entrygraph 0.1.32__tar.gz → 0.1.34__tar.gz

{entrygraph-0.1.32 → entrygraph-0.1.34}/PKG-INFO

@@ -1,6 +1,6 @@
 Metadata-Version: 2.4
 Name: entrygraph
-Version: 0.1.32
+Version: 0.1.34
 Summary: Language-agnostic code graph: query symbols, entrypoints, and source-to-sink call paths from a SQLite index
 Project-URL: Repository, https://github.com/brettbergin/entrygraph
 Author-email: Brett Bergin <brettberginbc@yahoo.com>

{entrygraph-0.1.32 → entrygraph-0.1.34}/src/entrygraph/_version.py

@@ -18,7 +18,7 @@ version_tuple: tuple[int | str, ...]
 commit_id: str | None
 __commit_id__: str | None
 
-__version__ = version = '0.1.32'
-__version_tuple__ = version_tuple = (0, 1, 32)
+__version__ = version = '0.1.34'
+__version_tuple__ = version_tuple = (0, 1, 34)
 
 __commit_id__ = commit_id = None

{entrygraph-0.1.32 → entrygraph-0.1.34}/src/entrygraph/api.py

@@ -331,11 +331,28 @@ class CodeGraph:
                 return PathResults()
             traverser = self._traverser(session, engine, kinds, floor, include_cha)
             raw_paths = traverser.paths(sources, sinks, max_depth=max_depth, max_paths=max_paths)
+            truncated = bool(getattr(raw_paths, "truncated", False))
+            if sink_category is not None:
+                # A category sink is tagged per-EDGE (with arg hints), but traversal
+                # stops at the sink SYMBOL. A path reaching that symbol via an
+                # untagged sibling edge — createHash('sha256') vs the md5 edge that
+                # tagged the shared createHash symbol — is a false positive. Keep a
+                # path only if its terminal edge is a category sink (or its terminal
+                # node is an explicit --sink symbol). This also drops degenerate
+                # length-1 `--source '*'` self-matches, which have no terminal edge.
+                explicit_ids = self._spec_to_ids(session, sink) if sink is not None else set()
+                sink_edges = self._category_sink_edge_ids(session, sink_category)
+                raw_paths = [
+                    p
+                    for p in raw_paths
+                    if p[-1][0] in explicit_ids
+                    or (p[-1][1] is not None and p[-1][1].edge_id in sink_edges)
+                ]
             if not raw_paths:
                 # 0 paths may mean the visit budget was spent before any sink was
                 # reached — propagate the flag so this isn't mistaken for "safe".
                 empty = PathResults()
-                empty.truncated = bool(getattr(raw_paths, "truncated", False))
+                empty.truncated = truncated
                 return empty
             all_ids = {node for path in raw_paths for node, _ in path}
             symbol_map = q.symbols_by_ids(session, all_ids)
@@ -366,7 +383,7 @@ class CodeGraph:
         # Truncating after the risk rank (not during DFS) is what makes the widen
         # flags monotonic — a wider edge set can only add candidates to rank.
         out = PathResults(results[:max_paths])
-        out.truncated = bool(getattr(raw_paths, "truncated", False))
+        out.truncated = truncated
         return out
 
     def reachable(
@@ -522,6 +539,18 @@ class CodeGraph:
                 ids |= set(ep_rows)
         return ids
 
+    def _category_sink_edge_ids(self, session: Session, sink_category: str) -> set[int]:
+        """Edge ids tagged as a sink of `sink_category` — used to require that a
+        path terminates at a sink EDGE, not merely a shared sink symbol."""
+        registry = self._registry(session)
+        sink_ids = registry.ids_for_category(sink_category)
+        if not sink_ids:
+            return set()
+        rows = session.execute(
+            select(models.Edge.id).where(models.Edge.sink_id.in_(sink_ids))
+        ).scalars()
+        return set(rows)
+
     def _sink_ids(self, session: Session, sink, sink_category: str | None) -> set[int]:
         ids = self._spec_to_ids(session, sink) if sink is not None else set()
         if sink_category is not None:

{entrygraph-0.1.32 → entrygraph-0.1.34}/src/entrygraph/detect/entrypoints/javascript.py

@@ -75,6 +75,10 @@ def _router_routes(framework: str):
                         route=route,
                         http_methods=[ref.callee_name.upper()],
                         framework=framework,
+                        # registration line, so the scanner can bind a
+                        # handler-passed-by-reference (router.get('/x', ctrl.fn))
+                        # to the callback edge emitted at the same site.
+                        span=ref.span,
                     )
                 )
         return hints

{entrygraph-0.1.32 → entrygraph-0.1.34}/src/entrygraph/pipeline/scanner.py

@@ -554,10 +554,17 @@ def _write_edges_and_entrypoints(
             local_symbol_ids=handler_ids_by_path.get(path, {}),
         )
         file_id = file_id_by_path[path]
+        # registration line -> handler symbol, for routes whose handler is passed by
+        # reference (router.get('/x', ctrl.fn)): the resolver emits a callback edge
+        # at the same line, and the entrypoint below binds to it instead of falling
+        # back to the module symbol.
+        callback_handler_by_line: dict[int, int] = {}
         for edge in resolver.resolve():
             is_call = edge.kind is EdgeKind.CALLS
             sink_id = sink_registry.match(edge.dst_qname, edge.arg_preview) if is_call else None
             source_id = sink_registry.match_source(edge.dst_qname) if is_call else None
+            if edge.kind is EdgeKind.PASSED_AS_CALLBACK and edge.dst_symbol_id is not None:
+                callback_handler_by_line.setdefault(edge.line, edge.dst_symbol_id)
             edge_writer.add(
                 {
                     "id": alloc.take(Edge),
@@ -579,10 +586,15 @@ def _write_edges_and_entrypoints(
             handler_q = hint.handler_qualified_name or ""
             # Bind to the handler defined in this file first (so same-package
             # collisions like per-file `func init()` each keep their own row),
-            # then the global map, then the file's module symbol as a last resort.
-            symbol_id = (
-                per_file.get(handler_q) or symbol_id_by_qname.get(handler_q) or module_ids[path]
-            )
+            # then the global map.
+            symbol_id = per_file.get(handler_q) or symbol_id_by_qname.get(handler_q)
+            # Route handler passed by reference (router.get('/x', ctrl.fn)) — the
+            # name isn't a symbol in scope, but the resolver bound the callback at
+            # the registration line. Bind the route to that real handler instead of
+            # the module, so it (not the whole module) is the http_input source.
+            if symbol_id is None and hint.span is not None:
+                symbol_id = callback_handler_by_line.get(hint.span.start_line)
+            symbol_id = symbol_id or module_ids[path]
             entrypoint_writer.add(
                 {
                     "id": alloc.take(Entrypoint),

{entrygraph-0.1.32 → entrygraph-0.1.34}/tests/test_reachability.py

@@ -170,3 +170,52 @@ def test_http_route_handler_is_an_http_input_source(tmp_path):
     graph.close()
     chains = [[s.qname for s in p.symbols] for p in paths]
     assert ["app.runReport", "js:child_process.exec"] in chains
+
+
+def test_category_path_requires_a_sink_tagged_terminal_edge(tmp_path):
+    # createHash('md5') is weak_crypto; createHash('sha256') is not. Both call the
+    # same crypto.createHash symbol, so a path must end at the *tagged* edge — the
+    # sha256 call must not be reported as weak_crypto (#34 / F-H15).
+    (tmp_path / "a.js").write_text(
+        'const crypto = require("crypto");\n'
+        'function weak(x) { return crypto.createHash("md5").update(x).digest("hex"); }\n'
+        'function strong(x) { return crypto.createHash("sha256").update(x).digest("hex"); }\n'
+    )
+    graph = CodeGraph.index(tmp_path, db=tmp_path / "g.db")
+    paths = graph.paths(source="*", sink_category="weak_crypto")
+    graph.close()
+    chains = [[s.qname for s in p.symbols] for p in paths]
+    assert ["a.weak", "js:crypto.createHash"] in chains  # md5 kept
+    assert all("a.strong" not in c for c in chains)  # sha256 dropped
+    assert all(len(c) >= 2 for c in chains)  # no degenerate single-node paths
+
+
+def test_route_handler_passed_by_reference_binds_to_the_handler(tmp_path):
+    # router.get('/x', ctrl.fn) binds to the module, but the resolver emits a
+    # callback edge at the registration line — the route must bind to that real
+    # handler so ctrl.fn (not the whole module) is the http_input source, and the
+    # taint path resolves WITHOUT --include-callbacks (#34, call-based binding).
+    src = tmp_path / "src"
+    src.mkdir(parents=True)
+    (tmp_path / "package.json").write_text('{"name":"app","dependencies":{"express":"^4"}}')
+    (src / "controller.js").write_text(
+        'const { exec } = require("child_process");\n'
+        "function getUser(req, res) { exec('lookup ' + req.body.id); }\n"
+        "module.exports = { getUser };\n"
+    )
+    (src / "routes.js").write_text(
+        'const { Router } = require("express");\n'
+        'const ctrl = require("./controller");\n'
+        "const router = Router();\n"
+        'router.get("/user", ctrl.getUser);\n'
+        "module.exports = router;\n"
+    )
+    graph = CodeGraph.index(tmp_path, db=tmp_path / "g.db")
+    # the route binds to the handler function, not the routes module
+    eps = graph.entrypoints(kind="http_route")
+    assert eps and eps[0].symbol.qname == "controller.getUser"
+    # and the taint path resolves by default (no include_callbacks)
+    paths = graph.paths(source_category="http_input", sink_category="command_exec")
+    graph.close()
+    chains = [[s.qname for s in p.symbols] for p in paths]
+    assert ["controller.getUser", "js:child_process.exec"] in chains