coretrace-python-analyzer 0.17.0__py3-none-any.whl → 0.18.0__py3-none-any.whl

coretrace_python/__init__.py

@@ -1,4 +1,4 @@
 """CoreTrace's Python static analysis frontend."""
 
-__version__ = "0.17.0"
+__version__ = "0.18.0"
 

coretrace_python/taint/engine.py

@@ -835,7 +835,8 @@ def function_entry_point(
     project: SummaryIndex | None = None,
 ) -> EntryPoint | None:
     """The entry point ``function`` is: one of its decorators or, for a method, one of its
-    class's bases matching an entry-point model, or a registration elsewhere (``routes``)."""
+    class's bases matching an entry-point model, a registration elsewhere (``routes``), or
+    a model naming the function, or its class, by its own project symbol."""
 
     owner = _owner(module, function)
     enclosing_function = _enclosing(module, function)
@@ -843,14 +844,22 @@ def function_entry_point(
         # ``app = Flask(__name__)`` inside ``create_app``: routes defined there resolve.
         instances = {**(instances or {}), **local_instances(enclosing_function, scopes, symbols)}
     entry = entry_point_of(function, models, scopes, symbols, owner, instances, project)
-    if entry is None and routes:
+    if entry is None:
         qualified = function.name if owner is None else f"{owner.name}.{function.name}"
-        entry = routes.get(project_symbol(module.name, qualified))
+        entry = _declared(project_symbol(module.name, qualified), models, routes)
         if entry is None and owner is not None:
-            entry = routes.get(project_symbol(module.name, owner.name))
+            entry = _declared(project_symbol(module.name, owner.name), models, routes)
     return entry
 
 
+def _declared(symbol: SymbolId, models: ModelTable, routes: Routes | None) -> EntryPoint | None:
+    """The entry point a project ``symbol`` is: registered as a handler, or named by a
+    model."""
+
+    registered = routes.get(symbol) if routes else None
+    return registered if registered is not None else models.entry_point(symbol)
+
+
 def _owner(module: nodes.Module, function: nodes.Function) -> nodes.Class | None:
     """The top-level class ``function`` is a method of, if any."""
 
@@ -891,6 +900,8 @@ def parameter_sources(
         for index in range(first, len(function.parameters)):
             if index - first < len(roles) and roles[index - first] is not None:
                 continue
+            if entry.inputs is not None and index - first not in entry.inputs:
+                continue
             annotation = function.parameters[index].annotation
             text = (request is not None and index > first) or (
                 annotation is not None and _scalar(annotation, symbols, enclosing)

coretrace_python/taint/models.py

@@ -110,12 +110,17 @@ class Sanitizer:
 
 @dataclass(frozen=True)
 class EntryPoint:
-    """Functions decorated by ``symbol``, and methods of classes deriving from it,
-    receive attacker-controlled parameters."""
+    """Functions decorated by ``symbol``, methods of classes deriving from it, and, when
+    ``symbol`` names a project function or class, that function or the class's methods
+    receive attacker-controlled parameters: those at ``inputs``, by position after
+    ``self`` for a method, or every parameter when ``inputs`` is None. A deployment
+    declaration an integration reads names a Lambda handler this way, whose event is
+    input and whose context is not."""
 
     symbol: SymbolId
     label: str
     kinds: TaintKind = TaintKind.ALL
+    inputs: tuple[int, ...] | None = None
 
 
 @dataclass(frozen=True)

coretrace_python/taint/templates.py

@@ -15,7 +15,8 @@ it extends or includes, can output data unescaped:
 
 Templates are found under the project's ``templates`` directories, by their path below
 one. A template the engine cannot find — named by an expression, under a ``DIRS`` entry
-of another name, shipped by an installed package — is never assumed to escape.
+of another name, shipped by an installed package — or cannot read is never assumed to
+escape.
 
 A template applying a filter of Django's own libraries calls the function behind it
 whenever it is rendered, though no Python call names that function: ``{{ bio|striptags }}``
@@ -149,7 +150,7 @@ def escaped_templates(root: Path) -> frozenset[str]:
     local: dict[str, bool] = {}
     requires: dict[str, set[str]] = {}
     for name, paths in found.items():
-        verdicts = [_inspect(_read(path)) for path in paths]
+        verdicts = [_verdict(path) for path in paths]
         local[name] = all(safe for safe, _ in verdicts)
         requires[name] = {needed for _, needs in verdicts for needed in needs}
     escaped = {name for name, safe in local.items() if safe}
@@ -171,6 +172,14 @@ def _read(path: Path) -> str:
     return _text(path) or ""
 
 
+def _verdict(path: Path) -> tuple[bool, set[str]]:
+    """Whether one template file escapes all it prints, and what it needs: a file the
+    engine cannot read is not established to escape, like a template it cannot find."""
+
+    text = _text(path)
+    return (False, set()) if text is None else _inspect(text)
+
+
 def _text(path: Path) -> str | None:
     """The text of ``path``, or None when it cannot be read."""
 

{coretrace_python_analyzer-0.17.0.dist-info → coretrace_python_analyzer-0.18.0.dist-info}/METADATA

@@ -1,6 +1,6 @@
 Metadata-Version: 2.5
 Name: coretrace-python-analyzer
-Version: 0.17.0
+Version: 0.18.0
 Summary: Static security analysis infrastructure for Python code
 Project-URL: Homepage, https://github.com/CoreTrace/coretrace-python-analyzer
 Project-URL: Repository, https://github.com/CoreTrace/coretrace-python-analyzer

{coretrace_python_analyzer-0.17.0.dist-info → coretrace_python_analyzer-0.18.0.dist-info}/RECORD

@@ -1,4 +1,4 @@
-coretrace_python/__init__.py,sha256=HRmDGjpSkbWNTv_zUrVcohlicTxeBUblXGvOBz0lia4,76
+coretrace_python/__init__.py,sha256=UXlC7yIk3dOxWBAjttYzugsg0Cacccz_IG6V-LsaqSU,76
 coretrace_python/__main__.py,sha256=V8DnYtRboISK2VCKm7DGHLREKvqLbqApyWlKBOs26wU,65
 coretrace_python/cache.py,sha256=-pZv-ELm4jMCTXQWSZIobHaT9UHIjFu7IlMkOM0i4LI,13607
 coretrace_python/cli.py,sha256=G5jhb6g6RgSRSjjS7DBgziIjUM1vTFwalJGvFHVKxrg,11225
@@ -144,14 +144,14 @@ coretrace_python/source/__init__.py,sha256=0Y8fvtbkETnNCJR9Zq7RS5TSgF9c22pz3SSk1
 coretrace_python/source/manager.py,sha256=JRmMOcWfS1nocbVrdcvfQTqEfIkmnb5JP857TpGywN4,2736
 coretrace_python/source/model.py,sha256=FZnN5mlir3tzbIpWoxnn6YtRi9UcJ_y0sZM60tKr8U4,1727
 coretrace_python/taint/__init__.py,sha256=nKpD33_4IRneAkd3Dt-j7Q-cHl47rDA_eLZFDHZVH28,1827
-coretrace_python/taint/engine.py,sha256=B3_o8feN0-a6PAfZCyERIxMiZnF50nTMi3rP5uesHOM,48923
-coretrace_python/taint/models.py,sha256=EMzAMY3woBjgDlGyFi9vsVmuE5r2OjnwEvHHoe9IuWE,20026
+coretrace_python/taint/engine.py,sha256=BHNdoyUryK9lDOZ-lq235GdTC9SDbeUHquoDH2DDCM8,49457
+coretrace_python/taint/models.py,sha256=pCvE-6dYKYSLK7pylxhLWpeUcMfMyXlh_1VUJbzieo8,20405
 coretrace_python/taint/routes.py,sha256=UAJKXcw_sM9shf58FfDroxVO9bNSm4qrQdZknwUB0lo,6110
-coretrace_python/taint/templates.py,sha256=cxa2PC-Md0pAPu0NxrIUJ5XMs26zck7O-dDH30TTB2I,31023
+coretrace_python/taint/templates.py,sha256=74y06rKs2F0cCOqRw_jbKwlZ8M4nUgsatOFX5ZWkRNQ,31344
 coretrace_python/taint/urls.py,sha256=kb0-uOT12ww7R3Jzs_lPKg9lFs74JI-bpa9pXX105xM,3166
-coretrace_python_analyzer-0.17.0.dist-info/METADATA,sha256=LCZjkte2jNcPz06rsm7jMwboXtkbiwbyrIQh9Ij4nR8,3217
-coretrace_python_analyzer-0.17.0.dist-info/WHEEL,sha256=W3fkpkm7-wf9vBI5Z-7s0eWkeM-spu78I8Neb98DeEg,87
-coretrace_python_analyzer-0.17.0.dist-info/entry_points.txt,sha256=wdozemiraOkbt65g_Y_zgspuZpoLxJdaCVMJt1Ft3c0,72
-coretrace_python_analyzer-0.17.0.dist-info/licenses/LICENSE,sha256=z8d0m5b2O9McPEK1xHG_dWgUBT6EfBDz6wA0F7xSPTA,11358
-coretrace_python_analyzer-0.17.0.dist-info/licenses/NOTICE,sha256=s3VHj5ngV0ozjW_kZJpg_35ne6JwoBK0ysOjbqVtA0w,113
-coretrace_python_analyzer-0.17.0.dist-info/RECORD,,
+coretrace_python_analyzer-0.18.0.dist-info/METADATA,sha256=UknDXxCfvCkshCAt4gMWAGWWGp_SzsiN9laP98Gq9qo,3217
+coretrace_python_analyzer-0.18.0.dist-info/WHEEL,sha256=W3fkpkm7-wf9vBI5Z-7s0eWkeM-spu78I8Neb98DeEg,87
+coretrace_python_analyzer-0.18.0.dist-info/entry_points.txt,sha256=wdozemiraOkbt65g_Y_zgspuZpoLxJdaCVMJt1Ft3c0,72
+coretrace_python_analyzer-0.18.0.dist-info/licenses/LICENSE,sha256=z8d0m5b2O9McPEK1xHG_dWgUBT6EfBDz6wA0F7xSPTA,11358
+coretrace_python_analyzer-0.18.0.dist-info/licenses/NOTICE,sha256=s3VHj5ngV0ozjW_kZJpg_35ne6JwoBK0ysOjbqVtA0w,113
+coretrace_python_analyzer-0.18.0.dist-info/RECORD,,