entrygraph 0.1.30__tar.gz → 0.1.31__tar.gz

{entrygraph-0.1.30 → entrygraph-0.1.31}/PKG-INFO

@@ -1,6 +1,6 @@
 Metadata-Version: 2.4
 Name: entrygraph
-Version: 0.1.30
+Version: 0.1.31
 Summary: Language-agnostic code graph: query symbols, entrypoints, and source-to-sink call paths from a SQLite index
 Project-URL: Repository, https://github.com/brettbergin/entrygraph
 Author-email: Brett Bergin <brettberginbc@yahoo.com>

{entrygraph-0.1.30 → entrygraph-0.1.31}/src/entrygraph/_version.py

@@ -18,7 +18,7 @@ version_tuple: tuple[int | str, ...]
 commit_id: str | None
 __commit_id__: str | None
 
-__version__ = version = '0.1.30'
-__version_tuple__ = version_tuple = (0, 1, 30)
+__version__ = version = '0.1.31'
+__version_tuple__ = version_tuple = (0, 1, 31)
 
 __commit_id__ = commit_id = None

{entrygraph-0.1.30 → entrygraph-0.1.31}/src/entrygraph/api.py

@@ -26,7 +26,7 @@ from entrygraph.errors import (
 )
 from entrygraph.graph.adjacency import AdjacencyCache
 from entrygraph.graph.scoring import is_constant_args, score_path
-from entrygraph.kinds import Confidence
+from entrygraph.kinds import Confidence, EntrypointKind
 from entrygraph.results import (
     CallPath,
     DetectedFramework,
@@ -507,6 +507,19 @@ class CodeGraph:
                     )
                 ).scalars()
                 ids |= set(rows)
+            if source_category == "http_input":
+                # Every HTTP route handler receives attacker-controlled request
+                # data, so the handler itself is an http_input source. This covers
+                # frameworks whose request access is a property read (Express
+                # `req.body`, Symfony `$request->get`) rather than a catalog-matched
+                # call, which otherwise yield zero source edges (F-H9) — Express/
+                # Symfony apps could never produce a taint path.
+                ep_rows = session.execute(
+                    select(models.Entrypoint.symbol_id).where(
+                        models.Entrypoint.kind == EntrypointKind.HTTP_ROUTE
+                    )
+                ).scalars()
+                ids |= set(ep_rows)
         return ids
 
     def _sink_ids(self, session: Session, sink, sink_category: str | None) -> set[int]:

{entrygraph-0.1.30 → entrygraph-0.1.31}/tests/test_reachability.py

@@ -146,3 +146,27 @@ def test_dfs_reports_truncation_when_budget_is_spent(monkeypatch):
     result = cache.paths({1}, {3}, max_paths=10)
     assert result == []  # budget spent before reaching the sink
     assert result.truncated is True
+
+
+def test_http_route_handler_is_an_http_input_source(tmp_path):
+    # Express reads request data as a property (`req.body`), not a catalog-matched
+    # call, so it produces no source edge — the handler itself must count as an
+    # http_input source or the app can never yield a taint path (#34 / F-H9).
+    src = tmp_path / "src"
+    src.mkdir(parents=True)
+    (tmp_path / "package.json").write_text('{"name":"app","dependencies":{"express":"^4"}}')
+    (src / "app.js").write_text(
+        'const express = require("express");\n'
+        'const { exec } = require("child_process");\n'
+        "const app = express();\n"
+        "function runReport(req, res) {\n"
+        "  const name = req.body.name;\n"  # property-read source (not a call)
+        '  exec("report " + name);\n'  # command_exec sink
+        "}\n"
+        'app.post("/reports", runReport);\n'
+    )
+    graph = CodeGraph.index(tmp_path, db=tmp_path / "g.db")
+    paths = graph.paths(source_category="http_input", sink_category="command_exec")
+    graph.close()
+    chains = [[s.qname for s in p.symbols] for p in paths]
+    assert ["app.runReport", "js:child_process.exec"] in chains