coretrace-python-analyzer 0.18.0__py3-none-any.whl → 0.19.0__py3-none-any.whl

coretrace_python/__init__.py

@@ -1,4 +1,4 @@
 """CoreTrace's Python static analysis frontend."""
 
-__version__ = "0.18.0"
+__version__ = "0.19.0"
 

coretrace_python/cache.py

@@ -42,7 +42,7 @@ from coretrace_python.interprocedural import (
 from coretrace_python.semantic.symbols import SymbolId
 from coretrace_python.source import SourceId, SourceSpan
 
-CACHE_FORMAT = 10
+CACHE_FORMAT = 11
 
 
 @dataclass(frozen=True)
@@ -134,7 +134,7 @@ class ProjectCache:
 def encode(module: CachedModule) -> dict[str, Any]:
     return {
         "format": CACHE_FORMAT,
-        "functions": [[f.name, _encode_span(f.span), f.entry_point] for f in module.functions],
+        "functions": [[f.name, _encode_span(f.span), f.entry_point, list(f.aliases)] for f in module.functions],
         "summaries": {name: _encode_summary(s) for name, s in module.summaries.items()},
         "sites": [_encode_site(site) for site in module.sites],
         "findings": [_encode_finding(finding) for finding in module.findings],
@@ -196,8 +196,13 @@ def _decode_span(data: Any) -> SourceSpan:
 
 
 def _decode_function(data: Any) -> ModuleFunction:
-    name, span, entry_point = data
-    return ModuleFunction(_string(name), _decode_span(span), None if entry_point is None else _string(entry_point))
+    name, span, entry_point, aliases = data
+    return ModuleFunction(
+        _string(name),
+        _decode_span(span),
+        None if entry_point is None else _string(entry_point),
+        tuple(_string(alias) for alias in aliases),
+    )
 
 
 def _decode_read(data: Any) -> SymbolRead:

coretrace_python/engine.py

@@ -9,6 +9,7 @@ from __future__ import annotations
 import concurrent.futures
 import hashlib
 import multiprocessing
+from collections import Counter
 from collections.abc import Callable, Iterable, Mapping, Sequence
 from dataclasses import dataclass, field, replace
 from pathlib import Path
@@ -88,6 +89,7 @@ from coretrace_python.interprocedural import (
     TemplateCallsAnalysis,
     build_module_graph,
     discover_sources,
+    name_modules,
     project_symbol,
 )
 from coretrace_python.ir import PYIR_SCHEMA_VERSION
@@ -371,7 +373,11 @@ def analyze_project(
     strongly connected components of the module graph, imports first; with ``jobs``
     above one the components of a wave are analysed in that many processes (§29).
     ``advisory_files`` add to the ``advisories.json`` at ``root``; ``policy_file``
-    replaces the ``coretrace-policy.toml`` there."""
+    replaces the ``coretrace-policy.toml`` there.
+
+    Every module is known by the name ``name_modules`` gives its file: its import name,
+    or its path from the root when another file has that import name. Such files carry
+    an ``ambiguous-module`` note and are covered as ``ambiguous``."""
 
     if jobs < 1:
         raise ValueError("jobs must be at least 1")
@@ -398,18 +404,18 @@ def analyze_project(
     files: dict[str, SourceFile] = {}
     unreadable: list[tuple[Path, str]] = []
     coverage: list[FileCoverage] = []
-    discovered = discover_sources(root, sources, unreadable)
+    named = name_modules(root, discover_sources(root, sources, unreadable))
     for path, reason in unreadable:
         findings.append(_note("syntax-error", f"{path}: {reason}", sources.add_source(str(path), ""), 1))
         coverage.append(FileCoverage(str(path), "unreadable", 0, 0))
-    for source in discovered:
+    for name, source in named.items():
         try:
-            modules[source.module_name] = build_hir(source)
+            modules[name] = build_hir(source)
         except (ParseError, HIRBuildError) as error:
             findings.append(_note("syntax-error", str(error), source, 1))
             coverage.append(FileCoverage(str(source.source_id), "syntax-error", 0, 0))
             continue
-        files[source.module_name] = source
+        files[name] = source
 
     managers = {name: _register_all(module) for name, module in modules.items()}
     probe = next(iter(managers.values()), None) or _register_all(build_hir(sources.add_source("<empty>", "")))
@@ -439,6 +445,8 @@ def analyze_project(
     graph = build_module_graph(
         {name: files[name] for name in analysable}, {name: modules[name] for name in analysable}, imports
     )
+    shared = _shared_names(graph)
+    findings.extend(_ambiguity_notes(graph, shared, root))
     routes: dict[SymbolId, EntryPoint] = {}
     for name in sorted(analysable):
         for symbol, registered in _routes_of(analysable[name]).items():
@@ -447,7 +455,8 @@ def analyze_project(
     templates = project_templates(root)
     clearing = models.clearing(escaped)
     template_calls = models.template_calls(
-        templates.filters, request_processor(modules[name] for name in sorted(analysable))
+        templates.filters,
+        request_processor((modules[name], analysable[name].get(ScopeAnalysis)) for name in sorted(analysable)),
     )
     for manager in analysable.values():
         manager.provide(RegisteredRoutes, routes)
@@ -514,15 +523,16 @@ def analyze_project(
         if pool is not None:
             pool.shutdown()
 
-    index = _seed(results, graph, frozenset())
+    index = _index(results, {name: name for name in results})
     call_graphs: dict[str, CallGraph] = {}
     functions: dict[str, tuple[ModuleFunction, ...]] = {}
     for name in sorted(analysable):
         entry = results[name]
         findings.extend(entry.findings)
         unsupported = sum(1 for f in entry.findings if f.rule_id == "unsupported-syntax")
+        status = "ambiguous" if files[name].module_name in shared else "analysed"
         coverage.append(
-            FileCoverage(str(files[name].source_id), "analysed", len(entry.functions), len(entry.functions) - unsupported)
+            FileCoverage(str(files[name].source_id), status, len(entry.functions), len(entry.functions) - unsupported)
         )
         functions[name] = entry.functions
         sites: dict[str, list[CallSite]] = {function.name: [] for function in entry.functions}
@@ -644,24 +654,76 @@ def _advisory_paths(root: Path, advisory_files: Sequence[Path]) -> tuple[Path, .
     return (*([default] if default.is_file() else []), *advisory_files)
 
 
+def _shared_names(graph: ModuleGraph) -> dict[str, list[str]]:
+    """The import names several analysable files have, each with those files' modules."""
+
+    by_name: dict[str, list[str]] = {}
+    for name in graph.modules:
+        by_name.setdefault(graph.source(name).module_name, []).append(name)
+    return {import_name: names for import_name, names in by_name.items() if len(names) > 1}
+
+
+def _ambiguity_notes(graph: ModuleGraph, shared: Mapping[str, list[str]], root: Path) -> list[Finding]:
+    """One note on each file whose import name another file shares, since a symbol of
+    that name may denote a function of either, and one on each importer whose import of
+    such a name no root resolved, since calls through it are not followed."""
+
+    def located(name: str) -> str:
+        return _located(_path_of(graph.source(name)), root)
+
+    notes: list[Finding] = []
+    for import_name, names in sorted(shared.items()):
+        for name in names:
+            others = ", ".join(located(other) for other in names if other != name)
+            message = (
+                f"{located(name)} is the module '{import_name}' like {others}: a symbol "
+                f"python.{import_name}.* may name a function of either, and an import of "
+                f"'{import_name}' resolves only from its own root"
+            )
+            notes.append(_note("ambiguous-module", message, graph.source(name), 1))
+    for name in graph.modules:
+        for import_name in sorted(graph.unresolved(name)):
+            candidates = " or ".join(located(other) for other in shared[import_name])
+            message = f"'{import_name}' imported here is {candidates}: calls into it are not followed"
+            notes.append(_note("ambiguous-module", message, graph.source(name), 1))
+    return notes
+
+
 def _seed(results: Mapping[str, CachedModule], graph: ModuleGraph, component: frozenset[str]) -> SummaryIndex:
     """The summaries a component starts from: those of every module it imports,
-    transitively, all final by the time its wave runs; the whole index for no component."""
-
-    if component:
-        wanted: set[str] = set()
-        pending = list(component)
-        while pending:
-            for imported in graph.imports(pending.pop()):
-                if imported in results and imported not in wanted:
-                    wanted.add(imported)
-                    pending.append(imported)
-    else:
-        wanted = set(results)
+    transitively, all final by the time its wave runs, each under the import name the
+    component's code refers to it by. Of several files with one import name, only the
+    one a member imports directly, resolved in its own root, goes under that name: the
+    others are reached through summaries that inline them already, and a name no
+    member's root resolved is followed into neither file."""
+
+    wanted: set[str] = set()
+    pending = list(component)
+    while pending:
+        for imported in graph.imports(pending.pop()):
+            if imported in results and imported not in wanted:
+                wanted.add(imported)
+                pending.append(imported)
+    direct = {imported for member in component for imported in graph.imports(member)}
+    by_import: dict[str, list[str]] = {}
+    for name in wanted:
+        by_import.setdefault(graph.source(name).module_name, []).append(name)
+    names: dict[str, str] = {}
+    for import_name, modules in by_import.items():
+        chosen = modules if len(modules) == 1 else [name for name in modules if name in direct]
+        if len(chosen) == 1:
+            names[chosen[0]] = import_name
+    return _index(results, names)
+
+
+def _index(results: Mapping[str, CachedModule], names: Mapping[str, str]) -> SummaryIndex:
+    """The summaries of the modules in ``names``, each function under the project symbol
+    of the module name given for its module."""
+
     return SummaryIndex(
         {
-            project_symbol(name, function): summary
-            for name in sorted(wanted)
+            project_symbol(module, function): summary
+            for name, module in sorted(names.items())
             for function, summary in results[name].summaries.items()
         }
     )
@@ -674,8 +736,12 @@ def _analyse_managers(
     affected: Affected,
 ) -> dict[str, CachedModule]:
     """Analyse one component: iterate its summaries to a fixpoint over ``seed`` (§21),
-    then extract what the rest of the run needs from each module."""
+    then extract what the rest of the run needs from each module. Each member registers
+    its functions under its import name, what the others' code refers to it by; a name
+    two members share, a cycle across roots, is registered by neither."""
 
+    counts = Counter(manager.module.name for manager in managers.values())
+    names = {name: manager.module.name for name, manager in managers.items() if counts[manager.module.name] == 1}
     index = seed
     for manager in managers.values():
         manager.provide(ProjectSummaries, index)
@@ -684,9 +750,9 @@ def _analyse_managers(
             {
                 **seed.summaries,
                 **{
-                    project_symbol(name, function): summary
-                    for name, manager in managers.items()
-                    for function, summary in _summaries_of(manager).items()
+                    project_symbol(module, function): summary
+                    for name, module in names.items()
+                    for function, summary in _summaries_of(managers[name]).items()
                 },
             }
         )
@@ -701,8 +767,9 @@ def _analyse_managers(
 
 @dataclass(frozen=True)
 class _Batch:
-    """One component handed to a worker process: it rebuilds the configuration from the
-    project root and the plugin roots, so only paths and the imported summaries travel."""
+    """One component handed to a worker process, its files under the engine's module
+    names: it rebuilds the configuration from the project root and the plugin roots, so
+    only paths and the imported summaries travel."""
 
     root: Path
     plugin_roots: tuple[Path, ...]

coretrace_python/findings/coverage.py

@@ -1,10 +1,12 @@
 """Analysis coverage: which files and functions a run actually looked at.
 
 "No findings" only means something when the reader knows what was analysed. Each file
-is ``analysed``, a ``syntax-error`` (the frontend rejected it) or ``unreadable`` (it could
-not be decoded); analysed files count their functions and how many lowered. The
-templates the project names but the run could not read are listed, each where the
-project names it: they may call any template filter.
+is ``analysed``, ``ambiguous`` (analysed, but another file has its Python module name,
+so a symbol of that name may denote a function of either and an import of it resolves
+only from its own root), a ``syntax-error`` (the frontend rejected it) or ``unreadable``
+(it could not be decoded); analysed and ambiguous files count their functions and how
+many lowered. The templates the project names but the run could not read are listed,
+each where the project names it: they may call any template filter.
 """
 
 from __future__ import annotations

coretrace_python/interprocedural/__init__.py

@@ -19,6 +19,7 @@ from coretrace_python.interprocedural.modulegraph import (
     build_module_graph,
     discover_files,
     discover_sources,
+    name_modules,
     project_symbol,
 )
 from coretrace_python.interprocedural.summaries import (
@@ -73,5 +74,6 @@ __all__ = [
     "cleared_by",
     "discover_files",
     "discover_sources",
+    "name_modules",
     "project_symbol",
 ]

coretrace_python/interprocedural/callgraph.py

@@ -132,12 +132,16 @@ class SignaturesAnalysis(Analysis[tuple[Signature, ...]]):
 @dataclass(frozen=True)
 class ModuleFunction:
     """One function of a module as a project plugin sees it: the name the call graph
-    gives it (``Class.method``, ``outer.inner``, ``<module>``), where it is, and the label
-    of the entry point it is (``http`` for a route, ``argv`` for a command), if any."""
+    gives it (``Class.method``, ``outer.inner``, ``<module>``), where it is, the label
+    of the entry point it is (``http`` for a route, ``argv`` for a command), if any, and
+    the module-level ``aliases`` bound to it by assigning one name to another
+    (``main = actual``), transitively and in source order; a method or a nested
+    function has none."""
 
     name: str
     span: SourceSpan
     entry_point: str | None = None
+    aliases: tuple[str, ...] = ()
 
 
 class CallGraph:

coretrace_python/interprocedural/modulegraph.py

@@ -6,12 +6,18 @@ each module imports. Functions defined in the project get project symbols
 (``python.app.helpers.run``) whose summaries live in a ``SummaryIndex`` that the engine
 provides to every module's manager, so calls into other files are analysed through
 summaries rather than by retaining every module's PyIR.
+
+The identity of a module is its file. Two files may have the same import name
+(``a/app.py`` and ``z/app.py`` outside any package are both ``app``, each from its own
+directory): the engine then names them by their path from the root, ``a.app`` and
+``z.app``, and an import of ``app`` resolves within the importer's own root only.
 """
 
 from __future__ import annotations
 
+from collections import Counter
 from collections.abc import Iterable, Mapping
-from dataclasses import dataclass
+from dataclasses import dataclass, field
 from pathlib import Path
 from types import MappingProxyType
 
@@ -67,6 +73,66 @@ def _is_environment(directory: Path, known: dict[Path, bool]) -> bool:
     return known[directory]
 
 
+def name_modules(root: Path, sources: Iterable[SourceFile]) -> dict[str, SourceFile]:
+    """One name per file, in the order given: its import name when no other file has it;
+    otherwise its path from ``root`` as a dotted name (``a/app.py`` and ``z/app.py`` are
+    ``a.app`` and ``z.app``, a root-level ``manage.py`` stays ``manage``), or that path
+    itself when even the dotted names coincide (``x.y/app.py`` and ``x/y/app.py``).
+    Decided over the whole set, so the names do not depend on the order the files are
+    found in."""
+
+    found = tuple(sources)
+    counts = Counter(source.module_name for source in found)
+    shared = [source for source in found if counts[source.module_name] > 1]
+    paths = {source.source_id: _relative(root, source) for source in shared}
+    dotted = {source_id: _dotted(path) for source_id, path in paths.items()}
+    taken = (
+        {name for name, count in counts.items() if count == 1}
+        | {name for name, count in Counter(dotted.values()).items() if count > 1}
+        | {path.as_posix() for path in paths.values()}
+    )
+    named: dict[str, SourceFile] = {}
+    for source in found:
+        if counts[source.module_name] == 1:
+            named[source.module_name] = source
+        elif dotted[source.source_id] not in taken:
+            named[dotted[source.source_id]] = source
+        else:
+            named[paths[source.source_id].as_posix()] = source
+    return named
+
+
+def _relative(root: Path, source: SourceFile) -> Path:
+    path = source.path if source.path is not None else Path(str(source.source_id))
+    try:
+        return path.relative_to(root.resolve())
+    except ValueError:
+        return path
+
+
+def _dotted(path: Path) -> str:
+    """``a/app.py`` as ``a.app`` and ``pkg/__init__.py`` as ``pkg``; a root-level
+    ``__init__.py`` has no dotted name and keeps its path."""
+
+    parts = path.with_suffix("").parts
+    if parts and parts[-1] == "__init__":
+        parts = parts[:-1]
+    return ".".join(parts) or path.as_posix()
+
+
+def _import_root(source: SourceFile) -> Path | None:
+    """The directory an import of ``source`` by its module name starts from: the parent
+    of its top-level package, or its own directory for a module outside any package,
+    where ``module_name_for`` stopped. ``None`` for a source not on disk."""
+
+    if source.path is None:
+        return None
+    directory = source.path.parent
+    while (directory / "__init__.py").is_file():
+        directory = directory.parent
+    return directory
+
+
 def project_symbol(module_name: str, qualified_name: str) -> SymbolId:
     """The canonical symbol of a project function. A module whose name is not an
     identifier cannot be imported by that name, but its functions still need stable
@@ -90,6 +156,7 @@ def _component(part: str) -> str:
 class ModuleGraph:
     _sources: Mapping[str, SourceFile]
     _imports: Mapping[str, frozenset[str]]
+    _unresolved: Mapping[str, frozenset[str]] = field(default_factory=dict)
 
     @property
     def modules(self) -> tuple[str, ...]:
@@ -104,6 +171,12 @@ class ModuleGraph:
     def importers(self, name: str) -> frozenset[str]:
         return frozenset(m for m, imported in self._imports.items() if name in imported)
 
+    def unresolved(self, name: str) -> frozenset[str]:
+        """The import names ``name`` imports that several project files have and not
+        exactly one in its own root: no edge records them."""
+
+        return self._unresolved.get(name, frozenset())
+
     def schedule(self) -> tuple[tuple[frozenset[str], ...], ...]:
         """Strongly connected components in waves: every component of a wave imports,
         outside itself, only components of earlier waves, so one wave can be analysed
@@ -167,10 +240,17 @@ def build_module_graph(
     modules: Mapping[str, nodes.Module],
     imports: Mapping[str, ImportTable],
 ) -> ModuleGraph:
-    """Edges from each module to the project modules it imports, in any scope."""
-
-    names = frozenset(sources)
+    """Edges from each module to the project modules it imports, in any scope. An import
+    names a module by its import name; when several files have that name, it resolves to
+    the one in the importer's own root and, without exactly one there, stays unresolved:
+    no edge, and the name is recorded on the graph."""
+
+    by_name: dict[str, list[str]] = {}
+    for name, source in sources.items():
+        by_name.setdefault(source.module_name, []).append(name)
+    roots = {name: _import_root(source) for name, source in sources.items()}
     edges: dict[str, frozenset[str]] = {}
+    unresolved: dict[str, frozenset[str]] = {}
     for name, module in modules.items():
         candidates: set[str] = set()
         dotted_tops: set[str] = set()
@@ -187,11 +267,24 @@ def build_module_graph(
                 candidates.add(path)
         # The most specific project module each import names; ``app.helpers`` implies
         # the ``app`` package, which is not an edge worth recording.
-        found = {
-            next((m for m in _prefixes(candidate) if m in names), None) for candidate in candidates
-        }
-        edges[name] = frozenset(m for m in found if m is not None and m != name)
-    return ModuleGraph(MappingProxyType(dict(sources)), MappingProxyType(edges))
+        found: set[str] = set()
+        missing: set[str] = set()
+        for candidate in candidates:
+            for prefix in _prefixes(candidate):
+                matching = by_name.get(prefix)
+                if matching is None:
+                    continue
+                if len(matching) > 1:
+                    matching = [m for m in matching if roots[m] == roots[name]]
+                if len(matching) == 1:
+                    found.add(matching[0])
+                else:
+                    missing.add(prefix)
+                break
+        edges[name] = frozenset(found - {name})
+        if missing:
+            unresolved[name] = frozenset(missing)
+    return ModuleGraph(MappingProxyType(dict(sources)), MappingProxyType(edges), MappingProxyType(unresolved))
 
 
 def _prefixes(dotted: str) -> list[str]:
@@ -217,5 +310,6 @@ __all__ = [
     "SummaryIndex",
     "build_module_graph",
     "discover_sources",
+    "name_modules",
     "project_symbol",
 ]

coretrace_python/semantic/scopes.py

@@ -113,8 +113,8 @@ class ScopeTable:
     def children(self, scope_id: ScopeId) -> tuple[Scope, ...]:
         return self._children[scope_id]
 
-    def scope_for(self, node: nodes.Function | nodes.Class | nodes.Comprehension) -> Scope:
-        """Return the scope introduced by a definition or comprehension node."""
+    def scope_for(self, node: nodes.Function | nodes.Class | nodes.Lambda | nodes.Comprehension) -> Scope:
+        """Return the scope introduced by a definition, lambda or comprehension node."""
 
         return self._scopes[self._spans[node.span]]
 

coretrace_python/taint/engine.py

@@ -836,7 +836,9 @@ def function_entry_point(
 ) -> EntryPoint | None:
     """The entry point ``function`` is: one of its decorators or, for a method, one of its
     class's bases matching an entry-point model, a registration elsewhere (``routes``), or
-    a model naming the function, or its class, by its own project symbol."""
+    a model naming the function, or its class, by its own project symbol or by a
+    module-level alias of it (``main = actual`` names ``actual`` as ``main``). A model
+    naming the method wins over one naming its class, whichever name it uses."""
 
     owner = _owner(module, function)
     enclosing_function = _enclosing(module, function)
@@ -844,12 +846,16 @@ def function_entry_point(
         # ``app = Flask(__name__)`` inside ``create_app``: routes defined there resolve.
         instances = {**(instances or {}), **local_instances(enclosing_function, scopes, symbols)}
     entry = entry_point_of(function, models, scopes, symbols, owner, instances, project)
-    if entry is None:
-        qualified = function.name if owner is None else f"{owner.name}.{function.name}"
-        entry = _declared(project_symbol(module.name, qualified), models, routes)
-        if entry is None and owner is not None:
-            entry = _declared(project_symbol(module.name, owner.name), models, routes)
-    return entry
+    if entry is not None:
+        return entry
+    defined = function if owner is None else owner
+    names = (defined.name, *_aliases(module, defined.name))
+    qualified = names if owner is None else (*(f"{name}.{function.name}" for name in names), *names)
+    for name in qualified:
+        entry = _declared(project_symbol(module.name, name), models, routes)
+        if entry is not None:
+            return entry
+    return None
 
 
 def _declared(symbol: SymbolId, models: ModelTable, routes: Routes | None) -> EntryPoint | None:
@@ -860,6 +866,43 @@ def _declared(symbol: SymbolId, models: ModelTable, routes: Routes | None) -> En
     return registered if registered is not None else models.entry_point(symbol)
 
 
+def _aliases(module: nodes.Module, name: str) -> Iterable[str]:
+    """The module-level names bound to ``name`` by assigning one name to another,
+    transitively and in source order: ``handler = actual`` then ``main = handler`` make
+    both aliases of ``actual``. A name bound inside a function or class, or to anything
+    but a name (a call, an import), is no alias."""
+
+    aliases: dict[str, list[str]] = {}
+    for statement in _module_level(module.body):
+        if isinstance(statement, nodes.Assign) and isinstance(statement.target, nodes.Name) and isinstance(statement.value, nodes.Name):
+            aliases.setdefault(statement.value.identifier, []).append(statement.target.identifier)
+    found = {name}
+    pending = [name]
+    while pending:
+        for alias in aliases.get(pending.pop(0), ()):
+            if alias not in found:
+                found.add(alias)
+                pending.append(alias)
+                yield alias
+
+
+def _module_level(body: Iterable[nodes.Statement]) -> Iterable[nodes.Statement]:
+    """The statements executed at module level: the body and what its compound
+    statements hold, not what a function or class defines."""
+
+    for statement in body:
+        if isinstance(statement, nodes.Function | nodes.Class):
+            continue
+        yield statement
+        for attribute in ("body", "orelse", "finalbody"):
+            nested = getattr(statement, attribute, None)
+            if isinstance(nested, tuple):
+                yield from _module_level(nested)
+        if isinstance(statement, nodes.Try):
+            for handler in statement.handlers:
+                yield from _module_level(handler.body)
+
+
 def _owner(module: nodes.Module, function: nodes.Function) -> nodes.Class | None:
     """The top-level class ``function`` is a method of, if any."""
 
@@ -1109,7 +1152,9 @@ class EntryPointAnalysis(Analysis[tuple[ModuleFunction, ...]]):
         functions: list[ModuleFunction] = []
         for name, function in graph.definitions.items():
             entry = function_entry_point(function, ctx.module, models, scopes, symbols, instances, routes, project)
-            functions.append(ModuleFunction(name, function.span, entry.label if entry is not None else None))
+            label = entry.label if entry is not None else None
+            # A dotted name, a method's or a nested function's, is bound by no assignment.
+            functions.append(ModuleFunction(name, function.span, label, tuple(_aliases(ctx.module, name))))
         return tuple(functions)
 
 

coretrace_python/taint/templates.py

@@ -24,18 +24,30 @@ calls ``django.template.defaultfilters.striptags``. Every template found counts,
 or not a Python call names it, since a class-based view renders its ``template_name``
 inside Django. A template the engine cannot read may call any filter; the engine says
 where the project names one.
+
+A project tag library, a module of a ``templatetags`` directory, replaces a filter of
+that name in every template loading it before applying the filter, as Django's parser
+does: ``{% load custom %}{{ bio|striptags }}`` calls the project's ``striptags`` when
+``custom.py`` registers one, a later load overrides an earlier one, and
+``{% load striptags from custom %}`` selects. The engine reads what a library registers
+on its ``register`` with the semantic layers, and where it cannot tell — no such library,
+a file it cannot read or understand, several apps giving the name and disagreeing — the
+filter is neither the built-in nor certainly replaced: no call is claimed, and the load
+is listed among what the engine could not read. ``OPTIONS["builtins"]`` and
+``OPTIONS["libraries"]`` of the settings are not read.
 """
 
 from __future__ import annotations
 
 import re
-from collections.abc import Iterable, Iterator, Mapping
+from collections.abc import Container, Iterable, Iterator, Mapping
 from dataclasses import dataclass, field
 from pathlib import Path
 from types import MappingProxyType
 from typing import ClassVar
 
 from coretrace_python.analysis import Analysis, AnalysisContext
+from coretrace_python.frontend import HIRBuildError, ParseError, build_hir
 from coretrace_python.hir import nodes
 from coretrace_python.hir.visitors import Node, children
 from coretrace_python.interprocedural import (
@@ -44,11 +56,21 @@ from coretrace_python.interprocedural import (
     TemplateFilter,
     discover_files,
 )
-from coretrace_python.semantic.symbols import SymbolId
-from coretrace_python.source import SourceId, SourceSpan
+from coretrace_python.semantic.imports import ImportResolutionError, analyze_imports
+from coretrace_python.semantic.scopes import (
+    BindingKind,
+    ResolutionKind,
+    ScopeError,
+    ScopeId,
+    ScopeTable,
+    analyze_scopes,
+)
+from coretrace_python.semantic.symbols import SymbolId, analyze_symbols
+from coretrace_python.source import SourceId, SourceManager, SourceSpan
 from coretrace_python.taint.models import ModelTable
 
 TEMPLATES_DIRECTORY = "templates"
+TEMPLATETAGS_DIRECTORY = "templatetags"
 
 _OUTPUT, _TAG, _URL = "\x00", "\x01", "/u"
 _SYNTAX = re.compile(r"{{(.*?)}}|{%(.*?)%}|{#.*?#}", re.DOTALL)
@@ -102,6 +124,10 @@ FILTER_FUNCTIONS: Mapping[str, SymbolId] = MappingProxyType(
 # Every filter but ``safe`` and ``safeseq`` escapes its input, or returns it for
 # autoescaping to escape, when autoescaping is on.
 _FILTERS = frozenset(FILTER_FUNCTIONS) - {"safe", "safeseq"}
+# The class a project tag library binds ``register`` to, by either of its paths, and
+# its methods registering tags, which register no filter.
+_LIBRARY_CLASSES = frozenset(SymbolId(f"python.django.template.{p}") for p in ("Library", "library.Library"))
+_TAG_REGISTRARS = frozenset({"tag", "tag_function", "simple_tag", "simple_block_tag", "inclusion_tag"})
 
 _URL_ATTRIBUTES = frozenset(
     {
@@ -131,6 +157,8 @@ _BINDING = re.compile(r"(\w+)=")
 # the request context processor adds gives (``request.GET``).
 _VARIABLE = re.compile(r"([A-Za-z_]\w*)(?:\.(\w+))?")
 _LITERALS = frozenset({"True", "False", "None"})
+# The variable a block renders to keep the parent's content, as ``_chain`` reads it.
+_BLOCK_SUPER = "block.super"
 
 REQUEST_PROCESSOR = "django.template.context_processors.request"
 _DJANGO_ENGINE = "django.template.backends.django.DjangoTemplates"
@@ -314,10 +342,11 @@ class FilterCall:
 @dataclass(frozen=True)
 class ProjectTemplates:
     """The templates found under the project's ``templates`` directories: their
-    ``names``, as a render call names them; the filters they apply, as ``calls``; where
-    they name a template the engine cannot read, as ``unread``; and, by name, the filter
-    calls rendering each template makes with the context keys reaching them, as
-    ``filters``."""
+    ``names``, as a render call names them; the filters of Django's own libraries they
+    apply, as ``calls``, unless a project library they load replaces the filter; where
+    they name a template the engine cannot read, or load a library it cannot read while
+    applying a filter of that name, as ``unread``; and, by name, the filter calls
+    rendering each template makes with the context keys reaching them, as ``filters``."""
 
     names: frozenset[str] = frozenset()
     calls: tuple[FilterCall, ...] = ()
@@ -363,13 +392,44 @@ class _Reference:
         return frozenset(found)
 
 
+@dataclass(frozen=True)
+class _Load:
+    """A ``{% load %}`` of ``library`` at ``offset``, of the ``names`` it selects
+    (``{% load a b from lib %}``), None for the whole library."""
+
+    library: str
+    names: frozenset[str] | None
+    offset: int
+
+
+@dataclass(frozen=True)
+class _Library:
+    """What the project's tag library files of one name register: the filter names they
+    surely register, ``certain``, and those they may register, ``uncertain`` — None when
+    they may register anything, as a file the engine cannot read or understand may."""
+
+    certain: frozenset[str] = frozenset()
+    uncertain: frozenset[str] | None = None
+
+    def overrides(self, name: str) -> bool | None:
+        """Whether loading the library replaces the filter ``name``; None when it may."""
+
+        if name in self.certain:
+            return True
+        return None if self.uncertain is None or name in self.uncertain else False
+
+
 @dataclass(frozen=True)
 class _Template:
-    """What one template file applies and references, and the ``blocks`` it defines."""
+    """What one template file applies and references, the ``blocks`` it defines, and
+    among them the ``extended`` ones, which render ``{{ block.super }}``, and the loads
+    under which it applies a filter the engine could not resolve."""
 
     applications: tuple[_Application, ...]
     references: tuple[_Reference, ...]
     blocks: frozenset[str]
+    extended: frozenset[str] = frozenset()
+    unresolved: tuple[_Load, ...] = ()
 
     def rendered(self, blocks: tuple[str, ...], overridden: frozenset[str]) -> bool:
         """Whether what stands in ``blocks`` renders when a template extending this one
@@ -379,15 +439,25 @@ class _Template:
         extends = any(reference.extends for reference in self.references)
         return not overridden.intersection(blocks) and (bool(blocks) or not extends)
 
+    @property
+    def replaced(self) -> frozenset[str]:
+        """The blocks this template replaces in what it extends: those it defines
+        without rendering ``{{ block.super }}``, which keeps the parent's content."""
+
+        return self.blocks - self.extended
+
 
 def project_templates(root: Path) -> ProjectTemplates:
     """What the templates under ``root`` call, and the templates they include or extend
     that the engine cannot read: named by an expression, or by a name found under no
-    ``templates`` directory. A template file that cannot be read is unread too. A name
+    ``templates`` directory. A template file that cannot be read is unread too, and so
+    is a template loading a library the engine cannot read, or find, or finds in several
+    apps disagreeing, where it then applies a filter of that library's name. A name
     found in several files gives no ``filters``: which one renders depends on the
     loaders."""
 
     found = {path: tuple(_names(path.relative_to(root).parts)) for path in discover_files(root)}
+    libraries = _libraries(found)
     templates = sorted(path for path, names in found.items() if names)
     files: dict[str, list[Path]] = {}
     for path in templates:
@@ -401,13 +471,17 @@ def project_templates(root: Path) -> ProjectTemplates:
         if text is None:
             unread.append(f"{relative}, unreadable")
             continue
-        read[path] = _read_scopes(text, SourceId(str(path)))
+        read[path] = _read_scopes(text, SourceId(str(path)), libraries)
         for reference in read[path].references:
             where = f"{relative}:{_position(text, reference.offset)[0]}"
             if reference.name is None:
                 unread.append(f"{where} names a template by an expression")
             elif reference.name not in files:
                 unread.append(f"{where} names {reference.name!r}, not found")
+        for load in read[path].unresolved:
+            library = libraries.get(load.library)
+            reason = "not found" if library is None else "not read" if library.uncertain is None else "found in several files"
+            unread.append(f"{relative}:{_position(text, load.offset)[0]} loads {load.library!r}, {reason}")
     calls = tuple(FilterCall(a.symbol, a.span) for template in read.values() for a in template.applications)
     filters = {
         name: tuple(
@@ -444,7 +518,7 @@ def _reaching(
         if reference.name is None:
             continue
         if reference.extends:
-            found = _reaching(reference.name, files, read, visiting | {name}, overridden | template.blocks)
+            found = _reaching(reference.name, files, read, visiting | {name}, overridden | template.replaced)
         elif template.rendered(reference.blocks, overridden):
             found = _reaching(reference.name, files, read, visiting | {name})
         else:
@@ -453,18 +527,23 @@ def _reaching(
             yield symbol, span, where, reference.maps(value), reference.maps(argument)
 
 
-def _read_scopes(text: str, source: SourceId) -> _Template:
+def _read_scopes(text: str, source: SourceId, libraries: Mapping[str, _Library]) -> _Template:
     """The filters a template applies and the templates it includes or extends, with the
     names free in it that reach each: through ``{% for %}``, ``{% with %}`` and the
     ``as`` of other tags, which bind a name until their block ends, the arguments of
-    earlier filters, and the output of ``{% filter %}`` blocks."""
+    earlier filters, and the output of ``{% filter %}`` blocks. A filter is the one of
+    Django's own libraries unless a project library, among ``libraries``, loaded before
+    it in the file replaces it, as Django's parser resolves filters."""
 
     applications: list[_Application] = []
     references: list[_Reference] = []
     opened: list[str] = []
     defined: set[str] = set()
+    extended: set[str] = set()
     scopes: list[dict[str, frozenset[str]]] = [{}]
     blocks: list[tuple[list[tuple[str, int, frozenset[str]]], set[str]]] = []
+    loaded: list[_Load] = []
+    unresolved: dict[_Load, None] = {}
 
     def free(names: frozenset[str]) -> frozenset[str]:
         found: set[str] = set()
@@ -474,14 +553,36 @@ def _read_scopes(text: str, source: SourceId) -> _Template:
             found |= {name} if bound is None else _through(bound, name)
         return frozenset(found)
 
+    def behind(name: str) -> SymbolId | _Load | None:
+        """The function behind the filter ``name`` applied here: the one of Django's own
+        libraries, unless the latest load so far of a library registering ``name``
+        replaces it (None), or may (that load). Django's own libraries register no name
+        of another, so their loads change nothing."""
+
+        builtin = FILTER_FUNCTIONS.get(name)
+        if builtin is None:
+            return None
+        for load in reversed(loaded):
+            if (load.names is not None and name not in load.names) or load.library in _LIBRARIES:
+                continue
+            library = libraries.get(load.library)
+            verdict = library.overrides(name) if library is not None else None
+            if verdict is None:
+                return load
+            if verdict:
+                return None
+        return builtin
+
     def apply(head: frozenset[str], chain: list[tuple[str, int, frozenset[str]]]) -> frozenset[str]:
         """Record the filters of ``chain`` applied to a value the free names ``head``
         reach; the free names reaching the value of the whole expression."""
 
         value = head
         for name, offset, argument in chain:
-            symbol = FILTER_FUNCTIONS.get(name)
-            if symbol is not None:
+            symbol = behind(name)
+            if isinstance(symbol, _Load):
+                unresolved[symbol] = None
+            elif symbol is not None:
                 line, column = _position(text, offset)
                 span = SourceSpan(source, line, column)
                 applications.append(_Application(symbol, span, value, free(argument), tuple(opened)))
@@ -491,6 +592,8 @@ def _read_scopes(text: str, source: SourceId) -> _Template:
     for offset, expression, tag in _expressions(text):
         if not tag:
             head, chain = _chain(expression, offset)
+            if opened and _BLOCK_SUPER in head:
+                extended.add(opened[-1])
             printed = apply(free(head), chain)
             for _, collected in blocks:
                 collected |= printed
@@ -543,10 +646,145 @@ def _read_scopes(text: str, source: SourceId) -> _Template:
             else:
                 context = {k: v for scope in scopes for k, v in scope.items()}
                 references.append(_Reference(named, offset, bindings, "only" in words, context, tuple(opened)))
+        elif name == "load":
+            selected = frozenset(words[1 : words.index("from")]) if "from" in words else None
+            loaded.extend(_Load(library, selected, offset) for library in _loaded(words[1:]))
         elif "as" in words[1:-1]:
             target = words[words.index("as", 1) + 1]
             scopes[-1][target] = values.get(words[1], frozenset()) if name == "regroup" else frozenset()
-    return _Template(tuple(applications), tuple(references), frozenset(defined))
+    return _Template(
+        tuple(applications), tuple(references), frozenset(defined), frozenset(extended), tuple(unresolved)
+    )
+
+
+def _libraries(paths: Iterable[Path]) -> dict[str, _Library]:
+    """The project's tag libraries among ``paths``, by the name ``{% load %}`` gives
+    them: the modules of the ``templatetags`` directories. Of several files of one name,
+    in different apps, only what every file registers is certain, and one the engine
+    cannot read leaves everything uncertain."""
+
+    readings: dict[str, list[frozenset[str] | None]] = {}
+    for path in paths:
+        if path.suffix == ".py" and path.parent.name == TEMPLATETAGS_DIRECTORY and path.stem != "__init__":
+            readings.setdefault(path.stem, []).append(_registered_filters(path))
+    libraries: dict[str, _Library] = {}
+    for name, found in readings.items():
+        read = [names for names in found if names is not None]
+        if len(read) < len(found):
+            libraries[name] = _Library()
+        else:
+            certain = read[0].intersection(*read[1:])
+            libraries[name] = _Library(certain, read[0].union(*read[1:]) - certain)
+    return libraries
+
+
+def _registered_filters(path: Path) -> frozenset[str] | None:
+    """The names of the filters the tag library module ``path`` registers, or None when
+    the engine cannot tell them all: the file cannot be read or parsed, ``register`` is
+    not bound to a ``Library`` at module level, a registration's name is not written as
+    a constant, or the library is filled or passed around in a way the engine does not
+    read. The ``Library`` is known by its symbol, whatever the import spelling, and a
+    registration under ``if``, ``try`` or a function counts."""
+
+    try:
+        module = build_hir(SourceManager().load_file(path))
+        scopes = analyze_scopes(module)
+        symbols = analyze_symbols(scopes, analyze_imports(module, scopes), module)
+    except (OSError, UnicodeDecodeError, ParseError, HIRBuildError, ScopeError, ImportResolutionError):
+        return None
+    scope = scopes.module_scope.id
+    if symbols.resolve(scope, "register") not in _LIBRARY_CLASSES:
+        return None
+    functions = {name for name, bound in scopes.module_scope.bindings.items() if bound.kind is BindingKind.FUNCTION}
+    registered: set[str] = set()
+
+    def record(name: str | None) -> bool:
+        if name is not None:
+            registered.add(name)
+        return name is not None
+
+    def visit(node: Node) -> bool:
+        """Read the registrations under ``node``; False when one cannot be read."""
+
+        if isinstance(node, nodes.Function):
+            for decorator in node.decorators:
+                if _library_attribute(symbols.resolve_expression(scope, decorator)) == "filter":
+                    named = _decorated(decorator, node.name) if isinstance(decorator, nodes.Call) else node.name
+                    if not record(named):
+                        return False
+                elif not visit(decorator):
+                    return False
+            return all(map(visit, (*node.parameters, *node.body)))
+        if isinstance(node, nodes.Call) and isinstance(node.callee, nodes.Name | nodes.Attribute):
+            callee = symbols.resolve_expression(scope, node.callee)
+            if callee in _LIBRARY_CLASSES:
+                return not (node.arguments or node.keywords)  # ``Library(filters=...)`` fills it unseen
+            if _library_attribute(callee) == "filter":
+                return record(_registered(node, functions)) and all(map(visit, (*node.arguments, *node.keywords)))
+        if isinstance(node, nodes.Name | nodes.Attribute):
+            symbol = symbols.resolve_expression(scope, node)
+            if _library_attribute(symbol) in _TAG_REGISTRARS:
+                return True
+            if symbol in _LIBRARY_CLASSES or _library_attribute(symbol) is not None:
+                return False  # the library, or its filters, in hands the engine does not follow
+        if isinstance(node, nodes.Assign) and isinstance(node.target, nodes.Name):
+            return visit(node.value)
+        return all(map(visit, children(node)))
+
+    return frozenset(registered) if all(map(visit, module.body)) else None
+
+
+def _library_attribute(symbol: SymbolId | None) -> str | None:
+    """The attribute of a ``Library`` that ``symbol`` names, ``filter`` for
+    ``register.filter``; None for any other symbol."""
+
+    if symbol is None:
+        return None
+    owner, _, name = symbol.canonical_name.rpartition(".")
+    return name if "." in owner and SymbolId(owner) in _LIBRARY_CLASSES else None
+
+
+def _decorated(call: nodes.Call, function: str) -> str | None:
+    """What ``@register.filter(...)`` registers ``function`` as: the constant ``name`` it
+    gives, or ``function`` itself when it gives only flags; None when the engine cannot
+    tell."""
+
+    given = _arguments(call, "name")
+    if given is None:
+        return None
+    return function if given[0] is None else _string(given[0])
+
+
+def _registered(call: nodes.Call, functions: Container[str]) -> str | None:
+    """What ``register.filter(...)`` registers when called as a statement: the constant
+    name of ``register.filter("x", fn)`` and ``register.filter(name="x", filter_func=fn)``,
+    the function's own name for ``register.filter(fn)`` when the module defines
+    ``fn``; None when the engine cannot tell."""
+
+    given = _arguments(call, "name", "filter_func")
+    if given is None:
+        return None
+    name, function = given
+    if function is None:
+        return name.identifier if isinstance(name, nodes.Name) and name.identifier in functions else None
+    return _string(name)
+
+
+def _arguments(call: nodes.Call, *parameters: str) -> list[nodes.Expression | None] | None:
+    """The argument ``call`` gives each of ``parameters``, by position or keyword; None
+    when it unpacks any, which could give them too."""
+
+    if any(isinstance(a, nodes.Starred) for a in call.arguments) or any(k.name is None for k in call.keywords):
+        return None
+    keywords = {keyword.name: keyword.value for keyword in call.keywords}
+    return [
+        call.arguments[position] if position < len(call.arguments) else keywords.get(name)
+        for position, name in enumerate(parameters)
+    ]
+
+
+def _string(expression: nodes.Expression | None) -> str | None:
+    return expression.value if isinstance(expression, nodes.Constant) and isinstance(expression.value, str) else None
 
 
 def _chain(expression: str, offset: int) -> tuple[frozenset[str], list[tuple[str, int, frozenset[str]]]]:
@@ -578,29 +816,41 @@ def _through(bound: frozenset[str], name: str) -> frozenset[str]:
     return frozenset(".".join(f"{b}.{attribute}".split(".")[:2]) if attribute else b for b in bound)
 
 
-def request_processor(modules: Iterable[nodes.Module]) -> bool:
+def request_processor(modules: Iterable[tuple[nodes.Module, ScopeTable]]) -> bool:
     """Whether every Django template engine the project's settings configure runs the
-    ``request`` context processor, for certain: each assignment to ``TEMPLATES`` is a
-    literal list of literal engines, at least one of them ``DjangoTemplates``, and each
-    of those lists the processor in a literal ``context_processors``; no other code
-    names ``TEMPLATES``, which could change it. A mere mention of the processor proves
-    nothing."""
+    ``request`` context processor, for certain: each module-level assignment to
+    ``TEMPLATES`` is a literal list of literal engines, at least one of them
+    ``DjangoTemplates``, and each of those lists the processor in a literal
+    ``context_processors``; no other code names the module's ``TEMPLATES``, or a
+    ``TEMPLATES`` it does not bind (a star import), which could change it. A
+    ``TEMPLATES`` bound in a function or a class is another name, which configures
+    nothing and changes nothing. A mere mention of the processor proves nothing."""
 
     assignments = mentions = 0
-    for module in modules:
-        stack: list[Node] = list(module.body)
-        while stack:
-            node = stack.pop()
-            stack.extend(children(node))
+    for module, scopes in modules:
+        for node, scope in _scoped(module, scopes):
             if isinstance(node, nodes.Name) and node.identifier == _ENGINES_SETTING:
-                mentions += 1
-            elif isinstance(node, nodes.Assign) and _names_engines(node.target):
+                if scopes.resolve(scope, node.identifier).kind in (ResolutionKind.GLOBAL, ResolutionKind.UNBOUND):
+                    mentions += 1
+            elif isinstance(node, nodes.Assign) and _names_engines(node.target) and scope == scopes.module_scope.id:
                 if not _runs_request_processor(node.value):
                     return False
                 assignments += 1
     return assignments > 0 and mentions == assignments
 
 
+def _scoped(module: nodes.Module, scopes: ScopeTable) -> Iterator[tuple[Node, ScopeId]]:
+    """Every node of ``module`` with the scope it stands in."""
+
+    stack: list[tuple[Node, ScopeId]] = [(node, scopes.module_scope.id) for node in module.body]
+    while stack:
+        node, scope = stack.pop()
+        yield node, scope
+        if isinstance(node, nodes.Function | nodes.Lambda | nodes.Class | nodes.Comprehension):
+            scope = scopes.scope_for(node).id
+        stack.extend((child, scope) for child in children(node))
+
+
 def _names_engines(target: nodes.Expression) -> bool:
     return isinstance(target, nodes.Name) and target.identifier == _ENGINES_SETTING
 

{coretrace_python_analyzer-0.18.0.dist-info → coretrace_python_analyzer-0.19.0.dist-info}/METADATA

@@ -1,6 +1,6 @@
 Metadata-Version: 2.5
 Name: coretrace-python-analyzer
-Version: 0.18.0
+Version: 0.19.0
 Summary: Static security analysis infrastructure for Python code
 Project-URL: Homepage, https://github.com/CoreTrace/coretrace-python-analyzer
 Project-URL: Repository, https://github.com/CoreTrace/coretrace-python-analyzer

{coretrace_python_analyzer-0.18.0.dist-info → coretrace_python_analyzer-0.19.0.dist-info}/RECORD

@@ -1,8 +1,8 @@
-coretrace_python/__init__.py,sha256=UXlC7yIk3dOxWBAjttYzugsg0Cacccz_IG6V-LsaqSU,76
+coretrace_python/__init__.py,sha256=FWsRdqY0ZoJRj8rA--2DntUA3GU1JsrZdyrjQIAq5wE,76
 coretrace_python/__main__.py,sha256=V8DnYtRboISK2VCKm7DGHLREKvqLbqApyWlKBOs26wU,65
-coretrace_python/cache.py,sha256=-pZv-ELm4jMCTXQWSZIobHaT9UHIjFu7IlMkOM0i4LI,13607
+coretrace_python/cache.py,sha256=XnUC677v8VQvlmLA_GQO376isHn6ZdSOOA0dRua0Foo,13716
 coretrace_python/cli.py,sha256=G5jhb6g6RgSRSjjS7DBgziIjUM1vTFwalJGvFHVKxrg,11225
-coretrace_python/engine.py,sha256=13lCa7rJTI6Q4Icyvs8gZpcJhW9WxO1poWXGjWCDHT0,33922
+coretrace_python/engine.py,sha256=i_YckOVHZa_Mcwxgi2jsMkw8O49zHFQZ313mA_Xtl-4,37643
 coretrace_python/abstract/__init__.py,sha256=n5FNkV8Z4LmwG0r06KWdLj4N2CPSgAKwY3896tdmRgM,999
 coretrace_python/abstract/constants.py,sha256=z4-e7IzysxzGi58wFFff1MlEoV8l7AZsB9EL-q6b7vY,9071
 coretrace_python/abstract/heap.py,sha256=OaESXFGC0qzyhAr76xrCu4skeDVzZM4wlenQqfMTkdk,9642
@@ -102,7 +102,7 @@ coretrace_python/dependency/sbom.py,sha256=rzJ-t0Mwoghej8nk0N63Dpjr_wYXm6JzuOPXj
 coretrace_python/dependency/vex.py,sha256=bafWyziWWQP-Fjw1bvyOcOPsdFMwKy-sjMGWL7IPY3w,8048
 coretrace_python/findings/__init__.py,sha256=yFKXSFEsAnFSxF1E_ptF2OH4YlUcCaSeIlWSvqMgaHo,500
 coretrace_python/findings/baseline.py,sha256=fbGQuULRsCjhxSNdwuLfwsvql9ZUfF3jqCXrRmIgOoQ,3468
-coretrace_python/findings/coverage.py,sha256=c7-NXdESYCzJWsSDx5EhflY6Lr7yr0XSxwOMPUDEE18,1385
+coretrace_python/findings/coverage.py,sha256=LT74vTEjnt_kAgWBEt60rM0sB6mFAyIVzhta0WNUkxE,1580
 coretrace_python/findings/model.py,sha256=zRK1FDuLgiVY4ch6H_AN9rDxC1orNW4wc8YN3cfVFfc,1424
 coretrace_python/findings/provenance.py,sha256=vP3nbyDPMlRlxVcVlurF0mSGNuxO3B7kzDDDd_BVws0,838
 coretrace_python/findings/refutation.py,sha256=UeYCz70LwyL8AMimhs3ys9cH0j1_YbdHVu7y3VvmmUg,22026
@@ -113,9 +113,9 @@ coretrace_python/frontend/parser.py,sha256=6-CG7rWxUYeOGeDP206SJWy4BMQUP9Mr6Jf-t
 coretrace_python/hir/__init__.py,sha256=xMpvj-RSp6bd78a_hhkqbe99-snjERkH-_Lv5o9ASbw,180
 coretrace_python/hir/nodes.py,sha256=4BI0f3UhKbnz9ZIxMoKXM7ujav0BmRpD0OXaoblRxIk,12364
 coretrace_python/hir/visitors.py,sha256=JFnX09hK6trLyRcWgZ5ehOG2ywX3VvkqQ1h82nahYNg,885
-coretrace_python/interprocedural/__init__.py,sha256=HvV9zibV_VX8cfIYzWXVEDGkkMZzDywx-lKJioYSFtg,1566
-coretrace_python/interprocedural/callgraph.py,sha256=a7fTvciUjMkEO0TsJqZm6L0OFyARmLQ1P2cjAnBTENk,21948
-coretrace_python/interprocedural/modulegraph.py,sha256=4sB7OKjBYfxtm7aMtHm2jRlqFVUNUsdnLhnv9UZ1BWA,8846
+coretrace_python/interprocedural/__init__.py,sha256=q8u1eIpM55wqVtn46cxuymOn5D5DWU7K35i8Nzzbc3w,1604
+coretrace_python/interprocedural/callgraph.py,sha256=EEG8kh9yyFPZiiFcouR8wuIwicClSKHu-z7nLh1kKOQ,22163
+coretrace_python/interprocedural/modulegraph.py,sha256=xKlO_L2mcZi0RoG9h2ulacYecqUhM5BG1RrdC6_HUk8,13036
 coretrace_python/interprocedural/summaries.py,sha256=6lybEynjtptZGGBw_3WKXx9ZZZqN96xL-r-tzo8fbMI,33862
 coretrace_python/ir/__init__.py,sha256=ShBPYYqoQFePP-mgBjGezQ2acel0-ReOHF9vCC-G_4Q,232
 coretrace_python/ir/defuse.py,sha256=CZEPnlgntRp4MqwR7kLldd2ZlIlBnr-V9VJAxXxwm0c,2616
@@ -138,20 +138,20 @@ coretrace_python/reporters/text.py,sha256=bHsHkMheyL0AB1iWtxBO5H9S14k1AqJvKkNsFr
 coretrace_python/semantic/__init__.py,sha256=tJOvNvMzJ9yjP2bgkLpPO29pl9gMQgICh6XVYJHrovw,464
 coretrace_python/semantic/identity.py,sha256=uQBdqEXrOtYmGIiR9hZu0Pimv52iW1rOOOvIdG0InNY,1472
 coretrace_python/semantic/imports.py,sha256=389MZs8iTUc3CyUHG0VAgWFsypd7VPFKkLHmFz9L-N0,5673
-coretrace_python/semantic/scopes.py,sha256=zg8ClITSAUbOMvLOV5BsfdG1oC4cd0VweUb9S5Jc4js,20241
+coretrace_python/semantic/scopes.py,sha256=-ZP88ppAjSBUPB5TvsznuP8YmCXU-LzSq6acq8iM95w,20264
 coretrace_python/semantic/symbols.py,sha256=G0jwsWFo2346Y1R2sztsB8HuZZm_aHfHSJXXeZKPQLo,7354
 coretrace_python/source/__init__.py,sha256=0Y8fvtbkETnNCJR9Zq7RS5TSgF9c22pz3SSk1KdAXF0,301
 coretrace_python/source/manager.py,sha256=JRmMOcWfS1nocbVrdcvfQTqEfIkmnb5JP857TpGywN4,2736
 coretrace_python/source/model.py,sha256=FZnN5mlir3tzbIpWoxnn6YtRi9UcJ_y0sZM60tKr8U4,1727
 coretrace_python/taint/__init__.py,sha256=nKpD33_4IRneAkd3Dt-j7Q-cHl47rDA_eLZFDHZVH28,1827
-coretrace_python/taint/engine.py,sha256=BHNdoyUryK9lDOZ-lq235GdTC9SDbeUHquoDH2DDCM8,49457
+coretrace_python/taint/engine.py,sha256=InunQrFgPq5NmiNkn0BQTTb_7D4IY_wZ2sJZn_K4iMs,51533
 coretrace_python/taint/models.py,sha256=pCvE-6dYKYSLK7pylxhLWpeUcMfMyXlh_1VUJbzieo8,20405
 coretrace_python/taint/routes.py,sha256=UAJKXcw_sM9shf58FfDroxVO9bNSm4qrQdZknwUB0lo,6110
-coretrace_python/taint/templates.py,sha256=74y06rKs2F0cCOqRw_jbKwlZ8M4nUgsatOFX5ZWkRNQ,31344
+coretrace_python/taint/templates.py,sha256=gUpUvVk_UIVY2a3T5ENm2TfBuPCDhnu2lu8h50srZ4Q,43963
 coretrace_python/taint/urls.py,sha256=kb0-uOT12ww7R3Jzs_lPKg9lFs74JI-bpa9pXX105xM,3166
-coretrace_python_analyzer-0.18.0.dist-info/METADATA,sha256=UknDXxCfvCkshCAt4gMWAGWWGp_SzsiN9laP98Gq9qo,3217
-coretrace_python_analyzer-0.18.0.dist-info/WHEEL,sha256=W3fkpkm7-wf9vBI5Z-7s0eWkeM-spu78I8Neb98DeEg,87
-coretrace_python_analyzer-0.18.0.dist-info/entry_points.txt,sha256=wdozemiraOkbt65g_Y_zgspuZpoLxJdaCVMJt1Ft3c0,72
-coretrace_python_analyzer-0.18.0.dist-info/licenses/LICENSE,sha256=z8d0m5b2O9McPEK1xHG_dWgUBT6EfBDz6wA0F7xSPTA,11358
-coretrace_python_analyzer-0.18.0.dist-info/licenses/NOTICE,sha256=s3VHj5ngV0ozjW_kZJpg_35ne6JwoBK0ysOjbqVtA0w,113
-coretrace_python_analyzer-0.18.0.dist-info/RECORD,,
+coretrace_python_analyzer-0.19.0.dist-info/METADATA,sha256=QWl44X6mXg-aIRsdgMZIGyX-Ms3CvvpysboxggSRJi4,3217
+coretrace_python_analyzer-0.19.0.dist-info/WHEEL,sha256=W3fkpkm7-wf9vBI5Z-7s0eWkeM-spu78I8Neb98DeEg,87
+coretrace_python_analyzer-0.19.0.dist-info/entry_points.txt,sha256=wdozemiraOkbt65g_Y_zgspuZpoLxJdaCVMJt1Ft3c0,72
+coretrace_python_analyzer-0.19.0.dist-info/licenses/LICENSE,sha256=z8d0m5b2O9McPEK1xHG_dWgUBT6EfBDz6wA0F7xSPTA,11358
+coretrace_python_analyzer-0.19.0.dist-info/licenses/NOTICE,sha256=s3VHj5ngV0ozjW_kZJpg_35ne6JwoBK0ysOjbqVtA0w,113
+coretrace_python_analyzer-0.19.0.dist-info/RECORD,,