entrygraph 0.1.8__tar.gz → 0.1.10__tar.gz

{entrygraph-0.1.8 → entrygraph-0.1.10}/PKG-INFO

@@ -1,6 +1,6 @@
 Metadata-Version: 2.4
 Name: entrygraph
-Version: 0.1.8
+Version: 0.1.10
 Summary: Language-agnostic code graph: query symbols, entrypoints, and source-to-sink call paths from a SQLite index
 Project-URL: Repository, https://github.com/brettbergin/entrygraph
 Author-email: Brett Bergin <brettberginbc@yahoo.com>

{entrygraph-0.1.8 → entrygraph-0.1.10}/src/entrygraph/_version.py

@@ -18,7 +18,7 @@ version_tuple: tuple[int | str, ...]
 commit_id: str | None
 __commit_id__: str | None
 
-__version__ = version = '0.1.8'
-__version_tuple__ = version_tuple = (0, 1, 8)
+__version__ = version = '0.1.10'
+__version_tuple__ = version_tuple = (0, 1, 10)
 
 __commit_id__ = commit_id = None

{entrygraph-0.1.8 → entrygraph-0.1.10}/src/entrygraph/pipeline/scanner.py

@@ -432,7 +432,9 @@ def _write_edges_and_entrypoints(
     entrypoint_rows: list[dict] = []
 
     for path, x, is_package in extractions:
-        resolver = FileResolver(x, module_ids[path], table, externals, is_package)
+        resolver = FileResolver(
+            x, module_ids[path], table, externals, is_package, sink_registry=sink_registry
+        )
         file_id = file_id_by_path[path]
         for edge in resolver.resolve():
             is_call = edge.kind is EdgeKind.CALLS
@@ -521,17 +523,22 @@ def _heal_dangling_edges(session, table: SymbolTable, new_qnames: set[str]) -> N
     """Re-bind edges left NULL (degraded on wipe, or targeting a not-yet-existing
     symbol) whose dst_qname now names a freshly-created symbol."""
     dangling = session.execute(
-        select(Edge.id, Edge.dst_qname).where(
+        select(Edge.id, Edge.dst_qname, Edge.confidence).where(
             Edge.dst_symbol_id.is_(None), Edge.dst_qname.in_(new_qnames)
         )
     ).all()
     updates = []
-    for edge_id, dst_qname in dangling:
+    unresolved = int(Confidence.UNRESOLVED)
+    for edge_id, dst_qname, confidence in dangling:
         target = table.by_fqn.get(dst_qname)
         if target is not None:
-            updates.append(
-                {"id": edge_id, "dst_symbol_id": target, "confidence": int(Confidence.IMPORT)}
-            )
+            # Preserve the edge's original tier. Only an edge that was UNRESOLVED
+            # (a project import whose target didn't exist yet) upgrades to IMPORT
+            # on heal, matching what a full re-index produces. An EXACT/IMPORT/
+            # FUZZY/cha edge whose target was merely wiped and recreated keeps its
+            # tier — healing must not silently promote a fuzzy or CHA edge.
+            healed = int(Confidence.IMPORT) if confidence == unresolved else confidence
+            updates.append({"id": edge_id, "dst_symbol_id": target, "confidence": healed})
     if updates:
         session.execute(update(Edge), updates)
 

{entrygraph-0.1.8 → entrygraph-0.1.10}/src/entrygraph/resolve/resolver.py

@@ -17,6 +17,7 @@ incremental re-resolution can heal them when the target appears.
 from __future__ import annotations
 
 from dataclasses import dataclass
+from typing import TYPE_CHECKING
 
 from entrygraph.extract.ir import FileExtraction, RawReference
 from entrygraph.kinds import Confidence, EdgeKind, SymbolKind
@@ -29,6 +30,9 @@ from entrygraph.resolve.hierarchy import (
 )
 from entrygraph.resolve.symbol_table import SymbolTable
 
+if TYPE_CHECKING:
+    from entrygraph.detect.taint import SinkRegistry
+
 # expand_relative re-exported for backward compatibility with callers/tests.
 __all__ = ["FileResolver", "ResolvedEdge", "expand_relative"]
 
@@ -66,12 +70,14 @@ class FileResolver:
         table: SymbolTable,
         externals: ExternalRegistry,
         is_package: bool = False,
+        sink_registry: SinkRegistry | None = None,
     ) -> None:
         self.x = extraction
         self.module_symbol_id = module_symbol_id
         self.table = table
         self.externals = externals
         self.is_package = is_package
+        self.sink_registry = sink_registry
         self.prefix = LANG_PREFIX.get(extraction.language, extraction.language)
         self.import_map, self.wildcard_modules = build_import_map(extraction, is_package)
 
@@ -217,6 +223,14 @@ class FileResolver:
                 return self.table.by_fqn[target]
         return self.table.unique_by_name(name, (SymbolKind.FUNCTION, SymbolKind.METHOD))
 
+    def _guess_is_sink(self, ref: RawReference) -> bool:
+        """Whether the receiver-agnostic guess for this attribute call matches a
+        registered sink — checked with the same call the index-time stamper uses."""
+        if self.sink_registry is None:
+            return False
+        guess = f"{self.prefix}:*.{ref.callee_name}"
+        return self.sink_registry.match(guess, ref.arg_preview) is not None
+
     def _bind(self, ref: RawReference) -> tuple[int | None, str, Confidence, str | None]:
         # 1. import-map expansion (chase re-export chains for project targets)
         first_seg = ref.callee_text.split(".", 1)[0].split("(", 1)[0]
@@ -270,14 +284,21 @@ class FileResolver:
         # where runner is a local variable) this is the only way to recover the
         # call-graph edge without local type inference — it's the documented
         # FUZZY tradeoff.
-        kinds = (
-            (SymbolKind.METHOD,)
-            if ref.receiver_text is not None
-            else (SymbolKind.FUNCTION, SymbolKind.CLASS)
-        )
-        dst_id = self.table.unique_by_name(ref.callee_name, kinds)
-        if dst_id is not None:
-            return dst_id, self.table.qname_of[dst_id], Confidence.FUZZY, None
+        #
+        # But if the receiver-agnostic guess (`py:*.execute`) is itself a
+        # registered sink, do NOT fuzzy-bind: rewriting dst_qname to a unique
+        # project method named `execute` would erase the sink stamp and hide the
+        # vulnerability. Prefer the guess so the sink survives (step 5); CHA still
+        # adds the project method as a via="cha" candidate, so no edge is lost.
+        if not (ref.receiver_text is not None and self._guess_is_sink(ref)):
+            kinds = (
+                (SymbolKind.METHOD,)
+                if ref.receiver_text is not None
+                else (SymbolKind.FUNCTION, SymbolKind.CLASS)
+            )
+            dst_id = self.table.unique_by_name(ref.callee_name, kinds)
+            if dst_id is not None:
+                return dst_id, self.table.qname_of[dst_id], Confidence.FUZZY, None
 
         # 5. unresolved: language-prefixed guess, still a real node for sinks
         if ref.receiver_text is not None:

entrygraph-0.1.10/tests/fixtures/python/fuzzy_sink/app.py

@@ -0,0 +1,14 @@
+import sqlite3
+
+
+class Runner:
+    # the ONLY project method named "execute" — the collision that used to
+    # swallow cursor.execute via unique-name fuzzy binding
+    def execute(self):
+        return 1
+
+
+def query(db_path, user_id):
+    conn = sqlite3.connect(db_path)
+    cur = conn.cursor()
+    cur.execute("SELECT * FROM users WHERE id = " + user_id)

entrygraph-0.1.10/tests/fixtures/python/heal_fidelity/caller.py

@@ -0,0 +1,4 @@
+def go(w):
+    # receiver `w` is an unknown local -> fuzzy-binds to Worker.process
+    # (unique name), producing a CROSS-FILE FUZZY edge into worker.py
+    return w.process()

entrygraph-0.1.10/tests/fixtures/python/heal_fidelity/worker.py

@@ -0,0 +1,3 @@
+class Worker:
+    def process(self):  # unique method name across the repo
+        return 1

entrygraph-0.1.10/tests/test_fuzzy_sink.py

@@ -0,0 +1,36 @@
+"""Sink preservation vs unique-name fuzzy binding (Phase 1.4).
+
+Regression: an unknown-receiver call like `cursor.execute(sql)` fuzzy-bound to a
+unique project method named `execute`, rewriting dst_qname so the `py:*.execute`
+SQL sink never got stamped — the vulnerability silently vanished from the graph.
+"""
+
+from __future__ import annotations
+
+from pathlib import Path
+
+import pytest
+
+from entrygraph import CodeGraph
+
+FUZZY_SINK_APP = Path(__file__).parent / "fixtures" / "python" / "fuzzy_sink"
+
+
+@pytest.fixture(scope="module")
+def graph(tmp_path_factory) -> CodeGraph:
+    db = tmp_path_factory.mktemp("db") / "graph.db"
+    g = CodeGraph.index(FUZZY_SINK_APP, db=db)
+    yield g
+    g.close()
+
+
+def test_sql_sink_survives_unique_name_collision(graph):
+    sinks = graph.sql("SELECT dst_qname, sink_id FROM edges WHERE sink_id IS NOT NULL")
+    by_qname = {r["dst_qname"]: r["sink_id"] for r in sinks}
+    assert by_qname.get("py:*.execute") == "py.sql-execute"
+
+
+def test_sql_path_reachable_despite_collision(graph):
+    paths = graph.paths(source="app.query", sink_category="sql", include_unresolved=True)
+    assert paths
+    assert paths[0].symbols[-1].qname == "py:*.execute"

entrygraph-0.1.10/tests/test_heal_fidelity.py

@@ -0,0 +1,66 @@
+"""Incremental healing must not alter an edge's confidence tier (Phase 2.4).
+
+Regression: `_heal_dangling_edges` re-bound every healed edge at Confidence.IMPORT
+unconditionally. A cross-file FUZZY (or via="cha") edge whose target file was
+merely touched came back as IMPORT, so a min_confidence>=IMPORT query returned
+edges a full re-index would score FUZZY.
+"""
+
+from __future__ import annotations
+
+import os
+import shutil
+from pathlib import Path
+
+import pytest
+from sqlalchemy import select
+from sqlalchemy.orm import Session
+
+from entrygraph.db.engine import make_engine
+from entrygraph.db.models import Edge, Symbol
+from entrygraph.pipeline.scanner import index_repository
+
+HEAL_APP = Path(__file__).parent / "fixtures" / "python" / "heal_fidelity"
+
+
+@pytest.fixture
+def repo(tmp_path) -> Path:
+    dst = tmp_path / "repo"
+    shutil.copytree(HEAL_APP, dst)
+    return dst
+
+
+def _edge_confidence(engine, src_qname, dst_qname) -> int | None:
+    with Session(engine) as s:
+        ids = {sym.qname: sym.id for sym in s.execute(select(Symbol)).scalars()}
+        src = ids.get(src_qname)
+        row = s.execute(
+            select(Edge.confidence).where(Edge.src_symbol_id == src, Edge.dst_qname == dst_qname)
+        ).first()
+    return row[0] if row else None
+
+
+def test_healed_fuzzy_edge_keeps_its_confidence(repo, tmp_path):
+    from entrygraph.kinds import Confidence
+
+    engine = make_engine(tmp_path / "inc.db")
+    index_repository(repo, engine)
+    before = _edge_confidence(engine, "caller.go", "worker.Worker.process")
+    assert before == int(Confidence.FUZZY)  # cross-file unique-name fuzzy edge
+
+    # touch worker.py: Worker.process gets a new id, the inbound edge is SET NULL
+    # then healed. Its tier must stay FUZZY, not be upgraded to IMPORT.
+    worker = repo / "worker.py"
+    worker.write_text(worker.read_text() + "\n# touch\n")
+    os.utime(worker, ns=(0, 10**18))
+    index_repository(repo, engine, incremental=True)
+
+    after = _edge_confidence(engine, "caller.go", "worker.Worker.process")
+    assert after == int(Confidence.FUZZY)
+
+    # and it matches a full re-index
+    full = make_engine(tmp_path / "full.db")
+    index_repository(repo, full)
+    assert after == _edge_confidence(full, "caller.go", "worker.Worker.process")
+    full.dispose()
+    engine.dispose()

{entrygraph-0.1.8 → entrygraph-0.1.10}/tests/test_resolver.py

@@ -20,7 +20,7 @@ def make_table() -> SymbolTable:
     return table
 
 
-def make_resolver(table, refs=(), imports=(), module="app.routes", module_id=2):
+def make_resolver(table, refs=(), imports=(), module="app.routes", module_id=2, sink_registry=None):
     x = FileExtraction(
         path="app/routes.py",
         language="python",
@@ -31,7 +31,7 @@ def make_resolver(table, refs=(), imports=(), module="app.routes", module_id=2):
         references=list(refs),
     )
     externals = ExternalRegistry(iter(range(100, 200)).__next__)
-    return FileResolver(x, module_id, table, externals), externals
+    return FileResolver(x, module_id, table, externals, sink_registry=sink_registry), externals
 
 
 def ref(callee_text, callee_name=None, receiver=None, caller=None, kind="call"):
@@ -180,6 +180,36 @@ def test_unresolved_gets_prefixed_placeholder():
     assert by_qname["py:eval"].confidence is Confidence.UNRESOLVED
 
 
+def test_sink_named_attribute_call_is_not_fuzzy_bound():
+    # `cursor.execute(...)` guesses to the sink `py:*.execute`. Even though a
+    # unique project method `Runner.execute` (id 12) exists, we must NOT fuzzy-bind
+    # to it — that would rewrite dst_qname and erase the SQL sink. Keep the guess.
+    from entrygraph.detect.taint import builtin_registry
+
+    table = make_table()
+    resolver, _ = make_resolver(
+        table, [ref("cursor.execute", receiver="cursor")], sink_registry=builtin_registry()
+    )
+    call = next(e for e in resolver.resolve() if e.kind is EdgeKind.CALLS and e.via != "cha")
+    assert call.dst_qname == "py:*.execute"
+    assert call.confidence is Confidence.UNRESOLVED
+    assert call.dst_symbol_id != 12
+
+
+def test_non_sink_attribute_call_still_fuzzy_binds_with_registry():
+    # `obj.render` is not a sink, so unique-name fuzzy binding still applies even
+    # with a sink registry present — the fix is targeted to sink names only.
+    from entrygraph.detect.taint import builtin_registry
+
+    table = make_table()
+    resolver, _ = make_resolver(
+        table, [ref("obj.render", receiver="obj")], sink_registry=builtin_registry()
+    )
+    call = next(e for e in resolver.resolve() if e.kind is EdgeKind.CALLS)
+    assert call.dst_symbol_id == 13  # Runner.render
+    assert call.confidence is Confidence.FUZZY
+
+
 def test_relative_import_expansion():
     table = make_table()
     table.add_symbol(40, "app.utils", 40 and "utils", SymbolKind.MODULE)