Skip to content

feat: decide an argument condition on the argument being passed - #199

Merged
SizzleUnrlsd merged 3 commits into
mainfrom
feat/argument-present-conditions
Sep 30, 2026
Merged

SizzleUnrlsd merged 3 commits into
mainfrom
feat/argument-present-conditions

Conversation

@SizzleUnrlsd

Copy link
Copy Markdown
Contributor

Closes #195.

A curated advisory could restrict an entry point with an argument condition on a constant value, but not say that the flaw needs the argument to be given at all, whatever its value — the shape of several aiohttp advisories (web.Response(reason=…), FormData.add_field(content_type=…), MultipartWriter.append(headers=…), session.get(url, cookies=…)). An argument condition with values contradicts exactly the calls those advisories are about (the value read from a request denotes a symbol, not a listed constant), so the lot-2 data left them semantic and every call stayed reachable, pending review.

  • Condition.present: bool = False (last field, positional constructions unchanged): the argument being passed at all is the condition, exclusive with values and default, requiring argument or position; JSON {"kind": "argument", "argument": "reason", "present": true, "text": "…"}, written only when set, so existing dumps are byte-identical.
  • Decision in check_conditions, reusing Arguments.given: given, whatever the value (including a folded **{"reason": …} literal from Taint the keys of a **mapping expansion as the keyword names of the call #193) → met; surely not given → contradicted, ruled_out reads web.Response(reason absent); *args, an unreadable **mapping or no arguments → pending.
  • With the issue's reproduction (aiohttp 3.13.2 pinned) the call passing reason=request.query["r"] is exploitable with conditions_met, and the file whose calls never pass reason is not_affected with the rule-out in the VEX impact statement.

Tests: tests/test_argument_present_conditions.py (14 cases, failing before the change — the field itself was the RED), positional/keyword/folded-literal met, **options and *rest pending, five malformed rejections, JSON round trip; pytest -m "not regression" 1595 passed, 2 skipped; regression corpus 19 passed, snapshots unchanged; ruff check . and mypy clean.

One fixture note: VEX not_affected needs a lock file (required_by semantics predating this change), so the fixture carries a uv.lock beside requirements.txt, as tests/test_keyword_name_conditions.py does.

Add Condition.present: the argument being given at all, whatever its value, is the condition, exclusive with values and default. A call giving it, positionally, by keyword or through a folded ** literal, meets it even when the value is unknown; a call surely without it is ruled out (reason absent); *args or an unreadable **mapping leaves it pending review. Closes #195.
@SizzleUnrlsd SizzleUnrlsd added the enhancement New feature or request label Sep 30, 2026
@SizzleUnrlsd SizzleUnrlsd self-assigned this Sep 30, 2026
@SizzleUnrlsd
SizzleUnrlsd merged commit 021db94 into main Sep 30, 2026
10 checks passed
Sign up for free to join this conversation on GitHub. Already have an account? Sign in to comment

Labels

enhancement New feature or request

Projects

None yet

Development

Successfully merging this pull request may close these issues.

Advisory condition on an argument being passed, whatever its value

1 participant