entrygraph 0.1.24__tar.gz → 0.1.26__tar.gz

{entrygraph-0.1.24 → entrygraph-0.1.26}/PKG-INFO

@@ -1,6 +1,6 @@
 Metadata-Version: 2.4
 Name: entrygraph
-Version: 0.1.24
+Version: 0.1.26
 Summary: Language-agnostic code graph: query symbols, entrypoints, and source-to-sink call paths from a SQLite index
 Project-URL: Repository, https://github.com/brettbergin/entrygraph
 Author-email: Brett Bergin <brettberginbc@yahoo.com>
@@ -202,7 +202,9 @@ entrygraph paths --source '*' --sink-category command_exec
   `--source-category http_input` / `env`) — `entrygraph paths --source-category http_input --sink-category sql`. Combine with `--source` to union both.
 - **Precision/recall dial**: by default only high-confidence edges are traversed.
   Widen with `--include-unresolved` (wildcard `py:*.execute` sinks + dynamic
-  calls) or `--include-fuzzy` (speculative class-hierarchy edges).
+  calls), `--include-fuzzy` (speculative class-hierarchy edges), or
+  `--include-callbacks` (function/method values passed as arguments — handler
+  registrations like `http.HandleFunc("/", handler)` or `this::handle`).
 - **Sanitizers**: a registered sanitizer for the sink's category called on a
   path (e.g. `shlex.quote`) *discounts* its risk score — heuristically, since
   there is no dataflow, so it never zeroes the risk or hides the path.

{entrygraph-0.1.24 → entrygraph-0.1.26}/README.md

@@ -151,7 +151,9 @@ entrygraph paths --source '*' --sink-category command_exec
   `--source-category http_input` / `env`) — `entrygraph paths --source-category http_input --sink-category sql`. Combine with `--source` to union both.
 - **Precision/recall dial**: by default only high-confidence edges are traversed.
   Widen with `--include-unresolved` (wildcard `py:*.execute` sinks + dynamic
-  calls) or `--include-fuzzy` (speculative class-hierarchy edges).
+  calls), `--include-fuzzy` (speculative class-hierarchy edges), or
+  `--include-callbacks` (function/method values passed as arguments — handler
+  registrations like `http.HandleFunc("/", handler)` or `this::handle`).
 - **Sanitizers**: a registered sanitizer for the sink's category called on a
   path (e.g. `shlex.quote`) *discounts* its risk score — heuristically, since
   there is no dataflow, so it never zeroes the risk or hides the path.

{entrygraph-0.1.24 → entrygraph-0.1.26}/src/entrygraph/_version.py

@@ -18,7 +18,7 @@ version_tuple: tuple[int | str, ...]
 commit_id: str | None
 __commit_id__: str | None
 
-__version__ = version = '0.1.24'
-__version_tuple__ = version_tuple = (0, 1, 24)
+__version__ = version = '0.1.26'
+__version_tuple__ = version_tuple = (0, 1, 26)
 
 __commit_id__ = commit_id = None

{entrygraph-0.1.24 → entrygraph-0.1.26}/src/entrygraph/cli/main.py

@@ -274,6 +274,7 @@ def cmd_paths(args) -> int:
             min_confidence=args.min_confidence,
             include_fuzzy=args.include_fuzzy,
             include_unresolved=args.include_unresolved,
+            include_callbacks=args.include_callbacks,
             prune_sanitized=args.prune_sanitized,
         )
     if args.json:
@@ -411,6 +412,13 @@ def build_parser() -> argparse.ArgumentParser:
         action="store_true",
         help="also traverse unresolved wildcard-sink and dynamic-call edges",
     )
+    p.add_argument(
+        "--include-callbacks",
+        dest="include_callbacks",
+        action="store_true",
+        help="also follow function/method values passed as arguments "
+        "(handler registrations, callbacks)",
+    )
     p.add_argument(
         "--prune-sanitized",
         dest="prune_sanitized",

{entrygraph-0.1.24 → entrygraph-0.1.26}/src/entrygraph/extract/java.py

@@ -206,6 +206,7 @@ class JavaExtractor:
                 receiver = None
                 callee_text = callee_name
             args = node.child_by_field_name("arguments")
+            caller = self._caller(node, ctx)
             out.references.append(
                 RawReference(
                     kind="call",
@@ -213,11 +214,12 @@ class JavaExtractor:
                     callee_name=callee_name,
                     receiver_text=receiver,
                     span=span_of(node),
-                    caller_qualified_name=self._caller(node, ctx),
+                    caller_qualified_name=caller,
                     arg_count=len(args.named_children) if args is not None else 0,
                     arg_preview=truncate(node_text(args)) if args is not None else None,
                 )
             )
+            self._emit_callbacks(args, caller, out)
 
         for node in caps.get("new", []):
             type_node = node.child_by_field_name("type")
@@ -239,6 +241,33 @@ class JavaExtractor:
                 )
             )
 
+    def _emit_callbacks(self, args: Node | None, caller: str | None, out: FileExtraction) -> None:
+        """Method-reference arguments passed to a call — a method value invoked
+        later, e.g. ``r.get("/run", this::handle)`` or ``stream.map(App::parse)``.
+        The qualifier becomes the receiver (``this`` resolves to the enclosing
+        class; a type/instance qualifier resolves by unique method name), so the
+        handler gets an inbound edge. Resolution keeps only project methods."""
+        if args is None:
+            return
+        for arg in args.named_children:
+            if arg.type != "method_reference":
+                continue
+            children = arg.named_children
+            if len(children) < 2 or children[-1].type != "identifier":
+                continue
+            receiver = node_text(children[0])  # "this" | "App" | "obj"
+            name = node_text(children[-1])
+            out.references.append(
+                RawReference(
+                    kind="callback",
+                    callee_text=f"{receiver}::{name}",
+                    callee_name=name,
+                    receiver_text=receiver,
+                    span=span_of(arg),
+                    caller_qualified_name=caller,
+                )
+            )
+
     # ---------------- helpers ----------------
 
     def _scope_chain(self, node: Node, ctx: FileContext) -> list[str]:

entrygraph-0.1.26/tests/fixtures/java/methodref_app/pom.xml

@@ -0,0 +1,6 @@
+<project>
+  <modelVersion>4.0.0</modelVersion>
+  <groupId>com.example</groupId>
+  <artifactId>app</artifactId>
+  <version>1.0</version>
+</project>

entrygraph-0.1.26/tests/fixtures/java/methodref_app/src/main/java/com/example/App.java

@@ -0,0 +1,11 @@
+package com.example;
+
+public class App {
+    void setup(Router r) {
+        r.get("/run", this::handle);
+    }
+
+    void handle() throws Exception {
+        Runtime.getRuntime().exec("sh");
+    }
+}

{entrygraph-0.1.24 → entrygraph-0.1.26}/tests/test_cli.py

@@ -80,6 +80,30 @@ def test_paths_by_category(db, capsys):
     assert paths and paths[0]["symbols"][-1] == "py:subprocess.run"
 
 
+NETHTTP_APP = Path(__file__).parent / "fixtures" / "go" / "nethttp_app"
+
+
+def test_paths_include_callbacks(tmp_path, capsys):
+    # a handler passed to http.HandleFunc is severed unless callback edges are
+    # traversed; --include-callbacks flips the query from unreachable to reachable.
+    db = str(tmp_path / "go.db")
+    assert main(["index", str(NETHTTP_APP), "--db", db]) == 0
+    args = [
+        "paths",
+        "--db",
+        db,
+        "--source",
+        "_root.main",
+        "--sink-category",
+        "command_exec",
+        "--include-unresolved",
+    ]
+    assert main(args) == 1  # handler severed -> no path
+    capsys.readouterr()
+    assert main([*args, "--include-callbacks"]) == 0  # reachable via the callback edge
+    assert "_root.handler" in capsys.readouterr().out
+
+
 def test_callers(db, capsys):
     assert main(["callers", "--db", db, "app.services.run_report"]) == 0
     assert "app.routes.create_report" in capsys.readouterr().out

{entrygraph-0.1.24 → entrygraph-0.1.26}/tests/test_extract_java.py

@@ -199,6 +199,32 @@ public class C {
     assert "ProcessBuilder" in calls
 
 
+def test_method_reference_argument_is_a_callback():
+    # r.get("/run", this::handle) / stream.map(App::parse) pass method values;
+    # they must be callbacks so the referenced method is reachable.
+    x = extract(
+        """
+package com.example;
+
+public class App {
+    void setup(Router r) {
+        r.get("/run", this::handle);
+        r.post("/x", App::parse);
+    }
+    void handle() {}
+    static void parse() {}
+}
+""",
+        path="src/main/java/com/example/App.java",
+    )
+    callbacks = {r.callee_name: r for r in x.references if r.kind == "callback"}
+    assert callbacks["handle"].receiver_text == "this"
+    assert callbacks["handle"].caller_qualified_name == "com.example.App.setup"
+    assert callbacks["parse"].receiver_text == "App"
+    # string literal args are not callbacks
+    assert "/run" not in callbacks
+
+
 # ---------------- unit: main detection ----------------
 
 

entrygraph-0.1.26/tests/test_java_callbacks.py

@@ -0,0 +1,45 @@
+"""End-to-end: Java method-reference callbacks connect handlers to their
+registration site (Phase 4).
+
+Regression: the Java extractor emitted no callback references, so a handler passed
+as a method reference (`this::handle`) had no inbound edge and was unreachable.
+"""
+
+from __future__ import annotations
+
+from pathlib import Path
+
+import pytest
+
+from entrygraph import CodeGraph
+
+METHODREF_APP = Path(__file__).parent / "fixtures" / "java" / "methodref_app"
+
+
+@pytest.fixture(scope="module")
+def graph(tmp_path_factory) -> CodeGraph:
+    db = tmp_path_factory.mktemp("db") / "graph.db"
+    g = CodeGraph.index(METHODREF_APP, db=db)
+    yield g
+    g.close()
+
+
+def test_callback_edge_created(graph):
+    rows = graph.sql(
+        "SELECT src.qname AS src, e.dst_qname AS dst FROM edges e "
+        "JOIN symbols src ON e.src_symbol_id = src.id WHERE e.kind = 'callback'"
+    )
+    pairs = {(r["src"], r["dst"]) for r in rows}
+    assert ("com.example.App.setup", "com.example.App.handle") in pairs
+
+
+def test_handler_reachable_only_with_callbacks(graph):
+    kw = {
+        "source": "com.example.App.setup",
+        "sink_category": "command_exec",
+        "include_unresolved": True,
+    }
+    assert graph.paths(**kw) == []
+    withcb = graph.paths(**kw, include_callbacks=True)
+    assert withcb
+    assert "com.example.App.handle" in [s.qname for s in withcb[0].symbols]