What's New

Thanks to all our contributors, users, and the many people that make PyT possible! ❤️

If you love PyT, please star our project on GitHub to show your support! ⭐

Unreleased

🎉 New Features

Added visting functions in the tests of while nodes (#186, thanks @adrianbn)

0.42

November 1st, 2018

💥 Breaking Changes

Changed trigger file format when specifying specific tainted args (#182, thanks @bcaller)

🎉 New Features

Function calls such as list.append and dict.update now propagate taint to the list or dict (#181, thanks @bcaller)

🐛 Bugfixes

IfExp (or ternary) expression handling improved (#179, thanks @bcaller)

0.40

September 11th, 2018

📣 Release Highlights

Logging changes. Logging verbosity can be changed with -v to -vvv (#172, thanks @bcaller)

💥 Breaking Changes

Removed --trim option (#169)

🎉 New Features

Added --only-unsanitised flag to not print sanitised vulnerabilities (#172, thanks @bcaller)

🐛 Bugfixes

Recursive functions don't cause RecursionError (#173, thanks @bcaller)
Handling of chained functions improved (#171, thanks @bcaller)

0.39

August 21st, 2018

🎉 New Features

Added handling of assignment unpacking e.g. a, b, c = d (#164, thanks @bcaller)
Made file loading and vulnerability order deterministic (#165, thanks @bcaller)

🐛 Bugfixes

Fixed VarsVisitor RuntimeError on code like f(g(a)(b)(c)) (#163, thanks @bcaller)

🔭 Precision

Taint propagates from methods of tainted objects (#167, thanks @bcaller)

🐍 Miscellaneous

Cleaned test cases of extraneous reassignments (#166, thanks @bcaller)

0.38

August 2nd, 2018

🎉 New Features

Support for all async node types (#158, thanks @bcaller)

🐛 Bugfixes

Fixed a bug where we wrote to the default_blackbox_mapping file even if the -i option was not being used. (#161, thanks @polyzen)

🐍 Miscellaneous

Switched to using built-in mock (#160, thanks @polyzen)

0.37

July 30th, 2018

🎉 New Features

Ability to analyze directories, -r Recursive option (#129, thanks @omergunal)
Added --dont-prepend-root option, makes it so that we don't require imports start with project_root.* (#151, thanks @bcaller)
Added --no-local-imports option, to require absolute imports be relative to the project root (#151, thanks @bcaller)
PEP 498 support, formatted string literals (#142, thanks @bcaller)
PEP 526 support, syntax for variable annotations (#143, thanks @bcaller)
Whitelist lines of sources and sinks ending in # nosec (#121, thanks @omergunal)

🔭 Precision

Added per-arg taint, for sink functions (#147, thanks @bcaller)
AugAssign, Yield, and YieldFrom taint propagation improvements (#155, thanks @bcaller)
Improved tuple assingment to be more precise and support starargs (#150, thanks @bcaller)

🐛 Bugfixes

Fixed a bug where get_call_names only handled ast.Attribute nodes (#148, thanks @bcaller)
Fixed a bug where vars_visitor.py crashed on Python 3.5 dict syntax (#144, thanks @bcaller)

🎭 Performance

Added an lru_cache to the generate_ast function (#153, thanks @bcaller)

🎓 Walkthrough / Help

Added README.rst files to almost every directory. (Partially #126)

🐍 Miscellaneous

Added tests for vars_visitor.py, making our overall coverage 91% (#139, thanks @stannum-l)
Cleaned and organized requirements, setup.py, tox.ini and .travis.yml (#152, thanks @bcaller)
Cleaned up the new pyt/core/ folder (#132)
Fixed all flake8 errors (#114 & #130, thanks @cclauss)
Re-organized the entire codebase into different directories (#126)
Return exit code 1 if any non-sanitised vulnerabilities are found (#156, thanks @bcaller)

0.34

April 24th, 2018

🎉 New Features

Baseline support (#106, thanks @omergunal)

✨ Usability

Combined all source/sink information files and made it the default (#116)

🔭 Precision

Fixed a bug where Post.query.paginate propagated taint (#115)
Fixed a false-positive where self was marked as taint (#119, thanks @lFatty)

🐛 Bugfixes

Fixed a bug where visit_Raise raised a TypeError (#117, thanks @lFatty)
Fixed a bug where we were not including pyt/vulnerability_definitions files (#122, thanks @Ekultek)
Fixed an infinite loop bug that was caused while handling certain loops (#118)

🐍 Miscellaneous

Moved out a bunch of historical files to the ReadTheDocs repo (#110, #111)