coretrace-python-analyzer 0.6.0__py3-none-any.whl → 0.8.0__py3-none-any.whl

coretrace_python/__init__.py

@@ -1,4 +1,4 @@
 """CoreTrace's Python static analysis frontend."""
 
-__version__ = "0.6.0"
+__version__ = "0.8.0"
 

coretrace_python/bundled/models/django/django_models.py

@@ -23,6 +23,7 @@ from coretrace_python.taint import (
     Source,
     SuffixSink,
     TaintKind,
+    TemplateRender,
     TypedParameter,
 )
 
@@ -119,7 +120,15 @@ class DjangoModels(ModelPlugin):
         Sink(_sym("django.http.HttpResponseRedirect"), TaintKind.REDIRECT, _TARGET_ONLY),
         Sink(_sym("django.http.HttpResponsePermanentRedirect"), TaintKind.REDIRECT, _TARGET_ONLY),
         Sanitizer(_sym("django.utils.html.escape"), TaintKind.HTML),
+        TemplateRender(_sym("django.template.loader.render_to_string")),
         Sanitizer(_sym("django.utils.html.conditional_escape"), TaintKind.HTML),
+        # The masked CSRF secret: ASCII letters and digits only, a malformed cookie is
+        # replaced before it is used.
+        Sanitizer(_sym("django.middleware.csrf.get_token"), TaintKind.ALL),
+        # A path of the project's URL configuration, never scheme-relative: attacker data
+        # in its arguments or query reaches no other host through a redirect.
+        *(Sanitizer(_sym(f"django.urls.{name}"), TaintKind.REDIRECT) for name in ("reverse", "reverse_lazy")),
+        *(Sanitizer(_sym(f"django.urls.base.{name}"), TaintKind.REDIRECT) for name in ("reverse", "reverse_lazy")),
         *(AuthorizationGuard(_sym(decorator), label) for decorator, label in _AUTHORIZATION_DECORATORS),
         # ``urlpatterns = [path('login/', views.log_in)]``: the referenced view is an
         # entry point wherever it is defined; routers register viewsets.

coretrace_python/bundled/models/http_clients/http_client_models.py

@@ -1,5 +1,8 @@
-"""Requests and httpx models: every request function is a SSRF sink, and what it returns
-is an ``http-response`` source, so data fetched from a remote server is untrusted."""
+"""Requests and httpx models: every request function is a SSRF sink for the argument that
+chooses the destination, and what it returns is an ``http-response`` source, so data
+fetched from a remote server is untrusted. The destination is the URL — first, or second
+after the method, or ``url=`` — or the prepared request a ``send`` takes; the body, the
+headers and the query parameters do not choose the host."""
 
 from __future__ import annotations
 
@@ -20,15 +23,18 @@ _CALLERS = (
     "httpx.AsyncClient",
 )
 
-_REQUEST_FUNCTIONS = (
-    *(f"{caller}.{method}" for caller in _CALLERS for method in _METHODS),
-    "requests.Session.send",
-    "httpx.stream",
-    "httpx.Client.stream",
-    "httpx.AsyncClient.stream",
-    "httpx.Client.send",
-    "httpx.AsyncClient.send",
-)
+# Where each function takes its destination, by position (the receiver of a method
+# excluded) and by keyword, as its signature declares it.
+_DESTINATIONS = {
+    **{f"{caller}.{method}": (0, "url") for caller in _CALLERS for method in _METHODS if method != "request"},
+    **{f"{caller}.request": (1, "url") for caller in _CALLERS},
+    "httpx.stream": (1, "url"),
+    "httpx.Client.stream": (1, "url"),
+    "httpx.AsyncClient.stream": (1, "url"),
+    "requests.Session.send": (0, "request"),
+    "httpx.Client.send": (0, "request"),
+    "httpx.AsyncClient.send": (0, "request"),
+}
 
 
 def _sym(path: str) -> SymbolId:
@@ -38,6 +44,9 @@ def _sym(path: str) -> SymbolId:
 class HttpClientModels(ModelPlugin):
     name: ClassVar[str] = "http-client-models"
     models: ClassVar[tuple[Model, ...]] = (
-        *(Sink(_sym(function), TaintKind.SSRF) for function in _REQUEST_FUNCTIONS),
-        *(Source(_sym(function), "http-response") for function in _REQUEST_FUNCTIONS),
+        *(
+            Sink(_sym(function), TaintKind.SSRF, ((TaintKind.SSRF, (position,)),), ((TaintKind.SSRF, (keyword,)),))
+            for function, (position, keyword) in _DESTINATIONS.items()
+        ),
+        *(Source(_sym(function), "http-response") for function in _DESTINATIONS),
     )

coretrace_python/cache.py

@@ -25,6 +25,7 @@ from coretrace_python.findings import Confidence, Finding, Severity
 from coretrace_python.interprocedural import (
     Arguments,
     CallSite,
+    Cleared,
     ExternalCall,
     ExternalSymbol,
     FunctionSummary,
@@ -41,7 +42,7 @@ from coretrace_python.interprocedural import (
 from coretrace_python.semantic.symbols import SymbolId
 from coretrace_python.source import SourceId, SourceSpan
 
-CACHE_FORMAT = 8
+CACHE_FORMAT = 10
 
 
 @dataclass(frozen=True)
@@ -233,10 +234,12 @@ def _encode_call(call: ExternalCall) -> dict[str, Any]:
     return {
         "symbol": str(call.symbol),
         "arguments": [sorted(deps) for deps in call.argument_dependencies],
-        "keywords": sorted(call.keyword_dependencies),
+        "keywords": [[name, sorted(deps)] for name, deps in call.keyword_dependencies],
         "location": _encode_span(call.location),
         "call_site": None if call.call_site is None else _encode_span(call.call_site),
         "given": _encode_arguments(call.arguments),
+        "argument_cleared": [_encode_cleared(c) for c in call.argument_cleared],
+        "keyword_cleared": [_encode_cleared(c) for c in call.keyword_cleared],
     }
 
 
@@ -245,13 +248,23 @@ def _decode_call(data: Mapping[str, Any]) -> ExternalCall:
     return ExternalCall(
         SymbolId(_string(data["symbol"])),
         tuple(_indices(deps) for deps in data["arguments"]),
-        _indices(data["keywords"]),
+        tuple((None if name is None else _string(name), _indices(deps)) for name, deps in data["keywords"]),
         _decode_span(data["location"]),
         None if site is None else _decode_span(site),
         _decode_arguments(data["given"]),
+        tuple(_decode_cleared(c) for c in data["argument_cleared"]),
+        tuple(_decode_cleared(c) for c in data["keyword_cleared"]),
     )
 
 
+def _encode_cleared(cleared: Cleared) -> list[list[int]]:
+    return [[parameter, bits] for parameter, bits in cleared]
+
+
+def _decode_cleared(data: Any) -> Cleared:
+    return tuple((_integer(parameter), _integer(bits)) for parameter, bits in data)
+
+
 def _encode_summary(summary: FunctionSummary) -> dict[str, Any]:
     return {
         "name": summary.name,
@@ -275,6 +288,7 @@ def _encode_summary(summary: FunctionSummary) -> dict[str, Any]:
             for w in summary.nonlocal_writes
         ],
         "static": summary.static,
+        "return_cleared": _encode_cleared(summary.return_cleared),
     }
 
 
@@ -303,6 +317,7 @@ def _decode_summary(data: Mapping[str, Any]) -> FunctionSummary:
             for w in data["nonlocal_writes"]
         ),
         bool(data["static"]),
+        _decode_cleared(data["return_cleared"]),
     )
 
 

coretrace_python/cli.py

@@ -27,6 +27,7 @@ from coretrace_python.reporters import FORMATS, render
 from coretrace_python.semantic.imports import ImportResolutionError
 from coretrace_python.semantic.scopes import ScopeError
 from coretrace_python.source import SourceManager
+from coretrace_python.taint import ModelError
 
 EXIT_CLEAN = 0
 EXIT_FINDINGS = 1
@@ -45,6 +46,7 @@ _ANALYSIS_ERRORS = (
     AnalysisError,
     ManifestError,
     IncompatiblePluginError,
+    ModelError,
 )
 
 

coretrace_python/engine.py

@@ -70,6 +70,7 @@ from coretrace_python.interprocedural import (
     CallGraph,
     CallGraphAnalysis,
     CallSite,
+    ClearingAnalysis,
     FunctionSummary,
     ModuleFunction,
     ModuleGraph,
@@ -109,6 +110,7 @@ from coretrace_python.source import SourceFile, SourceId, SourceManager, SourceS
 from coretrace_python.taint import (
     EntryPoint,
     EntryPointAnalysis,
+    EscapedTemplates,
     ModelTable,
     RegisteredRoutes,
     Routes,
@@ -116,6 +118,7 @@ from coretrace_python.taint import (
     SecurityModelRegistry,
     TaintAnalysis,
     TaintKind,
+    escaped_templates,
     registered_routes,
 )
 
@@ -146,6 +149,8 @@ ALL_ANALYSES: tuple[AnyAnalysis, ...] = (
     RefutationAnalysis,
     DependencyAnalysis,
     RegisteredRoutes,
+    EscapedTemplates,
+    ClearingAnalysis,
 )
 
 
@@ -178,7 +183,15 @@ class ResultsEvicted(TransformationPass):
 
     name: ClassVar[str] = "project.results-evicted"
     preserves: ClassVar[frozenset[AnyAnalysis]] = frozenset(
-        {*SEMANTIC_ANALYSES, SecurityModelAnalysis, ProjectSummaries, DependencyAnalysis, RegisteredRoutes}
+        {
+            *SEMANTIC_ANALYSES,
+            SecurityModelAnalysis,
+            ProjectSummaries,
+            DependencyAnalysis,
+            RegisteredRoutes,
+            EscapedTemplates,
+            ClearingAnalysis,
+        }
     )
 
     @classmethod
@@ -236,7 +249,9 @@ def build_manager(
     """A manager with every engine analysis registered and the engine inputs provided."""
 
     manager = _register_all(module)
-    manager.provide(SecurityModelAnalysis, (models or SecurityModelRegistry()).freeze())
+    table = (models or SecurityModelRegistry()).freeze()
+    manager.provide(SecurityModelAnalysis, table)
+    manager.provide(ClearingAnalysis, table.clearing())
     manager.provide(ProjectSummaries, SummaryIndex())
     manager.provide(RegisteredRoutes, _routes_of(manager))
     return manager
@@ -266,10 +281,14 @@ def load_plugins(plugin_roots: Sequence[Path], manager: AnalysisManager) -> Plug
     return registry
 
 
-def plugin_models(plugins: Iterable[Plugin]) -> ModelTable:
+def plugin_models(plugins: Iterable[Plugin], root: Path | None = None) -> ModelTable:
+    """The models of ``plugins``, with those they read from the project at ``root``."""
+
     models = SecurityModelRegistry()
     for plugin in plugins:
         models.register(*plugin.models, origin=plugin.name)
+        if root is not None:
+            models.register(*plugin.project_models(root), origin=plugin.name)
     return models.freeze()
 
 
@@ -284,7 +303,9 @@ def analyze_file(source: SourceFile, plugin_roots: Sequence[Path]) -> FileAnalys
 
     manager = _register_all(build_hir(source))
     registry = load_plugins(plugin_roots, manager)
-    manager.provide(SecurityModelAnalysis, plugin_models(loaded.plugin for loaded in registry))
+    table = plugin_models(loaded.plugin for loaded in registry)
+    manager.provide(SecurityModelAnalysis, table)
+    manager.provide(ClearingAnalysis, table.clearing())
     manager.provide(ProjectSummaries, SummaryIndex())
     manager.provide(RegisteredRoutes, _routes_of(manager))
     findings, supported = _check_module(manager, tuple(loaded.plugin for loaded in registry))
@@ -375,7 +396,7 @@ def analyze_project(
         (a for plugin in all_plugins for a in plugin.advisories), file_advisories
     )
     affected = affected_symbols(dependencies, advisories)
-    models = plugin_models(all_plugins).extended(*advisory_sinks(affected))
+    models = plugin_models(all_plugins, root).extended(*advisory_sinks(affected))
     for manager in managers.values():
         manager.provide(SecurityModelAnalysis, models)
         manager.provide(DependencyAnalysis, dependencies)
@@ -397,10 +418,14 @@ def analyze_project(
     for name in sorted(analysable):
         for symbol, registered in _routes_of(analysable[name]).items():
             routes.setdefault(symbol, registered)
+    escaped = escaped_templates(root)
+    clearing = models.clearing(escaped)
     for manager in analysable.values():
         manager.provide(RegisteredRoutes, routes)
+        manager.provide(EscapedTemplates, escaped)
+        manager.provide(ClearingAnalysis, clearing)
 
-    configuration = _configuration_key(registry, plugins, models, advisories, dependencies, routes)
+    configuration = _configuration_key(registry, plugins, models, advisories, dependencies, routes, escaped)
     keys = module_keys(
         graph,
         {name: fingerprint(configuration, str(files[name].source_id), name, files[name].text) for name in analysable},
@@ -441,6 +466,7 @@ def analyze_project(
                             encode_index(_seed(results, graph, component)),
                             advisory_paths,
                             _encode_routes(routes),
+                            tuple(sorted(escaped)),
                         ),
                     )
                     for component in pending
@@ -588,6 +614,7 @@ class _Batch:
     seed: Mapping[str, Any]
     advisory_paths: tuple[Path, ...] = ()
     routes: tuple[tuple[str, str, str, int], ...] = ()
+    escaped: tuple[str, ...] = ()
 
 
 def _analyse_batch(batch: _Batch) -> dict[str, dict[str, Any]]:
@@ -606,12 +633,15 @@ def _analyse_batch(batch: _Batch) -> dict[str, dict[str, Any]]:
         (a for plugin in all_plugins for a in plugin.advisories), file_advisories
     )
     affected = affected_symbols(dependencies, advisories)
-    models = plugin_models(all_plugins).extended(*advisory_sinks(affected))
+    models = plugin_models(all_plugins, batch.root).extended(*advisory_sinks(affected))
     routes = _decode_routes(batch.routes)
+    escaped = frozenset(batch.escaped)
     for manager in managers.values():
         manager.provide(SecurityModelAnalysis, models)
         manager.provide(DependencyAnalysis, dependencies)
         manager.provide(RegisteredRoutes, routes)
+        manager.provide(EscapedTemplates, escaped)
+        manager.provide(ClearingAnalysis, models.clearing(escaped))
     module_plugins = tuple(p for p in all_plugins if not isinstance(p, ProjectPlugin))
     results = _analyse_managers(managers, decode_index(batch.seed), module_plugins, affected)
     return {name: encode(entry) for name, entry in results.items()}
@@ -639,6 +669,7 @@ def _configuration_key(
     advisories: tuple[Advisory, ...],
     dependencies: DependencyGraph,
     routes: Routes | None = None,
+    escaped: frozenset[str] = frozenset(),
 ) -> str:
     """Everything a module's results depend on besides the project sources (§11)."""
 
@@ -658,6 +689,7 @@ def _configuration_key(
         repr(dependencies.requirements),
         repr(dependencies.errors),
         repr(_encode_routes(routes or {})),
+        repr(sorted(escaped)),
     )
 
 

coretrace_python/findings/refutation.py

@@ -8,10 +8,13 @@ and ``not`` combine as expected, a ``Validator`` model names a callable whose tr
 one of its arguments, a numeric value (``abstract.ranges``) cannot inject, and anything
 else that mentions the value is a guard that does not prove it. A proof counts for an
 origin when every dependence path from that origin to the sink argument goes through a
-proven value. A flow is refuted when every tainted origin is proven safe or the sink is
-unreachable, a hotspot when it sits behind an ``AuthorizationGuard`` (a decorator or a
-dominating condition) or when an unproven guard mentions it, and a vulnerability
-otherwise.
+proven value. A guard mentions an origin only when it examines what the sink receives:
+reading another attribute or item of an object the flow reads (``request.method`` next
+to ``request.POST``) examines nothing of it, while the same attribute, or a method called
+on the object (``form.is_valid()``), does. A flow is refuted when every tainted origin is
+proven safe or the sink is unreachable, a hotspot when it sits behind an
+``AuthorizationGuard`` (a decorator or a dominating condition) or when an unproven guard
+mentions it, and a vulnerability otherwise.
 """
 
 from __future__ import annotations
@@ -26,7 +29,12 @@ from coretrace_python.abstract import ConstantPropagation, RangeAnalysis, RangeF
 from coretrace_python.analysis import AnalysisContext, AnyAnalysis, FunctionAnalysis
 from coretrace_python.cfg import CFG, BlockId, CFGAnalysis, DominanceAnalysis, DominatorTree
 from coretrace_python.hir import nodes
-from coretrace_python.interprocedural import CallGraphAnalysis
+from coretrace_python.interprocedural import (
+    CallGraph,
+    CallGraphAnalysis,
+    KnownFunction,
+    project_symbol,
+)
 from coretrace_python.ir.model import (
     BoolOp,
     Branch,
@@ -37,6 +45,7 @@ from coretrace_python.ir.model import (
     Constant,
     FunctionIR,
     GetAttr,
+    GetItem,
     Instruction,
     UnaryOp,
     Value,
@@ -51,6 +60,7 @@ from coretrace_python.taint import (
     TaintAnalysis,
     TaintFacts,
     TaintFlow,
+    TaintKind,
 )
 
 VALIDATORS = frozenset(
@@ -210,15 +220,16 @@ class _Judge:
 
     def interpret(
         self, condition: Value, truth: bool | None
-    ) -> tuple[dict[Value, str], set[Value]]:
-        """Values the condition proves safe (with the reason), and values it mentions
-        without proving anything. ``truth`` is ``None`` when it is not fixed at the sink.
+    ) -> tuple[dict[Value, tuple[str, TaintKind]], set[Value]]:
+        """Values the condition proves safe (with the reason and the kinds it proves them
+        safe for), and values it mentions without proving anything. ``truth`` is ``None``
+        when it is not fixed at the sink.
 
         A recognised check evaluated the wrong way (``isdigit()`` known false) yields
         nothing: it is neither a proof nor a reassuring guard."""
 
         definition = self.defs.get(condition)
-        proven: dict[Value, str] = {}
+        proven: dict[Value, tuple[str, TaintKind]] = {}
         mentioned: set[Value] = set()
         if isinstance(definition, UnaryOp) and definition.operator == "not":
             return self.interpret(definition.operand, None if truth is None else not truth)
@@ -232,27 +243,29 @@ class _Judge:
         recognised = self.recognise(definition)
         if recognised is None:
             return proven, set(self.closure(condition)) | {condition}
-        tested, reason, when_true = recognised
+        tested, reason, when_true, kinds = recognised
         if truth is None:
             mentioned = set(self.closure(condition)) | {condition}
         elif truth == when_true:
             # The check proves ``tested``; whatever else it reads is merely mentioned.
-            proven[tested] = reason
+            proven[tested] = (reason, kinds)
             mentioned = set(self.closure(condition)) | {condition}
         return proven, mentioned
 
-    def recognise(self, definition: Instruction | None) -> tuple[Value, str, bool] | None:
-        """``(validated value, reason, truth that validates)`` for known check shapes."""
+    def recognise(self, definition: Instruction | None) -> tuple[Value, str, bool, TaintKind] | None:
+        """``(validated value, reason, truth that validates, kinds it proves)`` for known
+        check shapes. A string check, a constant allowlist or an equality with a constant
+        proves every kind; a ``Validator`` only the kinds it declares."""
 
         if isinstance(definition, Call) and not definition.arguments:
             callee = self.defs.get(definition.callee)
             if isinstance(callee, GetAttr) and callee.attribute in VALIDATORS:
-                return callee.object, f"guarded by {callee.attribute}()", True
+                return callee.object, f"guarded by {callee.attribute}()", True, TaintKind.ALL
         if isinstance(definition, Call):
             symbol = self.symbols.get(definition.callee)
             validator = self.models.validator(symbol) if symbol is not None else None
             if validator is not None and validator.argument < len(definition.arguments):
-                return definition.arguments[validator.argument], f"validated by {symbol}", True
+                return definition.arguments[validator.argument], f"validated by {symbol}", True, validator.kinds
         if isinstance(definition, Compare):
             left, right = definition.left, definition.right
             if definition.operator in ("in", "not_in") and self.is_constant_collection(right):
@@ -260,11 +273,72 @@ class _Judge:
                     left,
                     "allowlisted by a membership check on constants",
                     definition.operator == "in",
+                    TaintKind.ALL,
                 )
             if definition.operator in ("eq", "not_eq"):
                 for tested, other in ((left, right), (right, left)):
                     if isinstance(self.defs.get(other), Constant):
-                        return tested, "equals a constant", definition.operator == "eq"
+                        return tested, "equals a constant", definition.operator == "eq", TaintKind.ALL
+        return None
+
+    def examined(
+        self, condition: Value, mentioned: set[Value], argument: Value, chain: frozenset[Value]
+    ) -> set[Value]:
+        """What the guard examines of the values it mentions: everything its condition is
+        computed from, except an object it only reads another attribute or item of than
+        the flow reads (``request`` in ``request.method`` when the sink receives
+        ``request.POST['cmd']``). A method called on the object (``form.is_valid()``), the
+        same attribute or item, or any part of an object the flow takes whole (passes to
+        the sink or to a call), examines it."""
+
+        reads = {self.access(value) for value in chain} - {None}
+        whole = {argument} | {
+            operand
+            for value in chain
+            if (definition := self.defs.get(value)) is not None
+            for operand in definition.operands()
+            if not (isinstance(definition, GetAttr | GetItem) and definition.object == operand)
+        }
+        found: set[Value] = set()
+        called: set[Value] = set()
+        pending = [condition]
+        while pending:
+            value = pending.pop()
+            if value in found:
+                continue
+            found.add(value)
+            definition = self.defs.get(value)
+            if definition is None:
+                continue
+            if isinstance(definition, Call):
+                called.add(definition.callee)
+            access = None if value in called else self.access(value)
+            for operand in definition.operands():
+                if access is not None and access[0] == operand and operand not in whole and self.aside(access, reads):
+                    continue
+                pending.append(operand)
+        return found & mentioned
+
+    @staticmethod
+    def aside(access: tuple[Value, str, object], reads: set[tuple[Value, str, object] | None]) -> bool:
+        """Whether reading ``access`` reads beside what the flow reads of the same object;
+        an item under a key unknown on either side may be the same one."""
+
+        owner, kind, name = access
+        if kind == "item" and (name is None or (owner, "item", None) in reads):
+            return False
+        return access not in reads
+
+    def access(self, value: Value) -> tuple[Value, str, object] | None:
+        """``(object, "attribute" or "item", name or constant key)`` for a read of an
+        attribute or an item; ``None`` for any other value, and as the key when unknown."""
+
+        definition = self.defs.get(value)
+        if isinstance(definition, GetAttr):
+            return definition.object, "attribute", definition.attribute
+        if isinstance(definition, GetItem):
+            key = self.defs.get(definition.key)
+            return definition.object, "item", key.value if isinstance(key, Constant) else None
         return None
 
     def is_constant_collection(self, value: Value) -> bool:
@@ -323,11 +397,13 @@ class _Judge:
         )
         for guard in self.guards(sink):
             found, mentioned = self.interpret(guard.condition, guard.truth)
-            for value, reason in found.items():
-                if value in chain:
+            for value, (reason, kinds) in found.items():
+                # A check proving some kinds only leaves the others reaching the sink.
+                if value in chain and not flow.kinds & ~kinds:
                     proven.setdefault(value, reason)
+            examined = self.examined(guard.condition, mentioned, flow.argument, chain)
             for origin in origins:
-                if origin not in mentions and mentioned & (
+                if origin not in mentions and examined & (
                     {origin} | {w for w in chain if origin in self.closure(w)}
                 ):
                     mentions[origin] = guard.line
@@ -413,6 +489,7 @@ class RefutationAnalysis(FunctionAnalysis[Verdicts]):
         constants = ctx.get(ConstantPropagation, function)
         graph = ctx.get(CallGraphAnalysis)
         models = ctx.get(SecurityModelAnalysis)
+        name = graph.name_of(function)
         return judge_flows(
             ssa,
             ctx.get(CFGAnalysis, function),
@@ -421,7 +498,21 @@ class RefutationAnalysis(FunctionAnalysis[Verdicts]):
             frozenset(b.id for b in ssa.blocks if constants.reachable(b.id)),
             ctx.get(RangeAnalysis, function),
             models,
-            graph.symbols(graph.name_of(function)),
+            _with_project_callees(ssa, graph, name, ctx.module.name),
             authorization_of(function, models, ctx.get(ScopeAnalysis), ctx.get(SymbolAnalysis)),
         )
 
+
+def _with_project_callees(function: FunctionIR, graph: CallGraph, name: str, module: str) -> dict[Value, SymbolId]:
+    """The symbols of ``name``'s values, with each call to a function of its module named
+    by its project symbol, so a model declared on it (``Validator``) applies there too."""
+
+    symbols = dict(graph.symbols(name))
+    for block in function.blocks:
+        for instruction in block.instructions:
+            if isinstance(instruction, Call):
+                target = graph.target_at(name, instruction.location)
+                if isinstance(target, KnownFunction):
+                    symbols.setdefault(instruction.callee, project_symbol(module, target.name))
+    return symbols
+

coretrace_python/interprocedural/__init__.py

@@ -20,6 +20,9 @@ from coretrace_python.interprocedural.modulegraph import (
     project_symbol,
 )
 from coretrace_python.interprocedural.summaries import (
+    Cleared,
+    Clearing,
+    ClearingAnalysis,
     ExternalCall,
     FunctionSummary,
     Mutation,
@@ -28,6 +31,7 @@ from coretrace_python.interprocedural.summaries import (
     SummaryAnalysis,
     SummaryIndex,
     SummaryTable,
+    cleared_by,
 )
 
 __all__ = [
@@ -35,6 +39,9 @@ __all__ = [
     "CallGraph",
     "CallGraphAnalysis",
     "CallSite",
+    "Cleared",
+    "Clearing",
+    "ClearingAnalysis",
     "ExternalCall",
     "ExternalSymbol",
     "FunctionSummary",
@@ -51,6 +58,7 @@ __all__ = [
     "Target",
     "UnknownTarget",
     "build_module_graph",
+    "cleared_by",
     "discover_files",
     "discover_sources",
     "project_symbol",