summaries: a sink in unreachable code of a project function is reported at its callers #258

Problem

Function summaries ignore constant reachability. A sink inside a project function that can never run is still reported at every call of that function.

Checked on main (a758e1f), bundled plugins only:

import os


def run_it(cmd):
    if False:
        os.system(cmd)


def caller():
    run_it(input())

app.py:10: high command-injection: Command injection: stdin input reaches python.os.system through run_it

The same os.system(input()) written directly under if False: in caller is refuted: within a function, RefutationAnalysis drops flows whose sink block constant propagation proves unreachable. The summary of run_it records the external call whatever the reachability of its block, so the caller gets a vulnerability for code that cannot run.

The summaries already know reachability for one case: since the review of #240 part 2 (PR #257), the record of an invocation of a call's result (ExternalCall.invoked_at) is kept only when the call and the invocation can run. That fix was kept to the new records on purpose, because extending it changes existing verdicts.

Expected

An external call in a block that constant propagation proves unreachable is not recorded in its function's summary, so no caller reports a flow through it. Reachable calls are recorded as today.

Open points:

• Whether the dependencies computed in unreachable blocks (returns, stores, mutations) should be dropped too. Dropping them keeps a summary consistent with what can run, but changes more than sink reporting.
• ConstantPropagation is intraprocedural: a branch decided by a caller's constant argument is not seen, as within a function today.

Acceptance criteria

• The reproduction above reports nothing, through one and two levels of project functions; the same sink in reachable code is still reported.
• Regression baselines (tests/regression/expected/) are re-measured on the same commit and configuration, and every change is explained.