coretrace-python-analyzer 0.6.0__py3-none-any.whl → 0.7.0__py3-none-any.whl

coretrace_python/__init__.py

@@ -1,4 +1,4 @@
 """CoreTrace's Python static analysis frontend."""
 
-__version__ = "0.6.0"
+__version__ = "0.7.0"
 

coretrace_python/bundled/models/django/django_models.py

@@ -23,6 +23,7 @@ from coretrace_python.taint import (
     Source,
     SuffixSink,
     TaintKind,
+    TemplateRender,
     TypedParameter,
 )
 
@@ -119,7 +120,15 @@ class DjangoModels(ModelPlugin):
         Sink(_sym("django.http.HttpResponseRedirect"), TaintKind.REDIRECT, _TARGET_ONLY),
         Sink(_sym("django.http.HttpResponsePermanentRedirect"), TaintKind.REDIRECT, _TARGET_ONLY),
         Sanitizer(_sym("django.utils.html.escape"), TaintKind.HTML),
+        TemplateRender(_sym("django.template.loader.render_to_string")),
         Sanitizer(_sym("django.utils.html.conditional_escape"), TaintKind.HTML),
+        # The masked CSRF secret: ASCII letters and digits only, a malformed cookie is
+        # replaced before it is used.
+        Sanitizer(_sym("django.middleware.csrf.get_token"), TaintKind.ALL),
+        # A path of the project's URL configuration, never scheme-relative: attacker data
+        # in its arguments or query reaches no other host through a redirect.
+        *(Sanitizer(_sym(f"django.urls.{name}"), TaintKind.REDIRECT) for name in ("reverse", "reverse_lazy")),
+        *(Sanitizer(_sym(f"django.urls.base.{name}"), TaintKind.REDIRECT) for name in ("reverse", "reverse_lazy")),
         *(AuthorizationGuard(_sym(decorator), label) for decorator, label in _AUTHORIZATION_DECORATORS),
         # ``urlpatterns = [path('login/', views.log_in)]``: the referenced view is an
         # entry point wherever it is defined; routers register viewsets.

coretrace_python/bundled/models/http_clients/http_client_models.py

@@ -1,5 +1,8 @@
-"""Requests and httpx models: every request function is a SSRF sink, and what it returns
-is an ``http-response`` source, so data fetched from a remote server is untrusted."""
+"""Requests and httpx models: every request function is a SSRF sink for the argument that
+chooses the destination, and what it returns is an ``http-response`` source, so data
+fetched from a remote server is untrusted. The destination is the URL — first, or second
+after the method, or ``url=`` — or the prepared request a ``send`` takes; the body, the
+headers and the query parameters do not choose the host."""
 
 from __future__ import annotations
 
@@ -20,15 +23,18 @@ _CALLERS = (
     "httpx.AsyncClient",
 )
 
-_REQUEST_FUNCTIONS = (
-    *(f"{caller}.{method}" for caller in _CALLERS for method in _METHODS),
-    "requests.Session.send",
-    "httpx.stream",
-    "httpx.Client.stream",
-    "httpx.AsyncClient.stream",
-    "httpx.Client.send",
-    "httpx.AsyncClient.send",
-)
+# Where each function takes its destination, by position (the receiver of a method
+# excluded) and by keyword, as its signature declares it.
+_DESTINATIONS = {
+    **{f"{caller}.{method}": (0, "url") for caller in _CALLERS for method in _METHODS if method != "request"},
+    **{f"{caller}.request": (1, "url") for caller in _CALLERS},
+    "httpx.stream": (1, "url"),
+    "httpx.Client.stream": (1, "url"),
+    "httpx.AsyncClient.stream": (1, "url"),
+    "requests.Session.send": (0, "request"),
+    "httpx.Client.send": (0, "request"),
+    "httpx.AsyncClient.send": (0, "request"),
+}
 
 
 def _sym(path: str) -> SymbolId:
@@ -38,6 +44,9 @@ def _sym(path: str) -> SymbolId:
 class HttpClientModels(ModelPlugin):
     name: ClassVar[str] = "http-client-models"
     models: ClassVar[tuple[Model, ...]] = (
-        *(Sink(_sym(function), TaintKind.SSRF) for function in _REQUEST_FUNCTIONS),
-        *(Source(_sym(function), "http-response") for function in _REQUEST_FUNCTIONS),
+        *(
+            Sink(_sym(function), TaintKind.SSRF, ((TaintKind.SSRF, (position,)),), ((TaintKind.SSRF, (keyword,)),))
+            for function, (position, keyword) in _DESTINATIONS.items()
+        ),
+        *(Source(_sym(function), "http-response") for function in _DESTINATIONS),
     )

coretrace_python/cache.py

@@ -41,7 +41,7 @@ from coretrace_python.interprocedural import (
 from coretrace_python.semantic.symbols import SymbolId
 from coretrace_python.source import SourceId, SourceSpan
 
-CACHE_FORMAT = 8
+CACHE_FORMAT = 9
 
 
 @dataclass(frozen=True)
@@ -233,7 +233,7 @@ def _encode_call(call: ExternalCall) -> dict[str, Any]:
     return {
         "symbol": str(call.symbol),
         "arguments": [sorted(deps) for deps in call.argument_dependencies],
-        "keywords": sorted(call.keyword_dependencies),
+        "keywords": [[name, sorted(deps)] for name, deps in call.keyword_dependencies],
         "location": _encode_span(call.location),
         "call_site": None if call.call_site is None else _encode_span(call.call_site),
         "given": _encode_arguments(call.arguments),
@@ -245,7 +245,7 @@ def _decode_call(data: Mapping[str, Any]) -> ExternalCall:
     return ExternalCall(
         SymbolId(_string(data["symbol"])),
         tuple(_indices(deps) for deps in data["arguments"]),
-        _indices(data["keywords"]),
+        tuple((None if name is None else _string(name), _indices(deps)) for name, deps in data["keywords"]),
         _decode_span(data["location"]),
         None if site is None else _decode_span(site),
         _decode_arguments(data["given"]),

coretrace_python/engine.py

@@ -109,6 +109,7 @@ from coretrace_python.source import SourceFile, SourceId, SourceManager, SourceS
 from coretrace_python.taint import (
     EntryPoint,
     EntryPointAnalysis,
+    EscapedTemplates,
     ModelTable,
     RegisteredRoutes,
     Routes,
@@ -116,6 +117,7 @@ from coretrace_python.taint import (
     SecurityModelRegistry,
     TaintAnalysis,
     TaintKind,
+    escaped_templates,
     registered_routes,
 )
 
@@ -146,6 +148,7 @@ ALL_ANALYSES: tuple[AnyAnalysis, ...] = (
     RefutationAnalysis,
     DependencyAnalysis,
     RegisteredRoutes,
+    EscapedTemplates,
 )
 
 
@@ -178,7 +181,14 @@ class ResultsEvicted(TransformationPass):
 
     name: ClassVar[str] = "project.results-evicted"
     preserves: ClassVar[frozenset[AnyAnalysis]] = frozenset(
-        {*SEMANTIC_ANALYSES, SecurityModelAnalysis, ProjectSummaries, DependencyAnalysis, RegisteredRoutes}
+        {
+            *SEMANTIC_ANALYSES,
+            SecurityModelAnalysis,
+            ProjectSummaries,
+            DependencyAnalysis,
+            RegisteredRoutes,
+            EscapedTemplates,
+        }
     )
 
     @classmethod
@@ -397,10 +407,12 @@ def analyze_project(
     for name in sorted(analysable):
         for symbol, registered in _routes_of(analysable[name]).items():
             routes.setdefault(symbol, registered)
+    escaped = escaped_templates(root)
     for manager in analysable.values():
         manager.provide(RegisteredRoutes, routes)
+        manager.provide(EscapedTemplates, escaped)
 
-    configuration = _configuration_key(registry, plugins, models, advisories, dependencies, routes)
+    configuration = _configuration_key(registry, plugins, models, advisories, dependencies, routes, escaped)
     keys = module_keys(
         graph,
         {name: fingerprint(configuration, str(files[name].source_id), name, files[name].text) for name in analysable},
@@ -441,6 +453,7 @@ def analyze_project(
                             encode_index(_seed(results, graph, component)),
                             advisory_paths,
                             _encode_routes(routes),
+                            tuple(sorted(escaped)),
                         ),
                     )
                     for component in pending
@@ -588,6 +601,7 @@ class _Batch:
     seed: Mapping[str, Any]
     advisory_paths: tuple[Path, ...] = ()
     routes: tuple[tuple[str, str, str, int], ...] = ()
+    escaped: tuple[str, ...] = ()
 
 
 def _analyse_batch(batch: _Batch) -> dict[str, dict[str, Any]]:
@@ -612,6 +626,7 @@ def _analyse_batch(batch: _Batch) -> dict[str, dict[str, Any]]:
         manager.provide(SecurityModelAnalysis, models)
         manager.provide(DependencyAnalysis, dependencies)
         manager.provide(RegisteredRoutes, routes)
+        manager.provide(EscapedTemplates, frozenset(batch.escaped))
     module_plugins = tuple(p for p in all_plugins if not isinstance(p, ProjectPlugin))
     results = _analyse_managers(managers, decode_index(batch.seed), module_plugins, affected)
     return {name: encode(entry) for name, entry in results.items()}
@@ -639,6 +654,7 @@ def _configuration_key(
     advisories: tuple[Advisory, ...],
     dependencies: DependencyGraph,
     routes: Routes | None = None,
+    escaped: frozenset[str] = frozenset(),
 ) -> str:
     """Everything a module's results depend on besides the project sources (§11)."""
 
@@ -658,6 +674,7 @@ def _configuration_key(
         repr(dependencies.requirements),
         repr(dependencies.errors),
         repr(_encode_routes(routes or {})),
+        repr(sorted(escaped)),
     )
 
 

coretrace_python/findings/refutation.py

@@ -8,10 +8,13 @@ and ``not`` combine as expected, a ``Validator`` model names a callable whose tr
 one of its arguments, a numeric value (``abstract.ranges``) cannot inject, and anything
 else that mentions the value is a guard that does not prove it. A proof counts for an
 origin when every dependence path from that origin to the sink argument goes through a
-proven value. A flow is refuted when every tainted origin is proven safe or the sink is
-unreachable, a hotspot when it sits behind an ``AuthorizationGuard`` (a decorator or a
-dominating condition) or when an unproven guard mentions it, and a vulnerability
-otherwise.
+proven value. A guard mentions an origin only when it examines what the sink receives:
+reading another attribute or item of an object the flow reads (``request.method`` next
+to ``request.POST``) examines nothing of it, while the same attribute, or a method called
+on the object (``form.is_valid()``), does. A flow is refuted when every tainted origin is
+proven safe or the sink is unreachable, a hotspot when it sits behind an
+``AuthorizationGuard`` (a decorator or a dominating condition) or when an unproven guard
+mentions it, and a vulnerability otherwise.
 """
 
 from __future__ import annotations
@@ -37,6 +40,7 @@ from coretrace_python.ir.model import (
     Constant,
     FunctionIR,
     GetAttr,
+    GetItem,
     Instruction,
     UnaryOp,
     Value,
@@ -267,6 +271,66 @@ class _Judge:
                         return tested, "equals a constant", definition.operator == "eq"
         return None
 
+    def examined(
+        self, condition: Value, mentioned: set[Value], argument: Value, chain: frozenset[Value]
+    ) -> set[Value]:
+        """What the guard examines of the values it mentions: everything its condition is
+        computed from, except an object it only reads another attribute or item of than
+        the flow reads (``request`` in ``request.method`` when the sink receives
+        ``request.POST['cmd']``). A method called on the object (``form.is_valid()``), the
+        same attribute or item, or any part of an object the flow takes whole (passes to
+        the sink or to a call), examines it."""
+
+        reads = {self.access(value) for value in chain} - {None}
+        whole = {argument} | {
+            operand
+            for value in chain
+            if (definition := self.defs.get(value)) is not None
+            for operand in definition.operands()
+            if not (isinstance(definition, GetAttr | GetItem) and definition.object == operand)
+        }
+        found: set[Value] = set()
+        called: set[Value] = set()
+        pending = [condition]
+        while pending:
+            value = pending.pop()
+            if value in found:
+                continue
+            found.add(value)
+            definition = self.defs.get(value)
+            if definition is None:
+                continue
+            if isinstance(definition, Call):
+                called.add(definition.callee)
+            access = None if value in called else self.access(value)
+            for operand in definition.operands():
+                if access is not None and access[0] == operand and operand not in whole and self.aside(access, reads):
+                    continue
+                pending.append(operand)
+        return found & mentioned
+
+    @staticmethod
+    def aside(access: tuple[Value, str, object], reads: set[tuple[Value, str, object] | None]) -> bool:
+        """Whether reading ``access`` reads beside what the flow reads of the same object;
+        an item under a key unknown on either side may be the same one."""
+
+        owner, kind, name = access
+        if kind == "item" and (name is None or (owner, "item", None) in reads):
+            return False
+        return access not in reads
+
+    def access(self, value: Value) -> tuple[Value, str, object] | None:
+        """``(object, "attribute" or "item", name or constant key)`` for a read of an
+        attribute or an item; ``None`` for any other value, and as the key when unknown."""
+
+        definition = self.defs.get(value)
+        if isinstance(definition, GetAttr):
+            return definition.object, "attribute", definition.attribute
+        if isinstance(definition, GetItem):
+            key = self.defs.get(definition.key)
+            return definition.object, "item", key.value if isinstance(key, Constant) else None
+        return None
+
     def is_constant_collection(self, value: Value) -> bool:
         definition = self.defs.get(value)
         if isinstance(definition, Constant):
@@ -326,8 +390,9 @@ class _Judge:
             for value, reason in found.items():
                 if value in chain:
                     proven.setdefault(value, reason)
+            examined = self.examined(guard.condition, mentioned, flow.argument, chain)
             for origin in origins:
-                if origin not in mentions and mentioned & (
+                if origin not in mentions and examined & (
                     {origin} | {w for w in chain if origin in self.closure(w)}
                 ):
                     mentions[origin] = guard.line

coretrace_python/interprocedural/summaries.py

@@ -87,11 +87,13 @@ EMPTY = Dep()
 
 @dataclass(frozen=True)
 class ExternalCall:
-    """An external symbol reached from this function; dependencies are parameter indices."""
+    """An external symbol reached from this function; dependencies are parameter indices.
+    Keyword arguments keep their name, so a sink reading ``url=`` only can be decided;
+    ``*args`` and ``**kwargs`` have none."""
 
     symbol: SymbolId
     argument_dependencies: tuple[Dependencies, ...]
-    keyword_dependencies: Dependencies
+    keyword_dependencies: tuple[tuple[str | None, Dependencies], ...]
     location: SourceSpan
     call_site: SourceSpan | None
     # What the arguments of the call at ``location`` denote, where it is made.
@@ -313,9 +315,13 @@ class _DependenceProblem(DataflowProblem[State]):
 
     def call(self, call: Call, state: dict[Key, Dep]) -> Dep:
         arguments = tuple(self.deep(a, state) for a in call.arguments)
+        named = (
+            *((name, self.deep(value, state)) for name, value in call.keywords),
+            *((None, self.deep(value, state)) for value in call.starred),
+        )
         keywords = EMPTY
-        for value in (*call.starred, *(v for _, v in call.keywords)):
-            keywords |= self.deep(value, state)
+        for _, deps in named:
+            keywords |= deps
         everything = keywords
         for deps in arguments:
             everything |= deps
@@ -335,7 +341,7 @@ class _DependenceProblem(DataflowProblem[State]):
             self.record(
                 target.symbol,
                 tuple(a.parameters for a in arguments),
-                keywords.parameters,
+                tuple((name, deps.parameters) for name, deps in named),
                 call.location,
                 None,
                 self.graph.arguments_at(self.name, call.location),
@@ -418,7 +424,7 @@ class _DependenceProblem(DataflowProblem[State]):
             self.record(
                 reached.symbol,
                 tuple(mapped(d).parameters for d in reached.argument_dependencies),
-                mapped(reached.keyword_dependencies).parameters,
+                tuple((name, mapped(d).parameters) for name, d in reached.keyword_dependencies),
                 reached.location,
                 call.location,
                 reached.arguments,
@@ -435,7 +441,7 @@ class _DependenceProblem(DataflowProblem[State]):
         self,
         symbol: SymbolId,
         arguments: tuple[Dependencies, ...],
-        keywords: Dependencies,
+        keywords: tuple[tuple[str | None, Dependencies], ...],
         location: SourceSpan,
         call_site: SourceSpan | None,
         given: Arguments,
@@ -446,7 +452,11 @@ class _DependenceProblem(DataflowProblem[State]):
             arguments = tuple(
                 a | b for a, b in zip(previous.argument_dependencies, arguments, strict=False)
             )
-            keywords |= previous.keyword_dependencies
+            # The same call records the same keywords, in the same order.
+            keywords = tuple(
+                (name, deps | old)
+                for (name, deps), (_, old) in zip(keywords, previous.keyword_dependencies, strict=False)
+            )
         self.external[key] = ExternalCall(symbol, arguments, keywords, location, call_site, given)
 
 

coretrace_python/taint/__init__.py

@@ -24,15 +24,18 @@ from coretrace_python.taint.models import (
     Source,
     SuffixSink,
     TaintKind,
+    TemplateRender,
     TypedParameter,
     Validator,
 )
 from coretrace_python.taint.routes import RegisteredRoutes, Routes, registered_routes
+from coretrace_python.taint.templates import EscapedTemplates, escaped_templates
 
 __all__ = [
     "AuthorizationGuard",
     "EntryPoint",
     "EntryPointAnalysis",
+    "EscapedTemplates",
     "Model",
     "ModelError",
     "ModelTable",
@@ -52,8 +55,10 @@ __all__ = [
     "TaintFacts",
     "TaintFlow",
     "TaintKind",
+    "TemplateRender",
     "TypedParameter",
     "Validator",
+    "escaped_templates",
     "propagate_taint",
     "registered_routes",
 ]

coretrace_python/taint/engine.py

@@ -10,7 +10,7 @@ argument reaching a sink whose kinds it still carries is reported as a ``TaintFl
 from __future__ import annotations
 
 from collections.abc import Callable, Mapping
-from dataclasses import dataclass
+from dataclasses import dataclass, replace
 from types import MappingProxyType
 from typing import ClassVar
 
@@ -79,6 +79,7 @@ from coretrace_python.taint.models import (
     TaintKind,
 )
 from coretrace_python.taint.routes import RegisteredRoutes, Routes
+from coretrace_python.taint.templates import EscapedTemplates
 
 
 @dataclass(frozen=True)
@@ -152,9 +153,12 @@ class _TaintProblem(DataflowProblem[State]):
         heap: HeapFacts | None = None,
         seeds: Mapping[HeapLocation, Taint] | None = None,
         module: str = "",
+        escaped: frozenset[str] = frozenset(),
     ) -> None:
         self.name = name
         self.module = module
+        # As call sites record a constant argument: the way Python writes it.
+        self.escaped = frozenset(repr(name) for name in escaped)
         self.function = function
         self.models = models
         self.graph = graph
@@ -401,11 +405,17 @@ class _TaintProblem(DataflowProblem[State]):
         if sink is not None:
             for position, argument in enumerate(call.arguments):
                 self.report(flows, sink, self.rendered(argument, state), argument, call, None, None, position, given)
-            for argument in (*call.starred, *(value for _, value in call.keywords)):
+            for argument in call.starred:
                 self.report(flows, sink, self.rendered(argument, state), argument, call, None, None, None, given)
+            for name, argument in call.keywords:
+                self.report(
+                    flows, sink, self.rendered(argument, state), argument, call, None, None, None, given, keyword=name
+                )
         sanitizer = self.models.sanitizer(symbol)
         if sanitizer is not None:
             return everything.without(sanitizer.kinds)
+        if self.renders_escaped(symbol, given):
+            return everything.without(TaintKind.HTML)
         # A method on a tainted object returns tainted data (``request.args.get``).
         everything = everything.join(state.get(call.callee, Taint.none()))
         source = self.models.source_covering(symbol)
@@ -413,6 +423,14 @@ class _TaintProblem(DataflowProblem[State]):
             return everything.join(Taint(source.kinds, frozenset({source})))
         return everything
 
+    def renders_escaped(self, symbol: SymbolId, given: Arguments) -> bool:
+        """Whether the call renders, by a name written in the call, a template the
+        project shows escaping everything it renders."""
+
+        render = self.models.template_render(symbol)
+        named = given.given(render.keyword, render.position) if render is not None else None
+        return named is not None and named[0] and named[1] in self.escaped
+
     def guarded(self, sink: Sink | None, arguments: Arguments) -> Sink | None:
         """The sink as this call makes it: an argument declared safe (``yaml.load`` with
         ``Loader=SafeLoader``) takes off the kinds it covers, and no kind left, no sink."""
@@ -424,7 +442,7 @@ class _TaintProblem(DataflowProblem[State]):
         if safe is None or given is None or not given[0] or given[1] not in safe.values:
             return sink
         kinds = sink.kinds & ~safe.kinds
-        return Sink(sink.symbol, kinds, sink.positions) if kinds else None
+        return replace(sink, kinds=kinds) if kinds else None
 
     def rendered(self, argument: Value, state: Mapping[Key, Taint]) -> Taint:
         """The taint an argument brings to a sink. A container literal is serialised by
@@ -497,11 +515,16 @@ class _TaintProblem(DataflowProblem[State]):
             sink = self.guarded(self.models.sink(reached.symbol), reached.arguments)
             if sink is None:
                 continue
-            positions: list[int | None] = [*range(len(reached.argument_dependencies)), None]
-            for position, deps in zip(positions, (*reached.argument_dependencies, reached.keyword_dependencies), strict=True):
+            for position, deps in enumerate(reached.argument_dependencies):
                 taint, witness = mapped(deps)
                 if witness is not None:
                     self.report(flows, sink, taint, witness, call, through, reached.location, position, reached.arguments)
+            for name, deps in reached.keyword_dependencies:
+                taint, witness = mapped(deps)
+                if witness is not None:
+                    self.report(
+                        flows, sink, taint, witness, call, through, reached.location, None, reached.arguments, keyword=name
+                    )
         for mutation in summary.mutations:
             if mutation.parameter < len(values):
                 stored = mapped(mutation.dependencies)[0]
@@ -528,8 +551,9 @@ class _TaintProblem(DataflowProblem[State]):
         sink_location: SourceSpan | None,
         position: int | None = None,
         arguments: Arguments | None = None,
+        keyword: str | None = None,
     ) -> None:
-        reaching = taint.kinds & sink.kinds_at(position)
+        reaching = taint.kinds & sink.kinds_at(position, keyword)
         if not reaching:
             return
         for source in sorted(taint.sources, key=lambda s: str(s.symbol)):
@@ -792,8 +816,9 @@ def propagate_taint(
     heap: HeapFacts | None = None,
     seeds: Mapping[HeapLocation, Taint] | None = None,
     module: str = "",
+    escaped: frozenset[str] = frozenset(),
 ) -> TaintFacts:
-    problem = _TaintProblem(name, function, models, graph, summaries, parameters, project, heap, seeds, module)
+    problem = _TaintProblem(name, function, models, graph, summaries, parameters, project, heap, seeds, module, escaped)
     solution = solve(problem, cfg)
     taints: dict[Key, Taint] = {}
     flows: list[TaintFlow] = []
@@ -821,6 +846,7 @@ class TaintAnalysis(FunctionAnalysis[TaintFacts]):
             ProjectSummaries,
             HeapAnalysis,
             RegisteredRoutes,
+            EscapedTemplates,
         }
     )
 
@@ -857,6 +883,7 @@ class TaintAnalysis(FunctionAnalysis[TaintFacts]):
             heap,
             seeds,
             ctx.module.name,
+            ctx.get(EscapedTemplates),
         )
 
 

coretrace_python/taint/models.py

@@ -55,28 +55,42 @@ class Source:
 
 @dataclass(frozen=True)
 class Sink:
-    """A callable whose arguments must not carry the given taint kinds. ``positions``
-    restricts some kinds to argument positions: a SQL statement is the first argument
-    of ``execute``, its parameter tuple is not a statement."""
+    """A callable whose arguments must not carry the given taint kinds. ``positions`` and
+    ``keywords`` restrict some kinds to the arguments they list: a SQL statement is the
+    first argument of ``execute``, its parameter tuple is not a statement; the target of
+    ``requests.get`` is its first argument or ``url=``, its body is no destination."""
 
     symbol: SymbolId
     kinds: TaintKind
     positions: tuple[tuple[TaintKind, tuple[int, ...]], ...] = ()
-
-    def kinds_at(self, position: int | None) -> TaintKind:
-        """The kinds that must not reach the argument at ``position`` (``None`` for a
-        keyword or starred argument)."""
-
-        kinds = self.kinds
-        for restricted, allowed in self.positions:
-            if position is None or position not in allowed:
-                kinds &= ~restricted
-        return kinds
+    keywords: tuple[tuple[TaintKind, tuple[str, ...]], ...] = ()
+
+    def kinds_at(self, position: int | None, keyword: str | None = None) -> TaintKind:
+        """The kinds that must not reach the argument at ``position`` or passed as
+        ``keyword``; both are ``None`` for a starred argument or ``**kwargs``, which
+        reach no restricted kind. A restricted kind reaches any argument one of its
+        restrictions lists."""
+
+        restricted = allowed = TaintKind(0)
+        for kinds, positions in self.positions:
+            restricted |= kinds
+            if position in positions:
+                allowed |= kinds
+        for kinds, names in self.keywords:
+            restricted |= kinds
+            if keyword in names:
+                allowed |= kinds
+        return self.kinds & ~(restricted & ~allowed)
 
     def merged(self, other: Sink) -> Sink:
-        """This sink with ``other``'s kinds and positions added."""
+        """This sink with ``other``'s kinds, positions and keywords added."""
 
-        return Sink(self.symbol, self.kinds | other.kinds, self.positions + other.positions)
+        return Sink(
+            self.symbol,
+            self.kinds | other.kinds,
+            self.positions + other.positions,
+            self.keywords + other.keywords,
+        )
 
 
 @dataclass(frozen=True)
@@ -173,6 +187,17 @@ class Validator:
     argument: int = 0
 
 
+@dataclass(frozen=True)
+class TemplateRender:
+    """A call rendering the template it names (argument ``position``, or ``keyword``)
+    with autoescaping on, such as ``render_to_string``: what it returns carries no
+    ``HTML`` when the project shows that template escaping everything it renders."""
+
+    symbol: SymbolId
+    position: int = 0
+    keyword: str = "template_name"
+
+
 @dataclass(frozen=True)
 class AuthorizationGuard:
     """A decorator, or a condition, that restricts who reaches the code behind it; a
@@ -194,6 +219,7 @@ Model = (
     | RouteRegistrar
     | SuffixSink
     | SafeArgument
+    | TemplateRender
 )
 
 
@@ -210,6 +236,7 @@ class ModelTable:
     route_registrars: tuple[RouteRegistrar, ...] = ()
     suffix_sinks: tuple[SuffixSink, ...] = ()
     safe_arguments: tuple[SafeArgument, ...] = ()
+    template_renders: tuple[TemplateRender, ...] = ()
     _by_symbol: dict[type[Model], dict[SymbolId, Model]] = field(
         init=False, repr=False, compare=False
     )
@@ -225,6 +252,7 @@ class ModelTable:
             AuthorizationGuard: {m.symbol: m for m in self.authorizations},
             RouteRegistrar: {m.symbol: m for m in self.route_registrars},
             SafeArgument: {m.symbol: m for m in self.safe_arguments},
+            TemplateRender: {m.symbol: m for m in self.template_renders},
         }
         object.__setattr__(self, "_by_symbol", MappingProxyType(index))
 
@@ -291,6 +319,7 @@ class ModelTable:
             self.route_registrars,
             self.suffix_sinks,
             self.safe_arguments,
+            self.template_renders,
         )
 
     def sanitizer(self, symbol: SymbolId) -> Sanitizer | None:
@@ -301,6 +330,10 @@ class ModelTable:
         found = self._by_symbol[SafeArgument].get(symbol)
         return found if isinstance(found, SafeArgument) else None
 
+    def template_render(self, symbol: SymbolId) -> TemplateRender | None:
+        found = self._by_symbol[TemplateRender].get(symbol)
+        return found if isinstance(found, TemplateRender) else None
+
 
 class SecurityModelRegistry:
     """Mutable collection point for the models plugins register."""
@@ -347,6 +380,7 @@ class SecurityModelRegistry:
             route_registrars=tuple(m for m in models if isinstance(m, RouteRegistrar)),
             suffix_sinks=tuple(m for m in models if isinstance(m, SuffixSink)),
             safe_arguments=tuple(m for m in models if isinstance(m, SafeArgument)),
+            template_renders=tuple(m for m in models if isinstance(m, TemplateRender)),
         )
 
 

coretrace_python/taint/templates.py

@@ -0,0 +1,250 @@
+"""Django templates that escape everything they render (architecture §17).
+
+``render_to_string(name, context)`` returns HTML in which autoescaping escaped every
+variable, unless the template says otherwise. The engine does not render templates; it
+reads them, and establishes that a template escapes only when nothing in it, or in what
+it extends or includes, can output data unescaped:
+
+- no ``|safe`` or ``|safeseq``, no ``{% autoescape off %}``, and no tag, filter or tag
+  library beyond Django's own, whose output a custom one could mark safe;
+- no variable where HTML escaping does not protect it: in a ``<script>`` or ``<style>``
+  block, an event handler, a ``style`` or ``srcdoc`` attribute, a URL attribute whose
+  value does not start with a fixed relative or ``http(s)`` prefix, an unquoted
+  attribute, an attribute or a tag name;
+- no Python file of the project turning autoescaping off.
+
+Templates are found under the project's ``templates`` directories, by their path below
+one. A template the engine cannot find — named by an expression, under a ``DIRS`` entry
+of another name, shipped by an installed package — is never assumed to escape.
+"""
+
+from __future__ import annotations
+
+import re
+from collections.abc import Iterator
+from pathlib import Path
+from typing import ClassVar
+
+from coretrace_python.analysis import Analysis, AnalysisContext
+from coretrace_python.interprocedural import discover_files
+
+TEMPLATES_DIRECTORY = "templates"
+
+_OUTPUT, _TAG, _URL = "\x00", "\x01", "/u"
+_SYNTAX = re.compile(r"{{(.*?)}}|{%(.*?)%}|{#.*?#}", re.DOTALL)
+_AUTOESCAPE_OFF = re.compile(r"""["']autoescape["']\s*:\s*False|\bautoescape\s*=\s*False""")
+
+# Django's own libraries, tags and filters. Every filter but ``safe`` and ``safeseq``
+# escapes its input, or returns it for autoescaping to escape, when autoescaping is on.
+_LIBRARIES = frozenset({"static", "i18n", "l10n", "tz", "cache", "humanize"})
+_TAGS = frozenset(
+    {
+        "load", "extends", "include", "block", "endblock", "if", "elif", "else", "endif",
+        "for", "empty", "endfor", "with", "endwith", "ifchanged", "endifchanged", "spaceless",
+        "endspaceless", "filter", "endfilter", "autoescape", "endautoescape", "csrf_token",
+        "now", "lorem", "widthratio", "templatetag", "regroup", "resetcycle", "url", "static",
+        "get_static_prefix", "get_media_prefix", "firstof", "cycle", "trans", "translate",
+        "blocktrans", "blocktranslate", "endblocktrans", "endblocktranslate", "plural",
+        "get_current_language", "get_current_language_bidi", "get_available_languages",
+        "get_language_info", "get_language_info_list", "language", "endlanguage", "localize",
+        "endlocalize", "localtime", "endlocaltime", "timezone", "endtimezone",
+        "get_current_timezone", "cache", "endcache",
+    }
+)
+# Tags that print a value: checked where they stand, like a variable.
+_PRINTING = frozenset({"firstof", "cycle", "trans", "translate"})
+_FILTERS = frozenset(
+    {
+        "add", "addslashes", "capfirst", "center", "cut", "date", "default", "default_if_none",
+        "dictsort", "dictsortreversed", "divisibleby", "escape", "escapejs", "escapeseq",
+        "filesizeformat", "first", "floatformat", "force_escape", "get_digit", "iriencode",
+        "join", "json_script", "last", "length", "length_is", "linebreaks", "linebreaksbr",
+        "linenumbers", "ljust", "lower", "make_list", "phone2numeric", "pluralize", "pprint",
+        "random", "rjust", "slice", "slugify", "stringformat", "striptags", "time", "timesince",
+        "timeuntil", "title", "truncatechars", "truncatechars_html", "truncatewords",
+        "truncatewords_html", "unordered_list", "upper", "urlencode", "urlize", "urlizetrunc",
+        "wordcount", "wordwrap", "yesno", "language_name", "language_name_local",
+        "language_bidi", "language_name_translated", "localize", "unlocalize", "localtime",
+        "utc", "timezone", "apnumber", "intcomma", "intword", "naturalday", "naturaltime",
+        "ordinal",
+    }
+)
+
+_URL_ATTRIBUTES = frozenset(
+    {
+        "href", "src", "action", "formaction", "poster", "background", "cite", "data",
+        "srcset", "ping", "manifest", "longdesc", "usemap", "codebase", "classid", "archive",
+        "profile", "lowsrc", "dynsrc", "icon", "xlink:href",
+    }
+)
+# A relative path (not ``//host``), a fragment, a query, or an http(s) URL whose host is
+# fixed: no scheme such as ``javascript:`` can follow.
+_SAFE_URL_PREFIX = re.compile(r"(?:/(?!/)|\.{1,2}/|[#?]|https?://[^/?#\x00\x01]+[/?#])")
+_QUOTED = r"\"[^\"]*\"|'[^']*'"
+_ATTRIBUTE = re.compile(rf"([^\s\"'>/=]+)(?:\s*=\s*({_QUOTED}|[^\s\"'=<>`]+))?")
+_START_TAG = re.compile(rf"<([A-Za-z][^\s/>]*)((?:\s*[^\s\"'>/=]+(?:\s*=\s*(?:{_QUOTED}|[^\s\"'=<>`]+))?)*)\s*/?>")
+_RAW_TEXT = re.compile(r"<(script|style)\b[^>]*>(.*?)</\1\s*>", re.DOTALL | re.IGNORECASE)
+_COMMENT = re.compile(r"<!--.*?-->", re.DOTALL)
+_END_TAG = re.compile(r"</[A-Za-z][^>]*>")
+
+
+def escaped_templates(root: Path) -> frozenset[str]:
+    """The names of the templates under ``root`` that escape every variable they render,
+    as ``render_to_string`` names them (their path below a ``templates`` directory)."""
+
+    found: dict[str, list[Path]] = {}
+    for path in discover_files(root):
+        if path.suffix == ".py" and _AUTOESCAPE_OFF.search(_read(path)):
+            return frozenset()
+        for name in _names(path.relative_to(root).parts):
+            found.setdefault(name, []).append(path)
+    local: dict[str, bool] = {}
+    requires: dict[str, set[str]] = {}
+    for name, paths in found.items():
+        verdicts = [_inspect(_read(path)) for path in paths]
+        local[name] = all(safe for safe, _ in verdicts)
+        requires[name] = {needed for _, needs in verdicts for needed in needs}
+    escaped = {name for name, safe in local.items() if safe}
+    changed = True
+    while changed:
+        kept = {name for name in escaped if requires[name] <= escaped}
+        changed = kept != escaped
+        escaped = kept
+    return frozenset(escaped)
+
+
+def _names(parts: tuple[str, ...]) -> Iterator[str]:
+    for index, part in enumerate(parts[:-1]):
+        if part == TEMPLATES_DIRECTORY:
+            yield "/".join(parts[index + 1 :])
+
+
+def _read(path: Path) -> str:
+    try:
+        return path.read_text(encoding="utf-8", errors="replace")
+    except OSError:
+        return ""
+
+
+def _inspect(text: str) -> tuple[bool, set[str]]:
+    """Whether the template escapes all it prints itself, and the templates it extends
+    or includes, which must escape too."""
+
+    requires: set[str] = set()
+    html: list[str] = []
+    skipping: str | None = None
+    position = 0
+    text = text.replace(_OUTPUT, "").replace(_TAG, "")
+    for match in _SYNTAX.finditer(text):
+        variable, tag = match.group(1), match.group(2)
+        words = tag.split() if tag is not None else []
+        if skipping is not None:
+            if words[:1] == [skipping]:
+                if skipping == "endverbatim":
+                    html.append(text[position : match.start()])
+                skipping, position = None, match.end()
+            continue
+        html.append(text[position : match.start()])
+        position = match.end()
+        if variable is not None:
+            if not _escaping_filters(variable):
+                return False, requires
+            html.append(_OUTPUT)
+        elif words and words[0] in ("comment", "verbatim"):
+            skipping = f"end{words[0]}"
+            if words[0] == "verbatim":
+                position = match.end()
+        elif words:
+            name = words[0]
+            if name not in _TAGS:
+                return False, requires
+            if name == "load" and not set(_loaded(words[1:])) <= _LIBRARIES:
+                return False, requires
+            if name == "autoescape" and words[1:] != ["on"]:
+                return False, requires
+            if name == "filter" and not _escaping_filters(tag.split(None, 1)[1] if len(words) > 1 else ""):
+                return False, requires
+            if name in ("extends", "include"):
+                needed = _constant(words[1] if len(words) > 1 else "")
+                if needed is None:
+                    return False, requires
+                requires.add(needed)
+            html.append(_OUTPUT if name in _PRINTING else _URL if name in ("url", "static") else _TAG)
+    if skipping is not None:
+        return False, requires
+    html.append(text[position:])
+    return _escapes_where_printed("".join(html)), requires
+
+
+def _loaded(words: list[str]) -> list[str]:
+    """The libraries ``{% load a b %}`` or ``{% load x y from lib %}`` loads."""
+
+    return words[words.index("from") + 1 :] if "from" in words else words
+
+
+def _escaping_filters(expression: str) -> bool:
+    filters = re.sub(_QUOTED, "", expression).split("|")[1:]
+    return all(f.split(":", 1)[0].strip() in _FILTERS for f in filters)
+
+
+def _constant(word: str) -> str | None:
+    return word[1:-1] if len(word) >= 2 and word[0] == word[-1] and word[0] in "\"'" else None
+
+
+def _escapes_where_printed(html: str) -> bool:
+    """Whether every output marker of ``html`` stands where HTML escaping protects it."""
+
+    position = 0
+    while (start := html.find("<", position)) != -1:
+        rest = html[start:]
+        comment = _COMMENT.match(rest)
+        raw = _RAW_TEXT.match(rest)
+        tag = _START_TAG.match(rest)
+        end = _END_TAG.match(rest)
+        if comment:
+            position = start + comment.end()
+        elif raw:
+            if _OUTPUT in raw.group(2) or not _attributes_escape(raw.group(0)[: raw.start(2)]):
+                return False
+            position = start + raw.end()
+        elif tag:
+            if _OUTPUT in tag.group(1) or not _attributes_escape(tag.group(2)):
+                return False
+            position = start + tag.end()
+        elif end:
+            if _OUTPUT in end.group(0):
+                return False
+            position = start + end.end()
+        else:
+            # ``<{{ name }}``: the variable would name a tag, escaping cannot stop it.
+            if rest[1:].lstrip("/ \t\n").startswith(_OUTPUT):
+                return False
+            position = start + 1
+    return True
+
+
+def _attributes_escape(attributes: str) -> bool:
+    for match in _ATTRIBUTE.finditer(attributes):
+        name, value = match.group(1).lower(), match.group(2)
+        if _OUTPUT in name:
+            return False
+        if value is None or _OUTPUT not in value:
+            continue
+        if value[0] not in "\"'" or name.startswith("on") or name in ("style", "srcdoc"):
+            return False
+        if name in _URL_ATTRIBUTES:
+            prefix = value[1:].split(_OUTPUT, 1)[0]
+            if _TAG in prefix or not _SAFE_URL_PREFIX.match(prefix):
+                return False
+    return True
+
+
+class EscapedTemplates(Analysis[frozenset[str]]):
+    """The names of the project templates that escape everything they render, provided
+    by the engine for a project; none on its own."""
+
+    name: ClassVar[str] = "taint.escaped_templates"
+
+    @classmethod
+    def compute(cls, ctx: AnalysisContext) -> frozenset[str]:
+        return frozenset()

{coretrace_python_analyzer-0.6.0.dist-info → coretrace_python_analyzer-0.7.0.dist-info}/METADATA

@@ -1,6 +1,6 @@
 Metadata-Version: 2.5
 Name: coretrace-python-analyzer
-Version: 0.6.0
+Version: 0.7.0
 Summary: Static security analysis infrastructure for Python code
 Project-URL: Homepage, https://github.com/CoreTrace/coretrace-python-analyzer
 Project-URL: Repository, https://github.com/CoreTrace/coretrace-python-analyzer

{coretrace_python_analyzer-0.6.0.dist-info → coretrace_python_analyzer-0.7.0.dist-info}/RECORD

@@ -1,8 +1,8 @@
-coretrace_python/__init__.py,sha256=MPB7k3sSK3YPPbcgkTbDkNy8vJRChFlClF8INwVFbTw,75
+coretrace_python/__init__.py,sha256=kEx6lE06VX-mfQ6o7DrayGZNlR2uTGSdGItAWsSIeHI,75
 coretrace_python/__main__.py,sha256=V8DnYtRboISK2VCKm7DGHLREKvqLbqApyWlKBOs26wU,65
-coretrace_python/cache.py,sha256=0FgPpr5frJrZ3HndMMNJwSmXtkdWYv1yvkvCDMENt5E,12823
+coretrace_python/cache.py,sha256=tt-l1jOibCx0lNKGd7XF_xTlcCeBLewPWOPpS-e3Ynk,12929
 coretrace_python/cli.py,sha256=SwXYUR8DIgppkqom6kKNM701pb4p2omEy-hRXIM5yZE,10946
-coretrace_python/engine.py,sha256=Ou1gEoHThoi7eAqv12kIV7Wy16t6hCNVqzAEplUXCCI,28202
+coretrace_python/engine.py,sha256=3NxNKzkNTWxa7a4NVkZ0fyh5KitNpDHuTsCrdBa4VxU,28696
 coretrace_python/abstract/__init__.py,sha256=n5FNkV8Z4LmwG0r06KWdLj4N2CPSgAKwY3896tdmRgM,999
 coretrace_python/abstract/constants.py,sha256=z4-e7IzysxzGi58wFFff1MlEoV8l7AZsB9EL-q6b7vY,9071
 coretrace_python/abstract/heap.py,sha256=OaESXFGC0qzyhAr76xrCu4skeDVzZM4wlenQqfMTkdk,9642
@@ -29,13 +29,13 @@ coretrace_python/bundled/models/credentials/credential_models.py,sha256=Mw9ty8PD
 coretrace_python/bundled/models/credentials/plugin.toml,sha256=0ut7Jc7IdcvbsZKPu6ty-z3DBlMg2CUT7JX4y4nMybo,217
 coretrace_python/bundled/models/db_drivers/db_driver_models.py,sha256=x4SAwhcpuG5TLfhmVsuAQ1VV3lAXSNh5YHx7QuFBQyU,2339
 coretrace_python/bundled/models/db_drivers/plugin.toml,sha256=094-QIV92x-69uy2CgMulBXfGvt48qtefLyeW2q3SRs,178
-coretrace_python/bundled/models/django/django_models.py,sha256=xgczSQ98vyLgOHKTLb2nZL7VyxdoDUTJC8oKIh0kdRg,5756
+coretrace_python/bundled/models/django/django_models.py,sha256=1ftZ8tEBZJXrAiZr0rQZBSIOu4VqwOkHz8WE8FE5UBI,6445
 coretrace_python/bundled/models/django/plugin.toml,sha256=_Qa2X_4IViORQkcLvLsAC5vI-2P5CxgG8VvnuNIWcFQ,214
 coretrace_python/bundled/models/fastapi/fastapi_models.py,sha256=K2Edlo1RzYKmAJAIChNVUDc8gorAS48MGEMKNlCIGrI,1251
 coretrace_python/bundled/models/fastapi/plugin.toml,sha256=V_R2WcEc-qkST0tTpL-cRf2FEbjK6Mk727WbJmVpWJM,200
 coretrace_python/bundled/models/flask/flask_models.py,sha256=XVZWH4u2SdbErk40L-JjTBXQI1hrVCDlMu5BeqE1Ibc,2319
 coretrace_python/bundled/models/flask/plugin.toml,sha256=kI53Xwf5aZKd2n3fEQEbBzNnOXRvuonqEazTOIXPJP4,192
-coretrace_python/bundled/models/http_clients/http_client_models.py,sha256=TmVIg66zRRQxx3C9RT2XX6xLhemm037hIIBFRSyKzU0,1273
+coretrace_python/bundled/models/http_clients/http_client_models.py,sha256=9XhHWZKq3XWcD0WexucuedAiwxp3fhXxGmo9R6DNtSQ,1954
 coretrace_python/bundled/models/http_clients/plugin.toml,sha256=vq9tWHgy8-m8LiU1StGhm9Lsy7vnj3w90P4AKDaKfc0,216
 coretrace_python/bundled/models/python_stdlib/plugin.toml,sha256=DWqjG68rx91HCJi_VEp6tUs4ujkzlR7Lq7saMvtK2HM,187
 coretrace_python/bundled/models/python_stdlib/python_stdlib.py,sha256=3LmjcFx3rUhM3Mpw86q8bS5Xj6gRJs_p6M-8yBGiK2k,4632
@@ -99,7 +99,7 @@ coretrace_python/findings/__init__.py,sha256=gnJI-uB2CkgZ8I5aFYP_N5yZb7FGNIy7Lir
 coretrace_python/findings/baseline.py,sha256=fbGQuULRsCjhxSNdwuLfwsvql9ZUfF3jqCXrRmIgOoQ,3468
 coretrace_python/findings/coverage.py,sha256=U8URLEz6EN4B_TTQlLFCOtEmUbINt7a0Bexb-6OUFlI,1203
 coretrace_python/findings/model.py,sha256=zRK1FDuLgiVY4ch6H_AN9rDxC1orNW4wc8YN3cfVFfc,1424
-coretrace_python/findings/refutation.py,sha256=wL26drcy0JB-qHlRpb4jaYWej209GxTi2tt5SWnfCFw,17465
+coretrace_python/findings/refutation.py,sha256=MmFANBozz0sodIhGUhrgr7BCEwhw5s80kRPRMDRDIyU,20707
 coretrace_python/findings/suppressions.py,sha256=kN4q0CA1tzeAubeYe4rUv_aRXda4PAsMZY0r8M5cuQI,2633
 coretrace_python/frontend/__init__.py,sha256=ULI2tf_IRTMboaKM6uzTkGGh4Agy3cFjtw2H1IPrz4g,627
 coretrace_python/frontend/ast_adapter.py,sha256=VL2CgbQqDGSr2Wh-z0EpR0gBB7T29s0xHvfT-BPx08c,21833
@@ -110,7 +110,7 @@ coretrace_python/hir/visitors.py,sha256=JFnX09hK6trLyRcWgZ5ehOG2ywX3VvkqQ1h82nah
 coretrace_python/interprocedural/__init__.py,sha256=SXtIGE3DD4fADIXLDuEvyT_3oIsh7Vio3BL4U6oUm28,1162
 coretrace_python/interprocedural/callgraph.py,sha256=E6enTawqcl4-TObdjvoFe6l1zEedvsWbnjEBD6omzy8,19827
 coretrace_python/interprocedural/modulegraph.py,sha256=4sB7OKjBYfxtm7aMtHm2jRlqFVUNUsdnLhnv9UZ1BWA,8846
-coretrace_python/interprocedural/summaries.py,sha256=q--xpp1euaf5utxbK4CZtS8CSyLJ6p3MLel5Iu80X3w,20747
+coretrace_python/interprocedural/summaries.py,sha256=9-WGS-X37KJY1ynoXXA5HNfYFLeCyiKVMAIjeWgaVLI,21333
 coretrace_python/ir/__init__.py,sha256=ShBPYYqoQFePP-mgBjGezQ2acel0-ReOHF9vCC-G_4Q,232
 coretrace_python/ir/defuse.py,sha256=CZEPnlgntRp4MqwR7kLldd2ZlIlBnr-V9VJAxXxwm0c,2616
 coretrace_python/ir/lowering.py,sha256=V7r_4tEOi801NBOsPdG6pwrRHZIeVTahygYENneLQ4U,31428
@@ -137,13 +137,14 @@ coretrace_python/semantic/symbols.py,sha256=3JptnnX5_KBlSd00L_wcGlYZQdnmBvSBAhfi
 coretrace_python/source/__init__.py,sha256=0Y8fvtbkETnNCJR9Zq7RS5TSgF9c22pz3SSk1KdAXF0,301
 coretrace_python/source/manager.py,sha256=JRmMOcWfS1nocbVrdcvfQTqEfIkmnb5JP857TpGywN4,2736
 coretrace_python/source/model.py,sha256=FZnN5mlir3tzbIpWoxnn6YtRi9UcJ_y0sZM60tKr8U4,1727
-coretrace_python/taint/__init__.py,sha256=UIJwnPnyYODsvnpe6-cmF8tOvKoGvWE7yVH3yIfthcM,1199
-coretrace_python/taint/engine.py,sha256=UY59sb-sUWct3jzFHr6PBfJ_VFhZgb13tSyvD9nKqaM,38916
-coretrace_python/taint/models.py,sha256=23TMzT149dCpRULO3RAyzbZWmayXWw4-a5iRjrqC0yo,13074
+coretrace_python/taint/__init__.py,sha256=kfqCEXE5wKFLwz2XrT42_yEv9pW4vPfgg5yYBVVSr2I,1371
+coretrace_python/taint/engine.py,sha256=uB0Mga1xeKF6LVHx601pvojb0NLAPG0DqF8fy3dM8oU,40222
+coretrace_python/taint/models.py,sha256=i3_Sfwdqf_BGXV47jylfF3vuX6nYJcyAPiwC3xerh6g,14592
 coretrace_python/taint/routes.py,sha256=UAJKXcw_sM9shf58FfDroxVO9bNSm4qrQdZknwUB0lo,6110
-coretrace_python_analyzer-0.6.0.dist-info/METADATA,sha256=WW3JCb3v2qbdWowN5kzDA1NRREuGErf-QysFU7k2kIU,3216
-coretrace_python_analyzer-0.6.0.dist-info/WHEEL,sha256=W3fkpkm7-wf9vBI5Z-7s0eWkeM-spu78I8Neb98DeEg,87
-coretrace_python_analyzer-0.6.0.dist-info/entry_points.txt,sha256=wdozemiraOkbt65g_Y_zgspuZpoLxJdaCVMJt1Ft3c0,72
-coretrace_python_analyzer-0.6.0.dist-info/licenses/LICENSE,sha256=z8d0m5b2O9McPEK1xHG_dWgUBT6EfBDz6wA0F7xSPTA,11358
-coretrace_python_analyzer-0.6.0.dist-info/licenses/NOTICE,sha256=s3VHj5ngV0ozjW_kZJpg_35ne6JwoBK0ysOjbqVtA0w,113
-coretrace_python_analyzer-0.6.0.dist-info/RECORD,,
+coretrace_python/taint/templates.py,sha256=8Ojb43VXuWxOVifeXRpi3_2mjZfnvIC7GQ-AW80GUYk,11148
+coretrace_python_analyzer-0.7.0.dist-info/METADATA,sha256=lak3Dd-Dpbv_TEo-PAhnBg5r6iwrJmsDM5aa6wogg1w,3216
+coretrace_python_analyzer-0.7.0.dist-info/WHEEL,sha256=W3fkpkm7-wf9vBI5Z-7s0eWkeM-spu78I8Neb98DeEg,87
+coretrace_python_analyzer-0.7.0.dist-info/entry_points.txt,sha256=wdozemiraOkbt65g_Y_zgspuZpoLxJdaCVMJt1Ft3c0,72
+coretrace_python_analyzer-0.7.0.dist-info/licenses/LICENSE,sha256=z8d0m5b2O9McPEK1xHG_dWgUBT6EfBDz6wA0F7xSPTA,11358
+coretrace_python_analyzer-0.7.0.dist-info/licenses/NOTICE,sha256=s3VHj5ngV0ozjW_kZJpg_35ne6JwoBK0ysOjbqVtA0w,113
+coretrace_python_analyzer-0.7.0.dist-info/RECORD,,