entrygraph 0.1.25__tar.gz → 0.1.26__tar.gz

{entrygraph-0.1.25 → entrygraph-0.1.26}/PKG-INFO

@@ -1,6 +1,6 @@
 Metadata-Version: 2.4
 Name: entrygraph
-Version: 0.1.25
+Version: 0.1.26
 Summary: Language-agnostic code graph: query symbols, entrypoints, and source-to-sink call paths from a SQLite index
 Project-URL: Repository, https://github.com/brettbergin/entrygraph
 Author-email: Brett Bergin <brettberginbc@yahoo.com>
@@ -202,7 +202,9 @@ entrygraph paths --source '*' --sink-category command_exec
   `--source-category http_input` / `env`) — `entrygraph paths --source-category http_input --sink-category sql`. Combine with `--source` to union both.
 - **Precision/recall dial**: by default only high-confidence edges are traversed.
   Widen with `--include-unresolved` (wildcard `py:*.execute` sinks + dynamic
-  calls) or `--include-fuzzy` (speculative class-hierarchy edges).
+  calls), `--include-fuzzy` (speculative class-hierarchy edges), or
+  `--include-callbacks` (function/method values passed as arguments — handler
+  registrations like `http.HandleFunc("/", handler)` or `this::handle`).
 - **Sanitizers**: a registered sanitizer for the sink's category called on a
   path (e.g. `shlex.quote`) *discounts* its risk score — heuristically, since
   there is no dataflow, so it never zeroes the risk or hides the path.

{entrygraph-0.1.25 → entrygraph-0.1.26}/README.md

@@ -151,7 +151,9 @@ entrygraph paths --source '*' --sink-category command_exec
   `--source-category http_input` / `env`) — `entrygraph paths --source-category http_input --sink-category sql`. Combine with `--source` to union both.
 - **Precision/recall dial**: by default only high-confidence edges are traversed.
   Widen with `--include-unresolved` (wildcard `py:*.execute` sinks + dynamic
-  calls) or `--include-fuzzy` (speculative class-hierarchy edges).
+  calls), `--include-fuzzy` (speculative class-hierarchy edges), or
+  `--include-callbacks` (function/method values passed as arguments — handler
+  registrations like `http.HandleFunc("/", handler)` or `this::handle`).
 - **Sanitizers**: a registered sanitizer for the sink's category called on a
   path (e.g. `shlex.quote`) *discounts* its risk score — heuristically, since
   there is no dataflow, so it never zeroes the risk or hides the path.

{entrygraph-0.1.25 → entrygraph-0.1.26}/src/entrygraph/_version.py

@@ -18,7 +18,7 @@ version_tuple: tuple[int | str, ...]
 commit_id: str | None
 __commit_id__: str | None
 
-__version__ = version = '0.1.25'
-__version_tuple__ = version_tuple = (0, 1, 25)
+__version__ = version = '0.1.26'
+__version_tuple__ = version_tuple = (0, 1, 26)
 
 __commit_id__ = commit_id = None

{entrygraph-0.1.25 → entrygraph-0.1.26}/src/entrygraph/cli/main.py

@@ -274,6 +274,7 @@ def cmd_paths(args) -> int:
             min_confidence=args.min_confidence,
             include_fuzzy=args.include_fuzzy,
             include_unresolved=args.include_unresolved,
+            include_callbacks=args.include_callbacks,
             prune_sanitized=args.prune_sanitized,
         )
     if args.json:
@@ -411,6 +412,13 @@ def build_parser() -> argparse.ArgumentParser:
         action="store_true",
         help="also traverse unresolved wildcard-sink and dynamic-call edges",
     )
+    p.add_argument(
+        "--include-callbacks",
+        dest="include_callbacks",
+        action="store_true",
+        help="also follow function/method values passed as arguments "
+        "(handler registrations, callbacks)",
+    )
     p.add_argument(
         "--prune-sanitized",
         dest="prune_sanitized",

{entrygraph-0.1.25 → entrygraph-0.1.26}/tests/test_cli.py

@@ -80,6 +80,30 @@ def test_paths_by_category(db, capsys):
     assert paths and paths[0]["symbols"][-1] == "py:subprocess.run"
 
 
+NETHTTP_APP = Path(__file__).parent / "fixtures" / "go" / "nethttp_app"
+
+
+def test_paths_include_callbacks(tmp_path, capsys):
+    # a handler passed to http.HandleFunc is severed unless callback edges are
+    # traversed; --include-callbacks flips the query from unreachable to reachable.
+    db = str(tmp_path / "go.db")
+    assert main(["index", str(NETHTTP_APP), "--db", db]) == 0
+    args = [
+        "paths",
+        "--db",
+        db,
+        "--source",
+        "_root.main",
+        "--sink-category",
+        "command_exec",
+        "--include-unresolved",
+    ]
+    assert main(args) == 1  # handler severed -> no path
+    capsys.readouterr()
+    assert main([*args, "--include-callbacks"]) == 0  # reachable via the callback edge
+    assert "_root.handler" in capsys.readouterr().out
+
+
 def test_callers(db, capsys):
     assert main(["callers", "--db", db, "app.services.run_report"]) == 0
     assert "app.routes.create_report" in capsys.readouterr().out