coretrace-python-analyzer 0.14.0__py3-none-any.whl → 0.16.0__py3-none-any.whl

coretrace_python/__init__.py

@@ -1,4 +1,4 @@
 """CoreTrace's Python static analysis frontend."""
 
-__version__ = "0.14.0"
+__version__ = "0.16.0"
 

coretrace_python/bundled/dependency/reachable_vulnerability/reachable_vulnerability.py

@@ -1,5 +1,6 @@
 """Calls, anywhere in the project, to an API affected by a vulnerable requirement, and
-reads of an affected attribute whose getter runs the vulnerable code."""
+reads of an affected attribute whose getter runs the vulnerable code. A filter a project
+template applies is a call to the function behind it, at the template's line."""
 
 from __future__ import annotations
 
@@ -56,6 +57,10 @@ class ReachableVulnerabilityPlugin(ProjectPlugin):
                             reported.add((advisory, symbol))
                             check = check_conditions(entry, None)
                             findings.append(_reached(advisory, symbol, read.location, function, check))
+        for call in ctx.templates.calls:
+            for advisory in affected.get(call.symbol, ()):
+                check = check_conditions(advisory.entry_point(call.symbol), None)
+                findings.append(_reached(advisory, call.symbol, call.span, None, check))
         return findings
 
 
@@ -67,7 +72,9 @@ def _read_through(symbol: SymbolId) -> Iterator[SymbolId]:
         yield SymbolId(".".join(components[:end]))
 
 
-def _reached(advisory: Advisory, symbol: SymbolId, span: SourceSpan, function: str, check: ConditionCheck) -> Finding:
+def _reached(
+    advisory: Advisory, symbol: SymbolId, span: SourceSpan, function: str | None, check: ConditionCheck
+) -> Finding:
     return Finding(
         rule_id="reachable-vulnerability",
         message=(

coretrace_python/bundled/models/django/django_models.py

@@ -139,7 +139,10 @@ class DjangoModels(ModelPlugin):
         Sink(_sym("django.http.HttpResponseRedirect"), TaintKind.REDIRECT, _TARGET_ONLY),
         Sink(_sym("django.http.HttpResponsePermanentRedirect"), TaintKind.REDIRECT, _TARGET_ONLY),
         Sanitizer(_sym("django.utils.html.escape"), TaintKind.HTML),
-        TemplateRender(_sym("django.template.loader.render_to_string")),
+        TemplateRender(_sym("django.template.loader.render_to_string"), request=2),
+        TemplateRender(_sym("django.shortcuts.render"), 1, context=2, request=0),
+        TemplateRender(_sym("django.template.response.TemplateResponse"), 1, "template", 2, 0),
+        TemplateRender(_sym("django.template.response.SimpleTemplateResponse"), 0, "template"),
         Sanitizer(_sym("django.utils.html.conditional_escape"), TaintKind.HTML),
         # The masked CSRF secret: ASCII letters and digits only, a malformed cookie is
         # replaced before it is used.

coretrace_python/bundled/security/open_redirect/open_redirect.py

@@ -1,12 +1,26 @@
-"""Open redirect: attacker-controlled input reaching a open redirect sink."""
+"""Open redirect: attacker-controlled input reaching a open redirect sink.
+
+The rule draws its verdict from what the target's constant text proves (``taint.urls``),
+as a browser resolves it. A reference on the current site (``/profile/``, ``?page=``,
+``profile/``) keeps the browser on the site, where any further redirect is the project's
+own code, analysed on its own: refuted. A fixed absolute host sends the browser there,
+but the input chooses the path, where that host may redirect again: a hotspot. Anything
+unproven, ``"/" + next`` included, stays a vulnerability.
+"""
 
 from __future__ import annotations
 
 from typing import ClassVar
 
+from coretrace_python.abstract.strings import ModuleStringsAnalysis
+from coretrace_python.analysis import AnyAnalysis
 from coretrace_python.findings import Severity
-from coretrace_python.plugins import TaintDetector
-from coretrace_python.taint import TaintKind
+from coretrace_python.findings.refutation import Status, Verdict
+from coretrace_python.hir import nodes
+from coretrace_python.ir.ssa import SSAAnalysis
+from coretrace_python.plugins import PluginContext, TaintDetector
+from coretrace_python.taint import TaintFlow, TaintKind
+from coretrace_python.taint.urls import flow_url
 
 
 class OpenRedirectPlugin(TaintDetector):
@@ -15,3 +29,19 @@ class OpenRedirectPlugin(TaintDetector):
     kind: ClassVar[TaintKind] = TaintKind.REDIRECT
     severity: ClassVar[Severity] = Severity.MEDIUM
     title: ClassVar[str] = "Open redirect"
+    requires: ClassVar[frozenset[AnyAnalysis]] = TaintDetector.requires | {SSAAnalysis, ModuleStringsAnalysis}
+
+    def judge(self, ctx: PluginContext, function: nodes.Function, flow: TaintFlow, verdict: Verdict) -> Verdict:
+        ssa = ctx.get(SSAAnalysis, function)
+        defs = {i.result: i for block in ssa.blocks for i in block.instructions if i.result is not None}
+        target = flow_url(flow, defs, ctx.get(ModuleStringsAnalysis))
+        if target.relative:
+            return Verdict(flow, Status.REFUTED, f"the browser stays on the site: the target starts with {target.text!r}")
+        if target.origin is not None and verdict.status is Status.VULNERABILITY:
+            return Verdict(
+                flow,
+                Status.HOTSPOT,
+                f"the browser goes to the host fixed by {target.origin!r}, but the input chooses the path, "
+                "where that host may redirect again",
+            )
+        return verdict

coretrace_python/bundled/security/open_redirect/plugin.toml

@@ -1,7 +1,7 @@
 name = "open-redirect"
 version = "1.0.0"
 plugin_api = ">=1,<2"
-requires = ["taint.flows", "findings.refutation"]
+requires = ["taint.flows", "findings.refutation", "ir.ssa", "abstract.module_strings"]
 provides = ["vulnerability.open-redirect"]
 
 [entrypoint]

coretrace_python/bundled/security/ssrf/ssrf.py

@@ -1,21 +1,18 @@
 """Server-side request forgery: attacker-controlled input reaching a SSRF sink.
 
-How the URL is built, with ``+`` and f-strings, can prove part of its destination. Constant
-text fixing ``scheme://host`` and ending the authority with ``/``, ``?`` or ``#`` before
-any input keeps the input from choosing the host; the input still chooses the path, which
-may reach a sensitive resource of that host, and a redirect may lead elsewhere, so the
-flow is a hotspot. With the path fixed too, the input reaching the query or fragment
-only, and redirects disabled in the call, the destination is fixed and the flow is
-refuted. Anything unproven, a base of unknown value or a URL built in a helper function,
-stays a vulnerability.
+The rule draws its verdict from what the URL's constant text proves (``taint.urls``).
+A fixed host keeps the input from choosing it, but the input still chooses the path,
+which may reach a sensitive resource of that host, and a redirect may lead elsewhere: a
+hotspot. With the path fixed too, the input reaching the query or fragment only, and
+redirects disabled in the call, the destination is fixed: refuted. Anything unproven,
+a base of unknown value or a URL built in a helper function, stays a vulnerability.
 """
 
 from __future__ import annotations
 
-import re
 from typing import ClassVar
 
-from coretrace_python.abstract.strings import ModuleStringsAnalysis, leading_text
+from coretrace_python.abstract.strings import ModuleStringsAnalysis
 from coretrace_python.analysis import AnyAnalysis
 from coretrace_python.findings import Severity
 from coretrace_python.findings.refutation import Status, Verdict
@@ -23,15 +20,7 @@ from coretrace_python.hir import nodes
 from coretrace_python.ir.ssa import SSAAnalysis
 from coretrace_python.plugins import PluginContext, TaintDetector
 from coretrace_python.taint import TaintFlow, TaintKind
-
-# ``scheme://`` and an authority ended by ``/``, ``?`` or ``#``. A backslash, which some
-# URL parsers take for a slash, does not end it here.
-_FIXED_HOST = re.compile(r"[A-Za-z][A-Za-z0-9+.-]*://[^/?#\\]+[/?#]")
-# The same with the path fixed too: what follows is query or fragment.
-_FIXED_PATH = re.compile(r"[A-Za-z][A-Za-z0-9+.-]*://[^/?#\\]+(?:/[^?#]*)?[?#]")
-# A client honours the one of these keywords it knows and rejects the other with a
-# ``TypeError``: either way, the call follows no redirect.
-_NO_REDIRECTS = ("allow_redirects", "follow_redirects")
+from coretrace_python.taint.urls import flow_url, redirects_disabled
 
 
 class SsrfPlugin(TaintDetector):
@@ -43,22 +32,18 @@ class SsrfPlugin(TaintDetector):
     requires: ClassVar[frozenset[AnyAnalysis]] = TaintDetector.requires | {SSAAnalysis, ModuleStringsAnalysis}
 
     def judge(self, ctx: PluginContext, function: nodes.Function, flow: TaintFlow, verdict: Verdict) -> Verdict:
-        if flow.through is not None:
-            return verdict  # the URL is built in the callee
         ssa = ctx.get(SSAAnalysis, function)
         defs = {i.result: i for block in ssa.blocks for i in block.instructions if i.result is not None}
-        text, _ = leading_text(flow.argument, defs, ctx.get(ModuleStringsAnalysis))
-        host = _FIXED_HOST.match(text)
-        if host is None:
+        url = flow_url(flow, defs, ctx.get(ModuleStringsAnalysis))
+        if url.origin is None:
             return verdict
-        arguments = flow.sink_arguments
-        no_redirects = arguments is not None and any(arguments.given(name) == (True, "False") for name in _NO_REDIRECTS)
-        if _FIXED_PATH.match(text) is not None:
+        no_redirects = redirects_disabled(flow.sink_arguments)
+        if url.path_fixed:
             if no_redirects:
-                return Verdict(flow, Status.REFUTED, f"the destination is fixed by {text!r} and redirects are disabled")
+                return Verdict(flow, Status.REFUTED, f"the destination is fixed by {url.text!r} and redirects are disabled")
             left = "a redirect may lead elsewhere"
         else:
             left = "the input chooses the path" + ("" if no_redirects else ", and a redirect may lead elsewhere")
         if verdict.status is not Status.VULNERABILITY:
             return verdict
-        return Verdict(flow, Status.HOTSPOT, f"the host is fixed by {host.group(0)!r}, but {left}")
+        return Verdict(flow, Status.HOTSPOT, f"the host is fixed by {url.origin!r}, but {left}")

coretrace_python/dependency/advisories.py

@@ -251,7 +251,7 @@ def _condition(entry: Mapping[str, Any]) -> Condition:
     default = entry.get("default", False)
     if not isinstance(default, bool):
         raise TypeError(f"condition default must be true or false, got {default!r}")
-    return Condition(
+    condition = Condition(
         str(entry["kind"]),
         str(entry["text"]),
         None if entry.get("argument") is None else str(entry["argument"]),
@@ -259,3 +259,8 @@ def _condition(entry: Mapping[str, Any]) -> Condition:
         position,
         default,
     )
+    if condition.kind == "host" and (
+        (condition.argument is None and condition.position is None) or condition.values or condition.default
+    ):
+        raise ValueError("a host condition names the URL argument, by keyword or position, and nothing else")
+    return condition

coretrace_python/dependency/correlation.py

@@ -10,7 +10,7 @@ are correlated here into one high-confidence ``exploitable-vulnerability`` findi
 from __future__ import annotations
 
 from collections.abc import Iterable, Mapping
-from dataclasses import dataclass
+from dataclasses import dataclass, replace
 
 from coretrace_python.dependency.graph import (
     DIRECT,
@@ -24,6 +24,7 @@ from coretrace_python.findings.refutation import Status, Verdict, Verdicts
 from coretrace_python.interprocedural import Arguments, CallSite, ExternalSymbol
 from coretrace_python.semantic.symbols import SymbolId
 from coretrace_python.taint import Sink, TaintFlow, TaintKind
+from coretrace_python.taint.urls import UrlProof, redirects_disabled
 
 Affected = Mapping[SymbolId, tuple[Advisory, ...]]
 
@@ -61,14 +62,33 @@ class ConditionCheck:
     passed: str | None = None
 
 
-def check_conditions(entry: AdvisoryEntryPoint | None, arguments: Arguments | None) -> ConditionCheck:
-    """Decide ``entry``'s conditions against what the call's ``arguments`` denote."""
+def check_conditions(
+    entry: AdvisoryEntryPoint | None,
+    arguments: Arguments | None,
+    url: UrlProof | None = None,
+    passed_as: frozenset[tuple[int | None, str | None]] = frozenset(),
+) -> ConditionCheck:
+    """Decide ``entry``'s conditions against what the call's ``arguments`` denote and, for
+    a ``host`` condition, what ``url`` proves of the value the attacker's input is passed
+    in (``passed_as``). A host the URL's constant text fixes rules the call out when the
+    call disables redirects; otherwise a redirect may still lead to a host the attacker
+    controls, and the condition stays pending with that uncertainty."""
 
     if entry is None:
         return ConditionCheck()
     met: list[Condition] = []
     pending: list[Condition] = []
     for condition in entry.conditions:
+        if condition.kind == "host":
+            origin = url.origin if url is not None and _passed_in(condition, passed_as) else None
+            if origin is None:
+                pending.append(condition)
+            elif redirects_disabled(arguments):
+                return ConditionCheck(tuple(met), tuple(pending), condition, repr(origin))
+            else:
+                text = f"the host is fixed by {origin!r}, but a redirect may lead to a host the attacker controls"
+                pending.append(replace(condition, text=text))
+            continue
         given = arguments.given(condition.argument, condition.position) if condition.checkable and arguments is not None else None
         if given is None:
             pending.append(condition)
@@ -84,6 +104,16 @@ def check_conditions(entry: AdvisoryEntryPoint | None, arguments: Arguments | No
     return ConditionCheck(tuple(met), tuple(pending))
 
 
+def _passed_in(condition: Condition, passed_as: frozenset[tuple[int | None, str | None]]) -> bool:
+    """Whether a value passed as ``passed_as`` is the argument ``condition`` names."""
+
+    return any(
+        (keyword is not None and keyword == condition.argument)
+        or (keyword is None and position is not None and position == condition.position)
+        for position, keyword in passed_as
+    )
+
+
 def ruled_out(module: str, site: CallSite, check: ConditionCheck) -> str:
     """Which call a contradicted condition rules out, and why: ``app:12
     python.yaml.load(Loader=python.yaml.SafeLoader)``."""
@@ -120,9 +150,10 @@ def correlate(
     flows: Iterable[TaintFlow],
     verdicts: Verdicts | None,
     affected: Affected,
+    urls: Mapping[TaintFlow, UrlProof] | None = None,
 ) -> tuple[Finding, ...]:
     """Exploitable-vulnerability findings for the non-refuted ADVISORY flows of a function,
-    one per advisory the sink is affected by."""
+    one per advisory the sink is affected by; ``urls`` holds what each flow's URL proves."""
 
     findings: list[Finding] = []
     for flow in flows:
@@ -136,7 +167,7 @@ def correlate(
             entry = advisory.entry_point(flow.sink.symbol)
             if entry is not None and not any(entry.exploitable_through(p, k) for p, k in flow.passed_as):
                 continue
-            check = check_conditions(entry, flow.sink_arguments)
+            check = check_conditions(entry, flow.sink_arguments, (urls or {}).get(flow), flow.passed_as)
             if check.contradicted is None:
                 findings.append(_exploitable(function, flow, advisory, verdict, hotspot, check))
     return tuple(findings)

coretrace_python/dependency/graph.py

@@ -151,8 +151,10 @@ class Condition:
     ``argument`` condition names the argument by keyword, and by ``position`` when it may
     be passed positionally, and lists the ``values`` that satisfy it — symbols
     (``python.yaml.FullLoader``) or constants as Python writes them (``True``);
-    ``default`` says an absent argument means a vulnerable value. A ``semantic``
-    condition cannot be checked and is reported as pending review."""
+    ``default`` says an absent argument means a vulnerable value. A ``host`` condition
+    says the attacker must choose the host of the URL passed as ``argument`` (or at
+    ``position``); the engine decides it from what the URL's constant text proves. A
+    ``semantic`` condition cannot be checked and is reported as pending review."""
 
     kind: str
     text: str

coretrace_python/dependency/vex.py

@@ -7,7 +7,8 @@ subcomponent of the project:
   exploitable finding, whatever the policy or a suppression did with it;
 - ``not_affected``, as ``vulnerable_code_not_in_execute_path``, only when the advisory is
   curated (it names entry points), no code of the project reaches them, every file and
-  function was analysed, and a lock file shows that no other package requires the
+  function was analysed, every template the project names was read when a template
+  filter can reach them, and a lock file shows that no other package requires the
   vulnerable one, since the code of installed packages is not analysed;
 - ``under_investigation`` otherwise, with the reason in its notes.
 """
@@ -25,6 +26,7 @@ from coretrace_python.dependency.graph import Advisory, DependencyGraph, Require
 from coretrace_python.dependency.sbom import purl
 from coretrace_python.findings import Component, Finding
 from coretrace_python.findings.coverage import Coverage
+from coretrace_python.taint import FILTER_FUNCTIONS
 
 CONTEXT = "https://openvex.dev/ns/v0.2.0"
 # OpenVEX's shared namespace for documents without an IRI of their own, and the author
@@ -33,6 +35,8 @@ NAMESPACE = "https://openvex.dev/docs/public/vex-"
 AUTHOR = "Unknown Author"
 # Evidence levels that put the vulnerable code in the project's execution path, lowest first.
 REACHED = ("reachable", "exploitable")
+# What a template calls: a template the engine cannot read may reach these.
+_TEMPLATE_CALLS = frozenset(FILTER_FUNCTIONS.values())
 
 
 def render_vex(
@@ -140,6 +144,11 @@ def _status(
             f"No analysed code reaches {entries}, but {', '.join(partial)} could not be fully "
             f"analysed.{ruled}"
         )
+    if coverage.unread_templates and _TEMPLATE_CALLS.intersection(advisory.reachable_symbols):
+        return _investigating(
+            f"No analysed code reaches {entries}, but a template can reach them, and the engine could "
+            f"not read every template the project names: {'; '.join(coverage.unread_templates)}.{ruled}"
+        )
     required_by = dependencies.required_by(package)
     if required_by is None:
         return _investigating(

coretrace_python/engine.py

@@ -83,6 +83,8 @@ from coretrace_python.interprocedural import (
     SummaryAnalysis,
     SummaryIndex,
     SymbolRead,
+    TemplateCalls,
+    TemplateCallsAnalysis,
     build_module_graph,
     discover_sources,
     project_symbol,
@@ -124,8 +126,12 @@ from coretrace_python.taint import (
     TaintAnalysis,
     TaintKind,
     escaped_templates,
+    project_templates,
     registered_routes,
+    request_processor,
+    unread_renders,
 )
+from coretrace_python.taint.urls import flow_url
 
 TOOL_NAME = "coretrace-python-analyzer"
 
@@ -157,6 +163,7 @@ ALL_ANALYSES: tuple[AnyAnalysis, ...] = (
     RegisteredRoutes,
     EscapedTemplates,
     ClearingAnalysis,
+    TemplateCallsAnalysis,
 )
 
 
@@ -197,6 +204,7 @@ class ResultsEvicted(TransformationPass):
             RegisteredRoutes,
             EscapedTemplates,
             ClearingAnalysis,
+            TemplateCallsAnalysis,
         }
     )
 
@@ -430,13 +438,20 @@ def analyze_project(
         for symbol, registered in _routes_of(analysable[name]).items():
             routes.setdefault(symbol, registered)
     escaped = escaped_templates(root)
+    templates = project_templates(root)
     clearing = models.clearing(escaped)
+    template_calls = models.template_calls(
+        templates.filters, request_processor(modules[name] for name in sorted(analysable))
+    )
     for manager in analysable.values():
         manager.provide(RegisteredRoutes, routes)
         manager.provide(EscapedTemplates, escaped)
         manager.provide(ClearingAnalysis, clearing)
+        manager.provide(TemplateCallsAnalysis, template_calls)
 
-    configuration = _configuration_key(components, plugins, models, advisories, dependencies, routes, escaped)
+    configuration = _configuration_key(
+        components, plugins, models, advisories, dependencies, routes, escaped, template_calls
+    )
     keys = module_keys(
         graph,
         {name: fingerprint(configuration, str(files[name].source_id), name, files[name].text) for name in analysable},
@@ -478,6 +493,7 @@ def analyze_project(
                             advisory_paths,
                             _encode_routes(routes),
                             tuple(sorted(escaped)),
+                            template_calls,
                         ),
                     )
                     for component in pending
@@ -515,7 +531,9 @@ def analyze_project(
             frozenset(),
             reads={f: tuple(r) for f, r in reads.items()},
         )
-    context = ProjectContext(graph, dependencies, advisories, analysable, call_graphs, policy, root, functions)
+    context = ProjectContext(
+        graph, dependencies, advisories, analysable, call_graphs, policy, root, functions, templates
+    )
     for plugin in all_plugins:
         if isinstance(plugin, ProjectPlugin):
             findings.extend(plugin.analyze_project(context))
@@ -525,6 +543,9 @@ def analyze_project(
     findings = [_sourced(finding, origins) for finding in findings]
     accepted = tuple(f for f in findings if policy.accepts(f))
     kept, suppressed = partition(apply_policy(policy, findings), _text_of(sources))
+    unread = list(templates.unread)
+    for name in sorted(call_graphs):
+        unread.extend(unread_renders(name, call_graphs[name], models, templates.names))
     return ProjectAnalysis(
         graph,
         index,
@@ -533,7 +554,7 @@ def analyze_project(
         MappingProxyType(keys),
         reused,
         advisories,
-        Coverage(tuple(sorted(coverage, key=lambda c: c.path))),
+        Coverage(tuple(sorted(coverage, key=lambda c: c.path)), tuple(unread)),
         suppressed,
         accepted,
         components,
@@ -685,6 +706,7 @@ class _Batch:
     advisory_paths: tuple[Path, ...] = ()
     routes: tuple[tuple[str, str, str, int], ...] = ()
     escaped: tuple[str, ...] = ()
+    template_calls: TemplateCalls = field(default_factory=TemplateCalls)
 
 
 def _analyse_batch(batch: _Batch) -> dict[str, dict[str, Any]]:
@@ -712,6 +734,7 @@ def _analyse_batch(batch: _Batch) -> dict[str, dict[str, Any]]:
         manager.provide(RegisteredRoutes, routes)
         manager.provide(EscapedTemplates, escaped)
         manager.provide(ClearingAnalysis, models.clearing(escaped))
+        manager.provide(TemplateCallsAnalysis, batch.template_calls)
     module_plugins = tuple(p for p in all_plugins if not isinstance(p, ProjectPlugin))
     results = _analyse_managers(managers, decode_index(batch.seed), module_plugins, affected)
     return {name: encode(entry) for name, entry in results.items()}
@@ -740,6 +763,7 @@ def _configuration_key(
     dependencies: DependencyGraph,
     routes: Routes | None = None,
     escaped: frozenset[str] = frozenset(),
+    template_calls: TemplateCalls | None = None,
 ) -> str:
     """Everything a module's results depend on besides the project sources (§11)."""
 
@@ -757,6 +781,7 @@ def _configuration_key(
         repr(dependencies.errors),
         repr(_encode_routes(routes or {})),
         repr(sorted(escaped)),
+        repr(template_calls),
     )
 
 
@@ -770,14 +795,14 @@ def _analyse_module(
     graph = manager.get(CallGraphAnalysis)
     correlated: list[Finding] = []
     if affected:
+        strings = manager.get(ModuleStringsAnalysis)
         for function in supported:
+            flows = manager.get(TaintAnalysis, function).flows
+            ssa = manager.get(SSAAnalysis, function)
+            defs = {i.result: i for block in ssa.blocks for i in block.instructions if i.result is not None}
+            urls = {flow: flow_url(flow, defs, strings) for flow in flows if flow.kinds & TaintKind.ADVISORY}
             correlated.extend(
-                correlate(
-                    graph.name_of(function),
-                    manager.get(TaintAnalysis, function).flows,
-                    manager.get(RefutationAnalysis, function),
-                    affected,
-                )
+                correlate(graph.name_of(function), flows, manager.get(RefutationAnalysis, function), affected, urls)
             )
     return CachedModule(
         manager.get(EntryPointAnalysis),

coretrace_python/findings/coverage.py

@@ -2,7 +2,9 @@
 
 "No findings" only means something when the reader knows what was analysed. Each file
 is ``analysed``, a ``syntax-error`` (the frontend rejected it) or ``unreadable`` (it could
-not be decoded); analysed files count their functions and how many lowered.
+not be decoded); analysed files count their functions and how many lowered. The
+templates the project names but the run could not read are listed, each where the
+project names it: they may call any template filter.
 """
 
 from __future__ import annotations
@@ -21,6 +23,7 @@ class FileCoverage:
 @dataclass(frozen=True)
 class Coverage:
     details: tuple[FileCoverage, ...] = ()
+    unread_templates: tuple[str, ...] = ()
 
     @property
     def files(self) -> int:

coretrace_python/interprocedural/__init__.py

@@ -20,6 +20,7 @@ from coretrace_python.interprocedural.modulegraph import (
     project_symbol,
 )
 from coretrace_python.interprocedural.summaries import (
+    FILTER_ARGUMENTS,
     Cleared,
     Clearing,
     ClearingAnalysis,
@@ -31,10 +32,14 @@ from coretrace_python.interprocedural.summaries import (
     SummaryAnalysis,
     SummaryIndex,
     SummaryTable,
+    TemplateCalls,
+    TemplateCallsAnalysis,
+    TemplateFilter,
     cleared_by,
 )
 
 __all__ = [
+    "FILTER_ARGUMENTS",
     "Arguments",
     "CallGraph",
     "CallGraphAnalysis",
@@ -56,6 +61,9 @@ __all__ = [
     "SummaryTable",
     "SymbolRead",
     "Target",
+    "TemplateCalls",
+    "TemplateCallsAnalysis",
+    "TemplateFilter",
     "UnknownTarget",
     "build_module_graph",
     "cleared_by",