Closed yoann-marquer closed 2 months ago
Hi @yoann-marquer, thanks for reaching out.
There are multiple problems here.
First, pysa finds your virtual environment and includes it in its analysis. This is usually the desired behavior. Then, while type checking numpy (in your virtual environment), it seems to hit a performance regression or worse, an infinite loop. This is quite surprising but could simply be a bug in pyre. cc @stroxler and @grievejia in case this is known or if they want to look at it (but usually this is unfortunately low priority for us, unless we have the same problem internally).
so, first of, make sure you are using the latest version of pyre. I would even recommend trying with the pyre-check-nightly
pypi package.
Then, to prevent pysa from looking at your virtual environment, you should be able to add "site_package_search_strategy": "none"
in the .pyre_configuration
file, which should be located in pyre-check-clean/documentation/pysa_tutorial/exercise1/.pyre_configuration
.
See https://pyre-check.org/docs/configuration/ for more information about the pyre configuration file.
An alternative would be to simply exclude numpy.lib.tests.test_format.$toplevel
from the analysis.
This could be done by adding the following lines in a pysa model file (.pysa):
@SkipAnalysis
def numpy.lib.tests.test_format.__top_level__(): ...
For instance, you could add this to pyre-check-clean/documentation/pysa_tutorial/exercise1/sources_sinks.pysa
.
EDIT: Fixed missing : ...
in the SkipAnalysis model.
Thank you very much @arthaud for your help!
If it can help your team, my version numbers were:
pyre-check==0.9.22
fb-sapp==0.5.6
django-stubs==5.0.0
numpy==1.26.4
I tried the "site_package_search_strategy": "none"
solution.
In that case, indeed, Pysa manages to terminate the analysis, but without detecting the expected vulnerabilities.
I guess this is because necessary source/sink definitions are in django-stubs
or fb-sapp
.
Using your second solution, I encountered a Syntax error
, that I fixed by adding the necessary : ...
at the end of the definition.
This indeed solved my issue, and I was able to analyze the code snippet from the tutorial, and other code snippets from my own dataset as well :)
Pysa Bug
Pre-submission checklist [✓] I've checked the list of common issues and mine does not appear
Bug description Pysa execution of a tutorial example does not terminate when done inside another project environment.
Reproduction steps I cloned the pyre-check repository and successfully executed on my machine the Pysa tutorial on a newly created virtual environment, following the instructions in the pysa_tutorial directory.
Then, I tried to reproduce example 1 using my project virtual environment. My project main directory (named
SagaDatabase
) has the following structure:venv
pyre-check-clean
I installed the necessary requirements using:
pip3 install pyre-check fb-sapp django-stubs
then I moved to the first exercise:cd ./pyre-check-clean/documentation/pysa_tutorial/exercise1
in order to analyse the code snippet present in the directory:pyre --noninteractive analyze --no-verify
Expected behavior I expected Pysa execution to terminate after a few seconds, as for my initial test using a standalone instance of the
pyre-check
repository and a fresh virtual environment.Logs
Additional context I'm interested only in analyzing small code snippets (like the
views.py
file in the first exercise), not whole projects. The error indicates thatThe type check of numpy.lib.tests.test_format.$toplevel is taking more than 960 seconds
which is unrelated to the first example of the tutorial. Is there a way to restrict the type check to code snippets at given paths or in a given directory?