Skip to content
main
Switch branches/tags
Code

Latest commit

Summary:
This diff implements proper interaction between sanitizers and taint transforms.

The rules are quite simple:
* When no taint transforms are present, sanitizers are applied the same way as before.
* When a taint transform is applied to a taint, all previous sanitizers are invalidated (for both traces).
* Sanitizers can be applied on a taint that went through a transform, and will work as expected.

Note that we do not currently allow sanitizers of taint transforms. Once a taint is transformed in the forward trace, only sink sanitizers can be applied, and vice versa.

See integration tests for concrete examples.

Reviewed By: dkgi

Differential Revision: D35486651

fbshipit-source-id: 8f7ccd670659d76cca9306a4beb6216c4c2e690b
a1f6076

Files

Permalink
Failed to load latest commit information.
Type
Name
Latest commit message
Commit time
Aug 16, 2018

lint tests pyre License: MIT

Pyre is a performant type checker for Python compliant with PEP 484. Pyre can analyze codebases with millions of lines of code incrementally – providing instantaneous feedback to developers as they write code.

Pyre ships with Pysa, a security focused static analysis tool we've built on top of Pyre that reasons about data flows in Python applications. Please refer to our documentation to get started with our security analysis.

Requirements

To get started, you need Python 3.6 or later and watchman working on your system. On MacOS you can get everything with homebrew:

$ brew install python3 watchman

On Ubuntu, Mint, or Debian; use apt-get and homebrew:

$ sudo apt-get install python3 python3-pip python3-venv
$ brew install watchman

We tested Pyre on Ubuntu 18.04.5 LTS, CentOS 7, as well as OSX 10.11 and later.

Setting up a Project

We start by creating an empty project directory and setting up a virtual environment:

$ mkdir my_project && cd my_project
$ python3 -m venv ~/.venvs/venv
$ source ~/.venvs/venv/bin/activate
(venv) $ pip install pyre-check

Next, we teach Pyre about our new project:

(venv) $ pyre init

This command will set up a configuration for Pyre (.pyre_configuration) as well as watchman (.watchmanconfig) in your project's directory. Accept the defaults for now – you can change them later if necessary.

Running Pyre

We are now ready to run Pyre:

(venv) $ echo "i: int = 'string'" > test.py
(venv) $ pyre
 ƛ Found 1 type error!
test.py:1:0 Incompatible variable type [9]: i is declared to have type `int` but is used as type `str`.

This first invocation will start a daemon listening for filesystem changes – type checking your project incrementally as you make edits to the code. You will notice that subsequent invocations of pyre will be faster than the first one.

For more detailed documentation, see https://pyre-check.org.

Join the Pyre community

See CONTRIBUTING.md for how to help out.

License

Pyre is licensed under the MIT license.