[SizzleUnrlsd]

Part 2 of #240, second change: getattr(obj, name)(...). With #256 (import path), this completes #240.

Summary

Model:

• Sink.requires_called_result holds the kinds that apply only when the call's result is itself called.
• Merging keeps a kind conditional only when every declaration carrying it is, in either order. An unconditional declaration is never weakened, and an advisory sink added through ModelTable.extended does not widen a conditional kind.
• Sink.applying(invoked) gives the kinds that apply to the call itself or to one invocation of its result.
• getattr is a CODE sink on its name (argument 1), with selects, that requires its result to be called.

Summaries keep facts, independently of the models:

• ExternalCall.invoked_at gives one record per invocation of an external call's result. location stays the selecting call.
• The record key includes invoked_at, which is copied unchanged along helper chains.
• Invocations are found by ir.defuse.invocations, through copies and phis.
• Cache format 15.

The consuming engine filters:

• In a function: unconditional kinds at the call; conditional kinds at each invocation, where the flow is anchored (TaintFlow.invoked_at). Checks between selection and invocation are therefore judged.
• Through helpers: known() applies the same split per record.

Findings:

• code-injection reports a hotspot titled Untrusted attribute call, on modules and behind prefixes too, with selected_line and invoked_line in the metadata.
• A check proves the name only when it limits the value getattr received to constants. A check on a name rebound since, or on a derived value, proves nothing.
• Documented limits: a result that is returned, stored or passed on before it is called; attrgetter/methodcaller/__getattribute__/vars(); checks inside helpers.

Verification

• New tests/test_attribute_call_sinks.py and tests/test_sink_called_result.py: 33 tests, covering:

  • one finding per invocation, in a function and through one or two helpers;
  • converging selections;
  • rebound or derived names;
  • an unconditional sink whose result is called, reported once (eval(x)(), and an extra plugin declaring getattr unconditionally);
  • per-kind merging in both orders;
  • workers and a warm cache.

  No existing test changed apart from the luigi regression snapshot, in its own commit.

• Mutation check: breaking the record key, the cache encoding, the merge or the kind split fails the new tests.

• Full suite green, apart from the local test_packaging metadata issue. ruff check and mypy clean.

• Regression: one new finding, a hotspot at luigi/server.py:101:

  • getattr(self._scheduler, method)(**arguments) with the route's method;
  • RPC_METHODS is a module-level registry filled by a decorator, so it proves nothing (refutation: constant allowlists other than tuple and list literals are not recognised #239).

• No getattr finding on mitmproxy or healthchecks; cache size +2.3% and +1.7%.

Closes #240