You signed in with another tab or window. Reload to refresh your session.You signed out in another tab or window. Reload to refresh your session.You switched accounts on another tab or window. Reload to refresh your session.Dismiss alert
feat(engine): upgrade to inter-procedural flow-sensitive taint analysis
- Implemented global fixed-point iteration and function summaries for cross-boundary tracking.
- Refactored core engine to be flow-sensitive via new CFG implementation.
- Fixed critical call-graph bug and updated README with v0.1.5 architecture deep-dives.
PySpector is a Static Application Security Testing (SAST) framework for modern Python projects.
17
-
It combines a high-performance Rust analysis engine with a developer-friendly Python CLI to deliver fast and accurate vulnerability scanning.
16
+
PySpector is a State-of-the-Art Static Analysis Security Testing (SAST) framework, built in Rust for next-gen performances, made for modern Python projects and large codebases. Unlike traditional linters, PySpector utilizes a **Flow-Sensitive, Inter-Procedural Taint Engine** to track untrusted data across complex function boundaries and control flow structures.
18
17
19
18
By compiling the core analysis engine to a native binary, PySpector avoids the performance limitations of traditional Python-only tools. This makes it well-suited for CI/CD pipelines and local development environments where speed and scalability matter.
20
19
21
-
The tool is designed to be both comprehensive and intuitive, offering a multi-layered analysis approach that goes beyond simple pattern matching to understand the structure and data flow of your application.
20
+
PySpector is designed to be both comprehensive and intuitive, offering a multi-layered analysis approach that goes beyond simple pattern matching to understand the structure and data flow of your Python application.
22
21
23
22
## Table of Contents
24
23
-[Getting Started](#getting-started)
@@ -46,6 +45,7 @@ It is **highly recommended** to install PySpector in a dedicated Python 3.12 ven
46
45
47
46
-**Linux (Bash)**:
48
47
```bash
48
+
# Download Python 3.12
49
49
python3.12 -m venv venv
50
50
source venv/bin/activate
51
51
```
@@ -66,19 +66,32 @@ pip install pyspector
66
66
67
67
## Key Features
68
68
69
-
***Multi-Layered Analysis Engine:**PySpector employs a sophisticated, multi-layered approach to detect a broad spectrum of vulnerabilities:
69
+
***Flow-Sensitive Analysis:**Utilizes a Control Flow Graph (CFG) to track variable states sequentially, accurately distinguishing between safe and vulnerable code paths.
70
70
71
-
-**Regex-Based Pattern Matching:**Scans all files forspecific patterns, ideal for identifying hardcoded secrets, insecure configurationsin Dockerfiles, and weak settings in framework files.
71
+
***Inter-Procedural Taint Tracking:**Propagates untrusted data across functionboundaries using global fixed-point iteration and functionsummaries.
72
72
73
-
-**Abstract Syntax Tree (AST) Analysis:**For Python files, the tool parses the code into an AST to analyze its structure. This enables precise detection of vulnerabilities tied to code constructs, such as the use of eval(), insecure deserialization with pickle, or weak hashing algorithms.
73
+
***Context-Aware Summaries:**Sophisticated mapping of which functionparameters flow to return values, allowing for high-precision tracking through complex utility functions.
74
74
75
-
- **Inter-procedural Taint Analysis:** The engine builds a comprehensive call graph of the entire application to perform taint analysis. It tracks the flow of data from input sources (like web requests) to dangerous sinks (like command execution functions), allowing it to identify complex injection vulnerabilities with high accuracy.
75
+
***Multi-Engine Hybrid Scanning:**
76
+
77
+
***Regex Engine:** High-speed scanning for secrets, hardcoded credentials, and configuration errors.
76
78
77
-
***Comprehensive and Customizable Ruleset:**PySpector comes with 241 built-in rules that cover common vulnerabilities, including those from the OWASP Top 10. The rules are defined in a simple TOML format, making them easy to understand and extend.
79
+
***AST Engine:**Deep structural pattern matching to find Python-specific anti-patterns.
78
80
79
-
***Versatile Reporting:**Generates clear and actionable reports in multiple formats, including a developer-friendly console output, JSON, HTML, and SARIF forseamless integration with other security tools and platforms.
81
+
***Graph Engine:**Advanced CFG and Call-Graph-based data flow analysis forcomplex vulnerability chains.
80
82
81
-
***Efficient Baselining:** The interactive triage mode simplifies the process of establishing a security baseline, allowing teams to focus on new and relevant findings in each scan.
83
+
***Fastest Market Performances:** Core analysis engine implemented in Rust with `Rayon`for multi-threaded parallelization (allowing PySpector to scan 71% faster than Bandit, and 16.6x faster than Semgrep).
84
+
85
+
***AI-Agent Security:** Specialized rulesets designed to identify prompt injection, insecure tool use, and data leakage in LLM-integrated Python applications.
86
+
87
+
## Core Engine Architecture
88
+
89
+
PySpector v0.1.5 represents a shift from partially-static pattern matching, to a full graph-based analysis engine:
90
+
91
+
1. **AST Parsing:** Python source is converted into a structured JSON AST, for semantic analysis.
92
+
2. **Call Graph Construction:** PySpector builds a project-wide map of functiondefinitions, and call sites to enable cross-file analysis.
93
+
3. **CFG Generation:** Each functionis decomposed into a Control Flow Graph (CFG), allowing the engine to understand the order of operations and conditional Python logic.
94
+
4. **Fixed-Point Taint Propagation:** Using a Worklist Algorithm, the engine propagates "taint" from defined **Sources** to **Sinks**, while respecting **Sanitizers** that clean the data along the way.
0 commit comments