codeanalyzer-python 1.5.3__py3-none-any.whl → 1.5.4__py3-none-any.whl

codeanalyzer/dataflow/sdg.py

@@ -142,6 +142,26 @@ class _FunctionAssembler:
 
     # ---------------------------------------------------------------- formals
 
+    def formal_for(self, var: str) -> Optional[int]:
+        """The ``formal_in`` vertex that defines ``var`` in this callable.
+
+        A parameter, a capture and a read global are all defined at a
+        ``formal_in`` port, not at the synthetic CFG ENTRY node. Reaching-def
+        analysis reports ENTRY as the source for all three, so every place that
+        consumes a raw def source has to remap it here, or the SDG loses the
+        hop from the parameter to whatever uses it. Returns ``None`` when
+        ``var`` is not one of this callable's formals, so a caller can keep the
+        original source.
+        """
+        b = base_of(var)
+        if b in self.formal_in:
+            return self.formal_in[b]
+        if CAPTURE_PREFIX + b in self.formal_in:
+            return self.formal_in[CAPTURE_PREFIX + b]
+        if "::" in b and GLOBAL_PREFIX + b in self.formal_in:
+            return self.formal_in[GLOBAL_PREFIX + b]
+        return None
+
     def build_formals(self) -> None:
         scope, summary = self.scope, self.summary
         params = list(scope.params)
@@ -168,14 +188,8 @@ class _FunctionAssembler:
         for e in self.ddg:
             if e.source != entry:
                 continue
-            b = base_of(e.var)
-            if b in self.formal_in:
-                fid = self.formal_in[b]
-            elif CAPTURE_PREFIX + b in self.formal_in:
-                fid = self.formal_in[CAPTURE_PREFIX + b]
-            elif "::" in b and GLOBAL_PREFIX + b in self.formal_in:
-                fid = self.formal_in[GLOBAL_PREFIX + b]
-            else:
+            fid = self.formal_for(e.var)
+            if fid is None:
                 continue
             self.extra.append(PDGEdge(source=fid, target=e.target, type="DDG", var=e.var))
 
@@ -268,6 +282,8 @@ class _FunctionAssembler:
                         for src, var in self._defs_reaching_call_matching(
                             cs.node_id, path
                         ):
+                            if src == self.cfg.entry_id:
+                                src = self.formal_for(var) or src
                             self.extra.append(
                                 PDGEdge(source=src, target=aid, type="DDG", var=var)
                             )
@@ -296,6 +312,8 @@ class _FunctionAssembler:
                         for src, var in self._defs_reaching_call_matching(
                             cs.node_id, g
                         ):
+                            if src == self.cfg.entry_id:
+                                src = self.formal_for(var) or src
                             self.extra.append(
                                 PDGEdge(source=src, target=aid, type="DDG", var=var)
                             )

codeanalyzer/entrypoints/matching.py

@@ -104,8 +104,12 @@ def _methods_of(dec, spec: Optional[Dict[str, Any]], qualified: Optional[str] =
         return []
     source = spec.get("from")
     if source == "match_suffix":
+        # Only a real verb: `heuristic.http-verb` also matches `.websocket`, and a
+        # rule may accept any suffix, but `http_methods` is what a consumer filters
+        # on to enumerate methods -- a value that is not one is worse there than an
+        # empty list (#213). The dispatch path below already filters the same way.
         verb = (qualified or dec.qualified_name or "").rsplit(".", 1)[-1]
-        return [verb.upper()]
+        return [verb.upper()] if verb.lower() in _HTTP_VERBS else []
     if source == "keyword":
         raw = (dec.keyword_arguments or {}).get(spec.get("name", ""))
         value = _literal(raw)

{codeanalyzer_python-1.5.3.dist-info → codeanalyzer_python-1.5.4.dist-info}/METADATA

@@ -1,6 +1,6 @@
 Metadata-Version: 2.5
 Name: codeanalyzer-python
-Version: 1.5.3
+Version: 1.5.4
 Summary: Static analysis for Python — canonical schema v2 (symbol table, call graph, and native CFG/PDG/SDG dataflow) as analysis.json or a Neo4j property graph.
 Author-email: Rahul Krishna <i.m.ralk@gmail.com>
 License-File: LICENSE

{codeanalyzer_python-1.5.3.dist-info → codeanalyzer_python-1.5.4.dist-info}/RECORD

@@ -21,7 +21,7 @@ codeanalyzer/dataflow/identity.py,sha256=6aAz3iPSOpoS7l_moC7XGr2RS_GqJp_FlsWGglM
 codeanalyzer/dataflow/pdg.py,sha256=1Bm7AnoRqXBryZulII2idPw0feV8eZQ1VqqprQ8PW-g,3731
 codeanalyzer/dataflow/scalpel_oracle.py,sha256=FxRadKrTWar0VKHyQJM40n3cq25sld3Sj4lMdOm5NFk,11494
 codeanalyzer/dataflow/scc.py,sha256=Doa_0-5f3agCu_5UmeEDlCUErg34TtniKIv8Uqd7Jiw,3493
-codeanalyzer/dataflow/sdg.py,sha256=taDXkIg0BZUtDEJUjRJB_dxrFl6tKNOUdFyj0zCiso0,18533
+codeanalyzer/dataflow/sdg.py,sha256=_dcR6nNc0ZTETaLHbmliEMeTG-AcQU0x-7DiB1cvoPs,19445
 codeanalyzer/dataflow/slicing.py,sha256=lWZ7jHhlR8m7rECWJQXvwfs5GNZeJY55Cud3Ji5UbNU,3654
 codeanalyzer/dataflow/summaries.py,sha256=TLtc5h4bLBC4lViuMhMlEp5rp_nBpDPOl4_wfBuRUY4,9210
 codeanalyzer/dataflow/syntactic.py,sha256=AbHyXjKX_1xkGgKH48BpXYCWBauActGUwSMF_OD-uys,1124
@@ -38,7 +38,7 @@ codeanalyzer/dataflow/scalpel/core/func_call_visitor.py,sha256=ps0snjTchBXilhor3
 codeanalyzer/dataflow/scalpel/core/vars_visitor.py,sha256=gE5fNyJS6jslD6vsMRbFLoy3n1xTwH-b54mBcNYO72M,5660
 codeanalyzer/entrypoints/__init__.py,sha256=VaMd4mSEPLuPlRxxAve_nTJ9ZH62stXZGTPNwU_BQ50,99
 codeanalyzer/entrypoints/detect.py,sha256=fsWRQz1njvB9d3LIJEHxsNFE1GrB7q52KCvozw_UIUQ,4594
-codeanalyzer/entrypoints/matching.py,sha256=rQeY_w2dyG36DBUjle7GLXxqDKsoMhJYPjN4s11OGtM,7948
+codeanalyzer/entrypoints/matching.py,sha256=fppta04o1_HWBEHe6boV_7T964cdLuZlOoQHAW4yt0Q,8321
 codeanalyzer/entrypoints/pipeline.py,sha256=vVSdttMfSAWour2fsC3LomMtwFLzRqmJHixJS82VY1I,7828
 codeanalyzer/entrypoints/rules.py,sha256=yG772JHmNc2L10jIpxfg1xTh-QouJa6lNU9ubo3EZYg,6003
 codeanalyzer/entrypoints/rules.yml,sha256=sguICRfDDNGjJPfZz-JSwkI_hzbTJaau1liHV_y4rTA,4637
@@ -70,9 +70,9 @@ codeanalyzer/syntactic_analysis/symbol_table_builder.py,sha256=tKed-VCSd_albMeZf
 codeanalyzer/utils/__init__.py,sha256=hC6VWdR5rerSqBxzu9KQHTASWqwrrYJv-CMDwrTlzkc,137
 codeanalyzer/utils/logging.py,sha256=Fw0tattPAOMs3o0JMjjXhRVLIF64f-SCcygUXF9jqeg,904
 codeanalyzer/utils/progress_bar.py,sha256=C9JtzVdd10lIxTv-KA6PebqjKWueC_vMGwVzAtHuHIw,2818
-codeanalyzer_python-1.5.3.dist-info/METADATA,sha256=mYN0yUedKfOOzWquD1DxyaoE3c9yUpK9Prs9AXqj6d0,44845
-codeanalyzer_python-1.5.3.dist-info/WHEEL,sha256=zOwg4jB6zX2kU910N-cMawjivD6tO8NEWvE12je1bVk,87
-codeanalyzer_python-1.5.3.dist-info/entry_points.txt,sha256=v4Vux0Nnx7sOntVk_CH7W9RX6SkIkvR1FQYq73oVlCQ,105
-codeanalyzer_python-1.5.3.dist-info/licenses/LICENSE,sha256=xx0jnfkXJvxRnG63LTGOxlggYnIysveWIZ6H3PNdCrQ,11357
-codeanalyzer_python-1.5.3.dist-info/licenses/NOTICE,sha256=MdVkNYqHJ20on2FmWvgD4WpMsX5mir33xdyPvTXd0A0,1223
-codeanalyzer_python-1.5.3.dist-info/RECORD,,
+codeanalyzer_python-1.5.4.dist-info/METADATA,sha256=pky-NFu9SoPYS5JNaPnJF4J-9yTTp02bDGA0qxkorpA,44845
+codeanalyzer_python-1.5.4.dist-info/WHEEL,sha256=zOwg4jB6zX2kU910N-cMawjivD6tO8NEWvE12je1bVk,87
+codeanalyzer_python-1.5.4.dist-info/entry_points.txt,sha256=v4Vux0Nnx7sOntVk_CH7W9RX6SkIkvR1FQYq73oVlCQ,105
+codeanalyzer_python-1.5.4.dist-info/licenses/LICENSE,sha256=xx0jnfkXJvxRnG63LTGOxlggYnIysveWIZ6H3PNdCrQ,11357
+codeanalyzer_python-1.5.4.dist-info/licenses/NOTICE,sha256=MdVkNYqHJ20on2FmWvgD4WpMsX5mir33xdyPvTXd0A0,1223
+codeanalyzer_python-1.5.4.dist-info/RECORD,,