coretrace-python-analyzer 0.1.0__py3-none-any.whl

coretrace_python/taint/models.py

@@ -0,0 +1,317 @@
+"""Security model registry (architecture §16, §17).
+
+Taint kinds form a bitset joined with ``|``. Plugins register sources, sinks and
+sanitizers keyed by canonical symbol; the engine freezes them into an immutable
+``ModelTable`` and provides it to the Analysis Manager as the ``taint.models`` input,
+so every detector consumes the same models and the same taint result.
+"""
+
+from __future__ import annotations
+
+import hashlib
+import re
+from dataclasses import dataclass, field
+from enum import Flag, auto
+from types import MappingProxyType
+from typing import ClassVar
+
+from coretrace_python.analysis import Analysis, AnalysisContext, MissingInputError
+from coretrace_python.semantic.symbols import SymbolId
+
+
+class TaintKind(Flag):
+    NONE = 0
+    SQL = auto()
+    COMMAND = auto()
+    HTML = auto()
+    PATH = auto()
+    SSRF = auto()
+    CODE = auto()
+    ADVISORY = auto()
+    DESERIALIZATION = auto()
+    REDIRECT = auto()
+    ALL = SQL | COMMAND | HTML | PATH | SSRF | CODE | ADVISORY | DESERIALIZATION | REDIRECT
+    # Outside ALL on purpose: only credential-named parameters carry it, so a database
+    # write reached by ordinary input is not a plaintext credential.
+    CREDENTIAL = auto()
+
+
+class ModelError(Exception):
+    """Two models of the same kind claim the same symbol."""
+
+
+@dataclass(frozen=True)
+class Source:
+    """A symbol whose value, or call result, is attacker-controlled."""
+
+    symbol: SymbolId
+    label: str
+    kinds: TaintKind = TaintKind.ALL
+
+
+@dataclass(frozen=True)
+class Sink:
+    """A callable whose arguments must not carry the given taint kinds. ``positions``
+    restricts some kinds to argument positions: a SQL statement is the first argument
+    of ``execute``, its parameter tuple is not a statement."""
+
+    symbol: SymbolId
+    kinds: TaintKind
+    positions: tuple[tuple[TaintKind, tuple[int, ...]], ...] = ()
+
+    def kinds_at(self, position: int | None) -> TaintKind:
+        """The kinds that must not reach the argument at ``position`` (``None`` for a
+        keyword or starred argument)."""
+
+        kinds = self.kinds
+        for restricted, allowed in self.positions:
+            if position is None or position not in allowed:
+                kinds &= ~restricted
+        return kinds
+
+
+@dataclass(frozen=True)
+class Sanitizer:
+    """A callable whose result no longer carries the given taint kinds."""
+
+    symbol: SymbolId
+    kinds: TaintKind
+
+
+@dataclass(frozen=True)
+class EntryPoint:
+    """Functions decorated by ``symbol``, and methods of classes deriving from it,
+    receive attacker-controlled parameters."""
+
+    symbol: SymbolId
+    label: str
+    kinds: TaintKind = TaintKind.ALL
+
+
+@dataclass(frozen=True)
+class TypedParameter:
+    """A parameter annotated with ``symbol`` is attacker-controlled."""
+
+    symbol: SymbolId
+    label: str
+    kinds: TaintKind = TaintKind.ALL
+
+
+@dataclass(frozen=True)
+class NamedParameter:
+    """Parameters whose name matches ``pattern`` carry ``kinds`` (``password`` is a
+    credential wherever it is a parameter)."""
+
+    pattern: str
+    label: str
+    kinds: TaintKind
+
+    @property
+    def symbol(self) -> SymbolId:
+        digest = hashlib.sha1(self.pattern.encode("utf-8")).hexdigest()[:12]
+        return SymbolId(f"python.parameter.p{digest}")
+
+    def matches(self, name: str) -> bool:
+        return re.search(self.pattern, name) is not None
+
+
+@dataclass(frozen=True)
+class RouteRegistrar:
+    """A call registering a handler elsewhere (``path('login/', views.log_in)``): the
+    function or class referenced by ``argument`` (or ``keyword``) is an entry point."""
+
+    symbol: SymbolId
+    argument: int
+    label: str
+    kinds: TaintKind = TaintKind.ALL
+    keyword: str | None = None
+
+
+@dataclass(frozen=True)
+class SuffixSink:
+    """A sink matched by the tail of a call's symbol (``objects.raw`` for any model)."""
+
+    suffix: str
+    kinds: TaintKind
+    positions: tuple[tuple[TaintKind, tuple[int, ...]], ...] = ()
+
+    @property
+    def symbol(self) -> SymbolId:
+        return SymbolId(f"python.suffix.{self.suffix.replace('.', '_')}")
+
+
+@dataclass(frozen=True)
+class Validator:
+    """A callable whose truth proves its ``argument`` safe (refutation evidence, §24)."""
+
+    symbol: SymbolId
+    kinds: TaintKind = TaintKind.ALL
+    argument: int = 0
+
+
+@dataclass(frozen=True)
+class AuthorizationGuard:
+    """A decorator, or a condition, that restricts who reaches the code behind it; a
+    flow behind one is a hotspot rather than a vulnerability (§24)."""
+
+    symbol: SymbolId
+    label: str
+
+
+Model = (
+    Source
+    | Sink
+    | Sanitizer
+    | EntryPoint
+    | TypedParameter
+    | Validator
+    | AuthorizationGuard
+    | NamedParameter
+    | RouteRegistrar
+    | SuffixSink
+)
+
+
+@dataclass(frozen=True)
+class ModelTable:
+    sources: tuple[Source, ...]
+    sinks: tuple[Sink, ...]
+    sanitizers: tuple[Sanitizer, ...]
+    entry_points: tuple[EntryPoint, ...] = ()
+    typed_parameters: tuple[TypedParameter, ...] = ()
+    validators: tuple[Validator, ...] = ()
+    authorizations: tuple[AuthorizationGuard, ...] = ()
+    named_parameters: tuple[NamedParameter, ...] = ()
+    route_registrars: tuple[RouteRegistrar, ...] = ()
+    suffix_sinks: tuple[SuffixSink, ...] = ()
+    _by_symbol: dict[type[Model], dict[SymbolId, Model]] = field(
+        init=False, repr=False, compare=False
+    )
+
+    def __post_init__(self) -> None:
+        index: dict[type[Model], dict[SymbolId, Model]] = {
+            Source: {m.symbol: m for m in self.sources},
+            Sink: {m.symbol: m for m in self.sinks},
+            Sanitizer: {m.symbol: m for m in self.sanitizers},
+            EntryPoint: {m.symbol: m for m in self.entry_points},
+            TypedParameter: {m.symbol: m for m in self.typed_parameters},
+            Validator: {m.symbol: m for m in self.validators},
+            AuthorizationGuard: {m.symbol: m for m in self.authorizations},
+            RouteRegistrar: {m.symbol: m for m in self.route_registrars},
+        }
+        object.__setattr__(self, "_by_symbol", MappingProxyType(index))
+
+    def entry_point(self, symbol: SymbolId) -> EntryPoint | None:
+        found = self._by_symbol[EntryPoint].get(symbol)
+        return found if isinstance(found, EntryPoint) else None
+
+    def typed_parameter(self, symbol: SymbolId) -> TypedParameter | None:
+        found = self._by_symbol[TypedParameter].get(symbol)
+        return found if isinstance(found, TypedParameter) else None
+
+    def validator(self, symbol: SymbolId) -> Validator | None:
+        found = self._by_symbol[Validator].get(symbol)
+        return found if isinstance(found, Validator) else None
+
+    def authorization(self, symbol: SymbolId) -> AuthorizationGuard | None:
+        found = self._by_symbol[AuthorizationGuard].get(symbol)
+        return found if isinstance(found, AuthorizationGuard) else None
+
+    def source(self, symbol: SymbolId) -> Source | None:
+        found = self._by_symbol[Source].get(symbol)
+        return found if isinstance(found, Source) else None
+
+    def source_covering(self, symbol: SymbolId) -> Source | None:
+        """The source registered for ``symbol`` or for the closest symbol above it, so a
+        source on ``flask.request.args`` also covers ``flask.request.args.get``."""
+
+        parts = symbol.canonical_name.split(".")
+        for length in range(len(parts), 1, -1):
+            found = self.source(SymbolId(".".join(parts[:length])))
+            if found is not None:
+                return found
+        return None
+
+    def sink(self, symbol: SymbolId) -> Sink | None:
+        found = self._by_symbol[Sink].get(symbol)
+        if isinstance(found, Sink):
+            return found
+        for suffix in self.suffix_sinks:
+            if symbol.canonical_name.endswith(f".{suffix.suffix}"):
+                return Sink(symbol, suffix.kinds, suffix.positions)
+        return None
+
+    def route_registrar(self, symbol: SymbolId) -> RouteRegistrar | None:
+        found = self._by_symbol[RouteRegistrar].get(symbol)
+        return found if isinstance(found, RouteRegistrar) else None
+
+    def extended(self, *sinks: Sink) -> ModelTable:
+        """A table with extra sinks; a sink already present gains the new kinds."""
+
+        merged = {sink.symbol: sink for sink in self.sinks}
+        for sink in sinks:
+            current = merged.get(sink.symbol)
+            merged[sink.symbol] = (
+                Sink(sink.symbol, current.kinds | sink.kinds, current.positions + sink.positions)
+                if current is not None
+                else sink
+            )
+        return ModelTable(
+            self.sources,
+            tuple(merged.values()),
+            self.sanitizers,
+            self.entry_points,
+            self.typed_parameters,
+            self.validators,
+            self.authorizations,
+            self.named_parameters,
+            self.route_registrars,
+            self.suffix_sinks,
+        )
+
+    def sanitizer(self, symbol: SymbolId) -> Sanitizer | None:
+        found = self._by_symbol[Sanitizer].get(symbol)
+        return found if isinstance(found, Sanitizer) else None
+
+
+class SecurityModelRegistry:
+    """Mutable collection point for the models plugins register."""
+
+    def __init__(self) -> None:
+        self._models: dict[tuple[type[Model], SymbolId], Model] = {}
+
+    def register(self, *models: Model) -> None:
+        for model in models:
+            key = (type(model), model.symbol)
+            if key in self._models:
+                raise ModelError(
+                    f"{type(model).__name__.lower()} model for {model.symbol} is already registered"
+                )
+            self._models[key] = model
+
+    def freeze(self) -> ModelTable:
+        models = list(self._models.values())
+        return ModelTable(
+            sources=tuple(m for m in models if isinstance(m, Source)),
+            sinks=tuple(m for m in models if isinstance(m, Sink)),
+            sanitizers=tuple(m for m in models if isinstance(m, Sanitizer)),
+            entry_points=tuple(m for m in models if isinstance(m, EntryPoint)),
+            typed_parameters=tuple(m for m in models if isinstance(m, TypedParameter)),
+            validators=tuple(m for m in models if isinstance(m, Validator)),
+            authorizations=tuple(m for m in models if isinstance(m, AuthorizationGuard)),
+            named_parameters=tuple(m for m in models if isinstance(m, NamedParameter)),
+            route_registrars=tuple(m for m in models if isinstance(m, RouteRegistrar)),
+            suffix_sinks=tuple(m for m in models if isinstance(m, SuffixSink)),
+        )
+
+
+class SecurityModelAnalysis(Analysis[ModelTable]):
+    """The frozen model table, provided by the engine rather than computed."""
+
+    name: ClassVar[str] = "taint.models"
+
+    @classmethod
+    def compute(cls, ctx: AnalysisContext) -> ModelTable:
+        raise MissingInputError(
+            f"{cls.name} must be provided to the analysis manager before it is requested"
+        )

coretrace_python/taint/routes.py

@@ -0,0 +1,99 @@
+"""Entry points registered away from their definition (architecture §16, §25).
+
+Django views are plain functions listed in ``urls.py``; Flask and FastAPI applications
+can register handlers programmatically too. A ``RouteRegistrar`` model names the
+registering call and the argument that references the handler. The engine scans every
+module of a project for such calls before analysing and provides the result as the
+``taint.routes`` input, so a registered function, or the methods of a registered class,
+receive attacker-controlled parameters wherever they are defined.
+"""
+
+from __future__ import annotations
+
+from collections.abc import Iterator, Mapping
+from typing import ClassVar
+
+from coretrace_python.analysis import Analysis, AnalysisContext
+from coretrace_python.hir import nodes
+from coretrace_python.hir.visitors import Node, children
+from coretrace_python.interprocedural import project_symbol
+from coretrace_python.semantic.scopes import ScopeTable
+from coretrace_python.semantic.symbols import SymbolId, SymbolTable
+from coretrace_python.taint.models import EntryPoint, ModelTable
+
+Routes = Mapping[SymbolId, EntryPoint]
+
+
+class RegisteredRoutes(Analysis[Routes]):
+    """Project symbols registered as handlers, provided by the engine; empty on its own."""
+
+    name: ClassVar[str] = "taint.routes"
+
+    @classmethod
+    def compute(cls, ctx: AnalysisContext) -> Routes:
+        return {}
+
+
+def registered_routes(
+    module: nodes.Module, scopes: ScopeTable, symbols: SymbolTable, models: ModelTable
+) -> dict[SymbolId, EntryPoint]:
+    """The handlers this module registers, as project symbols, with the entry point the
+    registrar grants them."""
+
+    scope = scopes.module_scope.id
+    defined = {
+        s.name for s in module.body if isinstance(s, nodes.Function | nodes.Class)
+    }
+    found: dict[SymbolId, EntryPoint] = {}
+    for call in _calls(module.body):
+        callee = symbols.resolve_expression(scope, call.callee)
+        registrar = models.route_registrar(callee) if callee is not None else None
+        if registrar is None:
+            continue
+        handler: nodes.Expression | None = None
+        if registrar.argument < len(call.arguments):
+            handler = call.arguments[registrar.argument]
+        elif registrar.keyword is not None:
+            handler = next((k.value for k in call.keywords if k.name == registrar.keyword), None)
+        if handler is None:
+            continue
+        target = _handler_symbol(handler, module, symbols, scope, defined)
+        if target is not None:
+            found.setdefault(target, EntryPoint(registrar.symbol, registrar.label, registrar.kinds))
+    return found
+
+
+def _handler_symbol(
+    handler: nodes.Expression,
+    module: nodes.Module,
+    symbols: SymbolTable,
+    scope: object,
+    defined: set[str],
+) -> SymbolId | None:
+    if isinstance(handler, nodes.Call):
+        # ``NoteView.as_view()``: the class is the handler.
+        handler = handler.callee
+    if isinstance(handler, nodes.Attribute) and handler.name == "as_view":
+        handler = handler.value
+    symbol = symbols.resolve_expression(scope, handler)  # type: ignore[arg-type]
+    if symbol is not None:
+        return symbol
+    if isinstance(handler, nodes.Name) and handler.identifier in defined:
+        return project_symbol(module.name, handler.identifier)
+    return None
+
+
+def _calls(body: tuple[nodes.Statement, ...]) -> Iterator[nodes.Call]:
+    for statement in body:
+        if isinstance(statement, nodes.Function | nodes.Class):
+            continue
+        yield from _calls_in(statement)
+
+
+def _calls_in(node: Node) -> Iterator[nodes.Call]:
+    if isinstance(node, nodes.Function | nodes.Class | nodes.Lambda | nodes.Comprehension):
+        return
+    if isinstance(node, nodes.Call):
+        yield node
+    for child in children(node):
+        yield from _calls_in(child)

coretrace_python_analyzer-0.1.0.dist-info/METADATA

@@ -0,0 +1,74 @@
+Metadata-Version: 2.5
+Name: coretrace-python-analyzer
+Version: 0.1.0
+Summary: Static security analysis infrastructure for Python code
+Project-URL: Homepage, https://github.com/CoreTrace/coretrace-python-analyzer
+Project-URL: Repository, https://github.com/CoreTrace/coretrace-python-analyzer
+Project-URL: Issues, https://github.com/CoreTrace/coretrace-python-analyzer/issues
+Author: CoreTrace
+License: Apache-2.0
+Keywords: python,sast,security,static-analysis,taint
+Classifier: Development Status :: 4 - Beta
+Classifier: Environment :: Console
+Classifier: Intended Audience :: Developers
+Classifier: License :: OSI Approved :: Apache Software License
+Classifier: Programming Language :: Python :: 3
+Classifier: Programming Language :: Python :: 3.11
+Classifier: Programming Language :: Python :: 3.12
+Classifier: Programming Language :: Python :: 3.13
+Classifier: Topic :: Security
+Classifier: Topic :: Software Development :: Quality Assurance
+Requires-Python: >=3.11
+Provides-Extra: dev
+Requires-Dist: build>=1.2; extra == 'dev'
+Requires-Dist: mypy>=1.15; extra == 'dev'
+Requires-Dist: pytest>=8.0; extra == 'dev'
+Requires-Dist: ruff>=0.9; extra == 'dev'
+Requires-Dist: twine>=5.0; extra == 'dev'
+Description-Content-Type: text/markdown
+
+# CoreTrace Python Analyzer
+
+A standalone static security analyzer for Python. It finds injection vulnerabilities by
+following attacker-controlled data through the program, across functions, files, objects
+and closures, and judges each flow against the guards on its path; it reports dangerous
+API usage, secrets committed in sources and configuration, and vulnerable or forbidden
+dependencies, correlated with the code that reaches them. It runs offline, on a file or a
+whole project, with no runtime dependency.
+
+```bash
+pip install coretrace-python-analyzer
+coretrace-python-analyzer --check src/ --format sarif > report.sarif
+```
+
+- [Usage guide](docs/usage.md): command line, rules, report formats, dependencies and
+  advisories, cache and parallelism, continuous integration.
+- [Writing a plugin](docs/plugins.md): models for another framework, detectors for
+  another rule, secret patterns and project-wide checks.
+- [Architecture](docs/architecture.md): the engine's design and its migration plan.
+
+The pipeline: source manager, parser-independent high-level representation (PyHIR),
+semantic resolution of imports and scopes, lowering to a small intermediate
+representation (PyIR), control-flow graphs, SSA, data-flow and abstract interpretation,
+interprocedural summaries, taint and refutation, then plugins and reporters.
+
+## Development
+
+```bash
+python -m venv .venv
+python -m pip install -e ".[dev]"
+python -m mypy
+python -m pytest
+python -m ruff check .
+```
+
+The non-regression suite analyses the public repositories pinned in
+[`tests/regression/repositories.toml`](tests/regression/repositories.toml) and compares
+findings and coverage with the snapshots in `tests/regression/expected/`. It clones on
+first use, needs the network and runs in its own CI job:
+
+```bash
+python -m pytest -m regression
+CORETRACE_REGRESSION_UPDATE=1 python -m pytest -m regression   # record an intended change
+```
+

coretrace_python_analyzer-0.1.0.dist-info/RECORD

@@ -0,0 +1,126 @@
+coretrace_python/__init__.py,sha256=eutxN_wsAP00U-4iZdzViOyOKyUlbDgVeatEdvXDSQ4,75
+coretrace_python/__main__.py,sha256=V8DnYtRboISK2VCKm7DGHLREKvqLbqApyWlKBOs26wU,65
+coretrace_python/cache.py,sha256=CGA-5IpBF60rZc8StfhMRwzGxbG_PSluMyAIRi2AatI,10674
+coretrace_python/cli.py,sha256=jgZMY7-HjZDiN4i2d4qvG_2ryZzUYzM2aEuS_XVm6r4,7966
+coretrace_python/engine.py,sha256=1BYreAq6urpxefoBaQkto8SvaFXQB9EaKpTafttRBEw,25748
+coretrace_python/abstract/__init__.py,sha256=n5FNkV8Z4LmwG0r06KWdLj4N2CPSgAKwY3896tdmRgM,999
+coretrace_python/abstract/constants.py,sha256=z4-e7IzysxzGi58wFFff1MlEoV8l7AZsB9EL-q6b7vY,9071
+coretrace_python/abstract/heap.py,sha256=OaESXFGC0qzyhAr76xrCu4skeDVzZM4wlenQqfMTkdk,9642
+coretrace_python/abstract/ranges.py,sha256=zEl9ee55u3E02tkYzzIvCCud5mYRKIUgZd9h_0-crCM,11547
+coretrace_python/abstract/values.py,sha256=SQmgR8jo7cd8KJFDokejg-cFTjJU1CTBUPYyEvbMg-4,1739
+coretrace_python/analysis/__init__.py,sha256=hE7lDwXOdA05_aSZaERRgMv0C2ev8jjJbz4xvrja4Og,728
+coretrace_python/analysis/manager.py,sha256=suoIrPwimyu1AjF6BJwpqAkJBwe6XxzQu9JwV2TN2aQ,5843
+coretrace_python/analysis/provider.py,sha256=Q_OlEcoLzBAsNdAGWijbj_n3E2Ep5UQ4Z8_skqA5Ui8,2211
+coretrace_python/bundled/dependency/dependency_policy/dependency_policy.py,sha256=_CJYHijv4DTgfdumcCqAVV5_MPWjfZOadxeM5pQdw_k,1845
+coretrace_python/bundled/dependency/dependency_policy/plugin.toml,sha256=4w1TA-UKsa82WTnd1xy4bJuU3_G2RNCAWNICLPcZLMk,210
+coretrace_python/bundled/dependency/reachable_vulnerability/plugin.toml,sha256=LuF9jQqZfplN_GBky69Xjq2pksaX1Fs8PYEir-7-vY8,275
+coretrace_python/bundled/dependency/reachable_vulnerability/reachable_vulnerability.py,sha256=jMNw7-ly4Bhjh3gaUDW7z43HOoQPH9f17M3sZ8HtK2M,2507
+coretrace_python/bundled/dependency/sample_advisories/plugin.toml,sha256=cME4pSFzkFsxmIJGGBSrmXqynAd0dg34X-rgEoZ_u6E,184
+coretrace_python/bundled/dependency/sample_advisories/sample_advisories.py,sha256=uViz4fvg2-u7jFKPtPY2G0yPhr_8Ba09exZc-fcZ2w8,3649
+coretrace_python/bundled/dependency/vulnerable_dependency/plugin.toml,sha256=FbmiXLEqtPUZEsDc5q_UqCzn6AecL5HCSdGVy7_2dy0,238
+coretrace_python/bundled/dependency/vulnerable_dependency/vulnerable_dependency.py,sha256=Mu4pOhNrfxds-qsFr9_DZOAQHaW2QAKxwelQEpm41vU,1871
+coretrace_python/bundled/models/cli/cli_models.py,sha256=BfeXGLbS-3EnzYrJMhZeViQO9ZUZB-EFtxobWj-oW8M,977
+coretrace_python/bundled/models/cli/plugin.toml,sha256=D2gkrL1lWc6b4ME_C0hjzwZHJX1l_OChRs3_oapam_s,163
+coretrace_python/bundled/models/credentials/credential_models.py,sha256=Mw9ty8PDDyLNPtbPTTm-sIY9XE8gBsi02dPmLeum2kE,1423
+coretrace_python/bundled/models/credentials/plugin.toml,sha256=0ut7Jc7IdcvbsZKPu6ty-z3DBlMg2CUT7JX4y4nMybo,217
+coretrace_python/bundled/models/django/django_models.py,sha256=87NCkJ5BKWgF_kXnKLJC_tfsQAjqbhkE4o022_bkrok,5339
+coretrace_python/bundled/models/django/plugin.toml,sha256=_Qa2X_4IViORQkcLvLsAC5vI-2P5CxgG8VvnuNIWcFQ,214
+coretrace_python/bundled/models/fastapi/fastapi_models.py,sha256=K2Edlo1RzYKmAJAIChNVUDc8gorAS48MGEMKNlCIGrI,1251
+coretrace_python/bundled/models/fastapi/plugin.toml,sha256=V_R2WcEc-qkST0tTpL-cRf2FEbjK6Mk727WbJmVpWJM,200
+coretrace_python/bundled/models/flask/flask_models.py,sha256=CVspfwmn56fMg8LlhgZUm351_Zw8d8InNv_UZcoIusg,2171
+coretrace_python/bundled/models/flask/plugin.toml,sha256=kI53Xwf5aZKd2n3fEQEbBzNnOXRvuonqEazTOIXPJP4,192
+coretrace_python/bundled/models/http_clients/http_client_models.py,sha256=TmVIg66zRRQxx3C9RT2XX6xLhemm037hIIBFRSyKzU0,1273
+coretrace_python/bundled/models/http_clients/plugin.toml,sha256=vq9tWHgy8-m8LiU1StGhm9Lsy7vnj3w90P4AKDaKfc0,216
+coretrace_python/bundled/models/python_stdlib/plugin.toml,sha256=DWqjG68rx91HCJi_VEp6tUs4ujkzlR7Lq7saMvtK2HM,187
+coretrace_python/bundled/models/python_stdlib/python_stdlib.py,sha256=y88cIJ5Jfw7qCAgvHsXYu7BmVhhCBv66qk4FN0Moh84,3234
+coretrace_python/bundled/models/sqlalchemy/plugin.toml,sha256=2gRbglnMK5U2QWnzs2U2pDvmTeWmrlW7XpJ_8dRmIoY,182
+coretrace_python/bundled/models/sqlalchemy/sqlalchemy_models.py,sha256=Gm2qjyXUrjzALy-MigUhPQyyDxYdfWlQKDZLp1C6Jqk,1697
+coretrace_python/bundled/secrets/config_secrets/config_secrets.py,sha256=JfhWSyVbjlYD9pQYJN6qAc4Rp4IA8PP222akM4KTPU8,1283
+coretrace_python/bundled/secrets/config_secrets/plugin.toml,sha256=dRkA3zQ9wtT2EJyqZ5zGqJ5KYdyIQtQcSvesqrb4M0Q,177
+coretrace_python/bundled/secrets/hardcoded_secrets/hardcoded_secrets.py,sha256=7TD-Nf5S4yfoRBRmJ6Ab6v4Q2zIC2n79FRfNS3I4xos,544
+coretrace_python/bundled/secrets/hardcoded_secrets/plugin.toml,sha256=bkhRJFUrTFP2LiggDP3PkQpC0REtTq8aWrqlkYzxVHc,231
+coretrace_python/bundled/security/command_injection/command_injection.py,sha256=d8CgmU0tWyhuLk_GTaUQHQaWlKIxC5TDY-K370tdyhE,573
+coretrace_python/bundled/security/command_injection/plugin.toml,sha256=x9NUpwdVZsTQpaPNX3HoYcrZWk4sOGN-aSp9Bc8jvCA,240
+coretrace_python/bundled/security/insecure_deserialization/insecure_deserialization.py,sha256=-4KIQDaYo-09gSceuNEs3eutmBn2OBuYBTqiUEYOatk,637
+coretrace_python/bundled/security/insecure_deserialization/plugin.toml,sha256=5OTVO9jZN-HBid8v__jYkxU-RnKX974Qqu7JQMFdj54,268
+coretrace_python/bundled/security/open_redirect/open_redirect.py,sha256=nUjVIgYhVh_2xBs8_1LOfcLDgQ3g3z1E7APqg2sBdpo,562
+coretrace_python/bundled/security/open_redirect/plugin.toml,sha256=8t4KLNG1DIpjjen6TuKxMjz2jv6GDcwVJDm_hJUalCg,224
+coretrace_python/bundled/security/path_traversal/path_traversal.py,sha256=MiTDZBNU6i3WWua1qaxg1swqDy3wlWwBwG6G4ClyDgw,552
+coretrace_python/bundled/security/path_traversal/plugin.toml,sha256=f0ADZimUvQatOffltF5Ihu1mkzf5rNrsaIpKBg2v39c,228
+coretrace_python/bundled/security/plaintext_credentials/plaintext_credentials.py,sha256=QaE2CXAdl0bi4dE5d2d8KnLJrsAcxUDjR76ghfsnXXo,900
+coretrace_python/bundled/security/plaintext_credentials/plugin.toml,sha256=W56wUdAdf7NNirfQhTdKrn-cCwebqmvkRJg9OVFJUyM,263
+coretrace_python/bundled/security/sql_injection/plugin.toml,sha256=U35h6YdbbM93Ar_msWrwY98_bb6rN-qaa1e7XOtPeSo,224
+coretrace_python/bundled/security/sql_injection/sql_injection.py,sha256=W-ppZngb9mLwRjJPGkh__8kaDqYdSrVbciv0mPdYFNE,545
+coretrace_python/bundled/security/ssrf/plugin.toml,sha256=OySYgL9rGh1f4UuVpEOWdgcyp0vAmaP1m2IJ8Al6Ddc,189
+coretrace_python/bundled/security/ssrf/ssrf.py,sha256=bshcPZMjuQtTR4203CUTxFGZuwIYfsi58rnE5XdqKXc,549
+coretrace_python/bundled/security/xss/plugin.toml,sha256=o6aZWoDNCG6CJ11JDa5lVR0v6NHh-Jg5QpNRxoGSJaw,185
+coretrace_python/bundled/security/xss/xss.py,sha256=hzhoblPMivtwoWZ4v7YyAb15GGisX_imGWgxFzCDeqA,532
+coretrace_python/bundled/syntax/dangerous_eval/dangerous_eval.py,sha256=_ktrigLDf-XTKjWtYX-_wZ9-Gb3G4bCzRhpU0Xj-c1g,723
+coretrace_python/bundled/syntax/dangerous_eval/plugin.toml,sha256=97Eyrcet1jcewAIPa78IKYz9XgiOVsZSJ4vWYdMer2I,200
+coretrace_python/bundled/syntax/flask_debug/flask_debug.py,sha256=28OH3_Im_c_xsMxrjpXmCoBHvLOHQ4DT77dFBAwafbs,2596
+coretrace_python/bundled/syntax/flask_debug/plugin.toml,sha256=bz_6Njz6PAgK-o-yFBWB3U2g2vX6_5cFTfwrkkyQmGA,210
+coretrace_python/bundled/syntax/missing_timeout/missing_timeout.py,sha256=fp_IZDhCdaXR6A5tqvWUA-7jCUxqPpB5zRJH_jnaJQQ,2359
+coretrace_python/bundled/syntax/missing_timeout/plugin.toml,sha256=ZsoxXj_a1RxyhIt8FjwnaWDKvX0xpe8eGEof0WP_BwY,226
+coretrace_python/bundled/syntax/weak_crypto/plugin.toml,sha256=fTAnNZZ7N8-2WVJbmtQ3gJzKfBV5eTUkPfiPzj7R-aM,188
+coretrace_python/bundled/syntax/weak_crypto/weak_crypto.py,sha256=OAOuYR1f4Lc_JxdiHs1wxRRKC4K1kayg5REFIlHK71k,671
+coretrace_python/cfg/__init__.py,sha256=2bJEVjyyVwwciPvxiZuNAOpSVO36yutNRGc-7R54EXw,836
+coretrace_python/cfg/builder.py,sha256=bZdSz2LNDOz-DyQ4wu05s1yxpUCSrgOJZ8hpmcA2YgM,27859
+coretrace_python/cfg/dominance.py,sha256=QpM4-mKVMxe75ZLyqx2_1x-4v5WJd9iDqIdi4C7S7rQ,6602
+coretrace_python/cfg/model.py,sha256=6EJiXFAGrsMgCdyxMJ6TClY8tQhJF6Hq2bX802Gc0yg,5308
+coretrace_python/dataflow/__init__.py,sha256=N5uY8VTNjEk6-ARCgDkxr6uGqQIz2NbF-U9sC_v_lfA,547
+coretrace_python/dataflow/lattice.py,sha256=HgYGVcKVUlexvEc0yT47aQCudLxU_SWLpHhr17igkiE,1929
+coretrace_python/dataflow/solver.py,sha256=iDsW0wujhM2DXplu2JMKC46BRsroXlNETHPEoikPeG4,3475
+coretrace_python/dependency/__init__.py,sha256=JOa2OupSyMe6COiSF9Cah6kcdqYJewFprWi9-E1Je6Q,983
+coretrace_python/dependency/advisories.py,sha256=BDZatgUvxeW8vOLLnGax49gSPBO3yiRlUHcPpaZKeMc,6333
+coretrace_python/dependency/correlation.py,sha256=psRKsca9W8Mr790VfFHIjGiblE0k4onKIW-Y2nlt8I0,3562
+coretrace_python/dependency/graph.py,sha256=LIH8PdBBzpqNsic8tQHQmO8LuTJXEHSDHDGnW0mKjwc,10812
+coretrace_python/dependency/policy.py,sha256=u6nUw2nX-kTuqmw_vooxN8eXZoC31ZMoMaxC9pCcwec,2317
+coretrace_python/dependency/sbom.py,sha256=h4K3Gb9O_D6uZyfpwpC5rPcNjH_Ib-3uvFxix6OKlfs,2520
+coretrace_python/findings/__init__.py,sha256=gnJI-uB2CkgZ8I5aFYP_N5yZb7FGNIy7LirVDh4NLwo,372
+coretrace_python/findings/coverage.py,sha256=U8URLEz6EN4B_TTQlLFCOtEmUbINt7a0Bexb-6OUFlI,1203
+coretrace_python/findings/model.py,sha256=lUfefeq3tyYrTu8lA11JbYcHi_JleqWBL3vh7R89E1c,1147
+coretrace_python/findings/refutation.py,sha256=wL26drcy0JB-qHlRpb4jaYWej209GxTi2tt5SWnfCFw,17465
+coretrace_python/frontend/__init__.py,sha256=ULI2tf_IRTMboaKM6uzTkGGh4Agy3cFjtw2H1IPrz4g,627
+coretrace_python/frontend/ast_adapter.py,sha256=oFILfv3NElabtqA-v4xskb0ztz4_ya_dgErDB3s2Yx4,21661
+coretrace_python/frontend/parser.py,sha256=6-CG7rWxUYeOGeDP206SJWy4BMQUP9Mr6Jf-thaFm0s,669
+coretrace_python/hir/__init__.py,sha256=xMpvj-RSp6bd78a_hhkqbe99-snjERkH-_Lv5o9ASbw,180
+coretrace_python/hir/nodes.py,sha256=xvVJq1QmdjKsrS3nuSO8Uf1nX_1aZAyE6ZdCudi-_KY,11843
+coretrace_python/hir/visitors.py,sha256=JFnX09hK6trLyRcWgZ5ehOG2ywX3VvkqQ1h82nahYNg,885
+coretrace_python/interprocedural/__init__.py,sha256=uWnJK9v_ZCXiA-2Z64nkLuyUg1EOAhnVkJ3WxHZhsVM,1014
+coretrace_python/interprocedural/callgraph.py,sha256=ZtOip87-TgQ_DYLhDiR5Z03VsU0jxUVNgMkEkDuNZ4Q,12380
+coretrace_python/interprocedural/modulegraph.py,sha256=0UIKtxxAfTV7WW4B0xcJgVnD-Z6KRS3hpOTMshj1E_U,8595
+coretrace_python/interprocedural/summaries.py,sha256=BLB6nbWZFIHe54Cj1p64jhOLYm9xc1qvJmpoWQi-clw,17657
+coretrace_python/ir/__init__.py,sha256=ShBPYYqoQFePP-mgBjGezQ2acel0-ReOHF9vCC-G_4Q,232
+coretrace_python/ir/defuse.py,sha256=CZEPnlgntRp4MqwR7kLldd2ZlIlBnr-V9VJAxXxwm0c,2616
+coretrace_python/ir/lowering.py,sha256=1Ctuiq_TWzSuNg5eJe438wQ-bve6toKI4VNQJPLlGXE,25739
+coretrace_python/ir/model.py,sha256=cugasB1E05jLAoQyWkGQHvPMsyDEcyL5tbagKqYqRgU,10520
+coretrace_python/ir/printer.py,sha256=iMwFitjwFIM0gelpZelmzTWefwLdxOc37DlPkywI7is,8800
+coretrace_python/ir/ssa.py,sha256=cIYbcv90PI6AOeMrw2ZWp88fy7E2ZO4P3tqjtPHra7g,11116
+coretrace_python/plugins/__init__.py,sha256=Jh5oLVI_Rc7ZzibsMjJzg69LGeNcRRjLcY5XaVOhjgA,1308
+coretrace_python/plugins/api.py,sha256=y1bicTdPypstWs7aJ4JDIOSVKX-MwFq5NSjGntTZhDw,5309
+coretrace_python/plugins/detectors.py,sha256=RcCSsPpFiq4CTrC0IzXTXEAAWoMQXMAhAARgp182f7g,4781
+coretrace_python/plugins/loader.py,sha256=e7S6l3VhMpku0HpnAl5qbBRFiOlsSf66P7low7RsRvU,3174
+coretrace_python/plugins/manifest.py,sha256=F24pgQSwApRUL6ZihRSLv9wL_M03A_pZjrj9Zi4Ku3Q,3438
+coretrace_python/plugins/registry.py,sha256=ixKcT2YDky96TWCFckdzKnGRmFn1dbBVMSZLPvdxvY8,1177
+coretrace_python/plugins/secrets.py,sha256=SqoejVzHHRKn0vSiWBlmN-VEGXX3QgbcgBQ0zG_hkMk,12494
+coretrace_python/reporters/__init__.py,sha256=MHTEfIj5q1KvFeIm6aAzt4mwL8oCZMkpYlaAGaq_cdo,764
+coretrace_python/reporters/json_format.py,sha256=IvtyN2u3w-fYEtrTZtAJu_7L2NRr29B8IIVJBny9L88,1633
+coretrace_python/reporters/report.py,sha256=V2_MQwtChhU65vyiVSBFi4tXs9YKdEMWD5MxQ3470UY,654
+coretrace_python/reporters/sarif.py,sha256=FOmNX2_QzcEGRFMRwPHMt5ckJKp6UTKEwioOTTdD5tU,2125
+coretrace_python/reporters/text.py,sha256=0X6PZYjYdpNlXnAovkH6g4kWZkcIUcT5-5tycM3RF7I,854
+coretrace_python/semantic/__init__.py,sha256=_tjT9CgXfPbOMs8EFguhWrLeSmpyrqOHU_OSoQPiWYs,411
+coretrace_python/semantic/identity.py,sha256=uQBdqEXrOtYmGIiR9hZu0Pimv52iW1rOOOvIdG0InNY,1472
+coretrace_python/semantic/imports.py,sha256=389MZs8iTUc3CyUHG0VAgWFsypd7VPFKkLHmFz9L-N0,5673
+coretrace_python/semantic/scopes.py,sha256=ZCSu2XRo042BC8Ksj-drMUDIQfpBgcM83x368H2M2kI,19526
+coretrace_python/semantic/symbols.py,sha256=3JptnnX5_KBlSd00L_wcGlYZQdnmBvSBAhfivBF6DLo,3513
+coretrace_python/source/__init__.py,sha256=0Y8fvtbkETnNCJR9Zq7RS5TSgF9c22pz3SSk1KdAXF0,301
+coretrace_python/source/manager.py,sha256=JRmMOcWfS1nocbVrdcvfQTqEfIkmnb5JP857TpGywN4,2736
+coretrace_python/source/model.py,sha256=FZnN5mlir3tzbIpWoxnn6YtRi9UcJ_y0sZM60tKr8U4,1727
+coretrace_python/taint/__init__.py,sha256=D-NH3kx9wKTNeWASewawGAx7ChOkGMGhmjf-E4crHl0,1111
+coretrace_python/taint/engine.py,sha256=NEDJryXqCgc0l8STZ3fSMx-aD-8BO5z8YZLnAgaC7Pw,32452
+coretrace_python/taint/models.py,sha256=s7luO5vMaowxPcWoThkLTEdYuyw0JZZVkaKYW5o_xOI,10930
+coretrace_python/taint/routes.py,sha256=0ICYweRBktlXC0nZYIPi9rxHYEddJXAg_sAc7f_8Ie4,3865
+coretrace_python_analyzer-0.1.0.dist-info/METADATA,sha256=CI39rQWDZ48ltOrKGltLAkYRR-LFzz13stLxCBnP3Nk,3148
+coretrace_python_analyzer-0.1.0.dist-info/WHEEL,sha256=zOwg4jB6zX2kU910N-cMawjivD6tO8NEWvE12je1bVk,87
+coretrace_python_analyzer-0.1.0.dist-info/entry_points.txt,sha256=wdozemiraOkbt65g_Y_zgspuZpoLxJdaCVMJt1Ft3c0,72
+coretrace_python_analyzer-0.1.0.dist-info/RECORD,,

coretrace_python_analyzer-0.1.0.dist-info/WHEEL

@@ -0,0 +1,4 @@
+Wheel-Version: 1.0
+Generator: hatchling 1.32.0
+Root-Is-Purelib: true
+Tag: py3-none-any

coretrace_python_analyzer-0.1.0.dist-info/entry_points.txt

@@ -0,0 +1,2 @@
+[console_scripts]
+coretrace-python-analyzer = coretrace_python.cli:main