coretrace-python-analyzer 0.4.0__py3-none-any.whl → 0.6.0__py3-none-any.whl

coretrace_python/__init__.py

@@ -1,4 +1,4 @@
 """CoreTrace's Python static analysis frontend."""
 
-__version__ = "0.4.0"
+__version__ = "0.6.0"
 

coretrace_python/bundled/dependency/reachable_vulnerability/reachable_vulnerability.py

@@ -1,16 +1,24 @@
-"""Calls, anywhere in the project, to an API affected by a vulnerable requirement."""
+"""Calls, anywhere in the project, to an API affected by a vulnerable requirement, and
+reads of an affected attribute whose getter runs the vulnerable code."""
 
 from __future__ import annotations
 
-from collections.abc import Sequence
+from collections.abc import Iterator, Sequence
 from typing import ClassVar
 
 from coretrace_python.analysis import AnyAnalysis
-from coretrace_python.dependency import DependencyAnalysis
-from coretrace_python.dependency.correlation import affected_symbols, evidence
+from coretrace_python.dependency import Advisory, DependencyAnalysis
+from coretrace_python.dependency.correlation import (
+    ConditionCheck,
+    affected_symbols,
+    check_conditions,
+    evidence,
+)
 from coretrace_python.findings import Confidence, Finding
 from coretrace_python.interprocedural import CallGraphAnalysis, ExternalSymbol
 from coretrace_python.plugins import ProjectContext, ProjectPlugin
+from coretrace_python.semantic.symbols import SymbolId
+from coretrace_python.source import SourceSpan
 
 
 class ReachableVulnerabilityPlugin(ProjectPlugin):
@@ -29,18 +37,46 @@ class ReachableVulnerabilityPlugin(ProjectPlugin):
                     if not isinstance(site.target, ExternalSymbol):
                         continue
                     for advisory in affected.get(site.target.symbol, ()):
-                        findings.append(
-                            Finding(
-                                rule_id="reachable-vulnerability",
-                                message=(
-                                    f"{advisory.id}: {site.target.symbol} is affected in the required "
-                                    f"{advisory.package} {advisory.vulnerable}: {advisory.summary}"
-                                ),
-                                severity=advisory.severity,
-                                confidence=Confidence.HIGH,
-                                span=site.location,
-                                function=function,
-                                metadata=evidence(advisory, site.target.symbol, "reachable"),
-                            )
-                        )
+                        entry = advisory.entry_point(site.target.symbol)
+                        if entry is not None and entry.read:
+                            continue  # a call reads its callee first: reported with the reads
+                        check = check_conditions(entry, site.arguments)
+                        if check.contradicted is not None:
+                            continue
+                        findings.append(_reached(advisory, site.target.symbol, site.location, function, check))
+                # Reading ``request.form.get`` reads ``request.form``: one finding per entry
+                # point and function, where the function first reads it.
+                reported: set[tuple[Advisory, SymbolId]] = set()
+                for read in graph.reads(function):
+                    for symbol in _read_through(read.symbol):
+                        for advisory in affected.get(symbol, ()):
+                            entry = advisory.entry_point(symbol)
+                            if entry is None or not entry.read or (advisory, symbol) in reported:
+                                continue
+                            reported.add((advisory, symbol))
+                            check = check_conditions(entry, None)
+                            findings.append(_reached(advisory, symbol, read.location, function, check))
         return findings
+
+
+def _read_through(symbol: SymbolId) -> Iterator[SymbolId]:
+    """``symbol`` and every symbol it is an attribute of, as reading it reads them all."""
+
+    components = symbol.canonical_name.split(".")
+    for end in range(len(components), 1, -1):
+        yield SymbolId(".".join(components[:end]))
+
+
+def _reached(advisory: Advisory, symbol: SymbolId, span: SourceSpan, function: str, check: ConditionCheck) -> Finding:
+    return Finding(
+        rule_id="reachable-vulnerability",
+        message=(
+            f"{advisory.id}: {symbol} is affected in the required "
+            f"{advisory.package} {advisory.vulnerable}: {advisory.summary}"
+        ),
+        severity=advisory.severity,
+        confidence=Confidence.HIGH,
+        span=span,
+        function=function,
+        metadata=evidence(advisory, symbol, "reachable", check),
+    )

coretrace_python/bundled/dependency/vulnerable_dependency/plugin.toml

@@ -1,7 +1,7 @@
 name = "vulnerable-dependency"
 version = "1.0.0"
 plugin_api = ">=1,<2"
-requires = ["dependency.graph"]
+requires = ["dependency.graph", "interprocedural.callgraph"]
 provides = ["vulnerability.vulnerable-dependency"]
 
 [entrypoint]

coretrace_python/bundled/dependency/vulnerable_dependency/vulnerable_dependency.py

@@ -7,23 +7,34 @@ from typing import ClassVar
 
 from coretrace_python.analysis import AnyAnalysis
 from coretrace_python.dependency import DependencyAnalysis
+from coretrace_python.dependency.correlation import affected_symbols, check_conditions, ruled_out
 from coretrace_python.findings import Confidence, Finding
+from coretrace_python.interprocedural import CallGraphAnalysis, ExternalSymbol
 from coretrace_python.plugins import ProjectContext, ProjectPlugin
 
 
 class VulnerableDependencyPlugin(ProjectPlugin):
     name: ClassVar[str] = "vulnerable-dependency"
-    requires: ClassVar[frozenset[AnyAnalysis]] = frozenset({DependencyAnalysis})
+    requires: ClassVar[frozenset[AnyAnalysis]] = frozenset({DependencyAnalysis, CallGraphAnalysis})
 
     def analyze_project(self, ctx: ProjectContext) -> Sequence[Finding]:
         findings: list[Finding] = []
         imported = [s for module in ctx.modules for s in ctx.imports(module).all_symbols()]
+        excluded = _ruled_out(ctx)
         for requirement in ctx.dependencies.requirements:
             for advisory in ctx.advisories:
                 if not advisory.affects(requirement):
                     continue
                 pinned = requirement.pinned is not None
                 level = "imported" if advisory.imported_by(imported) else "declared"
+                metadata = {
+                    "advisory": advisory.id,
+                    "package": advisory.package,
+                    "specifier": requirement.specifier,
+                    "level": level,
+                }
+                if excluded.get(advisory.id):
+                    metadata["ruled_out"] = "; ".join(excluded[advisory.id])
                 findings.append(
                     Finding(
                         rule_id="vulnerable-dependency",
@@ -35,12 +46,26 @@ class VulnerableDependencyPlugin(ProjectPlugin):
                         severity=advisory.severity,
                         confidence=Confidence.HIGH if pinned else Confidence.MEDIUM,
                         span=requirement.span,
-                        metadata={
-                            "advisory": advisory.id,
-                            "package": advisory.package,
-                            "specifier": requirement.specifier,
-                            "level": level,
-                        },
+                        metadata=metadata,
                     )
                 )
         return findings
+
+
+def _ruled_out(ctx: ProjectContext) -> dict[str, list[str]]:
+    """By advisory, the calls to its entry points whose arguments contradict one of its
+    conditions: the evidence that the requirement, imported, is not reached there."""
+
+    affected = affected_symbols(ctx.dependencies, ctx.advisories)
+    excluded: dict[str, list[str]] = {}
+    for module in sorted(ctx.modules):
+        graph = ctx.call_graph(module)
+        for function in graph.functions:
+            for site in graph.sites(function):
+                if not isinstance(site.target, ExternalSymbol):
+                    continue
+                for advisory in affected.get(site.target.symbol, ()):
+                    check = check_conditions(advisory.entry_point(site.target.symbol), site.arguments)
+                    if check.contradicted is not None:
+                        excluded.setdefault(advisory.id, []).append(ruled_out(module, site, check))
+    return excluded

coretrace_python/bundled/models/python_stdlib/python_stdlib.py

@@ -6,9 +6,28 @@ from typing import ClassVar
 
 from coretrace_python.plugins import ModelPlugin
 from coretrace_python.semantic.symbols import SymbolId
-from coretrace_python.taint import Model, Sanitizer, Sink, Source, TaintKind, Validator
+from coretrace_python.taint import (
+    Model,
+    SafeArgument,
+    Sanitizer,
+    Sink,
+    Source,
+    TaintKind,
+    Validator,
+)
 
 _ENVIRONMENT_KINDS = TaintKind.ALL & ~(TaintKind.COMMAND | TaintKind.PATH)
+# SafeLoader and BaseLoader build plain data only, in Python and in C, under every spelling.
+_SAFE_YAML_LOADERS = (
+    "python.yaml.SafeLoader",
+    "python.yaml.loader.SafeLoader",
+    "python.yaml.BaseLoader",
+    "python.yaml.loader.BaseLoader",
+    "python.yaml.CSafeLoader",
+    "python.yaml.cyaml.CSafeLoader",
+    "python.yaml.CBaseLoader",
+    "python.yaml.cyaml.CBaseLoader",
+)
 _PROCESS_OUTPUT_KINDS = TaintKind.ALL & ~TaintKind.PATH
 
 
@@ -66,6 +85,11 @@ class PythonStdlibModels(ModelPlugin):
         Sink(_sym("dill.loads"), TaintKind.DESERIALIZATION),
         Sink(_sym("jsonpickle.decode"), TaintKind.DESERIALIZATION),
         Sink(_sym("yaml.load"), TaintKind.DESERIALIZATION),
+        Sink(_sym("yaml.load_all"), TaintKind.DESERIALIZATION),
+        Sink(_sym("yaml.full_load_all"), TaintKind.DESERIALIZATION),
+        Sink(_sym("yaml.unsafe_load_all"), TaintKind.DESERIALIZATION),
+        SafeArgument(_sym("yaml.load"), "Loader", _SAFE_YAML_LOADERS, position=1, kinds=TaintKind.DESERIALIZATION),
+        SafeArgument(_sym("yaml.load_all"), "Loader", _SAFE_YAML_LOADERS, position=1, kinds=TaintKind.DESERIALIZATION),
         Sink(_sym("yaml.unsafe_load"), TaintKind.DESERIALIZATION),
         Sink(_sym("yaml.full_load"), TaintKind.DESERIALIZATION),
         Sanitizer(_sym("os.path.basename"), TaintKind.PATH),

coretrace_python/cache.py

@@ -4,9 +4,10 @@ A module's results are stored under a key derived from everything they depend on
 source text and identity, the engine, schema and plugin API versions, the plugins and
 their code, the security models, the advisories, the dependency graph, and the keys of
 the project modules it imports transitively. A module whose key is unchanged on a later
-run is served from the cache: its summaries seed the project index, its call sites serve
-the project plugins and its findings are reported as they were. Entries are JSON, so a
-tampered or foreign file can never execute anything; an unreadable entry is a miss.
+run is served from the cache: its summaries seed the project index, its call sites and
+symbol reads serve the project plugins and its findings are reported as they were.
+Entries are JSON, so a tampered or foreign file can never execute anything; an
+unreadable entry is a miss.
 """
 
 from __future__ import annotations
@@ -22,32 +23,36 @@ from typing import Any
 
 from coretrace_python.findings import Confidence, Finding, Severity
 from coretrace_python.interprocedural import (
+    Arguments,
     CallSite,
     ExternalCall,
     ExternalSymbol,
     FunctionSummary,
     KnownFunction,
+    ModuleFunction,
     ModuleGraph,
     Mutation,
     NonlocalWrite,
     SummaryIndex,
+    SymbolRead,
     Target,
     UnknownTarget,
 )
 from coretrace_python.semantic.symbols import SymbolId
 from coretrace_python.source import SourceId, SourceSpan
 
-CACHE_FORMAT = 5
+CACHE_FORMAT = 8
 
 
 @dataclass(frozen=True)
 class CachedModule:
     """Everything a later run needs from one module without lowering it again."""
 
-    functions: tuple[str, ...]
+    functions: tuple[ModuleFunction, ...]
     summaries: Mapping[str, FunctionSummary]
     sites: tuple[CallSite, ...]
     findings: tuple[Finding, ...]
+    reads: tuple[SymbolRead, ...] = ()
 
     def __post_init__(self) -> None:
         object.__setattr__(self, "summaries", MappingProxyType(dict(self.summaries)))
@@ -128,10 +133,11 @@ class ProjectCache:
 def encode(module: CachedModule) -> dict[str, Any]:
     return {
         "format": CACHE_FORMAT,
-        "functions": list(module.functions),
+        "functions": [[f.name, _encode_span(f.span), f.entry_point] for f in module.functions],
         "summaries": {name: _encode_summary(s) for name, s in module.summaries.items()},
         "sites": [_encode_site(site) for site in module.sites],
         "findings": [_encode_finding(finding) for finding in module.findings],
+        "reads": [[r.function, _encode_span(r.location), str(r.symbol)] for r in module.reads],
     }
 
 
@@ -139,10 +145,11 @@ def decode(data: Mapping[str, Any]) -> CachedModule:
     if data["format"] != CACHE_FORMAT:
         raise ValueError(f"unsupported cache format {data['format']!r}")
     return CachedModule(
-        tuple(_string(name) for name in data["functions"]),
+        tuple(_decode_function(function) for function in data["functions"]),
         {_string(name): _decode_summary(s) for name, s in data["summaries"].items()},
         tuple(_decode_site(site) for site in data["sites"]),
         tuple(_decode_finding(finding) for finding in data["findings"]),
+        tuple(_decode_read(read) for read in data["reads"]),
     )
 
 
@@ -187,6 +194,16 @@ def _decode_span(data: Any) -> SourceSpan:
     )
 
 
+def _decode_function(data: Any) -> ModuleFunction:
+    name, span, entry_point = data
+    return ModuleFunction(_string(name), _decode_span(span), None if entry_point is None else _string(entry_point))
+
+
+def _decode_read(data: Any) -> SymbolRead:
+    function, span, symbol = data
+    return SymbolRead(_string(function), _decode_span(span), SymbolId(_string(symbol)))
+
+
 def _encode_finding(finding: Finding) -> dict[str, Any]:
     return {
         "rule": finding.rule_id,
@@ -219,6 +236,7 @@ def _encode_call(call: ExternalCall) -> dict[str, Any]:
         "keywords": sorted(call.keyword_dependencies),
         "location": _encode_span(call.location),
         "call_site": None if call.call_site is None else _encode_span(call.call_site),
+        "given": _encode_arguments(call.arguments),
     }
 
 
@@ -230,6 +248,7 @@ def _decode_call(data: Mapping[str, Any]) -> ExternalCall:
         _indices(data["keywords"]),
         _decode_span(data["location"]),
         None if site is None else _decode_span(site),
+        _decode_arguments(data["given"]),
     )
 
 
@@ -311,8 +330,7 @@ def _encode_site(site: CallSite) -> dict[str, Any]:
         "caller": site.caller,
         "location": _encode_span(site.location),
         "target": _encode_target(site.target),
-        "arguments": site.arguments,
-        "keywords": site.keywords,
+        "arguments": _encode_arguments(site.arguments),
     }
 
 
@@ -321,6 +339,27 @@ def _decode_site(data: Mapping[str, Any]) -> CallSite:
         _string(data["caller"]),
         _decode_span(data["location"]),
         _decode_target(data["target"]),
-        _integer(data["arguments"]),
-        _integer(data["keywords"]),
+        _decode_arguments(data["arguments"]),
+    )
+
+
+def _encode_arguments(arguments: Arguments) -> dict[str, Any]:
+    return {
+        "positional": list(arguments.positional),
+        "keywords": [[name, value] for name, value in arguments.keywords],
+        "unpacked": arguments.unpacked,
+    }
+
+
+def _decode_arguments(data: Mapping[str, Any]) -> Arguments:
+    def denoted(value: Any) -> str | None:
+        return None if value is None else _string(value)
+
+    unpacked = data["unpacked"]
+    if not isinstance(unpacked, bool):
+        raise TypeError(f"expected a boolean, got {unpacked!r}")
+    return Arguments(
+        tuple(denoted(value) for value in data["positional"]),
+        tuple((_string(name), denoted(value)) for name, value in data["keywords"]),
+        unpacked,
     )

coretrace_python/cli.py

@@ -3,13 +3,20 @@ from __future__ import annotations
 import argparse
 import sys
 import zipfile
+from datetime import UTC, datetime
 from pathlib import Path
 
 from coretrace_python import __version__, engine
 from coretrace_python.analysis import AnalysisError
 from coretrace_python.cache import ProjectCache
 from coretrace_python.cfg import CFGError
-from coretrace_python.dependency import dump_advisories, import_osv, read_osv, render_sbom
+from coretrace_python.dependency import (
+    dump_advisories,
+    import_osv,
+    read_osv,
+    render_sbom,
+    render_vex,
+)
 from coretrace_python.findings import Severity
 from coretrace_python.findings.baseline import Baseline, BaselineError
 from coretrace_python.frontend import HIRBuildError, ParseError, build_hir
@@ -106,6 +113,14 @@ def build_parser() -> argparse.ArgumentParser:
         metavar="PATH",
         help="with --check on a directory, write a CycloneDX bill of materials to PATH",
     )
+    parser.add_argument(
+        "--vex",
+        type=Path,
+        default=None,
+        metavar="PATH",
+        help="with --check on a directory, write to PATH an OpenVEX document saying whether "
+        "each advisory affecting a requirement affects the project",
+    )
     parser.add_argument(
         "--advisories",
         action="append",
@@ -182,6 +197,9 @@ def main(argv: list[str] | None = None) -> int:
     if args.sbom is not None and not (args.check and args.path.is_dir()):
         print("error: --sbom only applies to --check on a directory", file=sys.stderr)
         return EXIT_ERROR
+    if args.vex is not None and not (args.check and args.path.is_dir()):
+        print("error: --vex only applies to --check on a directory", file=sys.stderr)
+        return EXIT_ERROR
     if args.advisories and not (args.check and args.path.is_dir()):
         print("error: --advisories only applies to --check on a directory", file=sys.stderr)
         return EXIT_ERROR
@@ -227,6 +245,20 @@ def main(argv: list[str] | None = None) -> int:
                         render_sbom(analysis.dependencies, analysis.advisories, engine.TOOL_NAME, __version__),
                         encoding="utf-8",
                     )
+                if args.vex is not None:
+                    args.vex.write_text(
+                        render_vex(
+                            analysis.dependencies,
+                            analysis.advisories,
+                            (*analysis.findings, *analysis.suppressed, *analysis.accepted),
+                            analysis.coverage,
+                            args.path,
+                            engine.TOOL_NAME,
+                            __version__,
+                            datetime.now(UTC),
+                        ),
+                        encoding="utf-8",
+                    )
             else:
                 file_analysis = engine.analyze_file(SourceManager().load_file(args.path), plugin_roots)
                 findings, coverage = file_analysis.findings, file_analysis.coverage

coretrace_python/dependency/__init__.py

@@ -22,6 +22,7 @@ from coretrace_python.dependency.graph import (
 )
 from coretrace_python.dependency.policy import POLICY_FILE, Policy, apply_policy, load_policy
 from coretrace_python.dependency.sbom import render_sbom
+from coretrace_python.dependency.vex import render_vex
 
 __all__ = [
     "ADVISORY_FILE",
@@ -45,4 +46,5 @@ __all__ = [
     "parse_dependencies",
     "read_osv",
     "render_sbom",
+    "render_vex",
 ]

coretrace_python/dependency/advisories.py

@@ -138,14 +138,7 @@ def dump_advisories(advisories: Iterable[Advisory]) -> str:
                 "severity": a.severity.value,
                 "affected_symbols": [str(s) for s in a.affected_symbols],
                 "aliases": list(a.aliases),
-                "entry_points": [
-                    {
-                        "symbol": str(e.symbol),
-                        "justification": e.justification,
-                        "conditions": [_condition_entry(c) for c in e.conditions],
-                    }
-                    for e in a.entry_points
-                ],
+                "entry_points": [_entry_point_entry(e) for e in a.entry_points],
                 "modules": list(a.modules),
             }
             for a in advisories
@@ -154,12 +147,27 @@ def dump_advisories(advisories: Iterable[Advisory]) -> str:
     return json.dumps(document, indent=2) + "\n"
 
 
+def _entry_point_entry(entry_point: AdvisoryEntryPoint) -> dict[str, Any]:
+    entry: dict[str, Any] = {
+        "symbol": str(entry_point.symbol),
+        "justification": entry_point.justification,
+        "conditions": [_condition_entry(c) for c in entry_point.conditions],
+    }
+    if entry_point.read:
+        entry["read"] = True
+    return entry
+
+
 def _condition_entry(condition: Condition) -> dict[str, Any]:
     entry: dict[str, Any] = {"kind": condition.kind, "text": condition.text}
     if condition.argument is not None:
         entry["argument"] = condition.argument
     if condition.values:
         entry["values"] = list(condition.values)
+    if condition.position is not None:
+        entry["position"] = condition.position
+    if condition.default:
+        entry["default"] = True
     return entry
 
 
@@ -190,16 +198,29 @@ def _advisory(entry: Mapping[str, Any]) -> Advisory:
 
 
 def _entry_point(entry: Mapping[str, Any]) -> AdvisoryEntryPoint:
+    read = entry.get("read", False)
+    if not isinstance(read, bool):
+        raise TypeError(f"entry point read must be true or false, got {read!r}")
     return AdvisoryEntryPoint(
         SymbolId(str(entry["symbol"])),
         str(entry["justification"]),
-        tuple(
-            Condition(
-                str(c["kind"]),
-                str(c["text"]),
-                None if c.get("argument") is None else str(c["argument"]),
-                tuple(str(v) for v in c.get("values") or []),
-            )
-            for c in entry.get("conditions") or []
-        ),
+        tuple(_condition(c) for c in entry.get("conditions") or []),
+        read,
+    )
+
+
+def _condition(entry: Mapping[str, Any]) -> Condition:
+    position = entry.get("position")
+    if position is not None and (not isinstance(position, int) or isinstance(position, bool) or position < 0):
+        raise TypeError(f"condition position must be a non-negative integer, got {position!r}")
+    default = entry.get("default", False)
+    if not isinstance(default, bool):
+        raise TypeError(f"condition default must be true or false, got {default!r}")
+    return Condition(
+        str(entry["kind"]),
+        str(entry["text"]),
+        None if entry.get("argument") is None else str(entry["argument"]),
+        tuple(str(v) for v in entry.get("values") or []),
+        position,
+        default,
     )

coretrace_python/dependency/correlation.py

@@ -10,10 +10,18 @@ are correlated here into one high-confidence ``exploitable-vulnerability`` findi
 from __future__ import annotations
 
 from collections.abc import Iterable, Mapping
-
-from coretrace_python.dependency.graph import DIRECT, Advisory, DependencyGraph
+from dataclasses import dataclass
+
+from coretrace_python.dependency.graph import (
+    DIRECT,
+    Advisory,
+    AdvisoryEntryPoint,
+    Condition,
+    DependencyGraph,
+)
 from coretrace_python.findings import Confidence, Finding, Severity
 from coretrace_python.findings.refutation import Status, Verdict, Verdicts
+from coretrace_python.interprocedural import Arguments, CallSite, ExternalSymbol
 from coretrace_python.semantic.symbols import SymbolId
 from coretrace_python.taint import Sink, TaintFlow, TaintKind
 
@@ -40,10 +48,56 @@ def advisory_sinks(affected: Affected) -> tuple[Sink, ...]:
     return tuple(Sink(symbol, TaintKind.ADVISORY) for symbol in affected)
 
 
-def evidence(advisory: Advisory, symbol: SymbolId, level: str) -> dict[str, str]:
+@dataclass(frozen=True)
+class ConditionCheck:
+    """What one call tells of an entry point's conditions: those it meets, those left to
+    review (every semantic one, and every argument one the call does not decide), and
+    the argument condition it contradicts with what it passes instead (None: absent),
+    in which case the call does not reach the vulnerability."""
+
+    met: tuple[Condition, ...] = ()
+    pending: tuple[Condition, ...] = ()
+    contradicted: Condition | None = None
+    passed: str | None = None
+
+
+def check_conditions(entry: AdvisoryEntryPoint | None, arguments: Arguments | None) -> ConditionCheck:
+    """Decide ``entry``'s conditions against what the call's ``arguments`` denote."""
+
+    if entry is None:
+        return ConditionCheck()
+    met: list[Condition] = []
+    pending: list[Condition] = []
+    for condition in entry.conditions:
+        given = arguments.given(condition.argument, condition.position) if condition.checkable and arguments is not None else None
+        if given is None:
+            pending.append(condition)
+            continue
+        explicit, value = given
+        if explicit and value is None:
+            pending.append(condition)
+            continue
+        affected = value in condition.values if explicit else condition.default
+        if not affected:
+            return ConditionCheck(tuple(met), tuple(pending), condition, value)
+        met.append(condition)
+    return ConditionCheck(tuple(met), tuple(pending))
+
+
+def ruled_out(module: str, site: CallSite, check: ConditionCheck) -> str:
+    """Which call a contradicted condition rules out, and why: ``app:12
+    python.yaml.load(Loader=python.yaml.SafeLoader)``."""
+
+    assert check.contradicted is not None and isinstance(site.target, ExternalSymbol)
+    argument = check.contradicted.argument or f"#{check.contradicted.position}"
+    passed = f"{argument} absent" if check.passed is None else f"{argument}={check.passed}"
+    return f"{module}:{site.location.start_line} {site.target.symbol}({passed})"
+
+
+def evidence(advisory: Advisory, symbol: SymbolId, level: str, check: ConditionCheck) -> dict[str, str]:
     """What a finding keeps of the advisory for ``symbol``: the level of evidence
-    established, how the symbol relates to the vulnerability and under which
-    conditions, the ones the engine could not check listed as pending review."""
+    established, how the symbol relates to the vulnerability, and its conditions — those
+    the call meets and those left to review."""
 
     metadata = {"advisory": advisory.id, "package": advisory.package, "symbol": str(symbol), "level": level}
     entry = advisory.entry_point(symbol)
@@ -54,9 +108,10 @@ def evidence(advisory: Advisory, symbol: SymbolId, level: str) -> dict[str, str]
     metadata["justification"] = entry.justification
     if entry.conditions:
         metadata["conditions"] = "; ".join(c.text for c in entry.conditions)
-        # ponytail: no condition is checked yet, so every one awaits review; argument
-        # conditions get checked at the call site once call sites carry argument symbols.
-        metadata["conditions_pending_review"] = "; ".join(c.text for c in entry.conditions)
+    if check.met:
+        metadata["conditions_met"] = "; ".join(c.text for c in check.met)
+    if check.pending:
+        metadata["conditions_pending_review"] = "; ".join(c.text for c in check.pending)
     return metadata
 
 
@@ -77,21 +132,22 @@ def correlate(
         if verdict is not None and verdict.status is Status.REFUTED:
             continue
         hotspot = verdict is not None and verdict.status is Status.HOTSPOT
-        findings.extend(
-            _exploitable(function, flow, advisory, verdict, hotspot) for advisory in affected.get(flow.sink.symbol, ())
-        )
+        for advisory in affected.get(flow.sink.symbol, ()):
+            check = check_conditions(advisory.entry_point(flow.sink.symbol), flow.sink_arguments)
+            if check.contradicted is None:
+                findings.append(_exploitable(function, flow, advisory, verdict, hotspot, check))
     return tuple(findings)
 
 
 def _exploitable(
-    function: str, flow: TaintFlow, advisory: Advisory, verdict: Verdict | None, hotspot: bool
+    function: str, flow: TaintFlow, advisory: Advisory, verdict: Verdict | None, hotspot: bool, check: ConditionCheck
 ) -> Finding:
     message = (
         f"{advisory.id}: {flow.source.label} input reaches {flow.sink.symbol}, affected in "
         f"the required {advisory.package} {advisory.vulnerable}: {advisory.summary}"
     )
     metadata = {
-        **evidence(advisory, flow.sink.symbol, "exploitable"),
+        **evidence(advisory, flow.sink.symbol, "exploitable", check),
         "source": str(flow.source.symbol),
         "source_label": flow.source.label,
         "verdict": "hotspot" if hotspot else "vulnerability",