coretrace-python-analyzer 0.14.0__tar.gz → 0.16.0__tar.gz

{coretrace_python_analyzer-0.14.0 → coretrace_python_analyzer-0.16.0}/CHANGELOG.md

@@ -1,5 +1,23 @@
 # Changelog
 
+## 0.16.0 (2026-09-27)
+
+### Advisories
+
+- A filter of Django's own libraries that a project template applies is a call to the function behind it, at the template's line: `{{ bio|striptags }}` calls `django.template.defaultfilters.striptags`, and so do filters in tag arguments and `{% filter %}` blocks. An advisory entry point naming that function is reachable there, whether or not a Python call names the template, since a class-based view renders its `template_name` inside Django. A template the analyzer cannot read may apply any filter: when the project names one by an expression, or by a name found under no `templates` directory, in `render`, `render_to_string`, `TemplateResponse`, `{% include %}` or `{% extends %}`, an advisory whose entry points include a template filter stays `under_investigation` in the VEX document, and the notes say where. `render`, `TemplateResponse` and `SimpleTemplateResponse` are now template renders like `render_to_string` (#146).
+- Attacker input in a render context reaching a template filter makes an advisory entry point naming that filter exploitable at the render call. The analyzer links them only where it is certain of the value: a dict literal with constant keys that the render call alone uses, and a filter the rendered template applies to a context variable, directly or through `{% for %}`, `{% with %}`, constant `{% include %}` and `{% extends %}`, earlier filter arguments and `{% filter %}` blocks, in the blocks that render. A name a tag binds shadows the context, and `{% include ... only %}` passes none of it. The filter's value is its first argument, the filter's own argument its second. A project function rendering what it receives carries it the same way (#146).
+- The request the `request` context processor adds reaches a template's filters too, as `{{ request.GET.q|striptags }}`, only where the analyzer is certain of it: every Django template engine the settings assign to `TEMPLATES`, as literals no other code names, lists the processor; the render call passes the request (`render`, `TemplateResponse`, `render_to_string` given `request`) with a certain context, absent or a dict literal; nothing shadows `request`; and the template reads a text attribute of the request object, such as `GET`, `POST`, `COOKIES` or `headers`. Otherwise the filter stays reachable (#146).
+
+## 0.15.0 (2026-09-26)
+
+### Precision
+
+- `open-redirect` judges a flow on the destination a browser resolves from the target's constant text, with its own criteria rather than SSRF's. A reference on the current site keeps the browser there, so the flow is refuted. Such a reference is `/` followed by a character that is not a slash, a backslash, a space or a control character, as in `"/profile/" + id`; or `?`, `#`, or a relative path whose first segment holds no `:`. A fixed absolute host makes the flow a hotspot, since the input chooses the path, where that host may redirect again. Everything else stays a vulnerability, including `"/" + next`: `//evil.com` is another host. The URL facts both rules read are one shared proof, `coretrace_python.taint.urls`, and `ssrf` now reads it too, with the same verdicts. The regression corpus is unchanged: its three `open-redirect` findings redirect to values built without constant text (#168).
+
+### Advisories
+
+- An advisory entry point may declare a `host` condition: the attacker must choose the host of the URL passed as the named argument. It is decided from the URL's constant text, the proof `ssrf` and `open-redirect` read. A fixed host with redirects disabled in the call leaves the call reachable, not exploitable. A fixed host with redirects followed keeps it exploitable, because a redirect may lead to a host the attacker controls, and the condition pending review says so. Input in the query does not choose the host. Anything else stays pending review, and so do the environment conditions. A `host` condition must name its argument and carry nothing else (#170).
+
 ## 0.14.0 (2026-09-26)
 
 ### Precision

{coretrace_python_analyzer-0.14.0 → coretrace_python_analyzer-0.16.0}/PKG-INFO

@@ -1,6 +1,6 @@
 Metadata-Version: 2.5
 Name: coretrace-python-analyzer
-Version: 0.14.0
+Version: 0.16.0
 Summary: Static security analysis infrastructure for Python code
 Project-URL: Homepage, https://github.com/CoreTrace/coretrace-python-analyzer
 Project-URL: Repository, https://github.com/CoreTrace/coretrace-python-analyzer

{coretrace_python_analyzer-0.14.0 → coretrace_python_analyzer-0.16.0}/docs/plugins.md

@@ -117,7 +117,9 @@ that must not leave the application through a log, a third party or plain storag
 
 A rule may know more about its own sinks than the refutation does: `judge(ctx, function,
 flow, verdict)` returns the rule's verdict on a flow, given the refutation's, and by
-default returns it unchanged. `ssrf` reads there how the URL is built. The refutation's
+default returns it unchanged. `ssrf` and `open-redirect` read there what the URL's
+constant text proves, a proof they share (`coretrace_python.taint.urls`) and each
+judges by its own criteria. The refutation's
 verdict, which other consumers of the flow such as the advisory correlation read, does
 not change; a rule reading more analyses declares them in its `requires`.
 
@@ -155,7 +157,7 @@ class BottleModels(ModelPlugin):
 | `RouteRegistrar(symbol, argument, label, kinds=ALL, keyword=None)` | A call registering a view at argument `argument` (or `keyword`), such as Django's `path`; the view receives `label` input. |
 | `SuffixSink(suffix, kinds, positions=())` | A sink matched by the end of the symbol, for methods of any class such as `objects.raw`. |
 | `SafeArgument(symbol, argument, values, position=None, kinds=ALL)` | A call to the sink `symbol` whose `argument` (by keyword, or at `position`) denotes one of `values` is not a sink for `kinds`, such as `yaml.load` with `Loader=yaml.SafeLoader`. Values are written as the analyzer records arguments: a symbol by its canonical name, a constant as Python writes it (`True`). Only a value given explicitly makes the call safe. |
-| `TemplateRender(symbol, position=0, keyword="template_name")` | A call rendering, with autoescaping, the template named by its argument at `position` or `keyword`, such as `render_to_string`. What it returns carries no `HTML` when the name is written in the call and the project's template escapes everything it prints (see the usage guide). |
+| `TemplateRender(symbol, position=0, keyword="template_name", context=1, request=None)` | A call rendering, with autoescaping, the template named by its argument at `position` or `keyword`, such as `render_to_string`, with the variables of its argument at `context` or `context=` and the request at `request` or `request=` (None: the call takes none); it makes the filter calls the template applies, fed from that context and, with the `request` context processor, that request (see the usage guide). What it returns carries no `HTML` when the name is written in the call and the project's template escapes everything it prints (see the usage guide). A name the analyzer cannot read keeps an advisory a template filter reaches under investigation in the VEX document. |
 | `Validator(symbol, kinds=ALL, argument=0)` | A callable whose truth proves its argument safe for `kinds`, such as `re.fullmatch`. A flow guarded by it is refuted when it carries no other kind into the sink, and is a hotspot otherwise: a redirect validator does not make a shell command safe. `symbol` may be a function of the project, by its project symbol (`python.hc.accounts.views._allow_redirect`), which then counts wherever it is called, in its own module too. |
 | `RequestObject(symbol, text=())` | The inputs from `symbol`, an entry point, a route registrar, a typed parameter or a source, are request objects. A view receives the request first (after `self`), then URL parameters, which are text. Reading one of the request's `text` attributes gives text, as Django's `GET` or aiohttp's `query`; its body and files keep the request's kinds. An attribute read counts only when every source of the value is such a request. |
 | `AuthorizationGuard(symbol, label)` | A decorator or a condition restricting who reaches the code, such as `login_required`; a flow behind it is a hotspot. |
@@ -256,6 +258,10 @@ one, and the label of the entry point it is (`http` for a route, `argv` for a co
 when the models make it one. `ctx.call_graph(module)` gives each function's call sites
 (`sites(function)`) and the symbols it reads, called or not (`reads(function)`: reading
 `request.form['name']` reads `python.flask.request.form`), each where it first reads it.
+`ctx.templates` gives the templates found under the project's `templates` directories:
+their `names`, the filters they apply as `calls` (each a `FilterCall(symbol, span)`, the
+function behind the filter and where the template applies it), and where they name a
+template the analyzer cannot read (`unread`).
 The shipped `vulnerable-dependency`, `reachable-vulnerability` and `dependency-policy`
 plugins are of this kind.
 

{coretrace_python_analyzer-0.14.0 → coretrace_python_analyzer-0.16.0}/docs/usage.md

@@ -117,7 +117,7 @@ variable is not treated that way yet.
 | `ssrf` | The URL of an HTTP client request (Requests, httpx, `urllib`), by position or as `url=`; the body, headers and query parameters are not the destination. How `+` and f-strings build the URL can prove part of its destination. When constant text fixes `scheme://host` and ends the authority with `/`, `?` or `#` before any input (`"https://api.example.com/users/" + id`, or a module-level string bound once and never rebound), the flow is a hotspot: the input still chooses the path, which may reach a sensitive resource, and a redirect may lead elsewhere. With the path fixed too, the input reaching the query or fragment only, and the call disabling redirects (`allow_redirects=False`, `follow_redirects=False`), the destination is fixed and the flow is refuted. Anything unproven stays a vulnerability: a base of unknown value (imported, a call result), a constant leaving the authority open (`"https:/"`, no `/` after the host, a variable port), `urljoin`, `%`, `format`, a URL built in a helper function. |
 | `xss` | An HTTP response body built without escaping. A Django template rendered by `render_to_string` escapes, where the analyzer can establish it (below). |
 | `insecure-deserialization` | `pickle`, `marshal`, `dill`, `jsonpickle`, `shelve`, and the YAML loaders (`yaml.load`, `load_all`, `full_load`, `unsafe_load` and their several-document versions); `yaml.load` and `load_all` given a safe loader (`SafeLoader`, `BaseLoader`) are not. |
-| `open-redirect` | An HTTP redirect target. |
+| `open-redirect` | An HTTP redirect target, judged on the destination a browser resolves from the target's constant text, as `+` and f-strings build it. A reference on the current site keeps the browser there, where any further redirect is the project's own code, analysed on its own, so the flow is refuted. Such a reference is `/` followed by a character that is not a slash, a backslash, a space or a control character (`"/profile/" + id`), `?`, `#`, or a relative path whose first segment ends in the text without a `:`. A fixed absolute host (`"https://example.com/" + path`) sends the browser there, but the input chooses the path, where that host may redirect again: a hotspot. Anything else stays a vulnerability. That covers `"/" + next`, since `//evil.com` is another host, a host left open, a base of unknown value and a target built in a helper function. |
 | `plaintext-credential-storage` | A parameter named like a password stored in a database without hashing. Medium confidence, since a name is a hint. |
 | `exploitable-vulnerability` | An API affected by an advisory of a vulnerable requirement, see Dependencies. |
 
@@ -241,7 +241,7 @@ the directory of the checked file; a path outside it is printed as it is.
 ```json
 {
   "schema_version": 1,
-  "tool": {"name": "coretrace-python-analyzer", "version": "0.14.0"},
+  "tool": {"name": "coretrace-python-analyzer", "version": "0.16.0"},
   "root": "/home/me/project",
   "findings": [
     {
@@ -273,7 +273,7 @@ bytes. A single-file check lists no components.
 
 ```json
 "tool": {
-  "name": "coretrace-python-analyzer", "version": "0.14.0",
+  "name": "coretrace-python-analyzer", "version": "0.16.0",
   "components": [
     {"kind": "plugin", "name": "curated-advisories", "version": "2026.09.25", "digest": "sha256:…"},
     {"kind": "advisories", "name": "advisories.json", "digest": "sha256:…"}
@@ -362,6 +362,57 @@ it is reachable, called or not — `request.form['name']`, `for key in request.f
 `request.form.get('name')` all read it. A function reading it several times is reported
 once, where it first reads it.
 
+A filter of Django's own libraries that a project template applies is a call to the
+function behind it, placed at the template's line: `{{ bio|striptags }}` calls
+`python.django.template.defaultfilters.striptags`, and so do filters in tag arguments
+(`{% if bio|striptags %}`) and `{% filter %}` blocks. A template counts whether or not a
+Python call names it, since a class-based view renders its `template_name` inside
+Django. Most filters are functions of the same name in `django.template.defaultfilters`;
+`escape`, `escapejs`, `linebreaks`, `phone2numeric`, `slice`, `timesince` and `timeuntil`
+are `<name>_filter` there, and the filters of `i18n`, `l10n`, `tz` and `humanize` are in
+their library's module (`timezone` is `django.templatetags.tz.do_timezone`).
+
+Attacker input in the render context makes the filter exploitable at the render call:
+`render(request, "app/profile.html", {"bio": request.POST["bio"]})` with
+`{{ bio|striptags }}`. The analyzer links a context value to a filter only where it is
+certain of it:
+
+- The context is a dict literal with constant keys, used by the render call and
+  nothing else, written in the call or through a variable. A dict mutated or passed
+  elsewhere, one unpacking another (`**extra`), or a context built any other way leaves
+  the filter reachable.
+- The filter's value is a context variable, directly or through `{% for %}` and
+  `{% with %}`, the templates the template includes or extends by a constant name, the
+  arguments of the filters before it, or the output of a `{% filter %}` block. A name a
+  tag binds shadows the context, and `{% include ... only %}` passes none of it.
+- The filter renders: a template extending another renders only its blocks, which
+  replace the blocks of that name in what it extends.
+- One file has the template's name; of two files of the same name, which one renders
+  depends on the loaders.
+
+The filter's value is its first argument and its argument (`cut:bio`) its second, so an
+entry point naming only the value in `attacker_arguments` is not exploitable through
+the argument. A project function rendering the values it receives carries them the same
+way.
+
+With the `django.template.context_processors.request` context processor, a template
+rendered with the request reads it as `request`: `{{ request.GET.q|striptags }}` is
+exploitable at the render call too. The analyzer counts it only where all of these hold:
+
+- The project's settings assign `TEMPLATES` a literal list, every `DjangoTemplates`
+  engine of it lists the processor in a literal `context_processors`, and no other code
+  of the project names `TEMPLATES`. A mere mention of the processor proves nothing.
+- The render call passes the request: `render` and `TemplateResponse` always do,
+  `render_to_string` when given `request`, `SimpleTemplateResponse` never.
+- The render's context is certain, absent or a dict literal as above, so it cannot hide
+  a `request` entry. An entry of that name, a name a tag binds or `{% include ... only %}`
+  shadows the processor's request.
+- The template reads text the user controls: an attribute the request object lists
+  among its text attributes, such as `GET`, `POST`, `COOKIES` or `headers`; not `user` or
+  `session`.
+
+Through a project function, only the context entries are followed.
+
 Most vulnerabilities need attacker input in one argument: the path `send_from_directory`
 serves, not its `download_name`; the URL `requests.get` fetches, not its body. An entry
 point may name them in `attacker_arguments`, by keyword `argument` and, when it may be
@@ -386,6 +437,23 @@ a call passing a variable, or unpacking `*args` or `**kwargs`, leaves the condit
 pending review. A `semantic` condition — the document's tags, the platform, the
 template's origin — cannot be decided and is always pending review, never dropped.
 
+A `host` condition says the attacker must choose the host of the URL passed as
+`argument` (or at `position`), as credentials leaking to the host of a crafted URL
+need: `{"kind": "host", "text": "…", "argument": "url", "position": 0}`. It is
+decided from the URL's constant text, as `ssrf` and `open-redirect` read it, when the
+attacker's input is passed in that argument. The outcome has three cases:
+
+- Constant text fixes the host (`"https://api.example.com/" + path`) and the call
+  disables redirects (`allow_redirects=False`, `follow_redirects=False`): the call is
+  reachable, not exploitable.
+- Constant text fixes the host but redirects may be followed: the call stays
+  exploitable. The fixed initial host does not clear the chain, since a redirect may
+  lead to a host the attacker controls, and the condition pending review says so.
+  Input in the query does not choose the host.
+- Otherwise the condition stays pending review.
+
+The other conditions, the environment included, stay pending as before.
+
 Every dependency finding records the highest level of evidence established in its
 `level` metadata: `declared` (the requirement allows a vulnerable version), `imported`
 (a module of the package is imported somewhere), `reachable` (an entry point or affected
@@ -427,16 +495,25 @@ check, including findings the policy accepts or a comment suppresses:
 | Status | When |
 |---|---|
 | `affected` | The project's code reaches the vulnerable code. The notes give each place and its level, `reachable` or `exploitable`. |
-| `not_affected` | Justified as `vulnerable_code_not_in_execute_path`, only when all of these hold: the advisory names entry points, no code of the project reaches them, every file and function was analysed, and a lock file (`uv.lock` or `poetry.lock`) shows that no other package requires the vulnerable one. The impact statement names the entry points and any calls ruled out by their arguments. |
+| `not_affected` | Justified as `vulnerable_code_not_in_execute_path`, only when all of these hold: the advisory names entry points, no code of the project reaches them, every file and function was analysed, every template the project names was read if a template filter is among them, and a lock file (`uv.lock` or `poetry.lock`) shows that no other package requires the vulnerable one. The impact statement names the entry points and any calls ruled out by their arguments. |
 | `under_investigation` | Anything else. The notes say which condition failed. |
 
+A template the analyzer cannot read may apply any filter. The project names one when
+`render`, `render_to_string`, `TemplateResponse`, an `{% include %}` or an `{% extends %}`
+names a template by an expression, or by a name found under no `templates` directory,
+including one an installed package ships; a template file that cannot be read counts
+too. An advisory whose entry points include a template filter then stays
+`under_investigation`, and the notes list where the project names each such template
+(`app.views:12 names a template by an expression`). A template named elsewhere, such as
+a class-based view's `template_name`, is not checked.
+
 `not_affected` needs the lock-file check because the analyzer reads the project's code,
 not the code of installed packages. A framework calling the vulnerable function on the
 project's behalf would go unseen. Without a lock file, a package is never
 `not_affected`. The document's `@id` derives from its statements, so two runs with the
 same result share it; its `author` is `Unknown Author`, as OpenVEX tools write when they
 cannot know it. Its `tooling` names the analyzer and each component with its digest
-(`coretrace-python-analyzer 0.14.0; curated-advisories 2026.09.25 (sha256:…)`), so the
+(`coretrace-python-analyzer 0.16.0; curated-advisories 2026.09.25 (sha256:…)`), so the
 `@id` changes with the advisory data a statement was decided with.
 
 ## Large projects

{coretrace_python_analyzer-0.14.0 → coretrace_python_analyzer-0.16.0}/pyproject.toml

@@ -4,7 +4,7 @@ build-backend = "hatchling.build"
 
 [project]
 name = "coretrace-python-analyzer"
-version = "0.14.0"
+version = "0.16.0"
 description = "Static security analysis infrastructure for Python code"
 readme = "README.md"
 requires-python = ">=3.11"

{coretrace_python_analyzer-0.14.0 → coretrace_python_analyzer-0.16.0}/src/coretrace_python/__init__.py

@@ -1,4 +1,4 @@
 """CoreTrace's Python static analysis frontend."""
 
-__version__ = "0.14.0"
+__version__ = "0.16.0"
 

{coretrace_python_analyzer-0.14.0 → coretrace_python_analyzer-0.16.0}/src/coretrace_python/bundled/dependency/reachable_vulnerability/reachable_vulnerability.py

@@ -1,5 +1,6 @@
 """Calls, anywhere in the project, to an API affected by a vulnerable requirement, and
-reads of an affected attribute whose getter runs the vulnerable code."""
+reads of an affected attribute whose getter runs the vulnerable code. A filter a project
+template applies is a call to the function behind it, at the template's line."""
 
 from __future__ import annotations
 
@@ -56,6 +57,10 @@ class ReachableVulnerabilityPlugin(ProjectPlugin):
                             reported.add((advisory, symbol))
                             check = check_conditions(entry, None)
                             findings.append(_reached(advisory, symbol, read.location, function, check))
+        for call in ctx.templates.calls:
+            for advisory in affected.get(call.symbol, ()):
+                check = check_conditions(advisory.entry_point(call.symbol), None)
+                findings.append(_reached(advisory, call.symbol, call.span, None, check))
         return findings
 
 
@@ -67,7 +72,9 @@ def _read_through(symbol: SymbolId) -> Iterator[SymbolId]:
         yield SymbolId(".".join(components[:end]))
 
 
-def _reached(advisory: Advisory, symbol: SymbolId, span: SourceSpan, function: str, check: ConditionCheck) -> Finding:
+def _reached(
+    advisory: Advisory, symbol: SymbolId, span: SourceSpan, function: str | None, check: ConditionCheck
+) -> Finding:
     return Finding(
         rule_id="reachable-vulnerability",
         message=(

{coretrace_python_analyzer-0.14.0 → coretrace_python_analyzer-0.16.0}/src/coretrace_python/bundled/models/django/django_models.py

@@ -139,7 +139,10 @@ class DjangoModels(ModelPlugin):
         Sink(_sym("django.http.HttpResponseRedirect"), TaintKind.REDIRECT, _TARGET_ONLY),
         Sink(_sym("django.http.HttpResponsePermanentRedirect"), TaintKind.REDIRECT, _TARGET_ONLY),
         Sanitizer(_sym("django.utils.html.escape"), TaintKind.HTML),
-        TemplateRender(_sym("django.template.loader.render_to_string")),
+        TemplateRender(_sym("django.template.loader.render_to_string"), request=2),
+        TemplateRender(_sym("django.shortcuts.render"), 1, context=2, request=0),
+        TemplateRender(_sym("django.template.response.TemplateResponse"), 1, "template", 2, 0),
+        TemplateRender(_sym("django.template.response.SimpleTemplateResponse"), 0, "template"),
         Sanitizer(_sym("django.utils.html.conditional_escape"), TaintKind.HTML),
         # The masked CSRF secret: ASCII letters and digits only, a malformed cookie is
         # replaced before it is used.

coretrace_python_analyzer-0.16.0/src/coretrace_python/bundled/security/open_redirect/open_redirect.py

@@ -0,0 +1,47 @@
+"""Open redirect: attacker-controlled input reaching a open redirect sink.
+
+The rule draws its verdict from what the target's constant text proves (``taint.urls``),
+as a browser resolves it. A reference on the current site (``/profile/``, ``?page=``,
+``profile/``) keeps the browser on the site, where any further redirect is the project's
+own code, analysed on its own: refuted. A fixed absolute host sends the browser there,
+but the input chooses the path, where that host may redirect again: a hotspot. Anything
+unproven, ``"/" + next`` included, stays a vulnerability.
+"""
+
+from __future__ import annotations
+
+from typing import ClassVar
+
+from coretrace_python.abstract.strings import ModuleStringsAnalysis
+from coretrace_python.analysis import AnyAnalysis
+from coretrace_python.findings import Severity
+from coretrace_python.findings.refutation import Status, Verdict
+from coretrace_python.hir import nodes
+from coretrace_python.ir.ssa import SSAAnalysis
+from coretrace_python.plugins import PluginContext, TaintDetector
+from coretrace_python.taint import TaintFlow, TaintKind
+from coretrace_python.taint.urls import flow_url
+
+
+class OpenRedirectPlugin(TaintDetector):
+    name: ClassVar[str] = "open-redirect"
+    rule_id: ClassVar[str] = "open-redirect"
+    kind: ClassVar[TaintKind] = TaintKind.REDIRECT
+    severity: ClassVar[Severity] = Severity.MEDIUM
+    title: ClassVar[str] = "Open redirect"
+    requires: ClassVar[frozenset[AnyAnalysis]] = TaintDetector.requires | {SSAAnalysis, ModuleStringsAnalysis}
+
+    def judge(self, ctx: PluginContext, function: nodes.Function, flow: TaintFlow, verdict: Verdict) -> Verdict:
+        ssa = ctx.get(SSAAnalysis, function)
+        defs = {i.result: i for block in ssa.blocks for i in block.instructions if i.result is not None}
+        target = flow_url(flow, defs, ctx.get(ModuleStringsAnalysis))
+        if target.relative:
+            return Verdict(flow, Status.REFUTED, f"the browser stays on the site: the target starts with {target.text!r}")
+        if target.origin is not None and verdict.status is Status.VULNERABILITY:
+            return Verdict(
+                flow,
+                Status.HOTSPOT,
+                f"the browser goes to the host fixed by {target.origin!r}, but the input chooses the path, "
+                "where that host may redirect again",
+            )
+        return verdict

{coretrace_python_analyzer-0.14.0 → coretrace_python_analyzer-0.16.0}/src/coretrace_python/bundled/security/open_redirect/plugin.toml

@@ -1,7 +1,7 @@
 name = "open-redirect"
 version = "1.0.0"
 plugin_api = ">=1,<2"
-requires = ["taint.flows", "findings.refutation"]
+requires = ["taint.flows", "findings.refutation", "ir.ssa", "abstract.module_strings"]
 provides = ["vulnerability.open-redirect"]
 
 [entrypoint]

coretrace_python_analyzer-0.16.0/src/coretrace_python/bundled/security/ssrf/ssrf.py

@@ -0,0 +1,49 @@
+"""Server-side request forgery: attacker-controlled input reaching a SSRF sink.
+
+The rule draws its verdict from what the URL's constant text proves (``taint.urls``).
+A fixed host keeps the input from choosing it, but the input still chooses the path,
+which may reach a sensitive resource of that host, and a redirect may lead elsewhere: a
+hotspot. With the path fixed too, the input reaching the query or fragment only, and
+redirects disabled in the call, the destination is fixed: refuted. Anything unproven,
+a base of unknown value or a URL built in a helper function, stays a vulnerability.
+"""
+
+from __future__ import annotations
+
+from typing import ClassVar
+
+from coretrace_python.abstract.strings import ModuleStringsAnalysis
+from coretrace_python.analysis import AnyAnalysis
+from coretrace_python.findings import Severity
+from coretrace_python.findings.refutation import Status, Verdict
+from coretrace_python.hir import nodes
+from coretrace_python.ir.ssa import SSAAnalysis
+from coretrace_python.plugins import PluginContext, TaintDetector
+from coretrace_python.taint import TaintFlow, TaintKind
+from coretrace_python.taint.urls import flow_url, redirects_disabled
+
+
+class SsrfPlugin(TaintDetector):
+    name: ClassVar[str] = "ssrf"
+    rule_id: ClassVar[str] = "ssrf"
+    kind: ClassVar[TaintKind] = TaintKind.SSRF
+    severity: ClassVar[Severity] = Severity.HIGH
+    title: ClassVar[str] = "Server-side request forgery"
+    requires: ClassVar[frozenset[AnyAnalysis]] = TaintDetector.requires | {SSAAnalysis, ModuleStringsAnalysis}
+
+    def judge(self, ctx: PluginContext, function: nodes.Function, flow: TaintFlow, verdict: Verdict) -> Verdict:
+        ssa = ctx.get(SSAAnalysis, function)
+        defs = {i.result: i for block in ssa.blocks for i in block.instructions if i.result is not None}
+        url = flow_url(flow, defs, ctx.get(ModuleStringsAnalysis))
+        if url.origin is None:
+            return verdict
+        no_redirects = redirects_disabled(flow.sink_arguments)
+        if url.path_fixed:
+            if no_redirects:
+                return Verdict(flow, Status.REFUTED, f"the destination is fixed by {url.text!r} and redirects are disabled")
+            left = "a redirect may lead elsewhere"
+        else:
+            left = "the input chooses the path" + ("" if no_redirects else ", and a redirect may lead elsewhere")
+        if verdict.status is not Status.VULNERABILITY:
+            return verdict
+        return Verdict(flow, Status.HOTSPOT, f"the host is fixed by {url.origin!r}, but {left}")

{coretrace_python_analyzer-0.14.0 → coretrace_python_analyzer-0.16.0}/src/coretrace_python/dependency/advisories.py

@@ -251,7 +251,7 @@ def _condition(entry: Mapping[str, Any]) -> Condition:
     default = entry.get("default", False)
     if not isinstance(default, bool):
         raise TypeError(f"condition default must be true or false, got {default!r}")
-    return Condition(
+    condition = Condition(
         str(entry["kind"]),
         str(entry["text"]),
         None if entry.get("argument") is None else str(entry["argument"]),
@@ -259,3 +259,8 @@ def _condition(entry: Mapping[str, Any]) -> Condition:
         position,
         default,
     )
+    if condition.kind == "host" and (
+        (condition.argument is None and condition.position is None) or condition.values or condition.default
+    ):
+        raise ValueError("a host condition names the URL argument, by keyword or position, and nothing else")
+    return condition

{coretrace_python_analyzer-0.14.0 → coretrace_python_analyzer-0.16.0}/src/coretrace_python/dependency/correlation.py

@@ -10,7 +10,7 @@ are correlated here into one high-confidence ``exploitable-vulnerability`` findi
 from __future__ import annotations
 
 from collections.abc import Iterable, Mapping
-from dataclasses import dataclass
+from dataclasses import dataclass, replace
 
 from coretrace_python.dependency.graph import (
     DIRECT,
@@ -24,6 +24,7 @@ from coretrace_python.findings.refutation import Status, Verdict, Verdicts
 from coretrace_python.interprocedural import Arguments, CallSite, ExternalSymbol
 from coretrace_python.semantic.symbols import SymbolId
 from coretrace_python.taint import Sink, TaintFlow, TaintKind
+from coretrace_python.taint.urls import UrlProof, redirects_disabled
 
 Affected = Mapping[SymbolId, tuple[Advisory, ...]]
 
@@ -61,14 +62,33 @@ class ConditionCheck:
     passed: str | None = None
 
 
-def check_conditions(entry: AdvisoryEntryPoint | None, arguments: Arguments | None) -> ConditionCheck:
-    """Decide ``entry``'s conditions against what the call's ``arguments`` denote."""
+def check_conditions(
+    entry: AdvisoryEntryPoint | None,
+    arguments: Arguments | None,
+    url: UrlProof | None = None,
+    passed_as: frozenset[tuple[int | None, str | None]] = frozenset(),
+) -> ConditionCheck:
+    """Decide ``entry``'s conditions against what the call's ``arguments`` denote and, for
+    a ``host`` condition, what ``url`` proves of the value the attacker's input is passed
+    in (``passed_as``). A host the URL's constant text fixes rules the call out when the
+    call disables redirects; otherwise a redirect may still lead to a host the attacker
+    controls, and the condition stays pending with that uncertainty."""
 
     if entry is None:
         return ConditionCheck()
     met: list[Condition] = []
     pending: list[Condition] = []
     for condition in entry.conditions:
+        if condition.kind == "host":
+            origin = url.origin if url is not None and _passed_in(condition, passed_as) else None
+            if origin is None:
+                pending.append(condition)
+            elif redirects_disabled(arguments):
+                return ConditionCheck(tuple(met), tuple(pending), condition, repr(origin))
+            else:
+                text = f"the host is fixed by {origin!r}, but a redirect may lead to a host the attacker controls"
+                pending.append(replace(condition, text=text))
+            continue
         given = arguments.given(condition.argument, condition.position) if condition.checkable and arguments is not None else None
         if given is None:
             pending.append(condition)
@@ -84,6 +104,16 @@ def check_conditions(entry: AdvisoryEntryPoint | None, arguments: Arguments | No
     return ConditionCheck(tuple(met), tuple(pending))
 
 
+def _passed_in(condition: Condition, passed_as: frozenset[tuple[int | None, str | None]]) -> bool:
+    """Whether a value passed as ``passed_as`` is the argument ``condition`` names."""
+
+    return any(
+        (keyword is not None and keyword == condition.argument)
+        or (keyword is None and position is not None and position == condition.position)
+        for position, keyword in passed_as
+    )
+
+
 def ruled_out(module: str, site: CallSite, check: ConditionCheck) -> str:
     """Which call a contradicted condition rules out, and why: ``app:12
     python.yaml.load(Loader=python.yaml.SafeLoader)``."""
@@ -120,9 +150,10 @@ def correlate(
     flows: Iterable[TaintFlow],
     verdicts: Verdicts | None,
     affected: Affected,
+    urls: Mapping[TaintFlow, UrlProof] | None = None,
 ) -> tuple[Finding, ...]:
     """Exploitable-vulnerability findings for the non-refuted ADVISORY flows of a function,
-    one per advisory the sink is affected by."""
+    one per advisory the sink is affected by; ``urls`` holds what each flow's URL proves."""
 
     findings: list[Finding] = []
     for flow in flows:
@@ -136,7 +167,7 @@ def correlate(
             entry = advisory.entry_point(flow.sink.symbol)
             if entry is not None and not any(entry.exploitable_through(p, k) for p, k in flow.passed_as):
                 continue
-            check = check_conditions(entry, flow.sink_arguments)
+            check = check_conditions(entry, flow.sink_arguments, (urls or {}).get(flow), flow.passed_as)
             if check.contradicted is None:
                 findings.append(_exploitable(function, flow, advisory, verdict, hotspot, check))
     return tuple(findings)

{coretrace_python_analyzer-0.14.0 → coretrace_python_analyzer-0.16.0}/src/coretrace_python/dependency/graph.py

@@ -151,8 +151,10 @@ class Condition:
     ``argument`` condition names the argument by keyword, and by ``position`` when it may
     be passed positionally, and lists the ``values`` that satisfy it — symbols
     (``python.yaml.FullLoader``) or constants as Python writes them (``True``);
-    ``default`` says an absent argument means a vulnerable value. A ``semantic``
-    condition cannot be checked and is reported as pending review."""
+    ``default`` says an absent argument means a vulnerable value. A ``host`` condition
+    says the attacker must choose the host of the URL passed as ``argument`` (or at
+    ``position``); the engine decides it from what the URL's constant text proves. A
+    ``semantic`` condition cannot be checked and is reported as pending review."""
 
     kind: str
     text: str

{coretrace_python_analyzer-0.14.0 → coretrace_python_analyzer-0.16.0}/src/coretrace_python/dependency/vex.py

@@ -7,7 +7,8 @@ subcomponent of the project:
   exploitable finding, whatever the policy or a suppression did with it;
 - ``not_affected``, as ``vulnerable_code_not_in_execute_path``, only when the advisory is
   curated (it names entry points), no code of the project reaches them, every file and
-  function was analysed, and a lock file shows that no other package requires the
+  function was analysed, every template the project names was read when a template
+  filter can reach them, and a lock file shows that no other package requires the
   vulnerable one, since the code of installed packages is not analysed;
 - ``under_investigation`` otherwise, with the reason in its notes.
 """
@@ -25,6 +26,7 @@ from coretrace_python.dependency.graph import Advisory, DependencyGraph, Require
 from coretrace_python.dependency.sbom import purl
 from coretrace_python.findings import Component, Finding
 from coretrace_python.findings.coverage import Coverage
+from coretrace_python.taint import FILTER_FUNCTIONS
 
 CONTEXT = "https://openvex.dev/ns/v0.2.0"
 # OpenVEX's shared namespace for documents without an IRI of their own, and the author
@@ -33,6 +35,8 @@ NAMESPACE = "https://openvex.dev/docs/public/vex-"
 AUTHOR = "Unknown Author"
 # Evidence levels that put the vulnerable code in the project's execution path, lowest first.
 REACHED = ("reachable", "exploitable")
+# What a template calls: a template the engine cannot read may reach these.
+_TEMPLATE_CALLS = frozenset(FILTER_FUNCTIONS.values())
 
 
 def render_vex(
@@ -140,6 +144,11 @@ def _status(
             f"No analysed code reaches {entries}, but {', '.join(partial)} could not be fully "
             f"analysed.{ruled}"
         )
+    if coverage.unread_templates and _TEMPLATE_CALLS.intersection(advisory.reachable_symbols):
+        return _investigating(
+            f"No analysed code reaches {entries}, but a template can reach them, and the engine could "
+            f"not read every template the project names: {'; '.join(coverage.unread_templates)}.{ruled}"
+        )
     required_by = dependencies.required_by(package)
     if required_by is None:
         return _investigating(