coretrace-python-analyzer 0.12.0__py3-none-any.whl → 0.14.0__py3-none-any.whl

coretrace_python/__init__.py

@@ -1,4 +1,4 @@
 """CoreTrace's Python static analysis frontend."""
 
-__version__ = "0.12.0"
+__version__ = "0.14.0"
 

coretrace_python/abstract/strings.py

@@ -0,0 +1,98 @@
+"""The constant text a string starts with (architecture §18): what ``+`` and f-strings
+build from string literals and from module-level names bound once to one. Anything
+else, a parameter, a call result, an import, ``%`` or ``format``, is text of unknown
+value."""
+
+from __future__ import annotations
+
+from collections.abc import Mapping
+from types import MappingProxyType
+from typing import ClassVar
+
+from coretrace_python.analysis import Analysis, AnalysisContext, AnyAnalysis
+from coretrace_python.cfg import CFGError
+from coretrace_python.hir import nodes
+from coretrace_python.ir.lowering import (
+    MODULE_BODY,
+    LoweringError,
+    PyIRAnalysis,
+    analyzable_functions,
+)
+from coretrace_python.ir.model import (
+    BinaryOp,
+    BuildString,
+    Constant,
+    ForNext,
+    Global,
+    Instruction,
+    SetGlobal,
+    StoreLocal,
+    Value,
+)
+
+
+def leading_text(value: Value, defs: Mapping[Value, Instruction], strings: Mapping[str, str]) -> tuple[str, bool]:
+    """The constant text ``value`` starts with, and whether that text is all of it, given
+    the definitions of the function's values and the module's ``strings``."""
+
+    made = defs.get(value)
+    if isinstance(made, Constant):
+        return (made.value, True) if isinstance(made.value, str) else ("", False)
+    if isinstance(made, Global):
+        known = strings.get(made.name)
+        return ("", False) if known is None else (known, True)
+    if isinstance(made, BinaryOp) and made.operator == "add":
+        left, whole = leading_text(made.left, defs, strings)
+        if not whole:
+            return left, False
+        right, whole = leading_text(made.right, defs, strings)
+        return left + right, whole
+    if isinstance(made, BuildString):
+        text = ""
+        for part in made.parts:
+            piece, whole = leading_text(part, defs, strings)
+            text += piece
+            if not whole:
+                return text, False
+        return text, True
+    return "", False
+
+
+class ModuleStringsAnalysis(Analysis[Mapping[str, str]]):
+    """The module-level names bound once, to a string literal, and never rebound: by no
+    other statement of the module body, no function assigning them as ``global``, no
+    definition of that name. A module that does not lower entirely has none."""
+
+    name: ClassVar[str] = "abstract.module_strings"
+    requires: ClassVar[frozenset[AnyAnalysis]] = frozenset({PyIRAnalysis})
+
+    @classmethod
+    def compute(cls, ctx: AnalysisContext) -> Mapping[str, str]:
+        try:
+            functions = [ctx.get(PyIRAnalysis, function) for function in analyzable_functions(ctx.module)]
+        except (LoweringError, CFGError):
+            return MappingProxyType({})
+        body = next((function for function in functions if function.name == MODULE_BODY), None)
+        if body is None:
+            return MappingProxyType({})
+        defs = {i.result: i for block in body.blocks for i in block.instructions if i.result is not None}
+        stored: dict[str, list[Value | None]] = {}
+        for block in body.blocks:
+            for instruction in block.instructions:
+                if isinstance(instruction, StoreLocal):
+                    stored.setdefault(instruction.name, []).append(instruction.value)
+            if isinstance(block.terminator, ForNext):
+                # A ``for`` binds its target to each item.
+                stored.setdefault(block.terminator.target, []).append(None)
+        rebound = {
+            i.name for function in functions for block in function.blocks for i in block.instructions
+            if isinstance(i, SetGlobal)
+        }
+        rebound |= {s.name for s in ctx.module.body if isinstance(s, nodes.Function | nodes.Class)}
+        found: dict[str, str] = {}
+        for name, values in stored.items():
+            value = values[0] if len(values) == 1 and name not in rebound else None
+            made = defs.get(value) if value is not None else None
+            if isinstance(made, Constant) and isinstance(made.value, str):
+                found[name] = made.value
+        return MappingProxyType(found)

coretrace_python/bundled/models/aiohttp/aiohttp_models.py

@@ -12,6 +12,7 @@ from coretrace_python.semantic.symbols import SymbolId
 from coretrace_python.taint import (
     EntryPoint,
     Model,
+    RequestObject,
     RouteRegistrar,
     Sink,
     Source,
@@ -22,6 +23,23 @@ from coretrace_python.taint import (
 _METHODS = ("get", "post", "put", "patch", "delete", "head", "options")
 _REQUEST_CLASSES = ("aiohttp.web.Request", "aiohttp.web_request.Request")
 _ROUTERS = ("aiohttp.web.Application.router", "aiohttp.web.UrlDispatcher")
+# ``@routes.get('/')`` on a ``RouteTableDef``.
+_ROUTE_TABLES = tuple(f"aiohttp.web.RouteTableDef.{method}" for method in (*_METHODS, "route", "view"))
+# ``app.router.add_route('GET', '/', handler)``, ``app.router.add_get('/', handler)`` and
+# ``app.add_routes([web.get('/', handler)])``, each with the argument naming the handler.
+_ROUTE_CALLS = (
+    *((f"{router}.add_route", 2) for router in _ROUTERS),
+    *((f"{router}.add_{method}", 1) for router in _ROUTERS for method in (*_METHODS, "view")),
+    ("aiohttp.web.route", 2),
+    *((f"aiohttp.web.{method}", 1) for method in (*_METHODS, "view")),
+)
+# What a request gives as text; its body (``json()``, ``text()``, ``read()``) may hold a
+# structure.
+_REQUEST_TEXT = (
+    "query", "rel_url", "url", "path", "raw_path", "path_qs", "query_string", "match_info", "headers",
+    "raw_headers", "cookies", "method", "host", "scheme", "remote", "forwarded", "content_type", "charset",
+    "if_modified_since", "post",
+)
 _REDIRECTS = ("HTTPFound", "HTTPMovedPermanently", "HTTPSeeOther", "HTTPTemporaryRedirect", "HTTPPermanentRedirect")
 _CLIENT_FUNCTIONS = (
     *(f"aiohttp.ClientSession.{method}" for method in (*_METHODS, "request")),
@@ -40,18 +58,12 @@ class AiohttpModels(ModelPlugin):
         # The whole request is attacker-controlled: its query, match info, headers,
         # cookies and body all come from the client.
         *(TypedParameter(_sym(cls), "http") for cls in _REQUEST_CLASSES),
-        # ``@routes.get('/')`` on a ``RouteTableDef``.
-        *(EntryPoint(_sym(f"aiohttp.web.RouteTableDef.{method}"), "http") for method in (*_METHODS, "route", "view")),
-        # ``app.router.add_route('GET', '/', handler)`` and ``app.router.add_get('/', handler)``.
-        *(RouteRegistrar(_sym(f"{router}.add_route"), 2, "http", keyword="handler") for router in _ROUTERS),
+        *(EntryPoint(_sym(table), "http") for table in _ROUTE_TABLES),
+        *(RouteRegistrar(_sym(call), argument, "http", keyword="handler") for call, argument in _ROUTE_CALLS),
         *(
-            RouteRegistrar(_sym(f"{router}.add_{method}"), 1, "http", keyword="handler")
-            for router in _ROUTERS
-            for method in (*_METHODS, "view")
+            RequestObject(_sym(symbol), _REQUEST_TEXT)
+            for symbol in (*_REQUEST_CLASSES, *_ROUTE_TABLES, *(call for call, _ in _ROUTE_CALLS))
         ),
-        # ``app.add_routes([web.get('/', handler)])``: the route definitions name the handler.
-        RouteRegistrar(_sym("aiohttp.web.route"), 2, "http", keyword="handler"),
-        *(RouteRegistrar(_sym(f"aiohttp.web.{method}"), 1, "http", keyword="handler") for method in (*_METHODS, "view")),
         Sink(_sym("aiohttp.web.Response"), TaintKind.HTML),
         Sink(_sym("aiohttp.web.FileResponse"), TaintKind.PATH),
         *(Sink(_sym(f"aiohttp.web.{exception}"), TaintKind.REDIRECT) for exception in _REDIRECTS),

coretrace_python/bundled/models/django/django_models.py

@@ -17,6 +17,7 @@ from coretrace_python.taint import (
     AuthorizationGuard,
     EntryPoint,
     Model,
+    RequestObject,
     RouteRegistrar,
     Sanitizer,
     Sink,
@@ -88,6 +89,23 @@ _AUTHORIZATION_DECORATORS = (
 )
 
 
+# What a request object gives as text: the query string, form fields, headers, cookies
+# and path. Its body, its files and REST framework's parsed ``data`` may hold a structure.
+_REQUEST_TEXT = (
+    "GET", "POST", "COOKIES", "META", "headers", "path", "path_info", "method", "scheme", "encoding",
+    "content_type", "content_params", "resolver_match", "get_full_path", "get_full_path_info",
+    "build_absolute_uri", "get_host", "get_port", "get_signed_cookie", "query_params",
+)
+# Every input a request object comes from: an annotated parameter, a class-based view's
+# method or ``self.request``, a decorated view, a view registered in a URL configuration.
+_REQUEST_INPUTS = (
+    *_REQUEST_CLASSES,
+    *_VIEW_BASES,
+    *(f"{base}.request" for base in _VIEW_BASES),
+    *_VIEW_DECORATORS,
+    *_ROUTE_REGISTRARS,
+)
+
 _TARGET_ONLY = ((TaintKind.REDIRECT, (0,)),)
 
 
@@ -103,6 +121,7 @@ class DjangoModels(ModelPlugin):
         # ``self.request`` in a class-based view: the attribute is inherited from the base.
         *(Source(_sym(f"{base}.request"), "http") for base in _VIEW_BASES),
         *(EntryPoint(_sym(decorator), "http") for decorator in _VIEW_DECORATORS),
+        *(RequestObject(_sym(symbol), _REQUEST_TEXT) for symbol in _REQUEST_INPUTS),
         Sink(_sym("django.db.connection.cursor.execute"), TaintKind.SQL | TaintKind.CREDENTIAL, ((TaintKind.SQL, (0,)),)),
         Sink(_sym("django.db.connection.cursor.executemany"), TaintKind.SQL | TaintKind.CREDENTIAL, ((TaintKind.SQL, (0,)),)),
         Sink(_sym("django.db.models.expressions.RawSQL"), TaintKind.SQL | TaintKind.CREDENTIAL),

coretrace_python/bundled/models/tornado/tornado_models.py

@@ -8,7 +8,16 @@ from typing import ClassVar
 
 from coretrace_python.plugins import ModelPlugin
 from coretrace_python.semantic.symbols import SymbolId
-from coretrace_python.taint import TEXT_KINDS, EntryPoint, Model, Sanitizer, Sink, Source, TaintKind
+from coretrace_python.taint import (
+    TEXT_KINDS,
+    EntryPoint,
+    Model,
+    RequestObject,
+    Sanitizer,
+    Sink,
+    Source,
+    TaintKind,
+)
 
 _HANDLERS = ("tornado.web.RequestHandler", "tornado.websocket.WebSocketHandler")
 # Text, which cannot hold a query operator; the request object holds the raw body too.
@@ -16,6 +25,11 @@ _TEXT_METHODS = (
     "get_argument", "get_arguments", "get_query_argument", "get_query_arguments",
     "get_body_argument", "get_body_arguments", "get_cookie", "path_args", "path_kwargs",
 )
+# What ``self.request`` gives as text; its body and files may hold a structure.
+_REQUEST_TEXT = (
+    "arguments", "query_arguments", "body_arguments", "query", "uri", "path", "headers", "cookies",
+    "method", "host", "host_name", "remote_ip", "protocol", "version", "full_url",
+)
 _CLIENTS = ("tornado.httpclient.AsyncHTTPClient.fetch", "tornado.httpclient.HTTPClient.fetch")
 _TARGET_ONLY = ((TaintKind.REDIRECT, (0,)),)
 
@@ -33,6 +47,7 @@ class TornadoModels(ModelPlugin):
         EntryPoint(_sym("tornado.websocket.WebSocketHandler"), "http"),
         *(Source(_sym(f"{handler}.{method}"), "http", TEXT_KINDS) for handler in _HANDLERS for method in _TEXT_METHODS),
         *(Source(_sym(f"{handler}.request"), "http") for handler in _HANDLERS),
+        *(RequestObject(_sym(f"{handler}.request"), _REQUEST_TEXT) for handler in _HANDLERS),
         *(Sink(_sym(f"{handler}.write"), TaintKind.HTML) for handler in _HANDLERS),
         *(Sink(_sym(f"{handler}.finish"), TaintKind.HTML) for handler in _HANDLERS),
         *(Sink(_sym(f"{handler}.redirect"), TaintKind.REDIRECT, _TARGET_ONLY) for handler in _HANDLERS),

coretrace_python/bundled/security/ssrf/plugin.toml

@@ -1,7 +1,7 @@
 name = "ssrf"
 version = "1.0.0"
 plugin_api = ">=1,<2"
-requires = ["taint.flows", "findings.refutation"]
+requires = ["taint.flows", "findings.refutation", "ir.ssa", "abstract.module_strings"]
 provides = ["vulnerability.ssrf"]
 
 [entrypoint]

coretrace_python/bundled/security/ssrf/ssrf.py

@@ -1,12 +1,37 @@
-"""Server-side request forgery: attacker-controlled input reaching a SSRF sink."""
+"""Server-side request forgery: attacker-controlled input reaching a SSRF sink.
+
+How the URL is built, with ``+`` and f-strings, can prove part of its destination. Constant
+text fixing ``scheme://host`` and ending the authority with ``/``, ``?`` or ``#`` before
+any input keeps the input from choosing the host; the input still chooses the path, which
+may reach a sensitive resource of that host, and a redirect may lead elsewhere, so the
+flow is a hotspot. With the path fixed too, the input reaching the query or fragment
+only, and redirects disabled in the call, the destination is fixed and the flow is
+refuted. Anything unproven, a base of unknown value or a URL built in a helper function,
+stays a vulnerability.
+"""
 
 from __future__ import annotations
 
+import re
 from typing import ClassVar
 
+from coretrace_python.abstract.strings import ModuleStringsAnalysis, leading_text
+from coretrace_python.analysis import AnyAnalysis
 from coretrace_python.findings import Severity
-from coretrace_python.plugins import TaintDetector
-from coretrace_python.taint import TaintKind
+from coretrace_python.findings.refutation import Status, Verdict
+from coretrace_python.hir import nodes
+from coretrace_python.ir.ssa import SSAAnalysis
+from coretrace_python.plugins import PluginContext, TaintDetector
+from coretrace_python.taint import TaintFlow, TaintKind
+
+# ``scheme://`` and an authority ended by ``/``, ``?`` or ``#``. A backslash, which some
+# URL parsers take for a slash, does not end it here.
+_FIXED_HOST = re.compile(r"[A-Za-z][A-Za-z0-9+.-]*://[^/?#\\]+[/?#]")
+# The same with the path fixed too: what follows is query or fragment.
+_FIXED_PATH = re.compile(r"[A-Za-z][A-Za-z0-9+.-]*://[^/?#\\]+(?:/[^?#]*)?[?#]")
+# A client honours the one of these keywords it knows and rejects the other with a
+# ``TypeError``: either way, the call follows no redirect.
+_NO_REDIRECTS = ("allow_redirects", "follow_redirects")
 
 
 class SsrfPlugin(TaintDetector):
@@ -15,3 +40,25 @@ class SsrfPlugin(TaintDetector):
     kind: ClassVar[TaintKind] = TaintKind.SSRF
     severity: ClassVar[Severity] = Severity.HIGH
     title: ClassVar[str] = "Server-side request forgery"
+    requires: ClassVar[frozenset[AnyAnalysis]] = TaintDetector.requires | {SSAAnalysis, ModuleStringsAnalysis}
+
+    def judge(self, ctx: PluginContext, function: nodes.Function, flow: TaintFlow, verdict: Verdict) -> Verdict:
+        if flow.through is not None:
+            return verdict  # the URL is built in the callee
+        ssa = ctx.get(SSAAnalysis, function)
+        defs = {i.result: i for block in ssa.blocks for i in block.instructions if i.result is not None}
+        text, _ = leading_text(flow.argument, defs, ctx.get(ModuleStringsAnalysis))
+        host = _FIXED_HOST.match(text)
+        if host is None:
+            return verdict
+        arguments = flow.sink_arguments
+        no_redirects = arguments is not None and any(arguments.given(name) == (True, "False") for name in _NO_REDIRECTS)
+        if _FIXED_PATH.match(text) is not None:
+            if no_redirects:
+                return Verdict(flow, Status.REFUTED, f"the destination is fixed by {text!r} and redirects are disabled")
+            left = "a redirect may lead elsewhere"
+        else:
+            left = "the input chooses the path" + ("" if no_redirects else ", and a redirect may lead elsewhere")
+        if verdict.status is not Status.VULNERABILITY:
+            return verdict
+        return Verdict(flow, Status.HOTSPOT, f"the host is fixed by {host.group(0)!r}, but {left}")

coretrace_python/engine.py

@@ -17,6 +17,7 @@ from typing import Any, ClassVar
 
 from coretrace_python import __version__
 from coretrace_python.abstract import ConstantPropagation, HeapAnalysis, RangeAnalysis
+from coretrace_python.abstract.strings import ModuleStringsAnalysis
 from coretrace_python.analysis import (
     AnalysisContext,
     AnalysisManager,
@@ -143,6 +144,7 @@ ALL_ANALYSES: tuple[AnyAnalysis, ...] = (
     DefUseAnalysis,
     ConstantPropagation,
     RangeAnalysis,
+    ModuleStringsAnalysis,
     HeapAnalysis,
     CallGraphAnalysis,
     SummaryAnalysis,

coretrace_python/plugins/detectors.py

@@ -13,13 +13,14 @@ from typing import ClassVar
 
 from coretrace_python.analysis import AnyAnalysis
 from coretrace_python.findings import Confidence, Finding, Severity
-from coretrace_python.findings.refutation import RefutationAnalysis, Status
+from coretrace_python.findings.refutation import RefutationAnalysis, Status, Verdict
+from coretrace_python.hir import nodes
 from coretrace_python.interprocedural import CallGraphAnalysis
 from coretrace_python.ir.model import Call, Instruction, Symbol, Value
 from coretrace_python.ir.ssa import SSAAnalysis
 from coretrace_python.plugins.api import Plugin, PluginContext
 from coretrace_python.semantic.symbols import SymbolId
-from coretrace_python.taint import TaintAnalysis, TaintKind
+from coretrace_python.taint import TaintAnalysis, TaintFlow, TaintKind
 
 
 class TaintDetector(Plugin):
@@ -40,6 +41,9 @@ class TaintDetector(Plugin):
                 if not flow.kinds & self.kind:
                     continue
                 verdict = verdicts.verdict(flow)
+                if verdict.status is Status.REFUTED:
+                    continue
+                verdict = self.judge(ctx, function, flow, verdict)
                 if verdict.status is Status.REFUTED:
                     continue
                 message = f"{self.title}: {flow.source.label} input reaches {flow.sink.symbol}"
@@ -70,6 +74,13 @@ class TaintDetector(Plugin):
                 )
         return findings
 
+    def judge(self, ctx: PluginContext, function: nodes.Function, flow: TaintFlow, verdict: Verdict) -> Verdict:
+        """This rule's verdict on ``flow``, given the refutation's: the same, unless the rule
+        knows more about its own sinks. The refutation's verdict, which other consumers
+        of the flow read, does not change."""
+
+        return verdict
+
 
 def _lower(confidence: Confidence) -> Confidence:
     return {Confidence.HIGH: Confidence.MEDIUM}.get(confidence, Confidence.LOW)

coretrace_python/taint/__init__.py

@@ -17,6 +17,7 @@ from coretrace_python.taint.models import (
     ModelError,
     ModelTable,
     NamedParameter,
+    RequestObject,
     RouteRegistrar,
     SafeArgument,
     Sanitizer,
@@ -45,6 +46,7 @@ __all__ = [
     "ModelTable",
     "NamedParameter",
     "RegisteredRoutes",
+    "RequestObject",
     "RouteRegistrar",
     "Routes",
     "SafeArgument",

coretrace_python/taint/engine.py

@@ -74,6 +74,7 @@ from coretrace_python.semantic.scopes import ScopeAnalysis, ScopeId, ScopeTable
 from coretrace_python.semantic.symbols import SymbolAnalysis, SymbolId, SymbolTable
 from coretrace_python.source import SourceSpan
 from coretrace_python.taint.models import (
+    TEXT_KINDS,
     EntryPoint,
     ModelTable,
     SecurityModelAnalysis,
@@ -84,6 +85,9 @@ from coretrace_python.taint.models import (
 from coretrace_python.taint.routes import RegisteredRoutes, Routes
 from coretrace_python.taint.templates import EscapedTemplates
 
+# What only a structure carries, and text does not.
+_STRUCTURED = TaintKind.ALL & ~TEXT_KINDS
+
 
 @dataclass(frozen=True)
 class Taint:
@@ -274,19 +278,42 @@ class _TaintProblem(DataflowProblem[State]):
         taint = Taint.none()
         symbol = self.symbols.get(instruction.result) if instruction.result else None
         if symbol is not None:
-            source = self.models.source_covering(symbol)
-            if source is not None:
-                taint = Taint(source.kinds, frozenset({source}))
+            taint = self.covered(symbol)
         if isinstance(instruction, Symbol | Compare):
             return taint
         for operand in instruction.operands():
-            taint = taint.join(state.get(operand, Taint.none()))
+            operand_taint = state.get(operand, Taint.none())
+            if isinstance(instruction, GetAttr):
+                operand_taint = self.attribute(operand_taint, instruction.attribute)
+            taint = taint.join(operand_taint)
         if isinstance(instruction, BuildList | BuildTuple | BuildDict | BuildSet):
             # ``[*xs]`` and ``{**d}`` copy the contents of what they unpack.
             for unpacked in instruction.unpacked:
                 taint = taint.join(self.deep(unpacked, state))
         return taint
 
+    def covered(self, symbol: SymbolId) -> Taint:
+        """The taint of the source covering ``symbol``, if any. Below a request source, as
+        ``self.request.GET`` is, it is the taint of the request attribute read."""
+
+        source = self.models.source_covering(symbol)
+        if source is None:
+            return Taint.none()
+        taint = Taint(source.kinds, frozenset({source}))
+        if symbol == source.symbol:
+            return taint
+        read = symbol.canonical_name.removeprefix(f"{source.symbol.canonical_name}.").split(".")[0]
+        return self.attribute(taint, read)
+
+    def attribute(self, taint: Taint, name: str) -> Taint:
+        """What attribute ``name`` of a value carrying ``taint`` carries: text when every
+        source of the value is a request object listing ``name`` among its text attributes."""
+
+        requests = [self.models.request_object(source.symbol) for source in taint.sources]
+        if taint and all(request is not None and name in request.text for request in requests):
+            return taint.without(_STRUCTURED)
+        return taint
+
     def call(self, call: Call, state: dict[Key, Taint], flows: list[TaintFlow]) -> Taint:
         arguments = tuple(self.deep(a, state) for a in call.arguments)
         keywords = Taint.none()
@@ -420,11 +447,7 @@ class _TaintProblem(DataflowProblem[State]):
         if cleared:
             return everything.without(TaintKind(cleared))
         # A method on a tainted object returns tainted data (``request.args.get``).
-        everything = everything.join(state.get(call.callee, Taint.none()))
-        source = self.models.source_covering(symbol)
-        if source is not None:
-            return everything.join(Taint(source.kinds, frozenset({source})))
-        return everything
+        return everything.join(state.get(call.callee, Taint.none())).join(self.covered(symbol))
 
     def guarded(self, sink: Sink | None, arguments: Arguments) -> Sink | None:
         """The sink as this call makes it: an argument declared safe (``yaml.load`` with
@@ -777,7 +800,8 @@ def parameter_sources(
     entry point (``self`` excepted for a method), including one registered elsewhere
     (``routes``), and every parameter annotated with a typed-parameter symbol. An entry
     point's parameter annotated with scalars is text: FastAPI validates it before the
-    handler runs, and a scalar cannot hold a query operator."""
+    handler runs, and a scalar cannot hold a query operator. So are the URL parameters
+    a view receives after a request object."""
 
     owner = _owner(module, function)
     sources: dict[int, Source] = {}
@@ -786,10 +810,13 @@ def parameter_sources(
     entry = function_entry_point(function, module, models, scopes, symbols, instances, routes)
     if entry is not None:
         first = 1 if owner is not None else 0
+        request = models.request_object(entry.symbol)
         for index in range(first, len(function.parameters)):
             annotation = function.parameters[index].annotation
-            scalar = annotation is not None and _scalar(annotation, symbols, enclosing)
-            kinds = entry.kinds & ~TaintKind.NOSQL if scalar else entry.kinds
+            text = (request is not None and index > first) or (
+                annotation is not None and _scalar(annotation, symbols, enclosing)
+            )
+            kinds = entry.kinds & ~_STRUCTURED if text else entry.kinds
             sources[index] = Source(entry.symbol, entry.label, kinds)
     for index, parameter in enumerate(function.parameters):
         if parameter.annotation is None:

coretrace_python/taint/models.py

@@ -205,6 +205,22 @@ class TemplateRender:
     keyword: str = "template_name"
 
 
+@dataclass(frozen=True)
+class RequestObject:
+    """The inputs from ``symbol`` are request objects; ``symbol`` names an entry point, a
+    route registrar, a typed parameter or a source. A view receives the request first
+    (after ``self``), then URL parameters, which are text. Reading one of the request's
+    ``text`` attributes (``GET``, ``headers``) gives text, while its body and files keep the
+    kinds of the request: text carries ``TEXT_KINDS``."""
+
+    symbol: SymbolId
+    text: tuple[str, ...] = ()
+
+    def __post_init__(self) -> None:
+        # Sorted: the models' repr is part of the cache key, the same in every process.
+        object.__setattr__(self, "text", tuple(sorted(set(self.text))))
+
+
 @dataclass(frozen=True)
 class AuthorizationGuard:
     """A decorator, or a condition, that restricts who reaches the code behind it; a
@@ -228,6 +244,7 @@ Model = (
     | SafeArgument
     | TemplateRender
     | Members
+    | RequestObject
 )
 
 
@@ -246,6 +263,7 @@ class ModelTable:
     safe_arguments: tuple[SafeArgument, ...] = ()
     template_renders: tuple[TemplateRender, ...] = ()
     members: tuple[Members, ...] = ()
+    request_objects: tuple[RequestObject, ...] = ()
     _by_symbol: dict[type[Model], dict[SymbolId, Model]] = field(
         init=False, repr=False, compare=False
     )
@@ -262,6 +280,7 @@ class ModelTable:
             RouteRegistrar: {m.symbol: m for m in self.route_registrars},
             SafeArgument: {m.symbol: m for m in self.safe_arguments},
             TemplateRender: {m.symbol: m for m in self.template_renders},
+            RequestObject: {m.symbol: m for m in self.request_objects},
         }
         object.__setattr__(self, "_by_symbol", MappingProxyType(index))
 
@@ -330,6 +349,7 @@ class ModelTable:
             self.safe_arguments,
             self.template_renders,
             self.members,
+            self.request_objects,
         )
 
     def sanitizer(self, symbol: SymbolId) -> Sanitizer | None:
@@ -344,6 +364,10 @@ class ModelTable:
         found = self._by_symbol[TemplateRender].get(symbol)
         return found if isinstance(found, TemplateRender) else None
 
+    def request_object(self, symbol: SymbolId) -> RequestObject | None:
+        found = self._by_symbol[RequestObject].get(symbol)
+        return found if isinstance(found, RequestObject) else None
+
     def members_by_class(self) -> Mapping[SymbolId, Members]:
         """The ``Members`` models by class, as symbol resolution reads them."""
 
@@ -408,6 +432,7 @@ class SecurityModelRegistry:
             safe_arguments=tuple(m for m in models if isinstance(m, SafeArgument)),
             template_renders=tuple(m for m in models if isinstance(m, TemplateRender)),
             members=tuple(m for m in models if isinstance(m, Members)),
+            request_objects=tuple(m for m in models if isinstance(m, RequestObject)),
         )
 
 

{coretrace_python_analyzer-0.12.0.dist-info → coretrace_python_analyzer-0.14.0.dist-info}/METADATA

@@ -1,6 +1,6 @@
 Metadata-Version: 2.5
 Name: coretrace-python-analyzer
-Version: 0.12.0
+Version: 0.14.0
 Summary: Static security analysis infrastructure for Python code
 Project-URL: Homepage, https://github.com/CoreTrace/coretrace-python-analyzer
 Project-URL: Repository, https://github.com/CoreTrace/coretrace-python-analyzer

{coretrace_python_analyzer-0.12.0.dist-info → coretrace_python_analyzer-0.14.0.dist-info}/RECORD

@@ -1,12 +1,13 @@
-coretrace_python/__init__.py,sha256=85TrDjaBuFgudnqeEtHn3Snm9YTbwzOR_D7xaGXhXG8,76
+coretrace_python/__init__.py,sha256=kY0Q5RzkkixmFjJXYSXgYgHOkh327TcAyqMH9u0a_M0,76
 coretrace_python/__main__.py,sha256=V8DnYtRboISK2VCKm7DGHLREKvqLbqApyWlKBOs26wU,65
 coretrace_python/cache.py,sha256=-pZv-ELm4jMCTXQWSZIobHaT9UHIjFu7IlMkOM0i4LI,13607
 coretrace_python/cli.py,sha256=G5jhb6g6RgSRSjjS7DBgziIjUM1vTFwalJGvFHVKxrg,11225
-coretrace_python/engine.py,sha256=nwK8fbcEOT0zKiBlK67aCl7yiQpE00j56LLknXn7Djg,32276
+coretrace_python/engine.py,sha256=yICn93LZyoWOdDoZEIqoWATuhPQhLPW8ANLxJPskDwM,32371
 coretrace_python/abstract/__init__.py,sha256=n5FNkV8Z4LmwG0r06KWdLj4N2CPSgAKwY3896tdmRgM,999
 coretrace_python/abstract/constants.py,sha256=z4-e7IzysxzGi58wFFff1MlEoV8l7AZsB9EL-q6b7vY,9071
 coretrace_python/abstract/heap.py,sha256=OaESXFGC0qzyhAr76xrCu4skeDVzZM4wlenQqfMTkdk,9642
 coretrace_python/abstract/ranges.py,sha256=zEl9ee55u3E02tkYzzIvCCud5mYRKIUgZd9h_0-crCM,11547
+coretrace_python/abstract/strings.py,sha256=G5EGlhxjrpjU9TuXQifuVO-6MNMrUtZ_4S3nkMEvIuQ,4095
 coretrace_python/abstract/values.py,sha256=SQmgR8jo7cd8KJFDokejg-cFTjJU1CTBUPYyEvbMg-4,1739
 coretrace_python/analysis/__init__.py,sha256=hE7lDwXOdA05_aSZaERRgMv0C2ev8jjJbz4xvrja4Og,728
 coretrace_python/analysis/manager.py,sha256=suoIrPwimyu1AjF6BJwpqAkJBwe6XxzQu9JwV2TN2aQ,5843
@@ -19,7 +20,7 @@ coretrace_python/bundled/dependency/sample_advisories/plugin.toml,sha256=cME4pSF
 coretrace_python/bundled/dependency/sample_advisories/sample_advisories.py,sha256=jw98GK6hh5RAx05t8QPcUzsFMfGigAL8418vZLprKlc,3710
 coretrace_python/bundled/dependency/vulnerable_dependency/plugin.toml,sha256=4-OnbEb3lYVAoTfuz8mDPH4L9fHOPQ2KW1dDFAbClFk,267
 coretrace_python/bundled/dependency/vulnerable_dependency/vulnerable_dependency.py,sha256=THXqpuffQZ8nuv1b8zQrgkA7eTI1PxhODATMzqhWeyY,3393
-coretrace_python/bundled/models/aiohttp/aiohttp_models.py,sha256=EraiXpZih8yPRk5t0OKe2TMJO9iATv4Kj_lKLp_KpfA,2946
+coretrace_python/bundled/models/aiohttp/aiohttp_models.py,sha256=X3ZYgbrezHbsP3D9rVt-qM1_Iecu6nT_Yz9H7-XGl4M,3422
 coretrace_python/bundled/models/aiohttp/plugin.toml,sha256=YvU60RUBexYBtIxbXdmUhO83BoijmOe3MeQKwY8QDaM,220
 coretrace_python/bundled/models/bottle/bottle_models.py,sha256=Y0SUMCNGiGhzcMj0uxBLhCbLFgM7sBc4XBB-C5LEuDw,2200
 coretrace_python/bundled/models/bottle/plugin.toml,sha256=V2Ea1DcocKOWyOWm_KuzNCaPxN7ZOomSnCyo0e7WfXQ,196
@@ -29,7 +30,7 @@ coretrace_python/bundled/models/credentials/credential_models.py,sha256=Mw9ty8PD
 coretrace_python/bundled/models/credentials/plugin.toml,sha256=0ut7Jc7IdcvbsZKPu6ty-z3DBlMg2CUT7JX4y4nMybo,217
 coretrace_python/bundled/models/db_drivers/db_driver_models.py,sha256=x4SAwhcpuG5TLfhmVsuAQ1VV3lAXSNh5YHx7QuFBQyU,2339
 coretrace_python/bundled/models/db_drivers/plugin.toml,sha256=094-QIV92x-69uy2CgMulBXfGvt48qtefLyeW2q3SRs,178
-coretrace_python/bundled/models/django/django_models.py,sha256=1ftZ8tEBZJXrAiZr0rQZBSIOu4VqwOkHz8WE8FE5UBI,6445
+coretrace_python/bundled/models/django/django_models.py,sha256=Gg_qgQY4oT0CEW8RAFBoxyW2I56FSRJo5eWkZHZrGeQ,7370
 coretrace_python/bundled/models/django/plugin.toml,sha256=_Qa2X_4IViORQkcLvLsAC5vI-2P5CxgG8VvnuNIWcFQ,214
 coretrace_python/bundled/models/fastapi/fastapi_models.py,sha256=K2Edlo1RzYKmAJAIChNVUDc8gorAS48MGEMKNlCIGrI,1251
 coretrace_python/bundled/models/fastapi/plugin.toml,sha256=V_R2WcEc-qkST0tTpL-cRf2FEbjK6Mk727WbJmVpWJM,200
@@ -42,7 +43,7 @@ coretrace_python/bundled/models/python_stdlib/python_stdlib.py,sha256=IyCxTHjZcd
 coretrace_python/bundled/models/sqlalchemy/plugin.toml,sha256=2gRbglnMK5U2QWnzs2U2pDvmTeWmrlW7XpJ_8dRmIoY,182
 coretrace_python/bundled/models/sqlalchemy/sqlalchemy_models.py,sha256=Gm2qjyXUrjzALy-MigUhPQyyDxYdfWlQKDZLp1C6Jqk,1697
 coretrace_python/bundled/models/tornado/plugin.toml,sha256=u_XjJK2uKBR11zg4yGxsCDHcx2pKEQ1MBvvB6Mm0siA,222
-coretrace_python/bundled/models/tornado/tornado_models.py,sha256=B09X57SFbkV_CnMEb4peseB0tgCnwm3fP8om8wQoAHU,2222
+coretrace_python/bundled/models/tornado/tornado_models.py,sha256=Z8U46CbDHm7rORSsP26GBhUbe5m-LMf2QNkoBKZxB1M,2651
 coretrace_python/bundled/secrets/config_secrets/config_secrets.py,sha256=JfhWSyVbjlYD9pQYJN6qAc4Rp4IA8PP222akM4KTPU8,1283
 coretrace_python/bundled/secrets/config_secrets/plugin.toml,sha256=dRkA3zQ9wtT2EJyqZ5zGqJ5KYdyIQtQcSvesqrb4M0Q,177
 coretrace_python/bundled/secrets/hardcoded_secrets/hardcoded_secrets.py,sha256=7TD-Nf5S4yfoRBRmJ6Ab6v4Q2zIC2n79FRfNS3I4xos,544
@@ -63,8 +64,8 @@ coretrace_python/bundled/security/plaintext_credentials/plaintext_credentials.py
 coretrace_python/bundled/security/plaintext_credentials/plugin.toml,sha256=W56wUdAdf7NNirfQhTdKrn-cCwebqmvkRJg9OVFJUyM,263
 coretrace_python/bundled/security/sql_injection/plugin.toml,sha256=U35h6YdbbM93Ar_msWrwY98_bb6rN-qaa1e7XOtPeSo,224
 coretrace_python/bundled/security/sql_injection/sql_injection.py,sha256=W-ppZngb9mLwRjJPGkh__8kaDqYdSrVbciv0mPdYFNE,545
-coretrace_python/bundled/security/ssrf/plugin.toml,sha256=OySYgL9rGh1f4UuVpEOWdgcyp0vAmaP1m2IJ8Al6Ddc,189
-coretrace_python/bundled/security/ssrf/ssrf.py,sha256=bshcPZMjuQtTR4203CUTxFGZuwIYfsi58rnE5XdqKXc,549
+coretrace_python/bundled/security/ssrf/plugin.toml,sha256=Uh0hvcc2bkOEKBQUw6tyuvpPQRq8_JzhWc9nVQAdm1Y,226
+coretrace_python/bundled/security/ssrf/ssrf.py,sha256=Zk3eCu4Gp9vnR4DarG_RAm9U7hNv2ESAn_oVUVUMHF8,3441
 coretrace_python/bundled/security/xss/plugin.toml,sha256=o6aZWoDNCG6CJ11JDa5lVR0v6NHh-Jg5QpNRxoGSJaw,185
 coretrace_python/bundled/security/xss/xss.py,sha256=hzhoblPMivtwoWZ4v7YyAb15GGisX_imGWgxFzCDeqA,532
 coretrace_python/bundled/syntax/dangerous_eval/dangerous_eval.py,sha256=_ktrigLDf-XTKjWtYX-_wZ9-Gb3G4bCzRhpU0Xj-c1g,723
@@ -124,7 +125,7 @@ coretrace_python/ir/printer.py,sha256=otBIhZUvB_UfB68gid_FbPcSjBUSmxH3v7vBMZZQVk
 coretrace_python/ir/ssa.py,sha256=cIYbcv90PI6AOeMrw2ZWp88fy7E2ZO4P3tqjtPHra7g,11116
 coretrace_python/plugins/__init__.py,sha256=xRKqkvkvQMmfQACHHoBioYhIyyK4HoMAVogy6EZG8tg,1398
 coretrace_python/plugins/api.py,sha256=FcIe2c4sFB-PAPtYcJkidvdZJkr_xFKT8SvlBP5l38o,8603
-coretrace_python/plugins/detectors.py,sha256=ej5Z_MS0CBqrR4b9xycjTVUIo5arpArpdbr7nL732iI,5700
+coretrace_python/plugins/detectors.py,sha256=9c6yaLvf5nwtiiIskLd9WE_R4IE_RcqjOD5c-SH0SuI,6274
 coretrace_python/plugins/loader.py,sha256=Use-lHTL4-IJYQBZmODC89zhJbYKGvDSLZHWjZa5NaI,3885
 coretrace_python/plugins/manifest.py,sha256=F24pgQSwApRUL6ZihRSLv9wL_M03A_pZjrj9Zi4Ku3Q,3438
 coretrace_python/plugins/registry.py,sha256=ixKcT2YDky96TWCFckdzKnGRmFn1dbBVMSZLPvdxvY8,1177
@@ -142,14 +143,14 @@ coretrace_python/semantic/symbols.py,sha256=G0jwsWFo2346Y1R2sztsB8HuZZm_aHfHSJXX
 coretrace_python/source/__init__.py,sha256=0Y8fvtbkETnNCJR9Zq7RS5TSgF9c22pz3SSk1KdAXF0,301
 coretrace_python/source/manager.py,sha256=JRmMOcWfS1nocbVrdcvfQTqEfIkmnb5JP857TpGywN4,2736
 coretrace_python/source/model.py,sha256=FZnN5mlir3tzbIpWoxnn6YtRi9UcJ_y0sZM60tKr8U4,1727
-coretrace_python/taint/__init__.py,sha256=A-DU2w7cnoX-ZbRzzC4YjbmBqjhNsrPW1JfmlCjyqGs,1474
-coretrace_python/taint/engine.py,sha256=aJKYKNlt-cItwqukzF3XfAKDVHERNrVlaUuP-MtpC8Y,43353
-coretrace_python/taint/models.py,sha256=orTt70VZhzpIXSzSa_hm-YxKnLmF81VCwE-CO_CTLfc,15890
+coretrace_python/taint/__init__.py,sha256=n0WMjstUkrJZ2QnMgGBlJwqCZ0LHno670XRd__TEcaI,1514
+coretrace_python/taint/engine.py,sha256=rEAbwjR5v294PqBzBlu6f9WiMvVmwV83FqdsWbT4l3c,44648
+coretrace_python/taint/models.py,sha256=8AwPKKdmwAHmE7CxwUbtWn5w7JVkEJ06_Is7xQWTx38,17066
 coretrace_python/taint/routes.py,sha256=UAJKXcw_sM9shf58FfDroxVO9bNSm4qrQdZknwUB0lo,6110
 coretrace_python/taint/templates.py,sha256=8Ojb43VXuWxOVifeXRpi3_2mjZfnvIC7GQ-AW80GUYk,11148
-coretrace_python_analyzer-0.12.0.dist-info/METADATA,sha256=aI3xBMs5H9Ue5btuk_0XZnkA42jTzagtALNVCYCTKQA,3217
-coretrace_python_analyzer-0.12.0.dist-info/WHEEL,sha256=W3fkpkm7-wf9vBI5Z-7s0eWkeM-spu78I8Neb98DeEg,87
-coretrace_python_analyzer-0.12.0.dist-info/entry_points.txt,sha256=wdozemiraOkbt65g_Y_zgspuZpoLxJdaCVMJt1Ft3c0,72
-coretrace_python_analyzer-0.12.0.dist-info/licenses/LICENSE,sha256=z8d0m5b2O9McPEK1xHG_dWgUBT6EfBDz6wA0F7xSPTA,11358
-coretrace_python_analyzer-0.12.0.dist-info/licenses/NOTICE,sha256=s3VHj5ngV0ozjW_kZJpg_35ne6JwoBK0ysOjbqVtA0w,113
-coretrace_python_analyzer-0.12.0.dist-info/RECORD,,
+coretrace_python_analyzer-0.14.0.dist-info/METADATA,sha256=I6joOK1gGJSOzcn3pJ9PYii-2Yb7Ak-PSK9SmQWz4vQ,3217
+coretrace_python_analyzer-0.14.0.dist-info/WHEEL,sha256=W3fkpkm7-wf9vBI5Z-7s0eWkeM-spu78I8Neb98DeEg,87
+coretrace_python_analyzer-0.14.0.dist-info/entry_points.txt,sha256=wdozemiraOkbt65g_Y_zgspuZpoLxJdaCVMJt1Ft3c0,72
+coretrace_python_analyzer-0.14.0.dist-info/licenses/LICENSE,sha256=z8d0m5b2O9McPEK1xHG_dWgUBT6EfBDz6wA0F7xSPTA,11358
+coretrace_python_analyzer-0.14.0.dist-info/licenses/NOTICE,sha256=s3VHj5ngV0ozjW_kZJpg_35ne6JwoBK0ysOjbqVtA0w,113
+coretrace_python_analyzer-0.14.0.dist-info/RECORD,,