )

codeanalyzer/entrypoints/matching.py

@@ -104,8 +104,12 @@ def _methods_of(dec, spec: Optional[Dict[str, Any]], qualified: Optional[str] =
         return []
     source = spec.get("from")
     if source == "match_suffix":
+        # Only a real verb: `heuristic.http-verb` also matches `.websocket`, and a
+        # rule may accept any suffix, but `http_methods` is what a consumer filters
+        # on to enumerate methods -- a value that is not one is worse there than an
+        # empty list (#213). The dispatch path below already filters the same way.
         verb = (qualified or dec.qualified_name or "").rsplit(".", 1)[-1]
-        return [verb.upper()]
+        return [verb.upper()] if verb.lower() in _HTTP_VERBS else []
     if source == "keyword":
         raw = (dec.keyword_arguments or {}).get(spec.get("name", ""))
         value = _literal(raw)

codeanalyzer/neo4j/emit.py

@@ -31,7 +31,7 @@ from codeanalyzer.neo4j.bolt import BoltConfig, bolt_writer
 from codeanalyzer.neo4j.schema import build_schema_document
 from codeanalyzer.neo4j.cypher import render_cypher
 from codeanalyzer.neo4j.project import project
-from codeanalyzer.options import AnalysisOptions
+from codeanalyzer.options import GRAPH_CYPHER, AnalysisOptions
 from codeanalyzer.schema import Analysis
 from codeanalyzer.schema.assign_ids import assign_ids
 from codeanalyzer.utils import logger
@@ -75,6 +75,6 @@ def emit_neo4j(analysis: Analysis, options: AnalysisOptions) -> None:
 
     out_dir = options.output if options.output is not None else Path.cwd()
     out_dir.mkdir(parents=True, exist_ok=True)
-    target = out_dir / "graph.cypher"
+    target = out_dir / GRAPH_CYPHER
     target.write_text(render_cypher(rows, app_name))
     logger.info(f"Neo4j graph written to {target}")

codeanalyzer/neo4j/project.py

@@ -49,7 +49,9 @@ from codeanalyzer.schema import (
     PyVariableDeclaration,
 )
 from codeanalyzer.schema import model_dump
-from codeanalyzer.schema.ids import application_id, external_id, global_ordinal, purl_pypi
+from codeanalyzer.schema.ids import (
+    application_id, call_body_keys, external_id, global_ordinal, purl_pypi,
+)
 from codeanalyzer.schema.py_schema import PyDecorator, byte_offsets
 
 
@@ -183,12 +185,14 @@ def _project_program_graphs(
                 continue  # unstamped callable — assign_ids must run first
             owner = _sym(c.id)  # the :PyCallable node, keyed by its can:// id
             # ``callee_signature`` lives on ``PyCallable.call_sites``, not on the body
-            # node, so the graph joins the two on the call site's position (#203).
+            # node, so the graph joins the two on the call site's BODY KEY (#203,
+            # #215) -- re-derived from the same sequence L1 keyed ``body`` with, so
+            # two calls that start at one position keep their own signatures.
             # ``argument_types`` is deliberately not joined: it is the legacy field #86
             # split into ``PyCallArgument``, already carried as ``arguments_json``.
-            sig_by_pos = {
-                (cs.start_line, cs.start_column): cs.callee_signature
-                for cs in (c.call_sites or [])
+            sig_by_key = {
+                key: cs.callee_signature
+                for key, cs in call_body_keys(c.call_sites)
                 if cs.callee_signature
             }
             for local_key, node in (c.body or {}).items():
@@ -204,10 +208,7 @@ def _project_program_graphs(
                         {
                             "kind": node.kind,
                             **_span_props(span),
-                            "callee_signature": (
-                                sig_by_pos.get((span.start[0], span.start[1]))
-                                if span else None
-                            ),
+                            "callee_signature": sig_by_key.get(local_key),
                             "var": node.of,
                             "call_node": node.parent,
                             # Call-site detail (#120). The JSON emits one node per

codeanalyzer/options/__init__.py

@@ -1,3 +1,3 @@
-from .options import AnalysisOptions, EmitTarget
+from .options import ANALYSIS_JSON, GRAPH_CYPHER, AnalysisOptions, EmitTarget
 
-__all__ = ["AnalysisOptions", "EmitTarget"]
+__all__ = ["AnalysisOptions", "EmitTarget", "ANALYSIS_JSON", "GRAPH_CYPHER"]

codeanalyzer/options/options.py

@@ -4,6 +4,13 @@ from typing import Optional, Tuple
 from enum import Enum
 
 
+# The files a run writes into its output directory. Named once so artifact
+# discovery can recognize -- and skip -- the run's own output when it lands
+# inside the analyzed project (#207).
+ANALYSIS_JSON = "analysis.json"
+GRAPH_CYPHER = "graph.cypher"
+
+
 class EmitTarget(str, Enum):
     """Output target selected by ``--emit``.
 

codeanalyzer/schema/ids.py

@@ -10,7 +10,7 @@ and artifacts alike — which is what the prefix-scoped destructive statements
 an application named ``python`` mints ``can://python/python/...``, so a test
 for ``can://python/`` no longer means "a python id"; test the scheme instead."""
 from __future__ import annotations
-from typing import List, Optional
+from typing import Iterable, Iterator, List, Optional, Tuple
 
 SCHEME = "can://"
 
@@ -52,6 +52,42 @@ def external_id(app_id: str, module: Optional[str], name: str) -> str:
     return f"{base}/{module}/{name}" if module else f"{base}/{name}"
 
 
+def call_body_keys(sites: Iterable) -> Iterator[Tuple[str, object]]:
+    """The body key of each call site, in recording order: ``line:col``,
+    disambiguated ``/2``, ``/3``, ... when nested calls share a start position
+    (#215).
+
+    `getattr(o, n)(x)` begins the outer application and the inner `getattr` at the
+    same column, so a bare ``line:col`` key keeps one of the two and the dynamic
+    invocation is lost. Call sites are recorded pre-order, so the bare key goes to
+    the OUTERMOST call and the nested ones take the suffixes. The spelling is
+    codeanalyzer-typescript's (``callBodyKeys``, ``src/schema/l1Body.ts``), adopted
+    verbatim; the ``/`` never collides with a param-vertex segment, which always
+    begins ``actual_``.
+
+    The SINGLE definition of the sequence -- L1 builds ``body`` with it, and L2, the
+    dataflow builder, the defuse linker and the Neo4j projection re-derive the same
+    pairing from it rather than re-deriving a key from a position.
+    """
+    used = set()
+    for cs in sites or []:
+        base = f"{cs.start_line}:{cs.start_column}"
+        key = base
+        k = 2
+        while key in used:
+            key = f"{base}/{k}"
+            k += 1
+        used.add(key)
+        yield key, cs
+
+def call_body_key(callable_, site) -> Optional[str]:
+    """``site``'s body key within ``callable_`` — the pairing of
+    :func:`call_body_keys`, for a caller that holds one site rather than the list."""
+    for key, cs in call_body_keys(callable_.call_sites):
+        if cs is site:
+            return key
+    return None
+
 def global_ordinal(callable_id: str, local_key: str) -> str:
     """The GLOBAL ordinal id of a body node from its LOCAL key: synthetic keys
     (`@entry`, `@formal_in:0`) already carry the `@`; positional keys (`15:2`,

codeanalyzer/schema/l1_body.py

@@ -1,12 +1,11 @@
 """L1 body population: materialize `call` nodes from existing call sites.
 `callee` is left None here — the sanctioned null→id refinement happens at L2."""
 from __future__ import annotations
-from codeanalyzer.schema.ids import stamp_body_ids
+from codeanalyzer.schema.ids import call_body_keys, stamp_body_ids
 from codeanalyzer.schema.py_schema import PyApplication, PyClass, PyCallable, BodyNode, Span, byte_offsets
 
 def _do_callable(source: str, c: PyCallable) -> None:
-    for cs in c.call_sites or []:
-        key = f"{cs.start_line}:{cs.start_column}"
+    for key, cs in call_body_keys(c.call_sites):
         span = Span(start=(cs.start_line, cs.start_column),
                     end=(cs.end_line, cs.end_column),
                     bytes=byte_offsets(source, cs.start_line, cs.start_column, cs.end_line, cs.end_column)) if source else None

codeanalyzer/schema/l2_callees.py

@@ -5,17 +5,18 @@ signature; an unresolved call site leaves `callee` absent.
 
 Two resolution sources feed the backfill: Jedi's `callee_signature` on the
 call site itself, and the defuse linker's returned map (keyed by caller
-signature + "line:col"). The linker's resolutions are deliberately NOT written
+signature + the call site's body key, which carries a `/N` disambiguator when
+nested calls share a start position -- #215). The linker's resolutions are deliberately NOT written
 into `callee_signature` — the symbol table round-trips through the analysis
 cache, and a persisted resolution would resurface on a warm run as a Jedi
 edge, silently changing provenance."""
 from __future__ import annotations
+from codeanalyzer.schema.ids import call_body_keys
 from codeanalyzer.schema.py_schema import PyApplication, PyClass, PyCallable
 
 
 def _do_callable(c: PyCallable, sig_to_id: dict, resolutions: dict) -> None:
-    for cs in c.call_sites or []:
-        key = f"{cs.start_line}:{cs.start_column}"
+    for key, cs in call_body_keys(c.call_sites):
         jedi_sig = cs.callee_signature
         if jedi_sig and jedi_sig.startswith("typing."):
             # A decorator-typed callable resolved to its annotation, not a

codeanalyzer/semantic_analysis/defuse_linker.py

@@ -40,11 +40,14 @@ import ast
 import builtins as _py_builtins
 from typing import Dict, List, Optional, Tuple
 
+from codeanalyzer.schema.ids import call_body_key
 from codeanalyzer.schema.py_schema import PyCallable, PyCallEdge, PyClass, PyModule
 
 __all__ = ["defuse_linker_edges"]
 
-# (caller signature, "line:col" of the call site) -> resolved callee signature
+# (caller signature, the call site's body key) -> resolved callee signature.
+# The key is `call_body_key`, not a bare "line:col": two nested calls can start
+# at one position and only one of them is the resolution being recorded (#215).
 Resolutions = Dict[Tuple[str, str], str]
 
 _MAX_CHAIN = 16  # assignment-chain hops before giving up (cycle safety net)
@@ -1095,7 +1098,7 @@ def defuse_linker_edges(
                 oracle.vote(sig, site)
                 bump(caller.signature, sig)
                 resolutions[
-                    (caller.signature, f"{site.start_line}:{site.start_column}")
+                    (caller.signature, call_body_key(caller, site))
                 ] = sig
 
             # Calls Jedi's extractor never recorded as sites at all (with-
@@ -1398,7 +1401,7 @@ def defuse_linker_edges(
                     oracle.vote(sig, site)
                     bump(caller.signature, sig)
                     resolutions[
-                        (caller.signature, f"{site.start_line}:{site.start_column}")
+                        (caller.signature, call_body_key(caller, site))
                     ] = sig
                     made_progress = True
                 else:
@@ -1452,7 +1455,7 @@ def defuse_linker_edges(
             oracle.vote(sig, site)
             bump(caller.signature, sig)
             resolutions[
-                (caller.signature, f"{site.start_line}:{site.start_column}")
+                (caller.signature, call_body_key(caller, site))
             ] = sig
             made_progress = True
         remaining = still

codeanalyzer/syntactic_analysis/symbol_table_builder.py

@@ -130,8 +130,9 @@ class SymbolTableBuilder:
             return None, False
 
     @staticmethod
-    def _callee_anchor(node: ast.Call) -> Tuple[int, int]:
-        """Position of the callee *name* for Jedi inference.
+    def _callee_anchor(node: ast.Call) -> Optional[Tuple[int, int]]:
+        """Position of the callee *name* for Jedi inference, or ``None`` when the
+        callee is not a name at all.
 
         An ``ast.Call``'s own ``lineno``/``col_offset`` is the first
         character of the whole call expression — for an attribute call
@@ -139,11 +140,17 @@ class SymbolTableBuilder:
         would infer the receiver's type instead of the invoked method
         (issue #80). Anchor attribute calls inside the attribute name —
         its last character, so one-character names stay in range; other
-        callee shapes keep the call-expression start.
+        callee shapes keep the call-expression start. A callee that is itself a
+        call has no name to anchor on, so it yields ``None`` (#215).
         """
         func_expr = node.func
         if isinstance(func_expr, ast.Attribute):
             return func_expr.end_lineno, func_expr.end_col_offset - 1
+        if isinstance(func_expr, ast.Call):
+            # `getattr(o, n)(x)`: the callee IS a call, so the expression start is
+            # the INNER call's name and inferring there labels this site a call to
+            # `getattr` -- the thing that produced the callee, not the callee (#215).
+            return None
         return node.lineno, node.col_offset
 
     @staticmethod
@@ -766,11 +773,18 @@ class SymbolTableBuilder:
             func_expr = node.func
 
             method_name = "<unknown>"
-            anchor_line, anchor_col = self._callee_anchor(node)
-            callee_signature, is_constructor = self._infer_callee(
-                script, anchor_line, anchor_col
-            )
-            return_type = self._infer_call_return_type(script, anchor_line, anchor_col)
+            anchor = self._callee_anchor(node)
+            if anchor is None:
+                # A dynamic invocation: the site is recorded, and it resolves to
+                # nothing. Guessing a target here is what produced a graph full of
+                # calls to `builtins.getattr` (#215).
+                callee_signature, is_constructor, return_type = None, False, None
+            else:
+                anchor_line, anchor_col = anchor
+                callee_signature, is_constructor = self._infer_callee(
+                    script, anchor_line, anchor_col
+                )
+                return_type = self._infer_call_return_type(script, anchor_line, anchor_col)
 
             receiver_expr = None
             receiver_type = None

{codeanalyzer_python-1.5.2.dist-info → codeanalyzer_python-1.5.4.dist-info}/METADATA

@@ -1,6 +1,6 @@
 Metadata-Version: 2.5
 Name: codeanalyzer-python
-Version: 1.5.2
+Version: 1.5.4
 Summary: Static analysis for Python — canonical schema v2 (symbol table, call graph, and native CFG/PDG/SDG dataflow) as analysis.json or a Neo4j property graph.
 Author-email: Rahul Krishna <i.m.ralk@gmail.com>
 License-File: LICENSE

{codeanalyzer_python-1.5.2.dist-info → codeanalyzer_python-1.5.4.dist-info}/RECORD

@@ -1,6 +1,6 @@
 codeanalyzer/__init__.py,sha256=BZ3Kuwl-F_F-8H8cepLnVJ4Ku4NNUjjqg0Y6ujPQSsI,108
-codeanalyzer/__main__.py,sha256=o5_9ct61l3T7ryIsag8bz304NabVV-el_ooGD8tnbhA,15968
-codeanalyzer/core.py,sha256=JfSsQEacBiVn38tQP34QWdJqQx7ecE70EXI8obISZN4,46598
+codeanalyzer/__main__.py,sha256=noiZpfaiyFlnmdzHoWOAImXpxDkiQzTxSO4gmyZVyGI,15981
+codeanalyzer/core.py,sha256=UoK-7xgzJx-f3A_fmmeEZkBshiOWNDwc_RJTPhCTU0Y,47655
 codeanalyzer/provenance.py,sha256=DT-DqwdVwO7g-GyK3sC0_4vDNCUjZYEY1fyYCt-7VRM,2306
 codeanalyzer/py.typed,sha256=47DEQpj8HBSa-_TImW-5JCeuQeRkm5NMpJWZG3hSuFU,0
 codeanalyzer/artifacts/__init__.py,sha256=317sEeZLS1AYsfYDYIk7tLR3AdDFwWw_cmkeZDabkJo,906
@@ -8,12 +8,12 @@ codeanalyzer/artifacts/config_keys.py,sha256=ovwptAErLYutlCzUwvyim2kH6-6vUKxuRcB
 codeanalyzer/artifacts/config_use.py,sha256=1-jGacW249dwF7b6DOrTFuJ7sA5Ho9khgrgZqND0nro,27173
 codeanalyzer/artifacts/config_use_rules.yml,sha256=fNgI6IceOsj78LYmgoDH-vQ4-Mfb2ZFGKIQhLuoL4ik,1483
 codeanalyzer/artifacts/dependencies.py,sha256=h_-XV5KhrT-1Ytguw0c4fyI9zSFzn9Aj7kR66omvL3M,10853
-codeanalyzer/artifacts/discovery.py,sha256=cUVRSdV82G2hVGhkRGV7u24-tEAxUBmH9nkTg24ur0Y,5968
+codeanalyzer/artifacts/discovery.py,sha256=urN4ZvtnXs0w9Kv2-yeOQza1TV1mjLL007zHfbdjNSg,8416
 codeanalyzer/artifacts/parsers.py,sha256=xOjC53tT0Mv0k7ONGwzl5XUvpBLnZlEcGmyrX5DS45k,9035
 codeanalyzer/dataflow/__init__.py,sha256=HCNOH24rAGLUMG94N9aC-2SsAWSntk3uys7e39ipU5o,1725
 codeanalyzer/dataflow/access_paths.py,sha256=wC8Q9qD-RZzkoFWMVvu_6uNNmYP8z48OGp9h9v3F1d4,23623
 codeanalyzer/dataflow/alias.py,sha256=ZYKY0DiR3GHv6YJr7C001Lode9rZsk6-gxdomUyIvwg,3928
-codeanalyzer/dataflow/builder.py,sha256=grzgpl82KzNiwlgdTx60INMxkTZvddT3JzgaBRO4xh4,32839
+codeanalyzer/dataflow/builder.py,sha256=Ku16XuEJj46lnfuigMMyR6yheRW52f5U-ih9msxqSyo,33402
 codeanalyzer/dataflow/cfg.py,sha256=u5YXJjAaDshdgv-9kWWITbBJFP-MwXKq6hbNh0fhDm8,25307
 codeanalyzer/dataflow/defuse.py,sha256=LrX1ToOZzR79NlAGg5T647UAFkpiEqEnT7t0K5RXOiI,4377
 codeanalyzer/dataflow/dominance.py,sha256=X7Ki1QRdVqaseYsJtiUL7m9MbcC2WHEv9b8bczSLFUA,5086
@@ -21,7 +21,7 @@ codeanalyzer/dataflow/identity.py,sha256=6aAz3iPSOpoS7l_moC7XGr2RS_GqJp_FlsWGglM
 codeanalyzer/dataflow/pdg.py,sha256=1Bm7AnoRqXBryZulII2idPw0feV8eZQ1VqqprQ8PW-g,3731
 codeanalyzer/dataflow/scalpel_oracle.py,sha256=FxRadKrTWar0VKHyQJM40n3cq25sld3Sj4lMdOm5NFk,11494
 codeanalyzer/dataflow/scc.py,sha256=Doa_0-5f3agCu_5UmeEDlCUErg34TtniKIv8Uqd7Jiw,3493
-codeanalyzer/dataflow/sdg.py,sha256=taDXkIg0BZUtDEJUjRJB_dxrFl6tKNOUdFyj0zCiso0,18533
+codeanalyzer/dataflow/sdg.py,sha256=_dcR6nNc0ZTETaLHbmliEMeTG-AcQU0x-7DiB1cvoPs,19445
 codeanalyzer/dataflow/slicing.py,sha256=lWZ7jHhlR8m7rECWJQXvwfs5GNZeJY55Cud3Ji5UbNU,3654
 codeanalyzer/dataflow/summaries.py,sha256=TLtc5h4bLBC4lViuMhMlEp5rp_nBpDPOl4_wfBuRUY4,9210
 codeanalyzer/dataflow/syntactic.py,sha256=AbHyXjKX_1xkGgKH48BpXYCWBauActGUwSMF_OD-uys,1124
@@ -38,7 +38,7 @@ codeanalyzer/dataflow/scalpel/core/func_call_visitor.py,sha256=ps0snjTchBXilhor3
 codeanalyzer/dataflow/scalpel/core/vars_visitor.py,sha256=gE5fNyJS6jslD6vsMRbFLoy3n1xTwH-b54mBcNYO72M,5660
 codeanalyzer/entrypoints/__init__.py,sha256=VaMd4mSEPLuPlRxxAve_nTJ9ZH62stXZGTPNwU_BQ50,99
 codeanalyzer/entrypoints/detect.py,sha256=fsWRQz1njvB9d3LIJEHxsNFE1GrB7q52KCvozw_UIUQ,4594
-codeanalyzer/entrypoints/matching.py,sha256=rQeY_w2dyG36DBUjle7GLXxqDKsoMhJYPjN4s11OGtM,7948
+codeanalyzer/entrypoints/matching.py,sha256=fppta04o1_HWBEHe6boV_7T964cdLuZlOoQHAW4yt0Q,8321
 codeanalyzer/entrypoints/pipeline.py,sha256=vVSdttMfSAWour2fsC3LomMtwFLzRqmJHixJS82VY1I,7828
 codeanalyzer/entrypoints/rules.py,sha256=yG772JHmNc2L10jIpxfg1xTh-QouJa6lNU9ubo3EZYg,6003
 codeanalyzer/entrypoints/rules.yml,sha256=sguICRfDDNGjJPfZz-JSwkI_hzbTJaau1liHV_y4rTA,4637
@@ -47,32 +47,32 @@ codeanalyzer/jedi/jedi.py,sha256=47DEQpj8HBSa-_TImW-5JCeuQeRkm5NMpJWZG3hSuFU,0
 codeanalyzer/neo4j/__init__.py,sha256=8Ei6uThTOqmul6GhnKoGOjLXJZbyDwF5Jo-8I8NxnAk,1574
 codeanalyzer/neo4j/bolt.py,sha256=8l70iGDjY3Kdm-W1sb3b3O1uqLjDrVPYTpXhnkXdZOY,13694
 codeanalyzer/neo4j/cypher.py,sha256=-wledvXVrcLJRtSC5MCn1N3tqgC06rNfPBn0w6POqHo,6239
-codeanalyzer/neo4j/emit.py,sha256=OBCO77TDTaNpqk9Di3JIQzBouLpHPdgoXuPSs44iJuU,3587
-codeanalyzer/neo4j/project.py,sha256=gUAmIXLt0agWB1q1OS1Nzvlo1M6rqzzQymoy7lWxTps,42348
+codeanalyzer/neo4j/emit.py,sha256=7QYosqiadH2GIsjaUSmSlJ5g8yLjAAcMplsmFaJLnC4,3599
+codeanalyzer/neo4j/project.py,sha256=o6jdjwvHRxpNPNn-DXpOzebFq-fXgxoXTrKZ4_2ZVbQ,42383
 codeanalyzer/neo4j/rows.py,sha256=n_J3NVIusLPsHMjPCWaYvlL5sFm6V-kl_Z6B_BTH8Fk,10140
 codeanalyzer/neo4j/schema.py,sha256=0qZ1qJgmutlMHyIjdfD5N9QtA-gwl8Qcgh4NGguQEMs,18089
-codeanalyzer/options/__init__.py,sha256=6NewN0a-1HAEgKcxQjYyVn2WEDLrhax8h3WLgZddeqI,94
-codeanalyzer/options/options.py,sha256=2jDCcs74iSEOhz90LoRGts6PC8yV9IDPVxnLPNmonOA,1609
+codeanalyzer/options/__init__.py,sha256=HvKzVXBI91lBM941JSFN7npG4S2fHlVEKo9VC2lRso8,156
+codeanalyzer/options/options.py,sha256=DAo1i08D0K16jCivTrdOcBgKRPO50SngFZTPAL_kpmY,1862
 codeanalyzer/schema/__init__.py,sha256=hIyz02abUJNPW8yUgguaeKflZjTmOZWbDiKICNBD7yk,4141
 codeanalyzer/schema/assign_ids.py,sha256=pQHluLaO5a6hFREp3vjVRsUeAfTYSJ95RXS9TZvnoys,1590
 codeanalyzer/schema/call_graph_ids.py,sha256=mWAhJDBsW8i-siJiINOHCXEm4qM6F_5se9-HuHWIFqU,568
-codeanalyzer/schema/ids.py,sha256=YuioNK3Y-M2NcCBiGH4AB4rDezlqu6ycNO0R3O-Jxho,4388
-codeanalyzer/schema/l1_body.py,sha256=_sca0mTkMRb-5lasep87faGjDxZJd9jGB0hmBx3uCgk,1757
-codeanalyzer/schema/l2_callees.py,sha256=CTcBeGoO04DstDC6h-1sHMbbIrHDEOMxP01U9VLBcfc,2327
+codeanalyzer/schema/ids.py,sha256=eShvV3R6oQt1lCQ2DFAhWekSWom63wQJDfeWXJ7KovQ,5986
+codeanalyzer/schema/l1_body.py,sha256=-rBXZH1nhaCyQ2DVN-iIswuuSQ7Jsa8voSAaljv_c80,1737
+codeanalyzer/schema/l2_callees.py,sha256=UGubBSLA_-GCK9Kak2rqkmoFlGifiImVnPDrypjHfrA,2441
 codeanalyzer/schema/py_schema.py,sha256=4xJto32nWqHx0dkge4qHsV2JZSjbyv4ojnqpyBm78sQ,24588
 codeanalyzer/semantic_analysis/__init__.py,sha256=47DEQpj8HBSa-_TImW-5JCeuQeRkm5NMpJWZG3hSuFU,0
 codeanalyzer/semantic_analysis/call_graph.py,sha256=6YEB_wTn5-oQYLrbIhJYE0BsHl4fpWPoy5Hwd9mTnGc,11918
-codeanalyzer/semantic_analysis/defuse_linker.py,sha256=bSn1rCun28OQqSd2NOc9aVBSm47Gt9Iul4r_gwfqO1w,64930
+codeanalyzer/semantic_analysis/defuse_linker.py,sha256=3n1ew94eyBsSI98cFqP0uMHFUv7ob7QR9DL2hTKMHsQ,65099
 codeanalyzer/syntactic_analysis/__init__.py,sha256=EUQkJEh6wHjWx2qTTKbTbUgwSbfKeNieKHNy7RknVXA,476
 codeanalyzer/syntactic_analysis/exceptions.py,sha256=whs_n0vIu655Jkk1a7iOoXY6iIca4pZqJnU40V9Ejaw,537
 codeanalyzer/syntactic_analysis/import_resolver.py,sha256=Q8noZwSdDNt4P4NMqDTB9FaS-M0_d4ASK9GnJop9MDI,2751
-codeanalyzer/syntactic_analysis/symbol_table_builder.py,sha256=eTknBDlUuuQd3JEwbRtJt5pGVU89kOnzfmT4D5J_GKQ,47917
+codeanalyzer/syntactic_analysis/symbol_table_builder.py,sha256=tKed-VCSd_albMeZfUuPRCcKz_WEBic38DU21gM8o7g,48797
 codeanalyzer/utils/__init__.py,sha256=hC6VWdR5rerSqBxzu9KQHTASWqwrrYJv-CMDwrTlzkc,137
 codeanalyzer/utils/logging.py,sha256=Fw0tattPAOMs3o0JMjjXhRVLIF64f-SCcygUXF9jqeg,904
 codeanalyzer/utils/progress_bar.py,sha256=C9JtzVdd10lIxTv-KA6PebqjKWueC_vMGwVzAtHuHIw,2818
-codeanalyzer_python-1.5.2.dist-info/METADATA,sha256=hivDuG8vX-aDD0NW-giMx8A4XXclXcFCtnFR5dYJF2g,44845
-codeanalyzer_python-1.5.2.dist-info/WHEEL,sha256=zOwg4jB6zX2kU910N-cMawjivD6tO8NEWvE12je1bVk,87
-codeanalyzer_python-1.5.2.dist-info/entry_points.txt,sha256=v4Vux0Nnx7sOntVk_CH7W9RX6SkIkvR1FQYq73oVlCQ,105
-codeanalyzer_python-1.5.2.dist-info/licenses/LICENSE,sha256=xx0jnfkXJvxRnG63LTGOxlggYnIysveWIZ6H3PNdCrQ,11357
-codeanalyzer_python-1.5.2.dist-info/licenses/NOTICE,sha256=MdVkNYqHJ20on2FmWvgD4WpMsX5mir33xdyPvTXd0A0,1223
-codeanalyzer_python-1.5.2.dist-info/RECORD,,
+codeanalyzer_python-1.5.4.dist-info/METADATA,sha256=pky-NFu9SoPYS5JNaPnJF4J-9yTTp02bDGA0qxkorpA,44845
+codeanalyzer_python-1.5.4.dist-info/WHEEL,sha256=zOwg4jB6zX2kU910N-cMawjivD6tO8NEWvE12je1bVk,87
+codeanalyzer_python-1.5.4.dist-info/entry_points.txt,sha256=v4Vux0Nnx7sOntVk_CH7W9RX6SkIkvR1FQYq73oVlCQ,105
+codeanalyzer_python-1.5.4.dist-info/licenses/LICENSE,sha256=xx0jnfkXJvxRnG63LTGOxlggYnIysveWIZ6H3PNdCrQ,11357
+codeanalyzer_python-1.5.4.dist-info/licenses/NOTICE,sha256=MdVkNYqHJ20on2FmWvgD4WpMsX5mir33xdyPvTXd0A0,1223
+codeanalyzer_python-1.5.4.dist-info/RECORD,,