coretrace-python-analyzer 0.18.0__py3-none-any.whl → 0.20.0__py3-none-any.whl

coretrace_python/__init__.py

@@ -1,4 +1,4 @@
 """CoreTrace's Python static analysis frontend."""
 
-__version__ = "0.18.0"
+__version__ = "0.20.0"
 

coretrace_python/abstract/__init__.py

@@ -8,6 +8,7 @@ from coretrace_python.abstract.constants import (
 from coretrace_python.abstract.heap import (
     ATTRIBUTES,
     ELEMENTS,
+    KEYS,
     MUTATORS,
     AbstractObject,
     AliasSet,
@@ -24,6 +25,7 @@ from coretrace_python.abstract.values import AbstractValue, Truth
 __all__ = [
     "ATTRIBUTES",
     "ELEMENTS",
+    "KEYS",
     "MUTATORS",
     "AbstractObject",
     "AbstractValue",

coretrace_python/abstract/heap.py

@@ -6,7 +6,8 @@ globals and imported symbols by name, and the fields loaded from an object by fi
 Each value points to an ``AliasSet`` of objects, computed by a flow-insensitive
 points-to fixpoint over the SSA form; each object has two ``HeapLocation`` fields,
 ``elements`` for its items and ``attributes`` for its attributes, field-insensitive
-within each. Taint and dependence analyses key their states by these locations, so a
+within each, and a third, ``keys``, for the keys of a mapping, which only the taint
+engine fills. Taint and dependence analyses key their states by these locations, so a
 store, a mutating method call or a load on any alias reads and writes the same place.
 """
 
@@ -47,6 +48,8 @@ from coretrace_python.source import SourceSpan
 
 ELEMENTS = "elements"
 ATTRIBUTES = "attributes"
+# The keys of a mapping, stored by the taint engine; the points-to solver never fills it.
+KEYS = "keys"
 
 # Method names that store their arguments into the receiver's elements.
 MUTATORS = frozenset(

coretrace_python/cache.py

@@ -42,7 +42,7 @@ from coretrace_python.interprocedural import (
 from coretrace_python.semantic.symbols import SymbolId
 from coretrace_python.source import SourceId, SourceSpan
 
-CACHE_FORMAT = 10
+CACHE_FORMAT = 12
 
 
 @dataclass(frozen=True)
@@ -134,7 +134,7 @@ class ProjectCache:
 def encode(module: CachedModule) -> dict[str, Any]:
     return {
         "format": CACHE_FORMAT,
-        "functions": [[f.name, _encode_span(f.span), f.entry_point] for f in module.functions],
+        "functions": [[f.name, _encode_span(f.span), f.entry_point, list(f.aliases)] for f in module.functions],
         "summaries": {name: _encode_summary(s) for name, s in module.summaries.items()},
         "sites": [_encode_site(site) for site in module.sites],
         "findings": [_encode_finding(finding) for finding in module.findings],
@@ -196,8 +196,13 @@ def _decode_span(data: Any) -> SourceSpan:
 
 
 def _decode_function(data: Any) -> ModuleFunction:
-    name, span, entry_point = data
-    return ModuleFunction(_string(name), _decode_span(span), None if entry_point is None else _string(entry_point))
+    name, span, entry_point, aliases = data
+    return ModuleFunction(
+        _string(name),
+        _decode_span(span),
+        None if entry_point is None else _string(entry_point),
+        tuple(_string(alias) for alias in aliases),
+    )
 
 
 def _decode_read(data: Any) -> SymbolRead:
@@ -363,6 +368,7 @@ def _encode_arguments(arguments: Arguments) -> dict[str, Any]:
         "positional": list(arguments.positional),
         "keywords": [[name, value] for name, value in arguments.keywords],
         "unpacked": arguments.unpacked,
+        "keyword_unpacked": arguments.keyword_unpacked,
     }
 
 
@@ -370,11 +376,12 @@ def _decode_arguments(data: Mapping[str, Any]) -> Arguments:
     def denoted(value: Any) -> str | None:
         return None if value is None else _string(value)
 
-    unpacked = data["unpacked"]
-    if not isinstance(unpacked, bool):
-        raise TypeError(f"expected a boolean, got {unpacked!r}")
+    unpacked, keyword_unpacked = data["unpacked"], data["keyword_unpacked"]
+    if not isinstance(unpacked, bool) or not isinstance(keyword_unpacked, bool):
+        raise TypeError(f"expected booleans, got {unpacked!r} and {keyword_unpacked!r}")
     return Arguments(
         tuple(denoted(value) for value in data["positional"]),
         tuple((_string(name), denoted(value)) for name, value in data["keywords"]),
         unpacked,
+        keyword_unpacked,
     )

coretrace_python/dependency/advisories.py

@@ -263,4 +263,8 @@ def _condition(entry: Mapping[str, Any]) -> Condition:
         (condition.argument is None and condition.position is None) or condition.values or condition.default
     ):
         raise ValueError("a host condition names the URL argument, by keyword or position, and nothing else")
+    if condition.kind == "keyword_name" and (
+        condition.argument is not None or condition.position is not None or condition.values or condition.default
+    ):
+        raise ValueError("a keyword_name condition carries its text and nothing else")
     return condition

coretrace_python/dependency/correlation.py

@@ -23,7 +23,7 @@ from coretrace_python.findings import Confidence, Finding, Severity
 from coretrace_python.findings.refutation import Status, Verdict, Verdicts
 from coretrace_python.interprocedural import Arguments, CallSite, ExternalSymbol
 from coretrace_python.semantic.symbols import SymbolId
-from coretrace_python.taint import Sink, TaintFlow, TaintKind
+from coretrace_python.taint import KEYWORD_NAMES, Sink, TaintFlow, TaintKind
 from coretrace_python.taint.urls import UrlProof, redirects_disabled
 
 Affected = Mapping[SymbolId, tuple[Advisory, ...]]
@@ -72,13 +72,25 @@ def check_conditions(
     a ``host`` condition, what ``url`` proves of the value the attacker's input is passed
     in (``passed_as``). A host the URL's constant text fixes rules the call out when the
     call disables redirects; otherwise a redirect may still lead to a host the attacker
-    controls, and the condition stays pending with that uncertainty."""
+    controls, and the condition stays pending with that uncertainty. A ``keyword_name``
+    condition is met when the attacker's input is passed as the keys of a ``**`` mapping,
+    pending when the call expands a mapping whose keys are not established, and
+    contradicted by a call writing every keyword name."""
 
     if entry is None:
         return ConditionCheck()
     met: list[Condition] = []
     pending: list[Condition] = []
     for condition in entry.conditions:
+        if condition.kind == "keyword_name":
+            if any(keyword == KEYWORD_NAMES for _, keyword in passed_as):
+                met.append(condition)
+            elif arguments is None or arguments.keyword_unpacked:
+                pending.append(condition)
+            else:
+                names = ", ".join(sorted({name for name, _ in arguments.keywords}))
+                return ConditionCheck(tuple(met), tuple(pending), condition, names or None)
+            continue
         if condition.kind == "host":
             origin = url.origin if url is not None and _passed_in(condition, passed_as) else None
             if origin is None:
@@ -119,7 +131,8 @@ def ruled_out(module: str, site: CallSite, check: ConditionCheck) -> str:
     python.yaml.load(Loader=python.yaml.SafeLoader)``."""
 
     assert check.contradicted is not None and isinstance(site.target, ExternalSymbol)
-    argument = check.contradicted.argument or f"#{check.contradicted.position}"
+    contradicted = check.contradicted
+    argument = contradicted.argument or ("keywords" if contradicted.kind == "keyword_name" else f"#{contradicted.position}")
     passed = f"{argument} absent" if check.passed is None else f"{argument}={check.passed}"
     return f"{module}:{site.location.start_line} {site.target.symbol}({passed})"
 

coretrace_python/dependency/graph.py

@@ -154,7 +154,10 @@ class Condition:
     ``default`` says an absent argument means a vulnerable value. A ``host`` condition
     says the attacker must choose the host of the URL passed as ``argument`` (or at
     ``position``); the engine decides it from what the URL's constant text proves. A
-    ``semantic`` condition cannot be checked and is reported as pending review."""
+    ``keyword_name`` condition says the attacker must choose a keyword name of the call,
+    as an ORM alias expanded from a mapping; the engine decides it from the keys of what
+    the call expands with ``**``. A ``semantic`` condition cannot be checked and is
+    reported as pending review."""
 
     kind: str
     text: str

coretrace_python/engine.py

@@ -9,6 +9,7 @@ from __future__ import annotations
 import concurrent.futures
 import hashlib
 import multiprocessing
+from collections import Counter
 from collections.abc import Callable, Iterable, Mapping, Sequence
 from dataclasses import dataclass, field, replace
 from pathlib import Path
@@ -88,6 +89,7 @@ from coretrace_python.interprocedural import (
     TemplateCallsAnalysis,
     build_module_graph,
     discover_sources,
+    name_modules,
     project_symbol,
 )
 from coretrace_python.ir import PYIR_SCHEMA_VERSION
@@ -371,7 +373,11 @@ def analyze_project(
     strongly connected components of the module graph, imports first; with ``jobs``
     above one the components of a wave are analysed in that many processes (§29).
     ``advisory_files`` add to the ``advisories.json`` at ``root``; ``policy_file``
-    replaces the ``coretrace-policy.toml`` there."""
+    replaces the ``coretrace-policy.toml`` there.
+
+    Every module is known by the name ``name_modules`` gives its file: its import name,
+    or its path from the root when another file has that import name. Such files carry
+    an ``ambiguous-module`` note and are covered as ``ambiguous``."""
 
     if jobs < 1:
         raise ValueError("jobs must be at least 1")
@@ -398,18 +404,18 @@ def analyze_project(
     files: dict[str, SourceFile] = {}
     unreadable: list[tuple[Path, str]] = []
     coverage: list[FileCoverage] = []
-    discovered = discover_sources(root, sources, unreadable)
+    named = name_modules(root, discover_sources(root, sources, unreadable))
     for path, reason in unreadable:
         findings.append(_note("syntax-error", f"{path}: {reason}", sources.add_source(str(path), ""), 1))
         coverage.append(FileCoverage(str(path), "unreadable", 0, 0))
-    for source in discovered:
+    for name, source in named.items():
         try:
-            modules[source.module_name] = build_hir(source)
+            modules[name] = build_hir(source)
         except (ParseError, HIRBuildError) as error:
             findings.append(_note("syntax-error", str(error), source, 1))
             coverage.append(FileCoverage(str(source.source_id), "syntax-error", 0, 0))
             continue
-        files[source.module_name] = source
+        files[name] = source
 
     managers = {name: _register_all(module) for name, module in modules.items()}
     probe = next(iter(managers.values()), None) or _register_all(build_hir(sources.add_source("<empty>", "")))
@@ -439,6 +445,8 @@ def analyze_project(
     graph = build_module_graph(
         {name: files[name] for name in analysable}, {name: modules[name] for name in analysable}, imports
     )
+    shared = _shared_names(graph)
+    findings.extend(_ambiguity_notes(graph, shared, root))
     routes: dict[SymbolId, EntryPoint] = {}
     for name in sorted(analysable):
         for symbol, registered in _routes_of(analysable[name]).items():
@@ -447,7 +455,8 @@ def analyze_project(
     templates = project_templates(root)
     clearing = models.clearing(escaped)
     template_calls = models.template_calls(
-        templates.filters, request_processor(modules[name] for name in sorted(analysable))
+        templates.filters,
+        request_processor((modules[name], analysable[name].get(ScopeAnalysis)) for name in sorted(analysable)),
     )
     for manager in analysable.values():
         manager.provide(RegisteredRoutes, routes)
@@ -514,15 +523,16 @@ def analyze_project(
         if pool is not None:
             pool.shutdown()
 
-    index = _seed(results, graph, frozenset())
+    index = _index(results, {name: name for name in results})
     call_graphs: dict[str, CallGraph] = {}
     functions: dict[str, tuple[ModuleFunction, ...]] = {}
     for name in sorted(analysable):
         entry = results[name]
         findings.extend(entry.findings)
         unsupported = sum(1 for f in entry.findings if f.rule_id == "unsupported-syntax")
+        status = "ambiguous" if files[name].module_name in shared else "analysed"
         coverage.append(
-            FileCoverage(str(files[name].source_id), "analysed", len(entry.functions), len(entry.functions) - unsupported)
+            FileCoverage(str(files[name].source_id), status, len(entry.functions), len(entry.functions) - unsupported)
         )
         functions[name] = entry.functions
         sites: dict[str, list[CallSite]] = {function.name: [] for function in entry.functions}
@@ -644,24 +654,76 @@ def _advisory_paths(root: Path, advisory_files: Sequence[Path]) -> tuple[Path, .
     return (*([default] if default.is_file() else []), *advisory_files)
 
 
+def _shared_names(graph: ModuleGraph) -> dict[str, list[str]]:
+    """The import names several analysable files have, each with those files' modules."""
+
+    by_name: dict[str, list[str]] = {}
+    for name in graph.modules:
+        by_name.setdefault(graph.source(name).module_name, []).append(name)
+    return {import_name: names for import_name, names in by_name.items() if len(names) > 1}
+
+
+def _ambiguity_notes(graph: ModuleGraph, shared: Mapping[str, list[str]], root: Path) -> list[Finding]:
+    """One note on each file whose import name another file shares, since a symbol of
+    that name may denote a function of either, and one on each importer whose import of
+    such a name no root resolved, since calls through it are not followed."""
+
+    def located(name: str) -> str:
+        return _located(_path_of(graph.source(name)), root)
+
+    notes: list[Finding] = []
+    for import_name, names in sorted(shared.items()):
+        for name in names:
+            others = ", ".join(located(other) for other in names if other != name)
+            message = (
+                f"{located(name)} is the module '{import_name}' like {others}: a symbol "
+                f"python.{import_name}.* may name a function of either, and an import of "
+                f"'{import_name}' resolves only from its own root"
+            )
+            notes.append(_note("ambiguous-module", message, graph.source(name), 1))
+    for name in graph.modules:
+        for import_name in sorted(graph.unresolved(name)):
+            candidates = " or ".join(located(other) for other in shared[import_name])
+            message = f"'{import_name}' imported here is {candidates}: calls into it are not followed"
+            notes.append(_note("ambiguous-module", message, graph.source(name), 1))
+    return notes
+
+
 def _seed(results: Mapping[str, CachedModule], graph: ModuleGraph, component: frozenset[str]) -> SummaryIndex:
     """The summaries a component starts from: those of every module it imports,
-    transitively, all final by the time its wave runs; the whole index for no component."""
-
-    if component:
-        wanted: set[str] = set()
-        pending = list(component)
-        while pending:
-            for imported in graph.imports(pending.pop()):
-                if imported in results and imported not in wanted:
-                    wanted.add(imported)
-                    pending.append(imported)
-    else:
-        wanted = set(results)
+    transitively, all final by the time its wave runs, each under the import name the
+    component's code refers to it by. Of several files with one import name, only the
+    one a member imports directly, resolved in its own root, goes under that name: the
+    others are reached through summaries that inline them already, and a name no
+    member's root resolved is followed into neither file."""
+
+    wanted: set[str] = set()
+    pending = list(component)
+    while pending:
+        for imported in graph.imports(pending.pop()):
+            if imported in results and imported not in wanted:
+                wanted.add(imported)
+                pending.append(imported)
+    direct = {imported for member in component for imported in graph.imports(member)}
+    by_import: dict[str, list[str]] = {}
+    for name in wanted:
+        by_import.setdefault(graph.source(name).module_name, []).append(name)
+    names: dict[str, str] = {}
+    for import_name, modules in by_import.items():
+        chosen = modules if len(modules) == 1 else [name for name in modules if name in direct]
+        if len(chosen) == 1:
+            names[chosen[0]] = import_name
+    return _index(results, names)
+
+
+def _index(results: Mapping[str, CachedModule], names: Mapping[str, str]) -> SummaryIndex:
+    """The summaries of the modules in ``names``, each function under the project symbol
+    of the module name given for its module."""
+
     return SummaryIndex(
         {
-            project_symbol(name, function): summary
-            for name in sorted(wanted)
+            project_symbol(module, function): summary
+            for name, module in sorted(names.items())
             for function, summary in results[name].summaries.items()
         }
     )
@@ -674,8 +736,12 @@ def _analyse_managers(
     affected: Affected,
 ) -> dict[str, CachedModule]:
     """Analyse one component: iterate its summaries to a fixpoint over ``seed`` (§21),
-    then extract what the rest of the run needs from each module."""
+    then extract what the rest of the run needs from each module. Each member registers
+    its functions under its import name, what the others' code refers to it by; a name
+    two members share, a cycle across roots, is registered by neither."""
 
+    counts = Counter(manager.module.name for manager in managers.values())
+    names = {name: manager.module.name for name, manager in managers.items() if counts[manager.module.name] == 1}
     index = seed
     for manager in managers.values():
         manager.provide(ProjectSummaries, index)
@@ -684,9 +750,9 @@ def _analyse_managers(
             {
                 **seed.summaries,
                 **{
-                    project_symbol(name, function): summary
-                    for name, manager in managers.items()
-                    for function, summary in _summaries_of(manager).items()
+                    project_symbol(module, function): summary
+                    for name, module in names.items()
+                    for function, summary in _summaries_of(managers[name]).items()
                 },
             }
         )
@@ -701,8 +767,9 @@ def _analyse_managers(
 
 @dataclass(frozen=True)
 class _Batch:
-    """One component handed to a worker process: it rebuilds the configuration from the
-    project root and the plugin roots, so only paths and the imported summaries travel."""
+    """One component handed to a worker process, its files under the engine's module
+    names: it rebuilds the configuration from the project root and the plugin roots, so
+    only paths and the imported summaries travel."""
 
     root: Path
     plugin_roots: tuple[Path, ...]

coretrace_python/findings/coverage.py

@@ -1,10 +1,12 @@
 """Analysis coverage: which files and functions a run actually looked at.
 
 "No findings" only means something when the reader knows what was analysed. Each file
-is ``analysed``, a ``syntax-error`` (the frontend rejected it) or ``unreadable`` (it could
-not be decoded); analysed files count their functions and how many lowered. The
-templates the project names but the run could not read are listed, each where the
-project names it: they may call any template filter.
+is ``analysed``, ``ambiguous`` (analysed, but another file has its Python module name,
+so a symbol of that name may denote a function of either and an import of it resolves
+only from its own root), a ``syntax-error`` (the frontend rejected it) or ``unreadable``
+(it could not be decoded); analysed and ambiguous files count their functions and how
+many lowered. The templates the project names but the run could not read are listed,
+each where the project names it: they may call any template filter.
 """
 
 from __future__ import annotations

coretrace_python/interprocedural/__init__.py

@@ -19,6 +19,7 @@ from coretrace_python.interprocedural.modulegraph import (
     build_module_graph,
     discover_files,
     discover_sources,
+    name_modules,
     project_symbol,
 )
 from coretrace_python.interprocedural.summaries import (
@@ -73,5 +74,6 @@ __all__ = [
     "cleared_by",
     "discover_files",
     "discover_sources",
+    "name_modules",
     "project_symbol",
 ]

coretrace_python/interprocedural/callgraph.py

@@ -18,6 +18,7 @@ from typing import ClassVar
 from coretrace_python.analysis import Analysis, AnalysisContext, AnyAnalysis
 from coretrace_python.cfg import CFGError
 from coretrace_python.hir import nodes
+from coretrace_python.ir.defuse import DefUse, def_use
 from coretrace_python.ir.lowering import (
     MODULE_BODY,
     LoweringError,
@@ -26,6 +27,7 @@ from coretrace_python.ir.lowering import (
 )
 from coretrace_python.ir.model import (
     Await,
+    BuildDict,
     Call,
     Constant,
     FunctionIR,
@@ -68,11 +70,15 @@ class Arguments:
     (``python.yaml.FullLoader``), a constant as Python writes it (``True``, ``'/static'``),
     or None for anything else (a parameter, an expression). ``unpacked`` says the call
     unpacks ``*args`` or ``**kwargs``, so an argument it does not give explicitly may
-    still be given; after ``*args`` no position is known, and ``positional`` is empty."""
+    still be given; after ``*args`` no position is known, and ``positional`` is empty.
+    ``keyword_unpacked`` says the call expands a ``**mapping`` whose keys it does not
+    write, so a keyword name may be anything; a literal with constant keys is written out
+    as its keywords, and ``unpacked`` stays true for it only when ``*args`` is also given."""
 
     positional: tuple[str | None, ...] = ()
     keywords: tuple[tuple[str, str | None], ...] = ()
     unpacked: bool = False
+    keyword_unpacked: bool = False
 
     def given(self, keyword: str | None, position: int | None = None) -> tuple[bool, str | None] | None:
         """Whether the call gives an argument, by ``keyword`` or at ``position``, and what it
@@ -132,12 +138,16 @@ class SignaturesAnalysis(Analysis[tuple[Signature, ...]]):
 @dataclass(frozen=True)
 class ModuleFunction:
     """One function of a module as a project plugin sees it: the name the call graph
-    gives it (``Class.method``, ``outer.inner``, ``<module>``), where it is, and the label
-    of the entry point it is (``http`` for a route, ``argv`` for a command), if any."""
+    gives it (``Class.method``, ``outer.inner``, ``<module>``), where it is, the label
+    of the entry point it is (``http`` for a route, ``argv`` for a command), if any, and
+    the module-level ``aliases`` bound to it by assigning one name to another
+    (``main = actual``), transitively and in source order; a method or a nested
+    function has none."""
 
     name: str
     span: SourceSpan
     entry_point: str | None = None
+    aliases: tuple[str, ...] = ()
 
 
 class CallGraph:
@@ -241,8 +251,45 @@ def derive_symbols(
 # passed as an argument is not recorded, so call sites stay small in the cache.
 MAX_CONSTANT_LENGTH = 64
 
+_DICT = SymbolId("python.builtins.dict")
+
+
+def _keyword_entries(
+    value: Value, symbols: Mapping[Value, SymbolId], defs: Mapping[Value, Instruction], uses: DefUse
+) -> tuple[tuple[str, Value], ...] | None:
+    """The keywords a ``**value`` gives when every name is established: the string keys
+    of a dict literal, the keywords of ``dict(...)``, through what they unpack in turn;
+    None when a key is computed, the mapping is built elsewhere, or anything but the
+    call uses it, since a store or a mutating call may add a key the literal does not
+    write."""
+
+    if len(uses.uses(value)) != 1:
+        return None
+    made = defs.get(value)
+    entries: list[tuple[str, Value]] = []
+    if isinstance(made, BuildDict):
+        for key, item in made.items:
+            constant = defs.get(key)
+            if not isinstance(constant, Constant) or not isinstance(constant.value, str):
+                return None
+            entries.append((constant.value, item))
+        nested = made.unpacked
+    elif isinstance(made, Call) and symbols.get(made.callee) == _DICT and not made.arguments and not made.starred:
+        nested = tuple(v for name, v in made.keywords if name is None)
+        entries.extend((name, v) for name, v in made.keywords if name is not None)
+    else:
+        return None
+    for inner in nested:
+        found = _keyword_entries(inner, symbols, defs, uses)
+        if found is None:
+            return None
+        entries.extend(found)
+    return tuple(entries)
+
 
-def _arguments(call: Call, symbols: Mapping[Value, SymbolId], defs: Mapping[Value, Instruction]) -> Arguments:
+def _arguments(
+    call: Call, symbols: Mapping[Value, SymbolId], defs: Mapping[Value, Instruction], uses: DefUse
+) -> Arguments:
     def denoted(value: Value) -> str | None:
         symbol = symbols.get(value)
         if symbol is not None:
@@ -253,10 +300,22 @@ def _arguments(call: Call, symbols: Mapping[Value, SymbolId], defs: Mapping[Valu
         written = repr(made.value)
         return written if len(written) <= MAX_CONSTANT_LENGTH else None
 
+    keywords: list[tuple[str, str | None]] = []
+    keyword_unpacked = False
+    for name, value in call.keywords:
+        if name is not None:
+            keywords.append((name, denoted(value)))
+            continue
+        entries = _keyword_entries(value, symbols, defs, uses)
+        if entries is None:
+            keyword_unpacked = True
+        else:
+            keywords.extend((key, denoted(item)) for key, item in entries)
     return Arguments(
         () if call.starred else tuple(denoted(value) for value in call.arguments),
-        tuple((name, denoted(value)) for name, value in call.keywords if name is not None),
-        bool(call.starred) or any(name is None for name, _ in call.keywords),
+        tuple(keywords),
+        bool(call.starred) or keyword_unpacked,
+        keyword_unpacked,
     )
 
 
@@ -476,6 +535,7 @@ class CallGraphAnalysis(Analysis[CallGraph]):
                 table=table,
             )
             defs = {i.result: i for block in ssa.blocks for i in block.instructions if i.result is not None}
+            uses = def_use(ssa)
             found: list[CallSite] = []
             for block in ssa.blocks:
                 for instruction in block.instructions:
@@ -485,7 +545,7 @@ class CallGraphAnalysis(Analysis[CallGraph]):
                                 name,
                                 instruction.location,
                                 targets.get(instruction.callee, UnknownTarget()),
-                                _arguments(instruction, symbols[name], defs),
+                                _arguments(instruction, symbols[name], defs, uses),
                             )
                         )
             sites[name] = tuple(found)