coretrace-python-analyzer 0.5.0__tar.gz → 0.7.0__tar.gz

{coretrace_python_analyzer-0.5.0 → coretrace_python_analyzer-0.7.0}/CHANGELOG.md

@@ -1,5 +1,37 @@
 # Changelog
 
+## 0.7.0 (2026-09-25)
+
+### Precision
+
+- A dominating guard makes a flow a hotspot only when it examines what the sink receives. `if request.method == 'POST':` before `request.POST['cmd']` no longer lowers a vulnerability to a hotspot. A test of the value itself, of the same attribute, of a method called on it (`form.is_valid()`), or of any part of an object the flow passes whole still does. The regression snapshots record the verdict of each taint finding (#135).
+- The SSRF sinks of Requests and httpx read the destination only: the URL (the first argument, the second after the method for `request` and `stream`, or `url=`) or the prepared request `send` takes. Attacker data in the body, the JSON, the headers or the query parameters is no longer a server-side request forgery. `Sink` gains `keywords` next to `positions`, and function summaries keep the name of each keyword argument, so a project function forwarding `url=` still reaches the sink; the cache format is bumped (#128).
+- `render_to_string` escapes what it renders where the analyzer can establish it: on a directory check, it reads the project's Django templates, and a template escapes when neither it nor what it extends or includes marks output safe, uses a tag, filter or library beyond Django's own, or prints a variable where HTML escaping does not protect it, and no settings turn autoescaping off. Data reaching a response through such a template is no longer `xss`; any other template keeps the flow reported. `TemplateRender` declares such rendering calls, and the escaped templates are part of the cache key (#130).
+- Django's `csrf.get_token` returns a token of letters and digits whatever the request holds, and `reverse`/`reverse_lazy` build a local path that attacker data in their arguments or query cannot turn into another host: the first is no longer an injection, the second no longer an open redirect. `reverse` still carries other kinds, since it leaves `'` unquoted (#132).
+
+## 0.6.0 (2026-09-24)
+
+### Reports
+
+- `--vex PATH` writes an OpenVEX document with one statement per advisory affecting a requirement. A statement is `affected` when the project's code reaches the vulnerability, including findings the policy accepts or a comment suppresses. It is `not_affected` (`vulnerable_code_not_in_execute_path`) only for an advisory with entry points that nothing reaches, in a complete analysis, and when the lock file shows no other package requiring the vulnerable one. Anything else is `under_investigation`, with the reason (#97).
+
+### Dependencies
+
+- An advisory entry point marked `read` is an attribute whose getter runs the affected code, such as `request.form`: reading it is reachable, called or not — a subscript, an iteration or a method called on it reads it — with one finding per function, where it is first read (#111).
+- A lock file records which packages require which. `DependencyGraph.required_by(name)` gives the other packages requiring a package; the project's own packages are not counted. `ProjectAnalysis.accepted` keeps the findings of advisories the policy accepts (#97).
+
+### Detection
+
+- `yaml.load_all`, `yaml.full_load_all` and `yaml.unsafe_load_all` are deserialization sinks like their single-document versions; `yaml.load_all` with a safe loader is not, and `yaml.safe_load_all` stays safe (#123).
+
+### Precision
+
+- A sink call can be made safe by one of its arguments: a `SafeArgument` model names the argument and the values that take kinds off the sink, only when the call gives one explicitly. `yaml.load` with `SafeLoader`, `BaseLoader` or their C versions, under every spelling, is no longer an insecure deserialization; an absent loader, another loader, a variable or unpacked arguments still are (#121).
+
+### Plugins
+
+- The call graph records the symbols each function reads, called or not, where it first reads each: `CallGraph.reads(function)` gives them as `SymbolRead` records, modules served from the cache keep them, and the cache format is bumped (#111).
+
 ## 0.5.0 (2026-09-24)
 
 ### Dependencies

{coretrace_python_analyzer-0.5.0 → coretrace_python_analyzer-0.7.0}/PKG-INFO

@@ -1,6 +1,6 @@
 Metadata-Version: 2.5
 Name: coretrace-python-analyzer
-Version: 0.5.0
+Version: 0.7.0
 Summary: Static security analysis infrastructure for Python code
 Project-URL: Homepage, https://github.com/CoreTrace/coretrace-python-analyzer
 Project-URL: Repository, https://github.com/CoreTrace/coretrace-python-analyzer

{coretrace_python_analyzer-0.5.0 → coretrace_python_analyzer-0.7.0}/docs/plugins.md

@@ -141,18 +141,20 @@ class BottleModels(ModelPlugin):
 | Model | Declares |
 |---|---|
 | `Source(symbol, label, kinds=ALL)` | A call or attribute whose value is attacker-controlled; `label` names it in messages (`http`, `stdin`, `argv`, `http-response`). `kinds` restricts what it can inject. |
-| `Sink(symbol, kinds, positions=())` | A call dangerous for `kinds`; `positions` limits a kind to given argument indexes, as SQL sinks read the statement only. |
+| `Sink(symbol, kinds, positions=(), keywords=())` | A call dangerous for `kinds`. `positions` limits a kind to the given argument indexes, and `keywords` to the given keyword names; a restricted kind reaches only the arguments listed there. SQL sinks read the statement only, and the SSRF sinks of HTTP clients read the URL, by position or as `url=`. A starred argument or `**kwargs` reaches no restricted kind. |
 | `Sanitizer(symbol, kinds)` | A call whose result is safe for `kinds`. |
 | `EntryPoint(symbol, label, kinds=ALL)` | A decorator or a class base whose functions receive their parameters as `label` input, such as `flask.Flask.route`. |
 | `TypedParameter(symbol, label, kinds=ALL)` | A class whose annotated parameters carry `label` input, such as Django's `HttpRequest`. |
 | `NamedParameter(pattern, label, kinds)` | A regular expression on parameter names; matching parameters carry `kinds`, as `password` carries `CREDENTIAL`. |
 | `RouteRegistrar(symbol, argument, label, kinds=ALL, keyword=None)` | A call registering a view at argument `argument` (or `keyword`), such as Django's `path`; the view receives `label` input. |
 | `SuffixSink(suffix, kinds, positions=())` | A sink matched by the end of the symbol, for methods of any class such as `objects.raw`. |
+| `SafeArgument(symbol, argument, values, position=None, kinds=ALL)` | A call to the sink `symbol` whose `argument` (by keyword, or at `position`) denotes one of `values` is not a sink for `kinds`, such as `yaml.load` with `Loader=yaml.SafeLoader`. Values are written as the analyzer records arguments: a symbol by its canonical name, a constant as Python writes it (`True`). Only a value given explicitly makes the call safe. |
+| `TemplateRender(symbol, position=0, keyword="template_name")` | A call rendering, with autoescaping, the template named by its argument at `position` or `keyword`, such as `render_to_string`. What it returns carries no `HTML` when the name is written in the call and the project's template escapes everything it prints (see the usage guide). |
 | `Validator(symbol, kinds=ALL, argument=0)` | A callable whose truth proves its argument safe, such as `re.fullmatch`; a flow guarded by it is refuted. |
 | `AuthorizationGuard(symbol, label)` | A decorator or a condition restricting who reaches the code, such as `login_required`; a flow behind it is a hotspot. |
 
 Two plugins may describe the same symbol. An identical model is registered once; two
-`Sink` models merge their kinds and positions, so a plugin can add `SQL` to a sink
+`Sink` models merge their kinds, positions and keywords, so a plugin can add `SQL` to a sink
 another plugin declared for `COMMAND`; any other difference is a conflict that stops
 the analysis with a `ModelError` naming both plugins.
 
@@ -226,8 +228,11 @@ contributed, the policy, the project root, and each module's imports, call graph
 functions. `ctx.functions(module)` gives every function as the call graph names it
 (`Admin.get`, `outer.inner`, `<module>`), with its span, so a finding can be placed in
 one, and the label of the entry point it is (`http` for a route, `argv` for a command)
-when the models make it one. The shipped `vulnerable-dependency`,
-`reachable-vulnerability` and `dependency-policy` plugins are of this kind.
+when the models make it one. `ctx.call_graph(module)` gives each function's call sites
+(`sites(function)`) and the symbols it reads, called or not (`reads(function)`: reading
+`request.form['name']` reads `python.flask.request.form`), each where it first reads it.
+The shipped `vulnerable-dependency`, `reachable-vulnerability` and `dependency-policy`
+plugins are of this kind.
 
 ```python
 from collections.abc import Sequence

{coretrace_python_analyzer-0.5.0 → coretrace_python_analyzer-0.7.0}/docs/usage.md

@@ -50,6 +50,7 @@ coretrace-python-analyzer [--check | --emit-ir [--ssa]] [options] [path]
 | `--cache DIR` | Keep per-module results under `DIR` and reuse them for unchanged modules. |
 | `--jobs N` | Analyse independent modules in `N` processes. |
 | `--sbom PATH` | Write a CycloneDX bill of materials of the dependencies to `PATH`. |
+| `--vex PATH` | Write an OpenVEX document to `PATH`: whether each advisory affecting a requirement affects the project. |
 | `--advisories FILE` | Read a local advisory file in addition to `advisories.json` at the root. Repeatable. |
 | `--policy FILE` | Apply this dependency policy instead of `coretrace-policy.toml` at the root. |
 | `--import-advisories SRC OUT` | Convert an OSV dump into the local advisory file `OUT`, then exit. |
@@ -59,7 +60,7 @@ coretrace-python-analyzer [--check | --emit-ir [--ssa]] [options] [path]
 | `--ssa` | With `--emit-ir`, print the static single assignment form. |
 | `--help` | Show the options and exit. |
 
-`--cache`, `--jobs`, `--sbom`, `--advisories` and `--policy` apply to a directory check.
+`--cache`, `--jobs`, `--sbom`, `--vex`, `--advisories` and `--policy` apply to a directory check.
 
 ## What is analysed
 
@@ -107,9 +108,9 @@ a sanitizer for that kind of sink.
 | `command-injection` | Shell or process execution (`os.system`, `subprocess` with a string, …). |
 | `sql-injection` | A database statement (`cursor.execute`, SQLAlchemy `text`, Django `raw`, …). Parameters of a parameterised query are not statements. |
 | `path-traversal` | A file system path (`open`, `send_file`, `os.remove`, …). |
-| `ssrf` | The URL of an HTTP client request (Requests, httpx, `urllib`). |
-| `xss` | An HTTP response body built without escaping. |
-| `insecure-deserialization` | `pickle`, `yaml.load` and similar loaders. |
+| `ssrf` | The URL of an HTTP client request (Requests, httpx, `urllib`), by position or as `url=`; the body, headers and query parameters are not the destination. |
+| `xss` | An HTTP response body built without escaping. A Django template rendered by `render_to_string` escapes, where the analyzer can establish it (below). |
+| `insecure-deserialization` | `pickle`, `marshal`, `dill`, `jsonpickle`, `shelve`, and the YAML loaders (`yaml.load`, `load_all`, `full_load`, `unsafe_load` and their several-document versions); `yaml.load` and `load_all` given a safe loader (`SafeLoader`, `BaseLoader`) are not. |
 | `open-redirect` | An HTTP redirect target. |
 | `plaintext-credential-storage` | A parameter named like a password stored in a database without hashing. Medium confidence, since a name is a hint. |
 | `exploitable-vulnerability` | An API affected by an advisory of a vulnerable requirement, see Dependencies. |
@@ -117,9 +118,42 @@ a sanitizer for that kind of sink.
 Each flow is judged before it is reported. A dominating guard that proves the value
 safe (`isdigit()`, membership in a constant collection, equality with a constant, a
 numeric value proven by `int()`, `len()` or bounded arithmetic, a validator such as
-`re.fullmatch`) refutes it and nothing is reported. A guard that only mentions the value,
-or an authorization decorator such as `login_required`, makes it a hotspot reported at
-medium confidence. The verdict and its evidence are in the finding's metadata.
+`re.fullmatch`) refutes it and nothing is reported. A hotspot is reported at medium
+confidence. Two things make a flow a hotspot:
+
+- A guard that examines the data without proving it safe. That covers a test of the value
+  itself (`if cmd:`, `len(cmd) < 10`), of the same attribute, or of a method called on
+  it (`form.is_valid()`).
+- An authorization decorator such as `login_required`.
+
+A guard that reads another attribute of the object the data comes from is no guard of
+that data. `if request.method == 'POST':` before `os.system(request.POST['cmd'])` leaves
+a vulnerability. When the flow passes the object whole, to the sink or to a function,
+a guard on any of its attributes still counts. The verdict and its evidence are in the
+finding's metadata.
+
+Django's `render_to_string(name, context)` returns HTML in which autoescaping escaped
+every variable, so data reaching a response through it is no `xss`, if the template really
+escapes. On a directory check, the analyzer reads the project's templates to decide it.
+
+It establishes escaping only when all of the following hold:
+
+- It finds every template of that name under a `templates` directory, by the path Django
+  uses (`app/page.html`), and everything those templates extend or include.
+- None of them marks output safe: `|safe`, `|safeseq` or `{% autoescape off %}`.
+- None of them uses a tag or filter beyond Django's own, or loads a library beyond its
+  built-ins (`static`, `i18n`, `l10n`, `tz`, `cache`, `humanize`).
+- None of them places a variable where HTML escaping does not protect it: a `<script>`
+  or `<style>` block, an event handler (`onclick="…"`), a `style` attribute, a URL
+  attribute not fixed by a relative or `http(s)://host/` prefix, an unquoted attribute,
+  or an attribute name.
+- No Python file of the project sets `autoescape` to `False`.
+
+The analyzer never assumes escaping where it cannot read the template. That covers a
+template named by an expression, a template found through a `DIRS` entry not named
+`templates`, one shipped by an installed package, one rendered through `get_template`,
+and Flask's Jinja2 templates. The flow is then reported as before. A single-file check
+reads no template.
 
 ### Dangerous API usage
 
@@ -151,7 +185,7 @@ sources and in configuration files.
 | Rule | Trigger |
 |---|---|
 | `vulnerable-dependency` | A requirement allows a version affected by an advisory, reported at its line. |
-| `reachable-vulnerability` | A call in the project to an API the advisory affects. |
+| `reachable-vulnerability` | A call in the project to an API the advisory affects, or a read of an entry point marked `read`. |
 | `exploitable-vulnerability` | Attacker-controlled data reaches such a call. Critical. |
 | `denied-dependency` | A package the policy denies. |
 | `unpinned-dependency` | A requirement without an exact pin when the policy requires pins. |
@@ -201,7 +235,7 @@ the directory of the checked file; a path outside it is printed as it is.
 ```json
 {
   "schema_version": 1,
-  "tool": {"name": "coretrace-python-analyzer", "version": "0.5.0"},
+  "tool": {"name": "coretrace-python-analyzer", "version": "0.7.0"},
   "root": "/home/me/project",
   "findings": [
     {
@@ -291,6 +325,13 @@ call to either kind of symbol is reachable. `modules` names the top-level module
 package installs, so the analyzer can tell an imported package from a merely required
 one; it defaults to the package name.
 
+An entry point marked `"read": true` is an attribute whose getter runs the affected code,
+such as a request body parsed on first access
+(`{"symbol": "python.flask.request.form", "justification": "…", "read": true}`): reading
+it is reachable, called or not — `request.form['name']`, `for key in request.form`,
+`request.form.get('name')` all read it. A function reading it several times is reported
+once, where it first reads it.
+
 An `argument` condition is decided at each call. It names the argument by keyword and,
 when it may be passed positionally, by `position` (counted from 0, the receiver of a
 method excluded); `values` are what makes the call affected, written as the analyzer
@@ -305,7 +346,8 @@ template's origin — cannot be decided and is always pending review, never drop
 Every dependency finding records the highest level of evidence established in its
 `level` metadata: `declared` (the requirement allows a vulnerable version), `imported`
 (a module of the package is imported somewhere), `reachable` (an entry point or affected
-symbol is called) or `exploitable` (attacker input reaches it). The last two carry
+symbol is called, or an entry point marked `read` is read) or `exploitable` (attacker
+input reaches it). The last two carry
 `entry_point`, `justification`, `conditions`, and which of them the call meets
 (`conditions_met`) or leaves to review (`conditions_pending_review`). A requirement whose
 entry points are only called with arguments that contradict a condition stays
@@ -332,6 +374,24 @@ with its package URL, and the advisories affecting them as vulnerabilities.
 coretrace-python-analyzer --check src/ --sbom sbom.json --policy security/policy.toml
 ```
 
+`--vex PATH` writes an OpenVEX 0.2.0 document with one statement per advisory affecting
+a requirement. In each statement, the required package is a subcomponent of the project,
+identified as `pkg:generic/<directory>`. The status follows from the evidence of the
+check, including findings the policy accepts or a comment suppresses:
+
+| Status | When |
+|---|---|
+| `affected` | The project's code reaches the vulnerable code. The notes give each place and its level, `reachable` or `exploitable`. |
+| `not_affected` | Justified as `vulnerable_code_not_in_execute_path`, only when all of these hold: the advisory names entry points, no code of the project reaches them, every file and function was analysed, and a lock file (`uv.lock` or `poetry.lock`) shows that no other package requires the vulnerable one. The impact statement names the entry points and any calls ruled out by their arguments. |
+| `under_investigation` | Anything else. The notes say which condition failed. |
+
+`not_affected` needs the lock-file check because the analyzer reads the project's code,
+not the code of installed packages. A framework calling the vulnerable function on the
+project's behalf would go unseen. Without a lock file, a package is never
+`not_affected`. The document's `@id` derives from its statements, so two runs with the
+same result share it; its `author` is `Unknown Author`, as OpenVEX tools write when they
+cannot know it.
+
 ## Large projects
 
 `--cache DIR` keeps the results of a directory check on disk, one entry per module,

{coretrace_python_analyzer-0.5.0 → coretrace_python_analyzer-0.7.0}/pyproject.toml

@@ -4,7 +4,7 @@ build-backend = "hatchling.build"
 
 [project]
 name = "coretrace-python-analyzer"
-version = "0.5.0"
+version = "0.7.0"
 description = "Static security analysis infrastructure for Python code"
 readme = "README.md"
 requires-python = ">=3.11"

{coretrace_python_analyzer-0.5.0 → coretrace_python_analyzer-0.7.0}/src/coretrace_python/__init__.py

@@ -1,4 +1,4 @@
 """CoreTrace's Python static analysis frontend."""
 
-__version__ = "0.5.0"
+__version__ = "0.7.0"
 

coretrace_python_analyzer-0.7.0/src/coretrace_python/bundled/dependency/reachable_vulnerability/reachable_vulnerability.py

@@ -0,0 +1,82 @@
+"""Calls, anywhere in the project, to an API affected by a vulnerable requirement, and
+reads of an affected attribute whose getter runs the vulnerable code."""
+
+from __future__ import annotations
+
+from collections.abc import Iterator, Sequence
+from typing import ClassVar
+
+from coretrace_python.analysis import AnyAnalysis
+from coretrace_python.dependency import Advisory, DependencyAnalysis
+from coretrace_python.dependency.correlation import (
+    ConditionCheck,
+    affected_symbols,
+    check_conditions,
+    evidence,
+)
+from coretrace_python.findings import Confidence, Finding
+from coretrace_python.interprocedural import CallGraphAnalysis, ExternalSymbol
+from coretrace_python.plugins import ProjectContext, ProjectPlugin
+from coretrace_python.semantic.symbols import SymbolId
+from coretrace_python.source import SourceSpan
+
+
+class ReachableVulnerabilityPlugin(ProjectPlugin):
+    name: ClassVar[str] = "reachable-vulnerability"
+    requires: ClassVar[frozenset[AnyAnalysis]] = frozenset({DependencyAnalysis, CallGraphAnalysis})
+
+    def analyze_project(self, ctx: ProjectContext) -> Sequence[Finding]:
+        affected = affected_symbols(ctx.dependencies, ctx.advisories)
+        if not affected:
+            return ()
+        findings: list[Finding] = []
+        for module in ctx.modules:
+            graph = ctx.call_graph(module)
+            for function in graph.functions:
+                for site in graph.sites(function):
+                    if not isinstance(site.target, ExternalSymbol):
+                        continue
+                    for advisory in affected.get(site.target.symbol, ()):
+                        entry = advisory.entry_point(site.target.symbol)
+                        if entry is not None and entry.read:
+                            continue  # a call reads its callee first: reported with the reads
+                        check = check_conditions(entry, site.arguments)
+                        if check.contradicted is not None:
+                            continue
+                        findings.append(_reached(advisory, site.target.symbol, site.location, function, check))
+                # Reading ``request.form.get`` reads ``request.form``: one finding per entry
+                # point and function, where the function first reads it.
+                reported: set[tuple[Advisory, SymbolId]] = set()
+                for read in graph.reads(function):
+                    for symbol in _read_through(read.symbol):
+                        for advisory in affected.get(symbol, ()):
+                            entry = advisory.entry_point(symbol)
+                            if entry is None or not entry.read or (advisory, symbol) in reported:
+                                continue
+                            reported.add((advisory, symbol))
+                            check = check_conditions(entry, None)
+                            findings.append(_reached(advisory, symbol, read.location, function, check))
+        return findings
+
+
+def _read_through(symbol: SymbolId) -> Iterator[SymbolId]:
+    """``symbol`` and every symbol it is an attribute of, as reading it reads them all."""
+
+    components = symbol.canonical_name.split(".")
+    for end in range(len(components), 1, -1):
+        yield SymbolId(".".join(components[:end]))
+
+
+def _reached(advisory: Advisory, symbol: SymbolId, span: SourceSpan, function: str, check: ConditionCheck) -> Finding:
+    return Finding(
+        rule_id="reachable-vulnerability",
+        message=(
+            f"{advisory.id}: {symbol} is affected in the required "
+            f"{advisory.package} {advisory.vulnerable}: {advisory.summary}"
+        ),
+        severity=advisory.severity,
+        confidence=Confidence.HIGH,
+        span=span,
+        function=function,
+        metadata=evidence(advisory, symbol, "reachable", check),
+    )

{coretrace_python_analyzer-0.5.0 → coretrace_python_analyzer-0.7.0}/src/coretrace_python/bundled/models/django/django_models.py

@@ -23,6 +23,7 @@ from coretrace_python.taint import (
     Source,
     SuffixSink,
     TaintKind,
+    TemplateRender,
     TypedParameter,
 )
 
@@ -119,7 +120,15 @@ class DjangoModels(ModelPlugin):
         Sink(_sym("django.http.HttpResponseRedirect"), TaintKind.REDIRECT, _TARGET_ONLY),
         Sink(_sym("django.http.HttpResponsePermanentRedirect"), TaintKind.REDIRECT, _TARGET_ONLY),
         Sanitizer(_sym("django.utils.html.escape"), TaintKind.HTML),
+        TemplateRender(_sym("django.template.loader.render_to_string")),
         Sanitizer(_sym("django.utils.html.conditional_escape"), TaintKind.HTML),
+        # The masked CSRF secret: ASCII letters and digits only, a malformed cookie is
+        # replaced before it is used.
+        Sanitizer(_sym("django.middleware.csrf.get_token"), TaintKind.ALL),
+        # A path of the project's URL configuration, never scheme-relative: attacker data
+        # in its arguments or query reaches no other host through a redirect.
+        *(Sanitizer(_sym(f"django.urls.{name}"), TaintKind.REDIRECT) for name in ("reverse", "reverse_lazy")),
+        *(Sanitizer(_sym(f"django.urls.base.{name}"), TaintKind.REDIRECT) for name in ("reverse", "reverse_lazy")),
         *(AuthorizationGuard(_sym(decorator), label) for decorator, label in _AUTHORIZATION_DECORATORS),
         # ``urlpatterns = [path('login/', views.log_in)]``: the referenced view is an
         # entry point wherever it is defined; routers register viewsets.

coretrace_python_analyzer-0.7.0/src/coretrace_python/bundled/models/http_clients/http_client_models.py

@@ -0,0 +1,52 @@
+"""Requests and httpx models: every request function is a SSRF sink for the argument that
+chooses the destination, and what it returns is an ``http-response`` source, so data
+fetched from a remote server is untrusted. The destination is the URL — first, or second
+after the method, or ``url=`` — or the prepared request a ``send`` takes; the body, the
+headers and the query parameters do not choose the host."""
+
+from __future__ import annotations
+
+from typing import ClassVar
+
+from coretrace_python.plugins import ModelPlugin
+from coretrace_python.semantic.symbols import SymbolId
+from coretrace_python.taint import Model, Sink, Source, TaintKind
+
+_METHODS = ("get", "post", "put", "patch", "delete", "head", "options", "request")
+
+_CALLERS = (
+    "requests",
+    "requests.Session",
+    "requests.api",
+    "httpx",
+    "httpx.Client",
+    "httpx.AsyncClient",
+)
+
+# Where each function takes its destination, by position (the receiver of a method
+# excluded) and by keyword, as its signature declares it.
+_DESTINATIONS = {
+    **{f"{caller}.{method}": (0, "url") for caller in _CALLERS for method in _METHODS if method != "request"},
+    **{f"{caller}.request": (1, "url") for caller in _CALLERS},
+    "httpx.stream": (1, "url"),
+    "httpx.Client.stream": (1, "url"),
+    "httpx.AsyncClient.stream": (1, "url"),
+    "requests.Session.send": (0, "request"),
+    "httpx.Client.send": (0, "request"),
+    "httpx.AsyncClient.send": (0, "request"),
+}
+
+
+def _sym(path: str) -> SymbolId:
+    return SymbolId(f"python.{path}")
+
+
+class HttpClientModels(ModelPlugin):
+    name: ClassVar[str] = "http-client-models"
+    models: ClassVar[tuple[Model, ...]] = (
+        *(
+            Sink(_sym(function), TaintKind.SSRF, ((TaintKind.SSRF, (position,)),), ((TaintKind.SSRF, (keyword,)),))
+            for function, (position, keyword) in _DESTINATIONS.items()
+        ),
+        *(Source(_sym(function), "http-response") for function in _DESTINATIONS),
+    )

{coretrace_python_analyzer-0.5.0 → coretrace_python_analyzer-0.7.0}/src/coretrace_python/bundled/models/python_stdlib/python_stdlib.py

@@ -6,9 +6,28 @@ from typing import ClassVar
 
 from coretrace_python.plugins import ModelPlugin
 from coretrace_python.semantic.symbols import SymbolId
-from coretrace_python.taint import Model, Sanitizer, Sink, Source, TaintKind, Validator
+from coretrace_python.taint import (
+    Model,
+    SafeArgument,
+    Sanitizer,
+    Sink,
+    Source,
+    TaintKind,
+    Validator,
+)
 
 _ENVIRONMENT_KINDS = TaintKind.ALL & ~(TaintKind.COMMAND | TaintKind.PATH)
+# SafeLoader and BaseLoader build plain data only, in Python and in C, under every spelling.
+_SAFE_YAML_LOADERS = (
+    "python.yaml.SafeLoader",
+    "python.yaml.loader.SafeLoader",
+    "python.yaml.BaseLoader",
+    "python.yaml.loader.BaseLoader",
+    "python.yaml.CSafeLoader",
+    "python.yaml.cyaml.CSafeLoader",
+    "python.yaml.CBaseLoader",
+    "python.yaml.cyaml.CBaseLoader",
+)
 _PROCESS_OUTPUT_KINDS = TaintKind.ALL & ~TaintKind.PATH
 
 
@@ -66,6 +85,11 @@ class PythonStdlibModels(ModelPlugin):
         Sink(_sym("dill.loads"), TaintKind.DESERIALIZATION),
         Sink(_sym("jsonpickle.decode"), TaintKind.DESERIALIZATION),
         Sink(_sym("yaml.load"), TaintKind.DESERIALIZATION),
+        Sink(_sym("yaml.load_all"), TaintKind.DESERIALIZATION),
+        Sink(_sym("yaml.full_load_all"), TaintKind.DESERIALIZATION),
+        Sink(_sym("yaml.unsafe_load_all"), TaintKind.DESERIALIZATION),
+        SafeArgument(_sym("yaml.load"), "Loader", _SAFE_YAML_LOADERS, position=1, kinds=TaintKind.DESERIALIZATION),
+        SafeArgument(_sym("yaml.load_all"), "Loader", _SAFE_YAML_LOADERS, position=1, kinds=TaintKind.DESERIALIZATION),
         Sink(_sym("yaml.unsafe_load"), TaintKind.DESERIALIZATION),
         Sink(_sym("yaml.full_load"), TaintKind.DESERIALIZATION),
         Sanitizer(_sym("os.path.basename"), TaintKind.PATH),

{coretrace_python_analyzer-0.5.0 → coretrace_python_analyzer-0.7.0}/src/coretrace_python/cache.py

@@ -4,9 +4,10 @@ A module's results are stored under a key derived from everything they depend on
 source text and identity, the engine, schema and plugin API versions, the plugins and
 their code, the security models, the advisories, the dependency graph, and the keys of
 the project modules it imports transitively. A module whose key is unchanged on a later
-run is served from the cache: its summaries seed the project index, its call sites serve
-the project plugins and its findings are reported as they were. Entries are JSON, so a
-tampered or foreign file can never execute anything; an unreadable entry is a miss.
+run is served from the cache: its summaries seed the project index, its call sites and
+symbol reads serve the project plugins and its findings are reported as they were.
+Entries are JSON, so a tampered or foreign file can never execute anything; an
+unreadable entry is a miss.
 """
 
 from __future__ import annotations
@@ -33,13 +34,14 @@ from coretrace_python.interprocedural import (
     Mutation,
     NonlocalWrite,
     SummaryIndex,
+    SymbolRead,
     Target,
     UnknownTarget,
 )
 from coretrace_python.semantic.symbols import SymbolId
 from coretrace_python.source import SourceId, SourceSpan
 
-CACHE_FORMAT = 7
+CACHE_FORMAT = 9
 
 
 @dataclass(frozen=True)
@@ -50,6 +52,7 @@ class CachedModule:
     summaries: Mapping[str, FunctionSummary]
     sites: tuple[CallSite, ...]
     findings: tuple[Finding, ...]
+    reads: tuple[SymbolRead, ...] = ()
 
     def __post_init__(self) -> None:
         object.__setattr__(self, "summaries", MappingProxyType(dict(self.summaries)))
@@ -134,6 +137,7 @@ def encode(module: CachedModule) -> dict[str, Any]:
         "summaries": {name: _encode_summary(s) for name, s in module.summaries.items()},
         "sites": [_encode_site(site) for site in module.sites],
         "findings": [_encode_finding(finding) for finding in module.findings],
+        "reads": [[r.function, _encode_span(r.location), str(r.symbol)] for r in module.reads],
     }
 
 
@@ -145,6 +149,7 @@ def decode(data: Mapping[str, Any]) -> CachedModule:
         {_string(name): _decode_summary(s) for name, s in data["summaries"].items()},
         tuple(_decode_site(site) for site in data["sites"]),
         tuple(_decode_finding(finding) for finding in data["findings"]),
+        tuple(_decode_read(read) for read in data["reads"]),
     )
 
 
@@ -194,6 +199,11 @@ def _decode_function(data: Any) -> ModuleFunction:
     return ModuleFunction(_string(name), _decode_span(span), None if entry_point is None else _string(entry_point))
 
 
+def _decode_read(data: Any) -> SymbolRead:
+    function, span, symbol = data
+    return SymbolRead(_string(function), _decode_span(span), SymbolId(_string(symbol)))
+
+
 def _encode_finding(finding: Finding) -> dict[str, Any]:
     return {
         "rule": finding.rule_id,
@@ -223,7 +233,7 @@ def _encode_call(call: ExternalCall) -> dict[str, Any]:
     return {
         "symbol": str(call.symbol),
         "arguments": [sorted(deps) for deps in call.argument_dependencies],
-        "keywords": sorted(call.keyword_dependencies),
+        "keywords": [[name, sorted(deps)] for name, deps in call.keyword_dependencies],
         "location": _encode_span(call.location),
         "call_site": None if call.call_site is None else _encode_span(call.call_site),
         "given": _encode_arguments(call.arguments),
@@ -235,7 +245,7 @@ def _decode_call(data: Mapping[str, Any]) -> ExternalCall:
     return ExternalCall(
         SymbolId(_string(data["symbol"])),
         tuple(_indices(deps) for deps in data["arguments"]),
-        _indices(data["keywords"]),
+        tuple((None if name is None else _string(name), _indices(deps)) for name, deps in data["keywords"]),
         _decode_span(data["location"]),
         None if site is None else _decode_span(site),
         _decode_arguments(data["given"]),

{coretrace_python_analyzer-0.5.0 → coretrace_python_analyzer-0.7.0}/src/coretrace_python/cli.py

@@ -3,13 +3,20 @@ from __future__ import annotations
 import argparse
 import sys
 import zipfile
+from datetime import UTC, datetime
 from pathlib import Path
 
 from coretrace_python import __version__, engine
 from coretrace_python.analysis import AnalysisError
 from coretrace_python.cache import ProjectCache
 from coretrace_python.cfg import CFGError
-from coretrace_python.dependency import dump_advisories, import_osv, read_osv, render_sbom
+from coretrace_python.dependency import (
+    dump_advisories,
+    import_osv,
+    read_osv,
+    render_sbom,
+    render_vex,
+)
 from coretrace_python.findings import Severity
 from coretrace_python.findings.baseline import Baseline, BaselineError
 from coretrace_python.frontend import HIRBuildError, ParseError, build_hir
@@ -106,6 +113,14 @@ def build_parser() -> argparse.ArgumentParser:
         metavar="PATH",
         help="with --check on a directory, write a CycloneDX bill of materials to PATH",
     )
+    parser.add_argument(
+        "--vex",
+        type=Path,
+        default=None,
+        metavar="PATH",
+        help="with --check on a directory, write to PATH an OpenVEX document saying whether "
+        "each advisory affecting a requirement affects the project",
+    )
     parser.add_argument(
         "--advisories",
         action="append",
@@ -182,6 +197,9 @@ def main(argv: list[str] | None = None) -> int:
     if args.sbom is not None and not (args.check and args.path.is_dir()):
         print("error: --sbom only applies to --check on a directory", file=sys.stderr)
         return EXIT_ERROR
+    if args.vex is not None and not (args.check and args.path.is_dir()):
+        print("error: --vex only applies to --check on a directory", file=sys.stderr)
+        return EXIT_ERROR
     if args.advisories and not (args.check and args.path.is_dir()):
         print("error: --advisories only applies to --check on a directory", file=sys.stderr)
         return EXIT_ERROR
@@ -227,6 +245,20 @@ def main(argv: list[str] | None = None) -> int:
                         render_sbom(analysis.dependencies, analysis.advisories, engine.TOOL_NAME, __version__),
                         encoding="utf-8",
                     )
+                if args.vex is not None:
+                    args.vex.write_text(
+                        render_vex(
+                            analysis.dependencies,
+                            analysis.advisories,
+                            (*analysis.findings, *analysis.suppressed, *analysis.accepted),
+                            analysis.coverage,
+                            args.path,
+                            engine.TOOL_NAME,
+                            __version__,
+                            datetime.now(UTC),
+                        ),
+                        encoding="utf-8",
+                    )
             else:
                 file_analysis = engine.analyze_file(SourceManager().load_file(args.path), plugin_roots)
                 findings, coverage = file_analysis.findings, file_analysis.coverage

{coretrace_python_analyzer-0.5.0 → coretrace_python_analyzer-0.7.0}/src/coretrace_python/dependency/__init__.py

@@ -22,6 +22,7 @@ from coretrace_python.dependency.graph import (
 )
 from coretrace_python.dependency.policy import POLICY_FILE, Policy, apply_policy, load_policy
 from coretrace_python.dependency.sbom import render_sbom
+from coretrace_python.dependency.vex import render_vex
 
 __all__ = [
     "ADVISORY_FILE",
@@ -45,4 +46,5 @@ __all__ = [
     "parse_dependencies",
     "read_osv",
     "render_sbom",
+    "render_vex",
 ]