coretrace-python-analyzer 0.1.0__py3-none-any.whl

coretrace_python/plugins/manifest.py

@@ -0,0 +1,112 @@
+"""Plugin manifests (architecture §14, §33).
+
+A manifest is a ``plugin.toml`` file next to the plugin module::
+
+    name = "sql-injection"
+    version = "1.0.0"
+    plugin_api = ">=1,<2"
+    requires = ["semantic.symbols", "analysis.taint"]
+    provides = ["vulnerability.sql-injection"]
+
+    [entrypoint]
+    module = "sql_injection"
+    class = "SQLInjectionPlugin"
+"""
+
+from __future__ import annotations
+
+import re
+import tomllib
+from dataclasses import dataclass
+from pathlib import Path
+
+
+class ManifestError(Exception):
+    """A manifest that cannot be read, or that disagrees with its plugin."""
+
+
+_CONSTRAINT = re.compile(r"^(>=|<=|==|>|<)?(\d+)$")
+_COMPARE = {
+    "==": lambda actual, wanted: actual == wanted,
+    ">=": lambda actual, wanted: actual >= wanted,
+    "<=": lambda actual, wanted: actual <= wanted,
+    ">": lambda actual, wanted: actual > wanted,
+    "<": lambda actual, wanted: actual < wanted,
+}
+
+
+@dataclass(frozen=True)
+class VersionRange:
+    """Integer API version constraints such as ``">=1,<2"`` or ``"1"``."""
+
+    spec: str
+    constraints: tuple[tuple[str, int], ...]
+
+    @classmethod
+    def parse(cls, spec: str) -> VersionRange:
+        constraints: list[tuple[str, int]] = []
+        for part in spec.split(","):
+            match = _CONSTRAINT.match(part.strip())
+            if match is None:
+                raise ManifestError(f"invalid plugin_api range: {spec!r}")
+            operator, number = match.groups()
+            constraints.append((operator or "==", int(number)))
+        return cls(spec, tuple(constraints))
+
+    def contains(self, version: int) -> bool:
+        return all(_COMPARE[operator](version, wanted) for operator, wanted in self.constraints)
+
+    def __str__(self) -> str:
+        return self.spec
+
+
+@dataclass(frozen=True)
+class Entrypoint:
+    module: str
+    class_name: str
+
+
+@dataclass(frozen=True)
+class PluginManifest:
+    name: str
+    version: str
+    plugin_api: VersionRange
+    requires: tuple[str, ...]
+    provides: tuple[str, ...]
+    entrypoint: Entrypoint
+
+
+def load_manifest(path: Path) -> PluginManifest:
+    try:
+        data = tomllib.loads(path.read_text(encoding="utf-8"))
+    except (OSError, tomllib.TOMLDecodeError) as error:
+        raise ManifestError(f"{path}: {error}") from error
+
+    def string(key: str) -> str:
+        value = data.get(key)
+        if not isinstance(value, str) or not value:
+            raise ManifestError(f"{path}: missing or invalid field '{key}'")
+        return value
+
+    def strings(key: str) -> tuple[str, ...]:
+        value = data.get(key)
+        if not isinstance(value, list) or not all(isinstance(v, str) for v in value):
+            raise ManifestError(f"{path}: missing or invalid field '{key}'")
+        return tuple(value)
+
+    entrypoint = data.get("entrypoint")
+    if not isinstance(entrypoint, dict):
+        raise ManifestError(f"{path}: missing or invalid field 'entrypoint'")
+    module = entrypoint.get("module")
+    class_name = entrypoint.get("class")
+    if not isinstance(module, str) or not isinstance(class_name, str):
+        raise ManifestError(f"{path}: entrypoint needs 'module' and 'class'")
+
+    return PluginManifest(
+        name=string("name"),
+        version=string("version"),
+        plugin_api=VersionRange.parse(string("plugin_api")),
+        requires=strings("requires"),
+        provides=strings("provides"),
+        entrypoint=Entrypoint(module, class_name),
+    )

coretrace_python/plugins/registry.py

@@ -0,0 +1,34 @@
+"""Registry of loaded plugins, indexed by name and by provided capability."""
+
+from __future__ import annotations
+
+from collections.abc import Iterator
+
+from coretrace_python.plugins.loader import LoadedPlugin
+from coretrace_python.plugins.manifest import ManifestError
+
+
+class PluginRegistry:
+    def __init__(self) -> None:
+        self._by_name: dict[str, LoadedPlugin] = {}
+        self._by_capability: dict[str, list[LoadedPlugin]] = {}
+
+    def add(self, loaded: LoadedPlugin) -> None:
+        name = loaded.manifest.name
+        if name in self._by_name:
+            raise ManifestError(f"plugin {name!r} is already registered")
+        self._by_name[name] = loaded
+        for capability in loaded.manifest.provides:
+            self._by_capability.setdefault(capability, []).append(loaded)
+
+    def plugin(self, name: str) -> LoadedPlugin:
+        return self._by_name[name]
+
+    def providers(self, capability: str) -> tuple[LoadedPlugin, ...]:
+        return tuple(self._by_capability.get(capability, ()))
+
+    def __iter__(self) -> Iterator[LoadedPlugin]:
+        return iter(self._by_name.values())
+
+    def __len__(self) -> int:
+        return len(self._by_name)

coretrace_python/plugins/secrets.py

@@ -0,0 +1,330 @@
+"""Secret detection base (architecture §25 plugins/secrets).
+
+Secrets are string literals of the PyHIR. ``literals`` walks every string literal with
+the name it is bound to (assignment target, keyword argument, dictionary key) and the
+enclosing function; ``SecretDetector`` reports at most one finding per literal: a
+provider pattern first (``hardcoded-secret``), then a credential-like name with a real
+value (``hardcoded-credential``), then a high-entropy token on its own
+(``high-entropy-string``). Messages and metadata carry a redacted preview, never the
+secret. Only Python sources are scanned; configuration files are not.
+"""
+
+from __future__ import annotations
+
+import json
+import math
+import re
+import tomllib
+from collections import Counter
+from collections.abc import Iterator, Sequence
+from dataclasses import dataclass
+from pathlib import Path
+from typing import ClassVar
+
+from coretrace_python.findings import Confidence, Finding, Severity
+from coretrace_python.hir import nodes
+from coretrace_python.hir.visitors import Node, children
+from coretrace_python.interprocedural import discover_files
+from coretrace_python.plugins.api import Plugin, PluginContext
+from coretrace_python.source import SourceId, SourceSpan, decode_text
+
+Literal = tuple[str, str | None, SourceSpan, str | None]
+
+_HEX = re.compile(r"^[0-9a-fA-F]+$")
+_TOKEN = re.compile(r"^[A-Za-z0-9+/=_-]+$")
+_PLACEHOLDER = re.compile(r"^(<.*>|\$\{.*\}|\{\{.*\}\}|%.*%|\.{3,}|(.)\2*)$")
+_PLACEHOLDER_WORDS = frozenset(
+    {"", "changeme", "change_me", "password", "passwd", "secret", "token", "example", "xxx", "todo", "none", "null"}
+)
+_NOT_CREDENTIAL_SUFFIXES = ("_name", "_field", "_file", "_path", "_url", "_id", "_env", "_var", "_header", "_param")
+
+
+def shannon_entropy(text: str) -> float:
+    """Bits of information per character of ``text``."""
+
+    if not text:
+        return 0.0
+    counts = Counter(text)
+    length = len(text)
+    return -sum(count / length * math.log2(count / length) for count in counts.values())
+
+
+def literals(module: nodes.Module) -> Iterator[Literal]:
+    """Every string literal of the module as ``(value, bound name, span, function)``."""
+
+    for statement in module.body:
+        yield from _walk(statement, None, None)
+
+
+def _walk(node: Node, name: str | None, function: str | None) -> Iterator[Literal]:
+    if isinstance(node, nodes.Constant):
+        if isinstance(node.value, str):
+            yield node.value, name, node.span, function
+        return
+    if isinstance(node, nodes.Function):
+        for child in children(node):
+            yield from _walk(child, None, node.name)
+        return
+    if isinstance(node, nodes.Class):
+        for child in children(node):
+            yield from _walk(child, None, None)
+        return
+    if isinstance(node, nodes.Assign):
+        yield from _walk(node.value, _bound_name(node.target), function)
+        return
+    if isinstance(node, nodes.Keyword):
+        yield from _walk(node.value, node.name, function)
+        return
+    if isinstance(node, nodes.Parameter):
+        if node.default is not None:
+            yield from _walk(node.default, node.name, function)
+        return
+    if isinstance(node, nodes.Call) and _is_environment_lookup(node):
+        # ``os.getenv("APP_TOKEN", "fallback")``: the fallback is bound to the variable name.
+        variable, fallback = node.arguments[0], node.arguments[1]
+        assert isinstance(variable, nodes.Constant) and isinstance(variable.value, str)
+        yield from _walk(variable, None, function)
+        yield from _walk(fallback, variable.value, function)
+        for keyword in node.keywords:
+            yield from _walk(keyword, None, function)
+        return
+    if isinstance(node, nodes.Dict):
+        for key, value in node.items:
+            # A constant key names the value; it is not a value itself.
+            if isinstance(key, nodes.Constant):
+                bound = key.value if isinstance(key.value, str) else None
+            else:
+                bound = None
+                if key is not None:
+                    yield from _walk(key, None, function)
+            yield from _walk(value, bound, function)
+        return
+    for child in children(node):
+        yield from _walk(child, None, function)
+
+
+def _is_environment_lookup(call: nodes.Call) -> bool:
+    callee = call.callee
+    return (
+        isinstance(callee, nodes.Attribute)
+        and callee.name in ("getenv", "get")
+        and len(call.arguments) >= 2
+        and isinstance(call.arguments[0], nodes.Constant)
+        and isinstance(call.arguments[0].value, str)
+    )
+
+
+def _bound_name(target: nodes.Target) -> str | None:
+    """The name an assignment binds: ``name``, ``obj.attr`` or ``mapping['key']``."""
+
+    if isinstance(target, nodes.Name):
+        return target.identifier
+    if isinstance(target, nodes.Attribute):
+        return target.name
+    if isinstance(target, nodes.Subscript) and isinstance(target.key, nodes.Constant):
+        return target.key.value if isinstance(target.key.value, str) else None
+    return None
+
+
+@dataclass(frozen=True)
+class SecretPattern:
+    """A provider-specific secret format."""
+
+    provider: str
+    regex: str
+
+    def matches(self, text: str) -> bool:
+        return re.search(self.regex, text) is not None
+
+
+DEFAULT_PATTERNS: tuple[SecretPattern, ...] = (
+    SecretPattern("aws", r"\b(AKIA|ASIA)[0-9A-Z]{16}\b"),
+    SecretPattern("github", r"\bgh[pousr]_[A-Za-z0-9]{36,}\b"),
+    SecretPattern("github", r"\bgithub_pat_[A-Za-z0-9]{22}_[A-Za-z0-9]{59}\b"),
+    SecretPattern("slack", r"\bxox[abpr]-[0-9]{10,}-[0-9A-Za-z-]{10,}"),
+    SecretPattern("stripe", r"\b[sr]k_(live|test)_[0-9A-Za-z]{24,}\b"),
+    SecretPattern("google", r"\bAIza[0-9A-Za-z_-]{35}\b"),
+    SecretPattern("private-key", r"-----BEGIN [A-Z ]*PRIVATE KEY-----"),
+    SecretPattern("jwt", r"\beyJ[A-Za-z0-9_-]{8,}\.[A-Za-z0-9_-]{8,}\.[A-Za-z0-9_-]{8,}\b"),
+    SecretPattern("sendgrid", r"\bSG\.[A-Za-z0-9_-]{22}\.[A-Za-z0-9_-]{43}\b"),
+    SecretPattern("twilio", r"\bSK[0-9a-fA-F]{32}\b"),
+    SecretPattern(
+        "url",
+        r"://[^/\s:@'\"]+:[^/\s@'\"]+@"
+        r"|[?&](?:password|passwd|pwd|token|api_key|apikey|secret|access_key)=[^&\s'\"]{3,}",
+    ),
+)
+
+DEFAULT_CREDENTIAL_NAMES: tuple[str, ...] = (
+    "password",
+    "passwd",
+    "pwd",
+    "secret",
+    "token",
+    "api_key",
+    "apikey",
+    "api-key",
+    "private_key",
+    "access_key",
+    "credential",
+)
+
+CONFIG_SUFFIXES = frozenset({".env", ".yaml", ".yml", ".toml", ".json", ".ini", ".cfg", ".properties", ".conf"})
+_PAIR = re.compile(r"^\s*(?:-\s+)?([A-Za-z_][\w.-]*)\s*[:=]\s*(.*?)\s*$")
+_MAX_CONFIG_BYTES = 8_000_000
+
+
+def config_literals(root: Path) -> Iterator[Literal]:
+    """Every string value of the configuration files under ``root`` with the key it is
+    bound to: ``.env``, YAML, TOML, JSON, INI and properties files, decoded by their
+    byte order mark. Python files are left to ``literals``."""
+
+    for path in discover_files(root):
+        if not (path.suffix in CONFIG_SUFFIXES or path.name.startswith(".env")):
+            continue
+        try:
+            data = path.read_bytes()
+            if len(data) > _MAX_CONFIG_BYTES:
+                continue
+            text = decode_text(data)
+        except (OSError, UnicodeDecodeError):
+            continue
+        source = SourceId(str(path))
+        if path.suffix == ".json":
+            yield from _structured(source, text, _load_json(text))
+        elif path.suffix == ".toml":
+            yield from _structured(source, text, _load_toml(text))
+        else:
+            yield from _pairs(source, text)
+
+
+def _load_json(text: str) -> object:
+    try:
+        return json.loads(text)
+    except ValueError:
+        return None
+
+
+def _load_toml(text: str) -> object:
+    try:
+        return tomllib.loads(text)
+    except tomllib.TOMLDecodeError:
+        return None
+
+
+def _structured(source: SourceId, text: str, data: object) -> Iterator[Literal]:
+    lines = text.splitlines()
+
+    def line_of(key: str) -> int:
+        for number, line in enumerate(lines, start=1):
+            if re.match(rf'^\s*"?{re.escape(key)}"?\s*[:=]', line) or f'"{key}"' in line:
+                return number
+        return 1
+
+    def walk(node: object, key: str | None) -> Iterator[Literal]:
+        if isinstance(node, dict):
+            for name, value in node.items():
+                yield from walk(value, str(name))
+        elif isinstance(node, list):
+            for item in node:
+                yield from walk(item, key)
+        elif isinstance(node, str) and key is not None:
+            yield node, key, SourceSpan(source, line_of(key), 1), None
+
+    yield from walk(data, None)
+
+
+def _pairs(source: SourceId, text: str) -> Iterator[Literal]:
+    for number, line in enumerate(text.splitlines(), start=1):
+        stripped = line.strip()
+        if not stripped or stripped[0] in "#;[":
+            continue
+        match = _PAIR.match(line)
+        if match is None:
+            continue
+        key, value = match.group(1), match.group(2)
+        if value.startswith("#"):
+            continue
+        if len(value) >= 2 and value[0] == value[-1] and value[0] in "'\"":
+            value = value[1:-1]
+        if value:
+            yield value, key, SourceSpan(source, number, 1), None
+
+
+def redacted(value: str) -> str:
+    preview = value[:4] if len(value) > 8 else value[:1]
+    return f"{preview}… ({len(value)} characters)"
+
+
+def is_placeholder(value: str) -> bool:
+    lowered = value.strip().lower()
+    return len(lowered) < 4 or lowered in _PLACEHOLDER_WORDS or _PLACEHOLDER.match(lowered) is not None
+
+
+class SecretDetector(Plugin):
+    """Report hardcoded secrets among the module's string literals."""
+
+    patterns: ClassVar[tuple[SecretPattern, ...]] = ()
+    credential_names: ClassVar[tuple[str, ...]] = ()
+    entropy_threshold: ClassVar[float] = 4.5
+    hex_entropy_threshold: ClassVar[float] = 3.5
+    minimum_length: ClassVar[int] = 32
+
+    def analyze(self, ctx: PluginContext) -> Sequence[Finding]:
+        findings: list[Finding] = []
+        for value, name, span, function in literals(ctx.module):
+            finding = self.judge(value, name, span, function)
+            if finding is not None:
+                findings.append(finding)
+        return findings
+
+    def judge(self, value: str, name: str | None, span: SourceSpan, function: str | None) -> Finding | None:
+        where = f"in {name}" if name is not None else "in a string literal"
+        for pattern in self.patterns:
+            if pattern.matches(value):
+                return Finding(
+                    "hardcoded-secret",
+                    f"Hardcoded {pattern.provider} secret {where}: {redacted(value)}",
+                    Severity.HIGH,
+                    Confidence.HIGH,
+                    span,
+                    function,
+                    {"provider": pattern.provider, "name": name or "", "length": str(len(value))},
+                )
+        if name is not None and self.is_credential_name(name) and not is_placeholder(value):
+            return Finding(
+                "hardcoded-credential",
+                f"Hardcoded credential {where}: {redacted(value)}",
+                Severity.HIGH,
+                Confidence.MEDIUM,
+                span,
+                function,
+                {"name": name, "length": str(len(value))},
+            )
+        entropy = self.entropy_of(value)
+        if entropy is not None:
+            return Finding(
+                "high-entropy-string",
+                f"High-entropy string {where}: {redacted(value)}",
+                Severity.MEDIUM,
+                Confidence.LOW,
+                span,
+                function,
+                {"name": name or "", "length": str(len(value)), "entropy": f"{entropy:.2f}"},
+            )
+        return None
+
+    def is_credential_name(self, name: str) -> bool:
+        lowered = name.lower()
+        if lowered.endswith(_NOT_CREDENTIAL_SUFFIXES):
+            return False
+        return any(word in lowered for word in self.credential_names)
+
+    def entropy_of(self, value: str) -> float | None:
+        """The entropy of ``value`` when it looks like an opaque token, else ``None``."""
+
+        if len(value) < self.minimum_length or _TOKEN.match(value) is None:
+            return None
+        entropy = shannon_entropy(value)
+        threshold = self.hex_entropy_threshold if _HEX.match(value) else self.entropy_threshold
+        return entropy if entropy >= threshold else None

coretrace_python/reporters/__init__.py

@@ -0,0 +1,22 @@
+"""Reporters render normalized findings and never run an analysis (architecture §28)."""
+
+from __future__ import annotations
+
+from collections.abc import Callable, Mapping
+from types import MappingProxyType
+
+from coretrace_python.reporters.json_format import render_json
+from coretrace_python.reporters.report import Report
+from coretrace_python.reporters.sarif import render_sarif
+from coretrace_python.reporters.text import render_text
+
+FORMATS: Mapping[str, Callable[[Report], str]] = MappingProxyType(
+    {"text": render_text, "json": render_json, "sarif": render_sarif}
+)
+
+
+def render(format_name: str, report: Report) -> str:
+    return FORMATS[format_name](report)
+
+
+__all__ = ["FORMATS", "Report", "render", "render_json", "render_sarif", "render_text"]

coretrace_python/reporters/json_format.py

@@ -0,0 +1,48 @@
+"""JSON reporter: versioned normalized finding records."""
+
+from __future__ import annotations
+
+import json
+
+from coretrace_python.findings import FINDING_SCHEMA_VERSION, Finding
+from coretrace_python.reporters.report import Report
+
+
+def finding_record(finding: Finding) -> dict[str, object]:
+    span = finding.span
+    return {
+        "rule_id": finding.rule_id,
+        "message": finding.message,
+        "severity": finding.severity.value,
+        "confidence": finding.confidence.value,
+        "location": {
+            "path": str(span.source_id),
+            "line": span.start_line,
+            "column": span.start_column,
+            "end_line": span.end_line,
+            "end_column": span.end_column,
+        },
+        "function": finding.function,
+        "metadata": dict(finding.metadata),
+    }
+
+
+def render_json(report: Report) -> str:
+    document = {
+        "schema_version": FINDING_SCHEMA_VERSION,
+        "tool": {"name": report.tool_name, "version": report.tool_version},
+        "findings": [finding_record(finding) for finding in report.findings],
+    }
+    if report.coverage is not None:
+        coverage = report.coverage
+        document["coverage"] = {
+            "files": coverage.files,
+            "files_analysed": coverage.files_analysed,
+            "functions": coverage.functions,
+            "functions_analysed": coverage.functions_analysed,
+            "details": [
+                {"path": d.path, "status": d.status, "functions": d.functions, "analysed": d.analysed}
+                for d in coverage.details
+            ],
+        }
+    return json.dumps(document, indent=2) + "\n"

coretrace_python/reporters/report.py

@@ -0,0 +1,23 @@
+"""The normalized report every reporter renders (architecture §23, §28)."""
+
+from __future__ import annotations
+
+from dataclasses import dataclass
+
+from coretrace_python.findings import Coverage, Finding
+
+
+def _order(finding: Finding) -> tuple[str, int, int, str]:
+    span = finding.span
+    return (str(span.source_id), span.start_line, span.start_column, finding.rule_id)
+
+
+@dataclass(frozen=True)
+class Report:
+    findings: tuple[Finding, ...]
+    tool_name: str
+    tool_version: str
+    coverage: Coverage | None = None
+
+    def __post_init__(self) -> None:
+        object.__setattr__(self, "findings", tuple(sorted(self.findings, key=_order)))

coretrace_python/reporters/sarif.py

@@ -0,0 +1,70 @@
+"""SARIF 2.1.0 reporter."""
+
+from __future__ import annotations
+
+import json
+
+from coretrace_python.findings import Finding, Severity
+from coretrace_python.reporters.report import Report
+
+SARIF_VERSION = "2.1.0"
+SARIF_SCHEMA = "https://json.schemastore.org/sarif-2.1.0.json"
+
+_LEVELS = {
+    Severity.CRITICAL: "error",
+    Severity.HIGH: "error",
+    Severity.MEDIUM: "warning",
+    Severity.LOW: "note",
+    Severity.INFO: "note",
+}
+
+
+def _result(finding: Finding, rule_index: int) -> dict[str, object]:
+    span = finding.span
+    region: dict[str, int] = {"startLine": span.start_line, "startColumn": span.start_column}
+    if span.end_line is not None and span.end_column is not None:
+        region["endLine"] = span.end_line
+        region["endColumn"] = span.end_column
+    return {
+        "ruleId": finding.rule_id,
+        "ruleIndex": rule_index,
+        "level": _LEVELS[finding.severity],
+        "message": {"text": finding.message},
+        "locations": [
+            {
+                "physicalLocation": {
+                    "artifactLocation": {"uri": str(span.source_id)},
+                    "region": region,
+                }
+            }
+        ],
+    }
+
+
+def render_sarif(report: Report) -> str:
+    rule_ids: list[str] = []
+    for finding in report.findings:
+        if finding.rule_id not in rule_ids:
+            rule_ids.append(finding.rule_id)
+    document = {
+        "$schema": SARIF_SCHEMA,
+        "version": SARIF_VERSION,
+        "runs": [
+            {
+                "tool": {
+                    "driver": {
+                        "name": report.tool_name,
+                        "version": report.tool_version,
+                        "rules": [
+                            {"id": rule_id, "shortDescription": {"text": rule_id}}
+                            for rule_id in rule_ids
+                        ],
+                    }
+                },
+                "results": [
+                    _result(finding, rule_ids.index(finding.rule_id)) for finding in report.findings
+                ],
+            }
+        ],
+    }
+    return json.dumps(document, indent=2) + "\n"

coretrace_python/reporters/text.py

@@ -0,0 +1,24 @@
+"""Plain-text reporter: one ``path:line:column`` line per finding and a summary."""
+
+from __future__ import annotations
+
+from coretrace_python.reporters.report import Report
+
+
+def render_text(report: Report) -> str:
+    lines = []
+    for finding in report.findings:
+        span = finding.span
+        line = (
+            f"{span.source_id}:{span.start_line}:{span.start_column}: "
+            f"{finding.severity.value} {finding.rule_id}: {finding.message}"
+        )
+        if finding.function is not None:
+            line += f" [{finding.function}]"
+        lines.append(line)
+    count = len(report.findings)
+    summary = "no findings" if count == 0 else f"{count} finding{'s' if count > 1 else ''}"
+    lines.append(summary)
+    if report.coverage is not None:
+        lines.append(report.coverage.summary())
+    return "\n".join(lines) + "\n"

coretrace_python/semantic/__init__.py

@@ -0,0 +1,9 @@
+"""Semantic analyses computed from PyHIR: scopes, imports and symbols."""
+
+from coretrace_python.semantic.imports import ImportAnalysis
+from coretrace_python.semantic.scopes import ScopeAnalysis
+from coretrace_python.semantic.symbols import SymbolAnalysis
+
+SEMANTIC_ANALYSES = (ScopeAnalysis, ImportAnalysis, SymbolAnalysis)
+
+__all__ = ["SEMANTIC_ANALYSES", "ImportAnalysis", "ScopeAnalysis", "SymbolAnalysis"]