coretrace-python-analyzer 0.5.0__py3-none-any.whl → 0.6.0__py3-none-any.whl

coretrace_python/__init__.py

@@ -1,4 +1,4 @@
 """CoreTrace's Python static analysis frontend."""
 
-__version__ = "0.5.0"
+__version__ = "0.6.0"
 

coretrace_python/bundled/dependency/reachable_vulnerability/reachable_vulnerability.py

@@ -1,16 +1,24 @@
-"""Calls, anywhere in the project, to an API affected by a vulnerable requirement."""
+"""Calls, anywhere in the project, to an API affected by a vulnerable requirement, and
+reads of an affected attribute whose getter runs the vulnerable code."""
 
 from __future__ import annotations
 
-from collections.abc import Sequence
+from collections.abc import Iterator, Sequence
 from typing import ClassVar
 
 from coretrace_python.analysis import AnyAnalysis
-from coretrace_python.dependency import DependencyAnalysis
-from coretrace_python.dependency.correlation import affected_symbols, check_conditions, evidence
+from coretrace_python.dependency import Advisory, DependencyAnalysis
+from coretrace_python.dependency.correlation import (
+    ConditionCheck,
+    affected_symbols,
+    check_conditions,
+    evidence,
+)
 from coretrace_python.findings import Confidence, Finding
 from coretrace_python.interprocedural import CallGraphAnalysis, ExternalSymbol
 from coretrace_python.plugins import ProjectContext, ProjectPlugin
+from coretrace_python.semantic.symbols import SymbolId
+from coretrace_python.source import SourceSpan
 
 
 class ReachableVulnerabilityPlugin(ProjectPlugin):
@@ -29,21 +37,46 @@ class ReachableVulnerabilityPlugin(ProjectPlugin):
                     if not isinstance(site.target, ExternalSymbol):
                         continue
                     for advisory in affected.get(site.target.symbol, ()):
-                        check = check_conditions(advisory.entry_point(site.target.symbol), site.arguments)
+                        entry = advisory.entry_point(site.target.symbol)
+                        if entry is not None and entry.read:
+                            continue  # a call reads its callee first: reported with the reads
+                        check = check_conditions(entry, site.arguments)
                         if check.contradicted is not None:
                             continue
-                        findings.append(
-                            Finding(
-                                rule_id="reachable-vulnerability",
-                                message=(
-                                    f"{advisory.id}: {site.target.symbol} is affected in the required "
-                                    f"{advisory.package} {advisory.vulnerable}: {advisory.summary}"
-                                ),
-                                severity=advisory.severity,
-                                confidence=Confidence.HIGH,
-                                span=site.location,
-                                function=function,
-                                metadata=evidence(advisory, site.target.symbol, "reachable", check),
-                            )
-                        )
+                        findings.append(_reached(advisory, site.target.symbol, site.location, function, check))
+                # Reading ``request.form.get`` reads ``request.form``: one finding per entry
+                # point and function, where the function first reads it.
+                reported: set[tuple[Advisory, SymbolId]] = set()
+                for read in graph.reads(function):
+                    for symbol in _read_through(read.symbol):
+                        for advisory in affected.get(symbol, ()):
+                            entry = advisory.entry_point(symbol)
+                            if entry is None or not entry.read or (advisory, symbol) in reported:
+                                continue
+                            reported.add((advisory, symbol))
+                            check = check_conditions(entry, None)
+                            findings.append(_reached(advisory, symbol, read.location, function, check))
         return findings
+
+
+def _read_through(symbol: SymbolId) -> Iterator[SymbolId]:
+    """``symbol`` and every symbol it is an attribute of, as reading it reads them all."""
+
+    components = symbol.canonical_name.split(".")
+    for end in range(len(components), 1, -1):
+        yield SymbolId(".".join(components[:end]))
+
+
+def _reached(advisory: Advisory, symbol: SymbolId, span: SourceSpan, function: str, check: ConditionCheck) -> Finding:
+    return Finding(
+        rule_id="reachable-vulnerability",
+        message=(
+            f"{advisory.id}: {symbol} is affected in the required "
+            f"{advisory.package} {advisory.vulnerable}: {advisory.summary}"
+        ),
+        severity=advisory.severity,
+        confidence=Confidence.HIGH,
+        span=span,
+        function=function,
+        metadata=evidence(advisory, symbol, "reachable", check),
+    )

coretrace_python/bundled/models/python_stdlib/python_stdlib.py

@@ -6,9 +6,28 @@ from typing import ClassVar
 
 from coretrace_python.plugins import ModelPlugin
 from coretrace_python.semantic.symbols import SymbolId
-from coretrace_python.taint import Model, Sanitizer, Sink, Source, TaintKind, Validator
+from coretrace_python.taint import (
+    Model,
+    SafeArgument,
+    Sanitizer,
+    Sink,
+    Source,
+    TaintKind,
+    Validator,
+)
 
 _ENVIRONMENT_KINDS = TaintKind.ALL & ~(TaintKind.COMMAND | TaintKind.PATH)
+# SafeLoader and BaseLoader build plain data only, in Python and in C, under every spelling.
+_SAFE_YAML_LOADERS = (
+    "python.yaml.SafeLoader",
+    "python.yaml.loader.SafeLoader",
+    "python.yaml.BaseLoader",
+    "python.yaml.loader.BaseLoader",
+    "python.yaml.CSafeLoader",
+    "python.yaml.cyaml.CSafeLoader",
+    "python.yaml.CBaseLoader",
+    "python.yaml.cyaml.CBaseLoader",
+)
 _PROCESS_OUTPUT_KINDS = TaintKind.ALL & ~TaintKind.PATH
 
 
@@ -66,6 +85,11 @@ class PythonStdlibModels(ModelPlugin):
         Sink(_sym("dill.loads"), TaintKind.DESERIALIZATION),
         Sink(_sym("jsonpickle.decode"), TaintKind.DESERIALIZATION),
         Sink(_sym("yaml.load"), TaintKind.DESERIALIZATION),
+        Sink(_sym("yaml.load_all"), TaintKind.DESERIALIZATION),
+        Sink(_sym("yaml.full_load_all"), TaintKind.DESERIALIZATION),
+        Sink(_sym("yaml.unsafe_load_all"), TaintKind.DESERIALIZATION),
+        SafeArgument(_sym("yaml.load"), "Loader", _SAFE_YAML_LOADERS, position=1, kinds=TaintKind.DESERIALIZATION),
+        SafeArgument(_sym("yaml.load_all"), "Loader", _SAFE_YAML_LOADERS, position=1, kinds=TaintKind.DESERIALIZATION),
         Sink(_sym("yaml.unsafe_load"), TaintKind.DESERIALIZATION),
         Sink(_sym("yaml.full_load"), TaintKind.DESERIALIZATION),
         Sanitizer(_sym("os.path.basename"), TaintKind.PATH),

coretrace_python/cache.py

@@ -4,9 +4,10 @@ A module's results are stored under a key derived from everything they depend on
 source text and identity, the engine, schema and plugin API versions, the plugins and
 their code, the security models, the advisories, the dependency graph, and the keys of
 the project modules it imports transitively. A module whose key is unchanged on a later
-run is served from the cache: its summaries seed the project index, its call sites serve
-the project plugins and its findings are reported as they were. Entries are JSON, so a
-tampered or foreign file can never execute anything; an unreadable entry is a miss.
+run is served from the cache: its summaries seed the project index, its call sites and
+symbol reads serve the project plugins and its findings are reported as they were.
+Entries are JSON, so a tampered or foreign file can never execute anything; an
+unreadable entry is a miss.
 """
 
 from __future__ import annotations
@@ -33,13 +34,14 @@ from coretrace_python.interprocedural import (
     Mutation,
     NonlocalWrite,
     SummaryIndex,
+    SymbolRead,
     Target,
     UnknownTarget,
 )
 from coretrace_python.semantic.symbols import SymbolId
 from coretrace_python.source import SourceId, SourceSpan
 
-CACHE_FORMAT = 7
+CACHE_FORMAT = 8
 
 
 @dataclass(frozen=True)
@@ -50,6 +52,7 @@ class CachedModule:
     summaries: Mapping[str, FunctionSummary]
     sites: tuple[CallSite, ...]
     findings: tuple[Finding, ...]
+    reads: tuple[SymbolRead, ...] = ()
 
     def __post_init__(self) -> None:
         object.__setattr__(self, "summaries", MappingProxyType(dict(self.summaries)))
@@ -134,6 +137,7 @@ def encode(module: CachedModule) -> dict[str, Any]:
         "summaries": {name: _encode_summary(s) for name, s in module.summaries.items()},
         "sites": [_encode_site(site) for site in module.sites],
         "findings": [_encode_finding(finding) for finding in module.findings],
+        "reads": [[r.function, _encode_span(r.location), str(r.symbol)] for r in module.reads],
     }
 
 
@@ -145,6 +149,7 @@ def decode(data: Mapping[str, Any]) -> CachedModule:
         {_string(name): _decode_summary(s) for name, s in data["summaries"].items()},
         tuple(_decode_site(site) for site in data["sites"]),
         tuple(_decode_finding(finding) for finding in data["findings"]),
+        tuple(_decode_read(read) for read in data["reads"]),
     )
 
 
@@ -194,6 +199,11 @@ def _decode_function(data: Any) -> ModuleFunction:
     return ModuleFunction(_string(name), _decode_span(span), None if entry_point is None else _string(entry_point))
 
 
+def _decode_read(data: Any) -> SymbolRead:
+    function, span, symbol = data
+    return SymbolRead(_string(function), _decode_span(span), SymbolId(_string(symbol)))
+
+
 def _encode_finding(finding: Finding) -> dict[str, Any]:
     return {
         "rule": finding.rule_id,

coretrace_python/cli.py

@@ -3,13 +3,20 @@ from __future__ import annotations
 import argparse
 import sys
 import zipfile
+from datetime import UTC, datetime
 from pathlib import Path
 
 from coretrace_python import __version__, engine
 from coretrace_python.analysis import AnalysisError
 from coretrace_python.cache import ProjectCache
 from coretrace_python.cfg import CFGError
-from coretrace_python.dependency import dump_advisories, import_osv, read_osv, render_sbom
+from coretrace_python.dependency import (
+    dump_advisories,
+    import_osv,
+    read_osv,
+    render_sbom,
+    render_vex,
+)
 from coretrace_python.findings import Severity
 from coretrace_python.findings.baseline import Baseline, BaselineError
 from coretrace_python.frontend import HIRBuildError, ParseError, build_hir
@@ -106,6 +113,14 @@ def build_parser() -> argparse.ArgumentParser:
         metavar="PATH",
         help="with --check on a directory, write a CycloneDX bill of materials to PATH",
     )
+    parser.add_argument(
+        "--vex",
+        type=Path,
+        default=None,
+        metavar="PATH",
+        help="with --check on a directory, write to PATH an OpenVEX document saying whether "
+        "each advisory affecting a requirement affects the project",
+    )
     parser.add_argument(
         "--advisories",
         action="append",
@@ -182,6 +197,9 @@ def main(argv: list[str] | None = None) -> int:
     if args.sbom is not None and not (args.check and args.path.is_dir()):
         print("error: --sbom only applies to --check on a directory", file=sys.stderr)
         return EXIT_ERROR
+    if args.vex is not None and not (args.check and args.path.is_dir()):
+        print("error: --vex only applies to --check on a directory", file=sys.stderr)
+        return EXIT_ERROR
     if args.advisories and not (args.check and args.path.is_dir()):
         print("error: --advisories only applies to --check on a directory", file=sys.stderr)
         return EXIT_ERROR
@@ -227,6 +245,20 @@ def main(argv: list[str] | None = None) -> int:
                         render_sbom(analysis.dependencies, analysis.advisories, engine.TOOL_NAME, __version__),
                         encoding="utf-8",
                     )
+                if args.vex is not None:
+                    args.vex.write_text(
+                        render_vex(
+                            analysis.dependencies,
+                            analysis.advisories,
+                            (*analysis.findings, *analysis.suppressed, *analysis.accepted),
+                            analysis.coverage,
+                            args.path,
+                            engine.TOOL_NAME,
+                            __version__,
+                            datetime.now(UTC),
+                        ),
+                        encoding="utf-8",
+                    )
             else:
                 file_analysis = engine.analyze_file(SourceManager().load_file(args.path), plugin_roots)
                 findings, coverage = file_analysis.findings, file_analysis.coverage

coretrace_python/dependency/__init__.py

@@ -22,6 +22,7 @@ from coretrace_python.dependency.graph import (
 )
 from coretrace_python.dependency.policy import POLICY_FILE, Policy, apply_policy, load_policy
 from coretrace_python.dependency.sbom import render_sbom
+from coretrace_python.dependency.vex import render_vex
 
 __all__ = [
     "ADVISORY_FILE",
@@ -45,4 +46,5 @@ __all__ = [
     "parse_dependencies",
     "read_osv",
     "render_sbom",
+    "render_vex",
 ]

coretrace_python/dependency/advisories.py

@@ -138,14 +138,7 @@ def dump_advisories(advisories: Iterable[Advisory]) -> str:
                 "severity": a.severity.value,
                 "affected_symbols": [str(s) for s in a.affected_symbols],
                 "aliases": list(a.aliases),
-                "entry_points": [
-                    {
-                        "symbol": str(e.symbol),
-                        "justification": e.justification,
-                        "conditions": [_condition_entry(c) for c in e.conditions],
-                    }
-                    for e in a.entry_points
-                ],
+                "entry_points": [_entry_point_entry(e) for e in a.entry_points],
                 "modules": list(a.modules),
             }
             for a in advisories
@@ -154,6 +147,17 @@ def dump_advisories(advisories: Iterable[Advisory]) -> str:
     return json.dumps(document, indent=2) + "\n"
 
 
+def _entry_point_entry(entry_point: AdvisoryEntryPoint) -> dict[str, Any]:
+    entry: dict[str, Any] = {
+        "symbol": str(entry_point.symbol),
+        "justification": entry_point.justification,
+        "conditions": [_condition_entry(c) for c in entry_point.conditions],
+    }
+    if entry_point.read:
+        entry["read"] = True
+    return entry
+
+
 def _condition_entry(condition: Condition) -> dict[str, Any]:
     entry: dict[str, Any] = {"kind": condition.kind, "text": condition.text}
     if condition.argument is not None:
@@ -194,10 +198,14 @@ def _advisory(entry: Mapping[str, Any]) -> Advisory:
 
 
 def _entry_point(entry: Mapping[str, Any]) -> AdvisoryEntryPoint:
+    read = entry.get("read", False)
+    if not isinstance(read, bool):
+        raise TypeError(f"entry point read must be true or false, got {read!r}")
     return AdvisoryEntryPoint(
         SymbolId(str(entry["symbol"])),
         str(entry["justification"]),
         tuple(_condition(c) for c in entry.get("conditions") or []),
+        read,
     )
 
 

coretrace_python/dependency/correlation.py

@@ -69,7 +69,7 @@ def check_conditions(entry: AdvisoryEntryPoint | None, arguments: Arguments | No
     met: list[Condition] = []
     pending: list[Condition] = []
     for condition in entry.conditions:
-        given = _given(condition, arguments) if condition.checkable and arguments is not None else None
+        given = arguments.given(condition.argument, condition.position) if condition.checkable and arguments is not None else None
         if given is None:
             pending.append(condition)
             continue
@@ -84,18 +84,6 @@ def check_conditions(entry: AdvisoryEntryPoint | None, arguments: Arguments | No
     return ConditionCheck(tuple(met), tuple(pending))
 
 
-def _given(condition: Condition, arguments: Arguments) -> tuple[bool, str | None] | None:
-    """Whether the call gives the condition's argument, and what it denotes: ``(True,
-    value)`` when given, ``(False, None)`` when surely absent, None when it cannot tell."""
-
-    for name, value in arguments.keywords:
-        if name == condition.argument:
-            return True, value
-    if condition.position is not None and condition.position < len(arguments.positional):
-        return True, arguments.positional[condition.position]
-    return None if arguments.unpacked else (False, None)
-
-
 def ruled_out(module: str, site: CallSite, check: ConditionCheck) -> str:
     """Which call a contradicted condition rules out, and why: ``app:12
     python.yaml.load(Loader=python.yaml.SafeLoader)``."""

coretrace_python/dependency/graph.py

@@ -1,7 +1,8 @@
 """Dependency resolution (architecture §26).
 
 Requirements declared in ``requirements.txt``, ``pyproject.toml`` (PEP 621 and Poetry)
-and pinned in ``poetry.lock`` or ``uv.lock`` become a ``DependencyGraph``. Versions are
+and pinned in ``poetry.lock`` or ``uv.lock`` become a ``DependencyGraph``; a lock file
+also tells which other packages require each package. Versions are
 compared with a small PEP 440 subset (``==``, ``!=``, ``<``, ``<=``, ``>``, ``>=``,
 ``~=`` and Poetry's ``^``), enough to decide whether a requirement may allow a version an
 advisory marks as vulnerable. Nothing is downloaded.
@@ -11,9 +12,9 @@ from __future__ import annotations
 
 import re
 import tomllib
-from collections.abc import Iterable, Mapping
+from collections.abc import Iterable, Iterator, Mapping
 from dataclasses import dataclass
-from pathlib import PurePath
+from pathlib import PurePath, PurePosixPath
 from types import MappingProxyType
 from typing import Any, ClassVar
 
@@ -168,11 +169,16 @@ class Condition:
 @dataclass(frozen=True)
 class AdvisoryEntryPoint:
     """A public API through which a project reaches an affected symbol, justified by the
-    fixing commit or by a call path, with the conditions under which it is affected."""
+    fixing commit or by a call path, with the conditions under which it is affected.
+
+    An entry point is reached by a call, or — when ``read`` is set, for an attribute whose
+    getter runs the affected code, such as a lazily parsed request body — by any read of
+    it or of an attribute of it."""
 
     symbol: SymbolId
     justification: str
     conditions: tuple[Condition, ...] = ()
+    read: bool = False
 
 
 DIRECT = "affected symbol, changed by the fix"
@@ -219,9 +225,15 @@ class Advisory:
 
 
 class DependencyGraph:
-    def __init__(self, requirements: Mapping[str, Requirement] | None = None, errors: tuple[str, ...] = ()) -> None:
+    def __init__(
+        self,
+        requirements: Mapping[str, Requirement] | None = None,
+        errors: tuple[str, ...] = (),
+        dependents: Mapping[str, frozenset[str]] | None = None,
+    ) -> None:
         self._requirements = MappingProxyType(dict(sorted((requirements or {}).items())))
         self.errors = errors
+        self._dependents = MappingProxyType(dict(dependents or {}))
 
     @property
     def names(self) -> tuple[str, ...]:
@@ -234,6 +246,12 @@ class DependencyGraph:
     def requirement(self, name: str) -> Requirement | None:
         return self._requirements.get(normalize(name))
 
+    def required_by(self, name: str) -> frozenset[str] | None:
+        """The other packages a lock file shows requiring ``name`` — an empty set when
+        only the project does — or None when no lock file mentions it."""
+
+        return self._dependents.get(normalize(name))
+
     def merge(self, other: DependencyGraph) -> DependencyGraph:
         merged = dict(self._requirements)
         for name, requirement in other._requirements.items():
@@ -248,7 +266,10 @@ class DependencyGraph:
                 requirement.pinned or current.pinned,
                 current.optional and requirement.optional,
             )
-        return DependencyGraph(merged, self.errors + other.errors)
+        dependents = dict(self._dependents)
+        for name, found in other._dependents.items():
+            dependents[name] = dependents.get(name, frozenset()) | found
+        return DependencyGraph(merged, self.errors + other.errors, dependents)
 
 
 def parse_dependencies(source: SourceFile) -> DependencyGraph:
@@ -260,7 +281,7 @@ def parse_dependencies(source: SourceFile) -> DependencyGraph:
     if name == "pyproject.toml":
         return _parse_toml(source, _pyproject_requirements)
     if name in ("poetry.lock", "uv.lock"):
-        return _parse_toml(source, _lock_requirements)
+        return _parse_toml(source, _lock_requirements, _lock_dependents)
     return DependencyGraph()
 
 
@@ -276,7 +297,7 @@ def _parse_requirements_txt(source: SourceFile) -> DependencyGraph:
     return DependencyGraph(found)
 
 
-def _parse_toml(source: SourceFile, extract: Any) -> DependencyGraph:
+def _parse_toml(source: SourceFile, extract: Any, dependents: Any = None) -> DependencyGraph:
     try:
         data = tomllib.loads(source.text)
     except tomllib.TOMLDecodeError as error:
@@ -284,7 +305,7 @@ def _parse_toml(source: SourceFile, extract: Any) -> DependencyGraph:
     found: dict[str, Requirement] = {}
     for requirement in extract(data, source):
         found[requirement.name] = requirement
-    return DependencyGraph(found)
+    return DependencyGraph(found, dependents=None if dependents is None else dependents(data))
 
 
 def _line_of(source: SourceFile, key: str, default: int = 1) -> int:
@@ -335,6 +356,52 @@ def _lock_requirements(data: Mapping[str, Any], source: SourceFile) -> list[Requ
     return found
 
 
+def _lock_dependents(data: Mapping[str, Any]) -> dict[str, frozenset[str]]:
+    """For every package a lock file lists or requires, the other locked packages that
+    require it, optional extras and development groups included. The project's own
+    packages — uv's editable or virtual sources inside the project — are not others."""
+
+    dependents: dict[str, set[str]] = {}
+    for package in data.get("package", []) or []:
+        name = package.get("name")
+        if not isinstance(name, str):
+            continue
+        dependents.setdefault(normalize(name), set())
+        own = _is_project_package(package)
+        for dependency in _locked_dependencies(package):
+            found = dependents.setdefault(dependency, set())
+            if not own:
+                found.add(normalize(name))
+    return {name: frozenset(found) for name, found in dependents.items()}
+
+
+def _locked_dependencies(package: Mapping[str, Any]) -> Iterator[str]:
+    declared = package.get("dependencies") or []
+    if isinstance(declared, Mapping):  # poetry.lock: ``name = specifier``, optional ones too
+        yield from (normalize(str(name)) for name in declared)
+        return
+    groups = (
+        declared,
+        *(package.get("optional-dependencies") or {}).values(),
+        *(package.get("dev-dependencies") or {}).values(),
+    )
+    for group in groups:
+        for entry in group or []:
+            if isinstance(entry, Mapping) and isinstance(entry.get("name"), str):
+                yield normalize(entry["name"])
+
+
+def _is_project_package(package: Mapping[str, Any]) -> bool:
+    source = package.get("source")
+    if not isinstance(source, Mapping):
+        return False
+    path = source.get("editable", source.get("virtual"))
+    if not isinstance(path, str):
+        return False
+    location = PurePosixPath(path)
+    return not location.is_absolute() and ".." not in location.parts
+
+
 class DependencyAnalysis(Analysis[DependencyGraph]):
     """The project's dependency graph, provided by the engine; empty for a lone file."""
 

coretrace_python/dependency/policy.py

@@ -29,6 +29,11 @@ class Policy:
     def denies(self, package: str) -> bool:
         return normalize(package) in {normalize(name) for name in self.deny}
 
+    def accepts(self, finding: Finding) -> bool:
+        """Whether ``finding`` is about an advisory the project accepts."""
+
+        return finding.metadata.get("advisory") in self.ignore
+
 
 def load_policy(path: Path) -> Policy:
     try:
@@ -61,5 +66,4 @@ def _boolean(value: Any, key: str) -> bool:
 def apply_policy(policy: Policy, findings: Iterable[Finding]) -> tuple[Finding, ...]:
     """The findings minus those about an advisory the policy accepts."""
 
-    ignored = set(policy.ignore)
-    return tuple(f for f in findings if f.metadata.get("advisory") not in ignored)
+    return tuple(f for f in findings if not policy.accepts(f))

coretrace_python/dependency/vex.py

@@ -0,0 +1,182 @@
+"""OpenVEX statements from the evidence of a check (architecture §26).
+
+One statement per advisory affecting a requirement, with the required package as the
+subcomponent of the project:
+
+- ``affected`` when the project's code reaches the vulnerable code: a reachable or
+  exploitable finding, whatever the policy or a suppression did with it;
+- ``not_affected``, as ``vulnerable_code_not_in_execute_path``, only when the advisory is
+  curated (it names entry points), no code of the project reaches them, every file and
+  function was analysed, and a lock file shows that no other package requires the
+  vulnerable one, since the code of installed packages is not analysed;
+- ``under_investigation`` otherwise, with the reason in its notes.
+"""
+
+from __future__ import annotations
+
+import hashlib
+import json
+from collections.abc import Iterable, Sequence
+from datetime import UTC, datetime
+from pathlib import Path, PurePosixPath
+from urllib.parse import quote
+
+from coretrace_python.dependency.graph import Advisory, DependencyGraph, Requirement
+from coretrace_python.dependency.sbom import purl
+from coretrace_python.findings import Finding
+from coretrace_python.findings.coverage import Coverage
+
+CONTEXT = "https://openvex.dev/ns/v0.2.0"
+# OpenVEX's shared namespace for documents without an IRI of their own, and the author
+# OpenVEX tools such as govulncheck write when none is known.
+NAMESPACE = "https://openvex.dev/docs/public/vex-"
+AUTHOR = "Unknown Author"
+# Evidence levels that put the vulnerable code in the project's execution path, lowest first.
+REACHED = ("reachable", "exploitable")
+
+
+def render_vex(
+    dependencies: DependencyGraph,
+    advisories: Iterable[Advisory],
+    evidence: Iterable[Finding],
+    coverage: Coverage,
+    root: Path,
+    tool_name: str,
+    tool_version: str,
+    timestamp: datetime,
+) -> str:
+    """The OpenVEX document of the project at ``root``. ``evidence`` is every finding of
+    the check, those suppressed or accepted by the policy included. The document's
+    identifier derives from its statements, not from ``timestamp``."""
+
+    root = root.resolve()
+    findings = tuple(evidence)
+    # The product must be an IRI; the check knows the project by its directory only.
+    product = f"pkg:generic/{quote(root.name, safe='')}"
+    statements: list[dict[str, object]] = []
+    for advisory in sorted(advisories, key=lambda a: (a.id, a.package)):
+        about = [
+            f
+            for f in findings
+            if f.metadata.get("advisory") == advisory.id and f.metadata.get("package") == advisory.package
+        ]
+        for requirement in dependencies.requirements:
+            if advisory.affects(requirement):
+                statements.append(
+                    {
+                        "vulnerability": _vulnerability(advisory),
+                        "products": [{"@id": product, "subcomponents": [{"@id": purl(requirement)}]}],
+                        **_status(advisory, requirement, about, dependencies, coverage, root),
+                    }
+                )
+    tooling = f"{tool_name} {tool_version}"
+    content = {
+        "@context": CONTEXT,
+        "author": AUTHOR,
+        "version": 1,
+        "tooling": tooling,
+        "statements": statements,
+    }
+    digest = hashlib.sha256(json.dumps(content, sort_keys=True).encode("utf-8")).hexdigest()
+    document = {
+        "@context": CONTEXT,
+        "@id": NAMESPACE + digest,
+        "author": AUTHOR,
+        "timestamp": timestamp.astimezone(UTC).isoformat(timespec="seconds").replace("+00:00", "Z"),
+        "version": 1,
+        "tooling": tooling,
+        "statements": statements,
+    }
+    return json.dumps(document, indent=2) + "\n"
+
+
+def _vulnerability(advisory: Advisory) -> dict[str, object]:
+    vulnerability: dict[str, object] = {"name": advisory.id, "description": advisory.summary}
+    if advisory.aliases:
+        vulnerability["aliases"] = list(advisory.aliases)
+    return vulnerability
+
+
+def _status(
+    advisory: Advisory,
+    requirement: Requirement,
+    findings: Sequence[Finding],
+    dependencies: DependencyGraph,
+    coverage: Coverage,
+    root: Path,
+) -> dict[str, str]:
+    package = requirement.name
+    reached = _reached(findings, root)
+    if reached:
+        return {
+            "status": "affected",
+            "action_statement": (
+                f"Update {package} to a version outside the vulnerable range {advisory.vulnerable}."
+            ),
+            "status_notes": f"Reached by the project's code at {reached}.",
+        }
+    if not advisory.entry_points:
+        return _investigating(
+            "The advisory names no entry point, so whether the project reaches the vulnerable "
+            "code is not known."
+        )
+    symbols = ", ".join(sorted(str(e.symbol) for e in advisory.entry_points))
+    entries = f"the entry points of {advisory.id} ({symbols})"
+    ruled_out = "; ".join(str(f.metadata["ruled_out"]) for f in findings if "ruled_out" in f.metadata)
+    ruled = f" Calls ruled out by their arguments: {ruled_out}." if ruled_out else ""
+    partial = sorted(
+        _relative(d.path, root)
+        for d in coverage.details
+        if d.status != "analysed" or d.analysed < d.functions
+    )
+    if partial:
+        return _investigating(
+            f"No analysed code reaches {entries}, but {', '.join(partial)} could not be fully "
+            f"analysed.{ruled}"
+        )
+    required_by = dependencies.required_by(package)
+    if required_by is None:
+        return _investigating(
+            f"No code of the project reaches {entries}, but no lock file shows which installed "
+            f"packages require {package}, and their code is not analysed.{ruled}"
+        )
+    if required_by:
+        return _investigating(
+            f"No code of the project reaches {entries}, but {package} is required by "
+            f"{', '.join(sorted(required_by))}, whose code is not analysed.{ruled}"
+        )
+    return {
+        "status": "not_affected",
+        "justification": "vulnerable_code_not_in_execute_path",
+        "impact_statement": (
+            f"No code of the project reaches {entries}, and no other locked package requires "
+            f"{package}.{ruled}"
+        ),
+    }
+
+
+def _reached(findings: Sequence[Finding], root: Path) -> str:
+    """Where the project's code reaches the vulnerable code, each place at its highest
+    level of evidence; empty when nothing reaches it."""
+
+    levels: dict[tuple[str, int, str], str] = {}
+    for finding in findings:
+        level = finding.metadata.get("level")
+        if level in REACHED:
+            path = _relative(str(finding.span.source_id), root)
+            place = (path, finding.span.start_line, str(finding.metadata.get("symbol")))
+            levels[place] = max(level, levels.get(place, level), key=REACHED.index)
+    return "; ".join(
+        f"{path}:{line} {symbol} ({level})" for (path, line, symbol), level in sorted(levels.items())
+    )
+
+
+def _investigating(notes: str) -> dict[str, str]:
+    return {"status": "under_investigation", "status_notes": notes}
+
+
+def _relative(path: str, root: Path) -> str:
+    try:
+        return PurePosixPath(Path(path).relative_to(root)).as_posix()
+    except ValueError:
+        return path

coretrace_python/engine.py

@@ -76,6 +76,7 @@ from coretrace_python.interprocedural import (
     ProjectSummaries,
     SummaryAnalysis,
     SummaryIndex,
+    SymbolRead,
     build_module_graph,
     discover_sources,
     project_symbol,
@@ -201,6 +202,8 @@ class ProjectAnalysis:
     coverage: Coverage = field(default_factory=Coverage)
     # Findings silenced by an inline ``# coretrace: ignore`` comment.
     suppressed: tuple[Finding, ...] = ()
+    # Findings about an advisory the policy accepts, still evidence of what is reached.
+    accepted: tuple[Finding, ...] = ()
 
 
 @dataclass(frozen=True)
@@ -466,7 +469,15 @@ def analyze_project(
         sites: dict[str, list[CallSite]] = {function.name: [] for function in entry.functions}
         for site in entry.sites:
             sites.setdefault(site.caller, []).append(site)
-        call_graphs[name] = CallGraph({}, {f: tuple(s) for f, s in sites.items()}, frozenset())
+        reads: dict[str, list[SymbolRead]] = {}
+        for read in entry.reads:
+            reads.setdefault(read.function, []).append(read)
+        call_graphs[name] = CallGraph(
+            {},
+            {f: tuple(s) for f, s in sites.items()},
+            frozenset(),
+            reads={f: tuple(r) for f, r in reads.items()},
+        )
     context = ProjectContext(graph, dependencies, advisories, analysable, call_graphs, policy, root, functions)
     for plugin in all_plugins:
         if isinstance(plugin, ProjectPlugin):
@@ -474,6 +485,7 @@ def analyze_project(
     for plugin in all_plugins:
         if isinstance(plugin, ProjectPlugin):
             findings = list(apply_refinement(plugin, findings, plugin.refine(context, tuple(findings))))
+    accepted = tuple(f for f in findings if policy.accepts(f))
     kept, suppressed = partition(apply_policy(policy, findings), _text_of(sources))
     return ProjectAnalysis(
         graph,
@@ -485,6 +497,7 @@ def analyze_project(
         advisories,
         Coverage(tuple(sorted(coverage, key=lambda c: c.path))),
         suppressed,
+        accepted,
     )
 
 
@@ -651,7 +664,8 @@ def _configuration_key(
 def _analyse_module(
     manager: AnalysisManager, plugins: tuple[Plugin, ...], affected: Affected
 ) -> CachedModule:
-    """One module's findings, summaries and call sites: what the cache keeps (§11)."""
+    """One module's findings, summaries, call sites and symbol reads: what the cache
+    keeps (§11)."""
 
     findings, supported = _check_module(manager, plugins)
     graph = manager.get(CallGraphAnalysis)
@@ -671,6 +685,7 @@ def _analyse_module(
         _summaries_of(manager),
         tuple(site for function in graph.functions for site in graph.sites(function)),
         (*findings, *correlated),
+        tuple(read for function in graph.functions for read in graph.reads(function)),
     )
 
 

coretrace_python/interprocedural/__init__.py

@@ -8,6 +8,7 @@ from coretrace_python.interprocedural.callgraph import (
     ExternalSymbol,
     KnownFunction,
     ModuleFunction,
+    SymbolRead,
     Target,
     UnknownTarget,
 )
@@ -46,6 +47,7 @@ __all__ = [
     "SummaryAnalysis",
     "SummaryIndex",
     "SummaryTable",
+    "SymbolRead",
     "Target",
     "UnknownTarget",
     "build_module_graph",

coretrace_python/interprocedural/callgraph.py

@@ -3,7 +3,8 @@
 Every call site of every analysable function resolves, through the SSA form, to a
 ``KnownFunction`` defined at module level, an ``ExternalSymbol`` reached through imports
 or builtins, or ``UnknownTarget`` (parameters, attributes, methods) until type inference
-and framework models narrow it down.
+and framework models narrow it down. The graph also keeps the symbols each function
+reads, called or not: reading ``request.form`` runs its getter.
 """
 
 from __future__ import annotations
@@ -72,6 +73,18 @@ class Arguments:
     keywords: tuple[tuple[str, str | None], ...] = ()
     unpacked: bool = False
 
+    def given(self, keyword: str | None, position: int | None = None) -> tuple[bool, str | None] | None:
+        """Whether the call gives an argument, by ``keyword`` or at ``position``, and what it
+        denotes: ``(True, value)`` when given, ``(False, None)`` when surely absent, None
+        when the call cannot tell because it unpacks arguments."""
+
+        for name, value in self.keywords:
+            if name == keyword:
+                return True, value
+        if position is not None and position < len(self.positional):
+            return True, self.positional[position]
+        return None if self.unpacked else (False, None)
+
 
 @dataclass(frozen=True)
 class CallSite:
@@ -81,6 +94,16 @@ class CallSite:
     arguments: Arguments = field(default_factory=Arguments)
 
 
+@dataclass(frozen=True)
+class SymbolRead:
+    """Where ``function`` first reads ``symbol``: an imported name or an attribute of a
+    value denoting a symbol (``request.form`` in ``request.form['name']``)."""
+
+    function: str
+    location: SourceSpan
+    symbol: SymbolId
+
+
 @dataclass(frozen=True)
 class ModuleFunction:
     """One function of a module as a project plugin sees it: the name the call graph
@@ -99,8 +122,10 @@ class CallGraph:
         sites: Mapping[str, tuple[CallSite, ...]],
         unsupported: frozenset[str],
         symbols: Mapping[str, Mapping[Value, SymbolId]] | None = None,
+        reads: Mapping[str, tuple[SymbolRead, ...]] | None = None,
     ) -> None:
         self._symbols = {name: MappingProxyType(dict(found)) for name, found in (symbols or {}).items()}
+        self._reads = MappingProxyType(dict(reads or {}))
         self.definitions: Mapping[str, nodes.Function] = MappingProxyType(dict(definitions))
         # A graph rebuilt from cached call sites has sites but no definitions.
         self.functions = tuple(dict.fromkeys((*definitions, *sites)))
@@ -126,6 +151,11 @@ class CallGraph:
     def sites(self, caller: str) -> tuple[CallSite, ...]:
         return self._sites.get(caller, ())
 
+    def reads(self, function: str) -> tuple[SymbolRead, ...]:
+        """The symbols ``function`` reads, each where it first reads it."""
+
+        return self._reads.get(function, ())
+
     def target_at(self, caller: str, location: SourceSpan) -> Target:
         site = self._at.get((caller, location))
         return site.target if site is not None else UnknownTarget()
@@ -207,6 +237,22 @@ def _arguments(call: Call, symbols: Mapping[Value, SymbolId], defs: Mapping[Valu
     )
 
 
+def _reads(name: str, function: FunctionIR, symbols: Mapping[Value, SymbolId]) -> tuple[SymbolRead, ...]:
+    first: dict[SymbolId, SymbolRead] = {}
+    for block in function.blocks:
+        for instruction in block.instructions:
+            if isinstance(instruction, Symbol | GetAttr) and instruction.result in symbols:
+                read = SymbolRead(name, instruction.location, symbols[instruction.result])
+                known = first.get(read.symbol)
+                if known is None or _position(read.location) < _position(known.location):
+                    first[read.symbol] = read
+    return tuple(sorted(first.values(), key=lambda read: (_position(read.location), str(read.symbol))))
+
+
+def _position(span: SourceSpan) -> tuple[int, int]:
+    return span.start_line, span.start_column
+
+
 def resolve_targets(
     function: FunctionIR,
     scopes: ScopeTable,
@@ -359,6 +405,7 @@ class CallGraphAnalysis(Analysis[CallGraph]):
                         break
         sites: dict[str, tuple[CallSite, ...]] = {}
         symbols: dict[str, Mapping[Value, SymbolId]] = {}
+        reads: dict[str, tuple[SymbolRead, ...]] = {}
         unsupported: set[str] = set()
         for name, function in definitions.items():
             try:
@@ -395,4 +442,5 @@ class CallGraphAnalysis(Analysis[CallGraph]):
                             )
                         )
             sites[name] = tuple(found)
-        return CallGraph(definitions, sites, frozenset(unsupported), symbols)
+            reads[name] = _reads(name, ssa, symbols[name])
+        return CallGraph(definitions, sites, frozenset(unsupported), symbols, reads)

coretrace_python/taint/__init__.py

@@ -16,6 +16,7 @@ from coretrace_python.taint.models import (
     ModelTable,
     NamedParameter,
     RouteRegistrar,
+    SafeArgument,
     Sanitizer,
     SecurityModelAnalysis,
     SecurityModelRegistry,
@@ -39,6 +40,7 @@ __all__ = [
     "RegisteredRoutes",
     "RouteRegistrar",
     "Routes",
+    "SafeArgument",
     "Sanitizer",
     "SecurityModelAnalysis",
     "SecurityModelRegistry",

coretrace_python/taint/engine.py

@@ -396,9 +396,9 @@ class _TaintProblem(DataflowProblem[State]):
     ) -> Taint:
         """Sinks, sanitizers and sources of a call to an external symbol."""
 
-        sink = self.models.sink(symbol)
+        given = self.graph.arguments_at(self.name, call.location)
+        sink = self.guarded(self.models.sink(symbol), given)
         if sink is not None:
-            given = self.graph.arguments_at(self.name, call.location)
             for position, argument in enumerate(call.arguments):
                 self.report(flows, sink, self.rendered(argument, state), argument, call, None, None, position, given)
             for argument in (*call.starred, *(value for _, value in call.keywords)):
@@ -413,6 +413,19 @@ class _TaintProblem(DataflowProblem[State]):
             return everything.join(Taint(source.kinds, frozenset({source})))
         return everything
 
+    def guarded(self, sink: Sink | None, arguments: Arguments) -> Sink | None:
+        """The sink as this call makes it: an argument declared safe (``yaml.load`` with
+        ``Loader=SafeLoader``) takes off the kinds it covers, and no kind left, no sink."""
+
+        if sink is None:
+            return None
+        safe = self.models.safe_argument(sink.symbol)
+        given = arguments.given(safe.argument, safe.position) if safe is not None else None
+        if safe is None or given is None or not given[0] or given[1] not in safe.values:
+            return sink
+        kinds = sink.kinds & ~safe.kinds
+        return Sink(sink.symbol, kinds, sink.positions) if kinds else None
+
     def rendered(self, argument: Value, state: Mapping[Key, Taint]) -> Taint:
         """The taint an argument brings to a sink. A container literal is serialised by
         every framework (``self.write({...})`` answers JSON), never rendered as markup, so
@@ -481,7 +494,7 @@ class _TaintProblem(DataflowProblem[State]):
             return taint, witness
 
         for reached in summary.external_calls:
-            sink = self.models.sink(reached.symbol)
+            sink = self.guarded(self.models.sink(reached.symbol), reached.arguments)
             if sink is None:
                 continue
             positions: list[int | None] = [*range(len(reached.argument_dependencies)), None]

coretrace_python/taint/models.py

@@ -149,6 +149,21 @@ class SuffixSink:
         return SymbolId(f"python.suffix.{self.suffix.replace('.', '_')}")
 
 
+@dataclass(frozen=True)
+class SafeArgument:
+    """A call to the sink ``symbol`` whose ``argument`` (by keyword, or at ``position``)
+    denotes one of ``values`` is not a sink for ``kinds``: ``yaml.load`` with
+    ``Loader=SafeLoader``. Values are written as call sites record them: a symbol by its
+    canonical name, a constant as Python writes it. Only a value given explicitly makes
+    the call safe; an absent argument, a variable or unpacked arguments leave the sink."""
+
+    symbol: SymbolId
+    argument: str
+    values: tuple[str, ...]
+    position: int | None = None
+    kinds: TaintKind = TaintKind.ALL
+
+
 @dataclass(frozen=True)
 class Validator:
     """A callable whose truth proves its ``argument`` safe (refutation evidence, §24)."""
@@ -178,6 +193,7 @@ Model = (
     | NamedParameter
     | RouteRegistrar
     | SuffixSink
+    | SafeArgument
 )
 
 
@@ -193,6 +209,7 @@ class ModelTable:
     named_parameters: tuple[NamedParameter, ...] = ()
     route_registrars: tuple[RouteRegistrar, ...] = ()
     suffix_sinks: tuple[SuffixSink, ...] = ()
+    safe_arguments: tuple[SafeArgument, ...] = ()
     _by_symbol: dict[type[Model], dict[SymbolId, Model]] = field(
         init=False, repr=False, compare=False
     )
@@ -207,6 +224,7 @@ class ModelTable:
             Validator: {m.symbol: m for m in self.validators},
             AuthorizationGuard: {m.symbol: m for m in self.authorizations},
             RouteRegistrar: {m.symbol: m for m in self.route_registrars},
+            SafeArgument: {m.symbol: m for m in self.safe_arguments},
         }
         object.__setattr__(self, "_by_symbol", MappingProxyType(index))
 
@@ -272,12 +290,17 @@ class ModelTable:
             self.named_parameters,
             self.route_registrars,
             self.suffix_sinks,
+            self.safe_arguments,
         )
 
     def sanitizer(self, symbol: SymbolId) -> Sanitizer | None:
         found = self._by_symbol[Sanitizer].get(symbol)
         return found if isinstance(found, Sanitizer) else None
 
+    def safe_argument(self, symbol: SymbolId) -> SafeArgument | None:
+        found = self._by_symbol[SafeArgument].get(symbol)
+        return found if isinstance(found, SafeArgument) else None
+
 
 class SecurityModelRegistry:
     """Mutable collection point for the models plugins register."""
@@ -323,6 +346,7 @@ class SecurityModelRegistry:
             named_parameters=tuple(m for m in models if isinstance(m, NamedParameter)),
             route_registrars=tuple(m for m in models if isinstance(m, RouteRegistrar)),
             suffix_sinks=tuple(m for m in models if isinstance(m, SuffixSink)),
+            safe_arguments=tuple(m for m in models if isinstance(m, SafeArgument)),
         )
 
 

{coretrace_python_analyzer-0.5.0.dist-info → coretrace_python_analyzer-0.6.0.dist-info}/METADATA

@@ -1,6 +1,6 @@
 Metadata-Version: 2.5
 Name: coretrace-python-analyzer
-Version: 0.5.0
+Version: 0.6.0
 Summary: Static security analysis infrastructure for Python code
 Project-URL: Homepage, https://github.com/CoreTrace/coretrace-python-analyzer
 Project-URL: Repository, https://github.com/CoreTrace/coretrace-python-analyzer

{coretrace_python_analyzer-0.5.0.dist-info → coretrace_python_analyzer-0.6.0.dist-info}/RECORD

@@ -1,8 +1,8 @@
-coretrace_python/__init__.py,sha256=utnxu8MbeZzYTN5zz5v2YJUPEiq63GzimvSef3LaKIo,75
+coretrace_python/__init__.py,sha256=MPB7k3sSK3YPPbcgkTbDkNy8vJRChFlClF8INwVFbTw,75
 coretrace_python/__main__.py,sha256=V8DnYtRboISK2VCKm7DGHLREKvqLbqApyWlKBOs26wU,65
-coretrace_python/cache.py,sha256=D14p9uzdise9HtkIEJVLZXICt5jUPcDYUMxo2iuh9g0,12427
-coretrace_python/cli.py,sha256=ZE6F8wqNcE-ogfldii-UgUq4nOcEMnHuMCzz0l--yuw,9792
-coretrace_python/engine.py,sha256=ZXEPnio1cRSMme9HP2kmHJaYpychCRDYpZSyFosEZx0,27625
+coretrace_python/cache.py,sha256=0FgPpr5frJrZ3HndMMNJwSmXtkdWYv1yvkvCDMENt5E,12823
+coretrace_python/cli.py,sha256=SwXYUR8DIgppkqom6kKNM701pb4p2omEy-hRXIM5yZE,10946
+coretrace_python/engine.py,sha256=Ou1gEoHThoi7eAqv12kIV7Wy16t6hCNVqzAEplUXCCI,28202
 coretrace_python/abstract/__init__.py,sha256=n5FNkV8Z4LmwG0r06KWdLj4N2CPSgAKwY3896tdmRgM,999
 coretrace_python/abstract/constants.py,sha256=z4-e7IzysxzGi58wFFff1MlEoV8l7AZsB9EL-q6b7vY,9071
 coretrace_python/abstract/heap.py,sha256=OaESXFGC0qzyhAr76xrCu4skeDVzZM4wlenQqfMTkdk,9642
@@ -14,7 +14,7 @@ coretrace_python/analysis/provider.py,sha256=Q_OlEcoLzBAsNdAGWijbj_n3E2Ep5UQ4Z8_
 coretrace_python/bundled/dependency/dependency_policy/dependency_policy.py,sha256=_CJYHijv4DTgfdumcCqAVV5_MPWjfZOadxeM5pQdw_k,1845
 coretrace_python/bundled/dependency/dependency_policy/plugin.toml,sha256=4w1TA-UKsa82WTnd1xy4bJuU3_G2RNCAWNICLPcZLMk,210
 coretrace_python/bundled/dependency/reachable_vulnerability/plugin.toml,sha256=LuF9jQqZfplN_GBky69Xjq2pksaX1Fs8PYEir-7-vY8,275
-coretrace_python/bundled/dependency/reachable_vulnerability/reachable_vulnerability.py,sha256=FwEqdDbkyYOUzF2piVteFfSzEm75tCnk2qRe8RvRNxA,2414
+coretrace_python/bundled/dependency/reachable_vulnerability/reachable_vulnerability.py,sha256=QFI8fj-k1xMtRDNEej9HvxEB9c40IME-ZTPzVwoCxKk,3838
 coretrace_python/bundled/dependency/sample_advisories/plugin.toml,sha256=cME4pSFzkFsxmIJGGBSrmXqynAd0dg34X-rgEoZ_u6E,184
 coretrace_python/bundled/dependency/sample_advisories/sample_advisories.py,sha256=jw98GK6hh5RAx05t8QPcUzsFMfGigAL8418vZLprKlc,3710
 coretrace_python/bundled/dependency/vulnerable_dependency/plugin.toml,sha256=4-OnbEb3lYVAoTfuz8mDPH4L9fHOPQ2KW1dDFAbClFk,267
@@ -38,7 +38,7 @@ coretrace_python/bundled/models/flask/plugin.toml,sha256=kI53Xwf5aZKd2n3fEQEbBzN
 coretrace_python/bundled/models/http_clients/http_client_models.py,sha256=TmVIg66zRRQxx3C9RT2XX6xLhemm037hIIBFRSyKzU0,1273
 coretrace_python/bundled/models/http_clients/plugin.toml,sha256=vq9tWHgy8-m8LiU1StGhm9Lsy7vnj3w90P4AKDaKfc0,216
 coretrace_python/bundled/models/python_stdlib/plugin.toml,sha256=DWqjG68rx91HCJi_VEp6tUs4ujkzlR7Lq7saMvtK2HM,187
-coretrace_python/bundled/models/python_stdlib/python_stdlib.py,sha256=Ko5_Wbir8ZDo7NNO1S_4BV2aVh-LvYh1maZuCxQ8las,3757
+coretrace_python/bundled/models/python_stdlib/python_stdlib.py,sha256=3LmjcFx3rUhM3Mpw86q8bS5Xj6gRJs_p6M-8yBGiK2k,4632
 coretrace_python/bundled/models/sqlalchemy/plugin.toml,sha256=2gRbglnMK5U2QWnzs2U2pDvmTeWmrlW7XpJ_8dRmIoY,182
 coretrace_python/bundled/models/sqlalchemy/sqlalchemy_models.py,sha256=Gm2qjyXUrjzALy-MigUhPQyyDxYdfWlQKDZLp1C6Jqk,1697
 coretrace_python/bundled/models/tornado/plugin.toml,sha256=u_XjJK2uKBR11zg4yGxsCDHcx2pKEQ1MBvvB6Mm0siA,222
@@ -88,12 +88,13 @@ coretrace_python/cfg/model.py,sha256=6EJiXFAGrsMgCdyxMJ6TClY8tQhJF6Hq2bX802Gc0yg
 coretrace_python/dataflow/__init__.py,sha256=N5uY8VTNjEk6-ARCgDkxr6uGqQIz2NbF-U9sC_v_lfA,547
 coretrace_python/dataflow/lattice.py,sha256=HgYGVcKVUlexvEc0yT47aQCudLxU_SWLpHhr17igkiE,1929
 coretrace_python/dataflow/solver.py,sha256=iDsW0wujhM2DXplu2JMKC46BRsroXlNETHPEoikPeG4,3475
-coretrace_python/dependency/__init__.py,sha256=sZdigKRbM4NkV0Dr86FDF3rFRQz35pICVX6obgO2Rxo,1065
-coretrace_python/dependency/advisories.py,sha256=9g9teb2bzkHmnR9tB86AmtLLlVPhfedP8wITFwmXEXI,8381
-coretrace_python/dependency/correlation.py,sha256=7a-i-1HbemzIfHFvdx0GcVuZ7gyI0o-NOT7-6uYoR_w,7797
-coretrace_python/dependency/graph.py,sha256=0w6bWq7YNb_qcF7H-S-YGClhjS7JsK9Fh1i-w1ONpBQ,13910
-coretrace_python/dependency/policy.py,sha256=u6nUw2nX-kTuqmw_vooxN8eXZoC31ZMoMaxC9pCcwec,2317
+coretrace_python/dependency/__init__.py,sha256=CXE36X2d5rio90NWlpjLo8Hly-tmzDCvu05FZAj_WXQ,1138
+coretrace_python/dependency/advisories.py,sha256=tfR-5BmjV4GYcsF3CSGA4jSXNwOVG6mS8AqPfy2fWms,8653
+coretrace_python/dependency/correlation.py,sha256=pR9S0tcdumdk2DMfUXxz6Wdul_RZE8FBfVmCUEhcA7w,7231
+coretrace_python/dependency/graph.py,sha256=6UpAsqbtr5EoVGp6qkaQ7Gi1iUbGtulyh0hfpK_RqLg,16875
+coretrace_python/dependency/policy.py,sha256=bsxZXL9xC0jnAzkzDh6ncnW8oKLG2H13jYmXF_q99Ng,2454
 coretrace_python/dependency/sbom.py,sha256=h4K3Gb9O_D6uZyfpwpC5rPcNjH_Ib-3uvFxix6OKlfs,2520
+coretrace_python/dependency/vex.py,sha256=ZPASwL6Var269WifrU7g1NRlDf-jxKKs8LzMo8dUkxI,7237
 coretrace_python/findings/__init__.py,sha256=gnJI-uB2CkgZ8I5aFYP_N5yZb7FGNIy7LirVDh4NLwo,372
 coretrace_python/findings/baseline.py,sha256=fbGQuULRsCjhxSNdwuLfwsvql9ZUfF3jqCXrRmIgOoQ,3468
 coretrace_python/findings/coverage.py,sha256=U8URLEz6EN4B_TTQlLFCOtEmUbINt7a0Bexb-6OUFlI,1203
@@ -106,8 +107,8 @@ coretrace_python/frontend/parser.py,sha256=6-CG7rWxUYeOGeDP206SJWy4BMQUP9Mr6Jf-t
 coretrace_python/hir/__init__.py,sha256=xMpvj-RSp6bd78a_hhkqbe99-snjERkH-_Lv5o9ASbw,180
 coretrace_python/hir/nodes.py,sha256=4BI0f3UhKbnz9ZIxMoKXM7ujav0BmRpD0OXaoblRxIk,12364
 coretrace_python/hir/visitors.py,sha256=JFnX09hK6trLyRcWgZ5ehOG2ywX3VvkqQ1h82nahYNg,885
-coretrace_python/interprocedural/__init__.py,sha256=TCX98DRbO0rXFcohwixpDZUVo_9Mdnkbn8wtlBeiu7Q,1128
-coretrace_python/interprocedural/callgraph.py,sha256=NuXogZcdcJwRB_UYiGHGsIss0REjfiQueel7Tfo_4fI,17565
+coretrace_python/interprocedural/__init__.py,sha256=SXtIGE3DD4fADIXLDuEvyT_3oIsh7Vio3BL4U6oUm28,1162
+coretrace_python/interprocedural/callgraph.py,sha256=E6enTawqcl4-TObdjvoFe6l1zEedvsWbnjEBD6omzy8,19827
 coretrace_python/interprocedural/modulegraph.py,sha256=4sB7OKjBYfxtm7aMtHm2jRlqFVUNUsdnLhnv9UZ1BWA,8846
 coretrace_python/interprocedural/summaries.py,sha256=q--xpp1euaf5utxbK4CZtS8CSyLJ6p3MLel5Iu80X3w,20747
 coretrace_python/ir/__init__.py,sha256=ShBPYYqoQFePP-mgBjGezQ2acel0-ReOHF9vCC-G_4Q,232
@@ -136,13 +137,13 @@ coretrace_python/semantic/symbols.py,sha256=3JptnnX5_KBlSd00L_wcGlYZQdnmBvSBAhfi
 coretrace_python/source/__init__.py,sha256=0Y8fvtbkETnNCJR9Zq7RS5TSgF9c22pz3SSk1KdAXF0,301
 coretrace_python/source/manager.py,sha256=JRmMOcWfS1nocbVrdcvfQTqEfIkmnb5JP857TpGywN4,2736
 coretrace_python/source/model.py,sha256=FZnN5mlir3tzbIpWoxnn6YtRi9UcJ_y0sZM60tKr8U4,1727
-coretrace_python/taint/__init__.py,sha256=BuZVlVE4h7Kr873dW3PZ7miBfHQvlRRcqvEaJVvJAas,1161
-coretrace_python/taint/engine.py,sha256=4IFD5uFXG6QhPRBM9lY87hVCpfPLTAd7oTJZbveY5ZI,38180
-coretrace_python/taint/models.py,sha256=H-Q_nChzwqm-MEGfbfw5jMegpXlIfwUIunFiRXbE90I,12005
+coretrace_python/taint/__init__.py,sha256=UIJwnPnyYODsvnpe6-cmF8tOvKoGvWE7yVH3yIfthcM,1199
+coretrace_python/taint/engine.py,sha256=UY59sb-sUWct3jzFHr6PBfJ_VFhZgb13tSyvD9nKqaM,38916
+coretrace_python/taint/models.py,sha256=23TMzT149dCpRULO3RAyzbZWmayXWw4-a5iRjrqC0yo,13074
 coretrace_python/taint/routes.py,sha256=UAJKXcw_sM9shf58FfDroxVO9bNSm4qrQdZknwUB0lo,6110
-coretrace_python_analyzer-0.5.0.dist-info/METADATA,sha256=v8A0jSjku33W6bQ9nd7aWtBRxGh0GQziPYycy8G4Igc,3216
-coretrace_python_analyzer-0.5.0.dist-info/WHEEL,sha256=W3fkpkm7-wf9vBI5Z-7s0eWkeM-spu78I8Neb98DeEg,87
-coretrace_python_analyzer-0.5.0.dist-info/entry_points.txt,sha256=wdozemiraOkbt65g_Y_zgspuZpoLxJdaCVMJt1Ft3c0,72
-coretrace_python_analyzer-0.5.0.dist-info/licenses/LICENSE,sha256=z8d0m5b2O9McPEK1xHG_dWgUBT6EfBDz6wA0F7xSPTA,11358
-coretrace_python_analyzer-0.5.0.dist-info/licenses/NOTICE,sha256=s3VHj5ngV0ozjW_kZJpg_35ne6JwoBK0ysOjbqVtA0w,113
-coretrace_python_analyzer-0.5.0.dist-info/RECORD,,
+coretrace_python_analyzer-0.6.0.dist-info/METADATA,sha256=WW3JCb3v2qbdWowN5kzDA1NRREuGErf-QysFU7k2kIU,3216
+coretrace_python_analyzer-0.6.0.dist-info/WHEEL,sha256=W3fkpkm7-wf9vBI5Z-7s0eWkeM-spu78I8Neb98DeEg,87
+coretrace_python_analyzer-0.6.0.dist-info/entry_points.txt,sha256=wdozemiraOkbt65g_Y_zgspuZpoLxJdaCVMJt1Ft3c0,72
+coretrace_python_analyzer-0.6.0.dist-info/licenses/LICENSE,sha256=z8d0m5b2O9McPEK1xHG_dWgUBT6EfBDz6wA0F7xSPTA,11358
+coretrace_python_analyzer-0.6.0.dist-info/licenses/NOTICE,sha256=s3VHj5ngV0ozjW_kZJpg_35ne6JwoBK0ysOjbqVtA0w,113
+coretrace_python_analyzer-0.6.0.dist-info/RECORD,,