coretrace-python-analyzer 0.1.0__py3-none-any.whl → 0.2.0__py3-none-any.whl

coretrace_python/__init__.py

@@ -1,4 +1,4 @@
 """CoreTrace's Python static analysis frontend."""
 
-__version__ = "0.1.0"
+__version__ = "0.2.0"
 

coretrace_python/bundled/models/aiohttp/aiohttp_models.py

@@ -0,0 +1,61 @@
+"""aiohttp security models: handlers receive HTTP input whether they take an annotated
+``web.Request``, are registered on the router or decorated by a ``RouteTableDef``;
+responses, file responses and redirect exceptions are sinks; client sessions are SSRF
+sinks whose responses are untrusted."""
+
+from __future__ import annotations
+
+from typing import ClassVar
+
+from coretrace_python.plugins import ModelPlugin
+from coretrace_python.semantic.symbols import SymbolId
+from coretrace_python.taint import (
+    EntryPoint,
+    Model,
+    RouteRegistrar,
+    Sink,
+    Source,
+    TaintKind,
+    TypedParameter,
+)
+
+_METHODS = ("get", "post", "put", "patch", "delete", "head", "options")
+_REQUEST_CLASSES = ("aiohttp.web.Request", "aiohttp.web_request.Request")
+_ROUTERS = ("aiohttp.web.Application.router", "aiohttp.web.UrlDispatcher")
+_REDIRECTS = ("HTTPFound", "HTTPMovedPermanently", "HTTPSeeOther", "HTTPTemporaryRedirect", "HTTPPermanentRedirect")
+_CLIENT_FUNCTIONS = (
+    *(f"aiohttp.ClientSession.{method}" for method in (*_METHODS, "request")),
+    *(f"aiohttp.client.ClientSession.{method}" for method in (*_METHODS, "request")),
+    "aiohttp.request",
+)
+
+
+def _sym(path: str) -> SymbolId:
+    return SymbolId(f"python.{path}")
+
+
+class AiohttpModels(ModelPlugin):
+    name: ClassVar[str] = "aiohttp-models"
+    models: ClassVar[tuple[Model, ...]] = (
+        # The whole request is attacker-controlled: its query, match info, headers,
+        # cookies and body all come from the client.
+        *(TypedParameter(_sym(cls), "http") for cls in _REQUEST_CLASSES),
+        # ``@routes.get('/')`` on a ``RouteTableDef``.
+        *(EntryPoint(_sym(f"aiohttp.web.RouteTableDef.{method}"), "http") for method in (*_METHODS, "route", "view")),
+        # ``app.router.add_route('GET', '/', handler)`` and ``app.router.add_get('/', handler)``.
+        *(RouteRegistrar(_sym(f"{router}.add_route"), 2, "http", keyword="handler") for router in _ROUTERS),
+        *(
+            RouteRegistrar(_sym(f"{router}.add_{method}"), 1, "http", keyword="handler")
+            for router in _ROUTERS
+            for method in (*_METHODS, "view")
+        ),
+        # ``app.add_routes([web.get('/', handler)])``: the route definitions name the handler.
+        RouteRegistrar(_sym("aiohttp.web.route"), 2, "http", keyword="handler"),
+        *(RouteRegistrar(_sym(f"aiohttp.web.{method}"), 1, "http", keyword="handler") for method in (*_METHODS, "view")),
+        Sink(_sym("aiohttp.web.Response"), TaintKind.HTML),
+        Sink(_sym("aiohttp.web.FileResponse"), TaintKind.PATH),
+        *(Sink(_sym(f"aiohttp.web.{exception}"), TaintKind.REDIRECT) for exception in _REDIRECTS),
+        *(Sink(_sym(f"aiohttp.web_exceptions.{exception}"), TaintKind.REDIRECT) for exception in _REDIRECTS),
+        *(Sink(_sym(function), TaintKind.SSRF) for function in _CLIENT_FUNCTIONS),
+        *(Source(_sym(function), "http-response") for function in _CLIENT_FUNCTIONS),
+    )

coretrace_python/bundled/models/aiohttp/plugin.toml

@@ -0,0 +1,9 @@
+name = "aiohttp-models"
+version = "1.0.0"
+plugin_api = ">=1,<2"
+requires = []
+provides = ["model.http-sources", "model.aiohttp-routes", "model.ssrf-sinks"]
+
+[entrypoint]
+module = "aiohttp_models"
+class = "AiohttpModels"

coretrace_python/bundled/models/bottle/bottle_models.py

@@ -0,0 +1,39 @@
+"""Bottle security models: ``@route``, ``@get`` and the methods of a ``Bottle`` application
+are entry points, ``bottle.request`` is the HTTP source, ``redirect``, ``static_file``,
+``template`` and ``HTTPResponse`` are sinks, ``html_escape`` a sanitizer."""
+
+from __future__ import annotations
+
+from typing import ClassVar
+
+from coretrace_python.plugins import ModelPlugin
+from coretrace_python.semantic.symbols import SymbolId
+from coretrace_python.taint import EntryPoint, Model, Sanitizer, Sink, Source, TaintKind
+
+_METHODS = ("route", "get", "post", "put", "delete", "patch")
+_REQUEST_ATTRIBUTES = (
+    "query", "forms", "params", "json", "body", "headers", "cookies", "GET", "POST", "files",
+    "url", "path", "fullpath", "query_string", "get_cookie", "get_header",
+)
+_FIRST_ONLY = lambda kind: ((kind, (0,)),)
+
+
+def _sym(path: str) -> SymbolId:
+    return SymbolId(f"python.{path}")
+
+
+class BottleModels(ModelPlugin):
+    name: ClassVar[str] = "bottle-models"
+    models: ClassVar[tuple[Model, ...]] = (
+        *(EntryPoint(_sym(f"bottle.{method}"), "http") for method in _METHODS),
+        *(EntryPoint(_sym(f"bottle.Bottle.{method}"), "http") for method in _METHODS),
+        *(Source(_sym(f"bottle.request.{attribute}"), "http") for attribute in _REQUEST_ATTRIBUTES),
+        Sink(_sym("bottle.redirect"), TaintKind.REDIRECT, _FIRST_ONLY(TaintKind.REDIRECT)),
+        # ``static_file(filename, root)``: the root is the application's own.
+        Sink(_sym("bottle.static_file"), TaintKind.PATH, _FIRST_ONLY(TaintKind.PATH)),
+        # ``template(source_or_name, **variables)``: a tainted template is injection, the
+        # variables are escaped by the engine.
+        Sink(_sym("bottle.template"), TaintKind.HTML, _FIRST_ONLY(TaintKind.HTML)),
+        Sink(_sym("bottle.HTTPResponse"), TaintKind.HTML),
+        Sanitizer(_sym("bottle.html_escape"), TaintKind.HTML),
+    )

coretrace_python/bundled/models/bottle/plugin.toml

@@ -0,0 +1,9 @@
+name = "bottle-models"
+version = "1.0.0"
+plugin_api = ">=1,<2"
+requires = []
+provides = ["model.http-sources", "model.bottle-routes"]
+
+[entrypoint]
+module = "bottle_models"
+class = "BottleModels"

coretrace_python/bundled/models/db_drivers/db_driver_models.py

@@ -0,0 +1,71 @@
+"""Database driver models: the statement argument of aiopg, asyncpg, psycopg2 and PyMySQL
+query methods is a SQL sink; the parameter tuple or mapping is not a statement."""
+
+from __future__ import annotations
+
+from typing import ClassVar
+
+from coretrace_python.plugins import ModelPlugin
+from coretrace_python.semantic.symbols import SymbolId
+from coretrace_python.taint import Model, Sink, TaintKind
+
+_STATEMENT_ONLY = ((TaintKind.SQL, (0,)),)
+_CURSOR_METHODS = ("execute", "executemany", "mogrify")
+_ASYNCPG_METHODS = ("execute", "executemany", "fetch", "fetchrow", "fetchval", "cursor")
+
+# Every way a cursor is reached: through a connection object, an annotated class or a
+# pool; the symbol derivation follows call chains, so ``connect().cursor().execute`` is
+# ``connect.cursor.execute``.
+_CURSORS = (
+    "aiopg.connect.cursor",
+    "aiopg.Connection.cursor",
+    "aiopg.connection.Connection.cursor",
+    "aiopg.Cursor",
+    "aiopg.cursor.Cursor",
+    "aiopg.create_pool.acquire.cursor",
+    "aiopg.Pool.acquire.cursor",
+    "aiopg.pool.Pool.acquire.cursor",
+    "aiopg.create_pool.cursor",
+    "aiopg.Pool.cursor",
+    "psycopg2.connect.cursor",
+    "psycopg2.extensions.connection.cursor",
+    "psycopg2.extensions.cursor",
+    "psycopg2.extras.DictCursor",
+    "psycopg2.extras.RealDictCursor",
+    "pymysql.connect.cursor",
+    "pymysql.connections.Connection.cursor",
+    "pymysql.Connection.cursor",
+    "pymysql.cursors.Cursor",
+    "pymysql.cursors.DictCursor",
+)
+_ASYNCPG_CONNECTIONS = (
+    "asyncpg.connect",
+    "asyncpg.Connection",
+    "asyncpg.connection.Connection",
+    "asyncpg.create_pool",
+    "asyncpg.Pool",
+    "asyncpg.pool.Pool",
+    "asyncpg.create_pool.acquire",
+    "asyncpg.Pool.acquire",
+    "asyncpg.pool.Pool.acquire",
+)
+
+
+def _sym(path: str) -> SymbolId:
+    return SymbolId(f"python.{path}")
+
+
+class DbDriverModels(ModelPlugin):
+    name: ClassVar[str] = "db-driver-models"
+    models: ClassVar[tuple[Model, ...]] = (
+        *(
+            Sink(_sym(f"{cursor}.{method}"), TaintKind.SQL, _STATEMENT_ONLY)
+            for cursor in _CURSORS
+            for method in _CURSOR_METHODS
+        ),
+        *(
+            Sink(_sym(f"{connection}.{method}"), TaintKind.SQL, _STATEMENT_ONLY)
+            for connection in _ASYNCPG_CONNECTIONS
+            for method in _ASYNCPG_METHODS
+        ),
+    )

coretrace_python/bundled/models/db_drivers/plugin.toml

@@ -0,0 +1,9 @@
+name = "db-driver-models"
+version = "1.0.0"
+plugin_api = ">=1,<2"
+requires = []
+provides = ["model.sql-sinks"]
+
+[entrypoint]
+module = "db_driver_models"
+class = "DbDriverModels"

coretrace_python/bundled/models/django/django_models.py

@@ -20,6 +20,7 @@ from coretrace_python.taint import (
     RouteRegistrar,
     Sanitizer,
     Sink,
+    Source,
     SuffixSink,
     TaintKind,
     TypedParameter,
@@ -86,6 +87,9 @@ _AUTHORIZATION_DECORATORS = (
 )
 
 
+_TARGET_ONLY = ((TaintKind.REDIRECT, (0,)),)
+
+
 def _sym(path: str) -> SymbolId:
     return SymbolId(f"python.{path}")
 
@@ -95,6 +99,8 @@ class DjangoModels(ModelPlugin):
     models: ClassVar[tuple[Model, ...]] = (
         *(TypedParameter(_sym(cls), "http") for cls in _REQUEST_CLASSES),
         *(EntryPoint(_sym(base), "http") for base in _VIEW_BASES),
+        # ``self.request`` in a class-based view: the attribute is inherited from the base.
+        *(Source(_sym(f"{base}.request"), "http") for base in _VIEW_BASES),
         *(EntryPoint(_sym(decorator), "http") for decorator in _VIEW_DECORATORS),
         Sink(_sym("django.db.connection.cursor.execute"), TaintKind.SQL | TaintKind.CREDENTIAL, ((TaintKind.SQL, (0,)),)),
         Sink(_sym("django.db.connection.cursor.executemany"), TaintKind.SQL | TaintKind.CREDENTIAL, ((TaintKind.SQL, (0,)),)),
@@ -107,9 +113,11 @@ class DjangoModels(ModelPlugin):
         Sink(_sym("django.http.response.HttpResponse"), TaintKind.HTML),
         Sink(_sym("django.template.Template"), TaintKind.HTML),
         Sink(_sym("django.http.FileResponse"), TaintKind.PATH),
-        Sink(_sym("django.shortcuts.redirect"), TaintKind.REDIRECT),
-        Sink(_sym("django.http.HttpResponseRedirect"), TaintKind.REDIRECT),
-        Sink(_sym("django.http.HttpResponsePermanentRedirect"), TaintKind.REDIRECT),
+        # Only the target is a redirect: the other arguments of ``redirect`` are route
+        # parameters resolved through the URL configuration.
+        Sink(_sym("django.shortcuts.redirect"), TaintKind.REDIRECT, _TARGET_ONLY),
+        Sink(_sym("django.http.HttpResponseRedirect"), TaintKind.REDIRECT, _TARGET_ONLY),
+        Sink(_sym("django.http.HttpResponsePermanentRedirect"), TaintKind.REDIRECT, _TARGET_ONLY),
         Sanitizer(_sym("django.utils.html.escape"), TaintKind.HTML),
         Sanitizer(_sym("django.utils.html.conditional_escape"), TaintKind.HTML),
         *(AuthorizationGuard(_sym(decorator), label) for decorator, label in _AUTHORIZATION_DECORATORS),

coretrace_python/bundled/models/flask/flask_models.py

@@ -23,6 +23,9 @@ _REQUEST_ATTRIBUTES = (
 )
 
 
+_TARGET_ONLY = ((TaintKind.REDIRECT, (0,)),)
+
+
 def _sym(path: str) -> SymbolId:
     return SymbolId(f"python.{path}")
 
@@ -40,8 +43,9 @@ class FlaskModels(ModelPlugin):
         Sink(_sym("flask.Response"), TaintKind.HTML),
         Sink(_sym("flask.Markup"), TaintKind.HTML),
         Sink(_sym("flask.send_file"), TaintKind.PATH),
-        Sink(_sym("flask.redirect"), TaintKind.REDIRECT),
-        Sink(_sym("werkzeug.utils.redirect"), TaintKind.REDIRECT),
+        # ``redirect(location, code)``: the status code is not a target.
+        Sink(_sym("flask.redirect"), TaintKind.REDIRECT, _TARGET_ONLY),
+        Sink(_sym("werkzeug.utils.redirect"), TaintKind.REDIRECT, _TARGET_ONLY),
         Sink(_sym("flask.request.files.save"), TaintKind.PATH),
         Sanitizer(_sym("werkzeug.utils.secure_filename"), TaintKind.PATH),
         Sanitizer(_sym("flask.escape"), TaintKind.HTML),

coretrace_python/bundled/models/python_stdlib/python_stdlib.py

@@ -8,6 +8,9 @@ from coretrace_python.plugins import ModelPlugin
 from coretrace_python.semantic.symbols import SymbolId
 from coretrace_python.taint import Model, Sanitizer, Sink, Source, TaintKind, Validator
 
+_ENVIRONMENT_KINDS = TaintKind.ALL & ~(TaintKind.COMMAND | TaintKind.PATH)
+_PROCESS_OUTPUT_KINDS = TaintKind.ALL & ~TaintKind.PATH
+
 
 def _sym(path: str) -> SymbolId:
     return SymbolId(f"python.{path}")
@@ -18,13 +21,16 @@ class PythonStdlibModels(ModelPlugin):
     models: ClassVar[tuple[Model, ...]] = (
         Source(_sym("builtins.input"), "stdin"),
         Source(_sym("sys.stdin"), "stdin"),
-        # A command-line tool is expected to open the paths it is given.
+        # Operator-controlled inputs. A command-line tool is expected to open the paths
+        # it is given; the environment is set by whoever runs the program, so a command
+        # or a path built from it is not an injection; the output of a local process is
+        # not a path either, but a downloaded script piped into a shell is a real flaw.
         Source(_sym("sys.argv"), "argv", TaintKind.ALL & ~TaintKind.PATH),
-        Source(_sym("os.environ"), "environment"),
-        Source(_sym("subprocess.run.stdout"), "process-output"),
-        Source(_sym("subprocess.check_output"), "process-output"),
-        Source(_sym("subprocess.getoutput"), "process-output"),
-        Source(_sym("subprocess.Popen.communicate"), "process-output"),
+        Source(_sym("os.environ"), "environment", _ENVIRONMENT_KINDS),
+        Source(_sym("subprocess.run.stdout"), "process-output", _PROCESS_OUTPUT_KINDS),
+        Source(_sym("subprocess.check_output"), "process-output", _PROCESS_OUTPUT_KINDS),
+        Source(_sym("subprocess.getoutput"), "process-output", _PROCESS_OUTPUT_KINDS),
+        Source(_sym("subprocess.Popen.communicate"), "process-output", _PROCESS_OUTPUT_KINDS),
         Sink(_sym("os.system"), TaintKind.COMMAND),
         Sink(_sym("os.popen"), TaintKind.COMMAND),
         Sink(_sym("subprocess.run"), TaintKind.COMMAND),

coretrace_python/bundled/models/tornado/plugin.toml

@@ -0,0 +1,9 @@
+name = "tornado-models"
+version = "1.0.0"
+plugin_api = ">=1,<2"
+requires = []
+provides = ["model.http-sources", "model.tornado-handlers", "model.ssrf-sinks"]
+
+[entrypoint]
+module = "tornado_models"
+class = "TornadoModels"

coretrace_python/bundled/models/tornado/tornado_models.py

@@ -0,0 +1,37 @@
+"""Tornado security models: ``RequestHandler`` subclasses are entry points whose inherited
+request methods are HTTP sources and whose ``write``, ``finish`` and ``redirect`` are
+sinks; the HTTP clients are SSRF sinks with untrusted responses."""
+
+from __future__ import annotations
+
+from typing import ClassVar
+
+from coretrace_python.plugins import ModelPlugin
+from coretrace_python.semantic.symbols import SymbolId
+from coretrace_python.taint import EntryPoint, Model, Sanitizer, Sink, Source, TaintKind
+
+_HANDLERS = ("tornado.web.RequestHandler", "tornado.websocket.WebSocketHandler")
+_REQUEST_METHODS = (
+    "get_argument", "get_arguments", "get_query_argument", "get_query_arguments",
+    "get_body_argument", "get_body_arguments", "get_cookie", "request", "path_args", "path_kwargs",
+)
+_CLIENTS = ("tornado.httpclient.AsyncHTTPClient.fetch", "tornado.httpclient.HTTPClient.fetch")
+_TARGET_ONLY = ((TaintKind.REDIRECT, (0,)),)
+
+
+def _sym(path: str) -> SymbolId:
+    return SymbolId(f"python.{path}")
+
+
+class TornadoModels(ModelPlugin):
+    name: ClassVar[str] = "tornado-models"
+    models: ClassVar[tuple[Model, ...]] = (
+        *(EntryPoint(_sym(handler), "http") for handler in _HANDLERS),
+        *(Source(_sym(f"{handler}.{method}"), "http") for handler in _HANDLERS for method in _REQUEST_METHODS),
+        *(Sink(_sym(f"{handler}.write"), TaintKind.HTML) for handler in _HANDLERS),
+        *(Sink(_sym(f"{handler}.finish"), TaintKind.HTML) for handler in _HANDLERS),
+        *(Sink(_sym(f"{handler}.redirect"), TaintKind.REDIRECT, _TARGET_ONLY) for handler in _HANDLERS),
+        *(Sink(_sym(client), TaintKind.SSRF) for client in _CLIENTS),
+        *(Source(_sym(client), "http-response") for client in _CLIENTS),
+        Sanitizer(_sym("tornado.escape.xhtml_escape"), TaintKind.HTML),
+    )

coretrace_python/bundled/syntax/insecure_tempfile/insecure_tempfile.py

@@ -0,0 +1,25 @@
+"""``tempfile.mktemp`` returns a name without creating the file: another process can
+create it first. ``mkstemp``, ``NamedTemporaryFile`` and ``TemporaryDirectory`` are safe."""
+
+from __future__ import annotations
+
+from typing import ClassVar
+
+from coretrace_python.analysis import AnyAnalysis
+from coretrace_python.findings import Severity
+from coretrace_python.interprocedural import CallGraphAnalysis
+from coretrace_python.ir.ssa import SSAAnalysis
+from coretrace_python.plugins import SymbolCallDetector
+from coretrace_python.semantic.symbols import SymbolId
+
+
+class InsecureTempFilePlugin(SymbolCallDetector):
+    name: ClassVar[str] = "insecure-temp-file"
+    rule_id: ClassVar[str] = "insecure-temp-file"
+    requires: ClassVar[frozenset[AnyAnalysis]] = frozenset({SSAAnalysis, CallGraphAnalysis})
+    symbols: ClassVar[frozenset[SymbolId]] = frozenset({SymbolId("python.tempfile.mktemp")})
+    severity: ClassVar[Severity] = Severity.MEDIUM
+    message_template: ClassVar[str] = (
+        "call to {symbol} names a temporary file without creating it; use mkstemp or "
+        "NamedTemporaryFile"
+    )

coretrace_python/bundled/syntax/insecure_tempfile/plugin.toml

@@ -0,0 +1,9 @@
+name = "insecure-temp-file"
+version = "1.0.0"
+plugin_api = ">=1,<2"
+requires = ["interprocedural.callgraph", "ir.ssa"]
+provides = ["vulnerability.insecure-temp-file"]
+
+[entrypoint]
+module = "insecure_tempfile"
+class = "InsecureTempFilePlugin"

coretrace_python/bundled/syntax/insecure_tls/insecure_tls.py

@@ -0,0 +1,40 @@
+"""Disabled certificate verification: ``verify=False`` on an HTTP client call, or an
+``ssl`` context built without verification, lets any peer impersonate the server."""
+
+from __future__ import annotations
+
+from collections.abc import Mapping
+from typing import ClassVar
+
+from coretrace_python.analysis import AnyAnalysis
+from coretrace_python.findings import Severity
+from coretrace_python.interprocedural import CallGraphAnalysis
+from coretrace_python.ir.model import Call, Constant, Instruction, Value
+from coretrace_python.ir.ssa import SSAAnalysis
+from coretrace_python.plugins import SymbolCallDetector
+from coretrace_python.semantic.symbols import SymbolId
+
+_METHODS = ("get", "post", "put", "patch", "delete", "head", "options", "request")
+_CALLERS = ("requests", "requests.Session", "requests.api", "httpx", "httpx.Client", "httpx.AsyncClient")
+HTTP_CALLS = frozenset(
+    SymbolId(f"python.{caller}.{method}") for caller in _CALLERS for method in _METHODS
+) | frozenset(SymbolId(f"python.{client}") for client in ("httpx.Client", "httpx.AsyncClient"))
+UNVERIFIED = frozenset({SymbolId("python.ssl._create_unverified_context")})
+
+
+class InsecureTlsPlugin(SymbolCallDetector):
+    name: ClassVar[str] = "insecure-tls"
+    rule_id: ClassVar[str] = "insecure-tls"
+    requires: ClassVar[frozenset[AnyAnalysis]] = frozenset({SSAAnalysis, CallGraphAnalysis})
+    symbols: ClassVar[frozenset[SymbolId]] = HTTP_CALLS | UNVERIFIED
+    severity: ClassVar[Severity] = Severity.HIGH
+    message_template: ClassVar[str] = "call to {symbol} disables certificate verification"
+
+    def accepts(self, call: Call, symbol: SymbolId, defs: Mapping[Value, Instruction]) -> bool:
+        if symbol in UNVERIFIED:
+            return True
+        for name, value in call.keywords:
+            if name == "verify":
+                defined = defs.get(value)
+                return isinstance(defined, Constant) and defined.value is False
+        return False

coretrace_python/bundled/syntax/insecure_tls/plugin.toml

@@ -0,0 +1,9 @@
+name = "insecure-tls"
+version = "1.0.0"
+plugin_api = ">=1,<2"
+requires = ["interprocedural.callgraph", "ir.ssa"]
+provides = ["vulnerability.insecure-tls"]
+
+[entrypoint]
+module = "insecure_tls"
+class = "InsecureTlsPlugin"

coretrace_python/bundled/syntax/unsafe_archive/plugin.toml

@@ -0,0 +1,9 @@
+name = "unsafe-archive-extraction"
+version = "1.0.0"
+plugin_api = ">=1,<2"
+requires = ["interprocedural.callgraph", "ir.ssa"]
+provides = ["vulnerability.unsafe-archive-extraction"]
+
+[entrypoint]
+module = "unsafe_archive"
+class = "UnsafeArchivePlugin"

coretrace_python/bundled/syntax/unsafe_archive/unsafe_archive.py

@@ -0,0 +1,36 @@
+"""Archive extraction without member checks: a crafted archive with ``../`` members or
+absolute paths writes outside the target directory. ``tarfile`` accepts a ``filter``."""
+
+from __future__ import annotations
+
+from collections.abc import Mapping
+from typing import ClassVar
+
+from coretrace_python.analysis import AnyAnalysis
+from coretrace_python.findings import Severity
+from coretrace_python.interprocedural import CallGraphAnalysis
+from coretrace_python.ir.model import Call, Instruction, Value
+from coretrace_python.ir.ssa import SSAAnalysis
+from coretrace_python.plugins import SymbolCallDetector
+from coretrace_python.semantic.symbols import SymbolId
+
+_OPENERS = ("tarfile.open", "tarfile.TarFile", "tarfile.TarFile.open", "zipfile.ZipFile", "zipfile.Path")
+_EXTRACTORS = tuple(f"{opener}.{method}" for opener in _OPENERS for method in ("extractall", "extract"))
+
+
+class UnsafeArchivePlugin(SymbolCallDetector):
+    name: ClassVar[str] = "unsafe-archive-extraction"
+    rule_id: ClassVar[str] = "unsafe-archive-extraction"
+    requires: ClassVar[frozenset[AnyAnalysis]] = frozenset({SSAAnalysis, CallGraphAnalysis})
+    symbols: ClassVar[frozenset[SymbolId]] = frozenset(
+        SymbolId(f"python.{p}") for p in (*_EXTRACTORS, "shutil.unpack_archive")
+    )
+    severity: ClassVar[Severity] = Severity.MEDIUM
+    message_template: ClassVar[str] = (
+        "call to {symbol} extracts an archive without checking its member paths; a "
+        "crafted archive writes outside the target directory"
+    )
+
+    def accepts(self, call: Call, symbol: SymbolId, defs: Mapping[Value, Instruction]) -> bool:
+        # ``extractall(path, filter="data")`` rejects unsafe members (Python 3.12).
+        return not any(name == "filter" for name, _ in call.keywords)

coretrace_python/bundled/syntax/unsafe_xml/plugin.toml

@@ -0,0 +1,9 @@
+name = "unsafe-xml"
+version = "1.0.0"
+plugin_api = ">=1,<2"
+requires = ["interprocedural.callgraph", "ir.ssa"]
+provides = ["vulnerability.unsafe-xml"]
+
+[entrypoint]
+module = "unsafe_xml"
+class = "UnsafeXmlPlugin"

coretrace_python/bundled/syntax/unsafe_xml/unsafe_xml.py

@@ -0,0 +1,35 @@
+"""XML parsers of the standard library and lxml expand entities: a crafted document reads
+local files or exhausts memory. ``defusedxml`` offers the same functions safely."""
+
+from __future__ import annotations
+
+from typing import ClassVar
+
+from coretrace_python.analysis import AnyAnalysis
+from coretrace_python.findings import Severity
+from coretrace_python.interprocedural import CallGraphAnalysis
+from coretrace_python.ir.ssa import SSAAnalysis
+from coretrace_python.plugins import SymbolCallDetector
+from coretrace_python.semantic.symbols import SymbolId
+
+_PARSERS = (
+    "xml.etree.ElementTree.parse", "xml.etree.ElementTree.fromstring", "xml.etree.ElementTree.iterparse",
+    "xml.etree.ElementTree.XMLParser", "xml.etree.ElementTree.fromstringlist",
+    "xml.dom.minidom.parse", "xml.dom.minidom.parseString",
+    "xml.dom.pulldom.parse", "xml.dom.pulldom.parseString",
+    "xml.sax.parse", "xml.sax.parseString", "xml.sax.make_parser",
+    "xml.dom.expatbuilder.parse", "xml.dom.expatbuilder.parseString",
+    "lxml.etree.parse", "lxml.etree.fromstring", "lxml.etree.XMLParser", "lxml.etree.iterparse",
+    "lxml.etree.XML",
+)
+
+
+class UnsafeXmlPlugin(SymbolCallDetector):
+    name: ClassVar[str] = "unsafe-xml"
+    rule_id: ClassVar[str] = "unsafe-xml"
+    requires: ClassVar[frozenset[AnyAnalysis]] = frozenset({SSAAnalysis, CallGraphAnalysis})
+    symbols: ClassVar[frozenset[SymbolId]] = frozenset(SymbolId(f"python.{p}") for p in _PARSERS)
+    severity: ClassVar[Severity] = Severity.MEDIUM
+    message_template: ClassVar[str] = (
+        "call to {symbol} parses XML with entity expansion enabled; use defusedxml"
+    )

coretrace_python/bundled/syntax/weak_random/plugin.toml

@@ -0,0 +1,9 @@
+name = "weak-random"
+version = "1.0.0"
+plugin_api = ">=1,<2"
+requires = ["semantic.scopes", "semantic.symbols"]
+provides = ["vulnerability.weak-random"]
+
+[entrypoint]
+module = "weak_random"
+class = "WeakRandomPlugin"

coretrace_python/bundled/syntax/weak_random/weak_random.py

@@ -0,0 +1,86 @@
+"""``random`` builds a secret: the Mersenne Twister is predictable from a few outputs, so
+a token, key or session identifier drawn from it can be guessed. ``secrets`` and
+``random.SystemRandom`` are the alternatives. A call is reported when its result is
+assigned to a credential-like name, or when the enclosing function's name says it
+produces one."""
+
+from __future__ import annotations
+
+import re
+from collections.abc import Iterator, Sequence
+from typing import ClassVar
+
+from coretrace_python.analysis import AnyAnalysis
+from coretrace_python.findings import Confidence, Finding, Severity
+from coretrace_python.hir import nodes
+from coretrace_python.hir.visitors import Node, children
+from coretrace_python.plugins import Plugin, PluginContext
+from coretrace_python.semantic.scopes import ScopeAnalysis
+from coretrace_python.semantic.symbols import SymbolAnalysis, SymbolId
+
+_FUNCTIONS = ("random", "randint", "choice", "choices", "randrange", "getrandbits", "uniform", "sample", "randbytes")
+RANDOM = frozenset(SymbolId(f"python.random.{f}") for f in _FUNCTIONS)
+CREDENTIAL = re.compile(r"(?i)(token|secret|password|passwd|api_?key|session|nonce|salt|otp|csrf|auth)")
+
+
+class WeakRandomPlugin(Plugin):
+    name: ClassVar[str] = "weak-random"
+    rule_id: ClassVar[str] = "weak-random"
+    requires: ClassVar[frozenset[AnyAnalysis]] = frozenset({ScopeAnalysis, SymbolAnalysis})
+
+    def analyze(self, ctx: PluginContext) -> Sequence[Finding]:
+        scopes = ctx.get(ScopeAnalysis)
+        symbols = ctx.get(SymbolAnalysis)
+        findings: list[Finding] = []
+        for function in ctx.functions():
+            scope = scopes.scope_for(function).id
+            for target, call in _random_calls(function, scope, symbols):
+                purpose = target if target is not None and CREDENTIAL.search(target) else None
+                if purpose is None and CREDENTIAL.search(function.name):
+                    purpose = function.name
+                if purpose is None:
+                    continue
+                symbol = symbols.resolve_expression(scope, call.callee)
+                findings.append(
+                    Finding(
+                        self.rule_id,
+                        f"{symbol} is not a secure random source; {purpose!r} looks like a secret",
+                        Severity.MEDIUM,
+                        Confidence.MEDIUM,
+                        call.span,
+                        function.name,
+                        {"symbol": str(symbol), "purpose": purpose},
+                    )
+                )
+        return findings
+
+
+def _random_calls(
+    function: nodes.Function, scope: object, symbols: object
+) -> Iterator[tuple[str | None, nodes.Call]]:
+    """Calls to ``random`` functions with the name of the target they are assigned to."""
+
+    def walk(node: Node, target: str | None) -> Iterator[tuple[str | None, nodes.Call]]:
+        if isinstance(node, nodes.Function | nodes.Class | nodes.Lambda):
+            return
+        if isinstance(node, nodes.Assign | nodes.AugAssign):
+            target = _target_name(node.target)
+        if isinstance(node, nodes.Call):
+            symbol = symbols.resolve_expression(scope, node.callee)  # type: ignore[attr-defined]
+            if symbol in RANDOM:
+                yield target, node
+        for child in children(node):
+            yield from walk(child, target)
+
+    for statement in function.body:
+        yield from walk(statement, None)
+
+
+def _target_name(target: nodes.Target) -> str | None:
+    if isinstance(target, nodes.Name):
+        return target.identifier
+    if isinstance(target, nodes.Attribute):
+        return target.name
+    if isinstance(target, nodes.Subscript) and isinstance(target.key, nodes.Constant):
+        return str(target.key.value)
+    return None