[SizzleUnrlsd]

Summary

Second point of the consolidation: attribute state on self across methods. self.cmd = argv in __init__ then os.system(self.cmd) in run() was invisible, each method seeing its own self.

• Tests first (test: define self state across methods), implementation follows.
• The call graph knows the classes of a module: App(x) is a call to App.__init__ whose receiver is the new object, app.run() on an instance, self.run() inside a method and a.run() on a parameter annotated with the class are calls to the class's methods. Unknown classes stay unknown.
• Taint and dependence treat the receiver as the method's implicit first parameter: a method's summary already expresses what it reads from self as a dependency on its first parameter, and callers now map that parameter onto the receiver, contents included, so a value stored by __init__ or a setter method and read by another flows through the object, reported at the call site with through. It works across files through the project index, where App(x) looks up App.__init__.
• A method the framework calls, an entry point, starts with the attributes its sibling methods store into self from their own inputs and sources: self.cmd = request.POST[...] in a Django view's post reaches os.system in its get. Methods the project calls get their self from the caller instead, so nothing is invented for a class nobody drives.

On the sixteen repositories nothing changes: their classes hold no attacker-controlled state between methods.