coretrace-python-analyzer 0.20.0__py3-none-any.whl → 0.21.0__py3-none-any.whl

coretrace_python/__init__.py

@@ -1,4 +1,4 @@
 """CoreTrace's Python static analysis frontend."""
 
-__version__ = "0.20.0"
+__version__ = "0.21.0"
 

coretrace_python/bundled/dependency/reachable_vulnerability/reachable_vulnerability.py

@@ -8,12 +8,14 @@ from collections.abc import Iterator, Sequence
 from typing import ClassVar
 
 from coretrace_python.analysis import AnyAnalysis
-from coretrace_python.dependency import Advisory, DependencyAnalysis
+from coretrace_python.dependency import Advisory, AdvisoryEntryPoint, DependencyAnalysis
 from coretrace_python.dependency.correlation import (
     ConditionCheck,
+    affected_entries,
     affected_symbols,
     check_conditions,
     evidence,
+    suffix_index,
 )
 from coretrace_python.findings import Confidence, Finding
 from coretrace_python.interprocedural import CallGraphAnalysis, ExternalSymbol
@@ -30,6 +32,7 @@ class ReachableVulnerabilityPlugin(ProjectPlugin):
         affected = affected_symbols(ctx.dependencies, ctx.advisories)
         if not affected:
             return ()
+        suffixes = suffix_index(affected, ctx.modules)
         findings: list[Finding] = []
         for module in ctx.modules:
             graph = ctx.call_graph(module)
@@ -37,30 +40,28 @@ class ReachableVulnerabilityPlugin(ProjectPlugin):
                 for site in graph.sites(function):
                     if not isinstance(site.target, ExternalSymbol):
                         continue
-                    for advisory in affected.get(site.target.symbol, ()):
-                        entry = advisory.entry_point(site.target.symbol)
+                    for advisory, entry in affected_entries(site.target.symbol, affected, suffixes):
                         if entry is not None and entry.read:
                             continue  # a call reads its callee first: reported with the reads
-                        check = check_conditions(entry, site.arguments)
+                        check = check_conditions(entry, site.arguments, prior_calls=site.prior_calls)
                         if check.contradicted is not None:
                             continue
-                        findings.append(_reached(advisory, site.target.symbol, site.location, function, check))
+                        findings.append(_reached(advisory, site.target.symbol, site.location, function, check, entry))
                 # Reading ``request.form.get`` reads ``request.form``: one finding per entry
                 # point and function, where the function first reads it.
                 reported: set[tuple[Advisory, SymbolId]] = set()
                 for read in graph.reads(function):
                     for symbol in _read_through(read.symbol):
-                        for advisory in affected.get(symbol, ()):
-                            entry = advisory.entry_point(symbol)
+                        for advisory, entry in affected_entries(symbol, affected, suffixes):
                             if entry is None or not entry.read or (advisory, symbol) in reported:
                                 continue
                             reported.add((advisory, symbol))
                             check = check_conditions(entry, None)
-                            findings.append(_reached(advisory, symbol, read.location, function, check))
+                            findings.append(_reached(advisory, symbol, read.location, function, check, entry))
         for call in ctx.templates.calls:
-            for advisory in affected.get(call.symbol, ()):
-                check = check_conditions(advisory.entry_point(call.symbol), None)
-                findings.append(_reached(advisory, call.symbol, call.span, None, check))
+            for advisory, entry in affected_entries(call.symbol, affected, suffixes):
+                check = check_conditions(entry, None)
+                findings.append(_reached(advisory, call.symbol, call.span, None, check, entry))
         return findings
 
 
@@ -73,7 +74,12 @@ def _read_through(symbol: SymbolId) -> Iterator[SymbolId]:
 
 
 def _reached(
-    advisory: Advisory, symbol: SymbolId, span: SourceSpan, function: str | None, check: ConditionCheck
+    advisory: Advisory,
+    symbol: SymbolId,
+    span: SourceSpan,
+    function: str | None,
+    check: ConditionCheck,
+    entry: AdvisoryEntryPoint | None,
 ) -> Finding:
     return Finding(
         rule_id="reachable-vulnerability",
@@ -85,5 +91,5 @@ def _reached(
         confidence=Confidence.HIGH,
         span=span,
         function=function,
-        metadata=evidence(advisory, symbol, "reachable", check),
+        metadata=evidence(advisory, symbol, "reachable", check, entry),
     )

coretrace_python/bundled/dependency/vulnerable_dependency/vulnerable_dependency.py

@@ -7,7 +7,13 @@ from typing import ClassVar
 
 from coretrace_python.analysis import AnyAnalysis
 from coretrace_python.dependency import DependencyAnalysis
-from coretrace_python.dependency.correlation import affected_symbols, check_conditions, ruled_out
+from coretrace_python.dependency.correlation import (
+    affected_entries,
+    affected_symbols,
+    check_conditions,
+    ruled_out,
+    suffix_index,
+)
 from coretrace_python.findings import Confidence, Finding
 from coretrace_python.interprocedural import CallGraphAnalysis, ExternalSymbol
 from coretrace_python.plugins import ProjectContext, ProjectPlugin
@@ -57,6 +63,7 @@ def _ruled_out(ctx: ProjectContext) -> dict[str, list[str]]:
     conditions: the evidence that the requirement, imported, is not reached there."""
 
     affected = affected_symbols(ctx.dependencies, ctx.advisories)
+    suffixes = suffix_index(affected, ctx.modules)
     excluded: dict[str, list[str]] = {}
     for module in sorted(ctx.modules):
         graph = ctx.call_graph(module)
@@ -64,8 +71,8 @@ def _ruled_out(ctx: ProjectContext) -> dict[str, list[str]]:
             for site in graph.sites(function):
                 if not isinstance(site.target, ExternalSymbol):
                     continue
-                for advisory in affected.get(site.target.symbol, ()):
-                    check = check_conditions(advisory.entry_point(site.target.symbol), site.arguments)
+                for advisory, entry in affected_entries(site.target.symbol, affected, suffixes):
+                    check = check_conditions(entry, site.arguments, prior_calls=site.prior_calls)
                     if check.contradicted is not None:
                         excluded.setdefault(advisory.id, []).append(ruled_out(module, site, check))
     return excluded

coretrace_python/cache.py

@@ -34,6 +34,7 @@ from coretrace_python.interprocedural import (
     ModuleGraph,
     Mutation,
     NonlocalWrite,
+    PriorCall,
     SummaryIndex,
     SymbolRead,
     Target,
@@ -42,7 +43,7 @@ from coretrace_python.interprocedural import (
 from coretrace_python.semantic.symbols import SymbolId
 from coretrace_python.source import SourceId, SourceSpan
 
-CACHE_FORMAT = 12
+CACHE_FORMAT = 13
 
 
 @dataclass(frozen=True)
@@ -351,18 +352,33 @@ def _encode_site(site: CallSite) -> dict[str, Any]:
         "location": _encode_span(site.location),
         "target": _encode_target(site.target),
         "arguments": _encode_arguments(site.arguments),
+        "prior": None
+        if site.prior_calls is None
+        else [
+            [str(p.symbol), _encode_span(p.location), _encode_arguments(p.arguments), p.dominates]
+            for p in site.prior_calls
+        ],
     }
 
 
 def _decode_site(data: Mapping[str, Any]) -> CallSite:
+    prior = data["prior"]
     return CallSite(
         _string(data["caller"]),
         _decode_span(data["location"]),
         _decode_target(data["target"]),
         _decode_arguments(data["arguments"]),
+        None if prior is None else tuple(_decode_prior(entry) for entry in prior),
     )
 
 
+def _decode_prior(data: Any) -> PriorCall:
+    symbol, span, arguments, dominates = data
+    if not isinstance(dominates, bool):
+        raise TypeError(f"expected a boolean, got {dominates!r}")
+    return PriorCall(SymbolId(_string(symbol)), _decode_span(span), _decode_arguments(arguments), dominates)
+
+
 def _encode_arguments(arguments: Arguments) -> dict[str, Any]:
     return {
         "positional": list(arguments.positional),

coretrace_python/dependency/advisories.py

@@ -6,7 +6,7 @@ events into a version specifier; ``dump_advisories`` writes them as a small JSON
 that a project keeps at its root as ``advisories.json`` or passes with ``--advisories``.
 OSV records name no affected APIs, so imported advisories feed the requirement checks
 and the SBOM; a file completed by hand with ``affected_symbols``, ``entry_points`` and
-their ``conditions`` also feeds the reachability and correlation checks.
+their ``conditions`` and ``suffixes`` also feeds the reachability and correlation checks.
 """
 
 from __future__ import annotations
@@ -161,6 +161,8 @@ def _entry_point_entry(entry_point: AdvisoryEntryPoint) -> dict[str, Any]:
     }
     if entry_point.read:
         entry["read"] = True
+    if entry_point.suffixes:
+        entry["suffixes"] = list(entry_point.suffixes)
     if entry_point.attacker_arguments:
         entry["attacker_arguments"] = [_attacker_argument_entry(a) for a in entry_point.attacker_arguments]
     return entry
@@ -187,6 +189,10 @@ def _condition_entry(condition: Condition) -> dict[str, Any]:
         entry["position"] = condition.position
     if condition.default:
         entry["default"] = True
+    if condition.present:
+        entry["present"] = True
+    if condition.method is not None:
+        entry["method"] = condition.method
     return entry
 
 
@@ -226,9 +232,20 @@ def _entry_point(entry: Mapping[str, Any]) -> AdvisoryEntryPoint:
         tuple(_condition(c) for c in entry.get("conditions") or []),
         read,
         tuple(_attacker_argument(a) for a in entry.get("attacker_arguments") or []),
+        tuple(_suffix(s) for s in entry.get("suffixes") or []),
     )
 
 
+def _suffix(value: Any) -> str:
+    if not isinstance(value, str):
+        raise TypeError(f"an entry point suffix must be a string, got {value!r}")
+    parts = value.split(".")
+    # A single name (``annotate``) would match every project method of that name.
+    if len(parts) < 2 or not all(p.isidentifier() for p in parts):
+        raise ValueError(f"an entry point suffix is at least two dot-separated names, got {value!r}")
+    return value
+
+
 def _attacker_argument(entry: Mapping[str, Any]) -> AttackerArgument:
     argument, position, variadic = entry.get("argument"), entry.get("position"), entry.get("variadic", False)
     if argument is not None and not isinstance(argument, str):
@@ -251,6 +268,9 @@ def _condition(entry: Mapping[str, Any]) -> Condition:
     default = entry.get("default", False)
     if not isinstance(default, bool):
         raise TypeError(f"condition default must be true or false, got {default!r}")
+    present = entry.get("present", False)
+    if not isinstance(present, bool):
+        raise TypeError(f"condition present must be true or false, got {present!r}")
     condition = Condition(
         str(entry["kind"]),
         str(entry["text"]),
@@ -258,7 +278,22 @@ def _condition(entry: Mapping[str, Any]) -> Condition:
         tuple(str(v) for v in entry.get("values") or []),
         position,
         default,
+        present,
+        None if entry.get("method") is None else str(entry["method"]),
     )
+    if condition.present and (
+        condition.kind != "argument"
+        or (condition.argument is None and condition.position is None)
+        or condition.values
+        or condition.default
+    ):
+        raise ValueError("a present condition names the argument that must be passed, by keyword or position, and nothing else")
+    if condition.kind == "sequence" and not condition.method:
+        raise ValueError("a sequence condition names the method of the prior call")
+    if condition.kind == "sequence" and condition.values and condition.argument is None:
+        raise ValueError("the values of a sequence condition need the argument they constrain")
+    if condition.kind != "sequence" and condition.method is not None:
+        raise ValueError(f"only a sequence condition names a method, not {condition.kind!r}")
     if condition.kind == "host" and (
         (condition.argument is None and condition.position is None) or condition.values or condition.default
     ):

coretrace_python/dependency/correlation.py

@@ -21,9 +21,9 @@ from coretrace_python.dependency.graph import (
 )
 from coretrace_python.findings import Confidence, Finding, Severity
 from coretrace_python.findings.refutation import Status, Verdict, Verdicts
-from coretrace_python.interprocedural import Arguments, CallSite, ExternalSymbol
+from coretrace_python.interprocedural import Arguments, CallSite, ExternalSymbol, PriorCall
 from coretrace_python.semantic.symbols import SymbolId
-from coretrace_python.taint import KEYWORD_NAMES, Sink, TaintFlow, TaintKind
+from coretrace_python.taint import KEYWORD_NAMES, Sink, SuffixSink, TaintFlow, TaintKind
 from coretrace_python.taint.urls import UrlProof, redirects_disabled
 
 Affected = Mapping[SymbolId, tuple[Advisory, ...]]
@@ -49,6 +49,56 @@ def advisory_sinks(affected: Affected) -> tuple[Sink, ...]:
     return tuple(Sink(symbol, TaintKind.ADVISORY) for symbol in affected)
 
 
+@dataclass(frozen=True)
+class SuffixIndex:
+    """The curated entry-point suffixes of the matching advisories, and the project's
+    module prefixes: a derived symbol matches a suffix on a dot boundary, as a
+    ``SuffixSink`` does, and only when it belongs to a project module — another
+    package's ``objects.annotate`` stays out."""
+
+    entries: tuple[tuple[str, Advisory, AdvisoryEntryPoint], ...] = ()
+    prefixes: tuple[str, ...] = ()
+
+    def matches(self, symbol: SymbolId) -> tuple[tuple[Advisory, AdvisoryEntryPoint], ...]:
+        name = symbol.canonical_name
+        found = tuple((a, e) for tail, a, e in self.entries if name.endswith(tail))
+        return found if found and name.startswith(self.prefixes) else ()
+
+
+def suffix_index(affected: Affected, modules: Iterable[str]) -> SuffixIndex:
+    advisories = {a: None for found in affected.values() for a in found}
+    entries = tuple((f".{s}", a, e) for a in advisories for e in a.entry_points for s in e.suffixes)
+    return SuffixIndex(entries, tuple(f"python.{m}." for m in sorted(set(modules))))
+
+
+def affected_entries(
+    symbol: SymbolId, affected: Affected, suffixes: SuffixIndex | None = None
+) -> tuple[tuple[Advisory, AdvisoryEntryPoint | None], ...]:
+    """The advisories reached through ``symbol``, each with the entry point it is reached
+    by: the advisories affecting the exact symbol, then those a suffix matches."""
+
+    found: list[tuple[Advisory, AdvisoryEntryPoint | None]] = [
+        (a, a.entry_point(symbol)) for a in affected.get(symbol, ())
+    ]
+    if suffixes is not None:
+        seen = {(a.id, a.package, None if e is None else e.symbol) for a, e in found}
+        for advisory, entry in suffixes.matches(symbol):
+            key = (advisory.id, advisory.package, entry.symbol)
+            if key not in seen:
+                seen.add(key)
+                found.append((advisory, entry))
+    return tuple(found)
+
+
+def advisory_suffix_sinks(affected: Affected) -> tuple[SuffixSink, ...]:
+    """A suffix sink per curated entry-point suffix, so the taint engine tracks flows
+    into the derived symbols; ``correlate`` then keeps only the project's."""
+
+    advisories = {a: None for found in affected.values() for a in found}
+    suffixes = {s: None for a in advisories for e in a.entry_points for s in e.suffixes}
+    return tuple(SuffixSink(s, TaintKind.ADVISORY) for s in suffixes)
+
+
 @dataclass(frozen=True)
 class ConditionCheck:
     """What one call tells of an entry point's conditions: those it meets, those left to
@@ -67,6 +117,7 @@ def check_conditions(
     arguments: Arguments | None,
     url: UrlProof | None = None,
     passed_as: frozenset[tuple[int | None, str | None]] = frozenset(),
+    prior_calls: tuple[PriorCall, ...] | None = None,
 ) -> ConditionCheck:
     """Decide ``entry``'s conditions against what the call's ``arguments`` denote and, for
     a ``host`` condition, what ``url`` proves of the value the attacker's input is passed
@@ -75,7 +126,15 @@ def check_conditions(
     controls, and the condition stays pending with that uncertainty. A ``keyword_name``
     condition is met when the attacker's input is passed as the keys of a ``**`` mapping,
     pending when the call expands a mapping whose keys are not established, and
-    contradicted by a call writing every keyword name."""
+    contradicted by a call writing every keyword name. An ``argument`` condition with
+    ``present`` is met when the call gives the argument, whatever it denotes, and
+    contradicted when the call surely does not give it. A ``sequence`` condition is met
+    when one of the ``prior_calls`` on the call's receiver dominates it — surely executes
+    before it — matches the condition's method and passes what it requires; contradicted
+    when the receiver is followed whole and no matching call could do so, the call's own
+    ``arguments`` included, since across the iterations of a loop the call is its own
+    prior; pending otherwise — an unfollowed receiver (``prior_calls`` is None), an
+    undecided or non-dominating matching call, or an undecidable self-check."""
 
     if entry is None:
         return ConditionCheck()
@@ -101,10 +160,40 @@ def check_conditions(
                 text = f"the host is fixed by {origin!r}, but a redirect may lead to a host the attacker controls"
                 pending.append(replace(condition, text=text))
             continue
+        if condition.kind == "sequence":
+            candidates = [
+                p
+                for p in prior_calls or ()
+                if condition.method is not None and _named(p.symbol, condition.method)
+            ]
+            satisfied = [_first_call_satisfies(condition, p.arguments) for p in candidates]
+            hit = next(
+                (p for p, s in zip(candidates, satisfied, strict=True) if s is True and p.dominates), None
+            )
+            if hit is not None:
+                text = f"{condition.text} (prior {condition.method} at line {hit.location.start_line})"
+                met.append(replace(condition, text=text))
+            elif (
+                prior_calls is None
+                or condition.method is None
+                or None in satisfied
+                or True in satisfied
+                or _first_call_satisfies(condition, arguments) is not False
+            ):
+                pending.append(condition)
+            else:
+                return ConditionCheck(tuple(met), tuple(pending), condition, None)
+            continue
         given = arguments.given(condition.argument, condition.position) if condition.checkable and arguments is not None else None
         if given is None:
             pending.append(condition)
             continue
+        if condition.present:
+            if given[0]:
+                met.append(condition)
+            else:
+                return ConditionCheck(tuple(met), tuple(pending), condition, None)
+            continue
         explicit, value = given
         if explicit and value is None:
             pending.append(condition)
@@ -116,6 +205,32 @@ def check_conditions(
     return ConditionCheck(tuple(met), tuple(pending))
 
 
+def _named(symbol: SymbolId, method: str) -> bool:
+    """Whether ``symbol`` is the ``method`` a sequence condition names, by exact
+    canonical name or by ``.``-suffix (``Session.get``)."""
+
+    name = symbol.canonical_name
+    return name == method or name.endswith("." + method)
+
+
+def _first_call_satisfies(condition: Condition, arguments: Arguments | None) -> bool | None:
+    """Whether ``arguments`` carry what a sequence ``condition`` requires of the first
+    call: trivially when it names no argument, else as an argument condition reads
+    ``given()``; None when they cannot tell."""
+
+    if condition.argument is None and condition.position is None:
+        return True
+    if arguments is None:
+        return None
+    given = arguments.given(condition.argument, condition.position)
+    if given is None:
+        return None
+    explicit, value = given
+    if explicit and value is None:
+        return None
+    return value in condition.values if explicit else condition.default
+
+
 def _passed_in(condition: Condition, passed_as: frozenset[tuple[int | None, str | None]]) -> bool:
     """Whether a value passed as ``passed_as`` is the argument ``condition`` names."""
 
@@ -132,18 +247,31 @@ def ruled_out(module: str, site: CallSite, check: ConditionCheck) -> str:
 
     assert check.contradicted is not None and isinstance(site.target, ExternalSymbol)
     contradicted = check.contradicted
+    if contradicted.kind == "sequence":
+        return (
+            f"{module}:{site.location.start_line} {site.target.symbol}"
+            f"(no prior {contradicted.method} on the receiver)"
+        )
     argument = contradicted.argument or ("keywords" if contradicted.kind == "keyword_name" else f"#{contradicted.position}")
     passed = f"{argument} absent" if check.passed is None else f"{argument}={check.passed}"
     return f"{module}:{site.location.start_line} {site.target.symbol}({passed})"
 
 
-def evidence(advisory: Advisory, symbol: SymbolId, level: str, check: ConditionCheck) -> dict[str, str]:
+def evidence(
+    advisory: Advisory,
+    symbol: SymbolId,
+    level: str,
+    check: ConditionCheck,
+    entry: AdvisoryEntryPoint | None = None,
+) -> dict[str, str]:
     """What a finding keeps of the advisory for ``symbol``: the level of evidence
     established, how the symbol relates to the vulnerability, and its conditions — those
-    the call meets and those left to review."""
+    the call meets and those left to review. ``entry`` names the entry point ``symbol``
+    was matched by when it is not the advisory's own symbol, as a suffix match derives
+    it from the project; the metadata then keeps both."""
 
     metadata = {"advisory": advisory.id, "package": advisory.package, "symbol": str(symbol), "level": level}
-    entry = advisory.entry_point(symbol)
+    entry = entry if entry is not None else advisory.entry_point(symbol)
     if entry is None:
         metadata["justification"] = DIRECT
         return metadata
@@ -164,9 +292,12 @@ def correlate(
     verdicts: Verdicts | None,
     affected: Affected,
     urls: Mapping[TaintFlow, UrlProof] | None = None,
+    suffixes: SuffixIndex | None = None,
+    prior: Mapping[TaintFlow, tuple[PriorCall, ...] | None] | None = None,
 ) -> tuple[Finding, ...]:
     """Exploitable-vulnerability findings for the non-refuted ADVISORY flows of a function,
-    one per advisory the sink is affected by; ``urls`` holds what each flow's URL proves."""
+    one per advisory the sink is affected by; ``urls`` holds what each flow's URL proves
+    and ``prior`` the other calls on each flow's receiver, for sequence conditions."""
 
     findings: list[Finding] = []
     for flow in flows:
@@ -176,25 +307,32 @@ def correlate(
         if verdict is not None and verdict.status is Status.REFUTED:
             continue
         hotspot = verdict is not None and verdict.status is Status.HOTSPOT
-        for advisory in affected.get(flow.sink.symbol, ()):
-            entry = advisory.entry_point(flow.sink.symbol)
+        for advisory, entry in affected_entries(flow.sink.symbol, affected, suffixes):
             if entry is not None and not any(entry.exploitable_through(p, k) for p, k in flow.passed_as):
                 continue
-            check = check_conditions(entry, flow.sink_arguments, (urls or {}).get(flow), flow.passed_as)
+            check = check_conditions(
+                entry, flow.sink_arguments, (urls or {}).get(flow), flow.passed_as, (prior or {}).get(flow)
+            )
             if check.contradicted is None:
-                findings.append(_exploitable(function, flow, advisory, verdict, hotspot, check))
+                findings.append(_exploitable(function, flow, advisory, verdict, hotspot, check, entry))
     return tuple(findings)
 
 
 def _exploitable(
-    function: str, flow: TaintFlow, advisory: Advisory, verdict: Verdict | None, hotspot: bool, check: ConditionCheck
+    function: str,
+    flow: TaintFlow,
+    advisory: Advisory,
+    verdict: Verdict | None,
+    hotspot: bool,
+    check: ConditionCheck,
+    entry: AdvisoryEntryPoint | None,
 ) -> Finding:
     message = (
         f"{advisory.id}: {flow.source.label} input reaches {flow.sink.symbol}, affected in "
         f"the required {advisory.package} {advisory.vulnerable}: {advisory.summary}"
     )
     metadata = {
-        **evidence(advisory, flow.sink.symbol, "exploitable", check),
+        **evidence(advisory, flow.sink.symbol, "exploitable", check, entry),
         "source": str(flow.source.symbol),
         "source_label": flow.source.label,
         "verdict": "hotspot" if hotspot else "vulnerability",

coretrace_python/dependency/graph.py

@@ -151,13 +151,21 @@ class Condition:
     ``argument`` condition names the argument by keyword, and by ``position`` when it may
     be passed positionally, and lists the ``values`` that satisfy it — symbols
     (``python.yaml.FullLoader``) or constants as Python writes them (``True``);
-    ``default`` says an absent argument means a vulnerable value. A ``host`` condition
+    ``default`` says an absent argument means a vulnerable value; ``present`` says the
+    argument being passed at all, whatever its value, is the condition, so it excludes
+    ``values`` and ``default``. A ``host`` condition
     says the attacker must choose the host of the URL passed as ``argument`` (or at
     ``position``); the engine decides it from what the URL's constant text proves. A
     ``keyword_name`` condition says the attacker must choose a keyword name of the call,
     as an ORM alias expanded from a mapping; the engine decides it from the keys of what
-    the call expands with ``**``. A ``semantic`` condition cannot be checked and is
-    reported as pending review."""
+    the call expands with ``**``. A ``sequence`` condition says the flaw needs a prior
+    call on the same receiver: it names the ``method`` that call must be, by canonical
+    name or ``.``-suffix, and, when ``argument`` is named, what it must pass, as an
+    argument condition does. It is met when such a call dominates the entry call —
+    surely executes before it — matches ``method`` and passes a value in ``values``
+    (``default`` for an absent argument); contradicted when the receiver is fully
+    followed and no such prior call can precede; pending otherwise. A ``semantic``
+    condition cannot be checked and is reported as pending review."""
 
     kind: str
     text: str
@@ -165,6 +173,8 @@ class Condition:
     values: tuple[str, ...] = ()
     position: int | None = None
     default: bool = False
+    present: bool = False
+    method: str | None = None
 
     @property
     def checkable(self) -> bool:
@@ -204,13 +214,19 @@ class AdvisoryEntryPoint:
     An entry point is reached by a call, or — when ``read`` is set, for an attribute whose
     getter runs the affected code, such as a lazily parsed request body — by any read of
     it or of an attribute of it. When it names ``attacker_arguments``, attacker input
-    exploits it only through one of them; otherwise through any argument."""
+    exploits it only through one of them; otherwise through any argument.
+
+    A suffix names the tail of a derived project symbol through which the entry point is
+    reached when the engine cannot type the receiver: ``Item.objects.annotate`` derives
+    ``python.app.models.Item.objects.annotate``, which ``objects.annotate`` matches.
+    Suffixes match on dot boundaries, and only symbols of the project's own modules."""
 
     symbol: SymbolId
     justification: str
     conditions: tuple[Condition, ...] = ()
     read: bool = False
     attacker_arguments: tuple[AttackerArgument, ...] = ()
+    suffixes: tuple[str, ...] = ()
 
     def exploitable_through(self, position: int | None, keyword: str | None) -> bool:
         """Whether attacker input in the argument at ``position`` or ``keyword`` can

coretrace_python/engine.py

@@ -53,9 +53,12 @@ from coretrace_python.dependency import (
 )
 from coretrace_python.dependency.correlation import (
     Affected,
+    SuffixIndex,
     advisory_sinks,
+    advisory_suffix_sinks,
     affected_symbols,
     correlate,
+    suffix_index,
 )
 from coretrace_python.findings import (
     ADVISORIES,
@@ -424,7 +427,9 @@ def analyze_project(
     components = _components(registry, root, (path for path, _ in file_advisories))
     advisories, origins = _merge_advisories(_contributions(registry, plugins, root, file_advisories))
     affected = affected_symbols(dependencies, advisories)
-    models = plugin_models(all_plugins, root).extended(*advisory_sinks(affected))
+    models = plugin_models(all_plugins, root).extended(
+        *advisory_sinks(affected), suffixes=advisory_suffix_sinks(affected)
+    )
     members = models.members_by_class()
     for manager in managers.values():
         manager.provide(SecurityModelAnalysis, models)
@@ -480,6 +485,7 @@ def analyze_project(
     reused = tuple(sorted(results))
 
     module_plugins = tuple(p for p in all_plugins if not isinstance(p, ProjectPlugin))
+    suffixes = suffix_index(affected, analysable)
     pool = None
     if jobs > 1:
         pool = concurrent.futures.ProcessPoolExecutor(
@@ -492,7 +498,9 @@ def analyze_project(
             if pool is None:
                 for component in pending:
                     batch = {name: analysable[name] for name in sorted(component)}
-                    computed.update(_analyse_managers(batch, _seed(results, graph, component), module_plugins, affected))
+                    computed.update(
+                        _analyse_managers(batch, _seed(results, graph, component), module_plugins, affected, suffixes)
+                    )
                     for manager in batch.values():
                         manager.run(ResultsEvicted)
             else:
@@ -509,6 +517,7 @@ def analyze_project(
                             _encode_routes(routes),
                             tuple(sorted(escaped)),
                             template_calls,
+                            project=tuple(sorted(analysable)),
                         ),
                     )
                     for component in pending
@@ -734,6 +743,7 @@ def _analyse_managers(
     seed: SummaryIndex,
     plugins: tuple[Plugin, ...],
     affected: Affected,
+    suffixes: SuffixIndex,
 ) -> dict[str, CachedModule]:
     """Analyse one component: iterate its summaries to a fixpoint over ``seed`` (§21),
     then extract what the rest of the run needs from each module. Each member registers
@@ -762,7 +772,7 @@ def _analyse_managers(
         for manager in managers.values():
             manager.run(ProjectSummariesUpdated)
             manager.provide(ProjectSummaries, index)
-    return {name: _analyse_module(manager, plugins, affected) for name, manager in managers.items()}
+    return {name: _analyse_module(manager, plugins, affected, suffixes) for name, manager in managers.items()}
 
 
 @dataclass(frozen=True)
@@ -780,6 +790,9 @@ class _Batch:
     routes: tuple[tuple[str, str, str, int], ...] = ()
     escaped: tuple[str, ...] = ()
     template_calls: TemplateCalls = field(default_factory=TemplateCalls)
+    # Every analysable module of the project, not only the component's: a curated
+    # entry-point suffix matches derived symbols of any project module.
+    project: tuple[str, ...] = ()
 
 
 def _analyse_batch(batch: _Batch) -> dict[str, dict[str, Any]]:
@@ -796,7 +809,9 @@ def _analyse_batch(batch: _Batch) -> dict[str, dict[str, Any]]:
             continue
     advisories, _ = _merge_advisories(_contributions(registry, batch.plugins, batch.root, file_advisories))
     affected = affected_symbols(dependencies, advisories)
-    models = plugin_models(all_plugins, batch.root).extended(*advisory_sinks(affected))
+    models = plugin_models(all_plugins, batch.root).extended(
+        *advisory_sinks(affected), suffixes=advisory_suffix_sinks(affected)
+    )
     routes = _decode_routes(batch.routes)
     escaped = frozenset(batch.escaped)
     members = models.members_by_class()
@@ -810,7 +825,8 @@ def _analyse_batch(batch: _Batch) -> dict[str, dict[str, Any]]:
         manager.provide(ClearingAnalysis, models.clearing(escaped))
         manager.provide(TemplateCallsAnalysis, batch.template_calls)
     module_plugins = tuple(p for p in all_plugins if not isinstance(p, ProjectPlugin))
-    results = _analyse_managers(managers, decode_index(batch.seed), module_plugins, affected)
+    suffixes = suffix_index(affected, batch.project)
+    results = _analyse_managers(managers, decode_index(batch.seed), module_plugins, affected, suffixes)
     return {name: encode(entry) for name, entry in results.items()}
 
 
@@ -860,7 +876,7 @@ def _configuration_key(
 
 
 def _analyse_module(
-    manager: AnalysisManager, plugins: tuple[Plugin, ...], affected: Affected
+    manager: AnalysisManager, plugins: tuple[Plugin, ...], affected: Affected, suffixes: SuffixIndex
 ) -> CachedModule:
     """One module's findings, summaries, call sites and symbol reads: what the cache
     keeps (§11)."""
@@ -875,8 +891,17 @@ def _analyse_module(
             ssa = manager.get(SSAAnalysis, function)
             defs = {i.result: i for block in ssa.blocks for i in block.instructions if i.result is not None}
             urls = {flow: flow_url(flow, defs, strings) for flow in flows if flow.kinds & TaintKind.ADVISORY}
+            name = graph.name_of(function)
+            # A flow through a callee reaches the sink at another call: no receiver here.
+            prior = {
+                flow: graph.prior_calls_at(name, flow.location)
+                for flow in flows
+                if flow.kinds & TaintKind.ADVISORY and flow.through is None
+            }
             correlated.extend(
-                correlate(graph.name_of(function), flows, manager.get(RefutationAnalysis, function), affected, urls)
+                correlate(
+                    name, flows, manager.get(RefutationAnalysis, function), affected, urls, suffixes, prior
+                )
             )
     return CachedModule(
         manager.get(EntryPointAnalysis),

coretrace_python/interprocedural/__init__.py

@@ -8,6 +8,7 @@ from coretrace_python.interprocedural.callgraph import (
     ExternalSymbol,
     KnownFunction,
     ModuleFunction,
+    PriorCall,
     Signature,
     SignaturesAnalysis,
     SymbolRead,
@@ -58,6 +59,7 @@ __all__ = [
     "ModuleGraph",
     "Mutation",
     "NonlocalWrite",
+    "PriorCall",
     "ProjectSummaries",
     "Signature",
     "SignaturesAnalysis",

coretrace_python/interprocedural/callgraph.py

@@ -11,12 +11,13 @@ from __future__ import annotations
 
 import re
 from collections.abc import Mapping
-from dataclasses import dataclass, field
+from dataclasses import dataclass, field, replace
 from types import MappingProxyType
 from typing import ClassVar
 
 from coretrace_python.analysis import Analysis, AnalysisContext, AnyAnalysis
-from coretrace_python.cfg import CFGError
+from coretrace_python.cfg import BlockId, CFGError
+from coretrace_python.cfg.dominance import DominanceAnalysis, DominatorTree
 from coretrace_python.hir import nodes
 from coretrace_python.ir.defuse import DefUse, def_use
 from coretrace_python.ir.lowering import (
@@ -27,6 +28,7 @@ from coretrace_python.ir.lowering import (
 )
 from coretrace_python.ir.model import (
     Await,
+    BasicBlock,
     BuildDict,
     Call,
     Constant,
@@ -93,12 +95,26 @@ class Arguments:
         return None if self.unpacked else (False, None)
 
 
+@dataclass(frozen=True)
+class PriorCall:
+    """Another call on the same receiver in this function; ``dominates`` says it surely
+    executes before this one."""
+
+    symbol: SymbolId
+    location: SourceSpan
+    arguments: Arguments
+    dominates: bool
+
+
 @dataclass(frozen=True)
 class CallSite:
     caller: str
     location: SourceSpan
     target: Target
     arguments: Arguments = field(default_factory=Arguments)
+    # None: no receiver, or one the engine cannot follow; a tuple is the complete set
+    # of other external calls on the receiver, in source order.
+    prior_calls: tuple[PriorCall, ...] | None = None
 
 
 @dataclass(frozen=True)
@@ -201,6 +217,13 @@ class CallGraph:
         site = self._at.get((caller, location))
         return site.arguments if site is not None else Arguments()
 
+    def prior_calls_at(self, caller: str, location: SourceSpan) -> tuple[PriorCall, ...] | None:
+        """The other calls on the receiver of the call at ``location`` in ``caller``;
+        None when there is no receiver, or one the engine cannot follow."""
+
+        site = self._at.get((caller, location))
+        return site.prior_calls if site is not None else None
+
     def callees(self, caller: str) -> frozenset[str]:
         return frozenset(
             site.target.name for site in self.sites(caller) if isinstance(site.target, KnownFunction)
@@ -335,6 +358,105 @@ def _position(span: SourceSpan) -> tuple[int, int]:
     return span.start_line, span.start_column
 
 
+# A receiver carrying more calls than this is left unfollowed: the sibling pairing
+# stays bounded, and such code is generated, not a client bound and used twice.
+MAX_RECEIVER_CALLS = 12
+
+
+def _relate_receivers(
+    sites: list[CallSite],
+    calls: list[tuple[Call, BlockId, int]],
+    function: FunctionIR,
+    defs: Mapping[Value, Instruction],
+    uses: DefUse,
+    symbols: Mapping[Value, SymbolId],
+    tree: DominatorTree,
+) -> tuple[CallSite, ...]:
+    """The ``sites`` with ``prior_calls`` filled wherever the receiver's whole lifetime
+    is visible, so the set of its other calls is complete and program order is decided
+    by dominance; any other receiver leaves ``None``. ``calls`` gives each site's
+    instruction with its block and index, aligned with ``sites``."""
+
+    groups: dict[Value, list[int]] = {}
+    for index, (call, _, _) in enumerate(calls):
+        callee = defs.get(call.callee)
+        if isinstance(callee, GetAttr):
+            groups.setdefault(callee.object, []).append(index)
+    related = list(sites)
+    blocks = {block.id: block for block in function.blocks}
+    for receiver, group in groups.items():
+        if not _followed(receiver, group, sites, blocks, defs, uses, symbols):
+            continue
+        ordered = sorted(group, key=lambda member: _position(sites[member].location))
+        for index in group:
+            _, block, at = calls[index]
+            related[index] = replace(
+                sites[index],
+                prior_calls=tuple(
+                    PriorCall(
+                        target.symbol,
+                        sites[other].location,
+                        sites[other].arguments,
+                        _executes_before(calls[other], block, at, tree),
+                    )
+                    for other in ordered
+                    if other != index and isinstance(target := sites[other].target, ExternalSymbol)
+                ),
+            )
+    return tuple(related)
+
+
+def _followed(
+    receiver: Value,
+    group: list[int],
+    sites: list[CallSite],
+    blocks: Mapping[BlockId, BasicBlock],
+    defs: Mapping[Value, Instruction],
+    uses: DefUse,
+    symbols: Mapping[Value, SymbolId],
+) -> bool:
+    """Whether the receiver's whole lifetime is visible: bound once to the result of a
+    call or a ``with`` denoting a symbol, and read only to call external methods. Only
+    then is ``group`` complete enough to claim a prior call surely missing; a receiver
+    returned, passed to another call, mutated through an attribute or merged by a
+    ``Phi`` may be called elsewhere, and stays unfollowed."""
+
+    if len(group) > MAX_RECEIVER_CALLS or receiver not in symbols:
+        return False
+    if any(not isinstance(sites[index].target, ExternalSymbol) for index in group):
+        return False
+    made = defs.get(receiver)
+    while isinstance(made, Await):
+        made = defs.get(made.value)
+    if not isinstance(made, Call | WithEnter):
+        return False
+    for use in uses.uses(receiver):
+        if use.index is None:  # a terminator use, as a return, escapes
+            return False
+        read = blocks[use.block].instructions[use.index]
+        if not isinstance(read, GetAttr):
+            return False
+        for called in uses.uses(read.result):
+            if called.index is None:
+                return False
+            call = blocks[called.block].instructions[called.index]
+            if not isinstance(call, Call) or call.callee != read.result or read.result in call.argument_values():
+                return False
+    return True
+
+
+def _executes_before(
+    other: tuple[Call, BlockId, int], block: BlockId, index: int, tree: DominatorTree
+) -> bool:
+    """Whether ``other`` surely executes before the call at ``index`` in ``block``: it
+    comes earlier in the same block, or its block dominates this one."""
+
+    _, other_block, other_index = other
+    if other_block == block:
+        return other_index < index
+    return tree.dominates(other_block, block)
+
+
 def resolve_targets(
     function: FunctionIR,
     scopes: ScopeTable,
@@ -471,7 +593,7 @@ def _typed_with_module_classes(
 class CallGraphAnalysis(Analysis[CallGraph]):
     name: ClassVar[str] = "interprocedural.callgraph"
     requires: ClassVar[frozenset[AnyAnalysis]] = frozenset(
-        {SSAAnalysis, ScopeAnalysis, SymbolAnalysis, SignaturesAnalysis}
+        {SSAAnalysis, ScopeAnalysis, SymbolAnalysis, SignaturesAnalysis, DominanceAnalysis}
     )
 
     @classmethod
@@ -537,8 +659,9 @@ class CallGraphAnalysis(Analysis[CallGraph]):
             defs = {i.result: i for block in ssa.blocks for i in block.instructions if i.result is not None}
             uses = def_use(ssa)
             found: list[CallSite] = []
+            calls: list[tuple[Call, BlockId, int]] = []
             for block in ssa.blocks:
-                for instruction in block.instructions:
+                for index, instruction in enumerate(block.instructions):
                     if isinstance(instruction, Call):
                         found.append(
                             CallSite(
@@ -548,6 +671,9 @@ class CallGraphAnalysis(Analysis[CallGraph]):
                                 _arguments(instruction, symbols[name], defs, uses),
                             )
                         )
-            sites[name] = tuple(found)
+                        calls.append((instruction, block.id, index))
+            sites[name] = _relate_receivers(
+                found, calls, ssa, defs, uses, symbols[name], ctx.get(DominanceAnalysis, function)
+            )
             reads[name] = _reads(name, ssa, symbols[name])
         return CallGraph(definitions, sites, frozenset(unsupported), symbols, reads)

coretrace_python/taint/models.py

@@ -356,20 +356,23 @@ class ModelTable:
         return None
 
     def sink(self, symbol: SymbolId) -> Sink | None:
+        # An exact sink and the matching suffix sinks compose: an advisory sink on a
+        # derived symbol must not shadow ``objects.extra``'s SQL kind, nor conversely.
         found = self._by_symbol[Sink].get(symbol)
-        if isinstance(found, Sink):
-            return found
+        merged = found if isinstance(found, Sink) else None
         for suffix in self.suffix_sinks:
             if symbol.canonical_name.endswith(f".{suffix.suffix}"):
-                return Sink(symbol, suffix.kinds, suffix.positions)
-        return None
+                matched = Sink(symbol, suffix.kinds, suffix.positions)
+                merged = matched if merged is None else merged.merged(matched)
+        return merged
 
     def route_registrar(self, symbol: SymbolId) -> RouteRegistrar | None:
         found = self._by_symbol[RouteRegistrar].get(symbol)
         return found if isinstance(found, RouteRegistrar) else None
 
-    def extended(self, *sinks: Sink) -> ModelTable:
-        """A table with extra sinks; a sink already present gains the new kinds."""
+    def extended(self, *sinks: Sink, suffixes: tuple[SuffixSink, ...] = ()) -> ModelTable:
+        """A table with extra sinks and suffix sinks; a sink already present gains the
+        new kinds, a suffix sink already present is kept once."""
 
         merged = {sink.symbol: sink for sink in self.sinks}
         for sink in sinks:
@@ -385,7 +388,7 @@ class ModelTable:
             self.authorizations,
             self.named_parameters,
             self.route_registrars,
-            self.suffix_sinks,
+            self.suffix_sinks + tuple(s for s in suffixes if s not in self.suffix_sinks),
             self.safe_arguments,
             self.template_renders,
             self.members,

{coretrace_python_analyzer-0.20.0.dist-info → coretrace_python_analyzer-0.21.0.dist-info}/METADATA

@@ -1,6 +1,6 @@
 Metadata-Version: 2.5
 Name: coretrace-python-analyzer
-Version: 0.20.0
+Version: 0.21.0
 Summary: Static security analysis infrastructure for Python code
 Project-URL: Homepage, https://github.com/CoreTrace/coretrace-python-analyzer
 Project-URL: Repository, https://github.com/CoreTrace/coretrace-python-analyzer

{coretrace_python_analyzer-0.20.0.dist-info → coretrace_python_analyzer-0.21.0.dist-info}/RECORD

@@ -1,8 +1,8 @@
-coretrace_python/__init__.py,sha256=CxDlOASpblTY0nlvktbHjBs1Ntjlqj8ulKKg0N6LV6c,76
+coretrace_python/__init__.py,sha256=qxOYJ7AnuZXOGjD8kgEwDnqkaV4dOwzK_MuofIgTfc4,76
 coretrace_python/__main__.py,sha256=V8DnYtRboISK2VCKm7DGHLREKvqLbqApyWlKBOs26wU,65
-coretrace_python/cache.py,sha256=cXDJvi0GqEGwC9lK6TH_nMYIH64sgbZUToQMnf5lAA0,13908
+coretrace_python/cache.py,sha256=yrwI4echBNdOOJpfRMiZMeiUrnnP-dN4AHLwjUu6uSo,14559
 coretrace_python/cli.py,sha256=G5jhb6g6RgSRSjjS7DBgziIjUM1vTFwalJGvFHVKxrg,11225
-coretrace_python/engine.py,sha256=i_YckOVHZa_Mcwxgi2jsMkw8O49zHFQZ313mA_Xtl-4,37643
+coretrace_python/engine.py,sha256=NJZDfoEfPis0U4wm06vCqLFptdAv1s7V0IAvGdC6ujU,38676
 coretrace_python/abstract/__init__.py,sha256=UK1yHTU4fldnW0W-e-nyPEOsqCnXqGPVv7LkxfyBMII,1021
 coretrace_python/abstract/constants.py,sha256=z4-e7IzysxzGi58wFFff1MlEoV8l7AZsB9EL-q6b7vY,9071
 coretrace_python/abstract/heap.py,sha256=uJAA0bYnN3-4fdESo6o4CzlYJSIpwlFLoyccacN6Uk8,9831
@@ -15,11 +15,11 @@ coretrace_python/analysis/provider.py,sha256=Q_OlEcoLzBAsNdAGWijbj_n3E2Ep5UQ4Z8_
 coretrace_python/bundled/dependency/dependency_policy/dependency_policy.py,sha256=_CJYHijv4DTgfdumcCqAVV5_MPWjfZOadxeM5pQdw_k,1845
 coretrace_python/bundled/dependency/dependency_policy/plugin.toml,sha256=4w1TA-UKsa82WTnd1xy4bJuU3_G2RNCAWNICLPcZLMk,210
 coretrace_python/bundled/dependency/reachable_vulnerability/plugin.toml,sha256=LuF9jQqZfplN_GBky69Xjq2pksaX1Fs8PYEir-7-vY8,275
-coretrace_python/bundled/dependency/reachable_vulnerability/reachable_vulnerability.py,sha256=G6JfE-7gipA_0etgno0XZ-PeRdzdcGzZ3OiKD0P8nyA,4219
+coretrace_python/bundled/dependency/reachable_vulnerability/reachable_vulnerability.py,sha256=5hNA3UoCULDXgKC3gBIQOKD1oeEe_qZ3V-2y5vkmPsI,4362
 coretrace_python/bundled/dependency/sample_advisories/plugin.toml,sha256=cME4pSFzkFsxmIJGGBSrmXqynAd0dg34X-rgEoZ_u6E,184
 coretrace_python/bundled/dependency/sample_advisories/sample_advisories.py,sha256=jw98GK6hh5RAx05t8QPcUzsFMfGigAL8418vZLprKlc,3710
 coretrace_python/bundled/dependency/vulnerable_dependency/plugin.toml,sha256=4-OnbEb3lYVAoTfuz8mDPH4L9fHOPQ2KW1dDFAbClFk,267
-coretrace_python/bundled/dependency/vulnerable_dependency/vulnerable_dependency.py,sha256=THXqpuffQZ8nuv1b8zQrgkA7eTI1PxhODATMzqhWeyY,3393
+coretrace_python/bundled/dependency/vulnerable_dependency/vulnerable_dependency.py,sha256=KT9L5GHUV6EsOb9sEnbKpwPx5hwpzxp2hC5RJ9G1ldc,3523
 coretrace_python/bundled/models/aiohttp/aiohttp_models.py,sha256=X3ZYgbrezHbsP3D9rVt-qM1_Iecu6nT_Yz9H7-XGl4M,3422
 coretrace_python/bundled/models/aiohttp/plugin.toml,sha256=YvU60RUBexYBtIxbXdmUhO83BoijmOe3MeQKwY8QDaM,220
 coretrace_python/bundled/models/bottle/bottle_models.py,sha256=Y0SUMCNGiGhzcMj0uxBLhCbLFgM7sBc4XBB-C5LEuDw,2200
@@ -94,9 +94,9 @@ coretrace_python/dataflow/__init__.py,sha256=N5uY8VTNjEk6-ARCgDkxr6uGqQIz2NbF-U9
 coretrace_python/dataflow/lattice.py,sha256=HgYGVcKVUlexvEc0yT47aQCudLxU_SWLpHhr17igkiE,1929
 coretrace_python/dataflow/solver.py,sha256=iDsW0wujhM2DXplu2JMKC46BRsroXlNETHPEoikPeG4,3475
 coretrace_python/dependency/__init__.py,sha256=BxkxnNwIEpAYtwbshCQovG-YXJ80QbwyzkmyJdbgsVg,1184
-coretrace_python/dependency/advisories.py,sha256=t1BKlfGx6GkPd0BNAWjli8-bIJj347A5zvfuWPO4rlw,10818
-coretrace_python/dependency/correlation.py,sha256=HsERzPR9A5NceRNh1dnNUO5B7saJFdXz0TrhI3c8IzY,9855
-coretrace_python/dependency/graph.py,sha256=ZaDSy1h3H4AS8kwGHV768wYf_R4KcqDnxzDQMsoIa88,18847
+coretrace_python/dependency/advisories.py,sha256=ktGkMWJifjCQotP3ulJ5xK2IasDmMoox2gsne-AwwHU,12649
+coretrace_python/dependency/correlation.py,sha256=Z6GNsDK7Ji7E5xyZcJtinNdEQQToO9FbmV6ojDKwov0,16124
+coretrace_python/dependency/graph.py,sha256=939KKNugO9ipdWlShOquwEefC5qif5JbaRNstj50XkE,19971
 coretrace_python/dependency/policy.py,sha256=bsxZXL9xC0jnAzkzDh6ncnW8oKLG2H13jYmXF_q99Ng,2454
 coretrace_python/dependency/sbom.py,sha256=rzJ-t0Mwoghej8nk0N63Dpjr_wYXm6JzuOPXjD8Kqs4,3234
 coretrace_python/dependency/vex.py,sha256=bafWyziWWQP-Fjw1bvyOcOPsdFMwKy-sjMGWL7IPY3w,8048
@@ -113,8 +113,8 @@ coretrace_python/frontend/parser.py,sha256=6-CG7rWxUYeOGeDP206SJWy4BMQUP9Mr6Jf-t
 coretrace_python/hir/__init__.py,sha256=xMpvj-RSp6bd78a_hhkqbe99-snjERkH-_Lv5o9ASbw,180
 coretrace_python/hir/nodes.py,sha256=4BI0f3UhKbnz9ZIxMoKXM7ujav0BmRpD0OXaoblRxIk,12364
 coretrace_python/hir/visitors.py,sha256=JFnX09hK6trLyRcWgZ5ehOG2ywX3VvkqQ1h82nahYNg,885
-coretrace_python/interprocedural/__init__.py,sha256=q8u1eIpM55wqVtn46cxuymOn5D5DWU7K35i8Nzzbc3w,1604
-coretrace_python/interprocedural/callgraph.py,sha256=a4LNbp8ZboIgwkNgWIzYHipS1yHwXvgQy33ariECRcE,24452
+coretrace_python/interprocedural/__init__.py,sha256=Wq0ipLA3pqoKoHgCSqYJPMJtLKkJdhrQQGhEVbBG5jE,1636
+coretrace_python/interprocedural/callgraph.py,sha256=1vpzDscTI2mq0l3Xq7Cqgv7QEoZ49ILdPpDkaO_EJBE,29667
 coretrace_python/interprocedural/modulegraph.py,sha256=xKlO_L2mcZi0RoG9h2ulacYecqUhM5BG1RrdC6_HUk8,13036
 coretrace_python/interprocedural/summaries.py,sha256=6lybEynjtptZGGBw_3WKXx9ZZZqN96xL-r-tzo8fbMI,33862
 coretrace_python/ir/__init__.py,sha256=ShBPYYqoQFePP-mgBjGezQ2acel0-ReOHF9vCC-G_4Q,232
@@ -145,13 +145,13 @@ coretrace_python/source/manager.py,sha256=JRmMOcWfS1nocbVrdcvfQTqEfIkmnb5JP857Tp
 coretrace_python/source/model.py,sha256=FZnN5mlir3tzbIpWoxnn6YtRi9UcJ_y0sZM60tKr8U4,1727
 coretrace_python/taint/__init__.py,sha256=Da0nmvrxm9uKsmQogtHdc-FRrWo_xxpnLBDCSQ-xp9g,1867
 coretrace_python/taint/engine.py,sha256=NvGhkBpBviCKE0BGHlgEgKacKC55fSxjwUwkaBz7pkk,54415
-coretrace_python/taint/models.py,sha256=pCvE-6dYKYSLK7pylxhLWpeUcMfMyXlh_1VUJbzieo8,20405
+coretrace_python/taint/models.py,sha256=Rzi6fSVEfNC913NDB9y5sR4kraZPKR7D4qRLAURMm_c,20827
 coretrace_python/taint/routes.py,sha256=UAJKXcw_sM9shf58FfDroxVO9bNSm4qrQdZknwUB0lo,6110
 coretrace_python/taint/templates.py,sha256=gUpUvVk_UIVY2a3T5ENm2TfBuPCDhnu2lu8h50srZ4Q,43963
 coretrace_python/taint/urls.py,sha256=kb0-uOT12ww7R3Jzs_lPKg9lFs74JI-bpa9pXX105xM,3166
-coretrace_python_analyzer-0.20.0.dist-info/METADATA,sha256=iC4jLQhKfefmmGcBpJSgaVFWY-SassLvisc6EoUtdz4,3217
-coretrace_python_analyzer-0.20.0.dist-info/WHEEL,sha256=W3fkpkm7-wf9vBI5Z-7s0eWkeM-spu78I8Neb98DeEg,87
-coretrace_python_analyzer-0.20.0.dist-info/entry_points.txt,sha256=wdozemiraOkbt65g_Y_zgspuZpoLxJdaCVMJt1Ft3c0,72
-coretrace_python_analyzer-0.20.0.dist-info/licenses/LICENSE,sha256=z8d0m5b2O9McPEK1xHG_dWgUBT6EfBDz6wA0F7xSPTA,11358
-coretrace_python_analyzer-0.20.0.dist-info/licenses/NOTICE,sha256=s3VHj5ngV0ozjW_kZJpg_35ne6JwoBK0ysOjbqVtA0w,113
-coretrace_python_analyzer-0.20.0.dist-info/RECORD,,
+coretrace_python_analyzer-0.21.0.dist-info/METADATA,sha256=znaywXU-dm6Y2uyWG9vgT4CGZFC-V25w9k5fIxzsFDE,3217
+coretrace_python_analyzer-0.21.0.dist-info/WHEEL,sha256=W3fkpkm7-wf9vBI5Z-7s0eWkeM-spu78I8Neb98DeEg,87
+coretrace_python_analyzer-0.21.0.dist-info/entry_points.txt,sha256=wdozemiraOkbt65g_Y_zgspuZpoLxJdaCVMJt1Ft3c0,72
+coretrace_python_analyzer-0.21.0.dist-info/licenses/LICENSE,sha256=z8d0m5b2O9McPEK1xHG_dWgUBT6EfBDz6wA0F7xSPTA,11358
+coretrace_python_analyzer-0.21.0.dist-info/licenses/NOTICE,sha256=s3VHj5ngV0ozjW_kZJpg_35ne6JwoBK0ysOjbqVtA0w,113
+coretrace_python_analyzer-0.21.0.dist-info/RECORD,,