coretrace-python-analyzer 0.15.0__py3-none-any.whl → 0.17.0__py3-none-any.whl

coretrace_python/__init__.py

@@ -1,4 +1,4 @@
 """CoreTrace's Python static analysis frontend."""
 
-__version__ = "0.15.0"
+__version__ = "0.17.0"
 

coretrace_python/bundled/dependency/reachable_vulnerability/reachable_vulnerability.py

@@ -1,5 +1,6 @@
 """Calls, anywhere in the project, to an API affected by a vulnerable requirement, and
-reads of an affected attribute whose getter runs the vulnerable code."""
+reads of an affected attribute whose getter runs the vulnerable code. A filter a project
+template applies is a call to the function behind it, at the template's line."""
 
 from __future__ import annotations
 
@@ -56,6 +57,10 @@ class ReachableVulnerabilityPlugin(ProjectPlugin):
                             reported.add((advisory, symbol))
                             check = check_conditions(entry, None)
                             findings.append(_reached(advisory, symbol, read.location, function, check))
+        for call in ctx.templates.calls:
+            for advisory in affected.get(call.symbol, ()):
+                check = check_conditions(advisory.entry_point(call.symbol), None)
+                findings.append(_reached(advisory, call.symbol, call.span, None, check))
         return findings
 
 
@@ -67,7 +72,9 @@ def _read_through(symbol: SymbolId) -> Iterator[SymbolId]:
         yield SymbolId(".".join(components[:end]))
 
 
-def _reached(advisory: Advisory, symbol: SymbolId, span: SourceSpan, function: str, check: ConditionCheck) -> Finding:
+def _reached(
+    advisory: Advisory, symbol: SymbolId, span: SourceSpan, function: str | None, check: ConditionCheck
+) -> Finding:
     return Finding(
         rule_id="reachable-vulnerability",
         message=(

coretrace_python/bundled/models/django/django_models.py

@@ -139,7 +139,10 @@ class DjangoModels(ModelPlugin):
         Sink(_sym("django.http.HttpResponseRedirect"), TaintKind.REDIRECT, _TARGET_ONLY),
         Sink(_sym("django.http.HttpResponsePermanentRedirect"), TaintKind.REDIRECT, _TARGET_ONLY),
         Sanitizer(_sym("django.utils.html.escape"), TaintKind.HTML),
-        TemplateRender(_sym("django.template.loader.render_to_string")),
+        TemplateRender(_sym("django.template.loader.render_to_string"), request=2),
+        TemplateRender(_sym("django.shortcuts.render"), 1, context=2, request=0),
+        TemplateRender(_sym("django.template.response.TemplateResponse"), 1, "template", 2, 0),
+        TemplateRender(_sym("django.template.response.SimpleTemplateResponse"), 0, "template"),
         Sanitizer(_sym("django.utils.html.conditional_escape"), TaintKind.HTML),
         # The masked CSRF secret: ASCII letters and digits only, a malformed cookie is
         # replaced before it is used.

coretrace_python/dependency/vex.py

@@ -7,7 +7,8 @@ subcomponent of the project:
   exploitable finding, whatever the policy or a suppression did with it;
 - ``not_affected``, as ``vulnerable_code_not_in_execute_path``, only when the advisory is
   curated (it names entry points), no code of the project reaches them, every file and
-  function was analysed, and a lock file shows that no other package requires the
+  function was analysed, every template the project names was read when a template
+  filter can reach them, and a lock file shows that no other package requires the
   vulnerable one, since the code of installed packages is not analysed;
 - ``under_investigation`` otherwise, with the reason in its notes.
 """
@@ -25,6 +26,7 @@ from coretrace_python.dependency.graph import Advisory, DependencyGraph, Require
 from coretrace_python.dependency.sbom import purl
 from coretrace_python.findings import Component, Finding
 from coretrace_python.findings.coverage import Coverage
+from coretrace_python.taint import FILTER_FUNCTIONS
 
 CONTEXT = "https://openvex.dev/ns/v0.2.0"
 # OpenVEX's shared namespace for documents without an IRI of their own, and the author
@@ -33,6 +35,8 @@ NAMESPACE = "https://openvex.dev/docs/public/vex-"
 AUTHOR = "Unknown Author"
 # Evidence levels that put the vulnerable code in the project's execution path, lowest first.
 REACHED = ("reachable", "exploitable")
+# What a template calls: a template the engine cannot read may reach these.
+_TEMPLATE_CALLS = frozenset(FILTER_FUNCTIONS.values())
 
 
 def render_vex(
@@ -140,6 +144,11 @@ def _status(
             f"No analysed code reaches {entries}, but {', '.join(partial)} could not be fully "
             f"analysed.{ruled}"
         )
+    if coverage.unread_templates and _TEMPLATE_CALLS.intersection(advisory.reachable_symbols):
+        return _investigating(
+            f"No analysed code reaches {entries}, but a template can reach them, and the engine could "
+            f"not read every template the project names: {'; '.join(coverage.unread_templates)}.{ruled}"
+        )
     required_by = dependencies.required_by(package)
     if required_by is None:
         return _investigating(

coretrace_python/engine.py

@@ -80,9 +80,12 @@ from coretrace_python.interprocedural import (
     ModuleFunction,
     ModuleGraph,
     ProjectSummaries,
+    SignaturesAnalysis,
     SummaryAnalysis,
     SummaryIndex,
     SymbolRead,
+    TemplateCalls,
+    TemplateCallsAnalysis,
     build_module_graph,
     discover_sources,
     project_symbol,
@@ -124,7 +127,10 @@ from coretrace_python.taint import (
     TaintAnalysis,
     TaintKind,
     escaped_templates,
+    project_templates,
     registered_routes,
+    request_processor,
+    unread_renders,
 )
 from coretrace_python.taint.urls import flow_url
 
@@ -158,6 +164,8 @@ ALL_ANALYSES: tuple[AnyAnalysis, ...] = (
     RegisteredRoutes,
     EscapedTemplates,
     ClearingAnalysis,
+    TemplateCallsAnalysis,
+    SignaturesAnalysis,
 )
 
 
@@ -198,6 +206,8 @@ class ResultsEvicted(TransformationPass):
             RegisteredRoutes,
             EscapedTemplates,
             ClearingAnalysis,
+            TemplateCallsAnalysis,
+            SignaturesAnalysis,
         }
     )
 
@@ -261,6 +271,7 @@ def build_manager(
     table = (models or SecurityModelRegistry()).freeze()
     manager.provide(SecurityModelAnalysis, table)
     manager.provide(MembersAnalysis, table.members_by_class())
+    manager.provide(SignaturesAnalysis, table.signatures())
     manager.provide(ClearingAnalysis, table.clearing())
     manager.provide(ProjectSummaries, SummaryIndex())
     manager.provide(RegisteredRoutes, _routes_of(manager))
@@ -316,6 +327,7 @@ def analyze_file(source: SourceFile, plugin_roots: Sequence[Path]) -> FileAnalys
     table = plugin_models(loaded.plugin for loaded in registry)
     manager.provide(SecurityModelAnalysis, table)
     manager.provide(MembersAnalysis, table.members_by_class())
+    manager.provide(SignaturesAnalysis, table.signatures())
     manager.provide(ClearingAnalysis, table.clearing())
     manager.provide(ProjectSummaries, SummaryIndex())
     manager.provide(RegisteredRoutes, _routes_of(manager))
@@ -411,6 +423,7 @@ def analyze_project(
     for manager in managers.values():
         manager.provide(SecurityModelAnalysis, models)
         manager.provide(MembersAnalysis, members)
+        manager.provide(SignaturesAnalysis, models.signatures())
         manager.provide(DependencyAnalysis, dependencies)
 
     imports: dict[str, ImportTable] = {}
@@ -431,13 +444,20 @@ def analyze_project(
         for symbol, registered in _routes_of(analysable[name]).items():
             routes.setdefault(symbol, registered)
     escaped = escaped_templates(root)
+    templates = project_templates(root)
     clearing = models.clearing(escaped)
+    template_calls = models.template_calls(
+        templates.filters, request_processor(modules[name] for name in sorted(analysable))
+    )
     for manager in analysable.values():
         manager.provide(RegisteredRoutes, routes)
         manager.provide(EscapedTemplates, escaped)
         manager.provide(ClearingAnalysis, clearing)
+        manager.provide(TemplateCallsAnalysis, template_calls)
 
-    configuration = _configuration_key(components, plugins, models, advisories, dependencies, routes, escaped)
+    configuration = _configuration_key(
+        components, plugins, models, advisories, dependencies, routes, escaped, template_calls
+    )
     keys = module_keys(
         graph,
         {name: fingerprint(configuration, str(files[name].source_id), name, files[name].text) for name in analysable},
@@ -479,6 +499,7 @@ def analyze_project(
                             advisory_paths,
                             _encode_routes(routes),
                             tuple(sorted(escaped)),
+                            template_calls,
                         ),
                     )
                     for component in pending
@@ -516,7 +537,9 @@ def analyze_project(
             frozenset(),
             reads={f: tuple(r) for f, r in reads.items()},
         )
-    context = ProjectContext(graph, dependencies, advisories, analysable, call_graphs, policy, root, functions)
+    context = ProjectContext(
+        graph, dependencies, advisories, analysable, call_graphs, policy, root, functions, templates
+    )
     for plugin in all_plugins:
         if isinstance(plugin, ProjectPlugin):
             findings.extend(plugin.analyze_project(context))
@@ -526,6 +549,9 @@ def analyze_project(
     findings = [_sourced(finding, origins) for finding in findings]
     accepted = tuple(f for f in findings if policy.accepts(f))
     kept, suppressed = partition(apply_policy(policy, findings), _text_of(sources))
+    unread = list(templates.unread)
+    for name in sorted(call_graphs):
+        unread.extend(unread_renders(name, call_graphs[name], models, templates.names))
     return ProjectAnalysis(
         graph,
         index,
@@ -534,7 +560,7 @@ def analyze_project(
         MappingProxyType(keys),
         reused,
         advisories,
-        Coverage(tuple(sorted(coverage, key=lambda c: c.path))),
+        Coverage(tuple(sorted(coverage, key=lambda c: c.path)), tuple(unread)),
         suppressed,
         accepted,
         components,
@@ -686,6 +712,7 @@ class _Batch:
     advisory_paths: tuple[Path, ...] = ()
     routes: tuple[tuple[str, str, str, int], ...] = ()
     escaped: tuple[str, ...] = ()
+    template_calls: TemplateCalls = field(default_factory=TemplateCalls)
 
 
 def _analyse_batch(batch: _Batch) -> dict[str, dict[str, Any]]:
@@ -709,10 +736,12 @@ def _analyse_batch(batch: _Batch) -> dict[str, dict[str, Any]]:
     for manager in managers.values():
         manager.provide(SecurityModelAnalysis, models)
         manager.provide(MembersAnalysis, members)
+        manager.provide(SignaturesAnalysis, models.signatures())
         manager.provide(DependencyAnalysis, dependencies)
         manager.provide(RegisteredRoutes, routes)
         manager.provide(EscapedTemplates, escaped)
         manager.provide(ClearingAnalysis, models.clearing(escaped))
+        manager.provide(TemplateCallsAnalysis, batch.template_calls)
     module_plugins = tuple(p for p in all_plugins if not isinstance(p, ProjectPlugin))
     results = _analyse_managers(managers, decode_index(batch.seed), module_plugins, affected)
     return {name: encode(entry) for name, entry in results.items()}
@@ -741,6 +770,7 @@ def _configuration_key(
     dependencies: DependencyGraph,
     routes: Routes | None = None,
     escaped: frozenset[str] = frozenset(),
+    template_calls: TemplateCalls | None = None,
 ) -> str:
     """Everything a module's results depend on besides the project sources (§11)."""
 
@@ -758,6 +788,7 @@ def _configuration_key(
         repr(dependencies.errors),
         repr(_encode_routes(routes or {})),
         repr(sorted(escaped)),
+        repr(template_calls),
     )
 
 

coretrace_python/findings/coverage.py

@@ -2,7 +2,9 @@
 
 "No findings" only means something when the reader knows what was analysed. Each file
 is ``analysed``, a ``syntax-error`` (the frontend rejected it) or ``unreadable`` (it could
-not be decoded); analysed files count their functions and how many lowered.
+not be decoded); analysed files count their functions and how many lowered. The
+templates the project names but the run could not read are listed, each where the
+project names it: they may call any template filter.
 """
 
 from __future__ import annotations
@@ -21,6 +23,7 @@ class FileCoverage:
 @dataclass(frozen=True)
 class Coverage:
     details: tuple[FileCoverage, ...] = ()
+    unread_templates: tuple[str, ...] = ()
 
     @property
     def files(self) -> int:

coretrace_python/interprocedural/__init__.py

@@ -8,6 +8,8 @@ from coretrace_python.interprocedural.callgraph import (
     ExternalSymbol,
     KnownFunction,
     ModuleFunction,
+    Signature,
+    SignaturesAnalysis,
     SymbolRead,
     Target,
     UnknownTarget,
@@ -20,6 +22,7 @@ from coretrace_python.interprocedural.modulegraph import (
     project_symbol,
 )
 from coretrace_python.interprocedural.summaries import (
+    FILTER_ARGUMENTS,
     Cleared,
     Clearing,
     ClearingAnalysis,
@@ -31,10 +34,14 @@ from coretrace_python.interprocedural.summaries import (
     SummaryAnalysis,
     SummaryIndex,
     SummaryTable,
+    TemplateCalls,
+    TemplateCallsAnalysis,
+    TemplateFilter,
     cleared_by,
 )
 
 __all__ = [
+    "FILTER_ARGUMENTS",
     "Arguments",
     "CallGraph",
     "CallGraphAnalysis",
@@ -51,11 +58,16 @@ __all__ = [
     "Mutation",
     "NonlocalWrite",
     "ProjectSummaries",
+    "Signature",
+    "SignaturesAnalysis",
     "SummaryAnalysis",
     "SummaryIndex",
     "SummaryTable",
     "SymbolRead",
     "Target",
+    "TemplateCalls",
+    "TemplateCallsAnalysis",
+    "TemplateFilter",
     "UnknownTarget",
     "build_module_graph",
     "cleared_by",

coretrace_python/interprocedural/callgraph.py

@@ -9,6 +9,7 @@ reads, called or not: reading ``request.form`` runs its getter.
 
 from __future__ import annotations
 
+import re
 from collections.abc import Mapping
 from dataclasses import dataclass, field
 from types import MappingProxyType
@@ -104,6 +105,30 @@ class SymbolRead:
     symbol: SymbolId
 
 
+@dataclass(frozen=True)
+class Signature:
+    """What the parameters of the methods of a class denote when the canonical symbol
+    of its base matches ``pattern``, by position after ``self``: a class symbol, or None
+    for a parameter denoting none. A method taking another number of parameters has
+    none. The engine derives signatures from the security models (§16)."""
+
+    pattern: str
+    parameters: tuple[SymbolId | None, ...]
+
+    def matches(self, base: SymbolId) -> bool:
+        return re.search(self.pattern, base.canonical_name) is not None
+
+
+class SignaturesAnalysis(Analysis[tuple[Signature, ...]]):
+    """The signatures the models declare, provided by the engine; none on its own."""
+
+    name: ClassVar[str] = "interprocedural.signatures"
+
+    @classmethod
+    def compute(cls, ctx: AnalysisContext) -> tuple[Signature, ...]:
+        return ()
+
+
 @dataclass(frozen=True)
 class ModuleFunction:
     """One function of a module as a project plugin sees it: the name the call graph
@@ -357,6 +382,20 @@ def _annotated(
     return found
 
 
+def _declared(
+    function: nodes.Function, ssa: FunctionIR, bases: tuple[SymbolId, ...], signatures: tuple[Signature, ...]
+) -> dict[Value, SymbolId]:
+    """Parameters a signature types by their position, for a method of a class one of
+    whose ``bases`` matches the signature and which takes the parameters it lists."""
+
+    given = function.parameters[1:]
+    for signature in signatures:
+        if any(signature.matches(base) for base in bases) and len(given) == len(signature.parameters):
+            typed = zip(ssa.parameters[1:], signature.parameters, strict=False)
+            return {value: symbol for value, symbol in typed if symbol is not None}
+    return {}
+
+
 def _typed_with_module_classes(
     function: nodes.Function, ssa: FunctionIR, classes: Mapping[str, frozenset[str]]
 ) -> dict[Value, str]:
@@ -372,12 +411,15 @@ def _typed_with_module_classes(
 
 class CallGraphAnalysis(Analysis[CallGraph]):
     name: ClassVar[str] = "interprocedural.callgraph"
-    requires: ClassVar[frozenset[AnyAnalysis]] = frozenset({SSAAnalysis, ScopeAnalysis, SymbolAnalysis})
+    requires: ClassVar[frozenset[AnyAnalysis]] = frozenset(
+        {SSAAnalysis, ScopeAnalysis, SymbolAnalysis, SignaturesAnalysis}
+    )
 
     @classmethod
     def compute(cls, ctx: AnalysisContext) -> CallGraph:
         scopes = ctx.get(ScopeAnalysis)
         table = ctx.get(SymbolAnalysis)
+        signatures = ctx.get(SignaturesAnalysis)
         definitions: dict[str, nodes.Function] = {}
         for function in analyzable_functions(ctx.module):
             # A property and its setter, or a redefinition, share a qualified name; each
@@ -396,14 +438,15 @@ class CallGraphAnalysis(Analysis[CallGraph]):
             for statement in ctx.module.body
             if isinstance(statement, nodes.Class)
         }
+        # Inheritance follows the first base that resolves; a signature may match any.
         bases: dict[str, SymbolId] = {}
+        ancestry: dict[str, tuple[SymbolId, ...]] = {}
         for statement in ctx.module.body:
             if isinstance(statement, nodes.Class):
-                for base_expression in statement.bases:
-                    symbol = table.resolve_expression(scopes.module_scope.id, base_expression)
-                    if symbol is not None:
-                        bases[statement.name] = symbol
-                        break
+                resolved = [table.resolve_expression(scopes.module_scope.id, base) for base in statement.bases]
+                ancestry[statement.name] = tuple(symbol for symbol in resolved if symbol is not None)
+                if ancestry[statement.name]:
+                    bases[statement.name] = ancestry[statement.name][0]
         sites: dict[str, tuple[CallSite, ...]] = {}
         symbols: dict[str, Mapping[Value, SymbolId]] = {}
         reads: dict[str, tuple[SymbolRead, ...]] = {}
@@ -418,11 +461,13 @@ class CallGraphAnalysis(Analysis[CallGraph]):
             owner = name.rsplit(".", 1)[0] if "." in name and name.rsplit(".", 1)[0] in classes else None
             if owner is not None and _is_staticmethod(function):
                 owner = None  # a static method has no receiver
+            # A signature types parameters by their position; an annotation says more.
+            declared = _declared(function, ssa, ancestry.get(owner, ()) if owner is not None else (), signatures)
             targets, symbols[name] = resolve_targets(
                 ssa,
                 scopes,
                 known,
-                _annotated(function, ssa, scopes, table),
+                {**declared, **_annotated(function, ssa, scopes, table)},
                 frozenset(definitions),
                 classes,
                 owner,