coretrace-python-analyzer 0.4.0__tar.gz → 0.5.0__tar.gz

{coretrace_python_analyzer-0.4.0 → coretrace_python_analyzer-0.5.0}/CHANGELOG.md

@@ -1,5 +1,16 @@
 # Changelog
 
+## 0.5.0 (2026-09-24)
+
+### Dependencies
+
+- Argument conditions of advisory entry points are decided at each call, with a `position` for positional arguments and a `default` for absent ones: a call meeting them is reported with `conditions_met`, a call passing another known value does not reach the vulnerability and is listed in the requirement's `ruled_out`, and a call the analyzer cannot decide leaves them pending review (#110).
+
+### Plugins
+
+- `ProjectContext.functions(module)` gives project plugins every function of a module as its call graph names it, with its span and the label of the entry point it is (`http` for a route, `argv` for a command), decided by the taint engine's own rule; modules served from the cache keep them, and the cache format is bumped (#116).
+- Call sites and external calls record what each argument denotes — a symbol, a constant as Python writes it, or nothing known — in an `Arguments` record: `CallSite.arguments` (formerly the argument counts), `ExternalCall.arguments`, and `TaintFlow.sink_arguments` for the sink call of a flow, through callees in other modules too (#110).
+
 ## 0.4.0 (2026-09-24)
 
 ### Analysis

{coretrace_python_analyzer-0.4.0 → coretrace_python_analyzer-0.5.0}/PKG-INFO

@@ -1,6 +1,6 @@
 Metadata-Version: 2.5
 Name: coretrace-python-analyzer
-Version: 0.4.0
+Version: 0.5.0
 Summary: Static security analysis infrastructure for Python code
 Project-URL: Homepage, https://github.com/CoreTrace/coretrace-python-analyzer
 Project-URL: Repository, https://github.com/CoreTrace/coretrace-python-analyzer

{coretrace_python_analyzer-0.4.0 → coretrace_python_analyzer-0.5.0}/docs/plugins.md

@@ -222,9 +222,12 @@ rule. Findings carry a redacted preview only.
 
 Runs once per project after every module is analysed, with a `ProjectContext`: the
 module graph, the dependency graph, every advisory the plugins and advisory files
-contributed, the policy, the project root, and each module's imports and call graph. The
-shipped `vulnerable-dependency`, `reachable-vulnerability` and `dependency-policy` plugins
-are of this kind.
+contributed, the policy, the project root, and each module's imports, call graph and
+functions. `ctx.functions(module)` gives every function as the call graph names it
+(`Admin.get`, `outer.inner`, `<module>`), with its span, so a finding can be placed in
+one, and the label of the entry point it is (`http` for a route, `argv` for a command)
+when the models make it one. The shipped `vulnerable-dependency`,
+`reachable-vulnerability` and `dependency-policy` plugins are of this kind.
 
 ```python
 from collections.abc import Sequence
@@ -238,7 +241,7 @@ class RequirementsPresent(ProjectPlugin):
     name: ClassVar[str] = "requirements-present"
 
     def analyze_project(self, ctx: ProjectContext) -> Sequence[Finding]:
-        return ()  # inspect ctx.dependencies, ctx.modules(), ctx.call_graph(module)
+        return ()  # inspect ctx.dependencies, ctx.modules, ctx.call_graph(module), ctx.functions(module)
 ```
 
 ### Anything else: `Plugin`

{coretrace_python_analyzer-0.4.0 → coretrace_python_analyzer-0.5.0}/docs/usage.md

@@ -201,7 +201,7 @@ the directory of the checked file; a path outside it is printed as it is.
 ```json
 {
   "schema_version": 1,
-  "tool": {"name": "coretrace-python-analyzer", "version": "0.4.0"},
+  "tool": {"name": "coretrace-python-analyzer", "version": "0.5.0"},
   "root": "/home/me/project",
   "findings": [
     {
@@ -271,7 +271,8 @@ affected APIs that feed reachability and correlation:
           "symbol": "python.yaml.load",
           "justification": "same path when Loader is FullLoader",
           "conditions": [
-            {"kind": "argument", "text": "Loader is FullLoader", "argument": "Loader", "values": ["python.yaml.FullLoader"]},
+            {"kind": "argument", "text": "Loader is FullLoader, the default", "argument": "Loader", "position": 1,
+             "values": ["python.yaml.FullLoader", "python.yaml.loader.FullLoader"], "default": true},
             {"kind": "semantic", "text": "the document carries a python/object/apply tag"}
           ]
         }
@@ -285,17 +286,32 @@ affected APIs that feed reachability and correlation:
 
 `affected_symbols` are the functions the fix changed; `entry_points` the public APIs
 through which a project reaches them, each with the justification that ties it to the
-fix — the commit, or the call path — and the `conditions` under which it is affected: an
-argument value the engine can check, or a `semantic` condition it cannot yet, kept on the
-finding as pending review rather than dropped. A call to either kind of symbol is
-reachable. `modules` names the top-level modules the package installs, so the analyzer
-can tell an imported package from a merely required one; it defaults to the package name.
+fix — the commit, or the call path — and the `conditions` under which it is affected. A
+call to either kind of symbol is reachable. `modules` names the top-level modules the
+package installs, so the analyzer can tell an imported package from a merely required
+one; it defaults to the package name.
+
+An `argument` condition is decided at each call. It names the argument by keyword and,
+when it may be passed positionally, by `position` (counted from 0, the receiver of a
+method excluded); `values` are what makes the call affected, written as the analyzer
+sees arguments: a symbol by its canonical name (`python.yaml.FullLoader`, and every
+spelling a project may use, such as `python.yaml.loader.FullLoader`), a constant as
+Python writes it (`True`, `None`, `'/static'`); `default` says an absent argument means
+an affected value. A call passing another known value does not reach the vulnerability;
+a call passing a variable, or unpacking `*args` or `**kwargs`, leaves the condition
+pending review. A `semantic` condition — the document's tags, the platform, the
+template's origin — cannot be decided and is always pending review, never dropped.
 
 Every dependency finding records the highest level of evidence established in its
 `level` metadata: `declared` (the requirement allows a vulnerable version), `imported`
 (a module of the package is imported somewhere), `reachable` (an entry point or affected
-symbol is called) or `exploitable` (attacker input reaches it), with `entry_point`,
-`justification`, `conditions` and `conditions_pending_review` on the last two.
+symbol is called) or `exploitable` (attacker input reaches it). The last two carry
+`entry_point`, `justification`, `conditions`, and which of them the call meets
+(`conditions_met`) or leaves to review (`conditions_pending_review`). A requirement whose
+entry points are only called with arguments that contradict a condition stays
+`imported`, and its finding lists those calls in `ruled_out`
+(`app.views:12 python.yaml.load(Loader=python.yaml.SafeLoader)`), the evidence that
+they do not reach the vulnerability.
 
 A `coretrace-policy.toml` at the root, or the file passed with `--policy`, denies
 packages, requires pins and lists accepted advisories whose findings are dropped:

{coretrace_python_analyzer-0.4.0 → coretrace_python_analyzer-0.5.0}/pyproject.toml

@@ -4,7 +4,7 @@ build-backend = "hatchling.build"
 
 [project]
 name = "coretrace-python-analyzer"
-version = "0.4.0"
+version = "0.5.0"
 description = "Static security analysis infrastructure for Python code"
 readme = "README.md"
 requires-python = ">=3.11"

{coretrace_python_analyzer-0.4.0 → coretrace_python_analyzer-0.5.0}/src/coretrace_python/__init__.py

@@ -1,4 +1,4 @@
 """CoreTrace's Python static analysis frontend."""
 
-__version__ = "0.4.0"
+__version__ = "0.5.0"
 

{coretrace_python_analyzer-0.4.0 → coretrace_python_analyzer-0.5.0}/src/coretrace_python/bundled/dependency/reachable_vulnerability/reachable_vulnerability.py

@@ -7,7 +7,7 @@ from typing import ClassVar
 
 from coretrace_python.analysis import AnyAnalysis
 from coretrace_python.dependency import DependencyAnalysis
-from coretrace_python.dependency.correlation import affected_symbols, evidence
+from coretrace_python.dependency.correlation import affected_symbols, check_conditions, evidence
 from coretrace_python.findings import Confidence, Finding
 from coretrace_python.interprocedural import CallGraphAnalysis, ExternalSymbol
 from coretrace_python.plugins import ProjectContext, ProjectPlugin
@@ -29,6 +29,9 @@ class ReachableVulnerabilityPlugin(ProjectPlugin):
                     if not isinstance(site.target, ExternalSymbol):
                         continue
                     for advisory in affected.get(site.target.symbol, ()):
+                        check = check_conditions(advisory.entry_point(site.target.symbol), site.arguments)
+                        if check.contradicted is not None:
+                            continue
                         findings.append(
                             Finding(
                                 rule_id="reachable-vulnerability",
@@ -40,7 +43,7 @@ class ReachableVulnerabilityPlugin(ProjectPlugin):
                                 confidence=Confidence.HIGH,
                                 span=site.location,
                                 function=function,
-                                metadata=evidence(advisory, site.target.symbol, "reachable"),
+                                metadata=evidence(advisory, site.target.symbol, "reachable", check),
                             )
                         )
         return findings

{coretrace_python_analyzer-0.4.0 → coretrace_python_analyzer-0.5.0}/src/coretrace_python/bundled/dependency/vulnerable_dependency/plugin.toml

@@ -1,7 +1,7 @@
 name = "vulnerable-dependency"
 version = "1.0.0"
 plugin_api = ">=1,<2"
-requires = ["dependency.graph"]
+requires = ["dependency.graph", "interprocedural.callgraph"]
 provides = ["vulnerability.vulnerable-dependency"]
 
 [entrypoint]

{coretrace_python_analyzer-0.4.0 → coretrace_python_analyzer-0.5.0}/src/coretrace_python/bundled/dependency/vulnerable_dependency/vulnerable_dependency.py

@@ -7,23 +7,34 @@ from typing import ClassVar
 
 from coretrace_python.analysis import AnyAnalysis
 from coretrace_python.dependency import DependencyAnalysis
+from coretrace_python.dependency.correlation import affected_symbols, check_conditions, ruled_out
 from coretrace_python.findings import Confidence, Finding
+from coretrace_python.interprocedural import CallGraphAnalysis, ExternalSymbol
 from coretrace_python.plugins import ProjectContext, ProjectPlugin
 
 
 class VulnerableDependencyPlugin(ProjectPlugin):
     name: ClassVar[str] = "vulnerable-dependency"
-    requires: ClassVar[frozenset[AnyAnalysis]] = frozenset({DependencyAnalysis})
+    requires: ClassVar[frozenset[AnyAnalysis]] = frozenset({DependencyAnalysis, CallGraphAnalysis})
 
     def analyze_project(self, ctx: ProjectContext) -> Sequence[Finding]:
         findings: list[Finding] = []
         imported = [s for module in ctx.modules for s in ctx.imports(module).all_symbols()]
+        excluded = _ruled_out(ctx)
         for requirement in ctx.dependencies.requirements:
             for advisory in ctx.advisories:
                 if not advisory.affects(requirement):
                     continue
                 pinned = requirement.pinned is not None
                 level = "imported" if advisory.imported_by(imported) else "declared"
+                metadata = {
+                    "advisory": advisory.id,
+                    "package": advisory.package,
+                    "specifier": requirement.specifier,
+                    "level": level,
+                }
+                if excluded.get(advisory.id):
+                    metadata["ruled_out"] = "; ".join(excluded[advisory.id])
                 findings.append(
                     Finding(
                         rule_id="vulnerable-dependency",
@@ -35,12 +46,26 @@ class VulnerableDependencyPlugin(ProjectPlugin):
                         severity=advisory.severity,
                         confidence=Confidence.HIGH if pinned else Confidence.MEDIUM,
                         span=requirement.span,
-                        metadata={
-                            "advisory": advisory.id,
-                            "package": advisory.package,
-                            "specifier": requirement.specifier,
-                            "level": level,
-                        },
+                        metadata=metadata,
                     )
                 )
         return findings
+
+
+def _ruled_out(ctx: ProjectContext) -> dict[str, list[str]]:
+    """By advisory, the calls to its entry points whose arguments contradict one of its
+    conditions: the evidence that the requirement, imported, is not reached there."""
+
+    affected = affected_symbols(ctx.dependencies, ctx.advisories)
+    excluded: dict[str, list[str]] = {}
+    for module in sorted(ctx.modules):
+        graph = ctx.call_graph(module)
+        for function in graph.functions:
+            for site in graph.sites(function):
+                if not isinstance(site.target, ExternalSymbol):
+                    continue
+                for advisory in affected.get(site.target.symbol, ()):
+                    check = check_conditions(advisory.entry_point(site.target.symbol), site.arguments)
+                    if check.contradicted is not None:
+                        excluded.setdefault(advisory.id, []).append(ruled_out(module, site, check))
+    return excluded

{coretrace_python_analyzer-0.4.0 → coretrace_python_analyzer-0.5.0}/src/coretrace_python/cache.py

@@ -22,11 +22,13 @@ from typing import Any
 
 from coretrace_python.findings import Confidence, Finding, Severity
 from coretrace_python.interprocedural import (
+    Arguments,
     CallSite,
     ExternalCall,
     ExternalSymbol,
     FunctionSummary,
     KnownFunction,
+    ModuleFunction,
     ModuleGraph,
     Mutation,
     NonlocalWrite,
@@ -37,14 +39,14 @@ from coretrace_python.interprocedural import (
 from coretrace_python.semantic.symbols import SymbolId
 from coretrace_python.source import SourceId, SourceSpan
 
-CACHE_FORMAT = 5
+CACHE_FORMAT = 7
 
 
 @dataclass(frozen=True)
 class CachedModule:
     """Everything a later run needs from one module without lowering it again."""
 
-    functions: tuple[str, ...]
+    functions: tuple[ModuleFunction, ...]
     summaries: Mapping[str, FunctionSummary]
     sites: tuple[CallSite, ...]
     findings: tuple[Finding, ...]
@@ -128,7 +130,7 @@ class ProjectCache:
 def encode(module: CachedModule) -> dict[str, Any]:
     return {
         "format": CACHE_FORMAT,
-        "functions": list(module.functions),
+        "functions": [[f.name, _encode_span(f.span), f.entry_point] for f in module.functions],
         "summaries": {name: _encode_summary(s) for name, s in module.summaries.items()},
         "sites": [_encode_site(site) for site in module.sites],
         "findings": [_encode_finding(finding) for finding in module.findings],
@@ -139,7 +141,7 @@ def decode(data: Mapping[str, Any]) -> CachedModule:
     if data["format"] != CACHE_FORMAT:
         raise ValueError(f"unsupported cache format {data['format']!r}")
     return CachedModule(
-        tuple(_string(name) for name in data["functions"]),
+        tuple(_decode_function(function) for function in data["functions"]),
         {_string(name): _decode_summary(s) for name, s in data["summaries"].items()},
         tuple(_decode_site(site) for site in data["sites"]),
         tuple(_decode_finding(finding) for finding in data["findings"]),
@@ -187,6 +189,11 @@ def _decode_span(data: Any) -> SourceSpan:
     )
 
 
+def _decode_function(data: Any) -> ModuleFunction:
+    name, span, entry_point = data
+    return ModuleFunction(_string(name), _decode_span(span), None if entry_point is None else _string(entry_point))
+
+
 def _encode_finding(finding: Finding) -> dict[str, Any]:
     return {
         "rule": finding.rule_id,
@@ -219,6 +226,7 @@ def _encode_call(call: ExternalCall) -> dict[str, Any]:
         "keywords": sorted(call.keyword_dependencies),
         "location": _encode_span(call.location),
         "call_site": None if call.call_site is None else _encode_span(call.call_site),
+        "given": _encode_arguments(call.arguments),
     }
 
 
@@ -230,6 +238,7 @@ def _decode_call(data: Mapping[str, Any]) -> ExternalCall:
         _indices(data["keywords"]),
         _decode_span(data["location"]),
         None if site is None else _decode_span(site),
+        _decode_arguments(data["given"]),
     )
 
 
@@ -311,8 +320,7 @@ def _encode_site(site: CallSite) -> dict[str, Any]:
         "caller": site.caller,
         "location": _encode_span(site.location),
         "target": _encode_target(site.target),
-        "arguments": site.arguments,
-        "keywords": site.keywords,
+        "arguments": _encode_arguments(site.arguments),
     }
 
 
@@ -321,6 +329,27 @@ def _decode_site(data: Mapping[str, Any]) -> CallSite:
         _string(data["caller"]),
         _decode_span(data["location"]),
         _decode_target(data["target"]),
-        _integer(data["arguments"]),
-        _integer(data["keywords"]),
+        _decode_arguments(data["arguments"]),
+    )
+
+
+def _encode_arguments(arguments: Arguments) -> dict[str, Any]:
+    return {
+        "positional": list(arguments.positional),
+        "keywords": [[name, value] for name, value in arguments.keywords],
+        "unpacked": arguments.unpacked,
+    }
+
+
+def _decode_arguments(data: Mapping[str, Any]) -> Arguments:
+    def denoted(value: Any) -> str | None:
+        return None if value is None else _string(value)
+
+    unpacked = data["unpacked"]
+    if not isinstance(unpacked, bool):
+        raise TypeError(f"expected a boolean, got {unpacked!r}")
+    return Arguments(
+        tuple(denoted(value) for value in data["positional"]),
+        tuple((_string(name), denoted(value)) for name, value in data["keywords"]),
+        unpacked,
     )

{coretrace_python_analyzer-0.4.0 → coretrace_python_analyzer-0.5.0}/src/coretrace_python/dependency/advisories.py

@@ -160,6 +160,10 @@ def _condition_entry(condition: Condition) -> dict[str, Any]:
         entry["argument"] = condition.argument
     if condition.values:
         entry["values"] = list(condition.values)
+    if condition.position is not None:
+        entry["position"] = condition.position
+    if condition.default:
+        entry["default"] = True
     return entry
 
 
@@ -193,13 +197,22 @@ def _entry_point(entry: Mapping[str, Any]) -> AdvisoryEntryPoint:
     return AdvisoryEntryPoint(
         SymbolId(str(entry["symbol"])),
         str(entry["justification"]),
-        tuple(
-            Condition(
-                str(c["kind"]),
-                str(c["text"]),
-                None if c.get("argument") is None else str(c["argument"]),
-                tuple(str(v) for v in c.get("values") or []),
-            )
-            for c in entry.get("conditions") or []
-        ),
+        tuple(_condition(c) for c in entry.get("conditions") or []),
+    )
+
+
+def _condition(entry: Mapping[str, Any]) -> Condition:
+    position = entry.get("position")
+    if position is not None and (not isinstance(position, int) or isinstance(position, bool) or position < 0):
+        raise TypeError(f"condition position must be a non-negative integer, got {position!r}")
+    default = entry.get("default", False)
+    if not isinstance(default, bool):
+        raise TypeError(f"condition default must be true or false, got {default!r}")
+    return Condition(
+        str(entry["kind"]),
+        str(entry["text"]),
+        None if entry.get("argument") is None else str(entry["argument"]),
+        tuple(str(v) for v in entry.get("values") or []),
+        position,
+        default,
     )

{coretrace_python_analyzer-0.4.0 → coretrace_python_analyzer-0.5.0}/src/coretrace_python/dependency/correlation.py

@@ -10,10 +10,18 @@ are correlated here into one high-confidence ``exploitable-vulnerability`` findi
 from __future__ import annotations
 
 from collections.abc import Iterable, Mapping
-
-from coretrace_python.dependency.graph import DIRECT, Advisory, DependencyGraph
+from dataclasses import dataclass
+
+from coretrace_python.dependency.graph import (
+    DIRECT,
+    Advisory,
+    AdvisoryEntryPoint,
+    Condition,
+    DependencyGraph,
+)
 from coretrace_python.findings import Confidence, Finding, Severity
 from coretrace_python.findings.refutation import Status, Verdict, Verdicts
+from coretrace_python.interprocedural import Arguments, CallSite, ExternalSymbol
 from coretrace_python.semantic.symbols import SymbolId
 from coretrace_python.taint import Sink, TaintFlow, TaintKind
 
@@ -40,10 +48,68 @@ def advisory_sinks(affected: Affected) -> tuple[Sink, ...]:
     return tuple(Sink(symbol, TaintKind.ADVISORY) for symbol in affected)
 
 
-def evidence(advisory: Advisory, symbol: SymbolId, level: str) -> dict[str, str]:
+@dataclass(frozen=True)
+class ConditionCheck:
+    """What one call tells of an entry point's conditions: those it meets, those left to
+    review (every semantic one, and every argument one the call does not decide), and
+    the argument condition it contradicts with what it passes instead (None: absent),
+    in which case the call does not reach the vulnerability."""
+
+    met: tuple[Condition, ...] = ()
+    pending: tuple[Condition, ...] = ()
+    contradicted: Condition | None = None
+    passed: str | None = None
+
+
+def check_conditions(entry: AdvisoryEntryPoint | None, arguments: Arguments | None) -> ConditionCheck:
+    """Decide ``entry``'s conditions against what the call's ``arguments`` denote."""
+
+    if entry is None:
+        return ConditionCheck()
+    met: list[Condition] = []
+    pending: list[Condition] = []
+    for condition in entry.conditions:
+        given = _given(condition, arguments) if condition.checkable and arguments is not None else None
+        if given is None:
+            pending.append(condition)
+            continue
+        explicit, value = given
+        if explicit and value is None:
+            pending.append(condition)
+            continue
+        affected = value in condition.values if explicit else condition.default
+        if not affected:
+            return ConditionCheck(tuple(met), tuple(pending), condition, value)
+        met.append(condition)
+    return ConditionCheck(tuple(met), tuple(pending))
+
+
+def _given(condition: Condition, arguments: Arguments) -> tuple[bool, str | None] | None:
+    """Whether the call gives the condition's argument, and what it denotes: ``(True,
+    value)`` when given, ``(False, None)`` when surely absent, None when it cannot tell."""
+
+    for name, value in arguments.keywords:
+        if name == condition.argument:
+            return True, value
+    if condition.position is not None and condition.position < len(arguments.positional):
+        return True, arguments.positional[condition.position]
+    return None if arguments.unpacked else (False, None)
+
+
+def ruled_out(module: str, site: CallSite, check: ConditionCheck) -> str:
+    """Which call a contradicted condition rules out, and why: ``app:12
+    python.yaml.load(Loader=python.yaml.SafeLoader)``."""
+
+    assert check.contradicted is not None and isinstance(site.target, ExternalSymbol)
+    argument = check.contradicted.argument or f"#{check.contradicted.position}"
+    passed = f"{argument} absent" if check.passed is None else f"{argument}={check.passed}"
+    return f"{module}:{site.location.start_line} {site.target.symbol}({passed})"
+
+
+def evidence(advisory: Advisory, symbol: SymbolId, level: str, check: ConditionCheck) -> dict[str, str]:
     """What a finding keeps of the advisory for ``symbol``: the level of evidence
-    established, how the symbol relates to the vulnerability and under which
-    conditions, the ones the engine could not check listed as pending review."""
+    established, how the symbol relates to the vulnerability, and its conditions — those
+    the call meets and those left to review."""
 
     metadata = {"advisory": advisory.id, "package": advisory.package, "symbol": str(symbol), "level": level}
     entry = advisory.entry_point(symbol)
@@ -54,9 +120,10 @@ def evidence(advisory: Advisory, symbol: SymbolId, level: str) -> dict[str, str]
     metadata["justification"] = entry.justification
     if entry.conditions:
         metadata["conditions"] = "; ".join(c.text for c in entry.conditions)
-        # ponytail: no condition is checked yet, so every one awaits review; argument
-        # conditions get checked at the call site once call sites carry argument symbols.
-        metadata["conditions_pending_review"] = "; ".join(c.text for c in entry.conditions)
+    if check.met:
+        metadata["conditions_met"] = "; ".join(c.text for c in check.met)
+    if check.pending:
+        metadata["conditions_pending_review"] = "; ".join(c.text for c in check.pending)
     return metadata
 
 
@@ -77,21 +144,22 @@ def correlate(
         if verdict is not None and verdict.status is Status.REFUTED:
             continue
         hotspot = verdict is not None and verdict.status is Status.HOTSPOT
-        findings.extend(
-            _exploitable(function, flow, advisory, verdict, hotspot) for advisory in affected.get(flow.sink.symbol, ())
-        )
+        for advisory in affected.get(flow.sink.symbol, ()):
+            check = check_conditions(advisory.entry_point(flow.sink.symbol), flow.sink_arguments)
+            if check.contradicted is None:
+                findings.append(_exploitable(function, flow, advisory, verdict, hotspot, check))
     return tuple(findings)
 
 
 def _exploitable(
-    function: str, flow: TaintFlow, advisory: Advisory, verdict: Verdict | None, hotspot: bool
+    function: str, flow: TaintFlow, advisory: Advisory, verdict: Verdict | None, hotspot: bool, check: ConditionCheck
 ) -> Finding:
     message = (
         f"{advisory.id}: {flow.source.label} input reaches {flow.sink.symbol}, affected in "
         f"the required {advisory.package} {advisory.vulnerable}: {advisory.summary}"
     )
     metadata = {
-        **evidence(advisory, flow.sink.symbol, "exploitable"),
+        **evidence(advisory, flow.sink.symbol, "exploitable", check),
         "source": str(flow.source.symbol),
         "source_label": flow.source.label,
         "verdict": "hotspot" if hotspot else "vulnerability",

{coretrace_python_analyzer-0.4.0 → coretrace_python_analyzer-0.5.0}/src/coretrace_python/dependency/graph.py

@@ -147,13 +147,18 @@ class Condition:
     """What must hold for an entry point to reach, or exploit, the affected code: the
     value of an argument, the loader or algorithm used, the format decoded, the kind of
     input, a configuration. ``kind`` says whether the engine can check it: an
-    ``argument`` condition names the argument and the values that satisfy it; a
-    ``semantic`` condition cannot be checked yet and is reported as pending review."""
+    ``argument`` condition names the argument by keyword, and by ``position`` when it may
+    be passed positionally, and lists the ``values`` that satisfy it — symbols
+    (``python.yaml.FullLoader``) or constants as Python writes them (``True``);
+    ``default`` says an absent argument means a vulnerable value. A ``semantic``
+    condition cannot be checked and is reported as pending review."""
 
     kind: str
     text: str
     argument: str | None = None
     values: tuple[str, ...] = ()
+    position: int | None = None
+    default: bool = False
 
     @property
     def checkable(self) -> bool:

{coretrace_python_analyzer-0.4.0 → coretrace_python_analyzer-0.5.0}/src/coretrace_python/engine.py

@@ -71,6 +71,7 @@ from coretrace_python.interprocedural import (
     CallGraphAnalysis,
     CallSite,
     FunctionSummary,
+    ModuleFunction,
     ModuleGraph,
     ProjectSummaries,
     SummaryAnalysis,
@@ -106,6 +107,7 @@ from coretrace_python.semantic.symbols import SymbolAnalysis, SymbolId
 from coretrace_python.source import SourceFile, SourceId, SourceManager, SourceSpan, decode_text
 from coretrace_python.taint import (
     EntryPoint,
+    EntryPointAnalysis,
     ModelTable,
     RegisteredRoutes,
     Routes,
@@ -139,6 +141,7 @@ ALL_ANALYSES: tuple[AnyAnalysis, ...] = (
     ProjectSummaries,
     SecurityModelAnalysis,
     TaintAnalysis,
+    EntryPointAnalysis,
     RefutationAnalysis,
     DependencyAnalysis,
     RegisteredRoutes,
@@ -147,7 +150,7 @@ ALL_ANALYSES: tuple[AnyAnalysis, ...] = (
 
 # Named so the set stays right whichever analyses a build registers.
 _PROJECT_DEPENDANT_NAMES = frozenset(
-    {"interprocedural.project", "interprocedural.summaries", "taint.flows", "findings.refutation"}
+    {"interprocedural.project", "interprocedural.summaries", "taint.flows", "taint.entry_points", "findings.refutation"}
 )
 _PROJECT_DEPENDANTS: frozenset[AnyAnalysis] = frozenset(
     a for a in ALL_ANALYSES if a.name in _PROJECT_DEPENDANT_NAMES
@@ -451,6 +454,7 @@ def analyze_project(
 
     index = _seed(results, graph, frozenset())
     call_graphs: dict[str, CallGraph] = {}
+    functions: dict[str, tuple[ModuleFunction, ...]] = {}
     for name in sorted(analysable):
         entry = results[name]
         findings.extend(entry.findings)
@@ -458,11 +462,12 @@ def analyze_project(
         coverage.append(
             FileCoverage(str(files[name].source_id), "analysed", len(entry.functions), len(entry.functions) - unsupported)
         )
-        sites: dict[str, list[CallSite]] = {function: [] for function in entry.functions}
+        functions[name] = entry.functions
+        sites: dict[str, list[CallSite]] = {function.name: [] for function in entry.functions}
         for site in entry.sites:
             sites.setdefault(site.caller, []).append(site)
         call_graphs[name] = CallGraph({}, {f: tuple(s) for f, s in sites.items()}, frozenset())
-    context = ProjectContext(graph, dependencies, advisories, analysable, call_graphs, policy, root)
+    context = ProjectContext(graph, dependencies, advisories, analysable, call_graphs, policy, root, functions)
     for plugin in all_plugins:
         if isinstance(plugin, ProjectPlugin):
             findings.extend(plugin.analyze_project(context))
@@ -662,7 +667,7 @@ def _analyse_module(
                 )
             )
     return CachedModule(
-        graph.functions,
+        manager.get(EntryPointAnalysis),
         _summaries_of(manager),
         tuple(site for function in graph.functions for site in graph.sites(function)),
         (*findings, *correlated),

{coretrace_python_analyzer-0.4.0 → coretrace_python_analyzer-0.5.0}/src/coretrace_python/interprocedural/__init__.py

@@ -1,11 +1,13 @@
 """Call graph and function summaries (architecture §19, §20)."""
 
 from coretrace_python.interprocedural.callgraph import (
+    Arguments,
     CallGraph,
     CallGraphAnalysis,
     CallSite,
     ExternalSymbol,
     KnownFunction,
+    ModuleFunction,
     Target,
     UnknownTarget,
 )
@@ -28,6 +30,7 @@ from coretrace_python.interprocedural.summaries import (
 )
 
 __all__ = [
+    "Arguments",
     "CallGraph",
     "CallGraphAnalysis",
     "CallSite",
@@ -35,6 +38,7 @@ __all__ = [
     "ExternalSymbol",
     "FunctionSummary",
     "KnownFunction",
+    "ModuleFunction",
     "ModuleGraph",
     "Mutation",
     "NonlocalWrite",