entrygraph 0.1.0__py3-none-any.whl

entrygraph/data/sinks/go.toml

@@ -0,0 +1,87 @@
+# Built-in Go sink/source catalog.
+# Patterns are brace-globs matched against canonical callee qnames:
+#   import-expanded external calls -> "go:os/exec.Command"
+#   unresolved selector calls      -> "go:*.Query"
+#   unresolved bare calls          -> "go:panic"
+
+[[sink]]
+id = "go.command-exec.exec"
+category = "command_exec"
+severity = "high"
+callee = "go:os/exec.{Command,CommandContext}"
+description = "Subprocess execution via os/exec"
+
+[[sink]]
+id = "go.command-exec.os"
+category = "command_exec"
+severity = "high"
+callee = "go:os.StartProcess"
+description = "OS process spawn"
+
+[[sink]]
+id = "go.sql-query"
+category = "sql"
+severity = "medium"
+callee = "go:*.{Query,QueryRow,Exec,QueryContext,ExecContext,QueryRowContext}"
+description = "SQL statement execution (receiver-agnostic; database/sql)"
+
+[[sink]]
+id = "go.file-write"
+category = "file_write"
+severity = "low"
+callee = "go:os.{OpenFile,WriteFile,Create,Remove,RemoveAll}"
+description = "Filesystem mutation"
+
+[[sink]]
+id = "go.network-out"
+category = "network_out"
+severity = "low"
+callee = "go:net/http.{Get,Post,PostForm,Head}"
+description = "Outbound network request"
+
+[[source]]
+id = "go.nethttp.request"
+category = "http_input"
+callee = "go:*.{FormValue,PostFormValue,Query}"
+description = "HTTP request input"
+
+# --- C5 deepening ---
+[[sink]]
+id = "go.path-traversal"
+category = "path_traversal"
+severity = "medium"
+callee = "go:{os.Open,os.ReadFile,io/ioutil.{ReadFile,WriteFile}}"
+description = "File access (verify the path is not attacker-controlled)"
+
+[[sink]]
+id = "go.ssrf"
+category = "ssrf"
+severity = "medium"
+callee = "go:net/http.{NewRequest,NewRequestWithContext}"
+description = "Outbound HTTP request construction"
+
+[[sink]]
+id = "go.weak-crypto"
+category = "weak_crypto"
+severity = "low"
+callee = "go:{crypto/md5.{New,Sum},crypto/sha1.{New,Sum},crypto/des.NewCipher,crypto/rc4.NewCipher,math/rand.{Int,Intn,Float64}}"
+description = "Weak crypto or non-cryptographic RNG"
+
+[[sink]]
+id = "go.template-injection"
+category = "template_injection"
+severity = "medium"
+callee = "go:text/template.{New,Must}"
+description = "text/template (unescaped) rendering"
+
+[[source]]
+id = "go.gin.input"
+category = "http_input"
+callee = "go:*.{Param,GetHeader,Bind,BindJSON,ShouldBind,ShouldBindJSON}"
+description = "Gin request input"
+
+[[source]]
+id = "go.env"
+category = "env_input"
+callee = "go:os.Getenv"
+description = "Environment variable input"

entrygraph/data/sinks/java.toml

@@ -0,0 +1,92 @@
+# Built-in Java sink/source catalog.
+# Patterns are brace-globs matched against canonical callee qnames:
+#   resolved external calls    -> "java:com.example.Foo.bar"
+#   unresolved attribute calls -> "java:*.exec"     (unknown receiver)
+#   unresolved bare calls      -> "java:doThing"
+#
+# Runtime.getRuntime().exec(...) and new ProcessBuilder(...).start() both have
+# unknown receivers, so they land on "java:*.exec" / "java:*.start"-style
+# guesses; the receiver-agnostic patterns below catch them.
+
+[[sink]]
+id = "java.command-exec"
+category = "command_exec"
+severity = "high"
+callee = "java:{*.exec,Runtime.exec,ProcessBuilder,*.ProcessBuilder}"
+description = "OS command execution (Runtime.exec / ProcessBuilder)"
+
+[[sink]]
+id = "java.sql-execute"
+category = "sql"
+severity = "medium"
+callee = "java:*.{executeQuery,executeUpdate,execute,executeLargeUpdate,executeBatch}"
+description = "SQL statement execution (receiver-agnostic)"
+
+[[sink]]
+id = "java.deserialization"
+category = "deserialization"
+severity = "high"
+callee = "java:*.readObject"
+description = "Unsafe Java deserialization (ObjectInputStream.readObject)"
+
+[[sink]]
+id = "java.code-eval"
+category = "code_eval"
+severity = "critical"
+callee = "java:*.eval"
+description = "Dynamic code evaluation (ScriptEngine.eval)"
+
+# --- C5 deepening ---
+[[sink]]
+id = "java.ssrf"
+category = "ssrf"
+severity = "medium"
+callee = "java:*.{openConnection,openStream}"
+description = "Outbound connection (URL.openConnection / openStream)"
+
+[[sink]]
+id = "java.xxe"
+category = "xxe"
+severity = "medium"
+callee = "java:*.{newDocumentBuilder,newSAXParser,newXMLReader,createXMLStreamReader}"
+description = "XML parser factory susceptible to XXE"
+
+[[sink]]
+id = "java.deserialization.extra"
+category = "deserialization"
+severity = "high"
+callee = "java:{XMLDecoder,*.XMLDecoder,*.readUnshared,*.enableDefaultTyping}"
+description = "Unsafe deserialization (XMLDecoder / Jackson default typing)"
+
+[[sink]]
+id = "java.jndi"
+category = "jndi"
+severity = "medium"
+callee = "java:*.lookup"
+description = "JNDI lookup (InitialContext.lookup)"
+
+[[sink]]
+id = "java.expression-injection"
+category = "template_injection"
+severity = "high"
+callee = "java:*.{parseExpression,evaluate,createTemplate}"
+description = "Expression/template evaluation (SpEL / Velocity / Freemarker)"
+
+[[sink]]
+id = "java.path-traversal"
+category = "path_traversal"
+severity = "medium"
+callee = "java:{FileInputStream,*.FileInputStream,FileReader,*.FileReader,Files.readAllBytes,*.Files.readAllBytes,Paths.get}"
+description = "File access with a potentially attacker-controlled path"
+
+[[source]]
+id = "java.servlet.input"
+category = "http_input"
+callee = "java:*.{getParameter,getParameterValues,getHeader,getQueryString,getInputStream,getReader,getCookies}"
+description = "Servlet request input"
+
+[[source]]
+id = "java.env"
+category = "env_input"
+callee = "java:System.getenv"
+description = "Environment variable input"

entrygraph/data/sinks/javascript.toml

@@ -0,0 +1,112 @@
+# Built-in JavaScript / TypeScript sink catalog.
+# Canonical callees: import-expanded externals like "js:child_process.exec",
+# unresolved attribute calls like "js:*.query", bare calls like "js:eval".
+
+[[sink]]
+id = "js.command-exec.child_process"
+category = "command_exec"
+severity = "high"
+callee = "js:child_process.{exec,execSync,spawn,spawnSync,execFile,execFileSync}"
+description = "Child process execution"
+
+[[sink]]
+id = "js.command-exec.member"
+category = "command_exec"
+severity = "high"
+callee = "js:*.{exec,execSync,spawn,spawnSync}"
+description = "Child process execution (member call)"
+
+[[sink]]
+id = "js.code-eval"
+category = "code_eval"
+severity = "critical"
+callee = "js:{eval,Function}"
+description = "Dynamic code evaluation"
+
+[[sink]]
+id = "js.sql-query"
+category = "sql"
+severity = "medium"
+callee = "js:*.{query,execute,raw}"
+description = "SQL query execution (receiver-agnostic)"
+
+[[sink]]
+id = "js.file-write"
+category = "file_write"
+severity = "low"
+callee = "js:{fs.writeFile,fs.writeFileSync,fs.appendFile,fs.rm,fs.rmSync,fs.unlink}"
+description = "Filesystem mutation"
+
+[[sink]]
+id = "js.network-out"
+category = "network_out"
+severity = "low"
+callee = "js:{fetch,axios.get,axios.post,http.get,https.get}"
+description = "Outbound network request"
+
+[[source]]
+id = "js.express.req"
+category = "http_input"
+callee = "js:*.{body,query,params}"
+description = "Express request input"
+
+# --- sanitizers (S3): neutralize/reduce taint for a sink category ---
+[[sanitizer]]
+id = "js.sanitize.sqlstring"
+category = "sql"
+callee = "js:{sqlstring.escape,mysql.escape,*.escapeId,*.escape}"
+effect = "reduces"
+description = "SQL string escaping"
+
+[[sanitizer]]
+id = "js.sanitize.shellescape"
+category = "command_exec"
+callee = "js:{shell-quote.quote,shellescape}"
+effect = "neutralizes"
+description = "Shell argument quoting"
+
+[[sanitizer]]
+id = "js.sanitize.html-escape"
+category = "template_injection"
+callee = "js:{escape-html,he.encode,*.escapeHtml}"
+effect = "reduces"
+description = "HTML entity escaping"
+
+# --- C5 deepening ---
+[[sink]]
+id = "js.ssrf"
+category = "ssrf"
+severity = "medium"
+callee = "js:{axios.{request,put,delete,patch},got,http.request,https.request,undici.{request,fetch}}"
+require_arg_hint = "\\+|\\$\\{|`"
+description = "Server-side request with a non-literal URL"
+
+[[sink]]
+id = "js.path-traversal"
+category = "path_traversal"
+severity = "medium"
+callee = "js:fs.{readFile,readFileSync,createReadStream,open,openSync}"
+require_arg_hint = "\\+|\\$\\{|`"
+description = "File read with a non-literal path"
+
+[[sink]]
+id = "js.template-injection"
+category = "template_injection"
+severity = "high"
+callee = "js:{ejs.render,handlebars.compile,pug.render,nunjucks.renderString,lodash.template}"
+description = "Template rendering / compilation"
+
+[[sink]]
+id = "js.code-eval.vm"
+category = "code_eval"
+severity = "critical"
+callee = "js:vm.{runInNewContext,runInThisContext,runInContext}"
+description = "Node vm dynamic code execution"
+
+[[sink]]
+id = "js.weak-crypto"
+category = "weak_crypto"
+severity = "low"
+callee = "js:crypto.createHash"
+require_arg_hint = "md5|sha1"
+description = "Weak hashing algorithm"

entrygraph/data/sinks/lib_javascript.toml

@@ -0,0 +1,34 @@
+# Library summaries for JS/TS third-party wrappers. See lib_python.toml header.
+
+[[sink]]
+id = "lib.js.knex.raw"
+category = "sql"
+severity = "medium"
+callee = "js:{knex.raw,*.knex.raw}"
+description = "Knex raw SQL query"
+library = "knex"
+require_arg_hint = "\\+|\\$\\{|`"
+
+[[sink]]
+id = "lib.js.sequelize.query"
+category = "sql"
+severity = "medium"
+callee = "js:{sequelize.query,*.sequelize.query}"
+description = "Sequelize raw query"
+library = "sequelize"
+
+[[sink]]
+id = "lib.js.shelljs.exec"
+category = "command_exec"
+severity = "high"
+callee = "js:{shelljs.exec,shell.exec,*.shelljs.exec}"
+description = "ShellJS command execution"
+library = "shelljs"
+
+[[sink]]
+id = "lib.js.execa"
+category = "command_exec"
+severity = "high"
+callee = "js:{execa,execa.command,execa.sync,execa.commandSync}"
+description = "execa subprocess execution"
+library = "execa"

entrygraph/data/sinks/lib_python.toml

@@ -0,0 +1,39 @@
+# Library summaries: known third-party wrappers that reach a dangerous sink
+# internally. entrygraph stops at the repo boundary, so a call into one of these
+# would otherwise terminate at the wrapper. Modelled as ordinary sinks keyed on
+# the wrapper's canonical callee, with `library` set for provenance.
+#
+# Rule of thumb: receiver-agnostic `*.name` patterns only for DISTINCTIVE method
+# names; generic names must be module-qualified.
+
+[[sink]]
+id = "lib.py.fabric.run"
+category = "command_exec"
+severity = "high"
+callee = "py:{fabric.api.run,fabric.api.sudo,fabric.api.local,fabric.operations.run,fabric.operations.sudo,*.Connection.run,*.Connection.sudo}"
+description = "Fabric remote/local command execution"
+library = "fabric"
+
+[[sink]]
+id = "lib.py.paramiko.exec"
+category = "command_exec"
+severity = "high"
+callee = "py:*.exec_command"
+description = "Paramiko SSH remote command execution"
+library = "paramiko"
+
+[[sink]]
+id = "lib.py.sh"
+category = "command_exec"
+severity = "high"
+callee = "py:{sh.Command,sh.bash,sh.sh}"
+description = "sh module dynamic command invocation"
+library = "sh"
+
+[[sink]]
+id = "lib.py.invoke.run"
+category = "command_exec"
+severity = "high"
+callee = "py:{invoke.run,invoke.sudo,*.Context.run,*.Context.sudo}"
+description = "Invoke task-runner command execution"
+library = "invoke"

entrygraph/data/sinks/php.toml

@@ -0,0 +1,125 @@
+# Built-in PHP sink/source catalog.
+# Patterns are brace-globs matched against canonical callee qnames:
+#   resolved external calls    -> "php:App.Services.Runner.run"
+#   unresolved receiver calls  -> "php:*.query"
+#   unresolved bare calls      -> "php:shell_exec"
+#
+# Namespace separators (`\`) are normalized to `.` upstream, so globs are
+# dot-based. NOTE: `$_GET` / `$_POST` / `$_REQUEST` / `$_COOKIE` superglobals
+# are *variable reads*, not function calls, so they never surface as call
+# references and cannot be modeled as sources here — taint from them must be
+# tracked structurally, which is out of scope for this catalog.
+
+[[sink]]
+id = "php.command-exec"
+category = "command_exec"
+severity = "high"
+callee = "php:{exec,system,shell_exec,passthru,popen,proc_open,pcntl_exec}"
+description = "OS command execution"
+
+[[sink]]
+id = "php.code-eval"
+category = "code_eval"
+severity = "critical"
+callee = "php:{eval,assert,create_function}"
+description = "Dynamic code evaluation"
+
+[[sink]]
+id = "php.code-eval.callback"
+category = "code_eval"
+severity = "critical"
+callee = "php:{call_user_func,call_user_func_array}"
+require_arg_hint = "\\$"
+description = "Dynamic callback invocation with a non-literal callable"
+
+[[sink]]
+id = "php.code-inclusion"
+category = "code_inclusion"
+severity = "critical"
+callee = "php:{include,include_once,require,require_once}"
+require_arg_hint = "\\$"
+description = "Dynamic file inclusion with a non-literal path"
+
+[[sink]]
+id = "php.deserialization"
+category = "deserialization"
+severity = "high"
+callee = "php:unserialize"
+description = "Unsafe deserialization"
+
+[[sink]]
+id = "php.sql"
+category = "sql"
+severity = "high"
+callee = "php:{mysqli_query,mysqli_multi_query,pg_query,sqlite_query}"
+description = "SQL statement execution"
+
+[[sink]]
+id = "php.sql.pdo-query"
+category = "sql"
+severity = "high"
+callee = "php:*.{query,exec}"
+description = "PDO/DB query execution (receiver-agnostic)"
+
+[[sink]]
+id = "php.sql.pdo-prepare"
+category = "sql"
+severity = "low"
+callee = "php:*.prepare"
+description = "PDO prepared statement (receiver-agnostic)"
+
+[[sink]]
+id = "php.path-traversal"
+category = "path_traversal"
+severity = "medium"
+callee = "php:{file_get_contents,file_put_contents,fopen,readfile,unlink}"
+require_arg_hint = "\\$"
+description = "Filesystem access with a non-literal path"
+
+[[sink]]
+id = "php.ssrf"
+category = "ssrf"
+severity = "medium"
+callee = "php:{curl_exec,curl_init,fsockopen}"
+description = "Server-side request"
+
+[[sink]]
+id = "php.template-injection"
+category = "template_injection"
+severity = "high"
+callee = "php:*.render"
+require_arg_hint = "\\$"
+description = "Template rendering with non-literal input (receiver-agnostic)"
+
+[[sink]]
+id = "php.ldap"
+category = "ldap"
+severity = "medium"
+callee = "php:{ldap_search,ldap_bind}"
+description = "LDAP operation"
+
+[[sink]]
+id = "php.xxe"
+category = "xxe"
+severity = "medium"
+callee = "php:{simplexml_load_string,simplexml_load_file}"
+description = "XML parsing susceptible to XXE"
+
+[[sink]]
+id = "php.weak-crypto"
+category = "weak_crypto"
+severity = "low"
+callee = "php:{md5,sha1,mt_rand,rand}"
+description = "Weak hashing / insecure randomness"
+
+[[source]]
+id = "php.filter-input"
+category = "http_input"
+callee = "php:{filter_input,filter_input_array}"
+description = "Filtered request input"
+
+[[source]]
+id = "php.laravel.request"
+category = "http_input"
+callee = "php:*.{input,query,post,cookie,header}"
+description = "Laravel request accessors"

entrygraph/data/sinks/python.toml

@@ -0,0 +1,160 @@
+# Built-in Python sink/source catalog.
+# Patterns are brace-globs matched against canonical callee qnames:
+#   resolved external calls    -> "py:subprocess.run"
+#   unresolved attribute calls -> "py:*.execute"
+#   unresolved bare calls      -> "py:eval"
+
+[[sink]]
+id = "py.command-exec.subprocess"
+category = "command_exec"
+severity = "high"
+callee = "py:subprocess.{run,call,check_call,check_output,Popen,getoutput,getstatusoutput}"
+description = "Subprocess execution"
+
+[[sink]]
+id = "py.command-exec.os"
+category = "command_exec"
+severity = "high"
+callee = "py:os.{system,popen,execv,execve,execvp,execl,execlp,spawnv,spawnl,startfile}"
+description = "OS command execution"
+
+[[sink]]
+id = "py.code-eval"
+category = "code_eval"
+severity = "critical"
+callee = "py:{eval,exec,compile,builtins.eval,builtins.exec}"
+description = "Dynamic code evaluation"
+
+[[sink]]
+id = "py.sql-execute"
+category = "sql"
+severity = "medium"
+callee = "py:*.{execute,executemany,executescript}"
+description = "SQL statement execution (receiver-agnostic)"
+
+[[sink]]
+id = "py.deserialization.pickle"
+category = "deserialization"
+severity = "high"
+callee = "py:{pickle,cPickle,marshal,shelve}.{load,loads,open}"
+description = "Unsafe deserialization"
+
+[[sink]]
+id = "py.deserialization.yaml"
+category = "deserialization"
+severity = "high"
+callee = "py:yaml.{load,unsafe_load,full_load}"
+description = "Unsafe YAML loading"
+
+[[sink]]
+id = "py.template-injection.flask"
+category = "template_injection"
+severity = "high"
+callee = "py:{flask.render_template_string,*.render_template_string}"
+description = "Template rendering from a string"
+
+[[sink]]
+id = "py.file-write"
+category = "file_write"
+severity = "low"
+callee = "py:{shutil.rmtree,shutil.move,os.remove,os.unlink,os.rmdir,*.write_text,*.write_bytes}"
+description = "Filesystem mutation"
+
+[[sink]]
+id = "py.network-out"
+category = "network_out"
+severity = "low"
+callee = "py:{requests.{get,post,put,delete,patch,request},urllib.request.urlopen,httpx.{get,post,request}}"
+description = "Outbound network request"
+
+[[source]]
+id = "py.flask.request"
+category = "http_input"
+callee = "py:flask.request*"
+description = "Flask request object"
+
+[[source]]
+id = "py.stdin"
+category = "user_input"
+callee = "py:{input,sys.stdin.*}"
+description = "Interactive input"
+
+# --- sanitizers (S3) ---
+[[sanitizer]]
+id = "py.sanitize.shlex"
+category = "command_exec"
+callee = "py:shlex.{quote,split}"
+effect = "neutralizes"
+description = "Shell argument quoting"
+
+[[sanitizer]]
+id = "py.sanitize.markupsafe"
+category = "template_injection"
+callee = "py:{markupsafe.escape,markupsafe.escape_silent,html.escape,*.escape}"
+effect = "reduces"
+description = "HTML/template escaping"
+
+[[sanitizer]]
+id = "py.sanitize.shutil-which"
+category = "command_exec"
+callee = "py:shutil.which"
+effect = "reduces"
+description = "Resolving an executable path via allowlist lookup"
+
+# --- C5 deepening ---
+[[sink]]
+id = "py.ssrf"
+category = "ssrf"
+severity = "medium"
+callee = "py:{requests.{get,post,put,delete,patch,request},urllib.request.{urlopen,Request},httpx.{get,post,request,stream}}"
+require_arg_hint = "\\+|%|format|f['\"]"
+description = "Server-side request with a non-literal URL"
+
+[[sink]]
+id = "py.path-traversal"
+category = "path_traversal"
+severity = "medium"
+callee = "py:{open,io.open}"
+require_arg_hint = "\\+|%|format\\(|f['\"]"
+description = "File open with a non-literal path"
+
+[[sink]]
+id = "py.xxe"
+category = "xxe"
+severity = "medium"
+callee = "py:{xml.etree.ElementTree.{parse,fromstring},lxml.etree.{parse,fromstring,XML},xml.dom.minidom.{parse,parseString},xml.sax.{parse,parseString}}"
+description = "XML parsing susceptible to XXE"
+
+[[sink]]
+id = "py.weak-crypto"
+category = "weak_crypto"
+severity = "low"
+callee = "py:hashlib.{md5,sha1}"
+description = "Weak hashing algorithm"
+
+[[sink]]
+id = "py.deserialization.extra"
+category = "deserialization"
+severity = "high"
+callee = "py:{dill,cloudpickle,joblib}.{load,loads}"
+description = "Unsafe deserialization (dill/cloudpickle/joblib)"
+
+[[sink]]
+id = "py.template-injection.libs"
+category = "template_injection"
+severity = "high"
+callee = "py:{jinja2.Template,mako.template.Template,django.template.Template}"
+description = "Template constructed from a string"
+
+[[sink]]
+id = "py.dynamic-import"
+category = "code_eval"
+severity = "medium"
+callee = "py:{importlib.import_module,__import__}"
+description = "Dynamic module import"
+
+[[source]]
+id = "py.env"
+category = "env_input"
+callee = "py:{os.getenv,os.environ.get}"
+description = "Environment variable input"