coretrace-python-analyzer 0.11.0__py3-none-any.whl → 0.13.0__py3-none-any.whl

coretrace_python/__init__.py

@@ -1,4 +1,4 @@
 """CoreTrace's Python static analysis frontend."""
 
-__version__ = "0.11.0"
+__version__ = "0.13.0"
 

coretrace_python/bundled/models/aiohttp/aiohttp_models.py

@@ -12,6 +12,7 @@ from coretrace_python.semantic.symbols import SymbolId
 from coretrace_python.taint import (
     EntryPoint,
     Model,
+    RequestObject,
     RouteRegistrar,
     Sink,
     Source,
@@ -22,6 +23,23 @@ from coretrace_python.taint import (
 _METHODS = ("get", "post", "put", "patch", "delete", "head", "options")
 _REQUEST_CLASSES = ("aiohttp.web.Request", "aiohttp.web_request.Request")
 _ROUTERS = ("aiohttp.web.Application.router", "aiohttp.web.UrlDispatcher")
+# ``@routes.get('/')`` on a ``RouteTableDef``.
+_ROUTE_TABLES = tuple(f"aiohttp.web.RouteTableDef.{method}" for method in (*_METHODS, "route", "view"))
+# ``app.router.add_route('GET', '/', handler)``, ``app.router.add_get('/', handler)`` and
+# ``app.add_routes([web.get('/', handler)])``, each with the argument naming the handler.
+_ROUTE_CALLS = (
+    *((f"{router}.add_route", 2) for router in _ROUTERS),
+    *((f"{router}.add_{method}", 1) for router in _ROUTERS for method in (*_METHODS, "view")),
+    ("aiohttp.web.route", 2),
+    *((f"aiohttp.web.{method}", 1) for method in (*_METHODS, "view")),
+)
+# What a request gives as text; its body (``json()``, ``text()``, ``read()``) may hold a
+# structure.
+_REQUEST_TEXT = (
+    "query", "rel_url", "url", "path", "raw_path", "path_qs", "query_string", "match_info", "headers",
+    "raw_headers", "cookies", "method", "host", "scheme", "remote", "forwarded", "content_type", "charset",
+    "if_modified_since", "post",
+)
 _REDIRECTS = ("HTTPFound", "HTTPMovedPermanently", "HTTPSeeOther", "HTTPTemporaryRedirect", "HTTPPermanentRedirect")
 _CLIENT_FUNCTIONS = (
     *(f"aiohttp.ClientSession.{method}" for method in (*_METHODS, "request")),
@@ -40,18 +58,12 @@ class AiohttpModels(ModelPlugin):
         # The whole request is attacker-controlled: its query, match info, headers,
         # cookies and body all come from the client.
         *(TypedParameter(_sym(cls), "http") for cls in _REQUEST_CLASSES),
-        # ``@routes.get('/')`` on a ``RouteTableDef``.
-        *(EntryPoint(_sym(f"aiohttp.web.RouteTableDef.{method}"), "http") for method in (*_METHODS, "route", "view")),
-        # ``app.router.add_route('GET', '/', handler)`` and ``app.router.add_get('/', handler)``.
-        *(RouteRegistrar(_sym(f"{router}.add_route"), 2, "http", keyword="handler") for router in _ROUTERS),
+        *(EntryPoint(_sym(table), "http") for table in _ROUTE_TABLES),
+        *(RouteRegistrar(_sym(call), argument, "http", keyword="handler") for call, argument in _ROUTE_CALLS),
         *(
-            RouteRegistrar(_sym(f"{router}.add_{method}"), 1, "http", keyword="handler")
-            for router in _ROUTERS
-            for method in (*_METHODS, "view")
+            RequestObject(_sym(symbol), _REQUEST_TEXT)
+            for symbol in (*_REQUEST_CLASSES, *_ROUTE_TABLES, *(call for call, _ in _ROUTE_CALLS))
         ),
-        # ``app.add_routes([web.get('/', handler)])``: the route definitions name the handler.
-        RouteRegistrar(_sym("aiohttp.web.route"), 2, "http", keyword="handler"),
-        *(RouteRegistrar(_sym(f"aiohttp.web.{method}"), 1, "http", keyword="handler") for method in (*_METHODS, "view")),
         Sink(_sym("aiohttp.web.Response"), TaintKind.HTML),
         Sink(_sym("aiohttp.web.FileResponse"), TaintKind.PATH),
         *(Sink(_sym(f"aiohttp.web.{exception}"), TaintKind.REDIRECT) for exception in _REDIRECTS),

coretrace_python/bundled/models/bottle/bottle_models.py

@@ -8,13 +8,15 @@ from typing import ClassVar
 
 from coretrace_python.plugins import ModelPlugin
 from coretrace_python.semantic.symbols import SymbolId
-from coretrace_python.taint import EntryPoint, Model, Sanitizer, Sink, Source, TaintKind
+from coretrace_python.taint import TEXT_KINDS, EntryPoint, Model, Sanitizer, Sink, Source, TaintKind
 
 _METHODS = ("route", "get", "post", "put", "delete", "patch")
-_REQUEST_ATTRIBUTES = (
-    "query", "forms", "params", "json", "body", "headers", "cookies", "GET", "POST", "files",
+# Text, which cannot hold a query operator; JSON, raw bodies and files may hold a structure.
+_TEXT_ATTRIBUTES = (
+    "query", "forms", "params", "headers", "cookies", "GET", "POST",
     "url", "path", "fullpath", "query_string", "get_cookie", "get_header",
 )
+_PAYLOAD_ATTRIBUTES = ("json", "body", "files")
 _FIRST_ONLY = lambda kind: ((kind, (0,)),)
 
 
@@ -25,9 +27,11 @@ def _sym(path: str) -> SymbolId:
 class BottleModels(ModelPlugin):
     name: ClassVar[str] = "bottle-models"
     models: ClassVar[tuple[Model, ...]] = (
-        *(EntryPoint(_sym(f"bottle.{method}"), "http") for method in _METHODS),
-        *(EntryPoint(_sym(f"bottle.Bottle.{method}"), "http") for method in _METHODS),
-        *(Source(_sym(f"bottle.request.{attribute}"), "http") for attribute in _REQUEST_ATTRIBUTES),
+        # A route's parameters are segments of its URL.
+        *(EntryPoint(_sym(f"bottle.{method}"), "http", TEXT_KINDS) for method in _METHODS),
+        *(EntryPoint(_sym(f"bottle.Bottle.{method}"), "http", TEXT_KINDS) for method in _METHODS),
+        *(Source(_sym(f"bottle.request.{attribute}"), "http", TEXT_KINDS) for attribute in _TEXT_ATTRIBUTES),
+        *(Source(_sym(f"bottle.request.{attribute}"), "http") for attribute in _PAYLOAD_ATTRIBUTES),
         Sink(_sym("bottle.redirect"), TaintKind.REDIRECT, _FIRST_ONLY(TaintKind.REDIRECT)),
         # ``static_file(filename, root)``: the root is the application's own.
         Sink(_sym("bottle.static_file"), TaintKind.PATH, _FIRST_ONLY(TaintKind.PATH)),

coretrace_python/bundled/models/cli/cli_models.py

@@ -6,11 +6,11 @@ from typing import ClassVar
 
 from coretrace_python.plugins import ModelPlugin
 from coretrace_python.semantic.symbols import SymbolId
-from coretrace_python.taint import EntryPoint, Model, TaintKind
+from coretrace_python.taint import TEXT_KINDS, EntryPoint, Model, TaintKind
 
-# A command-line tool is expected to open the paths it is given: argv input carries every
-# kind but PATH.
-ARGV_KINDS = TaintKind.ALL & ~TaintKind.PATH
+# A command-line tool is expected to open the paths it is given: argv input is text,
+# without PATH.
+ARGV_KINDS = TEXT_KINDS & ~TaintKind.PATH
 
 _COMMANDS = (
     "click.command",

coretrace_python/bundled/models/django/django_models.py

@@ -17,6 +17,7 @@ from coretrace_python.taint import (
     AuthorizationGuard,
     EntryPoint,
     Model,
+    RequestObject,
     RouteRegistrar,
     Sanitizer,
     Sink,
@@ -88,6 +89,23 @@ _AUTHORIZATION_DECORATORS = (
 )
 
 
+# What a request object gives as text: the query string, form fields, headers, cookies
+# and path. Its body, its files and REST framework's parsed ``data`` may hold a structure.
+_REQUEST_TEXT = (
+    "GET", "POST", "COOKIES", "META", "headers", "path", "path_info", "method", "scheme", "encoding",
+    "content_type", "content_params", "resolver_match", "get_full_path", "get_full_path_info",
+    "build_absolute_uri", "get_host", "get_port", "get_signed_cookie", "query_params",
+)
+# Every input a request object comes from: an annotated parameter, a class-based view's
+# method or ``self.request``, a decorated view, a view registered in a URL configuration.
+_REQUEST_INPUTS = (
+    *_REQUEST_CLASSES,
+    *_VIEW_BASES,
+    *(f"{base}.request" for base in _VIEW_BASES),
+    *_VIEW_DECORATORS,
+    *_ROUTE_REGISTRARS,
+)
+
 _TARGET_ONLY = ((TaintKind.REDIRECT, (0,)),)
 
 
@@ -103,6 +121,7 @@ class DjangoModels(ModelPlugin):
         # ``self.request`` in a class-based view: the attribute is inherited from the base.
         *(Source(_sym(f"{base}.request"), "http") for base in _VIEW_BASES),
         *(EntryPoint(_sym(decorator), "http") for decorator in _VIEW_DECORATORS),
+        *(RequestObject(_sym(symbol), _REQUEST_TEXT) for symbol in _REQUEST_INPUTS),
         Sink(_sym("django.db.connection.cursor.execute"), TaintKind.SQL | TaintKind.CREDENTIAL, ((TaintKind.SQL, (0,)),)),
         Sink(_sym("django.db.connection.cursor.executemany"), TaintKind.SQL | TaintKind.CREDENTIAL, ((TaintKind.SQL, (0,)),)),
         Sink(_sym("django.db.models.expressions.RawSQL"), TaintKind.SQL | TaintKind.CREDENTIAL),

coretrace_python/bundled/models/flask/flask_models.py

@@ -7,6 +7,7 @@ from typing import ClassVar
 from coretrace_python.plugins import ModelPlugin
 from coretrace_python.semantic.symbols import SymbolId
 from coretrace_python.taint import (
+    TEXT_KINDS,
     AuthorizationGuard,
     EntryPoint,
     Model,
@@ -17,10 +18,10 @@ from coretrace_python.taint import (
     TaintKind,
 )
 
-_REQUEST_ATTRIBUTES = (
-    "args", "form", "values", "json", "data", "cookies", "headers", "files",
-    "get_json", "get_data", "url", "full_path", "path", "query_string", "stream",
-)
+# Strings, or mappings of strings: text, which cannot hold a query operator.
+_TEXT_ATTRIBUTES = ("args", "form", "values", "cookies", "headers", "url", "full_path", "path", "query_string")
+# JSON, and the raw bodies and files a ``json.loads`` may decode into a structure.
+_PAYLOAD_ATTRIBUTES = ("json", "get_json", "data", "get_data", "stream", "files")
 
 
 _TARGET_ONLY = ((TaintKind.REDIRECT, (0,)),)
@@ -33,11 +34,13 @@ def _sym(path: str) -> SymbolId:
 class FlaskModels(ModelPlugin):
     name: ClassVar[str] = "flask-models"
     models: ClassVar[tuple[Model, ...]] = (
-        *(Source(_sym(f"flask.request.{attribute}"), "http") for attribute in _REQUEST_ATTRIBUTES),
-        EntryPoint(_sym("flask.Flask.route"), "http"),
-        EntryPoint(_sym("flask.Blueprint.route"), "http"),
-        RouteRegistrar(_sym("flask.Flask.add_url_rule"), 2, "http", keyword="view_func"),
-        RouteRegistrar(_sym("flask.Blueprint.add_url_rule"), 2, "http", keyword="view_func"),
+        *(Source(_sym(f"flask.request.{attribute}"), "http", TEXT_KINDS) for attribute in _TEXT_ATTRIBUTES),
+        *(Source(_sym(f"flask.request.{attribute}"), "http") for attribute in _PAYLOAD_ATTRIBUTES),
+        # A route's parameters are segments of its URL.
+        EntryPoint(_sym("flask.Flask.route"), "http", TEXT_KINDS),
+        EntryPoint(_sym("flask.Blueprint.route"), "http", TEXT_KINDS),
+        RouteRegistrar(_sym("flask.Flask.add_url_rule"), 2, "http", TEXT_KINDS, keyword="view_func"),
+        RouteRegistrar(_sym("flask.Blueprint.add_url_rule"), 2, "http", TEXT_KINDS, keyword="view_func"),
         Sink(_sym("flask.render_template_string"), TaintKind.HTML),
         Sink(_sym("flask.make_response"), TaintKind.HTML),
         Sink(_sym("flask.Response"), TaintKind.HTML),

coretrace_python/bundled/models/python_stdlib/python_stdlib.py

@@ -7,6 +7,7 @@ from typing import ClassVar
 from coretrace_python.plugins import ModelPlugin
 from coretrace_python.semantic.symbols import SymbolId
 from coretrace_python.taint import (
+    TEXT_KINDS,
     Model,
     SafeArgument,
     Sanitizer,
@@ -16,7 +17,7 @@ from coretrace_python.taint import (
     Validator,
 )
 
-_ENVIRONMENT_KINDS = TaintKind.ALL & ~(TaintKind.COMMAND | TaintKind.PATH)
+_ENVIRONMENT_KINDS = TEXT_KINDS & ~(TaintKind.COMMAND | TaintKind.PATH)
 # SafeLoader and BaseLoader build plain data only, in Python and in C, under every spelling.
 _SAFE_YAML_LOADERS = (
     "python.yaml.SafeLoader",
@@ -38,13 +39,14 @@ def _sym(path: str) -> SymbolId:
 class PythonStdlibModels(ModelPlugin):
     name: ClassVar[str] = "python-stdlib-models"
     models: ClassVar[tuple[Model, ...]] = (
-        Source(_sym("builtins.input"), "stdin"),
+        # A line of text; the stream may be a payload ``json.load`` decodes.
+        Source(_sym("builtins.input"), "stdin", TEXT_KINDS),
         Source(_sym("sys.stdin"), "stdin"),
         # Operator-controlled inputs. A command-line tool is expected to open the paths
         # it is given; the environment is set by whoever runs the program, so a command
         # or a path built from it is not an injection; the output of a local process is
         # not a path either, but a downloaded script piped into a shell is a real flaw.
-        Source(_sym("sys.argv"), "argv", TaintKind.ALL & ~TaintKind.PATH),
+        Source(_sym("sys.argv"), "argv", TEXT_KINDS & ~TaintKind.PATH),
         Source(_sym("os.environ"), "environment", _ENVIRONMENT_KINDS),
         Source(_sym("subprocess.run.stdout"), "process-output", _PROCESS_OUTPUT_KINDS),
         Source(_sym("subprocess.check_output"), "process-output", _PROCESS_OUTPUT_KINDS),

coretrace_python/bundled/models/tornado/tornado_models.py

@@ -8,12 +8,27 @@ from typing import ClassVar
 
 from coretrace_python.plugins import ModelPlugin
 from coretrace_python.semantic.symbols import SymbolId
-from coretrace_python.taint import EntryPoint, Model, Sanitizer, Sink, Source, TaintKind
+from coretrace_python.taint import (
+    TEXT_KINDS,
+    EntryPoint,
+    Model,
+    RequestObject,
+    Sanitizer,
+    Sink,
+    Source,
+    TaintKind,
+)
 
 _HANDLERS = ("tornado.web.RequestHandler", "tornado.websocket.WebSocketHandler")
-_REQUEST_METHODS = (
+# Text, which cannot hold a query operator; the request object holds the raw body too.
+_TEXT_METHODS = (
     "get_argument", "get_arguments", "get_query_argument", "get_query_arguments",
-    "get_body_argument", "get_body_arguments", "get_cookie", "request", "path_args", "path_kwargs",
+    "get_body_argument", "get_body_arguments", "get_cookie", "path_args", "path_kwargs",
+)
+# What ``self.request`` gives as text; its body and files may hold a structure.
+_REQUEST_TEXT = (
+    "arguments", "query_arguments", "body_arguments", "query", "uri", "path", "headers", "cookies",
+    "method", "host", "host_name", "remote_ip", "protocol", "version", "full_url",
 )
 _CLIENTS = ("tornado.httpclient.AsyncHTTPClient.fetch", "tornado.httpclient.HTTPClient.fetch")
 _TARGET_ONLY = ((TaintKind.REDIRECT, (0,)),)
@@ -26,8 +41,13 @@ def _sym(path: str) -> SymbolId:
 class TornadoModels(ModelPlugin):
     name: ClassVar[str] = "tornado-models"
     models: ClassVar[tuple[Model, ...]] = (
-        *(EntryPoint(_sym(handler), "http") for handler in _HANDLERS),
-        *(Source(_sym(f"{handler}.{method}"), "http") for handler in _HANDLERS for method in _REQUEST_METHODS),
+        # A request handler's parameters are segments of its URL; a WebSocket handler also
+        # receives the messages, raw payloads a ``json.loads`` may decode.
+        EntryPoint(_sym("tornado.web.RequestHandler"), "http", TEXT_KINDS),
+        EntryPoint(_sym("tornado.websocket.WebSocketHandler"), "http"),
+        *(Source(_sym(f"{handler}.{method}"), "http", TEXT_KINDS) for handler in _HANDLERS for method in _TEXT_METHODS),
+        *(Source(_sym(f"{handler}.request"), "http") for handler in _HANDLERS),
+        *(RequestObject(_sym(f"{handler}.request"), _REQUEST_TEXT) for handler in _HANDLERS),
         *(Sink(_sym(f"{handler}.write"), TaintKind.HTML) for handler in _HANDLERS),
         *(Sink(_sym(f"{handler}.finish"), TaintKind.HTML) for handler in _HANDLERS),
         *(Sink(_sym(f"{handler}.redirect"), TaintKind.REDIRECT, _TARGET_ONLY) for handler in _HANDLERS),

coretrace_python/bundled/security/nosql_injection/nosql_injection.py

@@ -0,0 +1,20 @@
+"""NoSQL injection: attacker input that may hold a structure reaching a NOSQL sink, such
+as a MongoDB filter, where a JSON body giving ``{"$ne": null}`` matches any value. Text
+input carries no ``NOSQL``: a string cannot hold an operator. The engine ships no NOSQL
+sink; model plugins declare them."""
+
+from __future__ import annotations
+
+from typing import ClassVar
+
+from coretrace_python.findings import Severity
+from coretrace_python.plugins import TaintDetector
+from coretrace_python.taint import TaintKind
+
+
+class NoSqlInjectionPlugin(TaintDetector):
+    name: ClassVar[str] = "nosql-injection"
+    rule_id: ClassVar[str] = "nosql-injection"
+    kind: ClassVar[TaintKind] = TaintKind.NOSQL
+    severity: ClassVar[Severity] = Severity.HIGH
+    title: ClassVar[str] = "NoSQL injection"

coretrace_python/bundled/security/nosql_injection/plugin.toml

@@ -0,0 +1,9 @@
+name = "nosql-injection"
+version = "1.0.0"
+plugin_api = ">=1,<2"
+requires = ["taint.flows", "findings.refutation"]
+provides = ["vulnerability.nosql-injection"]
+
+[entrypoint]
+module = "nosql_injection"
+class = "NoSqlInjectionPlugin"

coretrace_python/engine.py

@@ -109,7 +109,7 @@ from coretrace_python.reporters import Report
 from coretrace_python.semantic import SEMANTIC_ANALYSES
 from coretrace_python.semantic.imports import ImportAnalysis, ImportResolutionError, ImportTable
 from coretrace_python.semantic.scopes import ScopeAnalysis, ScopeError
-from coretrace_python.semantic.symbols import SymbolAnalysis, SymbolId
+from coretrace_python.semantic.symbols import MembersAnalysis, SymbolAnalysis, SymbolId
 from coretrace_python.source import SourceFile, SourceId, SourceManager, SourceSpan, decode_text
 from coretrace_python.taint import (
     EntryPoint,
@@ -257,6 +257,7 @@ def build_manager(
     manager = _register_all(module)
     table = (models or SecurityModelRegistry()).freeze()
     manager.provide(SecurityModelAnalysis, table)
+    manager.provide(MembersAnalysis, table.members_by_class())
     manager.provide(ClearingAnalysis, table.clearing())
     manager.provide(ProjectSummaries, SummaryIndex())
     manager.provide(RegisteredRoutes, _routes_of(manager))
@@ -311,6 +312,7 @@ def analyze_file(source: SourceFile, plugin_roots: Sequence[Path]) -> FileAnalys
     registry = load_plugins(plugin_roots, manager)
     table = plugin_models(loaded.plugin for loaded in registry)
     manager.provide(SecurityModelAnalysis, table)
+    manager.provide(MembersAnalysis, table.members_by_class())
     manager.provide(ClearingAnalysis, table.clearing())
     manager.provide(ProjectSummaries, SummaryIndex())
     manager.provide(RegisteredRoutes, _routes_of(manager))
@@ -402,8 +404,10 @@ def analyze_project(
     advisories, origins = _merge_advisories(_contributions(registry, plugins, root, file_advisories))
     affected = affected_symbols(dependencies, advisories)
     models = plugin_models(all_plugins, root).extended(*advisory_sinks(affected))
+    members = models.members_by_class()
     for manager in managers.values():
         manager.provide(SecurityModelAnalysis, models)
+        manager.provide(MembersAnalysis, members)
         manager.provide(DependencyAnalysis, dependencies)
 
     imports: dict[str, ImportTable] = {}
@@ -698,8 +702,10 @@ def _analyse_batch(batch: _Batch) -> dict[str, dict[str, Any]]:
     models = plugin_models(all_plugins, batch.root).extended(*advisory_sinks(affected))
     routes = _decode_routes(batch.routes)
     escaped = frozenset(batch.escaped)
+    members = models.members_by_class()
     for manager in managers.values():
         manager.provide(SecurityModelAnalysis, models)
+        manager.provide(MembersAnalysis, members)
         manager.provide(DependencyAnalysis, dependencies)
         manager.provide(RegisteredRoutes, routes)
         manager.provide(EscapedTemplates, escaped)

coretrace_python/interprocedural/callgraph.py

@@ -176,12 +176,12 @@ class CallGraph:
 
 
 def derive_symbols(
-    function: FunctionIR, initial: Mapping[Value, SymbolId] | None = None
+    function: FunctionIR, table: SymbolTable, initial: Mapping[Value, SymbolId] | None = None
 ) -> dict[Value, SymbolId]:
-    """Symbols of values: ``Symbol`` results, attributes and items of symbol values,
-    results of calling a symbol (``sqlite3.connect(p)`` denotes ``python.sqlite3.connect``)
-    and the values a ``with`` on such a result binds. Known functions derive nothing;
-    parameters only through ``initial``, their annotated classes."""
+    """Symbols of values: ``Symbol`` results, attributes and items of symbol values, as
+    ``table`` types them, results of calling a symbol (``sqlite3.connect(p)`` denotes
+    ``python.sqlite3.connect``) and the values a ``with`` on such a result binds. Known
+    functions derive nothing; parameters only through ``initial``, their annotated classes."""
 
     symbols: dict[Value, SymbolId] = dict(initial or {})
     changed = True
@@ -195,11 +195,9 @@ def derive_symbols(
                 if isinstance(instruction, Symbol):
                     symbol = instruction.symbol_id
                 elif isinstance(instruction, GetAttr) and instruction.object in symbols:
-                    symbol = symbols[instruction.object].attribute(instruction.attribute)
+                    symbol = table.attribute(symbols[instruction.object], instruction.attribute)
                 elif isinstance(instruction, GetItem) and instruction.object in symbols:
-                    # An item of a symbol-denoted container (``request.files['f']``)
-                    # carries the container's symbol, so its methods resolve.
-                    symbol = symbols[instruction.object]
+                    symbol = table.item(symbols[instruction.object])
                 elif isinstance(instruction, Call | WithEnter):
                     origin = (
                         instruction.callee if isinstance(instruction, Call) else instruction.context
@@ -263,6 +261,8 @@ def resolve_targets(
     owner: str | None = None,
     typed: Mapping[Value, str] | None = None,
     bases: Mapping[str, SymbolId] | None = None,
+    *,
+    table: SymbolTable,
 ) -> tuple[dict[Value, Target], dict[Value, SymbolId]]:
     """Map every callee value of ``function`` to its target, and every symbol value.
     ``nested`` names the functions defined inside this one (``outer.inner``);
@@ -271,7 +271,8 @@ def resolve_targets(
     call to ``App.__init__``, ``app.run()`` and ``self.run()`` calls to ``App.run``.
     ``bases`` maps a module class to the symbol of its base: an attribute the class does
     not define is inherited, so ``self.get_argument`` in a ``RequestHandler`` subclass
-    denotes ``tornado.web.RequestHandler.get_argument``."""
+    denotes ``tornado.web.RequestHandler.get_argument``. ``table`` says what the
+    attributes and items of a class a ``Members`` model describes give."""
 
     module = scopes.module_scope
     classes = classes or {}
@@ -294,8 +295,8 @@ def resolve_targets(
                 class_name = instance_of[instruction.object]
                 base = (bases or {}).get(class_name)
                 if base is not None and instruction.attribute not in classes.get(class_name, ()):
-                    inherited[instruction.result] = base.attribute(instruction.attribute)
-    symbols = derive_symbols(function, inherited)
+                    inherited[instruction.result] = table.attribute(base, instruction.attribute)
+    symbols = derive_symbols(function, table, inherited)
     targets: dict[Value, Target] = {
         value: ExternalSymbol(symbol) for value, symbol in symbols.items()
     }
@@ -427,6 +428,7 @@ class CallGraphAnalysis(Analysis[CallGraph]):
                 owner,
                 _typed_with_module_classes(function, ssa, classes),
                 bases,
+                table=table,
             )
             defs = {i.result: i for block in ssa.blocks for i in block.instructions if i.result is not None}
             found: list[CallSite] = []

coretrace_python/ir/lowering.py

@@ -141,7 +141,7 @@ class _FunctionLowerer:
             return self.symbols.resolve(self.scope.id, node.identifier)
         if isinstance(node, nodes.Attribute):
             parent = self.imported_symbol(node.value)
-            return parent.attribute(node.name) if parent is not None else None
+            return self.symbols.attribute(parent, node.name) if parent is not None else None
         return None
 
     def expression(self, node: nodes.Expression) -> Value:

coretrace_python/semantic/__init__.py

@@ -2,8 +2,8 @@
 
 from coretrace_python.semantic.imports import ImportAnalysis
 from coretrace_python.semantic.scopes import ScopeAnalysis
-from coretrace_python.semantic.symbols import SymbolAnalysis
+from coretrace_python.semantic.symbols import MembersAnalysis, SymbolAnalysis
 
-SEMANTIC_ANALYSES = (ScopeAnalysis, ImportAnalysis, SymbolAnalysis)
+SEMANTIC_ANALYSES = (ScopeAnalysis, ImportAnalysis, MembersAnalysis, SymbolAnalysis)
 
-__all__ = ["SEMANTIC_ANALYSES", "ImportAnalysis", "ScopeAnalysis", "SymbolAnalysis"]
+__all__ = ["SEMANTIC_ANALYSES", "ImportAnalysis", "MembersAnalysis", "ScopeAnalysis", "SymbolAnalysis"]

coretrace_python/semantic/symbols.py

@@ -4,6 +4,7 @@ from __future__ import annotations
 
 import builtins
 from collections.abc import Mapping
+from dataclasses import dataclass
 from types import MappingProxyType
 from typing import ClassVar
 
@@ -16,19 +17,69 @@ from coretrace_python.semantic.scopes import ResolutionKind, ScopeAnalysis, Scop
 BUILTIN_NAMES = frozenset(name for name in dir(builtins) if not name.startswith("_"))
 
 
+@dataclass(frozen=True)
+class Members:
+    """What the attributes and items of an instance of ``symbol`` give, for a class whose
+    instances give other objects by name, as a pymongo client gives the database it is
+    dotted or indexed with (``client.shop``, ``client['shop']``).
+
+    ``typed`` maps an attribute to the class of what it gives, called or not, since a
+    call denotes its callee: ``get_database`` gives a database, as a ``db`` property does.
+    ``dynamic``, when set, is the class of every item and of every attribute outside
+    ``defined`` and ``typed``. Otherwise an attribute keeps its path and an item its
+    container's symbol, as for any other class."""
+
+    symbol: SymbolId
+    dynamic: SymbolId | None = None
+    defined: tuple[str, ...] = ()
+    typed: tuple[tuple[str, SymbolId], ...] = ()
+
+    def __post_init__(self) -> None:
+        # Sorted: the models' repr is part of the cache key, the same in every process.
+        object.__setattr__(self, "defined", tuple(sorted(set(self.defined))))
+
+    def attribute(self, name: str) -> SymbolId:
+        for attribute, gives in self.typed:
+            if attribute == name:
+                return gives
+        if self.dynamic is not None and name not in self.defined:
+            return self.dynamic
+        return self.symbol.attribute(name)
+
+    def item(self) -> SymbolId:
+        return self.symbol if self.dynamic is None else self.dynamic
+
+
 class SymbolTable:
     """Resolve names to canonical symbols through scopes, imports, builtins and the
-    module-level instances created by calling a symbol (``app = Flask(__name__)``)."""
+    module-level names bound to a value denoting a symbol (``app = Flask(__name__)``,
+    ``cursor = conn.cursor()``). ``members`` holds the ``Members`` models by class."""
 
     def __init__(
         self,
         scopes: ScopeTable,
         imports: ImportTable,
         instances: Mapping[str, SymbolId] | None = None,
+        members: Mapping[SymbolId, Members] | None = None,
     ) -> None:
         self._scopes = scopes
         self._imports = imports
         self._instances = MappingProxyType(dict(instances or {}))
+        self._members = MappingProxyType(dict(members or {}))
+
+    def attribute(self, symbol: SymbolId, name: str) -> SymbolId:
+        """The symbol of attribute ``name`` of what ``symbol`` denotes: its path, unless
+        a ``Members`` model describes the class."""
+
+        members = self._members.get(symbol)
+        return symbol.attribute(name) if members is None else members.attribute(name)
+
+    def item(self, symbol: SymbolId) -> SymbolId:
+        """The symbol of an item of what ``symbol`` denotes: the container's own, so its
+        methods resolve (``request.files['f'].save``), unless a ``Members`` model says."""
+
+        members = self._members.get(symbol)
+        return symbol if members is None else members.item()
 
     def resolve(self, scope_id: ScopeId, name: str) -> SymbolId | None:
         resolution = self._scopes.resolve(scope_id, name)
@@ -49,39 +100,78 @@ class SymbolTable:
             return self.resolve(scope_id, node.identifier)
         if isinstance(node, nodes.Attribute):
             parent = self.resolve_expression(scope_id, node.value)
-            return parent.attribute(node.name) if parent is not None else None
+            return self.attribute(parent, node.name) if parent is not None else None
         if isinstance(node, nodes.Call):
             return self.resolve_expression(scope_id, node.callee)
         return None
 
 
 def analyze_symbols(
-    scopes: ScopeTable, imports: ImportTable, module: nodes.Module | None = None
+    scopes: ScopeTable,
+    imports: ImportTable,
+    module: nodes.Module | None = None,
+    members: Mapping[SymbolId, Members] | None = None,
 ) -> SymbolTable:
-    table = SymbolTable(scopes, imports)
+    table = SymbolTable(scopes, imports, members=members)
     if module is None:
         return table
     instances: dict[str, SymbolId] = {}
     module_scope = scopes.module_scope.id
     for statement in module.body:
-        if (
-            isinstance(statement, nodes.Assign)
-            and isinstance(statement.target, nodes.Name)
-            and isinstance(statement.value, nodes.Call)
-        ):
-            symbol = table.resolve_expression(module_scope, statement.value.callee)
+        if isinstance(statement, nodes.Assign) and isinstance(statement.target, nodes.Name):
+            symbol = _denoted(table, module_scope, statement.value)
             if symbol is not None:
                 instances[statement.target.identifier] = symbol
-    return SymbolTable(scopes, imports, instances)
+                # Later bindings resolve through this one, in statement order.
+                table = SymbolTable(scopes, imports, instances, members)
+    return table
+
+
+def _denoted(table: SymbolTable, scope_id: ScopeId, node: nodes.Expression) -> SymbolId | None:
+    """What a value denotes, as a function body derives it (``derive_symbols``): a
+    resolved name or an attribute of one, the result of calling one, or an item of one,
+    which carries its container's symbol (``os.environ['HOME']``) unless a ``Members``
+    model says what its items are."""
+
+    if isinstance(node, nodes.Subscript):
+        container = _denoted(table, scope_id, node.value)
+        return table.item(container) if container is not None else None
+    if isinstance(node, nodes.Attribute):
+        parent = _denoted(table, scope_id, node.value)
+        return table.attribute(parent, node.name) if parent is not None else None
+    if isinstance(node, nodes.Call):
+        return _denoted(table, scope_id, node.callee)
+    return table.resolve_expression(scope_id, node)
+
+
+class MembersAnalysis(Analysis[Mapping[SymbolId, Members]]):
+    """The ``Members`` models by class, provided by the engine from the security models;
+    none on its own, so every attribute keeps its path."""
+
+    name: ClassVar[str] = "semantic.members"
+
+    @classmethod
+    def compute(cls, ctx: AnalysisContext) -> Mapping[SymbolId, Members]:
+        return MappingProxyType({})
 
 
 class SymbolAnalysis(Analysis[SymbolTable]):
     name: ClassVar[str] = "semantic.symbols"
-    requires: ClassVar[frozenset[AnyAnalysis]] = frozenset({ScopeAnalysis, ImportAnalysis})
+    requires: ClassVar[frozenset[AnyAnalysis]] = frozenset({ScopeAnalysis, ImportAnalysis, MembersAnalysis})
 
     @classmethod
     def compute(cls, ctx: AnalysisContext) -> SymbolTable:
-        return analyze_symbols(ctx.get(ScopeAnalysis), ctx.get(ImportAnalysis), ctx.module)
-
-
-__all__ = ["BUILTIN_NAMES", "SymbolAnalysis", "SymbolId", "SymbolTable", "analyze_symbols"]
+        return analyze_symbols(
+            ctx.get(ScopeAnalysis), ctx.get(ImportAnalysis), ctx.module, ctx.get(MembersAnalysis)
+        )
+
+
+__all__ = [
+    "BUILTIN_NAMES",
+    "Members",
+    "MembersAnalysis",
+    "SymbolAnalysis",
+    "SymbolId",
+    "SymbolTable",
+    "analyze_symbols",
+]

coretrace_python/taint/__init__.py

@@ -1,5 +1,6 @@
 """Security models and the global multi-kind taint engine (architecture §16, §17)."""
 
+from coretrace_python.semantic.symbols import Members
 from coretrace_python.taint.engine import (
     EntryPointAnalysis,
     Taint,
@@ -9,12 +10,14 @@ from coretrace_python.taint.engine import (
     propagate_taint,
 )
 from coretrace_python.taint.models import (
+    TEXT_KINDS,
     AuthorizationGuard,
     EntryPoint,
     Model,
     ModelError,
     ModelTable,
     NamedParameter,
+    RequestObject,
     RouteRegistrar,
     SafeArgument,
     Sanitizer,
@@ -32,15 +35,18 @@ from coretrace_python.taint.routes import RegisteredRoutes, Routes, registered_r
 from coretrace_python.taint.templates import EscapedTemplates, escaped_templates
 
 __all__ = [
+    "TEXT_KINDS",
     "AuthorizationGuard",
     "EntryPoint",
     "EntryPointAnalysis",
     "EscapedTemplates",
+    "Members",
     "Model",
     "ModelError",
     "ModelTable",
     "NamedParameter",
     "RegisteredRoutes",
+    "RequestObject",
     "RouteRegistrar",
     "Routes",
     "SafeArgument",

coretrace_python/taint/engine.py

@@ -70,10 +70,11 @@ from coretrace_python.ir.model import (
     Value,
 )
 from coretrace_python.ir.ssa import SSAAnalysis
-from coretrace_python.semantic.scopes import ScopeAnalysis, ScopeTable
+from coretrace_python.semantic.scopes import ScopeAnalysis, ScopeId, ScopeTable
 from coretrace_python.semantic.symbols import SymbolAnalysis, SymbolId, SymbolTable
 from coretrace_python.source import SourceSpan
 from coretrace_python.taint.models import (
+    TEXT_KINDS,
     EntryPoint,
     ModelTable,
     SecurityModelAnalysis,
@@ -84,6 +85,9 @@ from coretrace_python.taint.models import (
 from coretrace_python.taint.routes import RegisteredRoutes, Routes
 from coretrace_python.taint.templates import EscapedTemplates
 
+# What only a structure carries, and text does not.
+_STRUCTURED = TaintKind.ALL & ~TEXT_KINDS
+
 
 @dataclass(frozen=True)
 class Taint:
@@ -274,19 +278,42 @@ class _TaintProblem(DataflowProblem[State]):
         taint = Taint.none()
         symbol = self.symbols.get(instruction.result) if instruction.result else None
         if symbol is not None:
-            source = self.models.source_covering(symbol)
-            if source is not None:
-                taint = Taint(source.kinds, frozenset({source}))
+            taint = self.covered(symbol)
         if isinstance(instruction, Symbol | Compare):
             return taint
         for operand in instruction.operands():
-            taint = taint.join(state.get(operand, Taint.none()))
+            operand_taint = state.get(operand, Taint.none())
+            if isinstance(instruction, GetAttr):
+                operand_taint = self.attribute(operand_taint, instruction.attribute)
+            taint = taint.join(operand_taint)
         if isinstance(instruction, BuildList | BuildTuple | BuildDict | BuildSet):
             # ``[*xs]`` and ``{**d}`` copy the contents of what they unpack.
             for unpacked in instruction.unpacked:
                 taint = taint.join(self.deep(unpacked, state))
         return taint
 
+    def covered(self, symbol: SymbolId) -> Taint:
+        """The taint of the source covering ``symbol``, if any. Below a request source, as
+        ``self.request.GET`` is, it is the taint of the request attribute read."""
+
+        source = self.models.source_covering(symbol)
+        if source is None:
+            return Taint.none()
+        taint = Taint(source.kinds, frozenset({source}))
+        if symbol == source.symbol:
+            return taint
+        read = symbol.canonical_name.removeprefix(f"{source.symbol.canonical_name}.").split(".")[0]
+        return self.attribute(taint, read)
+
+    def attribute(self, taint: Taint, name: str) -> Taint:
+        """What attribute ``name`` of a value carrying ``taint`` carries: text when every
+        source of the value is a request object listing ``name`` among its text attributes."""
+
+        requests = [self.models.request_object(source.symbol) for source in taint.sources]
+        if taint and all(request is not None and name in request.text for request in requests):
+            return taint.without(_STRUCTURED)
+        return taint
+
     def call(self, call: Call, state: dict[Key, Taint], flows: list[TaintFlow]) -> Taint:
         arguments = tuple(self.deep(a, state) for a in call.arguments)
         keywords = Taint.none()
@@ -420,11 +447,7 @@ class _TaintProblem(DataflowProblem[State]):
         if cleared:
             return everything.without(TaintKind(cleared))
         # A method on a tainted object returns tainted data (``request.args.get``).
-        everything = everything.join(state.get(call.callee, Taint.none()))
-        source = self.models.source_covering(symbol)
-        if source is not None:
-            return everything.join(Taint(source.kinds, frozenset({source})))
-        return everything
+        return everything.join(state.get(call.callee, Taint.none())).join(self.covered(symbol))
 
     def guarded(self, sink: Sink | None, arguments: Arguments) -> Sink | None:
         """The sink as this call makes it: an argument declared safe (``yaml.load`` with
@@ -551,7 +574,12 @@ class _TaintProblem(DataflowProblem[State]):
         reaching = taint.kinds & sink.kinds_at(position, keyword)
         if not reaching:
             return
-        for source in sorted(taint.sources, key=lambda s: str(s.symbol)):
+        # One flow per origin: the parameters of one entry point share its source, with
+        # the kinds each can carry (a scalar one no NOSQL); the flow's kinds are the taint's.
+        origins: dict[tuple[SymbolId, str], Source] = {}
+        for source in sorted(taint.sources, key=lambda s: (str(s.symbol), s.label, s.kinds.value)):
+            origins.setdefault((source.symbol, source.label), source)
+        for source in origins.values():
             flows.append(
                 TaintFlow(
                     source,
@@ -770,17 +798,26 @@ def parameter_sources(
 ) -> Mapping[int, Source]:
     """The attacker-controlled parameters of ``function``, by index: every parameter of an
     entry point (``self`` excepted for a method), including one registered elsewhere
-    (``routes``), and every parameter annotated with a typed-parameter symbol."""
+    (``routes``), and every parameter annotated with a typed-parameter symbol. An entry
+    point's parameter annotated with scalars is text: FastAPI validates it before the
+    handler runs, and a scalar cannot hold a query operator. So are the URL parameters
+    a view receives after a request object."""
 
     owner = _owner(module, function)
     sources: dict[int, Source] = {}
+    scope = scopes.scope_for(function)
+    enclosing = scope.parent if scope.parent is not None else scope.id
     entry = function_entry_point(function, module, models, scopes, symbols, instances, routes)
     if entry is not None:
         first = 1 if owner is not None else 0
+        request = models.request_object(entry.symbol)
         for index in range(first, len(function.parameters)):
-            sources[index] = Source(entry.symbol, entry.label, entry.kinds)
-    scope = scopes.scope_for(function)
-    enclosing = scope.parent if scope.parent is not None else scope.id
+            annotation = function.parameters[index].annotation
+            text = (request is not None and index > first) or (
+                annotation is not None and _scalar(annotation, symbols, enclosing)
+            )
+            kinds = entry.kinds & ~_STRUCTURED if text else entry.kinds
+            sources[index] = Source(entry.symbol, entry.label, kinds)
     for index, parameter in enumerate(function.parameters):
         if parameter.annotation is None:
             continue
@@ -800,6 +837,59 @@ def parameter_sources(
     return sources
 
 
+def _typing(*names: str) -> frozenset[SymbolId]:
+    return frozenset(SymbolId(f"python.{module}.{name}") for module in ("typing", "typing_extensions") for name in names)
+
+
+_SCALARS = frozenset(
+    SymbolId(f"python.{name}")
+    for name in (
+        "builtins.str",
+        "builtins.int",
+        "builtins.float",
+        "builtins.bool",
+        "builtins.bytes",
+        "uuid.UUID",
+        "datetime.date",
+        "datetime.datetime",
+        "datetime.time",
+        "datetime.timedelta",
+        "decimal.Decimal",
+    )
+)
+_CONTAINERS = frozenset(
+    SymbolId(f"python.builtins.{name}") for name in ("list", "set", "frozenset", "tuple")
+) | _typing("List", "Set", "FrozenSet", "Tuple", "Sequence")
+_UNIONS = _typing("Optional", "Union")
+_LITERAL = _typing("Literal")
+_ANNOTATED = _typing("Annotated")
+
+
+def _scalar(annotation: nodes.Expression, symbols: SymbolTable, scope: ScopeId) -> bool:
+    """Whether a value annotated with ``annotation`` holds scalars only: a scalar class,
+    a literal, a container of scalars, a union of them with ``None``, or one of them
+    ``Annotated`` with metadata. Anything unknown may hold a structure."""
+
+    if isinstance(annotation, nodes.Constant):
+        return annotation.value is None or annotation.value is Ellipsis
+    if isinstance(annotation, nodes.BinaryOp):
+        return annotation.operator == "bit_or" and all(
+            _scalar(side, symbols, scope) for side in (annotation.left, annotation.right)
+        )
+    if isinstance(annotation, nodes.Subscript):
+        origin = symbols.resolve_expression(scope, annotation.value)
+        key = annotation.key
+        arguments = key.elements if isinstance(key, nodes.Tuple) else (key,)
+        if origin in _LITERAL:
+            return True
+        if origin in _ANNOTATED:
+            return _scalar(arguments[0], symbols, scope)
+        return (origin in _UNIONS or origin in _CONTAINERS) and all(
+            _scalar(argument, symbols, scope) for argument in arguments
+        )
+    return symbols.resolve_expression(scope, annotation) in _SCALARS
+
+
 def propagate_taint(
     name: str,
     function: FunctionIR,

coretrace_python/taint/models.py

@@ -10,6 +10,7 @@ from __future__ import annotations
 
 import hashlib
 import re
+from collections.abc import Mapping
 from dataclasses import dataclass, field
 from enum import Flag, auto
 from types import MappingProxyType
@@ -17,7 +18,7 @@ from typing import ClassVar
 
 from coretrace_python.analysis import Analysis, AnalysisContext, MissingInputError
 from coretrace_python.interprocedural import Clearing
-from coretrace_python.semantic.symbols import SymbolId
+from coretrace_python.semantic.symbols import Members, SymbolId
 
 
 class TaintKind(Flag):
@@ -41,6 +42,11 @@ class TaintKind(Flag):
     PII = auto()
 
 
+# What text input carries: a string cannot hold a query operator, only a structure can,
+# so a form field, a header or a URL parameter carries every kind but NOSQL.
+TEXT_KINDS = TaintKind.ALL & ~TaintKind.NOSQL
+
+
 class ModelError(Exception):
     """Two models of the same kind claim the same symbol."""
 
@@ -199,6 +205,22 @@ class TemplateRender:
     keyword: str = "template_name"
 
 
+@dataclass(frozen=True)
+class RequestObject:
+    """The inputs from ``symbol`` are request objects; ``symbol`` names an entry point, a
+    route registrar, a typed parameter or a source. A view receives the request first
+    (after ``self``), then URL parameters, which are text. Reading one of the request's
+    ``text`` attributes (``GET``, ``headers``) gives text, while its body and files keep the
+    kinds of the request: text carries ``TEXT_KINDS``."""
+
+    symbol: SymbolId
+    text: tuple[str, ...] = ()
+
+    def __post_init__(self) -> None:
+        # Sorted: the models' repr is part of the cache key, the same in every process.
+        object.__setattr__(self, "text", tuple(sorted(set(self.text))))
+
+
 @dataclass(frozen=True)
 class AuthorizationGuard:
     """A decorator, or a condition, that restricts who reaches the code behind it; a
@@ -221,6 +243,8 @@ Model = (
     | SuffixSink
     | SafeArgument
     | TemplateRender
+    | Members
+    | RequestObject
 )
 
 
@@ -238,6 +262,8 @@ class ModelTable:
     suffix_sinks: tuple[SuffixSink, ...] = ()
     safe_arguments: tuple[SafeArgument, ...] = ()
     template_renders: tuple[TemplateRender, ...] = ()
+    members: tuple[Members, ...] = ()
+    request_objects: tuple[RequestObject, ...] = ()
     _by_symbol: dict[type[Model], dict[SymbolId, Model]] = field(
         init=False, repr=False, compare=False
     )
@@ -254,6 +280,7 @@ class ModelTable:
             RouteRegistrar: {m.symbol: m for m in self.route_registrars},
             SafeArgument: {m.symbol: m for m in self.safe_arguments},
             TemplateRender: {m.symbol: m for m in self.template_renders},
+            RequestObject: {m.symbol: m for m in self.request_objects},
         }
         object.__setattr__(self, "_by_symbol", MappingProxyType(index))
 
@@ -321,6 +348,8 @@ class ModelTable:
             self.suffix_sinks,
             self.safe_arguments,
             self.template_renders,
+            self.members,
+            self.request_objects,
         )
 
     def sanitizer(self, symbol: SymbolId) -> Sanitizer | None:
@@ -335,6 +364,15 @@ class ModelTable:
         found = self._by_symbol[TemplateRender].get(symbol)
         return found if isinstance(found, TemplateRender) else None
 
+    def request_object(self, symbol: SymbolId) -> RequestObject | None:
+        found = self._by_symbol[RequestObject].get(symbol)
+        return found if isinstance(found, RequestObject) else None
+
+    def members_by_class(self) -> Mapping[SymbolId, Members]:
+        """The ``Members`` models by class, as symbol resolution reads them."""
+
+        return MappingProxyType({m.symbol: m for m in self.members})
+
     def clearing(self, escaped: frozenset[str] = frozenset()) -> Clearing:
         """What calls clear from the data they return: every sanitizer its kinds, every
         template render ``HTML`` when it names one of the ``escaped`` templates."""
@@ -393,6 +431,8 @@ class SecurityModelRegistry:
             suffix_sinks=tuple(m for m in models if isinstance(m, SuffixSink)),
             safe_arguments=tuple(m for m in models if isinstance(m, SafeArgument)),
             template_renders=tuple(m for m in models if isinstance(m, TemplateRender)),
+            members=tuple(m for m in models if isinstance(m, Members)),
+            request_objects=tuple(m for m in models if isinstance(m, RequestObject)),
         )
 
 

{coretrace_python_analyzer-0.11.0.dist-info → coretrace_python_analyzer-0.13.0.dist-info}/METADATA

@@ -1,6 +1,6 @@
 Metadata-Version: 2.5
 Name: coretrace-python-analyzer
-Version: 0.11.0
+Version: 0.13.0
 Summary: Static security analysis infrastructure for Python code
 Project-URL: Homepage, https://github.com/CoreTrace/coretrace-python-analyzer
 Project-URL: Repository, https://github.com/CoreTrace/coretrace-python-analyzer

{coretrace_python_analyzer-0.11.0.dist-info → coretrace_python_analyzer-0.13.0.dist-info}/RECORD

@@ -1,8 +1,8 @@
-coretrace_python/__init__.py,sha256=lwZwSBKMQK9wIdXsR7HCxeMNGo0vXmvI-7UK0Q66xu4,76
+coretrace_python/__init__.py,sha256=4_uvCC4RHPELcdUoMgQ00MwplbVOBvuK0TpVzxBnXII,76
 coretrace_python/__main__.py,sha256=V8DnYtRboISK2VCKm7DGHLREKvqLbqApyWlKBOs26wU,65
 coretrace_python/cache.py,sha256=-pZv-ELm4jMCTXQWSZIobHaT9UHIjFu7IlMkOM0i4LI,13607
 coretrace_python/cli.py,sha256=G5jhb6g6RgSRSjjS7DBgziIjUM1vTFwalJGvFHVKxrg,11225
-coretrace_python/engine.py,sha256=-E4z-HvKffI0WMUXPKdQxm61anu-r-cYXHGqnppalYk,31953
+coretrace_python/engine.py,sha256=nwK8fbcEOT0zKiBlK67aCl7yiQpE00j56LLknXn7Djg,32276
 coretrace_python/abstract/__init__.py,sha256=n5FNkV8Z4LmwG0r06KWdLj4N2CPSgAKwY3896tdmRgM,999
 coretrace_python/abstract/constants.py,sha256=z4-e7IzysxzGi58wFFff1MlEoV8l7AZsB9EL-q6b7vY,9071
 coretrace_python/abstract/heap.py,sha256=OaESXFGC0qzyhAr76xrCu4skeDVzZM4wlenQqfMTkdk,9642
@@ -19,30 +19,30 @@ coretrace_python/bundled/dependency/sample_advisories/plugin.toml,sha256=cME4pSF
 coretrace_python/bundled/dependency/sample_advisories/sample_advisories.py,sha256=jw98GK6hh5RAx05t8QPcUzsFMfGigAL8418vZLprKlc,3710
 coretrace_python/bundled/dependency/vulnerable_dependency/plugin.toml,sha256=4-OnbEb3lYVAoTfuz8mDPH4L9fHOPQ2KW1dDFAbClFk,267
 coretrace_python/bundled/dependency/vulnerable_dependency/vulnerable_dependency.py,sha256=THXqpuffQZ8nuv1b8zQrgkA7eTI1PxhODATMzqhWeyY,3393
-coretrace_python/bundled/models/aiohttp/aiohttp_models.py,sha256=EraiXpZih8yPRk5t0OKe2TMJO9iATv4Kj_lKLp_KpfA,2946
+coretrace_python/bundled/models/aiohttp/aiohttp_models.py,sha256=X3ZYgbrezHbsP3D9rVt-qM1_Iecu6nT_Yz9H7-XGl4M,3422
 coretrace_python/bundled/models/aiohttp/plugin.toml,sha256=YvU60RUBexYBtIxbXdmUhO83BoijmOe3MeQKwY8QDaM,220
-coretrace_python/bundled/models/bottle/bottle_models.py,sha256=0yt8-7g-Pxtas3qQcIdORkWLiqJu4O3JzCrSnhzbgHs,1885
+coretrace_python/bundled/models/bottle/bottle_models.py,sha256=Y0SUMCNGiGhzcMj0uxBLhCbLFgM7sBc4XBB-C5LEuDw,2200
 coretrace_python/bundled/models/bottle/plugin.toml,sha256=V2Ea1DcocKOWyOWm_KuzNCaPxN7ZOomSnCyo0e7WfXQ,196
-coretrace_python/bundled/models/cli/cli_models.py,sha256=BfeXGLbS-3EnzYrJMhZeViQO9ZUZB-EFtxobWj-oW8M,977
+coretrace_python/bundled/models/cli/cli_models.py,sha256=jKCCpVsIWsOeG8-Q1P79bU6CENOAaxSQ_HZe6jLwd0c,980
 coretrace_python/bundled/models/cli/plugin.toml,sha256=D2gkrL1lWc6b4ME_C0hjzwZHJX1l_OChRs3_oapam_s,163
 coretrace_python/bundled/models/credentials/credential_models.py,sha256=Mw9ty8PDDyLNPtbPTTm-sIY9XE8gBsi02dPmLeum2kE,1423
 coretrace_python/bundled/models/credentials/plugin.toml,sha256=0ut7Jc7IdcvbsZKPu6ty-z3DBlMg2CUT7JX4y4nMybo,217
 coretrace_python/bundled/models/db_drivers/db_driver_models.py,sha256=x4SAwhcpuG5TLfhmVsuAQ1VV3lAXSNh5YHx7QuFBQyU,2339
 coretrace_python/bundled/models/db_drivers/plugin.toml,sha256=094-QIV92x-69uy2CgMulBXfGvt48qtefLyeW2q3SRs,178
-coretrace_python/bundled/models/django/django_models.py,sha256=1ftZ8tEBZJXrAiZr0rQZBSIOu4VqwOkHz8WE8FE5UBI,6445
+coretrace_python/bundled/models/django/django_models.py,sha256=Gg_qgQY4oT0CEW8RAFBoxyW2I56FSRJo5eWkZHZrGeQ,7370
 coretrace_python/bundled/models/django/plugin.toml,sha256=_Qa2X_4IViORQkcLvLsAC5vI-2P5CxgG8VvnuNIWcFQ,214
 coretrace_python/bundled/models/fastapi/fastapi_models.py,sha256=K2Edlo1RzYKmAJAIChNVUDc8gorAS48MGEMKNlCIGrI,1251
 coretrace_python/bundled/models/fastapi/plugin.toml,sha256=V_R2WcEc-qkST0tTpL-cRf2FEbjK6Mk727WbJmVpWJM,200
-coretrace_python/bundled/models/flask/flask_models.py,sha256=XVZWH4u2SdbErk40L-JjTBXQI1hrVCDlMu5BeqE1Ibc,2319
+coretrace_python/bundled/models/flask/flask_models.py,sha256=quR3hm4BqyFCNkBByAhaPVgeC-O-W-dnH_UFNFpgj_k,2717
 coretrace_python/bundled/models/flask/plugin.toml,sha256=kI53Xwf5aZKd2n3fEQEbBzNnOXRvuonqEazTOIXPJP4,192
 coretrace_python/bundled/models/http_clients/http_client_models.py,sha256=9XhHWZKq3XWcD0WexucuedAiwxp3fhXxGmo9R6DNtSQ,1954
 coretrace_python/bundled/models/http_clients/plugin.toml,sha256=vq9tWHgy8-m8LiU1StGhm9Lsy7vnj3w90P4AKDaKfc0,216
 coretrace_python/bundled/models/python_stdlib/plugin.toml,sha256=DWqjG68rx91HCJi_VEp6tUs4ujkzlR7Lq7saMvtK2HM,187
-coretrace_python/bundled/models/python_stdlib/python_stdlib.py,sha256=7S2OEcdY41hQiHm_FX8WIc2DEzl4NQUdZer7yyoRz1Y,4774
+coretrace_python/bundled/models/python_stdlib/python_stdlib.py,sha256=IyCxTHjZcd81YA2-JalQE7OvVSZBisDVCo6330my3JY,4873
 coretrace_python/bundled/models/sqlalchemy/plugin.toml,sha256=2gRbglnMK5U2QWnzs2U2pDvmTeWmrlW7XpJ_8dRmIoY,182
 coretrace_python/bundled/models/sqlalchemy/sqlalchemy_models.py,sha256=Gm2qjyXUrjzALy-MigUhPQyyDxYdfWlQKDZLp1C6Jqk,1697
 coretrace_python/bundled/models/tornado/plugin.toml,sha256=u_XjJK2uKBR11zg4yGxsCDHcx2pKEQ1MBvvB6Mm0siA,222
-coretrace_python/bundled/models/tornado/tornado_models.py,sha256=2j0UPHNBAmf7HvsHCbxKdW974L4rmantXapo8KNEppM,1805
+coretrace_python/bundled/models/tornado/tornado_models.py,sha256=Z8U46CbDHm7rORSsP26GBhUbe5m-LMf2QNkoBKZxB1M,2651
 coretrace_python/bundled/secrets/config_secrets/config_secrets.py,sha256=JfhWSyVbjlYD9pQYJN6qAc4Rp4IA8PP222akM4KTPU8,1283
 coretrace_python/bundled/secrets/config_secrets/plugin.toml,sha256=dRkA3zQ9wtT2EJyqZ5zGqJ5KYdyIQtQcSvesqrb4M0Q,177
 coretrace_python/bundled/secrets/hardcoded_secrets/hardcoded_secrets.py,sha256=7TD-Nf5S4yfoRBRmJ6Ab6v4Q2zIC2n79FRfNS3I4xos,544
@@ -53,6 +53,8 @@ coretrace_python/bundled/security/command_injection/command_injection.py,sha256=
 coretrace_python/bundled/security/command_injection/plugin.toml,sha256=x9NUpwdVZsTQpaPNX3HoYcrZWk4sOGN-aSp9Bc8jvCA,240
 coretrace_python/bundled/security/insecure_deserialization/insecure_deserialization.py,sha256=-4KIQDaYo-09gSceuNEs3eutmBn2OBuYBTqiUEYOatk,637
 coretrace_python/bundled/security/insecure_deserialization/plugin.toml,sha256=5OTVO9jZN-HBid8v__jYkxU-RnKX974Qqu7JQMFdj54,268
+coretrace_python/bundled/security/nosql_injection/nosql_injection.py,sha256=0MCTZ3DjOf5DQrLgnPPgpa80CYUd5teQ_iau3s_82O0,789
+coretrace_python/bundled/security/nosql_injection/plugin.toml,sha256=FP2qTPtH7ZCiu6vwfgadWlXfVnlKOigXJ43cv9PlorA,232
 coretrace_python/bundled/security/open_redirect/open_redirect.py,sha256=nUjVIgYhVh_2xBs8_1LOfcLDgQ3g3z1E7APqg2sBdpo,562
 coretrace_python/bundled/security/open_redirect/plugin.toml,sha256=8t4KLNG1DIpjjen6TuKxMjz2jv6GDcwVJDm_hJUalCg,224
 coretrace_python/bundled/security/path_traversal/path_traversal.py,sha256=MiTDZBNU6i3WWua1qaxg1swqDy3wlWwBwG6G4ClyDgw,552
@@ -111,12 +113,12 @@ coretrace_python/hir/__init__.py,sha256=xMpvj-RSp6bd78a_hhkqbe99-snjERkH-_Lv5o9A
 coretrace_python/hir/nodes.py,sha256=4BI0f3UhKbnz9ZIxMoKXM7ujav0BmRpD0OXaoblRxIk,12364
 coretrace_python/hir/visitors.py,sha256=JFnX09hK6trLyRcWgZ5ehOG2ywX3VvkqQ1h82nahYNg,885
 coretrace_python/interprocedural/__init__.py,sha256=rBASF3aAvl5CFAmIISu2gID9mqY_iyi-4Hx0GzDVZsg,1300
-coretrace_python/interprocedural/callgraph.py,sha256=E6enTawqcl4-TObdjvoFe6l1zEedvsWbnjEBD6omzy8,19827
+coretrace_python/interprocedural/callgraph.py,sha256=3phhsJQ4pnpDullBluROSCbuz4AKaZsvycxrvq4UM7c,19898
 coretrace_python/interprocedural/modulegraph.py,sha256=4sB7OKjBYfxtm7aMtHm2jRlqFVUNUsdnLhnv9UZ1BWA,8846
 coretrace_python/interprocedural/summaries.py,sha256=Z_KT3ggH7fgPz1mJL6TBz6V5STka1koIuUBAuYMti7o,26113
 coretrace_python/ir/__init__.py,sha256=ShBPYYqoQFePP-mgBjGezQ2acel0-ReOHF9vCC-G_4Q,232
 coretrace_python/ir/defuse.py,sha256=CZEPnlgntRp4MqwR7kLldd2ZlIlBnr-V9VJAxXxwm0c,2616
-coretrace_python/ir/lowering.py,sha256=V7r_4tEOi801NBOsPdG6pwrRHZIeVTahygYENneLQ4U,31428
+coretrace_python/ir/lowering.py,sha256=kIVB1HlIW6AMW7-2x9z7wcdhObWj8rjP_eKqOKtgxoM,31442
 coretrace_python/ir/model.py,sha256=i7LvHEnl5pmWYUcSui17ZGS1rdPVavMpnjt7Tog7P4c,11125
 coretrace_python/ir/printer.py,sha256=otBIhZUvB_UfB68gid_FbPcSjBUSmxH3v7vBMZZQVkg,9125
 coretrace_python/ir/ssa.py,sha256=cIYbcv90PI6AOeMrw2ZWp88fy7E2ZO4P3tqjtPHra7g,11116
@@ -132,22 +134,22 @@ coretrace_python/reporters/json_format.py,sha256=x1XRw6UOOX624LRw2rJFiZDBbIX-LVz
 coretrace_python/reporters/report.py,sha256=hEQPDtnEgDF0djXfg74vBM1B0uajZ_AWtNtu3eH7QI4,1777
 coretrace_python/reporters/sarif.py,sha256=0HF47hZ6F2WtrDDb2uICLPqYI0gLRiUgxBX69C5lbnU,3649
 coretrace_python/reporters/text.py,sha256=bHsHkMheyL0AB1iWtxBO5H9S14k1AqJvKkNsFro71xo,1043
-coretrace_python/semantic/__init__.py,sha256=_tjT9CgXfPbOMs8EFguhWrLeSmpyrqOHU_OSoQPiWYs,411
+coretrace_python/semantic/__init__.py,sha256=tJOvNvMzJ9yjP2bgkLpPO29pl9gMQgICh6XVYJHrovw,464
 coretrace_python/semantic/identity.py,sha256=uQBdqEXrOtYmGIiR9hZu0Pimv52iW1rOOOvIdG0InNY,1472
 coretrace_python/semantic/imports.py,sha256=389MZs8iTUc3CyUHG0VAgWFsypd7VPFKkLHmFz9L-N0,5673
 coretrace_python/semantic/scopes.py,sha256=zg8ClITSAUbOMvLOV5BsfdG1oC4cd0VweUb9S5Jc4js,20241
-coretrace_python/semantic/symbols.py,sha256=3JptnnX5_KBlSd00L_wcGlYZQdnmBvSBAhfivBF6DLo,3513
+coretrace_python/semantic/symbols.py,sha256=G0jwsWFo2346Y1R2sztsB8HuZZm_aHfHSJXXeZKPQLo,7354
 coretrace_python/source/__init__.py,sha256=0Y8fvtbkETnNCJR9Zq7RS5TSgF9c22pz3SSk1KdAXF0,301
 coretrace_python/source/manager.py,sha256=JRmMOcWfS1nocbVrdcvfQTqEfIkmnb5JP857TpGywN4,2736
 coretrace_python/source/model.py,sha256=FZnN5mlir3tzbIpWoxnn6YtRi9UcJ_y0sZM60tKr8U4,1727
-coretrace_python/taint/__init__.py,sha256=kfqCEXE5wKFLwz2XrT42_yEv9pW4vPfgg5yYBVVSr2I,1371
-coretrace_python/taint/engine.py,sha256=_uVUc2m29aljN_YR2iCQtEdvZFc-LJ5CDWiZF1Tz3WU,40524
-coretrace_python/taint/models.py,sha256=B84caPxmQvTdB9H_80nZOqcFlpNd9ofpKI2YL5Uc0UA,15269
+coretrace_python/taint/__init__.py,sha256=n0WMjstUkrJZ2QnMgGBlJwqCZ0LHno670XRd__TEcaI,1514
+coretrace_python/taint/engine.py,sha256=rEAbwjR5v294PqBzBlu6f9WiMvVmwV83FqdsWbT4l3c,44648
+coretrace_python/taint/models.py,sha256=8AwPKKdmwAHmE7CxwUbtWn5w7JVkEJ06_Is7xQWTx38,17066
 coretrace_python/taint/routes.py,sha256=UAJKXcw_sM9shf58FfDroxVO9bNSm4qrQdZknwUB0lo,6110
 coretrace_python/taint/templates.py,sha256=8Ojb43VXuWxOVifeXRpi3_2mjZfnvIC7GQ-AW80GUYk,11148
-coretrace_python_analyzer-0.11.0.dist-info/METADATA,sha256=s9XGnFo_DdCtjSWnMC3WL6Dj1KiPskmmE-xqE7H9M6Q,3217
-coretrace_python_analyzer-0.11.0.dist-info/WHEEL,sha256=W3fkpkm7-wf9vBI5Z-7s0eWkeM-spu78I8Neb98DeEg,87
-coretrace_python_analyzer-0.11.0.dist-info/entry_points.txt,sha256=wdozemiraOkbt65g_Y_zgspuZpoLxJdaCVMJt1Ft3c0,72
-coretrace_python_analyzer-0.11.0.dist-info/licenses/LICENSE,sha256=z8d0m5b2O9McPEK1xHG_dWgUBT6EfBDz6wA0F7xSPTA,11358
-coretrace_python_analyzer-0.11.0.dist-info/licenses/NOTICE,sha256=s3VHj5ngV0ozjW_kZJpg_35ne6JwoBK0ysOjbqVtA0w,113
-coretrace_python_analyzer-0.11.0.dist-info/RECORD,,
+coretrace_python_analyzer-0.13.0.dist-info/METADATA,sha256=XNQT5nbo6DGzDqYJw9p1sYyciIkdituTpM82-o3z8-8,3217
+coretrace_python_analyzer-0.13.0.dist-info/WHEEL,sha256=W3fkpkm7-wf9vBI5Z-7s0eWkeM-spu78I8Neb98DeEg,87
+coretrace_python_analyzer-0.13.0.dist-info/entry_points.txt,sha256=wdozemiraOkbt65g_Y_zgspuZpoLxJdaCVMJt1Ft3c0,72
+coretrace_python_analyzer-0.13.0.dist-info/licenses/LICENSE,sha256=z8d0m5b2O9McPEK1xHG_dWgUBT6EfBDz6wA0F7xSPTA,11358
+coretrace_python_analyzer-0.13.0.dist-info/licenses/NOTICE,sha256=s3VHj5ngV0ozjW_kZJpg_35ne6JwoBK0ysOjbqVtA0w,113
+coretrace_python_analyzer-0.13.0.dist-info/RECORD,,