callgraph

func AnalyzeIntraProceduralTaint ¶

func AnalyzeIntraProceduralTaint(
	functionFQN string,
	statements []*core.Statement,
	defUseChain *core.DefUseChain,
	sources []string,
	sinks []string,
	sanitizers []string,
) *core.TaintSummary

AnalyzeIntraProceduralTaint performs forward taint analysis on a function. Deprecated: Use taint.AnalyzeIntraProceduralTaint instead.

func BuildCallGraph ¶

func BuildCallGraph(codeGraph *graph.CodeGraph, registry *core.ModuleRegistry, projectRoot string) (*core.CallGraph, error)

BuildCallGraph constructs the complete call graph for a Python project. This is Pass 3 of the 3-pass algorithm:

• Pass 1: BuildModuleRegistry - map files to modules
• Pass 2: ExtractImports + ExtractCallSites - parse imports and calls
• Pass 3: BuildCallGraph - resolve calls and build graph

Algorithm:

1. For each Python file in the project: a. Extract imports to build ImportMap b. Extract call sites from AST c. Extract function definitions from main graph
2. For each call site: a. Resolve target name using ImportMap b. Find target function definition in registry c. Add edge from caller to callee d. Store detailed call site information

Parameters:

• codeGraph: the existing code graph with parsed AST nodes
• registry: module registry mapping files to modules
• projectRoot: absolute path to project root

Returns:

• CallGraph: complete call graph with edges and call sites
• error: if any step fails

Example:

Given:
  File: myapp/views.py
    def get_user():
        sanitize(data)  # call to myapp.utils.sanitize

Creates:
  edges: {"myapp.views.get_user": ["myapp.utils.sanitize"]}
  reverseEdges: {"myapp.utils.sanitize": ["myapp.views.get_user"]}
  callSites: {"myapp.views.get_user": [CallSite{Target: "sanitize", ...}]}

func BuildModuleRegistry ¶

func BuildModuleRegistry(rootPath string) (*core.ModuleRegistry, error)

BuildModuleRegistry is a convenience wrapper. Deprecated: Use registry.BuildModuleRegistry instead.

func ExtractCallSites ¶

func ExtractCallSites(filePath string, sourceCode []byte, importMap *core.ImportMap) ([]*core.CallSite, error)

ExtractCallSites extracts all function/method call sites from a Python file. Deprecated: Use resolution.ExtractCallSites instead.

func ExtractClassAttributes ¶

func ExtractClassAttributes(
	filePath string,
	sourceCode []byte,
	modulePath string,
	typeEngine *resolution.TypeInferenceEngine,
	attrRegistry *registry.AttributeRegistry,
) error

ExtractClassAttributes extracts class attributes from Python file. Deprecated: Use extraction.ExtractClassAttributes instead.

func ExtractImports ¶

func ExtractImports(filePath string, sourceCode []byte, registry *core.ModuleRegistry) (*core.ImportMap, error)

ExtractImports extracts all import statements from a Python file and builds an ImportMap. Deprecated: Use resolution.ExtractImports instead.

func ExtractStatements ¶

func ExtractStatements(filePath string, sourceCode []byte, functionNode *sitter.Node) ([]*core.Statement, error)

ExtractStatements extracts all statements from a Python function body. Deprecated: Use extraction.ExtractStatements instead.

func ExtractVariableAssignments ¶

func ExtractVariableAssignments(
	filePath string,
	sourceCode []byte,
	typeEngine *resolution.TypeInferenceEngine,
	registry *core.ModuleRegistry,
	builtinRegistry *registry.BuiltinRegistry,
) error

ExtractVariableAssignments extracts variable assignments from a Python file. Deprecated: Use extraction.ExtractVariableAssignments instead.

func GetFrameworkCategory ¶

func GetFrameworkCategory(fqn string) string

GetFrameworkCategory is a convenience wrapper. Deprecated: Use core.GetFrameworkCategory instead.

func GetFrameworkName ¶

func GetFrameworkName(fqn string) string

GetFrameworkName is a convenience wrapper. Deprecated: Use core.GetFrameworkName instead.

func InitializeCallGraph ¶

func InitializeCallGraph(codeGraph *graph.CodeGraph, projectRoot string) (*CallGraph, *ModuleRegistry, *PatternRegistry, error)

InitializeCallGraph builds the call graph from a code graph. This integrates the 3-pass algorithm into the main initialization pipeline.

Algorithm:

1. Build module registry from project directory
2. Build call graph from code graph using registry
3. Load default security patterns
4. Return integrated result

Parameters:

• codeGraph: the parsed code graph from Initialize()
• projectRoot: absolute path to project root directory

Returns:

• CallGraph: complete call graph with edges and call sites
• ModuleRegistry: module path mappings
• PatternRegistry: loaded security patterns
• error: if any step fails

func IsDjangoORMPattern ¶

func IsDjangoORMPattern(target string) (bool, string)

IsDjangoORMPattern checks if a call target matches Django ORM pattern. Django ORM pattern: ModelName.objects.<method>

Examples:

• "Task.objects.filter" → true
• "User.objects.get" → true
• "Annotation.objects.all" → true
• "task.save" → false (instance method, not manager)

Parameters:

• target: call target string (e.g., "Task.objects.filter")

Returns:

• true if it matches Django ORM pattern
• the method name if matched (e.g., "filter")

func IsORMPattern ¶

func IsORMPattern(target string) (bool, string, string)

IsORMPattern checks if a call target matches any known ORM pattern.

Parameters:

• target: call target string

Returns:

• true if it matches any ORM pattern
• the ORM pattern name (e.g., "Django ORM")
• the method name (e.g., "filter")

func IsSQLAlchemyORMPattern ¶

func IsSQLAlchemyORMPattern(target string) (bool, string)

IsSQLAlchemyORMPattern checks if a call target matches SQLAlchemy ORM pattern. SQLAlchemy patterns are more varied, but common ones include:

• session.query(Model).filter(...)
• db.session.query(Model).all()
• Model.query.filter_by(...)

Parameters:

• target: call target string

Returns:

• true if it matches SQLAlchemy ORM pattern
• the method name if matched

func ParsePythonFile ¶

func ParsePythonFile(sourceCode []byte) (*sitter.Tree, error)

ParsePythonFile parses a Python source file using tree-sitter. Deprecated: Use extraction.ParsePythonFile instead.

func PrintAttributeFailureStats ¶

func PrintAttributeFailureStats()

PrintAttributeFailureStats prints detailed statistics about attribute chain failures.

func ResolveAttributePlaceholders ¶

func ResolveAttributePlaceholders(
	registry *registry.AttributeRegistry,
	typeEngine *TypeInferenceEngine,
	moduleRegistry *ModuleRegistry,
	codeGraph *graph.CodeGraph,
)

ResolveAttributePlaceholders resolves placeholder types in the attribute registry Placeholders are created during extraction when we can't determine the exact type:

• class:User → resolve to fully qualified class name
• call:calculate → resolve to function return type
• param:User → resolve to fully qualified class name

This is Pass 3 of the attribute extraction algorithm.

Parameters:

• registry: attribute registry with placeholder types
• typeEngine: type inference engine with return types
• moduleRegistry: module registry for resolving class names
• codeGraph: code graph for finding class definitions

func ResolveDjangoORMCall ¶

func ResolveDjangoORMCall(target string, modulePath string, registry *ModuleRegistry, codeGraph *graph.CodeGraph) (string, bool)

ResolveDjangoORMCall attempts to resolve a Django ORM call pattern. It constructs a synthetic FQN for the ORM method even though it doesn't exist in source code, because Django generates these methods at runtime.

Parameters:

• target: the call target (e.g., "Task.objects.filter")
• modulePath: the current module path
• registry: module registry
• codeGraph: the parsed code graph (for model validation)

Returns:

• fully qualified name for the ORM call
• true if successfully resolved as Django ORM

func ResolveORMCall ¶

func ResolveORMCall(target string, modulePath string, registry *ModuleRegistry, codeGraph *graph.CodeGraph) (string, bool)

ResolveORMCall attempts to resolve any ORM pattern.

Parameters:

• target: the call target
• modulePath: the current module path
• registry: module registry
• codeGraph: the parsed code graph

Returns:

• fully qualified name for the ORM call
• true if successfully resolved as any ORM pattern

func ResolveSQLAlchemyORMCall ¶

func ResolveSQLAlchemyORMCall(target string, modulePath string) (string, bool)

ResolveSQLAlchemyORMCall attempts to resolve a SQLAlchemy ORM call pattern.

Parameters:

• target: the call target
• modulePath: the current module path

Returns:

• fully qualified name for the ORM call
• true if successfully resolved as SQLAlchemy ORM

func ValidateDjangoModel ¶

func ValidateDjangoModel(modelName string, codeGraph *graph.CodeGraph) bool

ValidateDjangoModel checks if a name is likely a Django model by examining the code graph for the class definition and checking if it inherits from django.db.models.Model or has "Model" in its name.

This is a heuristic check since we can't always definitively determine if something is a Django model without runtime information.

Parameters:

• modelName: the name to check (e.g., "Task", "User")
• codeGraph: the parsed code graph

Returns:

• true if the name is likely a Django model