coretrace-python-analyzer 0.16.0__tar.gz → 0.18.0__tar.gz

{coretrace_python_analyzer-0.16.0 → coretrace_python_analyzer-0.18.0}/CHANGELOG.md

@@ -1,5 +1,21 @@
 # Changelog
 
+## 0.18.0 (2026-09-28)
+
+### Precision
+
+- A Django template file the analyzer cannot read, because of its permissions, no longer counts as escaping everything it renders: it read the file as empty text, and an empty template escapes. The flow through `render_to_string` stays `xss`, and a template extending or including the unreadable one is not established to escape either, as for a template the analyzer cannot find. An unreadable file was already listed among the templates the project names but the run could not read.
+
+### Plugins
+
+- An `EntryPoint` may name a project function or class by its own symbol, `python.app.handlers.main`, so an integration reading a deployment declaration, a SAM template or a `serverless.yml`, can make a bare Lambda handler an entry point; the engine itself infers nothing from a function's name. `EntryPoint.inputs` limits the parameters that are input to the given positions, after `self` for a method: the handler's event, not its context (#180).
+
+## 0.17.0 (2026-09-28)
+
+### Plugins
+
+- `BasePattern(pattern, label, parameters, kinds)` makes the methods of a class whose base's canonical symbol matches a regular expression entry points, for bases generated per project such as a gRPC servicer's, whatever the module's prefix and however the base is imported. Each parameter after `self` is, by position, either input of the model's kinds or an object of a class the model names, which the sources on that class taint without the object being input: a `Source` on `ServicerContext.invocation_metadata` gives the client's metadata, and `peer()` gives nothing. When the project holds the base, only the methods the base defines are entry points, so a servicer's utility methods are not; otherwise every method with the listed number of parameters is. `async` methods and the messages of an iterated parameter are covered (#176).
+
 ## 0.16.0 (2026-09-27)
 
 ### Advisories

{coretrace_python_analyzer-0.16.0 → coretrace_python_analyzer-0.18.0}/PKG-INFO

@@ -1,6 +1,6 @@
 Metadata-Version: 2.5
 Name: coretrace-python-analyzer
-Version: 0.16.0
+Version: 0.18.0
 Summary: Static security analysis infrastructure for Python code
 Project-URL: Homepage, https://github.com/CoreTrace/coretrace-python-analyzer
 Project-URL: Repository, https://github.com/CoreTrace/coretrace-python-analyzer

{coretrace_python_analyzer-0.16.0 → coretrace_python_analyzer-0.18.0}/docs/plugins.md

@@ -151,9 +151,10 @@ class BottleModels(ModelPlugin):
 | `Source(symbol, label, kinds=ALL)` | A call or attribute whose value is attacker-controlled; `label` names it in messages (`http`, `stdin`, `argv`, `http-response`). `kinds` restricts what it can inject. Text input, such as a form field, a header or a URL parameter, carries `TEXT_KINDS`, every kind but `NOSQL`: a string cannot hold a query operator. |
 | `Sink(symbol, kinds, positions=(), keywords=())` | A call dangerous for `kinds`. `positions` limits a kind to the given argument indexes, and `keywords` to the given keyword names; a restricted kind reaches only the arguments listed there. SQL sinks read the statement only, and the SSRF sinks of HTTP clients read the URL, by position or as `url=`. A starred argument or `**kwargs` reaches no restricted kind. |
 | `Sanitizer(symbol, kinds)` | A call whose result is safe for `kinds`, including when the call is inside a project function the data goes through. |
-| `EntryPoint(symbol, label, kinds=ALL)` | A decorator or a class base whose functions receive their parameters as `label` input, such as `flask.Flask.route`. |
+| `EntryPoint(symbol, label, kinds=ALL, inputs=None)` | A decorator or a class base whose functions receive their parameters as `label` input, such as `flask.Flask.route`; or a project function or class named by its own symbol (`python.app.handlers.main`), as an integration reading a deployment declaration names a Lambda handler. `inputs` limits the parameters that are input to those positions, after `self` for a method: a handler's event, not its context. |
 | `TypedParameter(symbol, label, kinds=ALL)` | A class whose annotated parameters carry `label` input, such as Django's `HttpRequest`. |
 | `NamedParameter(pattern, label, kinds)` | A regular expression on parameter names; matching parameters carry `kinds`, as `password` carries `CREDENTIAL`. |
+| `BasePattern(pattern, label, parameters=(None,), kinds=ALL)` | A regular expression on the canonical symbol of a class's base, for bases generated per project such as a gRPC servicer's (`(?:^|\.)\w+_pb2_grpc\.\w+Servicer$`), whatever the module's prefix and however the base is imported. The methods taking the parameters listed, by position after `self`, are entry points: a position left `None` is `label` input carrying `kinds`; one holding a class symbol denotes an object of that class, which the sources on the class taint, as `invocation_metadata()` on a `ServicerContext`, without the object itself being input. When the project holds the base, only the methods the base defines count; otherwise every method with that number of parameters. Inheritance identifies a potential service, not its registration on a server. |
 | `RouteRegistrar(symbol, argument, label, kinds=ALL, keyword=None)` | A call registering a view at argument `argument` (or `keyword`), such as Django's `path`; the view receives `label` input. |
 | `SuffixSink(suffix, kinds, positions=())` | A sink matched by the end of the symbol, for methods of any class such as `objects.raw`. |
 | `SafeArgument(symbol, argument, values, position=None, kinds=ALL)` | A call to the sink `symbol` whose `argument` (by keyword, or at `position`) denotes one of `values` is not a sink for `kinds`, such as `yaml.load` with `Loader=yaml.SafeLoader`. Values are written as the analyzer records arguments: a symbol by its canonical name, a constant as Python writes it (`True`). Only a value given explicitly makes the call safe. |

{coretrace_python_analyzer-0.16.0 → coretrace_python_analyzer-0.18.0}/docs/usage.md

@@ -156,9 +156,9 @@ It establishes escaping only when all of the following hold:
 - No Python file of the project sets `autoescape` to `False`.
 
 The analyzer never assumes escaping where it cannot read the template. That covers a
-template named by an expression, a template found through a `DIRS` entry not named
-`templates`, one shipped by an installed package, one rendered through `get_template`,
-and Flask's Jinja2 templates. The flow is then reported as before. A single-file check
+template file it cannot read, a template named by an expression, a template found
+through a `DIRS` entry not named `templates`, one shipped by an installed package, one
+rendered through `get_template`, and Flask's Jinja2 templates. The flow is then reported as before. A single-file check
 reads no template.
 
 ### Dangerous API usage
@@ -241,7 +241,7 @@ the directory of the checked file; a path outside it is printed as it is.
 ```json
 {
   "schema_version": 1,
-  "tool": {"name": "coretrace-python-analyzer", "version": "0.16.0"},
+  "tool": {"name": "coretrace-python-analyzer", "version": "0.18.0"},
   "root": "/home/me/project",
   "findings": [
     {
@@ -273,7 +273,7 @@ bytes. A single-file check lists no components.
 
 ```json
 "tool": {
-  "name": "coretrace-python-analyzer", "version": "0.16.0",
+  "name": "coretrace-python-analyzer", "version": "0.18.0",
   "components": [
     {"kind": "plugin", "name": "curated-advisories", "version": "2026.09.25", "digest": "sha256:…"},
     {"kind": "advisories", "name": "advisories.json", "digest": "sha256:…"}
@@ -513,7 +513,7 @@ project's behalf would go unseen. Without a lock file, a package is never
 `not_affected`. The document's `@id` derives from its statements, so two runs with the
 same result share it; its `author` is `Unknown Author`, as OpenVEX tools write when they
 cannot know it. Its `tooling` names the analyzer and each component with its digest
-(`coretrace-python-analyzer 0.16.0; curated-advisories 2026.09.25 (sha256:…)`), so the
+(`coretrace-python-analyzer 0.18.0; curated-advisories 2026.09.25 (sha256:…)`), so the
 `@id` changes with the advisory data a statement was decided with.
 
 ## Large projects

{coretrace_python_analyzer-0.16.0 → coretrace_python_analyzer-0.18.0}/pyproject.toml

@@ -4,7 +4,7 @@ build-backend = "hatchling.build"
 
 [project]
 name = "coretrace-python-analyzer"
-version = "0.16.0"
+version = "0.18.0"
 description = "Static security analysis infrastructure for Python code"
 readme = "README.md"
 requires-python = ">=3.11"

{coretrace_python_analyzer-0.16.0 → coretrace_python_analyzer-0.18.0}/src/coretrace_python/__init__.py

@@ -1,4 +1,4 @@
 """CoreTrace's Python static analysis frontend."""
 
-__version__ = "0.16.0"
+__version__ = "0.18.0"
 

{coretrace_python_analyzer-0.16.0 → coretrace_python_analyzer-0.18.0}/src/coretrace_python/engine.py

@@ -80,6 +80,7 @@ from coretrace_python.interprocedural import (
     ModuleFunction,
     ModuleGraph,
     ProjectSummaries,
+    SignaturesAnalysis,
     SummaryAnalysis,
     SummaryIndex,
     SymbolRead,
@@ -164,6 +165,7 @@ ALL_ANALYSES: tuple[AnyAnalysis, ...] = (
     EscapedTemplates,
     ClearingAnalysis,
     TemplateCallsAnalysis,
+    SignaturesAnalysis,
 )
 
 
@@ -205,6 +207,7 @@ class ResultsEvicted(TransformationPass):
             EscapedTemplates,
             ClearingAnalysis,
             TemplateCallsAnalysis,
+            SignaturesAnalysis,
         }
     )
 
@@ -268,6 +271,7 @@ def build_manager(
     table = (models or SecurityModelRegistry()).freeze()
     manager.provide(SecurityModelAnalysis, table)
     manager.provide(MembersAnalysis, table.members_by_class())
+    manager.provide(SignaturesAnalysis, table.signatures())
     manager.provide(ClearingAnalysis, table.clearing())
     manager.provide(ProjectSummaries, SummaryIndex())
     manager.provide(RegisteredRoutes, _routes_of(manager))
@@ -323,6 +327,7 @@ def analyze_file(source: SourceFile, plugin_roots: Sequence[Path]) -> FileAnalys
     table = plugin_models(loaded.plugin for loaded in registry)
     manager.provide(SecurityModelAnalysis, table)
     manager.provide(MembersAnalysis, table.members_by_class())
+    manager.provide(SignaturesAnalysis, table.signatures())
     manager.provide(ClearingAnalysis, table.clearing())
     manager.provide(ProjectSummaries, SummaryIndex())
     manager.provide(RegisteredRoutes, _routes_of(manager))
@@ -418,6 +423,7 @@ def analyze_project(
     for manager in managers.values():
         manager.provide(SecurityModelAnalysis, models)
         manager.provide(MembersAnalysis, members)
+        manager.provide(SignaturesAnalysis, models.signatures())
         manager.provide(DependencyAnalysis, dependencies)
 
     imports: dict[str, ImportTable] = {}
@@ -730,6 +736,7 @@ def _analyse_batch(batch: _Batch) -> dict[str, dict[str, Any]]:
     for manager in managers.values():
         manager.provide(SecurityModelAnalysis, models)
         manager.provide(MembersAnalysis, members)
+        manager.provide(SignaturesAnalysis, models.signatures())
         manager.provide(DependencyAnalysis, dependencies)
         manager.provide(RegisteredRoutes, routes)
         manager.provide(EscapedTemplates, escaped)

{coretrace_python_analyzer-0.16.0 → coretrace_python_analyzer-0.18.0}/src/coretrace_python/interprocedural/__init__.py

@@ -8,6 +8,8 @@ from coretrace_python.interprocedural.callgraph import (
     ExternalSymbol,
     KnownFunction,
     ModuleFunction,
+    Signature,
+    SignaturesAnalysis,
     SymbolRead,
     Target,
     UnknownTarget,
@@ -56,6 +58,8 @@ __all__ = [
     "Mutation",
     "NonlocalWrite",
     "ProjectSummaries",
+    "Signature",
+    "SignaturesAnalysis",
     "SummaryAnalysis",
     "SummaryIndex",
     "SummaryTable",

{coretrace_python_analyzer-0.16.0 → coretrace_python_analyzer-0.18.0}/src/coretrace_python/interprocedural/callgraph.py

@@ -9,6 +9,7 @@ reads, called or not: reading ``request.form`` runs its getter.
 
 from __future__ import annotations
 
+import re
 from collections.abc import Mapping
 from dataclasses import dataclass, field
 from types import MappingProxyType
@@ -104,6 +105,30 @@ class SymbolRead:
     symbol: SymbolId
 
 
+@dataclass(frozen=True)
+class Signature:
+    """What the parameters of the methods of a class denote when the canonical symbol
+    of its base matches ``pattern``, by position after ``self``: a class symbol, or None
+    for a parameter denoting none. A method taking another number of parameters has
+    none. The engine derives signatures from the security models (§16)."""
+
+    pattern: str
+    parameters: tuple[SymbolId | None, ...]
+
+    def matches(self, base: SymbolId) -> bool:
+        return re.search(self.pattern, base.canonical_name) is not None
+
+
+class SignaturesAnalysis(Analysis[tuple[Signature, ...]]):
+    """The signatures the models declare, provided by the engine; none on its own."""
+
+    name: ClassVar[str] = "interprocedural.signatures"
+
+    @classmethod
+    def compute(cls, ctx: AnalysisContext) -> tuple[Signature, ...]:
+        return ()
+
+
 @dataclass(frozen=True)
 class ModuleFunction:
     """One function of a module as a project plugin sees it: the name the call graph
@@ -357,6 +382,20 @@ def _annotated(
     return found
 
 
+def _declared(
+    function: nodes.Function, ssa: FunctionIR, bases: tuple[SymbolId, ...], signatures: tuple[Signature, ...]
+) -> dict[Value, SymbolId]:
+    """Parameters a signature types by their position, for a method of a class one of
+    whose ``bases`` matches the signature and which takes the parameters it lists."""
+
+    given = function.parameters[1:]
+    for signature in signatures:
+        if any(signature.matches(base) for base in bases) and len(given) == len(signature.parameters):
+            typed = zip(ssa.parameters[1:], signature.parameters, strict=False)
+            return {value: symbol for value, symbol in typed if symbol is not None}
+    return {}
+
+
 def _typed_with_module_classes(
     function: nodes.Function, ssa: FunctionIR, classes: Mapping[str, frozenset[str]]
 ) -> dict[Value, str]:
@@ -372,12 +411,15 @@ def _typed_with_module_classes(
 
 class CallGraphAnalysis(Analysis[CallGraph]):
     name: ClassVar[str] = "interprocedural.callgraph"
-    requires: ClassVar[frozenset[AnyAnalysis]] = frozenset({SSAAnalysis, ScopeAnalysis, SymbolAnalysis})
+    requires: ClassVar[frozenset[AnyAnalysis]] = frozenset(
+        {SSAAnalysis, ScopeAnalysis, SymbolAnalysis, SignaturesAnalysis}
+    )
 
     @classmethod
     def compute(cls, ctx: AnalysisContext) -> CallGraph:
         scopes = ctx.get(ScopeAnalysis)
         table = ctx.get(SymbolAnalysis)
+        signatures = ctx.get(SignaturesAnalysis)
         definitions: dict[str, nodes.Function] = {}
         for function in analyzable_functions(ctx.module):
             # A property and its setter, or a redefinition, share a qualified name; each
@@ -396,14 +438,15 @@ class CallGraphAnalysis(Analysis[CallGraph]):
             for statement in ctx.module.body
             if isinstance(statement, nodes.Class)
         }
+        # Inheritance follows the first base that resolves; a signature may match any.
         bases: dict[str, SymbolId] = {}
+        ancestry: dict[str, tuple[SymbolId, ...]] = {}
         for statement in ctx.module.body:
             if isinstance(statement, nodes.Class):
-                for base_expression in statement.bases:
-                    symbol = table.resolve_expression(scopes.module_scope.id, base_expression)
-                    if symbol is not None:
-                        bases[statement.name] = symbol
-                        break
+                resolved = [table.resolve_expression(scopes.module_scope.id, base) for base in statement.bases]
+                ancestry[statement.name] = tuple(symbol for symbol in resolved if symbol is not None)
+                if ancestry[statement.name]:
+                    bases[statement.name] = ancestry[statement.name][0]
         sites: dict[str, tuple[CallSite, ...]] = {}
         symbols: dict[str, Mapping[Value, SymbolId]] = {}
         reads: dict[str, tuple[SymbolRead, ...]] = {}
@@ -418,11 +461,13 @@ class CallGraphAnalysis(Analysis[CallGraph]):
             owner = name.rsplit(".", 1)[0] if "." in name and name.rsplit(".", 1)[0] in classes else None
             if owner is not None and _is_staticmethod(function):
                 owner = None  # a static method has no receiver
+            # A signature types parameters by their position; an annotation says more.
+            declared = _declared(function, ssa, ancestry.get(owner, ()) if owner is not None else (), signatures)
             targets, symbols[name] = resolve_targets(
                 ssa,
                 scopes,
                 known,
-                _annotated(function, ssa, scopes, table),
+                {**declared, **_annotated(function, ssa, scopes, table)},
                 frozenset(definitions),
                 classes,
                 owner,

{coretrace_python_analyzer-0.16.0 → coretrace_python_analyzer-0.18.0}/src/coretrace_python/interprocedural/summaries.py

@@ -363,6 +363,12 @@ class SummaryIndex:
     def summary(self, symbol: SymbolId) -> FunctionSummary | None:
         return self.summaries.get(symbol)
 
+    def defines(self, owner: SymbolId) -> bool:
+        """Whether the project defines a function of ``owner``, a class or a module."""
+
+        prefix = owner.canonical_name + "."
+        return any(s.canonical_name.startswith(prefix) for s in self.symbols)
+
     def __eq__(self, other: object) -> bool:
         return isinstance(other, SummaryIndex) and dict(self.summaries) == dict(other.summaries)
 

{coretrace_python_analyzer-0.16.0 → coretrace_python_analyzer-0.18.0}/src/coretrace_python/taint/__init__.py

@@ -12,6 +12,7 @@ from coretrace_python.taint.engine import (
 from coretrace_python.taint.models import (
     TEXT_KINDS,
     AuthorizationGuard,
+    BasePattern,
     EntryPoint,
     Model,
     ModelError,
@@ -47,6 +48,7 @@ __all__ = [
     "FILTER_FUNCTIONS",
     "TEXT_KINDS",
     "AuthorizationGuard",
+    "BasePattern",
     "EntryPoint",
     "EntryPointAnalysis",
     "EscapedTemplates",

{coretrace_python_analyzer-0.16.0 → coretrace_python_analyzer-0.18.0}/src/coretrace_python/taint/engine.py

@@ -80,6 +80,7 @@ from coretrace_python.semantic.symbols import SymbolAnalysis, SymbolId, SymbolTa
 from coretrace_python.source import SourceSpan
 from coretrace_python.taint.models import (
     TEXT_KINDS,
+    BasePattern,
     EntryPoint,
     ModelTable,
     SecurityModelAnalysis,
@@ -780,9 +781,11 @@ def entry_point_of(
     symbols: SymbolTable,
     owner: nodes.Class | None = None,
     instances: Instances | None = None,
+    project: SummaryIndex | None = None,
 ) -> EntryPoint | None:
     """The entry-point model matching one of the function's decorators or, for a
-    method, one of the bases of ``owner``, if any."""
+    method, one of the bases of ``owner``, if any: by symbol, or by a base pattern when
+    the method is one the pattern covers (``project`` says what the base defines)."""
 
     scope = scopes.scope_for(function)
     enclosing = scope.parent if scope.parent is not None else scope.id
@@ -803,9 +806,24 @@ def entry_point_of(
             entry = models.entry_point(candidate)
             if entry is not None:
                 return entry
+            pattern = models.base_pattern(candidate) if id(expression) in enclosing_of else None
+            if pattern is not None and _covered(function, candidate, pattern, project):
+                return EntryPoint(candidate, pattern.label, pattern.kinds)
     return None
 
 
+def _covered(function: nodes.Function, base: SymbolId, pattern: BasePattern, project: SummaryIndex | None) -> bool:
+    """Whether a method of a class deriving from ``base`` is one ``pattern`` covers: it
+    takes the parameters the pattern lists and, when the project holds the base, the
+    base defines it; a utility method of the class is no entry point."""
+
+    if len(function.parameters) - 1 != len(pattern.parameters):
+        return False
+    if project is None or not project.defines(base):
+        return True
+    return project.summary(base.attribute(function.name)) is not None
+
+
 def function_entry_point(
     function: nodes.Function,
     module: nodes.Module,
@@ -814,24 +832,34 @@ def function_entry_point(
     symbols: SymbolTable,
     instances: Instances | None = None,
     routes: Routes | None = None,
+    project: SummaryIndex | None = None,
 ) -> EntryPoint | None:
     """The entry point ``function`` is: one of its decorators or, for a method, one of its
-    class's bases matching an entry-point model, or a registration elsewhere (``routes``)."""
+    class's bases matching an entry-point model, a registration elsewhere (``routes``), or
+    a model naming the function, or its class, by its own project symbol."""
 
     owner = _owner(module, function)
     enclosing_function = _enclosing(module, function)
     if enclosing_function is not None:
         # ``app = Flask(__name__)`` inside ``create_app``: routes defined there resolve.
         instances = {**(instances or {}), **local_instances(enclosing_function, scopes, symbols)}
-    entry = entry_point_of(function, models, scopes, symbols, owner, instances)
-    if entry is None and routes:
+    entry = entry_point_of(function, models, scopes, symbols, owner, instances, project)
+    if entry is None:
         qualified = function.name if owner is None else f"{owner.name}.{function.name}"
-        entry = routes.get(project_symbol(module.name, qualified))
+        entry = _declared(project_symbol(module.name, qualified), models, routes)
         if entry is None and owner is not None:
-            entry = routes.get(project_symbol(module.name, owner.name))
+            entry = _declared(project_symbol(module.name, owner.name), models, routes)
     return entry
 
 
+def _declared(symbol: SymbolId, models: ModelTable, routes: Routes | None) -> EntryPoint | None:
+    """The entry point a project ``symbol`` is: registered as a handler, or named by a
+    model."""
+
+    registered = routes.get(symbol) if routes else None
+    return registered if registered is not None else models.entry_point(symbol)
+
+
 def _owner(module: nodes.Module, function: nodes.Function) -> nodes.Class | None:
     """The top-level class ``function`` is a method of, if any."""
 
@@ -849,23 +877,31 @@ def parameter_sources(
     symbols: SymbolTable,
     instances: Instances | None = None,
     routes: Routes | None = None,
+    project: SummaryIndex | None = None,
 ) -> Mapping[int, Source]:
     """The attacker-controlled parameters of ``function``, by index: every parameter of an
     entry point (``self`` excepted for a method), including one registered elsewhere
     (``routes``), and every parameter annotated with a typed-parameter symbol. An entry
     point's parameter annotated with scalars is text: FastAPI validates it before the
     handler runs, and a scalar cannot hold a query operator. So are the URL parameters
-    a view receives after a request object."""
+    a view receives after a request object. A parameter a base pattern types with a
+    class is not input: the sources on that class say what it gives."""
 
     owner = _owner(module, function)
     sources: dict[int, Source] = {}
     scope = scopes.scope_for(function)
     enclosing = scope.parent if scope.parent is not None else scope.id
-    entry = function_entry_point(function, module, models, scopes, symbols, instances, routes)
+    entry = function_entry_point(function, module, models, scopes, symbols, instances, routes, project)
     if entry is not None:
         first = 1 if owner is not None else 0
         request = models.request_object(entry.symbol)
+        pattern = models.base_pattern(entry.symbol) if models.entry_point(entry.symbol) is None else None
+        roles = pattern.parameters if pattern is not None else ()
         for index in range(first, len(function.parameters)):
+            if index - first < len(roles) and roles[index - first] is not None:
+                continue
+            if entry.inputs is not None and index - first not in entry.inputs:
+                continue
             annotation = function.parameters[index].annotation
             text = (request is not None and index > first) or (
                 annotation is not None and _scalar(annotation, symbols, enclosing)
@@ -1010,11 +1046,12 @@ class TaintAnalysis(FunctionAnalysis[TaintFacts]):
         graph = ctx.get(CallGraphAnalysis)
         models = ctx.get(SecurityModelAnalysis)
         scopes, symbols = ctx.get(ScopeAnalysis), ctx.get(SymbolAnalysis)
-        instances = factory_instances(ctx.module, scopes, symbols, ctx.get(SummaryAnalysis), ctx.get(ProjectSummaries))
+        project = ctx.get(ProjectSummaries)
+        instances = factory_instances(ctx.module, scopes, symbols, ctx.get(SummaryAnalysis), project)
         routes = ctx.get(RegisteredRoutes)
 
         def sources_of(member: nodes.Function) -> Mapping[int, Source]:
-            return parameter_sources(member, ctx.module, models, scopes, symbols, instances, routes)
+            return parameter_sources(member, ctx.module, models, scopes, symbols, instances, routes, project)
 
         ssa = ctx.get(SSAAnalysis, function)
         heap = ctx.get(HeapAnalysis, function)
@@ -1068,9 +1105,10 @@ class EntryPointAnalysis(Analysis[tuple[ModuleFunction, ...]]):
         scopes, symbols = ctx.get(ScopeAnalysis), ctx.get(SymbolAnalysis)
         instances = factory_instances(ctx.module, scopes, symbols, ctx.get(SummaryAnalysis), ctx.get(ProjectSummaries))
         routes = ctx.get(RegisteredRoutes)
+        project = ctx.get(ProjectSummaries)
         functions: list[ModuleFunction] = []
         for name, function in graph.definitions.items():
-            entry = function_entry_point(function, ctx.module, models, scopes, symbols, instances, routes)
+            entry = function_entry_point(function, ctx.module, models, scopes, symbols, instances, routes, project)
             functions.append(ModuleFunction(name, function.span, entry.label if entry is not None else None))
         return tuple(functions)
 

{coretrace_python_analyzer-0.16.0 → coretrace_python_analyzer-0.18.0}/src/coretrace_python/taint/models.py

@@ -17,7 +17,7 @@ from types import MappingProxyType
 from typing import ClassVar
 
 from coretrace_python.analysis import Analysis, AnalysisContext, MissingInputError
-from coretrace_python.interprocedural import Clearing, TemplateCalls, TemplateFilter
+from coretrace_python.interprocedural import Clearing, Signature, TemplateCalls, TemplateFilter
 from coretrace_python.semantic.symbols import Members, SymbolId
 
 
@@ -110,12 +110,17 @@ class Sanitizer:
 
 @dataclass(frozen=True)
 class EntryPoint:
-    """Functions decorated by ``symbol``, and methods of classes deriving from it,
-    receive attacker-controlled parameters."""
+    """Functions decorated by ``symbol``, methods of classes deriving from it, and, when
+    ``symbol`` names a project function or class, that function or the class's methods
+    receive attacker-controlled parameters: those at ``inputs``, by position after
+    ``self`` for a method, or every parameter when ``inputs`` is None. A deployment
+    declaration an integration reads names a Lambda handler this way, whose event is
+    input and whose context is not."""
 
     symbol: SymbolId
     label: str
     kinds: TaintKind = TaintKind.ALL
+    inputs: tuple[int, ...] | None = None
 
 
 @dataclass(frozen=True)
@@ -145,6 +150,32 @@ class NamedParameter:
         return re.search(self.pattern, name) is not None
 
 
+@dataclass(frozen=True)
+class BasePattern:
+    """Methods of a class whose base's canonical symbol matches ``pattern`` are entry
+    points labelled ``label``, when they take the parameters the model lists, by
+    position after ``self``: a position left None is attacker input carrying ``kinds``;
+    one holding a class symbol denotes an object of that class, which the sources on
+    the class taint. A gRPC servicer's RPCs take the request, or the iterator of the
+    client's messages, and a ``ServicerContext``. When the project holds the base,
+    only the methods it defines are entry points; otherwise every method with that
+    number of parameters. Inheritance identifies a potential service, not its
+    registration on a server."""
+
+    pattern: str
+    label: str
+    parameters: tuple[SymbolId | None, ...] = (None,)
+    kinds: TaintKind = TaintKind.ALL
+
+    @property
+    def symbol(self) -> SymbolId:
+        digest = hashlib.sha1(self.pattern.encode("utf-8")).hexdigest()[:12]
+        return SymbolId(f"python.base.p{digest}")
+
+    def matches(self, base: SymbolId) -> bool:
+        return re.search(self.pattern, base.canonical_name) is not None
+
+
 @dataclass(frozen=True)
 class RouteRegistrar:
     """A call registering a handler elsewhere (``path('login/', views.log_in)``): the
@@ -251,6 +282,7 @@ Model = (
     | TemplateRender
     | Members
     | RequestObject
+    | BasePattern
 )
 
 
@@ -270,6 +302,7 @@ class ModelTable:
     template_renders: tuple[TemplateRender, ...] = ()
     members: tuple[Members, ...] = ()
     request_objects: tuple[RequestObject, ...] = ()
+    base_patterns: tuple[BasePattern, ...] = ()
     _by_symbol: dict[type[Model], dict[SymbolId, Model]] = field(
         init=False, repr=False, compare=False
     )
@@ -287,6 +320,7 @@ class ModelTable:
             SafeArgument: {m.symbol: m for m in self.safe_arguments},
             TemplateRender: {m.symbol: m for m in self.template_renders},
             RequestObject: {m.symbol: m for m in self.request_objects},
+            BasePattern: {m.symbol: m for m in self.base_patterns},
         }
         object.__setattr__(self, "_by_symbol", MappingProxyType(index))
 
@@ -356,8 +390,20 @@ class ModelTable:
             self.template_renders,
             self.members,
             self.request_objects,
+            self.base_patterns,
         )
 
+    def base_pattern(self, base: SymbolId) -> BasePattern | None:
+        """The pattern model the canonical symbol of a class's ``base`` matches, if any."""
+
+        return next((m for m in self.base_patterns if m.matches(base)), None)
+
+    def signatures(self) -> tuple[Signature, ...]:
+        """What the methods of the classes the base patterns match receive, by position,
+        for the call graph to type them."""
+
+        return tuple(Signature(m.pattern, m.parameters) for m in self.base_patterns)
+
     def sanitizer(self, symbol: SymbolId) -> Sanitizer | None:
         found = self._by_symbol[Sanitizer].get(symbol)
         return found if isinstance(found, Sanitizer) else None
@@ -451,6 +497,7 @@ class SecurityModelRegistry:
             template_renders=tuple(m for m in models if isinstance(m, TemplateRender)),
             members=tuple(m for m in models if isinstance(m, Members)),
             request_objects=tuple(m for m in models if isinstance(m, RequestObject)),
+            base_patterns=tuple(m for m in models if isinstance(m, BasePattern)),
         )
 
 

{coretrace_python_analyzer-0.16.0 → coretrace_python_analyzer-0.18.0}/src/coretrace_python/taint/templates.py

@@ -15,7 +15,8 @@ it extends or includes, can output data unescaped:
 
 Templates are found under the project's ``templates`` directories, by their path below
 one. A template the engine cannot find — named by an expression, under a ``DIRS`` entry
-of another name, shipped by an installed package — is never assumed to escape.
+of another name, shipped by an installed package — or cannot read is never assumed to
+escape.
 
 A template applying a filter of Django's own libraries calls the function behind it
 whenever it is rendered, though no Python call names that function: ``{{ bio|striptags }}``
@@ -149,7 +150,7 @@ def escaped_templates(root: Path) -> frozenset[str]:
     local: dict[str, bool] = {}
     requires: dict[str, set[str]] = {}
     for name, paths in found.items():
-        verdicts = [_inspect(_read(path)) for path in paths]
+        verdicts = [_verdict(path) for path in paths]
         local[name] = all(safe for safe, _ in verdicts)
         requires[name] = {needed for _, needs in verdicts for needed in needs}
     escaped = {name for name, safe in local.items() if safe}
@@ -171,6 +172,14 @@ def _read(path: Path) -> str:
     return _text(path) or ""
 
 
+def _verdict(path: Path) -> tuple[bool, set[str]]:
+    """Whether one template file escapes all it prints, and what it needs: a file the
+    engine cannot read is not established to escape, like a template it cannot find."""
+
+    text = _text(path)
+    return (False, set()) if text is None else _inspect(text)
+
+
 def _text(path: Path) -> str | None:
     """The text of ``path``, or None when it cannot be read."""