Repository navigation
feat: decide an argument condition on the argument being passed - #199
Merged
Merged
Conversation
Add Condition.present: the argument being given at all, whatever its value, is the condition, exclusive with values and default. A call giving it, positionally, by keyword or through a folded ** literal, meets it even when the value is unknown; a call surely without it is ruled out (reason absent); *args or an unreadable **mapping leaves it pending review. Closes #195.
This was referenced Sep 30, 2026
Merged
This file contains hidden or bidirectional Unicode text that may be interpreted or compiled differently than what appears below. To review, open the file in an editor that reveals hidden Unicode characters.
Learn more about bidirectional Unicode characters
Sign up for free
to join this conversation on GitHub.
Already have an account?
Sign in to comment
Add this suggestion to a batch that can be applied as a single commit.This suggestion is invalid because no changes were made to the code.Suggestions cannot be applied while the pull request is closed.Suggestions cannot be applied while viewing a subset of changes.Only one suggestion per line can be applied in a batch.Add this suggestion to a batch that can be applied as a single commit.Applying suggestions on deleted lines is not supported.You must change the existing code in this line in order to create a valid suggestion.Outdated suggestions cannot be applied.This suggestion has been applied or marked resolved.Suggestions cannot be applied from pending reviews.Suggestions cannot be applied on multi-line comments.Suggestions cannot be applied while the pull request is queued to merge.Suggestion cannot be applied right now. Please check back later.
Closes #195.
A curated advisory could restrict an entry point with an
argumentcondition on a constant value, but not say that the flaw needs the argument to be given at all, whatever its value — the shape of several aiohttp advisories (web.Response(reason=…),FormData.add_field(content_type=…),MultipartWriter.append(headers=…),session.get(url, cookies=…)). Anargumentcondition with values contradicts exactly the calls those advisories are about (the value read from a request denotes a symbol, not a listed constant), so the lot-2 data left them semantic and every call stayed reachable, pending review.Condition.present: bool = False(last field, positional constructions unchanged): the argument being passed at all is the condition, exclusive withvaluesanddefault, requiringargumentorposition; JSON{"kind": "argument", "argument": "reason", "present": true, "text": "…"}, written only when set, so existing dumps are byte-identical.check_conditions, reusingArguments.given: given, whatever the value (including a folded**{"reason": …}literal from Taint the keys of a **mapping expansion as the keyword names of the call #193) → met; surely not given → contradicted,ruled_outreadsweb.Response(reason absent);*args, an unreadable**mappingor no arguments → pending.reason=request.query["r"]is exploitable withconditions_met, and the file whose calls never passreasonisnot_affectedwith the rule-out in the VEX impact statement.Tests:
tests/test_argument_present_conditions.py(14 cases, failing before the change — the field itself was the RED), positional/keyword/folded-literal met,**optionsand*restpending, five malformed rejections, JSON round trip;pytest -m "not regression"1595 passed, 2 skipped; regression corpus 19 passed, snapshots unchanged;ruff check .andmypyclean.One fixture note: VEX
not_affectedneeds a lock file (required_bysemantics predating this change), so the fixture carries auv.lockbesiderequirements.txt, astests/test_keyword_name_conditions.pydoes.