coretrace-python-analyzer 0.20.0__py3-none-any.whl → 0.22.0__py3-none-any.whl

coretrace_python/__init__.py

@@ -1,4 +1,4 @@
 """CoreTrace's Python static analysis frontend."""
 
-__version__ = "0.20.0"
+__version__ = "0.22.0"
 

coretrace_python/bundled/dependency/reachable_vulnerability/reachable_vulnerability.py

@@ -8,12 +8,14 @@ from collections.abc import Iterator, Sequence
 from typing import ClassVar
 
 from coretrace_python.analysis import AnyAnalysis
-from coretrace_python.dependency import Advisory, DependencyAnalysis
+from coretrace_python.dependency import Advisory, AdvisoryEntryPoint, DependencyAnalysis
 from coretrace_python.dependency.correlation import (
     ConditionCheck,
+    affected_entries,
     affected_symbols,
     check_conditions,
     evidence,
+    suffix_index,
 )
 from coretrace_python.findings import Confidence, Finding
 from coretrace_python.interprocedural import CallGraphAnalysis, ExternalSymbol
@@ -30,6 +32,7 @@ class ReachableVulnerabilityPlugin(ProjectPlugin):
         affected = affected_symbols(ctx.dependencies, ctx.advisories)
         if not affected:
             return ()
+        suffixes = suffix_index(affected, ctx.modules)
         findings: list[Finding] = []
         for module in ctx.modules:
             graph = ctx.call_graph(module)
@@ -37,30 +40,28 @@ class ReachableVulnerabilityPlugin(ProjectPlugin):
                 for site in graph.sites(function):
                     if not isinstance(site.target, ExternalSymbol):
                         continue
-                    for advisory in affected.get(site.target.symbol, ()):
-                        entry = advisory.entry_point(site.target.symbol)
+                    for advisory, entry in affected_entries(site.target.symbol, affected, suffixes):
                         if entry is not None and entry.read:
                             continue  # a call reads its callee first: reported with the reads
-                        check = check_conditions(entry, site.arguments)
+                        check = check_conditions(entry, site.arguments, prior_calls=site.prior_calls)
                         if check.contradicted is not None:
                             continue
-                        findings.append(_reached(advisory, site.target.symbol, site.location, function, check))
+                        findings.append(_reached(advisory, site.target.symbol, site.location, function, check, entry))
                 # Reading ``request.form.get`` reads ``request.form``: one finding per entry
                 # point and function, where the function first reads it.
                 reported: set[tuple[Advisory, SymbolId]] = set()
                 for read in graph.reads(function):
                     for symbol in _read_through(read.symbol):
-                        for advisory in affected.get(symbol, ()):
-                            entry = advisory.entry_point(symbol)
+                        for advisory, entry in affected_entries(symbol, affected, suffixes):
                             if entry is None or not entry.read or (advisory, symbol) in reported:
                                 continue
                             reported.add((advisory, symbol))
                             check = check_conditions(entry, None)
-                            findings.append(_reached(advisory, symbol, read.location, function, check))
+                            findings.append(_reached(advisory, symbol, read.location, function, check, entry))
         for call in ctx.templates.calls:
-            for advisory in affected.get(call.symbol, ()):
-                check = check_conditions(advisory.entry_point(call.symbol), None)
-                findings.append(_reached(advisory, call.symbol, call.span, None, check))
+            for advisory, entry in affected_entries(call.symbol, affected, suffixes):
+                check = check_conditions(entry, None)
+                findings.append(_reached(advisory, call.symbol, call.span, None, check, entry))
         return findings
 
 
@@ -73,7 +74,12 @@ def _read_through(symbol: SymbolId) -> Iterator[SymbolId]:
 
 
 def _reached(
-    advisory: Advisory, symbol: SymbolId, span: SourceSpan, function: str | None, check: ConditionCheck
+    advisory: Advisory,
+    symbol: SymbolId,
+    span: SourceSpan,
+    function: str | None,
+    check: ConditionCheck,
+    entry: AdvisoryEntryPoint | None,
 ) -> Finding:
     return Finding(
         rule_id="reachable-vulnerability",
@@ -85,5 +91,5 @@ def _reached(
         confidence=Confidence.HIGH,
         span=span,
         function=function,
-        metadata=evidence(advisory, symbol, "reachable", check),
+        metadata=evidence(advisory, symbol, "reachable", check, entry),
     )

coretrace_python/bundled/dependency/vulnerable_dependency/vulnerable_dependency.py

@@ -3,11 +3,18 @@
 from __future__ import annotations
 
 from collections.abc import Sequence
+from pathlib import PurePath
 from typing import ClassVar
 
 from coretrace_python.analysis import AnyAnalysis
-from coretrace_python.dependency import DependencyAnalysis
-from coretrace_python.dependency.correlation import affected_symbols, check_conditions, ruled_out
+from coretrace_python.dependency import Advisory, DependencyAnalysis, Requirement
+from coretrace_python.dependency.correlation import (
+    affected_entries,
+    affected_symbols,
+    check_conditions,
+    ruled_out,
+    suffix_index,
+)
 from coretrace_python.findings import Confidence, Finding
 from coretrace_python.interprocedural import CallGraphAnalysis, ExternalSymbol
 from coretrace_python.plugins import ProjectContext, ProjectPlugin
@@ -38,11 +45,7 @@ class VulnerableDependencyPlugin(ProjectPlugin):
                 findings.append(
                     Finding(
                         rule_id="vulnerable-dependency",
-                        message=(
-                            f"{advisory.id}: {advisory.package} {advisory.vulnerable} is "
-                            f"{'required' if pinned else 'allowed'} by {requirement.name}"
-                            f"{requirement.specifier or ''}: {advisory.summary}"
-                        ),
+                        message=_message(ctx, advisory, requirement),
                         severity=advisory.severity,
                         confidence=Confidence.HIGH if pinned else Confidence.MEDIUM,
                         span=requirement.span,
@@ -52,11 +55,32 @@ class VulnerableDependencyPlugin(ProjectPlugin):
         return findings
 
 
+def _message(ctx: ProjectContext, advisory: Advisory, requirement: Requirement) -> str:
+    """The evidence: for a locked package, the version the lock file pins and the
+    packages that require it; for a declared requirement, the specifier that allows or
+    requires a vulnerable version."""
+
+    if requirement.locked is None:
+        verb = "required" if requirement.pinned is not None else "allowed"
+        return (
+            f"{advisory.id}: {advisory.package} {advisory.vulnerable} is {verb} by "
+            f"{requirement.name}{requirement.specifier or ''}: {advisory.summary}"
+        )
+    lock = PurePath(str(requirement.span.source_id)).name
+    dependents = sorted(ctx.dependencies.required_by(requirement.name) or ())
+    required = f" (required by {', '.join(dependents)})" if dependents else ""
+    return (
+        f"{advisory.id}: {advisory.package} {requirement.locked}, pinned in {lock}, "
+        f"is in {advisory.vulnerable}{required}: {advisory.summary}"
+    )
+
+
 def _ruled_out(ctx: ProjectContext) -> dict[str, list[str]]:
     """By advisory, the calls to its entry points whose arguments contradict one of its
     conditions: the evidence that the requirement, imported, is not reached there."""
 
     affected = affected_symbols(ctx.dependencies, ctx.advisories)
+    suffixes = suffix_index(affected, ctx.modules)
     excluded: dict[str, list[str]] = {}
     for module in sorted(ctx.modules):
         graph = ctx.call_graph(module)
@@ -64,8 +88,8 @@ def _ruled_out(ctx: ProjectContext) -> dict[str, list[str]]:
             for site in graph.sites(function):
                 if not isinstance(site.target, ExternalSymbol):
                     continue
-                for advisory in affected.get(site.target.symbol, ()):
-                    check = check_conditions(advisory.entry_point(site.target.symbol), site.arguments)
+                for advisory, entry in affected_entries(site.target.symbol, affected, suffixes):
+                    check = check_conditions(entry, site.arguments, prior_calls=site.prior_calls)
                     if check.contradicted is not None:
                         excluded.setdefault(advisory.id, []).append(ruled_out(module, site, check))
     return excluded