coretrace-python-analyzer 0.14.0__py3-none-any.whl → 0.15.0__py3-none-any.whl

coretrace_python/__init__.py

@@ -1,4 +1,4 @@
 """CoreTrace's Python static analysis frontend."""
 
-__version__ = "0.14.0"
+__version__ = "0.15.0"
 

coretrace_python/bundled/security/open_redirect/open_redirect.py

@@ -1,12 +1,26 @@
-"""Open redirect: attacker-controlled input reaching a open redirect sink."""
+"""Open redirect: attacker-controlled input reaching a open redirect sink.
+
+The rule draws its verdict from what the target's constant text proves (``taint.urls``),
+as a browser resolves it. A reference on the current site (``/profile/``, ``?page=``,
+``profile/``) keeps the browser on the site, where any further redirect is the project's
+own code, analysed on its own: refuted. A fixed absolute host sends the browser there,
+but the input chooses the path, where that host may redirect again: a hotspot. Anything
+unproven, ``"/" + next`` included, stays a vulnerability.
+"""
 
 from __future__ import annotations
 
 from typing import ClassVar
 
+from coretrace_python.abstract.strings import ModuleStringsAnalysis
+from coretrace_python.analysis import AnyAnalysis
 from coretrace_python.findings import Severity
-from coretrace_python.plugins import TaintDetector
-from coretrace_python.taint import TaintKind
+from coretrace_python.findings.refutation import Status, Verdict
+from coretrace_python.hir import nodes
+from coretrace_python.ir.ssa import SSAAnalysis
+from coretrace_python.plugins import PluginContext, TaintDetector
+from coretrace_python.taint import TaintFlow, TaintKind
+from coretrace_python.taint.urls import flow_url
 
 
 class OpenRedirectPlugin(TaintDetector):
@@ -15,3 +29,19 @@ class OpenRedirectPlugin(TaintDetector):
     kind: ClassVar[TaintKind] = TaintKind.REDIRECT
     severity: ClassVar[Severity] = Severity.MEDIUM
     title: ClassVar[str] = "Open redirect"
+    requires: ClassVar[frozenset[AnyAnalysis]] = TaintDetector.requires | {SSAAnalysis, ModuleStringsAnalysis}
+
+    def judge(self, ctx: PluginContext, function: nodes.Function, flow: TaintFlow, verdict: Verdict) -> Verdict:
+        ssa = ctx.get(SSAAnalysis, function)
+        defs = {i.result: i for block in ssa.blocks for i in block.instructions if i.result is not None}
+        target = flow_url(flow, defs, ctx.get(ModuleStringsAnalysis))
+        if target.relative:
+            return Verdict(flow, Status.REFUTED, f"the browser stays on the site: the target starts with {target.text!r}")
+        if target.origin is not None and verdict.status is Status.VULNERABILITY:
+            return Verdict(
+                flow,
+                Status.HOTSPOT,
+                f"the browser goes to the host fixed by {target.origin!r}, but the input chooses the path, "
+                "where that host may redirect again",
+            )
+        return verdict

coretrace_python/bundled/security/open_redirect/plugin.toml

@@ -1,7 +1,7 @@
 name = "open-redirect"
 version = "1.0.0"
 plugin_api = ">=1,<2"
-requires = ["taint.flows", "findings.refutation"]
+requires = ["taint.flows", "findings.refutation", "ir.ssa", "abstract.module_strings"]
 provides = ["vulnerability.open-redirect"]
 
 [entrypoint]

coretrace_python/bundled/security/ssrf/ssrf.py

@@ -1,21 +1,18 @@
 """Server-side request forgery: attacker-controlled input reaching a SSRF sink.
 
-How the URL is built, with ``+`` and f-strings, can prove part of its destination. Constant
-text fixing ``scheme://host`` and ending the authority with ``/``, ``?`` or ``#`` before
-any input keeps the input from choosing the host; the input still chooses the path, which
-may reach a sensitive resource of that host, and a redirect may lead elsewhere, so the
-flow is a hotspot. With the path fixed too, the input reaching the query or fragment
-only, and redirects disabled in the call, the destination is fixed and the flow is
-refuted. Anything unproven, a base of unknown value or a URL built in a helper function,
-stays a vulnerability.
+The rule draws its verdict from what the URL's constant text proves (``taint.urls``).
+A fixed host keeps the input from choosing it, but the input still chooses the path,
+which may reach a sensitive resource of that host, and a redirect may lead elsewhere: a
+hotspot. With the path fixed too, the input reaching the query or fragment only, and
+redirects disabled in the call, the destination is fixed: refuted. Anything unproven,
+a base of unknown value or a URL built in a helper function, stays a vulnerability.
 """
 
 from __future__ import annotations
 
-import re
 from typing import ClassVar
 
-from coretrace_python.abstract.strings import ModuleStringsAnalysis, leading_text
+from coretrace_python.abstract.strings import ModuleStringsAnalysis
 from coretrace_python.analysis import AnyAnalysis
 from coretrace_python.findings import Severity
 from coretrace_python.findings.refutation import Status, Verdict
@@ -23,15 +20,7 @@ from coretrace_python.hir import nodes
 from coretrace_python.ir.ssa import SSAAnalysis
 from coretrace_python.plugins import PluginContext, TaintDetector
 from coretrace_python.taint import TaintFlow, TaintKind
-
-# ``scheme://`` and an authority ended by ``/``, ``?`` or ``#``. A backslash, which some
-# URL parsers take for a slash, does not end it here.
-_FIXED_HOST = re.compile(r"[A-Za-z][A-Za-z0-9+.-]*://[^/?#\\]+[/?#]")
-# The same with the path fixed too: what follows is query or fragment.
-_FIXED_PATH = re.compile(r"[A-Za-z][A-Za-z0-9+.-]*://[^/?#\\]+(?:/[^?#]*)?[?#]")
-# A client honours the one of these keywords it knows and rejects the other with a
-# ``TypeError``: either way, the call follows no redirect.
-_NO_REDIRECTS = ("allow_redirects", "follow_redirects")
+from coretrace_python.taint.urls import flow_url, redirects_disabled
 
 
 class SsrfPlugin(TaintDetector):
@@ -43,22 +32,18 @@ class SsrfPlugin(TaintDetector):
     requires: ClassVar[frozenset[AnyAnalysis]] = TaintDetector.requires | {SSAAnalysis, ModuleStringsAnalysis}
 
     def judge(self, ctx: PluginContext, function: nodes.Function, flow: TaintFlow, verdict: Verdict) -> Verdict:
-        if flow.through is not None:
-            return verdict  # the URL is built in the callee
         ssa = ctx.get(SSAAnalysis, function)
         defs = {i.result: i for block in ssa.blocks for i in block.instructions if i.result is not None}
-        text, _ = leading_text(flow.argument, defs, ctx.get(ModuleStringsAnalysis))
-        host = _FIXED_HOST.match(text)
-        if host is None:
+        url = flow_url(flow, defs, ctx.get(ModuleStringsAnalysis))
+        if url.origin is None:
             return verdict
-        arguments = flow.sink_arguments
-        no_redirects = arguments is not None and any(arguments.given(name) == (True, "False") for name in _NO_REDIRECTS)
-        if _FIXED_PATH.match(text) is not None:
+        no_redirects = redirects_disabled(flow.sink_arguments)
+        if url.path_fixed:
             if no_redirects:
-                return Verdict(flow, Status.REFUTED, f"the destination is fixed by {text!r} and redirects are disabled")
+                return Verdict(flow, Status.REFUTED, f"the destination is fixed by {url.text!r} and redirects are disabled")
             left = "a redirect may lead elsewhere"
         else:
             left = "the input chooses the path" + ("" if no_redirects else ", and a redirect may lead elsewhere")
         if verdict.status is not Status.VULNERABILITY:
             return verdict
-        return Verdict(flow, Status.HOTSPOT, f"the host is fixed by {host.group(0)!r}, but {left}")
+        return Verdict(flow, Status.HOTSPOT, f"the host is fixed by {url.origin!r}, but {left}")

coretrace_python/dependency/advisories.py

@@ -251,7 +251,7 @@ def _condition(entry: Mapping[str, Any]) -> Condition:
     default = entry.get("default", False)
     if not isinstance(default, bool):
         raise TypeError(f"condition default must be true or false, got {default!r}")
-    return Condition(
+    condition = Condition(
         str(entry["kind"]),
         str(entry["text"]),
         None if entry.get("argument") is None else str(entry["argument"]),
@@ -259,3 +259,8 @@ def _condition(entry: Mapping[str, Any]) -> Condition:
         position,
         default,
     )
+    if condition.kind == "host" and (
+        (condition.argument is None and condition.position is None) or condition.values or condition.default
+    ):
+        raise ValueError("a host condition names the URL argument, by keyword or position, and nothing else")
+    return condition

coretrace_python/dependency/correlation.py

@@ -10,7 +10,7 @@ are correlated here into one high-confidence ``exploitable-vulnerability`` findi
 from __future__ import annotations
 
 from collections.abc import Iterable, Mapping
-from dataclasses import dataclass
+from dataclasses import dataclass, replace
 
 from coretrace_python.dependency.graph import (
     DIRECT,
@@ -24,6 +24,7 @@ from coretrace_python.findings.refutation import Status, Verdict, Verdicts
 from coretrace_python.interprocedural import Arguments, CallSite, ExternalSymbol
 from coretrace_python.semantic.symbols import SymbolId
 from coretrace_python.taint import Sink, TaintFlow, TaintKind
+from coretrace_python.taint.urls import UrlProof, redirects_disabled
 
 Affected = Mapping[SymbolId, tuple[Advisory, ...]]
 
@@ -61,14 +62,33 @@ class ConditionCheck:
     passed: str | None = None
 
 
-def check_conditions(entry: AdvisoryEntryPoint | None, arguments: Arguments | None) -> ConditionCheck:
-    """Decide ``entry``'s conditions against what the call's ``arguments`` denote."""
+def check_conditions(
+    entry: AdvisoryEntryPoint | None,
+    arguments: Arguments | None,
+    url: UrlProof | None = None,
+    passed_as: frozenset[tuple[int | None, str | None]] = frozenset(),
+) -> ConditionCheck:
+    """Decide ``entry``'s conditions against what the call's ``arguments`` denote and, for
+    a ``host`` condition, what ``url`` proves of the value the attacker's input is passed
+    in (``passed_as``). A host the URL's constant text fixes rules the call out when the
+    call disables redirects; otherwise a redirect may still lead to a host the attacker
+    controls, and the condition stays pending with that uncertainty."""
 
     if entry is None:
         return ConditionCheck()
     met: list[Condition] = []
     pending: list[Condition] = []
     for condition in entry.conditions:
+        if condition.kind == "host":
+            origin = url.origin if url is not None and _passed_in(condition, passed_as) else None
+            if origin is None:
+                pending.append(condition)
+            elif redirects_disabled(arguments):
+                return ConditionCheck(tuple(met), tuple(pending), condition, repr(origin))
+            else:
+                text = f"the host is fixed by {origin!r}, but a redirect may lead to a host the attacker controls"
+                pending.append(replace(condition, text=text))
+            continue
         given = arguments.given(condition.argument, condition.position) if condition.checkable and arguments is not None else None
         if given is None:
             pending.append(condition)
@@ -84,6 +104,16 @@ def check_conditions(entry: AdvisoryEntryPoint | None, arguments: Arguments | No
     return ConditionCheck(tuple(met), tuple(pending))
 
 
+def _passed_in(condition: Condition, passed_as: frozenset[tuple[int | None, str | None]]) -> bool:
+    """Whether a value passed as ``passed_as`` is the argument ``condition`` names."""
+
+    return any(
+        (keyword is not None and keyword == condition.argument)
+        or (keyword is None and position is not None and position == condition.position)
+        for position, keyword in passed_as
+    )
+
+
 def ruled_out(module: str, site: CallSite, check: ConditionCheck) -> str:
     """Which call a contradicted condition rules out, and why: ``app:12
     python.yaml.load(Loader=python.yaml.SafeLoader)``."""
@@ -120,9 +150,10 @@ def correlate(
     flows: Iterable[TaintFlow],
     verdicts: Verdicts | None,
     affected: Affected,
+    urls: Mapping[TaintFlow, UrlProof] | None = None,
 ) -> tuple[Finding, ...]:
     """Exploitable-vulnerability findings for the non-refuted ADVISORY flows of a function,
-    one per advisory the sink is affected by."""
+    one per advisory the sink is affected by; ``urls`` holds what each flow's URL proves."""
 
     findings: list[Finding] = []
     for flow in flows:
@@ -136,7 +167,7 @@ def correlate(
             entry = advisory.entry_point(flow.sink.symbol)
             if entry is not None and not any(entry.exploitable_through(p, k) for p, k in flow.passed_as):
                 continue
-            check = check_conditions(entry, flow.sink_arguments)
+            check = check_conditions(entry, flow.sink_arguments, (urls or {}).get(flow), flow.passed_as)
             if check.contradicted is None:
                 findings.append(_exploitable(function, flow, advisory, verdict, hotspot, check))
     return tuple(findings)

coretrace_python/dependency/graph.py

@@ -151,8 +151,10 @@ class Condition:
     ``argument`` condition names the argument by keyword, and by ``position`` when it may
     be passed positionally, and lists the ``values`` that satisfy it — symbols
     (``python.yaml.FullLoader``) or constants as Python writes them (``True``);
-    ``default`` says an absent argument means a vulnerable value. A ``semantic``
-    condition cannot be checked and is reported as pending review."""
+    ``default`` says an absent argument means a vulnerable value. A ``host`` condition
+    says the attacker must choose the host of the URL passed as ``argument`` (or at
+    ``position``); the engine decides it from what the URL's constant text proves. A
+    ``semantic`` condition cannot be checked and is reported as pending review."""
 
     kind: str
     text: str

coretrace_python/engine.py

@@ -126,6 +126,7 @@ from coretrace_python.taint import (
     escaped_templates,
     registered_routes,
 )
+from coretrace_python.taint.urls import flow_url
 
 TOOL_NAME = "coretrace-python-analyzer"
 
@@ -770,14 +771,14 @@ def _analyse_module(
     graph = manager.get(CallGraphAnalysis)
     correlated: list[Finding] = []
     if affected:
+        strings = manager.get(ModuleStringsAnalysis)
         for function in supported:
+            flows = manager.get(TaintAnalysis, function).flows
+            ssa = manager.get(SSAAnalysis, function)
+            defs = {i.result: i for block in ssa.blocks for i in block.instructions if i.result is not None}
+            urls = {flow: flow_url(flow, defs, strings) for flow in flows if flow.kinds & TaintKind.ADVISORY}
             correlated.extend(
-                correlate(
-                    graph.name_of(function),
-                    manager.get(TaintAnalysis, function).flows,
-                    manager.get(RefutationAnalysis, function),
-                    affected,
-                )
+                correlate(graph.name_of(function), flows, manager.get(RefutationAnalysis, function), affected, urls)
             )
     return CachedModule(
         manager.get(EntryPointAnalysis),

coretrace_python/taint/urls.py

@@ -0,0 +1,70 @@
+"""What the constant text a URL starts with proves about its destination, and whether a
+call follows redirects: one proof that the rules reading URLs share, each drawing its
+own verdict from it. The text is what ``+`` and f-strings build before any other value
+(``abstract.strings``); the proof says nothing about the rest of the URL."""
+
+from __future__ import annotations
+
+import re
+from collections.abc import Mapping
+from dataclasses import dataclass
+
+from coretrace_python.abstract.strings import leading_text
+from coretrace_python.interprocedural import Arguments
+from coretrace_python.ir.model import Instruction, Value
+from coretrace_python.taint.engine import TaintFlow
+
+# ``scheme://`` and an authority ended by ``/``, ``?`` or ``#``. A backslash, which some
+# URL parsers take for a slash, does not end it here.
+_ORIGIN = re.compile(r"[A-Za-z][A-Za-z0-9+.-]*://[^/?#\\]+[/?#]")
+# The same with the path fixed too: what follows is query or fragment.
+_PATH = re.compile(r"[A-Za-z][A-Za-z0-9+.-]*://[^/?#\\]+(?:/[^?#]*)?[?#]")
+# A reference a browser resolves on the current site: ``/`` then a character that is not
+# a slash, a backslash, a space or a control character (``//`` and ``/\`` name another
+# host, and a browser drops tabs and newlines), a query or a fragment, or a relative path
+# whose first segment ends in the text without a ``:`` that would make it a scheme.
+_RELATIVE = re.compile(r"/[^/\\\x00-\x20\x7f]|[?#]|[^/\\?#:\x00-\x20\x7f][^/\\?#:]*[/?#]")
+# A client honours the one of these keywords it knows and rejects the other with a
+# ``TypeError``: either way, the call follows no redirect.
+_NO_REDIRECTS = ("allow_redirects", "follow_redirects")
+
+
+@dataclass(frozen=True)
+class UrlProof:
+    """What the constant ``text`` a URL starts with proves: the ``origin`` it fixes
+    (``scheme://authority`` and the character ending it), whether it fixes the path
+    too (``path_fixed``), and whether it starts a reference a browser resolves on the
+    current site (``relative``)."""
+
+    text: str
+    origin: str | None = None
+    path_fixed: bool = False
+    relative: bool = False
+
+
+def url_proof(text: str) -> UrlProof:
+    origin = _ORIGIN.match(text)
+    return UrlProof(
+        text,
+        origin.group(0) if origin is not None else None,
+        _PATH.match(text) is not None,
+        _RELATIVE.match(text) is not None,
+    )
+
+
+def flow_url(flow: TaintFlow, defs: Mapping[Value, Instruction], strings: Mapping[str, str]) -> UrlProof:
+    """The proof for the value ``flow`` passes to its sink, ``defs`` defining the values
+    of the function making the call. A flow reaching its sink in a callee proves nothing:
+    the value is built there."""
+
+    if flow.through is not None:
+        return UrlProof("")
+    text, _ = leading_text(flow.argument, defs, strings)
+    return url_proof(text)
+
+
+def redirects_disabled(arguments: Arguments | None) -> bool:
+    """Whether the call disables redirects explicitly (``allow_redirects=False`` or
+    ``follow_redirects=False``); absent, a variable or unpacked options do not."""
+
+    return arguments is not None and any(arguments.given(name) == (True, "False") for name in _NO_REDIRECTS)

{coretrace_python_analyzer-0.14.0.dist-info → coretrace_python_analyzer-0.15.0.dist-info}/METADATA

@@ -1,6 +1,6 @@
 Metadata-Version: 2.5
 Name: coretrace-python-analyzer
-Version: 0.14.0
+Version: 0.15.0
 Summary: Static security analysis infrastructure for Python code
 Project-URL: Homepage, https://github.com/CoreTrace/coretrace-python-analyzer
 Project-URL: Repository, https://github.com/CoreTrace/coretrace-python-analyzer

{coretrace_python_analyzer-0.14.0.dist-info → coretrace_python_analyzer-0.15.0.dist-info}/RECORD

@@ -1,8 +1,8 @@
-coretrace_python/__init__.py,sha256=kY0Q5RzkkixmFjJXYSXgYgHOkh327TcAyqMH9u0a_M0,76
+coretrace_python/__init__.py,sha256=LF0lqv_rMHWvWLyAat8Ysu4q_nrKXQ35Q-QHFk2BarI,76
 coretrace_python/__main__.py,sha256=V8DnYtRboISK2VCKm7DGHLREKvqLbqApyWlKBOs26wU,65
 coretrace_python/cache.py,sha256=-pZv-ELm4jMCTXQWSZIobHaT9UHIjFu7IlMkOM0i4LI,13607
 coretrace_python/cli.py,sha256=G5jhb6g6RgSRSjjS7DBgziIjUM1vTFwalJGvFHVKxrg,11225
-coretrace_python/engine.py,sha256=yICn93LZyoWOdDoZEIqoWATuhPQhLPW8ANLxJPskDwM,32371
+coretrace_python/engine.py,sha256=Px9_zXYfBUbSEitgWcseEhza-h4j6hL_qFE8kuogrMY,32678
 coretrace_python/abstract/__init__.py,sha256=n5FNkV8Z4LmwG0r06KWdLj4N2CPSgAKwY3896tdmRgM,999
 coretrace_python/abstract/constants.py,sha256=z4-e7IzysxzGi58wFFff1MlEoV8l7AZsB9EL-q6b7vY,9071
 coretrace_python/abstract/heap.py,sha256=OaESXFGC0qzyhAr76xrCu4skeDVzZM4wlenQqfMTkdk,9642
@@ -56,8 +56,8 @@ coretrace_python/bundled/security/insecure_deserialization/insecure_deserializat
 coretrace_python/bundled/security/insecure_deserialization/plugin.toml,sha256=5OTVO9jZN-HBid8v__jYkxU-RnKX974Qqu7JQMFdj54,268
 coretrace_python/bundled/security/nosql_injection/nosql_injection.py,sha256=0MCTZ3DjOf5DQrLgnPPgpa80CYUd5teQ_iau3s_82O0,789
 coretrace_python/bundled/security/nosql_injection/plugin.toml,sha256=FP2qTPtH7ZCiu6vwfgadWlXfVnlKOigXJ43cv9PlorA,232
-coretrace_python/bundled/security/open_redirect/open_redirect.py,sha256=nUjVIgYhVh_2xBs8_1LOfcLDgQ3g3z1E7APqg2sBdpo,562
-coretrace_python/bundled/security/open_redirect/plugin.toml,sha256=8t4KLNG1DIpjjen6TuKxMjz2jv6GDcwVJDm_hJUalCg,224
+coretrace_python/bundled/security/open_redirect/open_redirect.py,sha256=t2LiqdgoD8A_ZG0iG5kZ88ZnSEcnngpHNbZUzCM92Ek,2365
+coretrace_python/bundled/security/open_redirect/plugin.toml,sha256=2SMFY7GeczfUqeX4fp600Qj24k8fUPCg4zD__JBabkw,261
 coretrace_python/bundled/security/path_traversal/path_traversal.py,sha256=MiTDZBNU6i3WWua1qaxg1swqDy3wlWwBwG6G4ClyDgw,552
 coretrace_python/bundled/security/path_traversal/plugin.toml,sha256=f0ADZimUvQatOffltF5Ihu1mkzf5rNrsaIpKBg2v39c,228
 coretrace_python/bundled/security/plaintext_credentials/plaintext_credentials.py,sha256=QaE2CXAdl0bi4dE5d2d8KnLJrsAcxUDjR76ghfsnXXo,900
@@ -65,7 +65,7 @@ coretrace_python/bundled/security/plaintext_credentials/plugin.toml,sha256=W56wU
 coretrace_python/bundled/security/sql_injection/plugin.toml,sha256=U35h6YdbbM93Ar_msWrwY98_bb6rN-qaa1e7XOtPeSo,224
 coretrace_python/bundled/security/sql_injection/sql_injection.py,sha256=W-ppZngb9mLwRjJPGkh__8kaDqYdSrVbciv0mPdYFNE,545
 coretrace_python/bundled/security/ssrf/plugin.toml,sha256=Uh0hvcc2bkOEKBQUw6tyuvpPQRq8_JzhWc9nVQAdm1Y,226
-coretrace_python/bundled/security/ssrf/ssrf.py,sha256=Zk3eCu4Gp9vnR4DarG_RAm9U7hNv2ESAn_oVUVUMHF8,3441
+coretrace_python/bundled/security/ssrf/ssrf.py,sha256=OBe7GcYvdXLpFHsdt7wPA9-UPN6i1tBiDx6a79SL6yg,2532
 coretrace_python/bundled/security/xss/plugin.toml,sha256=o6aZWoDNCG6CJ11JDa5lVR0v6NHh-Jg5QpNRxoGSJaw,185
 coretrace_python/bundled/security/xss/xss.py,sha256=hzhoblPMivtwoWZ4v7YyAb15GGisX_imGWgxFzCDeqA,532
 coretrace_python/bundled/syntax/dangerous_eval/dangerous_eval.py,sha256=_ktrigLDf-XTKjWtYX-_wZ9-Gb3G4bCzRhpU0Xj-c1g,723
@@ -94,9 +94,9 @@ coretrace_python/dataflow/__init__.py,sha256=N5uY8VTNjEk6-ARCgDkxr6uGqQIz2NbF-U9
 coretrace_python/dataflow/lattice.py,sha256=HgYGVcKVUlexvEc0yT47aQCudLxU_SWLpHhr17igkiE,1929
 coretrace_python/dataflow/solver.py,sha256=iDsW0wujhM2DXplu2JMKC46BRsroXlNETHPEoikPeG4,3475
 coretrace_python/dependency/__init__.py,sha256=BxkxnNwIEpAYtwbshCQovG-YXJ80QbwyzkmyJdbgsVg,1184
-coretrace_python/dependency/advisories.py,sha256=zti7MrojcfxfYWJuGpyLXXJU3pffpT4SJnQUa_g34Lw,10274
-coretrace_python/dependency/correlation.py,sha256=GLtrMn5yYr4NcKYNYZTqIFpwoXOrgsqI9t6lggXxFbg,7388
-coretrace_python/dependency/graph.py,sha256=HtvKeWWG9cy9TzJQ7lYMGPfHjPBxoSVgwzoj71SegaE,18445
+coretrace_python/dependency/advisories.py,sha256=RPtqT5M_kmRVnjs53PRnDJKUsUysdJmk8KuE3sigUOk,10564
+coretrace_python/dependency/correlation.py,sha256=nr5FZ3yOT4HsKzvEAFlzzaPJxBc9_X-IuyOWtRjS67Q,9033
+coretrace_python/dependency/graph.py,sha256=U9KzdVCcM7P1W6qSSSMkzMIIVEh3qlzBpBi2FAFy0y0,18633
 coretrace_python/dependency/policy.py,sha256=bsxZXL9xC0jnAzkzDh6ncnW8oKLG2H13jYmXF_q99Ng,2454
 coretrace_python/dependency/sbom.py,sha256=rzJ-t0Mwoghej8nk0N63Dpjr_wYXm6JzuOPXjD8Kqs4,3234
 coretrace_python/dependency/vex.py,sha256=YddBuXsv7UgEnHdM9Jfjpo_A700IuIqRMjQz7AHSLX4,7437
@@ -148,9 +148,10 @@ coretrace_python/taint/engine.py,sha256=rEAbwjR5v294PqBzBlu6f9WiMvVmwV83FqdsWbT4
 coretrace_python/taint/models.py,sha256=8AwPKKdmwAHmE7CxwUbtWn5w7JVkEJ06_Is7xQWTx38,17066
 coretrace_python/taint/routes.py,sha256=UAJKXcw_sM9shf58FfDroxVO9bNSm4qrQdZknwUB0lo,6110
 coretrace_python/taint/templates.py,sha256=8Ojb43VXuWxOVifeXRpi3_2mjZfnvIC7GQ-AW80GUYk,11148
-coretrace_python_analyzer-0.14.0.dist-info/METADATA,sha256=I6joOK1gGJSOzcn3pJ9PYii-2Yb7Ak-PSK9SmQWz4vQ,3217
-coretrace_python_analyzer-0.14.0.dist-info/WHEEL,sha256=W3fkpkm7-wf9vBI5Z-7s0eWkeM-spu78I8Neb98DeEg,87
-coretrace_python_analyzer-0.14.0.dist-info/entry_points.txt,sha256=wdozemiraOkbt65g_Y_zgspuZpoLxJdaCVMJt1Ft3c0,72
-coretrace_python_analyzer-0.14.0.dist-info/licenses/LICENSE,sha256=z8d0m5b2O9McPEK1xHG_dWgUBT6EfBDz6wA0F7xSPTA,11358
-coretrace_python_analyzer-0.14.0.dist-info/licenses/NOTICE,sha256=s3VHj5ngV0ozjW_kZJpg_35ne6JwoBK0ysOjbqVtA0w,113
-coretrace_python_analyzer-0.14.0.dist-info/RECORD,,
+coretrace_python/taint/urls.py,sha256=kb0-uOT12ww7R3Jzs_lPKg9lFs74JI-bpa9pXX105xM,3166
+coretrace_python_analyzer-0.15.0.dist-info/METADATA,sha256=MrHb31ufFhrM7ievaxqYvuwvTlqnif8HAvvQkVsfO30,3217
+coretrace_python_analyzer-0.15.0.dist-info/WHEEL,sha256=W3fkpkm7-wf9vBI5Z-7s0eWkeM-spu78I8Neb98DeEg,87
+coretrace_python_analyzer-0.15.0.dist-info/entry_points.txt,sha256=wdozemiraOkbt65g_Y_zgspuZpoLxJdaCVMJt1Ft3c0,72
+coretrace_python_analyzer-0.15.0.dist-info/licenses/LICENSE,sha256=z8d0m5b2O9McPEK1xHG_dWgUBT6EfBDz6wA0F7xSPTA,11358
+coretrace_python_analyzer-0.15.0.dist-info/licenses/NOTICE,sha256=s3VHj5ngV0ozjW_kZJpg_35ne6JwoBK0ysOjbqVtA0w,113
+coretrace_python_analyzer-0.15.0.dist-info/RECORD,,