entrygraph 0.1.30__tar.gz → 0.1.32__tar.gz

{entrygraph-0.1.30 → entrygraph-0.1.32}/PKG-INFO

@@ -1,6 +1,6 @@
 Metadata-Version: 2.4
 Name: entrygraph
-Version: 0.1.30
+Version: 0.1.32
 Summary: Language-agnostic code graph: query symbols, entrypoints, and source-to-sink call paths from a SQLite index
 Project-URL: Repository, https://github.com/brettbergin/entrygraph
 Author-email: Brett Bergin <brettberginbc@yahoo.com>

{entrygraph-0.1.30 → entrygraph-0.1.32}/src/entrygraph/_version.py

@@ -18,7 +18,7 @@ version_tuple: tuple[int | str, ...]
 commit_id: str | None
 __commit_id__: str | None
 
-__version__ = version = '0.1.30'
-__version_tuple__ = version_tuple = (0, 1, 30)
+__version__ = version = '0.1.32'
+__version_tuple__ = version_tuple = (0, 1, 32)
 
 __commit_id__ = commit_id = None

{entrygraph-0.1.30 → entrygraph-0.1.32}/src/entrygraph/api.py

@@ -26,7 +26,7 @@ from entrygraph.errors import (
 )
 from entrygraph.graph.adjacency import AdjacencyCache
 from entrygraph.graph.scoring import is_constant_args, score_path
-from entrygraph.kinds import Confidence
+from entrygraph.kinds import Confidence, EntrypointKind
 from entrygraph.results import (
     CallPath,
     DetectedFramework,
@@ -507,6 +507,19 @@ class CodeGraph:
                     )
                 ).scalars()
                 ids |= set(rows)
+            if source_category == "http_input":
+                # Every HTTP route handler receives attacker-controlled request
+                # data, so the handler itself is an http_input source. This covers
+                # frameworks whose request access is a property read (Express
+                # `req.body`, Symfony `$request->get`) rather than a catalog-matched
+                # call, which otherwise yield zero source edges (F-H9) — Express/
+                # Symfony apps could never produce a taint path.
+                ep_rows = session.execute(
+                    select(models.Entrypoint.symbol_id).where(
+                        models.Entrypoint.kind == EntrypointKind.HTTP_ROUTE
+                    )
+                ).scalars()
+                ids |= set(ep_rows)
         return ids
 
     def _sink_ids(self, session: Session, sink, sink_category: str | None) -> set[int]:

{entrygraph-0.1.30 → entrygraph-0.1.32}/src/entrygraph/data/sinks/go.toml

@@ -23,7 +23,12 @@ id = "go.sql-query"
 category = "sql"
 severity = "medium"
 callee = "go:*.{Query,QueryRow,Exec,QueryContext,ExecContext,QueryRowContext}"
-description = "SQL statement execution (receiver-agnostic; database/sql)"
+# Receiver-agnostic `.Query`/`.Exec` collide with non-SQL APIs (net/url
+# `URL.Query()`, gin `c.Query("id")`, which take no arg or a constant). Require the
+# argument to show string concatenation or fmt.Sprintf — the SQL-injection signal.
+# A constant or parameterized ($1/?) query is not flagged.
+require_arg_hint = "\\+|Sprintf"
+description = "SQL statement execution (receiver-agnostic, dynamic-arg; database/sql)"
 
 [[sink]]
 id = "go.file-write"

{entrygraph-0.1.30 → entrygraph-0.1.32}/src/entrygraph/data/sinks/javascript.toml

@@ -13,7 +13,12 @@ description = "Child process execution"
 id = "js.command-exec.member"
 category = "command_exec"
 severity = "high"
-callee = "js:*.{exec,execSync,spawn,spawnSync}"
+# `exec` is deliberately excluded from this unknown-receiver wildcard: it collides
+# with RegExp.prototype.exec (a very common false positive), and real child_process
+# exec — destructured `const {exec}` or aliased `cp.exec` — resolves to
+# js:child_process.exec via the import map and is caught by the specific sink above.
+# execSync/spawn/spawnSync have no built-in method collision, so they stay.
+callee = "js:*.{execSync,spawn,spawnSync}"
 description = "Child process execution (member call)"
 
 [[sink]]
@@ -28,7 +33,12 @@ id = "js.sql-query"
 category = "sql"
 severity = "medium"
 callee = "js:*.{query,execute,raw}"
-description = "SQL query execution (receiver-agnostic)"
+# Receiver-agnostic `.query`/`.execute` collide with non-SQL APIs (DOM/tRPC/nock
+# `.query`, `URL.query`). Require the argument to show string concatenation or
+# template interpolation — the actual SQL-injection signal — mirroring the knex/
+# sequelize lib patterns. A constant or parameterized query is not flagged.
+require_arg_hint = "\\+|\\$\\{|`"
+description = "SQL query execution (receiver-agnostic, dynamic-arg)"
 
 [[sink]]
 id = "js.file-write"

{entrygraph-0.1.30 → entrygraph-0.1.32}/tests/test_reachability.py

@@ -146,3 +146,27 @@ def test_dfs_reports_truncation_when_budget_is_spent(monkeypatch):
     result = cache.paths({1}, {3}, max_paths=10)
     assert result == []  # budget spent before reaching the sink
     assert result.truncated is True
+
+
+def test_http_route_handler_is_an_http_input_source(tmp_path):
+    # Express reads request data as a property (`req.body`), not a catalog-matched
+    # call, so it produces no source edge — the handler itself must count as an
+    # http_input source or the app can never yield a taint path (#34 / F-H9).
+    src = tmp_path / "src"
+    src.mkdir(parents=True)
+    (tmp_path / "package.json").write_text('{"name":"app","dependencies":{"express":"^4"}}')
+    (src / "app.js").write_text(
+        'const express = require("express");\n'
+        'const { exec } = require("child_process");\n'
+        "const app = express();\n"
+        "function runReport(req, res) {\n"
+        "  const name = req.body.name;\n"  # property-read source (not a call)
+        '  exec("report " + name);\n'  # command_exec sink
+        "}\n"
+        'app.post("/reports", runReport);\n'
+    )
+    graph = CodeGraph.index(tmp_path, db=tmp_path / "g.db")
+    paths = graph.paths(source_category="http_input", sink_category="command_exec")
+    graph.close()
+    chains = [[s.qname for s in p.symbols] for p in paths]
+    assert ["app.runReport", "js:child_process.exec"] in chains

{entrygraph-0.1.30 → entrygraph-0.1.32}/tests/test_sink_catalog.py

@@ -49,3 +49,27 @@ def test_spot_check_new_sinks(registry):
 def test_categories_are_queryable(registry):
     for category in ("ssrf", "xxe", "weak_crypto", "path_traversal", "jndi"):
         assert registry.ids_for_category(category), f"no sinks for {category}"
+
+
+def test_regexp_exec_is_not_a_command_sink(registry):
+    # `js:*.exec` collided with RegExp.prototype.exec. Real child_process exec
+    # resolves to js:child_process.exec (imported/aliased) and stays tagged; the
+    # bare unknown-receiver `.exec` no longer matches command_exec.
+    assert registry.match("js:child_process.exec", "('ls ' + x)") == "js.command-exec.child_process"
+    assert registry.match("js:*.exec", "(input)") is None
+    # sibling child-process methods with no built-in collision still match
+    assert registry.match("js:*.spawn", "(cmd)") == "js.command-exec.member"
+    assert registry.match("js:*.execSync", "(cmd)") == "js.command-exec.member"
+
+
+def test_receiver_agnostic_sql_requires_dynamic_arg(registry):
+    # `*.Query`/`*.query` collided with url.Query()/gin c.Query()/DOM .query.
+    # Only a concatenated or interpolated argument (the injection signal) tags.
+    assert registry.match("go:*.Exec", '("ALTER DATABASE COLLATE " + c)') == "go.sql-query"
+    assert registry.match("go:*.Query", "()") is None  # url.Query()
+    assert registry.match("go:*.Query", '("offset")') is None  # gin c.Query("offset")
+    assert (
+        registry.match("go:*.Exec", '(ctx, "UPDATE t SET k = ? WHERE id = ?")') is None
+    )  # param'd
+    assert registry.match("js:*.query", "('SELECT * FROM t WHERE id = ' + id)") == "js.sql-query"
+    assert registry.match("js:*.query", "({ where: { id } })") is None  # ORM/tRPC object arg