entrygraph 0.1.26__tar.gz → 0.1.27__tar.gz

{entrygraph-0.1.26 → entrygraph-0.1.27}/PKG-INFO

@@ -1,6 +1,6 @@
 Metadata-Version: 2.4
 Name: entrygraph
-Version: 0.1.26
+Version: 0.1.27
 Summary: Language-agnostic code graph: query symbols, entrypoints, and source-to-sink call paths from a SQLite index
 Project-URL: Repository, https://github.com/brettbergin/entrygraph
 Author-email: Brett Bergin <brettberginbc@yahoo.com>

{entrygraph-0.1.26 → entrygraph-0.1.27}/src/entrygraph/_version.py

@@ -18,7 +18,7 @@ version_tuple: tuple[int | str, ...]
 commit_id: str | None
 __commit_id__: str | None
 
-__version__ = version = '0.1.26'
-__version_tuple__ = version_tuple = (0, 1, 26)
+__version__ = version = '0.1.27'
+__version_tuple__ = version_tuple = (0, 1, 27)
 
 __commit_id__ = commit_id = None

{entrygraph-0.1.26 → entrygraph-0.1.27}/src/entrygraph/data/sinks/csharp.toml

@@ -104,3 +104,26 @@ id = "csharp.env"
 category = "env_input"
 callee = "cs:Environment.GetEnvironmentVariable"
 description = "Environment variable input"
+
+# ---------------- sanitizers ----------------
+
+[[sanitizer]]
+id = "cs.sanitize.path-getfilename"
+category = "path_traversal"
+callee = "cs:*.{GetFileName,GetFullPath}"
+effect = "reduces"
+description = "Path.GetFileName / GetFullPath normalization"
+
+[[sanitizer]]
+id = "cs.sanitize.uri-escape"
+category = "ssrf"
+callee = "cs:*.{EscapeDataString,EscapeUriString}"
+effect = "reduces"
+description = "Uri.EscapeDataString URL encoding"
+
+[[sanitizer]]
+id = "cs.sanitize.sql-parameter"
+category = "sql"
+callee = "cs:*.{AddWithValue}"
+effect = "reduces"
+description = "Parameterized query value binding (SqlParameter)"

{entrygraph-0.1.26 → entrygraph-0.1.27}/src/entrygraph/data/sinks/go.toml

@@ -85,3 +85,33 @@ id = "go.env"
 category = "env_input"
 callee = "go:os.Getenv"
 description = "Environment variable input"
+
+# ---------------- sanitizers ----------------
+
+[[sanitizer]]
+id = "go.sanitize.filepath-clean"
+category = "path_traversal"
+callee = "go:{path/filepath.Clean,path.Clean,path/filepath.Base,path.Base}"
+effect = "reduces"
+description = "Path normalization / basename"
+
+[[sanitizer]]
+id = "go.sanitize.html-escape"
+category = "template_injection"
+callee = "go:{html.EscapeString,template.HTMLEscapeString}"
+effect = "reduces"
+description = "HTML escaping"
+
+[[sanitizer]]
+id = "go.sanitize.url-escape"
+category = "ssrf"
+callee = "go:{url.QueryEscape,url.PathEscape}"
+effect = "reduces"
+description = "URL component escaping"
+
+[[sanitizer]]
+id = "go.sanitize.strconv-sql"
+category = "sql"
+callee = "go:{strconv.Atoi,strconv.ParseInt,strconv.ParseUint,strconv.ParseFloat}"
+effect = "neutralizes"
+description = "Numeric parse — a parsed number cannot carry SQL injection"

{entrygraph-0.1.26 → entrygraph-0.1.27}/src/entrygraph/data/sinks/java.toml

@@ -90,3 +90,26 @@ id = "java.env"
 category = "env_input"
 callee = "java:System.getenv"
 description = "Environment variable input"
+
+# ---------------- sanitizers ----------------
+
+[[sanitizer]]
+id = "java.sanitize.html-encode"
+category = "template_injection"
+callee = "java:*.{forHtml,forHtmlContent,forJavaScript,escapeHtml4,escapeHtml,escapeXml11,htmlEscape}"
+effect = "reduces"
+description = "OWASP Encoder / commons-text / Spring HTML escaping"
+
+[[sanitizer]]
+id = "java.sanitize.path-normalize"
+category = "path_traversal"
+callee = "java:*.{getFileName,normalize,getName}"
+effect = "reduces"
+description = "Path normalization / filename extraction (Path.getFileName, FilenameUtils.getName)"
+
+[[sanitizer]]
+id = "java.sanitize.url-encode"
+category = "ssrf"
+callee = "java:*.{urlEncode,encode}"
+effect = "reduces"
+description = "URL encoding (URLEncoder.encode)"

{entrygraph-0.1.26 → entrygraph-0.1.27}/src/entrygraph/data/sinks/php.toml

@@ -123,3 +123,47 @@ id = "php.laravel.request"
 category = "http_input"
 callee = "php:*.{input,query,post,cookie,header}"
 description = "Laravel request accessors"
+
+# ---------------- sanitizers ----------------
+
+[[sanitizer]]
+id = "php.sanitize.escapeshell"
+category = "command_exec"
+callee = "php:{escapeshellarg,escapeshellcmd}"
+effect = "neutralizes"
+description = "Shell argument/command escaping"
+
+[[sanitizer]]
+id = "php.sanitize.htmlspecialchars"
+category = "template_injection"
+callee = "php:{htmlspecialchars,htmlentities,strip_tags}"
+effect = "reduces"
+description = "HTML escaping"
+
+[[sanitizer]]
+id = "php.sanitize.sql-escape"
+category = "sql"
+callee = "php:{mysqli_real_escape_string,pg_escape_string,pg_escape_literal}"
+effect = "reduces"
+description = "SQL string escaping"
+
+[[sanitizer]]
+id = "php.sanitize.sql-quote"
+category = "sql"
+callee = "php:*.{quote,real_escape_string}"
+effect = "reduces"
+description = "PDO::quote / mysqli::real_escape_string"
+
+[[sanitizer]]
+id = "php.sanitize.intval"
+category = "sql"
+callee = "php:{intval,floatval}"
+effect = "neutralizes"
+description = "Numeric cast — a parsed number cannot carry SQL injection"
+
+[[sanitizer]]
+id = "php.sanitize.basename"
+category = "path_traversal"
+callee = "php:{basename,realpath}"
+effect = "reduces"
+description = "Basename / realpath resolution"

{entrygraph-0.1.26 → entrygraph-0.1.27}/src/entrygraph/data/sinks/ruby.toml

@@ -100,3 +100,33 @@ category = "env_input"
 callee = "rb:*.{fetch}"
 require_arg_hint = "ENV"
 description = "Environment variable input"
+
+# ---------------- sanitizers ----------------
+
+[[sanitizer]]
+id = "rb.sanitize.shellwords"
+category = "command_exec"
+callee = "rb:*.{shellescape}"
+effect = "neutralizes"
+description = "Shell argument quoting (Shellwords.escape / String#shellescape)"
+
+[[sanitizer]]
+id = "rb.sanitize.html-escape"
+category = "template_injection"
+callee = "rb:{CGI.escapeHTML,ERB.Util.html_escape,ERB.Util.h,Rack.Utils.escape_html}"
+effect = "reduces"
+description = "HTML escaping"
+
+[[sanitizer]]
+id = "rb.sanitize.sql"
+category = "sql"
+callee = "rb:*.{sanitize_sql,sanitize_sql_array,sanitize_sql_for_conditions,quote}"
+effect = "reduces"
+description = "ActiveRecord SQL sanitization"
+
+[[sanitizer]]
+id = "rb.sanitize.basename"
+category = "path_traversal"
+callee = "rb:{File.basename}"
+effect = "reduces"
+description = "Basename extraction"

{entrygraph-0.1.26 → entrygraph-0.1.27}/src/entrygraph/data/sinks/rust.toml

@@ -66,3 +66,19 @@ id = "rust.stdin"
 category = "stdin_input"
 callee = "rs:{std.io.stdin,io.stdin}"
 description = "Standard input"
+
+# ---------------- sanitizers ----------------
+
+[[sanitizer]]
+id = "rs.sanitize.shell-escape"
+category = "command_exec"
+callee = "rs:{shell_escape.escape,shell_escape.unix.escape,shlex.quote,shlex.try_quote}"
+effect = "neutralizes"
+description = "Shell argument quoting (shell-escape / shlex crates)"
+
+[[sanitizer]]
+id = "rs.sanitize.path-filename"
+category = "path_traversal"
+callee = "rs:*.{file_name,canonicalize}"
+effect = "reduces"
+description = "Path::file_name / canonicalize"

entrygraph-0.1.27/tests/test_sanitizer_languages.py

@@ -0,0 +1,56 @@
+"""End-to-end sanitizer detection across the newly-covered languages (Phase 5).
+
+Regression: Go, Java, Ruby, C#, PHP, and Rust shipped zero sanitizers. A sibling
+sanitizer call for the sink's category now discounts the path's risk (matched via
+out-edges, per the query-time sanitizer machinery).
+"""
+
+from __future__ import annotations
+
+import pytest
+
+from entrygraph import CodeGraph
+
+# (language, filename, source code, path source qname, sink category, expected sanitizer id)
+CASES = [
+    (
+        "go",
+        "main.go",
+        'package main\nimport ("os"; "path/filepath")\n'
+        "func h(p string) { filepath.Clean(p); os.ReadFile(p) }\n",
+        "_root.h",
+        "path_traversal",
+        "go.sanitize.filepath-clean",
+    ),
+    (
+        "php",
+        "i.php",
+        "<?php\nfunction h($c) { escapeshellarg($c); system($c); }\n",
+        "i.h",
+        "command_exec",
+        "php.sanitize.escapeshell",
+    ),
+    (
+        "ruby",
+        "a.rb",
+        "def h(c)\n  c.shellescape\n  system(c)\nend\n",
+        "a.h",
+        "command_exec",
+        "rb.sanitize.shellwords",
+    ),
+]
+
+
+@pytest.mark.parametrize("lang,fname,code,source,category,sanitizer", CASES)
+def test_sibling_sanitizer_discounts_risk(tmp_path, lang, fname, code, source, category, sanitizer):
+    (tmp_path / fname).write_text(code)
+    g = CodeGraph.index(tmp_path, db=tmp_path / "g.db")
+    try:
+        paths = g.paths(source=source, sink_category=category, include_unresolved=True)
+        assert paths, f"{lang}: expected a {category} path from {source}"
+        path = paths[0]
+        assert sanitizer in {sid for e in path.edges for sid in e.sanitized_by}
+        # a detected sanitizer discounts risk without zeroing it
+        assert 0.0 < path.risk_score < 0.5
+    finally:
+        g.close()

{entrygraph-0.1.26 → entrygraph-0.1.27}/tests/test_taint.py

@@ -79,6 +79,31 @@ def test_sanitizer_matching_and_category_lookup():
     assert reg.sanitizers_for_category("command_exec")[0].id == "san"
 
 
+def test_builtin_sanitizers_cover_all_languages():
+    # every supported language now ships sanitizers, matched against the exact
+    # canonical callee form its resolver produces.
+    reg = builtin_registry()
+    cases = [
+        ("go:path/filepath.Clean", "go.sanitize.filepath-clean"),
+        ("go:strconv.Atoi", "go.sanitize.strconv-sql"),
+        ("java:*.forHtml", "java.sanitize.html-encode"),
+        ("java:*.getFileName", "java.sanitize.path-normalize"),
+        ("rb:*.shellescape", "rb.sanitize.shellwords"),
+        ("rb:File.basename", "rb.sanitize.basename"),
+        ("cs:System.IO.Path.GetFileName", "cs.sanitize.path-getfilename"),
+        ("cs:*.AddWithValue", "cs.sanitize.sql-parameter"),
+        ("php:escapeshellarg", "php.sanitize.escapeshell"),
+        ("php:htmlspecialchars", "php.sanitize.htmlspecialchars"),
+        ("rs:shell_escape.escape", "rs.sanitize.shell-escape"),
+        ("rs:*.file_name", "rs.sanitize.path-filename"),
+    ]
+    for callee, sid in cases:
+        assert sid in {s.id for s in reg.match_sanitizers(callee)}, callee
+    # all eight languages represented
+    langs = {sid.split(".")[0] for sid in reg.sanitizers}
+    assert langs == {"py", "js", "go", "java", "rb", "cs", "php", "rs"}
+
+
 def test_match_source_and_source_category():
     reg = SinkRegistry(
         sinks=[],