coretrace-python-analyzer 0.2.0__py3-none-any.whl → 0.3.0__py3-none-any.whl

coretrace_python/__init__.py

@@ -1,4 +1,4 @@
 """CoreTrace's Python static analysis frontend."""
 
-__version__ = "0.2.0"
+__version__ = "0.3.0"
 

coretrace_python/cache.py

@@ -14,7 +14,7 @@ from __future__ import annotations
 import hashlib
 import json
 import os
-from collections.abc import Iterable, Mapping
+from collections.abc import Mapping
 from dataclasses import dataclass
 from pathlib import Path
 from types import MappingProxyType
@@ -64,15 +64,18 @@ def fingerprint(*parts: str) -> str:
     return digest.hexdigest()
 
 
-def directory_fingerprint(directory: Path, suffixes: Iterable[str] = (".py", ".toml")) -> str:
-    """A digest of the source files under ``directory``, so edited plugin code misses."""
+def directory_fingerprint(directory: Path) -> str:
+    """A digest of every file under ``directory``, so an edited plugin misses: its code,
+    its manifest and the rule or advisory data it ships in any format. Bytecode and
+    hidden files are not part of what the plugin does."""
 
-    wanted = tuple(suffixes)
     parts: list[str] = []
     for path in sorted(directory.rglob("*")):
-        if path.is_file() and path.suffix in wanted:
-            parts.append(str(path.relative_to(directory)))
-            parts.append(path.read_text(encoding="utf-8", errors="replace"))
+        relative = path.relative_to(directory)
+        if not path.is_file() or any(p == "__pycache__" or p.startswith(".") for p in relative.parts):
+            continue
+        parts.append(str(relative))
+        parts.append(path.read_bytes().hex())
     return fingerprint(*parts)
 
 

coretrace_python/engine.py

@@ -257,7 +257,7 @@ def load_plugins(plugin_roots: Sequence[Path], manager: AnalysisManager) -> Plug
 def plugin_models(plugins: Iterable[Plugin]) -> ModelTable:
     models = SecurityModelRegistry()
     for plugin in plugins:
-        models.register(*plugin.models)
+        models.register(*plugin.models, origin=plugin.name)
     return models.freeze()
 
 

coretrace_python/plugins/loader.py

@@ -4,6 +4,7 @@ from __future__ import annotations
 
 import hashlib
 import importlib.util
+import sys
 from dataclasses import dataclass
 from pathlib import Path
 
@@ -63,16 +64,31 @@ def discover_plugins(root: Path, manager: AnalysisManager) -> tuple[LoadedPlugin
 
 
 def _import_entrypoint(directory: Path, manifest: PluginManifest) -> type[Plugin]:
-    module_path = directory / f"{manifest.entrypoint.module}.py"
+    """Import the entrypoint, a module ``<name>.py`` or a package ``<name>/__init__.py``.
+
+    The module name derives from the path, so two plugins may both call their module
+    ``models``; a package is registered in ``sys.modules`` under that name before it
+    runs, which is what its relative imports resolve through."""
+
+    package_path = directory / manifest.entrypoint.module / "__init__.py"
+    is_package = package_path.is_file()
+    module_path = package_path if is_package else directory / f"{manifest.entrypoint.module}.py"
     if not module_path.is_file():
         raise ManifestError(
             f"{directory / MANIFEST_FILENAME}: entrypoint module"
             f" {manifest.entrypoint.module!r} not found"
         )
     unique = hashlib.sha1(str(module_path.resolve()).encode()).hexdigest()[:12]
-    spec = importlib.util.spec_from_file_location(f"coretrace_plugin_{unique}", module_path)
+    name = f"coretrace_plugin_{unique}"
+    spec = importlib.util.spec_from_file_location(
+        name,
+        module_path,
+        submodule_search_locations=[str(module_path.parent)] if is_package else None,
+    )
     assert spec is not None and spec.loader is not None
     module = importlib.util.module_from_spec(spec)
+    if is_package:
+        sys.modules[name] = module
     spec.loader.exec_module(module)
 
     candidate = getattr(module, manifest.entrypoint.class_name, None)

coretrace_python/taint/engine.py

@@ -147,8 +147,10 @@ class _TaintProblem(DataflowProblem[State]):
         project: SummaryIndex | None = None,
         heap: HeapFacts | None = None,
         seeds: Mapping[HeapLocation, Taint] | None = None,
+        module: str = "",
     ) -> None:
         self.name = name
+        self.module = module
         self.function = function
         self.models = models
         self.graph = graph
@@ -294,9 +296,10 @@ class _TaintProblem(DataflowProblem[State]):
                 through = target.symbol.canonical_name.removeprefix("python.")
                 bound = () if project.static else self.receiver(call, project.name)
                 arguments = (*(self.deep(r, state) for r in bound), *arguments)
-                return self.known(
+                result = self.known(
                     project, through, arguments, keywords, everything, call, flows, state, (), bound
                 )
+                return self.declared_clean(target.symbol, result)
             symbol = target.symbol
             if not self.modelled(symbol):
                 # ``get_conn().execute`` derived ``app.database.get_conn.execute``; what
@@ -312,9 +315,10 @@ class _TaintProblem(DataflowProblem[State]):
                 *arguments,
                 *(self.deep(value, state) for value in captured),
             )
-            return self.known(
+            result = self.known(
                 summary, target.name, arguments, keywords, everything, call, flows, state, captured, bound
             )
+            return self.declared_clean(project_symbol(self.module, target.name), result)
         returned = self.returned_symbol(call)
         if returned is not None:
             return self.external(returned, everything, call, state, flows)
@@ -369,6 +373,13 @@ class _TaintProblem(DataflowProblem[State]):
         made = self.defs.get(call.callee)
         return made.captured if isinstance(made, MakeFunction) else ()
 
+    def declared_clean(self, symbol: SymbolId, result: Taint) -> Taint:
+        """A ``Sanitizer`` declared on a project function is the project's own knowledge
+        of what its result carries; it wins over what the summary derived from the body."""
+
+        sanitizer = self.models.sanitizer(symbol)
+        return result if sanitizer is None else result.without(sanitizer.kinds)
+
     def modelled(self, symbol: SymbolId) -> bool:
         return (
             self.models.sink(symbol) is not None
@@ -730,8 +741,9 @@ def propagate_taint(
     project: SummaryIndex | None = None,
     heap: HeapFacts | None = None,
     seeds: Mapping[HeapLocation, Taint] | None = None,
+    module: str = "",
 ) -> TaintFacts:
-    problem = _TaintProblem(name, function, models, graph, summaries, parameters, project, heap, seeds)
+    problem = _TaintProblem(name, function, models, graph, summaries, parameters, project, heap, seeds, module)
     solution = solve(problem, cfg)
     taints: dict[Key, Taint] = {}
     flows: list[TaintFlow] = []
@@ -794,6 +806,7 @@ class TaintAnalysis(FunctionAnalysis[TaintFacts]):
             ctx.get(ProjectSummaries),
             heap,
             seeds,
+            ctx.module.name,
         )
 
 

coretrace_python/taint/models.py

@@ -30,10 +30,14 @@ class TaintKind(Flag):
     ADVISORY = auto()
     DESERIALIZATION = auto()
     REDIRECT = auto()
-    ALL = SQL | COMMAND | HTML | PATH | SSRF | CODE | ADVISORY | DESERIALIZATION | REDIRECT
-    # Outside ALL on purpose: only credential-named parameters carry it, so a database
-    # write reached by ordinary input is not a plaintext credential.
+    NOSQL = auto()
+    ALL = SQL | COMMAND | HTML | PATH | SSRF | CODE | ADVISORY | DESERIALIZATION | REDIRECT | NOSQL
+    # Outside ALL on purpose: only the values a model marks carry them, so a database
+    # write reached by ordinary input is not a plaintext credential, and ordinary input
+    # reaching a logger is neither log forging nor a personal-data leak.
     CREDENTIAL = auto()
+    LOG = auto()
+    PII = auto()
 
 
 class ModelError(Exception):
@@ -69,6 +73,11 @@ class Sink:
                 kinds &= ~restricted
         return kinds
 
+    def merged(self, other: Sink) -> Sink:
+        """This sink with ``other``'s kinds and positions added."""
+
+        return Sink(self.symbol, self.kinds | other.kinds, self.positions + other.positions)
+
 
 @dataclass(frozen=True)
 class Sanitizer:
@@ -251,11 +260,7 @@ class ModelTable:
         merged = {sink.symbol: sink for sink in self.sinks}
         for sink in sinks:
             current = merged.get(sink.symbol)
-            merged[sink.symbol] = (
-                Sink(sink.symbol, current.kinds | sink.kinds, current.positions + sink.positions)
-                if current is not None
-                else sink
-            )
+            merged[sink.symbol] = sink if current is None else current.merged(sink)
         return ModelTable(
             self.sources,
             tuple(merged.values()),
@@ -279,15 +284,31 @@ class SecurityModelRegistry:
 
     def __init__(self) -> None:
         self._models: dict[tuple[type[Model], SymbolId], Model] = {}
+        self._origins: dict[tuple[type[Model], SymbolId], str | None] = {}
+
+    def register(self, *models: Model, origin: str | None = None) -> None:
+        """Add models; ``origin`` names the plugin so a conflict can name both sides.
+
+        Two plugins may describe the same symbol: an identical model is ignored, sinks
+        merge their kinds and positions, any other difference is a conflict."""
 
-    def register(self, *models: Model) -> None:
         for model in models:
             key = (type(model), model.symbol)
-            if key in self._models:
+            current = self._models.get(key)
+            if current is None:
+                self._models[key] = model
+                self._origins[key] = origin
+            elif current == model:
+                continue
+            elif isinstance(model, Sink) and isinstance(current, Sink):
+                self._models[key] = current.merged(model)
+            else:
+                registered = self._origins[key]
+                sides = f" by {registered!r} and {origin!r}" if registered and origin else ""
                 raise ModelError(
-                    f"{type(model).__name__.lower()} model for {model.symbol} is already registered"
+                    f"{type(model).__name__.lower()} model for {model.symbol}"
+                    f" is registered twice{sides} with different values"
                 )
-            self._models[key] = model
 
     def freeze(self) -> ModelTable:
         models = list(self._models.values())

{coretrace_python_analyzer-0.2.0.dist-info → coretrace_python_analyzer-0.3.0.dist-info}/METADATA

@@ -1,6 +1,6 @@
 Metadata-Version: 2.5
 Name: coretrace-python-analyzer
-Version: 0.2.0
+Version: 0.3.0
 Summary: Static security analysis infrastructure for Python code
 Project-URL: Homepage, https://github.com/CoreTrace/coretrace-python-analyzer
 Project-URL: Repository, https://github.com/CoreTrace/coretrace-python-analyzer

{coretrace_python_analyzer-0.2.0.dist-info → coretrace_python_analyzer-0.3.0.dist-info}/RECORD

@@ -1,8 +1,8 @@
-coretrace_python/__init__.py,sha256=Aitn8kEWC3OxAz_1TliVDkeY0-Dz9mZf-S09r7oSD4M,75
+coretrace_python/__init__.py,sha256=o079IGFBNi5YGVym-lPxQ5BTW75JafwRhu2pSI-MMjE,75
 coretrace_python/__main__.py,sha256=V8DnYtRboISK2VCKm7DGHLREKvqLbqApyWlKBOs26wU,65
-coretrace_python/cache.py,sha256=267JaeUore7nmYwCRQ5dv4VIESyeFkQg4MqLPXOyUcc,11194
+coretrace_python/cache.py,sha256=3NoJIz_lHC6gKrq72dJA89ZDyfXJ4jqI646631uPbDM,11316
 coretrace_python/cli.py,sha256=ZE6F8wqNcE-ogfldii-UgUq4nOcEMnHuMCzz0l--yuw,9792
-coretrace_python/engine.py,sha256=RDuwxwMOV1pT7fX2T9WU9EfoBn_9dNXOcY-7ztNpb5U,27154
+coretrace_python/engine.py,sha256=TWEnRs-QdBMzI2UYzj2IacwPfJAVj7M7PAXs5RuLiRY,27174
 coretrace_python/abstract/__init__.py,sha256=n5FNkV8Z4LmwG0r06KWdLj4N2CPSgAKwY3896tdmRgM,999
 coretrace_python/abstract/constants.py,sha256=z4-e7IzysxzGi58wFFff1MlEoV8l7AZsB9EL-q6b7vY,9071
 coretrace_python/abstract/heap.py,sha256=OaESXFGC0qzyhAr76xrCu4skeDVzZM4wlenQqfMTkdk,9642
@@ -119,7 +119,7 @@ coretrace_python/ir/ssa.py,sha256=cIYbcv90PI6AOeMrw2ZWp88fy7E2ZO4P3tqjtPHra7g,11
 coretrace_python/plugins/__init__.py,sha256=Jh5oLVI_Rc7ZzibsMjJzg69LGeNcRRjLcY5XaVOhjgA,1308
 coretrace_python/plugins/api.py,sha256=y1bicTdPypstWs7aJ4JDIOSVKX-MwFq5NSjGntTZhDw,5309
 coretrace_python/plugins/detectors.py,sha256=ej5Z_MS0CBqrR4b9xycjTVUIo5arpArpdbr7nL732iI,5700
-coretrace_python/plugins/loader.py,sha256=e7S6l3VhMpku0HpnAl5qbBRFiOlsSf66P7low7RsRvU,3174
+coretrace_python/plugins/loader.py,sha256=Ozj7NELI1ib3uoAPMsaImYmCJN3HKAjU0BZtQdFs5IQ,3837
 coretrace_python/plugins/manifest.py,sha256=F24pgQSwApRUL6ZihRSLv9wL_M03A_pZjrj9Zi4Ku3Q,3438
 coretrace_python/plugins/registry.py,sha256=ixKcT2YDky96TWCFckdzKnGRmFn1dbBVMSZLPvdxvY8,1177
 coretrace_python/plugins/secrets.py,sha256=fpCxXpz3u7a-p1mAabC99FK_DpC1RSg62lLPe96pGy8,15162
@@ -137,12 +137,12 @@ coretrace_python/source/__init__.py,sha256=0Y8fvtbkETnNCJR9Zq7RS5TSgF9c22pz3SSk1
 coretrace_python/source/manager.py,sha256=JRmMOcWfS1nocbVrdcvfQTqEfIkmnb5JP857TpGywN4,2736
 coretrace_python/source/model.py,sha256=FZnN5mlir3tzbIpWoxnn6YtRi9UcJ_y0sZM60tKr8U4,1727
 coretrace_python/taint/__init__.py,sha256=D-NH3kx9wKTNeWASewawGAx7ChOkGMGhmjf-E4crHl0,1111
-coretrace_python/taint/engine.py,sha256=QedazdxW-5jwiYbZWFI7AyQycSQWNDVOVbkPIKkI0i8,34667
-coretrace_python/taint/models.py,sha256=s7luO5vMaowxPcWoThkLTEdYuyw0JZZVkaKYW5o_xOI,10930
+coretrace_python/taint/engine.py,sha256=XJGv7UBeKV4k1oUpDlYPotxDPrDo45-TIIt_vw9XBhM,35325
+coretrace_python/taint/models.py,sha256=H-Q_nChzwqm-MEGfbfw5jMegpXlIfwUIunFiRXbE90I,12005
 coretrace_python/taint/routes.py,sha256=UAJKXcw_sM9shf58FfDroxVO9bNSm4qrQdZknwUB0lo,6110
-coretrace_python_analyzer-0.2.0.dist-info/METADATA,sha256=Cztxh-bWrr4a_Ttxusa8jsRqA1i5knoRD9gbF_X4jlU,3216
-coretrace_python_analyzer-0.2.0.dist-info/WHEEL,sha256=zOwg4jB6zX2kU910N-cMawjivD6tO8NEWvE12je1bVk,87
-coretrace_python_analyzer-0.2.0.dist-info/entry_points.txt,sha256=wdozemiraOkbt65g_Y_zgspuZpoLxJdaCVMJt1Ft3c0,72
-coretrace_python_analyzer-0.2.0.dist-info/licenses/LICENSE,sha256=z8d0m5b2O9McPEK1xHG_dWgUBT6EfBDz6wA0F7xSPTA,11358
-coretrace_python_analyzer-0.2.0.dist-info/licenses/NOTICE,sha256=s3VHj5ngV0ozjW_kZJpg_35ne6JwoBK0ysOjbqVtA0w,113
-coretrace_python_analyzer-0.2.0.dist-info/RECORD,,
+coretrace_python_analyzer-0.3.0.dist-info/METADATA,sha256=NmKBjMkxToUaG9ZAPRnnGShune4UJtnzvgWQVx7qC4k,3216
+coretrace_python_analyzer-0.3.0.dist-info/WHEEL,sha256=W3fkpkm7-wf9vBI5Z-7s0eWkeM-spu78I8Neb98DeEg,87
+coretrace_python_analyzer-0.3.0.dist-info/entry_points.txt,sha256=wdozemiraOkbt65g_Y_zgspuZpoLxJdaCVMJt1Ft3c0,72
+coretrace_python_analyzer-0.3.0.dist-info/licenses/LICENSE,sha256=z8d0m5b2O9McPEK1xHG_dWgUBT6EfBDz6wA0F7xSPTA,11358
+coretrace_python_analyzer-0.3.0.dist-info/licenses/NOTICE,sha256=s3VHj5ngV0ozjW_kZJpg_35ne6JwoBK0ysOjbqVtA0w,113
+coretrace_python_analyzer-0.3.0.dist-info/RECORD,,

{coretrace_python_analyzer-0.2.0.dist-info → coretrace_python_analyzer-0.3.0.dist-info}/WHEEL

@@ -1,4 +1,4 @@
 Wheel-Version: 1.0
-Generator: hatchling 1.32.0
+Generator: hatchling 1.32.4
 Root-Is-Purelib: true
 Tag: py3-none-any