PyPI - coretrace-python-analyzer - Versions diffs - 0.3.0__tar.gz → 0.5.0__tar.gz - Mend

coretrace-python-analyzer 0.3.0tar.gz → 0.5.0tar.gz

This diff represents the content of publicly available package versions that have been released to one of the supported registries. The information contained in this diff is provided for informational purposes only and reflects changes between package versions as they appear in their respective public registries.

Files changed (258) hide show

{coretrace_python_analyzer-0.3.0 → coretrace_python_analyzer-0.5.0}/CHANGELOG.md RENAMED Viewed

@@ -1,5 +1,34 @@
 # Changelog
+## 0.5.0 (2026-09-24)
+### Dependencies
+- Argument conditions of advisory entry points are decided at each call, with a `position` for positional arguments and a `default` for absent ones: a call meeting them is reported with `conditions_met`, a call passing another known value does not reach the vulnerability and is listed in the requirement's `ruled_out`, and a call the analyzer cannot decide leaves them pending review (#110).
+### Plugins
+- `ProjectContext.functions(module)` gives project plugins every function of a module as its call graph names it, with its span and the label of the entry point it is (`http` for a route, `argv` for a command), decided by the taint engine's own rule; modules served from the cache keep them, and the cache format is bumped (#116).
+- Call sites and external calls record what each argument denotes — a symbol, a constant as Python writes it, or nothing known — in an `Arguments` record: `CallSite.arguments` (formerly the argument counts), `ExternalCall.arguments`, and `TaintFlow.sink_arguments` for the sink call of a flow, through callees in other modules too (#110).
+## 0.4.0 (2026-09-24)
+### Analysis
+- The module body and the bodies of top-level classes are analysed as the functions `<module>` and `Cls.<body>`: their calls are call sites, their values carry taint, and an advisory entry point called at import time or in a class body is reachable. Coverage counts them; the cache format is bumped so cached results gain their findings (#113).
+### Dependencies
+- Advisories distinguish the `affected_symbols` a fix changed from the public `entry_points` through which they are reached, each justified and carrying `conditions` (checkable argument values, or `semantic` ones kept as pending review); `modules` names what the package installs. Every dependency finding records its evidence `level`: `declared`, `imported`, `reachable` or `exploitable` (#109).
+- A call to an API affected by several advisories of the pinned release reports every one of them, not the first listed (#109).
+- One advisory per identifier and package: a later contributor replaces an earlier one, so a curated feed refines the bundled sample, and the sample names the modules its packages install (#109).
+- A version specifier may be a union of ranges separated by `||`, as an advisory over several release series needs (`>=4.2,<4.2.28 || >=5.2,<5.2.11`); the OSV import produces one such advisory per package instead of one per range (#112).
+### Plugins
+- Every plugin module is registered in `sys.modules` before it runs, so a single-file plugin may define a dataclass under `from __future__ import annotations` (#105).
+- `ProjectPlugin.refine(ctx, findings)` lets a project plugin reclassify the findings of a run: severity, confidence and added metadata only, with `refined_by` and the original values recorded; anything else raises `RefinementError` (#106).
 ## 0.3.0 (2026-09-22)
 ### Plugins

{coretrace_python_analyzer-0.3.0 → coretrace_python_analyzer-0.5.0}/PKG-INFO RENAMED Viewed

@@ -1,6 +1,6 @@
 Metadata-Version: 2.5
 Name: coretrace-python-analyzer
-Version: 0.3.0
+Version: 0.5.0
 Summary: Static security analysis infrastructure for Python code
 Project-URL: Homepage, https://github.com/CoreTrace/coretrace-python-analyzer
 Project-URL: Repository, https://github.com/CoreTrace/coretrace-python-analyzer

{coretrace_python_analyzer-0.3.0 → coretrace_python_analyzer-0.5.0}/docs/plugins.md RENAMED Viewed

@@ -162,6 +162,38 @@ symbols, as the shipped `sample-advisories` plugin does. Requirements matching t
 reported, calls to the affected symbols become reachable vulnerabilities and tainted
 calls become exploitable ones.
+### Reclassifying findings: `ProjectPlugin.refine`
+A project plugin may also implement `refine(ctx, findings)`, called once with every
+finding of the run after all plugins have reported. It returns the same findings, in
+the same order, and may only change their `severity` and `confidence` or add metadata:
+the rule, the location, the message and the evidence a finding already carries are not
+the refiner's to touch, and the engine rejects a refinement that changes or drops any
+of them with a `RefinementError`. A reclassified finding records `refined_by` and the
+`original_severity` or `original_confidence` it had, so a report always shows what the
+detector said and who changed it.
+```python
+from dataclasses import replace
+from coretrace_python.findings import Confidence
+from coretrace_python.plugins import ProjectContext, ProjectPlugin
+class InternalOnly(ProjectPlugin):
+    name = "internal-only"
+    def analyze_project(self, ctx: ProjectContext):
+        return ()
+    def refine(self, ctx: ProjectContext, findings):
+        return tuple(
+            replace(f, confidence=Confidence.LOW, metadata={**f.metadata, "exposure": "internal"})
+            if f.function in INTERNAL else f
+            for f in findings
+        )
+```
 ### Secret scanners: `SecretDetector`
 Judges every string literal of the module, or every value of a configuration file,
@@ -190,9 +222,12 @@ rule. Findings carry a redacted preview only.
 Runs once per project after every module is analysed, with a `ProjectContext`: the
 module graph, the dependency graph, every advisory the plugins and advisory files
-contributed, the policy, the project root, and each module's imports and call graph. The
-shipped `vulnerable-dependency`, `reachable-vulnerability` and `dependency-policy` plugins
-are of this kind.
+contributed, the policy, the project root, and each module's imports, call graph and
+functions. `ctx.functions(module)` gives every function as the call graph names it
+(`Admin.get`, `outer.inner`, `<module>`), with its span, so a finding can be placed in
+one, and the label of the entry point it is (`http` for a route, `argv` for a command)
+when the models make it one. The shipped `vulnerable-dependency`,
+`reachable-vulnerability` and `dependency-policy` plugins are of this kind.
 ```python
 from collections.abc import Sequence
@@ -206,7 +241,7 @@ class RequirementsPresent(ProjectPlugin):
     name: ClassVar[str] = "requirements-present"
     def analyze_project(self, ctx: ProjectContext) -> Sequence[Finding]:
-        return ()  # inspect ctx.dependencies, ctx.modules(), ctx.call_graph(module)
+        return ()  # inspect ctx.dependencies, ctx.modules, ctx.call_graph(module), ctx.functions(module)
 ```
 ### Anything else: `Plugin`

{coretrace_python_analyzer-0.3.0 → coretrace_python_analyzer-0.5.0}/docs/usage.md RENAMED Viewed

@@ -71,7 +71,10 @@ its package (`app/views.py` is `app.views`). Hidden directories, `node_modules`,
 dependency graph. Configuration files under the root (`.env`, YAML, TOML, JSON, INI,
 properties) are scanned for secrets.
-Functions and methods are analysed; module-level statements outside functions are not.
+Functions and methods are analysed, and so are the module body and the bodies of
+top-level classes, as the functions `<module>` and `Cls.<body>`: `application =
+get_asgi_application()` in `asgi.py` or `email = forms.EmailField()` in a form class are
+calls the analyzer sees, and a module-level `os.system(input())` is a finding in `<module>`.
 A function using syntax outside the supported subset is reported as an
 `unsupported-syntax` note and the other functions are still analysed; a file Python
 itself cannot parse is reported as a `syntax-error`. The coverage line and the JSON
@@ -198,7 +201,7 @@ the directory of the checked file; a path outside it is printed as it is.
 ```json
 {
   "schema_version": 1,
-  "tool": {"name": "coretrace-python-analyzer", "version": "0.3.0"},
+  "tool": {"name": "coretrace-python-analyzer", "version": "0.5.0"},
   "root": "/home/me/project",
   "findings": [
     {
@@ -241,7 +244,8 @@ coretrace-python-analyzer --check src/ --advisories advisories.json
 A directory check reads `advisories.json` at the project root and every file passed
 with `--advisories`; a local entry wins over a plugin's for the same advisory. The file
-lists advisories with the package, the vulnerable version range and, optionally, the
+lists advisories with the package, the vulnerable version range (a specifier, or several
+separated by `||` when several release series are affected) and, optionally, the
 affected APIs that feed reachability and correlation:
 ```json
@@ -254,13 +258,61 @@ affected APIs that feed reachability and correlation:
       "vulnerable": "<5.4",
       "summary": "yaml.load can execute arbitrary code from untrusted documents",
       "severity": "critical",
-      "affected_symbols": ["python.yaml.load", "python.yaml.full_load"],
+      "affected_symbols": ["python.yaml.constructor.FullConstructor.construct_python_object_apply"],
+      "entry_points": [
+        {
+          "symbol": "python.yaml.full_load",
+          "justification": "FullLoader uses FullConstructor (commit 5080ba5)",
+          "conditions": [
+            {"kind": "semantic", "text": "the document carries a python/object/apply tag"}
+          ]
+        },
+        {
+          "symbol": "python.yaml.load",
+          "justification": "same path when Loader is FullLoader",
+          "conditions": [
+            {"kind": "argument", "text": "Loader is FullLoader, the default", "argument": "Loader", "position": 1,
+             "values": ["python.yaml.FullLoader", "python.yaml.loader.FullLoader"], "default": true},
+            {"kind": "semantic", "text": "the document carries a python/object/apply tag"}
+          ]
+        }
+      ],
+      "modules": ["yaml"],
       "aliases": ["GHSA-8q59-q68h-6hv4"]
     }
   ]
 }
 ```
+`affected_symbols` are the functions the fix changed; `entry_points` the public APIs
+through which a project reaches them, each with the justification that ties it to the
+fix — the commit, or the call path — and the `conditions` under which it is affected. A
+call to either kind of symbol is reachable. `modules` names the top-level modules the
+package installs, so the analyzer can tell an imported package from a merely required
+one; it defaults to the package name.
+An `argument` condition is decided at each call. It names the argument by keyword and,
+when it may be passed positionally, by `position` (counted from 0, the receiver of a
+method excluded); `values` are what makes the call affected, written as the analyzer
+sees arguments: a symbol by its canonical name (`python.yaml.FullLoader`, and every
+spelling a project may use, such as `python.yaml.loader.FullLoader`), a constant as
+Python writes it (`True`, `None`, `'/static'`); `default` says an absent argument means
+an affected value. A call passing another known value does not reach the vulnerability;
+a call passing a variable, or unpacking `*args` or `**kwargs`, leaves the condition
+pending review. A `semantic` condition — the document's tags, the platform, the
+template's origin — cannot be decided and is always pending review, never dropped.
+Every dependency finding records the highest level of evidence established in its
+`level` metadata: `declared` (the requirement allows a vulnerable version), `imported`
+(a module of the package is imported somewhere), `reachable` (an entry point or affected
+symbol is called) or `exploitable` (attacker input reaches it). The last two carry
+`entry_point`, `justification`, `conditions`, and which of them the call meets
+(`conditions_met`) or leaves to review (`conditions_pending_review`). A requirement whose
+entry points are only called with arguments that contradict a condition stays
+`imported`, and its finding lists those calls in `ruled_out`
+(`app.views:12 python.yaml.load(Loader=python.yaml.SafeLoader)`), the evidence that
+they do not reach the vulnerability.
 A `coretrace-policy.toml` at the root, or the file passed with `--policy`, denies
 packages, requires pins and lists accepted advisories whose findings are dropped:

{coretrace_python_analyzer-0.3.0 → coretrace_python_analyzer-0.5.0}/pyproject.toml RENAMED Viewed

@@ -4,7 +4,7 @@ build-backend = "hatchling.build"
 [project]
 name = "coretrace-python-analyzer"
-version = "0.3.0"
+version = "0.5.0"
 description = "Static security analysis infrastructure for Python code"
 readme = "README.md"
 requires-python = ">=3.11"

{coretrace_python_analyzer-0.3.0 → coretrace_python_analyzer-0.5.0}/src/coretrace_python/__init__.py RENAMED Viewed

@@ -1,4 +1,4 @@
 """CoreTrace's Python static analysis frontend."""
-__version__ = "0.3.0"
+__version__ = "0.5.0"

coretrace_python_analyzer-0.5.0/src/coretrace_python/bundled/dependency/reachable_vulnerability/reachable_vulnerability.py ADDED Viewed

@@ -0,0 +1,49 @@
+"""Calls, anywhere in the project, to an API affected by a vulnerable requirement."""
+from __future__ import annotations
+from collections.abc import Sequence
+from typing import ClassVar
+from coretrace_python.analysis import AnyAnalysis
+from coretrace_python.dependency import DependencyAnalysis
+from coretrace_python.dependency.correlation import affected_symbols, check_conditions, evidence
+from coretrace_python.findings import Confidence, Finding
+from coretrace_python.interprocedural import CallGraphAnalysis, ExternalSymbol
+from coretrace_python.plugins import ProjectContext, ProjectPlugin
+class ReachableVulnerabilityPlugin(ProjectPlugin):
+    name: ClassVar[str] = "reachable-vulnerability"
+    requires: ClassVar[frozenset[AnyAnalysis]] = frozenset({DependencyAnalysis, CallGraphAnalysis})
+    def analyze_project(self, ctx: ProjectContext) -> Sequence[Finding]:
+        affected = affected_symbols(ctx.dependencies, ctx.advisories)
+        if not affected:
+            return ()
+        findings: list[Finding] = []
+        for module in ctx.modules:
+            graph = ctx.call_graph(module)
+            for function in graph.functions:
+                for site in graph.sites(function):
+                    if not isinstance(site.target, ExternalSymbol):
+                        continue
+                    for advisory in affected.get(site.target.symbol, ()):
+                        check = check_conditions(advisory.entry_point(site.target.symbol), site.arguments)
+                        if check.contradicted is not None:
+                            continue
+                        findings.append(
+                            Finding(
+                                rule_id="reachable-vulnerability",
+                                message=(
+                                    f"{advisory.id}: {site.target.symbol} is affected in the required "
+                                    f"{advisory.package} {advisory.vulnerable}: {advisory.summary}"
+                                ),
+                                severity=advisory.severity,
+                                confidence=Confidence.HIGH,
+                                span=site.location,
+                                function=function,
+                                metadata=evidence(advisory, site.target.symbol, "reachable", check),
+                            )
+                        )
+        return findings

{coretrace_python_analyzer-0.3.0 → coretrace_python_analyzer-0.5.0}/src/coretrace_python/bundled/dependency/sample_advisories/sample_advisories.py RENAMED Viewed

@@ -28,6 +28,7 @@ class SampleAdvisories(ModelPlugin):
             "yaml.load and full_load can execute arbitrary code from untrusted documents",
             Severity.CRITICAL,
             (_sym("yaml.load"), _sym("yaml.full_load"), _sym("yaml.unsafe_load")),
+            modules=("yaml",),
         ),
         Advisory(
             "CVE-2018-18074",
@@ -105,5 +106,6 @@ class SampleAdvisories(ModelPlugin):
             Severity.HIGH,
             (_sym("PIL.Image.open"),),
             ("GHSA-cfh3-3jmp-rvhc",),
+            modules=("PIL",),
         ),
     )

{coretrace_python_analyzer-0.3.0 → coretrace_python_analyzer-0.5.0}/src/coretrace_python/bundled/dependency/vulnerable_dependency/plugin.toml RENAMED Viewed

@@ -1,7 +1,7 @@
 name = "vulnerable-dependency"
 version = "1.0.0"
 plugin_api = ">=1,<2"
-requires = ["dependency.graph"]
+requires = ["dependency.graph", "interprocedural.callgraph"]
 provides = ["vulnerability.vulnerable-dependency"]
 [entrypoint]

coretrace_python_analyzer-0.5.0/src/coretrace_python/bundled/dependency/vulnerable_dependency/vulnerable_dependency.py ADDED Viewed

@@ -0,0 +1,71 @@
+"""Requirements that allow a version an advisory marks as vulnerable."""
+from __future__ import annotations
+from collections.abc import Sequence
+from typing import ClassVar
+from coretrace_python.analysis import AnyAnalysis
+from coretrace_python.dependency import DependencyAnalysis
+from coretrace_python.dependency.correlation import affected_symbols, check_conditions, ruled_out
+from coretrace_python.findings import Confidence, Finding
+from coretrace_python.interprocedural import CallGraphAnalysis, ExternalSymbol
+from coretrace_python.plugins import ProjectContext, ProjectPlugin
+class VulnerableDependencyPlugin(ProjectPlugin):
+    name: ClassVar[str] = "vulnerable-dependency"
+    requires: ClassVar[frozenset[AnyAnalysis]] = frozenset({DependencyAnalysis, CallGraphAnalysis})
+    def analyze_project(self, ctx: ProjectContext) -> Sequence[Finding]:
+        findings: list[Finding] = []
+        imported = [s for module in ctx.modules for s in ctx.imports(module).all_symbols()]
+        excluded = _ruled_out(ctx)
+        for requirement in ctx.dependencies.requirements:
+            for advisory in ctx.advisories:
+                if not advisory.affects(requirement):
+                    continue
+                pinned = requirement.pinned is not None
+                level = "imported" if advisory.imported_by(imported) else "declared"
+                metadata = {
+                    "advisory": advisory.id,
+                    "package": advisory.package,
+                    "specifier": requirement.specifier,
+                    "level": level,
+                }
+                if excluded.get(advisory.id):
+                    metadata["ruled_out"] = "; ".join(excluded[advisory.id])
+                findings.append(
+                    Finding(
+                        rule_id="vulnerable-dependency",
+                        message=(
+                            f"{advisory.id}: {advisory.package} {advisory.vulnerable} is "
+                            f"{'required' if pinned else 'allowed'} by {requirement.name}"
+                            f"{requirement.specifier or ''}: {advisory.summary}"
+                        ),
+                        severity=advisory.severity,
+                        confidence=Confidence.HIGH if pinned else Confidence.MEDIUM,
+                        span=requirement.span,
+                        metadata=metadata,
+                    )
+                )
+        return findings
+def _ruled_out(ctx: ProjectContext) -> dict[str, list[str]]:
+    """By advisory, the calls to its entry points whose arguments contradict one of its
+    conditions: the evidence that the requirement, imported, is not reached there."""
+    affected = affected_symbols(ctx.dependencies, ctx.advisories)
+    excluded: dict[str, list[str]] = {}
+    for module in sorted(ctx.modules):
+        graph = ctx.call_graph(module)
+        for function in graph.functions:
+            for site in graph.sites(function):
+                if not isinstance(site.target, ExternalSymbol):
+                    continue
+                for advisory in affected.get(site.target.symbol, ()):
+                    check = check_conditions(advisory.entry_point(site.target.symbol), site.arguments)
+                    if check.contradicted is not None:
+                        excluded.setdefault(advisory.id, []).append(ruled_out(module, site, check))
+    return excluded

{coretrace_python_analyzer-0.3.0 → coretrace_python_analyzer-0.5.0}/src/coretrace_python/cache.py RENAMED Viewed

@@ -22,11 +22,13 @@ from typing import Any
 from coretrace_python.findings import Confidence, Finding, Severity
 from coretrace_python.interprocedural import (
+    Arguments,
     CallSite,
     ExternalCall,
     ExternalSymbol,
     FunctionSummary,
     KnownFunction,
+    ModuleFunction,
     ModuleGraph,
     Mutation,
     NonlocalWrite,
@@ -37,14 +39,14 @@ from coretrace_python.interprocedural import (
 from coretrace_python.semantic.symbols import SymbolId
 from coretrace_python.source import SourceId, SourceSpan
-CACHE_FORMAT = 4
+CACHE_FORMAT = 7
 @dataclass(frozen=True)
 class CachedModule:
     """Everything a later run needs from one module without lowering it again."""
-    functions: tuple[str, ...]
+    functions: tuple[ModuleFunction, ...]
     summaries: Mapping[str, FunctionSummary]
     sites: tuple[CallSite, ...]
     findings: tuple[Finding, ...]
@@ -128,7 +130,7 @@ class ProjectCache:
 def encode(module: CachedModule) -> dict[str, Any]:
     return {
         "format": CACHE_FORMAT,
-        "functions": list(module.functions),
+        "functions": [[f.name, _encode_span(f.span), f.entry_point] for f in module.functions],
         "summaries": {name: _encode_summary(s) for name, s in module.summaries.items()},
         "sites": [_encode_site(site) for site in module.sites],
         "findings": [_encode_finding(finding) for finding in module.findings],
@@ -139,7 +141,7 @@ def decode(data: Mapping[str, Any]) -> CachedModule:
     if data["format"] != CACHE_FORMAT:
         raise ValueError(f"unsupported cache format {data['format']!r}")
     return CachedModule(
-        tuple(_string(name) for name in data["functions"]),
+        tuple(_decode_function(function) for function in data["functions"]),
         {_string(name): _decode_summary(s) for name, s in data["summaries"].items()},
         tuple(_decode_site(site) for site in data["sites"]),
         tuple(_decode_finding(finding) for finding in data["findings"]),
@@ -187,6 +189,11 @@ def _decode_span(data: Any) -> SourceSpan:
     )
+def _decode_function(data: Any) -> ModuleFunction:
+    name, span, entry_point = data
+    return ModuleFunction(_string(name), _decode_span(span), None if entry_point is None else _string(entry_point))
 def _encode_finding(finding: Finding) -> dict[str, Any]:
     return {
         "rule": finding.rule_id,
@@ -219,6 +226,7 @@ def _encode_call(call: ExternalCall) -> dict[str, Any]:
         "keywords": sorted(call.keyword_dependencies),
         "location": _encode_span(call.location),
         "call_site": None if call.call_site is None else _encode_span(call.call_site),
+        "given": _encode_arguments(call.arguments),
     }
@@ -230,6 +238,7 @@ def _decode_call(data: Mapping[str, Any]) -> ExternalCall:
         _indices(data["keywords"]),
         _decode_span(data["location"]),
         None if site is None else _decode_span(site),
+        _decode_arguments(data["given"]),
     )
@@ -311,8 +320,7 @@ def _encode_site(site: CallSite) -> dict[str, Any]:
         "caller": site.caller,
         "location": _encode_span(site.location),
         "target": _encode_target(site.target),
-        "arguments": site.arguments,
-        "keywords": site.keywords,
+        "arguments": _encode_arguments(site.arguments),
     }
@@ -321,6 +329,27 @@ def _decode_site(data: Mapping[str, Any]) -> CallSite:
         _string(data["caller"]),
         _decode_span(data["location"]),
         _decode_target(data["target"]),
-        _integer(data["arguments"]),
-        _integer(data["keywords"]),
+        _decode_arguments(data["arguments"]),
+    )
+def _encode_arguments(arguments: Arguments) -> dict[str, Any]:
+    return {
+        "positional": list(arguments.positional),
+        "keywords": [[name, value] for name, value in arguments.keywords],
+        "unpacked": arguments.unpacked,
+    }
+def _decode_arguments(data: Mapping[str, Any]) -> Arguments:
+    def denoted(value: Any) -> str | None:
+        return None if value is None else _string(value)
+    unpacked = data["unpacked"]
+    if not isinstance(unpacked, bool):
+        raise TypeError(f"expected a boolean, got {unpacked!r}")
+    return Arguments(
+        tuple(denoted(value) for value in data["positional"]),
+        tuple((_string(name), denoted(value)) for name, value in data["keywords"]),
+        unpacked,
     )

{coretrace_python_analyzer-0.3.0 → coretrace_python_analyzer-0.5.0}/src/coretrace_python/dependency/__init__.py RENAMED Viewed

@@ -11,6 +11,8 @@ from coretrace_python.dependency.advisories import (
 from coretrace_python.dependency.graph import (
     DEPENDENCY_FILES,
     Advisory,
+    AdvisoryEntryPoint,
+    Condition,
     DependencyAnalysis,
     DependencyGraph,
     Requirement,
@@ -26,7 +28,9 @@ __all__ = [
     "DEPENDENCY_FILES",
     "POLICY_FILE",
     "Advisory",
+    "AdvisoryEntryPoint",
     "AdvisoryFileError",
+    "Condition",
     "DependencyAnalysis",
     "DependencyGraph",
     "Policy",

{coretrace_python_analyzer-0.3.0 → coretrace_python_analyzer-0.5.0}/src/coretrace_python/dependency/advisories.py RENAMED Viewed

@@ -5,8 +5,8 @@ OSV dump into ``Advisory`` values, keeping the PyPI ecosystem and turning each r
 events into a version specifier; ``dump_advisories`` writes them as a small JSON file
 that a project keeps at its root as ``advisories.json`` or passes with ``--advisories``.
 OSV records name no affected APIs, so imported advisories feed the requirement checks
-and the SBOM; a file completed by hand with ``affected_symbols`` also feeds the
-reachability and correlation checks.
+and the SBOM; a file completed by hand with ``affected_symbols``, ``entry_points`` and
+their ``conditions`` also feeds the reachability and correlation checks.
 """
 from __future__ import annotations
@@ -17,7 +17,7 @@ from collections.abc import Iterable, Iterator, Mapping
 from pathlib import Path
 from typing import Any
-from coretrace_python.dependency.graph import Advisory, normalize
+from coretrace_python.dependency.graph import Advisory, AdvisoryEntryPoint, Condition, normalize
 from coretrace_python.findings import Severity
 from coretrace_python.semantic.symbols import SymbolId
@@ -84,8 +84,9 @@ def import_osv(records: Iterable[Mapping[str, Any]]) -> tuple[Advisory, ...]:
             if str(package.get("ecosystem", "")).lower() != "pypi" or not package.get("name"):
                 continue
             name = normalize(str(package["name"]))
-            for specifier in _specifiers(affected.get("ranges") or []):
-                advisories.append(Advisory(identifier, name, specifier, summary, severity, (), aliases))
+            specifiers = _specifiers(affected.get("ranges") or [])
+            if specifiers:
+                advisories.append(Advisory(identifier, name, " || ".join(specifiers), summary, severity, (), aliases))
     return tuple(advisories)
@@ -137,6 +138,15 @@ def dump_advisories(advisories: Iterable[Advisory]) -> str:
                 "severity": a.severity.value,
                 "affected_symbols": [str(s) for s in a.affected_symbols],
                 "aliases": list(a.aliases),
+                "entry_points": [
+                    {
+                        "symbol": str(e.symbol),
+                        "justification": e.justification,
+                        "conditions": [_condition_entry(c) for c in e.conditions],
+                    }
+                    for e in a.entry_points
+                ],
+                "modules": list(a.modules),
             }
             for a in advisories
         ],
@@ -144,6 +154,19 @@ def dump_advisories(advisories: Iterable[Advisory]) -> str:
     return json.dumps(document, indent=2) + "\n"
+def _condition_entry(condition: Condition) -> dict[str, Any]:
+    entry: dict[str, Any] = {"kind": condition.kind, "text": condition.text}
+    if condition.argument is not None:
+        entry["argument"] = condition.argument
+    if condition.values:
+        entry["values"] = list(condition.values)
+    if condition.position is not None:
+        entry["position"] = condition.position
+    if condition.default:
+        entry["default"] = True
+    return entry
 def load_advisories(path: Path) -> tuple[Advisory, ...]:
     try:
         document = json.loads(path.read_text(encoding="utf-8"))
@@ -165,4 +188,31 @@ def _advisory(entry: Mapping[str, Any]) -> Advisory:
         Severity(entry["severity"]),
         tuple(SymbolId(str(s)) for s in entry.get("affected_symbols") or []),
         tuple(str(a) for a in entry.get("aliases") or []),
+        tuple(_entry_point(e) for e in entry.get("entry_points") or []),
+        tuple(str(m) for m in entry.get("modules") or []),
+    )
+def _entry_point(entry: Mapping[str, Any]) -> AdvisoryEntryPoint:
+    return AdvisoryEntryPoint(
+        SymbolId(str(entry["symbol"])),
+        str(entry["justification"]),
+        tuple(_condition(c) for c in entry.get("conditions") or []),
+    )
+def _condition(entry: Mapping[str, Any]) -> Condition:
+    position = entry.get("position")
+    if position is not None and (not isinstance(position, int) or isinstance(position, bool) or position < 0):
+        raise TypeError(f"condition position must be a non-negative integer, got {position!r}")
+    default = entry.get("default", False)
+    if not isinstance(default, bool):
+        raise TypeError(f"condition default must be true or false, got {default!r}")
+    return Condition(
+        str(entry["kind"]),
+        str(entry["text"]),
+        None if entry.get("argument") is None else str(entry["argument"]),
+        tuple(str(v) for v in entry.get("values") or []),
+        position,
+        default,
     )

coretrace-python-analyzer 0.3.0__tar.gz → 0.5.0__tar.gz

coretrace-python-analyzer 0.3.0tar.gz → 0.5.0tar.gz