coretrace-python-analyzer 0.1.0__py3-none-any.whl

coretrace_python/bundled/models/python_stdlib/python_stdlib.py

@@ -0,0 +1,68 @@
+"""Security models for the Python standard library (architecture §16)."""
+
+from __future__ import annotations
+
+from typing import ClassVar
+
+from coretrace_python.plugins import ModelPlugin
+from coretrace_python.semantic.symbols import SymbolId
+from coretrace_python.taint import Model, Sanitizer, Sink, Source, TaintKind, Validator
+
+
+def _sym(path: str) -> SymbolId:
+    return SymbolId(f"python.{path}")
+
+
+class PythonStdlibModels(ModelPlugin):
+    name: ClassVar[str] = "python-stdlib-models"
+    models: ClassVar[tuple[Model, ...]] = (
+        Source(_sym("builtins.input"), "stdin"),
+        Source(_sym("sys.stdin"), "stdin"),
+        # A command-line tool is expected to open the paths it is given.
+        Source(_sym("sys.argv"), "argv", TaintKind.ALL & ~TaintKind.PATH),
+        Source(_sym("os.environ"), "environment"),
+        Source(_sym("subprocess.run.stdout"), "process-output"),
+        Source(_sym("subprocess.check_output"), "process-output"),
+        Source(_sym("subprocess.getoutput"), "process-output"),
+        Source(_sym("subprocess.Popen.communicate"), "process-output"),
+        Sink(_sym("os.system"), TaintKind.COMMAND),
+        Sink(_sym("os.popen"), TaintKind.COMMAND),
+        Sink(_sym("subprocess.run"), TaintKind.COMMAND),
+        Sink(_sym("subprocess.call"), TaintKind.COMMAND),
+        Sink(_sym("subprocess.check_call"), TaintKind.COMMAND),
+        Sink(_sym("subprocess.check_output"), TaintKind.COMMAND),
+        Sink(_sym("subprocess.Popen"), TaintKind.COMMAND),
+        Sink(_sym("builtins.eval"), TaintKind.CODE),
+        Sink(_sym("builtins.exec"), TaintKind.CODE),
+        Sink(_sym("builtins.open"), TaintKind.PATH),
+        Sink(_sym("os.remove"), TaintKind.PATH),
+        Sink(_sym("os.unlink"), TaintKind.PATH),
+        Sink(_sym("os.rmdir"), TaintKind.PATH),
+        Sink(_sym("shutil.rmtree"), TaintKind.PATH),
+        Sink(_sym("urllib.request.urlopen"), TaintKind.SSRF),
+        *(
+            Sink(
+                _sym(f"sqlite3.connect{cursor}.{method}"),
+                TaintKind.SQL | TaintKind.CREDENTIAL,
+                ((TaintKind.SQL, (0,)),),
+            )
+            for cursor in ("", ".cursor")
+            for method in ("execute", "executemany", "executescript")
+        ),
+        Sanitizer(_sym("shlex.quote"), TaintKind.COMMAND),
+        Sanitizer(_sym("html.escape"), TaintKind.HTML),
+        Sink(_sym("pickle.loads"), TaintKind.DESERIALIZATION),
+        Sink(_sym("pickle.load"), TaintKind.DESERIALIZATION),
+        Sink(_sym("pickle.Unpickler"), TaintKind.DESERIALIZATION),
+        Sink(_sym("marshal.loads"), TaintKind.DESERIALIZATION),
+        Sink(_sym("marshal.load"), TaintKind.DESERIALIZATION),
+        Sink(_sym("shelve.open"), TaintKind.DESERIALIZATION),
+        Sink(_sym("dill.loads"), TaintKind.DESERIALIZATION),
+        Sink(_sym("jsonpickle.decode"), TaintKind.DESERIALIZATION),
+        Sink(_sym("yaml.load"), TaintKind.DESERIALIZATION),
+        Sink(_sym("yaml.unsafe_load"), TaintKind.DESERIALIZATION),
+        Sink(_sym("yaml.full_load"), TaintKind.DESERIALIZATION),
+        Sanitizer(_sym("os.path.basename"), TaintKind.PATH),
+        Validator(_sym("re.fullmatch"), argument=1),
+        Validator(_sym("re.compile.fullmatch")),
+    )

coretrace_python/bundled/models/sqlalchemy/plugin.toml

@@ -0,0 +1,9 @@
+name = "sqlalchemy-models"
+version = "1.0.0"
+plugin_api = ">=1,<2"
+requires = []
+provides = ["model.sql-sinks"]
+
+[entrypoint]
+module = "sqlalchemy_models"
+class = "SqlAlchemyModels"

coretrace_python/bundled/models/sqlalchemy/sqlalchemy_models.py

@@ -0,0 +1,47 @@
+"""SQLAlchemy security models: raw SQL execution sinks.
+
+Symbols follow the engine's call-chain rule: the result of calling a symbol denotes
+that symbol, so ``create_engine(url).connect().execute`` is
+``python.sqlalchemy.create_engine.connect.execute``.
+"""
+
+from __future__ import annotations
+
+from typing import ClassVar
+
+from coretrace_python.plugins import ModelPlugin
+from coretrace_python.semantic.symbols import SymbolId
+from coretrace_python.taint import Model, Sanitizer, Sink, TaintKind
+
+_EXECUTORS = (
+    "sqlalchemy.create_engine",
+    "sqlalchemy.create_engine.connect",
+    "sqlalchemy.create_engine.begin",
+    "sqlalchemy.engine.create_engine",
+    "sqlalchemy.engine.create_engine.connect",
+    "sqlalchemy.orm.Session",
+    "sqlalchemy.orm.sessionmaker",
+    "sqlalchemy.orm.scoped_session",
+)
+
+
+_TEXT_MODULES = ("sqlalchemy", "sqlalchemy.sql", "sqlalchemy.sql.expression")
+
+
+def _sym(path: str) -> SymbolId:
+    return SymbolId(f"python.{path}")
+
+
+class SqlAlchemyModels(ModelPlugin):
+    name: ClassVar[str] = "sqlalchemy-models"
+    models: ClassVar[tuple[Model, ...]] = (
+        *(
+            Sink(_sym(f"{executor}.{method}"), TaintKind.SQL | TaintKind.CREDENTIAL, ((TaintKind.SQL, (0,)),))
+            for executor in _EXECUTORS
+            for method in ("execute", "exec_driver_sql", "scalar", "scalars")
+        ),
+        # ``text()`` is where SQL text is committed: a sink, and its result carries no
+        # further SQL taint so the ``execute`` that follows does not report it twice.
+        *(Sink(_sym(f"{module}.text"), TaintKind.SQL) for module in _TEXT_MODULES),
+        *(Sanitizer(_sym(f"{module}.text"), TaintKind.SQL) for module in _TEXT_MODULES),
+    )

coretrace_python/bundled/secrets/config_secrets/config_secrets.py

@@ -0,0 +1,38 @@
+"""Hardcoded secrets in configuration files: ``.env``, YAML, TOML, JSON, INI, properties.
+
+Judged with the same rules as the Python literal detector, once per project.
+"""
+
+from __future__ import annotations
+
+from collections.abc import Sequence
+from typing import ClassVar
+
+from coretrace_python.findings import Finding
+from coretrace_python.plugins import PluginContext, ProjectContext, ProjectPlugin
+from coretrace_python.plugins.secrets import (
+    DEFAULT_CREDENTIAL_NAMES,
+    DEFAULT_PATTERNS,
+    SecretDetector,
+    SecretPattern,
+    config_literals,
+)
+
+
+class ConfigSecrets(SecretDetector, ProjectPlugin):
+    name: ClassVar[str] = "config-secrets"
+    patterns: ClassVar[tuple[SecretPattern, ...]] = DEFAULT_PATTERNS
+    credential_names: ClassVar[tuple[str, ...]] = DEFAULT_CREDENTIAL_NAMES
+
+    def analyze(self, ctx: PluginContext) -> Sequence[Finding]:
+        return ()
+
+    def analyze_project(self, ctx: ProjectContext) -> Sequence[Finding]:
+        if ctx.root is None:
+            return ()
+        findings: list[Finding] = []
+        for value, name, span, function in config_literals(ctx.root):
+            finding = self.judge(value, name, span, function)
+            if finding is not None:
+                findings.append(finding)
+        return findings

coretrace_python/bundled/secrets/config_secrets/plugin.toml

@@ -0,0 +1,9 @@
+name = "config-secrets"
+version = "1.0.0"
+plugin_api = ">=1,<2"
+requires = []
+provides = ["secret.config-files"]
+
+[entrypoint]
+module = "config_secrets"
+class = "ConfigSecrets"

coretrace_python/bundled/secrets/hardcoded_secrets/hardcoded_secrets.py

@@ -0,0 +1,19 @@
+"""Hardcoded secrets in Python literals: provider formats, credential-like names,
+high-entropy tokens."""
+
+from __future__ import annotations
+
+from typing import ClassVar
+
+from coretrace_python.plugins.secrets import (
+    DEFAULT_CREDENTIAL_NAMES,
+    DEFAULT_PATTERNS,
+    SecretDetector,
+    SecretPattern,
+)
+
+
+class HardcodedSecrets(SecretDetector):
+    name: ClassVar[str] = "hardcoded-secrets"
+    patterns: ClassVar[tuple[SecretPattern, ...]] = DEFAULT_PATTERNS
+    credential_names: ClassVar[tuple[str, ...]] = DEFAULT_CREDENTIAL_NAMES

coretrace_python/bundled/secrets/hardcoded_secrets/plugin.toml

@@ -0,0 +1,9 @@
+name = "hardcoded-secrets"
+version = "1.0.0"
+plugin_api = ">=1,<2"
+requires = []
+provides = ["secret.provider-patterns", "secret.credentials", "secret.entropy"]
+
+[entrypoint]
+module = "hardcoded_secrets"
+class = "HardcodedSecrets"

coretrace_python/bundled/security/command_injection/command_injection.py

@@ -0,0 +1,17 @@
+"""Command injection: attacker-controlled input reaching a COMMAND sink."""
+
+from __future__ import annotations
+
+from typing import ClassVar
+
+from coretrace_python.findings import Severity
+from coretrace_python.plugins import TaintDetector
+from coretrace_python.taint import TaintKind
+
+
+class CommandInjectionPlugin(TaintDetector):
+    name: ClassVar[str] = "command-injection"
+    rule_id: ClassVar[str] = "command-injection"
+    kind: ClassVar[TaintKind] = TaintKind.COMMAND
+    severity: ClassVar[Severity] = Severity.HIGH
+    title: ClassVar[str] = "Command injection"

coretrace_python/bundled/security/command_injection/plugin.toml

@@ -0,0 +1,9 @@
+name = "command-injection"
+version = "1.0.0"
+plugin_api = ">=1,<2"
+requires = ["taint.flows", "findings.refutation"]
+provides = ["vulnerability.command-injection"]
+
+[entrypoint]
+module = "command_injection"
+class = "CommandInjectionPlugin"

coretrace_python/bundled/security/insecure_deserialization/insecure_deserialization.py

@@ -0,0 +1,17 @@
+"""Insecure deserialization: attacker-controlled input reaching a insecure deserialization sink."""
+
+from __future__ import annotations
+
+from typing import ClassVar
+
+from coretrace_python.findings import Severity
+from coretrace_python.plugins import TaintDetector
+from coretrace_python.taint import TaintKind
+
+
+class InsecureDeserializationPlugin(TaintDetector):
+    name: ClassVar[str] = "insecure-deserialization"
+    rule_id: ClassVar[str] = "insecure-deserialization"
+    kind: ClassVar[TaintKind] = TaintKind.DESERIALIZATION
+    severity: ClassVar[Severity] = Severity.CRITICAL
+    title: ClassVar[str] = "Insecure deserialization"

coretrace_python/bundled/security/insecure_deserialization/plugin.toml

@@ -0,0 +1,9 @@
+name = "insecure-deserialization"
+version = "1.0.0"
+plugin_api = ">=1,<2"
+requires = ["taint.flows", "findings.refutation"]
+provides = ["vulnerability.insecure-deserialization"]
+
+[entrypoint]
+module = "insecure_deserialization"
+class = "InsecureDeserializationPlugin"

coretrace_python/bundled/security/open_redirect/open_redirect.py

@@ -0,0 +1,17 @@
+"""Open redirect: attacker-controlled input reaching a open redirect sink."""
+
+from __future__ import annotations
+
+from typing import ClassVar
+
+from coretrace_python.findings import Severity
+from coretrace_python.plugins import TaintDetector
+from coretrace_python.taint import TaintKind
+
+
+class OpenRedirectPlugin(TaintDetector):
+    name: ClassVar[str] = "open-redirect"
+    rule_id: ClassVar[str] = "open-redirect"
+    kind: ClassVar[TaintKind] = TaintKind.REDIRECT
+    severity: ClassVar[Severity] = Severity.MEDIUM
+    title: ClassVar[str] = "Open redirect"

coretrace_python/bundled/security/open_redirect/plugin.toml

@@ -0,0 +1,9 @@
+name = "open-redirect"
+version = "1.0.0"
+plugin_api = ">=1,<2"
+requires = ["taint.flows", "findings.refutation"]
+provides = ["vulnerability.open-redirect"]
+
+[entrypoint]
+module = "open_redirect"
+class = "OpenRedirectPlugin"

coretrace_python/bundled/security/path_traversal/path_traversal.py

@@ -0,0 +1,17 @@
+"""Path traversal: attacker-controlled input reaching a PATH sink."""
+
+from __future__ import annotations
+
+from typing import ClassVar
+
+from coretrace_python.findings import Severity
+from coretrace_python.plugins import TaintDetector
+from coretrace_python.taint import TaintKind
+
+
+class PathTraversalPlugin(TaintDetector):
+    name: ClassVar[str] = "path-traversal"
+    rule_id: ClassVar[str] = "path-traversal"
+    kind: ClassVar[TaintKind] = TaintKind.PATH
+    severity: ClassVar[Severity] = Severity.HIGH
+    title: ClassVar[str] = "Path traversal"

coretrace_python/bundled/security/path_traversal/plugin.toml

@@ -0,0 +1,9 @@
+name = "path-traversal"
+version = "1.0.0"
+plugin_api = ">=1,<2"
+requires = ["taint.flows", "findings.refutation"]
+provides = ["vulnerability.path-traversal"]
+
+[entrypoint]
+module = "path_traversal"
+class = "PathTraversalPlugin"

coretrace_python/bundled/security/plaintext_credentials/plaintext_credentials.py

@@ -0,0 +1,21 @@
+"""Plaintext credentials in database queries: a password-named parameter reaching a
+database statement without passing through a hashing function, whether the statement
+stores it or compares it, since comparing in clear implies storing in clear. A name is
+a hint, so medium confidence."""
+
+from __future__ import annotations
+
+from typing import ClassVar
+
+from coretrace_python.findings import Confidence, Severity
+from coretrace_python.plugins import TaintDetector
+from coretrace_python.taint import TaintKind
+
+
+class PlaintextCredentialsPlugin(TaintDetector):
+    name: ClassVar[str] = "plaintext-credentials"
+    rule_id: ClassVar[str] = "plaintext-credential-storage"
+    kind: ClassVar[TaintKind] = TaintKind.CREDENTIAL
+    severity: ClassVar[Severity] = Severity.HIGH
+    confidence: ClassVar[Confidence] = Confidence.MEDIUM
+    title: ClassVar[str] = "Plaintext credential in a database query"

coretrace_python/bundled/security/plaintext_credentials/plugin.toml

@@ -0,0 +1,9 @@
+name = "plaintext-credentials"
+version = "1.0.0"
+plugin_api = ">=1,<2"
+requires = ["taint.flows", "findings.refutation"]
+provides = ["vulnerability.plaintext-credential-storage"]
+
+[entrypoint]
+module = "plaintext_credentials"
+class = "PlaintextCredentialsPlugin"

coretrace_python/bundled/security/sql_injection/plugin.toml

@@ -0,0 +1,9 @@
+name = "sql-injection"
+version = "1.0.0"
+plugin_api = ">=1,<2"
+requires = ["taint.flows", "findings.refutation"]
+provides = ["vulnerability.sql-injection"]
+
+[entrypoint]
+module = "sql_injection"
+class = "SqlInjectionPlugin"

coretrace_python/bundled/security/sql_injection/sql_injection.py

@@ -0,0 +1,17 @@
+"""SQL injection: attacker-controlled input reaching a SQL sink."""
+
+from __future__ import annotations
+
+from typing import ClassVar
+
+from coretrace_python.findings import Severity
+from coretrace_python.plugins import TaintDetector
+from coretrace_python.taint import TaintKind
+
+
+class SqlInjectionPlugin(TaintDetector):
+    name: ClassVar[str] = "sql-injection"
+    rule_id: ClassVar[str] = "sql-injection"
+    kind: ClassVar[TaintKind] = TaintKind.SQL
+    severity: ClassVar[Severity] = Severity.HIGH
+    title: ClassVar[str] = "SQL injection"

coretrace_python/bundled/security/ssrf/plugin.toml

@@ -0,0 +1,9 @@
+name = "ssrf"
+version = "1.0.0"
+plugin_api = ">=1,<2"
+requires = ["taint.flows", "findings.refutation"]
+provides = ["vulnerability.ssrf"]
+
+[entrypoint]
+module = "ssrf"
+class = "SsrfPlugin"

coretrace_python/bundled/security/ssrf/ssrf.py

@@ -0,0 +1,17 @@
+"""Server-side request forgery: attacker-controlled input reaching a SSRF sink."""
+
+from __future__ import annotations
+
+from typing import ClassVar
+
+from coretrace_python.findings import Severity
+from coretrace_python.plugins import TaintDetector
+from coretrace_python.taint import TaintKind
+
+
+class SsrfPlugin(TaintDetector):
+    name: ClassVar[str] = "ssrf"
+    rule_id: ClassVar[str] = "ssrf"
+    kind: ClassVar[TaintKind] = TaintKind.SSRF
+    severity: ClassVar[Severity] = Severity.HIGH
+    title: ClassVar[str] = "Server-side request forgery"

coretrace_python/bundled/security/xss/plugin.toml

@@ -0,0 +1,9 @@
+name = "xss"
+version = "1.0.0"
+plugin_api = ">=1,<2"
+requires = ["taint.flows", "findings.refutation"]
+provides = ["vulnerability.xss"]
+
+[entrypoint]
+module = "xss"
+class = "XssPlugin"

coretrace_python/bundled/security/xss/xss.py

@@ -0,0 +1,17 @@
+"""Cross-site scripting: attacker-controlled input reaching a HTML sink."""
+
+from __future__ import annotations
+
+from typing import ClassVar
+
+from coretrace_python.findings import Severity
+from coretrace_python.plugins import TaintDetector
+from coretrace_python.taint import TaintKind
+
+
+class XssPlugin(TaintDetector):
+    name: ClassVar[str] = "xss"
+    rule_id: ClassVar[str] = "xss"
+    kind: ClassVar[TaintKind] = TaintKind.HTML
+    severity: ClassVar[Severity] = Severity.HIGH
+    title: ClassVar[str] = "Cross-site scripting"

coretrace_python/bundled/syntax/dangerous_eval/dangerous_eval.py

@@ -0,0 +1,19 @@
+"""Report calls to the dynamic-code builtins, whatever name the file gives them."""
+
+from __future__ import annotations
+
+from typing import ClassVar
+
+from coretrace_python.findings import Severity
+from coretrace_python.plugins import SymbolCallDetector
+from coretrace_python.semantic.symbols import SymbolId
+
+
+class DangerousEvalPlugin(SymbolCallDetector):
+    name: ClassVar[str] = "dangerous-eval"
+    rule_id: ClassVar[str] = "dangerous-eval"
+    symbols: ClassVar[frozenset[SymbolId]] = frozenset(
+        {SymbolId("python.builtins.eval"), SymbolId("python.builtins.exec")}
+    )
+    severity: ClassVar[Severity] = Severity.HIGH
+    message_template: ClassVar[str] = "call to {symbol} executes dynamically built code"

coretrace_python/bundled/syntax/dangerous_eval/plugin.toml

@@ -0,0 +1,9 @@
+name = "dangerous-eval"
+version = "1.0.0"
+plugin_api = ">=1,<2"
+requires = ["ir.ssa"]
+provides = ["vulnerability.dangerous-eval"]
+
+[entrypoint]
+module = "dangerous_eval"
+class = "DangerousEvalPlugin"

coretrace_python/bundled/syntax/flask_debug/flask_debug.py

@@ -0,0 +1,63 @@
+"""``app.run(debug=True)``: the Werkzeug debugger executes code on any exception."""
+
+from __future__ import annotations
+
+from collections.abc import Iterator, Sequence
+from typing import ClassVar
+
+from coretrace_python.analysis import AnyAnalysis
+from coretrace_python.findings import Confidence, Finding, Severity
+from coretrace_python.hir import nodes
+from coretrace_python.hir.visitors import Node, children
+from coretrace_python.plugins import Plugin, PluginContext
+from coretrace_python.semantic.scopes import ScopeAnalysis, ScopeId, ScopeTable
+from coretrace_python.semantic.symbols import SymbolAnalysis, SymbolId
+
+RUN = SymbolId("python.flask.Flask.run")
+
+
+class FlaskDebugPlugin(Plugin):
+    name: ClassVar[str] = "flask-debug"
+    requires: ClassVar[frozenset[AnyAnalysis]] = frozenset({ScopeAnalysis, SymbolAnalysis})
+
+    def analyze(self, ctx: PluginContext) -> Sequence[Finding]:
+        scopes = ctx.get(ScopeAnalysis)
+        symbols = ctx.get(SymbolAnalysis)
+        findings: list[Finding] = []
+        for call, scope, function in _calls(ctx.module.body, scopes, scopes.module_scope.id, None):
+            if symbols.resolve_expression(scope, call.callee) != RUN:
+                continue
+            if not any(
+                k.name == "debug" and isinstance(k.value, nodes.Constant) and k.value.value is True
+                for k in call.keywords
+            ):
+                continue
+            findings.append(
+                Finding(
+                    "debug-enabled",
+                    "Flask debugger enabled: app.run(debug=True) exposes an interactive "
+                    "debugger able to execute Python on any exception",
+                    Severity.HIGH,
+                    Confidence.HIGH,
+                    call.span,
+                    function,
+                    {"symbol": str(RUN)},
+                )
+            )
+        return findings
+
+
+def _calls(
+    body: Sequence[Node], scopes: ScopeTable, scope: ScopeId, function: str | None
+) -> Iterator[tuple[nodes.Call, ScopeId, str | None]]:
+    for node in body:
+        if isinstance(node, nodes.Function):
+            yield from _calls(node.body, scopes, scopes.scope_for(node).id, node.name)
+        elif isinstance(node, nodes.Class):
+            yield from _calls(node.body, scopes, scopes.scope_for(node).id, None)
+        elif isinstance(node, nodes.Lambda | nodes.Comprehension):
+            continue
+        else:
+            if isinstance(node, nodes.Call):
+                yield node, scope, function
+            yield from _calls(list(children(node)), scopes, scope, function)

coretrace_python/bundled/syntax/flask_debug/plugin.toml

@@ -0,0 +1,9 @@
+name = "flask-debug"
+version = "1.0.0"
+plugin_api = ">=1,<2"
+requires = ["semantic.scopes", "semantic.symbols"]
+provides = ["syntax.flask-debug"]
+
+[entrypoint]
+module = "flask_debug"
+class = "FlaskDebugPlugin"

coretrace_python/bundled/syntax/missing_timeout/missing_timeout.py

@@ -0,0 +1,51 @@
+"""HTTP client calls without a ``timeout``: a slow or silent peer blocks the caller."""
+
+from __future__ import annotations
+
+from collections.abc import Sequence
+from typing import ClassVar
+
+from coretrace_python.analysis import AnyAnalysis
+from coretrace_python.findings import Confidence, Finding, Severity
+from coretrace_python.interprocedural import CallGraphAnalysis
+from coretrace_python.ir.model import Call
+from coretrace_python.ir.ssa import SSAAnalysis
+from coretrace_python.plugins import Plugin, PluginContext
+from coretrace_python.semantic.symbols import SymbolId
+
+_METHODS = ("get", "post", "put", "patch", "delete", "head", "options", "request")
+_CALLERS = ("requests", "requests.Session", "requests.api", "httpx", "httpx.Client", "httpx.AsyncClient")
+HTTP_CALLS = frozenset(SymbolId(f"python.{caller}.{method}") for caller in _CALLERS for method in _METHODS)
+
+
+class MissingTimeoutPlugin(Plugin):
+    name: ClassVar[str] = "missing-timeout"
+    requires: ClassVar[frozenset[AnyAnalysis]] = frozenset({SSAAnalysis, CallGraphAnalysis})
+
+    def analyze(self, ctx: PluginContext) -> Sequence[Finding]:
+        graph = ctx.get(CallGraphAnalysis)
+        findings: list[Finding] = []
+        for function in ctx.functions():
+            symbols = graph.symbols(graph.name_of(function))
+            for block in ctx.get(SSAAnalysis, function).blocks:
+                for instruction in block.instructions:
+                    if not isinstance(instruction, Call):
+                        continue
+                    symbol = symbols.get(instruction.callee)
+                    if symbol is None or symbol not in HTTP_CALLS:
+                        continue
+                    if any(name == "timeout" for name, _ in instruction.keywords):
+                        continue
+                    findings.append(
+                        Finding(
+                            "missing-timeout",
+                            f"{symbol} is called without a timeout; a slow or silent peer "
+                            "blocks this code indefinitely",
+                            Severity.LOW,
+                            Confidence.HIGH,
+                            instruction.location,
+                            function.name,
+                            {"symbol": str(symbol)},
+                        )
+                    )
+        return findings

coretrace_python/bundled/syntax/missing_timeout/plugin.toml

@@ -0,0 +1,9 @@
+name = "missing-timeout"
+version = "1.0.0"
+plugin_api = ">=1,<2"
+requires = ["ir.ssa", "interprocedural.callgraph"]
+provides = ["syntax.missing-timeout"]
+
+[entrypoint]
+module = "missing_timeout"
+class = "MissingTimeoutPlugin"

coretrace_python/bundled/syntax/weak_crypto/plugin.toml

@@ -0,0 +1,9 @@
+name = "weak-crypto"
+version = "1.0.0"
+plugin_api = ">=1,<2"
+requires = ["ir.ssa"]
+provides = ["vulnerability.weak-crypto"]
+
+[entrypoint]
+module = "weak_crypto"
+class = "WeakCryptoPlugin"

coretrace_python/bundled/syntax/weak_crypto/weak_crypto.py

@@ -0,0 +1,19 @@
+"""Report uses of broken hash algorithms."""
+
+from __future__ import annotations
+
+from typing import ClassVar
+
+from coretrace_python.findings import Severity
+from coretrace_python.plugins import SymbolCallDetector
+from coretrace_python.semantic.symbols import SymbolId
+
+
+class WeakCryptoPlugin(SymbolCallDetector):
+    name: ClassVar[str] = "weak-crypto"
+    rule_id: ClassVar[str] = "weak-crypto"
+    symbols: ClassVar[frozenset[SymbolId]] = frozenset(
+        {SymbolId("python.hashlib.md5"), SymbolId("python.hashlib.sha1")}
+    )
+    severity: ClassVar[Severity] = Severity.MEDIUM
+    message_template: ClassVar[str] = "call to {symbol} uses a broken hash algorithm"