coretrace-python-analyzer 0.23.0__py3-none-any.whl → 0.25.0__py3-none-any.whl

coretrace_python/__init__.py

@@ -1,4 +1,4 @@
 """CoreTrace's Python static analysis frontend."""
 
-__version__ = "0.23.0"
+__version__ = "0.25.0"
 

coretrace_python/bundled/dependency/dependency_policy/dependency_policy.py

@@ -2,17 +2,27 @@
 
 from __future__ import annotations
 
-from collections.abc import Sequence
+from collections.abc import Mapping, Sequence
 from typing import ClassVar
 
 from coretrace_python.analysis import AnyAnalysis
 from coretrace_python.dependency import DependencyAnalysis
-from coretrace_python.findings import Confidence, Finding, Severity
+from coretrace_python.findings import Confidence, Finding, RuleDescription, Severity
 from coretrace_python.plugins import ProjectContext, ProjectPlugin
 
 
 class DependencyPolicyPlugin(ProjectPlugin):
     name: ClassVar[str] = "dependency-policy"
+    rules: ClassVar[Mapping[str, RuleDescription]] = {
+        "denied-dependency": RuleDescription(
+            "Denied dependency",
+            "A requirement on a package the policy denies.",
+        ),
+        "unpinned-dependency": RuleDescription(
+            "Unpinned dependency",
+            "A requirement without an exact pin, when the policy requires pins.",
+        ),
+    }
     requires: ClassVar[frozenset[AnyAnalysis]] = frozenset({DependencyAnalysis})
 
     def analyze_project(self, ctx: ProjectContext) -> Sequence[Finding]:

coretrace_python/bundled/dependency/reachable_vulnerability/reachable_vulnerability.py

@@ -4,7 +4,7 @@ template applies is a call to the function behind it, at the template's line."""
 
 from __future__ import annotations
 
-from collections.abc import Iterator, Sequence
+from collections.abc import Iterator, Mapping, Sequence
 from typing import ClassVar
 
 from coretrace_python.analysis import AnyAnalysis
@@ -17,7 +17,7 @@ from coretrace_python.dependency.correlation import (
     evidence,
     suffix_index,
 )
-from coretrace_python.findings import Confidence, Finding
+from coretrace_python.findings import Confidence, Finding, RuleDescription
 from coretrace_python.interprocedural import CallGraphAnalysis, ExternalSymbol
 from coretrace_python.plugins import ProjectContext, ProjectPlugin
 from coretrace_python.semantic.symbols import SymbolId
@@ -26,6 +26,12 @@ from coretrace_python.source import SourceSpan
 
 class ReachableVulnerabilityPlugin(ProjectPlugin):
     name: ClassVar[str] = "reachable-vulnerability"
+    rules: ClassVar[Mapping[str, RuleDescription]] = {
+        "reachable-vulnerability": RuleDescription(
+            "Reachable dependency vulnerability",
+            "The project calls an API that an advisory of a vulnerable requirement affects.",
+        ),
+    }
     requires: ClassVar[frozenset[AnyAnalysis]] = frozenset({DependencyAnalysis, CallGraphAnalysis})
 
     def analyze_project(self, ctx: ProjectContext) -> Sequence[Finding]:

coretrace_python/bundled/dependency/vulnerable_dependency/vulnerable_dependency.py

@@ -2,7 +2,7 @@
 
 from __future__ import annotations
 
-from collections.abc import Sequence
+from collections.abc import Mapping, Sequence
 from pathlib import PurePath
 from typing import ClassVar
 
@@ -15,13 +15,19 @@ from coretrace_python.dependency.correlation import (
     ruled_out,
     suffix_index,
 )
-from coretrace_python.findings import Confidence, Finding
+from coretrace_python.findings import Confidence, Finding, RuleDescription
 from coretrace_python.interprocedural import CallGraphAnalysis, ExternalSymbol
 from coretrace_python.plugins import ProjectContext, ProjectPlugin
 
 
 class VulnerableDependencyPlugin(ProjectPlugin):
     name: ClassVar[str] = "vulnerable-dependency"
+    rules: ClassVar[Mapping[str, RuleDescription]] = {
+        "vulnerable-dependency": RuleDescription(
+            "Vulnerable dependency",
+            "A requirement allows a version that an advisory affects.",
+        ),
+    }
     requires: ClassVar[frozenset[AnyAnalysis]] = frozenset({DependencyAnalysis, CallGraphAnalysis})
 
     def analyze_project(self, ctx: ProjectContext) -> Sequence[Finding]:

coretrace_python/bundled/security/code_injection/code_injection.py

@@ -18,11 +18,12 @@ runs depends on what the object exposes, a hotspot."""
 
 from __future__ import annotations
 
+from collections.abc import Mapping
 from typing import ClassVar
 
 from coretrace_python.abstract.strings import ModuleStringsAnalysis, leading_text
 from coretrace_python.analysis import AnyAnalysis
-from coretrace_python.findings import Severity
+from coretrace_python.findings import RuleDescription, Severity
 from coretrace_python.findings.refutation import Status, Verdict
 from coretrace_python.hir import nodes
 from coretrace_python.ir.ssa import SSAAnalysis
@@ -42,6 +43,12 @@ _GETATTR = SymbolId("python.builtins.getattr")
 
 class CodeInjectionPlugin(TaintDetector):
     name: ClassVar[str] = "code-injection"
+    rules: ClassVar[Mapping[str, RuleDescription]] = {
+        "code-injection": RuleDescription(
+            "Code injection",
+            "Attacker-controlled data chooses code that runs: the code eval or exec runs, the module an import loads, the script runpy runs, or the attribute getattr selects and the program calls.",
+        ),
+    }
     rule_id: ClassVar[str] = "code-injection"
     kind: ClassVar[TaintKind] = TaintKind.CODE
     severity: ClassVar[Severity] = Severity.HIGH

coretrace_python/bundled/security/command_injection/command_injection.py

@@ -36,7 +36,7 @@ from typing import ClassVar
 
 from coretrace_python.abstract.strings import ModuleStringsAnalysis, leading_text
 from coretrace_python.analysis import AnyAnalysis
-from coretrace_python.findings import Severity
+from coretrace_python.findings import RuleDescription, Severity
 from coretrace_python.findings.refutation import Status, Verdict
 from coretrace_python.hir import nodes
 from coretrace_python.interprocedural import Arguments
@@ -398,6 +398,12 @@ class _Operands:
 
 class CommandInjectionPlugin(TaintDetector):
     name: ClassVar[str] = "command-injection"
+    rules: ClassVar[Mapping[str, RuleDescription]] = {
+        "command-injection": RuleDescription(
+            "Command injection",
+            "Attacker-controlled data reaches a shell or process execution (os.system, subprocess, ...) where it can run or choose a command.",
+        ),
+    }
     rule_id: ClassVar[str] = "command-injection"
     kind: ClassVar[TaintKind] = TaintKind.COMMAND
     severity: ClassVar[Severity] = Severity.HIGH

coretrace_python/bundled/security/insecure_deserialization/insecure_deserialization.py

@@ -2,15 +2,22 @@
 
 from __future__ import annotations
 
+from collections.abc import Mapping
 from typing import ClassVar
 
-from coretrace_python.findings import Severity
+from coretrace_python.findings import RuleDescription, Severity
 from coretrace_python.plugins import TaintDetector
 from coretrace_python.taint import TaintKind
 
 
 class InsecureDeserializationPlugin(TaintDetector):
     name: ClassVar[str] = "insecure-deserialization"
+    rules: ClassVar[Mapping[str, RuleDescription]] = {
+        "insecure-deserialization": RuleDescription(
+            "Insecure deserialization",
+            "Attacker-controlled data reaches a deserializer that can build arbitrary objects or run code: pickle, marshal, dill, jsonpickle, shelve, or a YAML loader without a safe loader.",
+        ),
+    }
     rule_id: ClassVar[str] = "insecure-deserialization"
     kind: ClassVar[TaintKind] = TaintKind.DESERIALIZATION
     severity: ClassVar[Severity] = Severity.CRITICAL

coretrace_python/bundled/security/nosql_injection/nosql_injection.py

@@ -5,15 +5,22 @@ sink; model plugins declare them."""
 
 from __future__ import annotations
 
+from collections.abc import Mapping
 from typing import ClassVar
 
-from coretrace_python.findings import Severity
+from coretrace_python.findings import RuleDescription, Severity
 from coretrace_python.plugins import TaintDetector
 from coretrace_python.taint import TaintKind
 
 
 class NoSqlInjectionPlugin(TaintDetector):
     name: ClassVar[str] = "nosql-injection"
+    rules: ClassVar[Mapping[str, RuleDescription]] = {
+        "nosql-injection": RuleDescription(
+            "NoSQL injection",
+            "Attacker input that may hold a structure, such as a JSON body, reaches a NoSQL query, where an operator such as {\"$ne\": null} matches any value.",
+        ),
+    }
     rule_id: ClassVar[str] = "nosql-injection"
     kind: ClassVar[TaintKind] = TaintKind.NOSQL
     severity: ClassVar[Severity] = Severity.HIGH

coretrace_python/bundled/security/open_redirect/open_redirect.py

@@ -10,11 +10,12 @@ unproven, ``"/" + next`` included, stays a vulnerability.
 
 from __future__ import annotations
 
+from collections.abc import Mapping
 from typing import ClassVar
 
 from coretrace_python.abstract.strings import ModuleStringsAnalysis
 from coretrace_python.analysis import AnyAnalysis
-from coretrace_python.findings import Severity
+from coretrace_python.findings import RuleDescription, Severity
 from coretrace_python.findings.refutation import Status, Verdict
 from coretrace_python.hir import nodes
 from coretrace_python.ir.ssa import SSAAnalysis
@@ -25,6 +26,12 @@ from coretrace_python.taint.urls import flow_url
 
 class OpenRedirectPlugin(TaintDetector):
     name: ClassVar[str] = "open-redirect"
+    rules: ClassVar[Mapping[str, RuleDescription]] = {
+        "open-redirect": RuleDescription(
+            "Open redirect",
+            "Attacker-controlled data chooses the target of an HTTP redirect, which can send the user to another site.",
+        ),
+    }
     rule_id: ClassVar[str] = "open-redirect"
     kind: ClassVar[TaintKind] = TaintKind.REDIRECT
     severity: ClassVar[Severity] = Severity.MEDIUM

coretrace_python/bundled/security/path_traversal/path_traversal.py

@@ -2,15 +2,22 @@
 
 from __future__ import annotations
 
+from collections.abc import Mapping
 from typing import ClassVar
 
-from coretrace_python.findings import Severity
+from coretrace_python.findings import RuleDescription, Severity
 from coretrace_python.plugins import TaintDetector
 from coretrace_python.taint import TaintKind
 
 
 class PathTraversalPlugin(TaintDetector):
     name: ClassVar[str] = "path-traversal"
+    rules: ClassVar[Mapping[str, RuleDescription]] = {
+        "path-traversal": RuleDescription(
+            "Path traversal",
+            "Attacker-controlled data reaches a file system path (open, send_file, os.remove, ...).",
+        ),
+    }
     rule_id: ClassVar[str] = "path-traversal"
     kind: ClassVar[TaintKind] = TaintKind.PATH
     severity: ClassVar[Severity] = Severity.HIGH

coretrace_python/bundled/security/plaintext_credentials/plaintext_credentials.py

@@ -5,15 +5,22 @@ a hint, so medium confidence."""
 
 from __future__ import annotations
 
+from collections.abc import Mapping
 from typing import ClassVar
 
-from coretrace_python.findings import Confidence, Severity
+from coretrace_python.findings import Confidence, RuleDescription, Severity
 from coretrace_python.plugins import TaintDetector
 from coretrace_python.taint import TaintKind
 
 
 class PlaintextCredentialsPlugin(TaintDetector):
     name: ClassVar[str] = "plaintext-credentials"
+    rules: ClassVar[Mapping[str, RuleDescription]] = {
+        "plaintext-credential-storage": RuleDescription(
+            "Plaintext credential storage",
+            "A parameter named like a password is stored in a database without hashing.",
+        ),
+    }
     rule_id: ClassVar[str] = "plaintext-credential-storage"
     kind: ClassVar[TaintKind] = TaintKind.CREDENTIAL
     severity: ClassVar[Severity] = Severity.HIGH

coretrace_python/bundled/security/sql_injection/sql_injection.py

@@ -2,15 +2,22 @@
 
 from __future__ import annotations
 
+from collections.abc import Mapping
 from typing import ClassVar
 
-from coretrace_python.findings import Severity
+from coretrace_python.findings import RuleDescription, Severity
 from coretrace_python.plugins import TaintDetector
 from coretrace_python.taint import TaintKind
 
 
 class SqlInjectionPlugin(TaintDetector):
     name: ClassVar[str] = "sql-injection"
+    rules: ClassVar[Mapping[str, RuleDescription]] = {
+        "sql-injection": RuleDescription(
+            "SQL injection",
+            "Attacker-controlled data reaches a database statement (cursor.execute, SQLAlchemy text, Django raw, ...) rather than a query parameter.",
+        ),
+    }
     rule_id: ClassVar[str] = "sql-injection"
     kind: ClassVar[TaintKind] = TaintKind.SQL
     severity: ClassVar[Severity] = Severity.HIGH

coretrace_python/bundled/security/ssrf/ssrf.py

@@ -10,11 +10,12 @@ a base of unknown value or a URL built in a helper function, stays a vulnerabili
 
 from __future__ import annotations
 
+from collections.abc import Mapping
 from typing import ClassVar
 
 from coretrace_python.abstract.strings import ModuleStringsAnalysis
 from coretrace_python.analysis import AnyAnalysis
-from coretrace_python.findings import Severity
+from coretrace_python.findings import RuleDescription, Severity
 from coretrace_python.findings.refutation import Status, Verdict
 from coretrace_python.hir import nodes
 from coretrace_python.ir.ssa import SSAAnalysis
@@ -25,6 +26,12 @@ from coretrace_python.taint.urls import flow_url, redirects_disabled
 
 class SsrfPlugin(TaintDetector):
     name: ClassVar[str] = "ssrf"
+    rules: ClassVar[Mapping[str, RuleDescription]] = {
+        "ssrf": RuleDescription(
+            "Server-side request forgery",
+            "Attacker-controlled data reaches the destination of an HTTP client request (Requests, httpx, urllib).",
+        ),
+    }
     rule_id: ClassVar[str] = "ssrf"
     kind: ClassVar[TaintKind] = TaintKind.SSRF
     severity: ClassVar[Severity] = Severity.HIGH

coretrace_python/bundled/security/xss/xss.py

@@ -2,15 +2,22 @@
 
 from __future__ import annotations
 
+from collections.abc import Mapping
 from typing import ClassVar
 
-from coretrace_python.findings import Severity
+from coretrace_python.findings import RuleDescription, Severity
 from coretrace_python.plugins import TaintDetector
 from coretrace_python.taint import TaintKind
 
 
 class XssPlugin(TaintDetector):
     name: ClassVar[str] = "xss"
+    rules: ClassVar[Mapping[str, RuleDescription]] = {
+        "xss": RuleDescription(
+            "Cross-site scripting",
+            "Attacker-controlled data reaches an HTTP response body built without escaping.",
+        ),
+    }
     rule_id: ClassVar[str] = "xss"
     kind: ClassVar[TaintKind] = TaintKind.HTML
     severity: ClassVar[Severity] = Severity.HIGH

coretrace_python/bundled/syntax/dangerous_eval/dangerous_eval.py

@@ -2,15 +2,22 @@
 
 from __future__ import annotations
 
+from collections.abc import Mapping
 from typing import ClassVar
 
-from coretrace_python.findings import Severity
+from coretrace_python.findings import RuleDescription, Severity
 from coretrace_python.plugins import SymbolCallDetector
 from coretrace_python.semantic.symbols import SymbolId
 
 
 class DangerousEvalPlugin(SymbolCallDetector):
     name: ClassVar[str] = "dangerous-eval"
+    rules: ClassVar[Mapping[str, RuleDescription]] = {
+        "dangerous-eval": RuleDescription(
+            "Dynamic code execution",
+            "A call to eval or exec, whatever name the file gives them.",
+        ),
+    }
     rule_id: ClassVar[str] = "dangerous-eval"
     symbols: ClassVar[frozenset[SymbolId]] = frozenset(
         {SymbolId("python.builtins.eval"), SymbolId("python.builtins.exec")}

coretrace_python/bundled/syntax/flask_debug/flask_debug.py

@@ -2,11 +2,11 @@
 
 from __future__ import annotations
 
-from collections.abc import Iterator, Sequence
+from collections.abc import Iterator, Mapping, Sequence
 from typing import ClassVar
 
 from coretrace_python.analysis import AnyAnalysis
-from coretrace_python.findings import Confidence, Finding, Severity
+from coretrace_python.findings import Confidence, Finding, RuleDescription, Severity
 from coretrace_python.hir import nodes
 from coretrace_python.hir.visitors import Node, children
 from coretrace_python.plugins import Plugin, PluginContext
@@ -18,6 +18,12 @@ RUN = SymbolId("python.flask.Flask.run")
 
 class FlaskDebugPlugin(Plugin):
     name: ClassVar[str] = "flask-debug"
+    rules: ClassVar[Mapping[str, RuleDescription]] = {
+        "debug-enabled": RuleDescription(
+            "Debug mode enabled",
+            "A Flask application run with debug=True, which exposes an interactive debugger.",
+        ),
+    }
     requires: ClassVar[frozenset[AnyAnalysis]] = frozenset({ScopeAnalysis, SymbolAnalysis})
 
     def analyze(self, ctx: PluginContext) -> Sequence[Finding]:

coretrace_python/bundled/syntax/insecure_tempfile/insecure_tempfile.py

@@ -3,10 +3,11 @@ create it first. ``mkstemp``, ``NamedTemporaryFile`` and ``TemporaryDirectory``
 
 from __future__ import annotations
 
+from collections.abc import Mapping
 from typing import ClassVar
 
 from coretrace_python.analysis import AnyAnalysis
-from coretrace_python.findings import Severity
+from coretrace_python.findings import RuleDescription, Severity
 from coretrace_python.interprocedural import CallGraphAnalysis
 from coretrace_python.ir.ssa import SSAAnalysis
 from coretrace_python.plugins import SymbolCallDetector
@@ -15,6 +16,12 @@ from coretrace_python.semantic.symbols import SymbolId
 
 class InsecureTempFilePlugin(SymbolCallDetector):
     name: ClassVar[str] = "insecure-temp-file"
+    rules: ClassVar[Mapping[str, RuleDescription]] = {
+        "insecure-temp-file": RuleDescription(
+            "Insecure temporary file",
+            "tempfile.mktemp, which names a file without creating it, so that another process can create it first.",
+        ),
+    }
     rule_id: ClassVar[str] = "insecure-temp-file"
     requires: ClassVar[frozenset[AnyAnalysis]] = frozenset({SSAAnalysis, CallGraphAnalysis})
     symbols: ClassVar[frozenset[SymbolId]] = frozenset({SymbolId("python.tempfile.mktemp")})

coretrace_python/bundled/syntax/insecure_tls/insecure_tls.py

@@ -7,7 +7,7 @@ from collections.abc import Mapping
 from typing import ClassVar
 
 from coretrace_python.analysis import AnyAnalysis
-from coretrace_python.findings import Severity
+from coretrace_python.findings import RuleDescription, Severity
 from coretrace_python.interprocedural import CallGraphAnalysis
 from coretrace_python.ir.model import Call, Constant, Instruction, Value
 from coretrace_python.ir.ssa import SSAAnalysis
@@ -24,6 +24,12 @@ UNVERIFIED = frozenset({SymbolId("python.ssl._create_unverified_context")})
 
 class InsecureTlsPlugin(SymbolCallDetector):
     name: ClassVar[str] = "insecure-tls"
+    rules: ClassVar[Mapping[str, RuleDescription]] = {
+        "insecure-tls": RuleDescription(
+            "TLS certificate verification disabled",
+            "verify=False on a Requests or httpx call, or ssl._create_unverified_context(), which accept any certificate.",
+        ),
+    }
     rule_id: ClassVar[str] = "insecure-tls"
     requires: ClassVar[frozenset[AnyAnalysis]] = frozenset({SSAAnalysis, CallGraphAnalysis})
     symbols: ClassVar[frozenset[SymbolId]] = HTTP_CALLS | UNVERIFIED

coretrace_python/bundled/syntax/missing_timeout/missing_timeout.py

@@ -2,11 +2,11 @@
 
 from __future__ import annotations
 
-from collections.abc import Sequence
+from collections.abc import Mapping, Sequence
 from typing import ClassVar
 
 from coretrace_python.analysis import AnyAnalysis
-from coretrace_python.findings import Confidence, Finding, Severity
+from coretrace_python.findings import Confidence, Finding, RuleDescription, Severity
 from coretrace_python.interprocedural import CallGraphAnalysis
 from coretrace_python.ir.model import Call
 from coretrace_python.ir.ssa import SSAAnalysis
@@ -20,6 +20,12 @@ HTTP_CALLS = frozenset(SymbolId(f"python.{caller}.{method}") for caller in _CALL
 
 class MissingTimeoutPlugin(Plugin):
     name: ClassVar[str] = "missing-timeout"
+    rules: ClassVar[Mapping[str, RuleDescription]] = {
+        "missing-timeout": RuleDescription(
+            "HTTP request without a timeout",
+            "A Requests or httpx call without a timeout, which can wait forever.",
+        ),
+    }
     requires: ClassVar[frozenset[AnyAnalysis]] = frozenset({SSAAnalysis, CallGraphAnalysis})
 
     def analyze(self, ctx: PluginContext) -> Sequence[Finding]:

coretrace_python/bundled/syntax/unsafe_archive/unsafe_archive.py

@@ -7,7 +7,7 @@ from collections.abc import Mapping
 from typing import ClassVar
 
 from coretrace_python.analysis import AnyAnalysis
-from coretrace_python.findings import Severity
+from coretrace_python.findings import RuleDescription, Severity
 from coretrace_python.interprocedural import CallGraphAnalysis
 from coretrace_python.ir.model import Call, Instruction, Value
 from coretrace_python.ir.ssa import SSAAnalysis
@@ -20,6 +20,12 @@ _EXTRACTORS = tuple(f"{opener}.{method}" for opener in _OPENERS for method in ("
 
 class UnsafeArchivePlugin(SymbolCallDetector):
     name: ClassVar[str] = "unsafe-archive-extraction"
+    rules: ClassVar[Mapping[str, RuleDescription]] = {
+        "unsafe-archive-extraction": RuleDescription(
+            "Unsafe archive extraction",
+            "A tarfile or zipfile extraction, or shutil.unpack_archive, without a member filter: a member can be written outside the destination.",
+        ),
+    }
     rule_id: ClassVar[str] = "unsafe-archive-extraction"
     requires: ClassVar[frozenset[AnyAnalysis]] = frozenset({SSAAnalysis, CallGraphAnalysis})
     symbols: ClassVar[frozenset[SymbolId]] = frozenset(

coretrace_python/bundled/syntax/unsafe_xml/unsafe_xml.py

@@ -19,7 +19,7 @@ from typing import ClassVar
 
 from coretrace_python.abstract.strings import ModuleStringsAnalysis
 from coretrace_python.analysis import AnyAnalysis
-from coretrace_python.findings import Confidence, Severity
+from coretrace_python.findings import Confidence, RuleDescription, Severity
 from coretrace_python.interprocedural import CallGraphAnalysis
 from coretrace_python.ir.model import Call, Constant, Global, Instruction, Value
 from coretrace_python.ir.ssa import SSAAnalysis
@@ -64,6 +64,12 @@ def _resolve_entities(call: Call, defs: Mapping[Value, Instruction]) -> object:
 
 class UnsafeXmlPlugin(SymbolCallDetector):
     name: ClassVar[str] = "unsafe-xml"
+    rules: ClassVar[Mapping[str, RuleDescription]] = {
+        "unsafe-xml": RuleDescription(
+            "Unsafe XML parser",
+            "An XML parser of the standard library or of lxml, exposed to the entities a document declares; defusedxml is the safe replacement.",
+        ),
+    }
     rule_id: ClassVar[str] = "unsafe-xml"
     requires: ClassVar[frozenset[AnyAnalysis]] = frozenset({SSAAnalysis, CallGraphAnalysis, ModuleStringsAnalysis})
     symbols: ClassVar[frozenset[SymbolId]] = _STANDARD_LIBRARY | _LXML | _LXML_UNTIL_6_1

coretrace_python/bundled/syntax/weak_crypto/weak_crypto.py

@@ -2,15 +2,22 @@
 
 from __future__ import annotations
 
+from collections.abc import Mapping
 from typing import ClassVar
 
-from coretrace_python.findings import Severity
+from coretrace_python.findings import RuleDescription, Severity
 from coretrace_python.plugins import SymbolCallDetector
 from coretrace_python.semantic.symbols import SymbolId
 
 
 class WeakCryptoPlugin(SymbolCallDetector):
     name: ClassVar[str] = "weak-crypto"
+    rules: ClassVar[Mapping[str, RuleDescription]] = {
+        "weak-crypto": RuleDescription(
+            "Weak cryptographic algorithm",
+            "A broken algorithm such as hashlib.md5 or hashlib.sha1.",
+        ),
+    }
     rule_id: ClassVar[str] = "weak-crypto"
     symbols: ClassVar[frozenset[SymbolId]] = frozenset(
         {SymbolId("python.hashlib.md5"), SymbolId("python.hashlib.sha1")}

coretrace_python/bundled/syntax/weak_random/weak_random.py

@@ -7,11 +7,11 @@ produces one."""
 from __future__ import annotations
 
 import re
-from collections.abc import Iterator, Sequence
+from collections.abc import Iterator, Mapping, Sequence
 from typing import ClassVar
 
 from coretrace_python.analysis import AnyAnalysis
-from coretrace_python.findings import Confidence, Finding, Severity
+from coretrace_python.findings import Confidence, Finding, RuleDescription, Severity
 from coretrace_python.hir import nodes
 from coretrace_python.hir.visitors import Node, children
 from coretrace_python.plugins import Plugin, PluginContext
@@ -25,6 +25,12 @@ CREDENTIAL = re.compile(r"(?i)(token|secret|password|passwd|api_?key|session|non
 
 class WeakRandomPlugin(Plugin):
     name: ClassVar[str] = "weak-random"
+    rules: ClassVar[Mapping[str, RuleDescription]] = {
+        "weak-random": RuleDescription(
+            "Weak random value for a credential",
+            "A value of the random module used as a credential; random is not cryptographically secure.",
+        ),
+    }
     rule_id: ClassVar[str] = "weak-random"
     requires: ClassVar[frozenset[AnyAnalysis]] = frozenset({ScopeAnalysis, SymbolAnalysis})
 

coretrace_python/cache.py

@@ -21,7 +21,7 @@ from pathlib import Path
 from types import MappingProxyType
 from typing import Any
 
-from coretrace_python.findings import Confidence, Finding, Severity
+from coretrace_python.findings import Confidence, Finding, RelatedLocation, Severity
 from coretrace_python.interprocedural import (
     Arguments,
     CallSite,
@@ -42,7 +42,11 @@ from coretrace_python.interprocedural import (
 from coretrace_python.semantic.symbols import SymbolId
 from coretrace_python.source import FileLocation, Location, SourceId, SourceSpan
 
-CACHE_FORMAT = 16
+# Cached summaries from earlier versions preserve unstable external-call
+# insertion order. They must be recomputed with canonical ordering (#261).
+# Findings carry their related locations from format 18 on (#271). A module's key holds
+# the names it is imported by from format 19 on (#264).
+CACHE_FORMAT = 19
 
 
 @dataclass(frozen=True)
@@ -227,6 +231,7 @@ def _encode_finding(finding: Finding) -> dict[str, Any]:
         "span": _encode_location(finding.span),
         "function": finding.function,
         "metadata": dict(finding.metadata),
+        "related": [[_encode_span(r.span), r.message] for r in finding.related],
     }
 
 
@@ -240,6 +245,7 @@ def _decode_finding(data: Mapping[str, Any]) -> Finding:
         _decode_location(data["span"]),
         None if function is None else _string(function),
         {_string(k): _string(v) for k, v in data["metadata"].items()},
+        tuple(RelatedLocation(_decode_span(span), _string(message)) for span, message in data["related"]),
     )
 
 

coretrace_python/cli.py

@@ -280,6 +280,7 @@ def main(argv: list[str] | None = None) -> int:
                 coverage = analysis.coverage
                 suppressed = analysis.suppressed
                 components = analysis.components
+                rules = analysis.rules
                 if args.sbom is not None:
                     args.sbom.write_text(
                         render_sbom(
@@ -307,6 +308,7 @@ def main(argv: list[str] | None = None) -> int:
                 findings, coverage = file_analysis.findings, file_analysis.coverage
                 suppressed = file_analysis.suppressed
                 components = ()
+                rules = file_analysis.rules
             baselined = None
             recorded = None
             if previous is not None:
@@ -317,7 +319,7 @@ def main(argv: list[str] | None = None) -> int:
             elif args.baseline is not None:
                 recorded = Baseline.of(findings, root, key)
                 findings, baselined = (), findings
-            report = engine.report(findings, coverage, root, suppressed, baselined, components)
+            report = engine.report(findings, coverage, root, suppressed, baselined, components, rules)
             text = render(args.format or "text", report)
             # Recorded once the report is rendered, so that a failed check keeps the
             # previous baseline.