Display positions in SourceDuplicate errors

[abishekvashok]

Pre-submission checklist

• I've ran the linters locally and fixed lint errors related to the files I modified in this PR. You can install the linters by running pip install -r requirements-dev.txt && pre-commit install
• pre-commit run

Summary

Previously when SourceDuplicate errors occured, we just left a note specifying the duplicate name. Now we can specify the locations where the duplicates occured.

Modifies annotationParser as annotationParser.source_or_sink is where the sink or source is parsed into from taint.config files to contain the location information to be used incase duplicates occur.

Modifies and updates tests to confirm and check the new record field and type of SourceDuplicate error.

Test Plan

• Post changes with the default taint.config, running pysa on documentation/pysa_tutorial/exercise1

• Modify taint.config to:

{
  "sources": [
    {
      "name": "CustomUserControlled",
      "comment": "use to annotate user input"
    },
    {
      "name": "CustomUserControlled",
      "comment": "duplicate for testing"
    }
  ],

  "sinks": [
    {
      "name": "CodeExecution",
      "comment": "use to annotate execution of python code"
    }
  ],

  "features": [],

  "rules": [
    {
      "name": "Possible RCE:",
      "code": 5001,
      "sources": [ "CustomUserControlled" ],
      "sinks": [ "CodeExecution" ],
      "message_format": "User specified data may reach a code execution sink"
    }
  ]
}

Before this PR:

After this PR:

• make test

Footnotes:

• pysa github action was failing before this PR

Fixes part of: MLH-Fellowship#82
Signed-off-by: Abishek V Ashok abishekvashok@gmail.com

[arthaud]

That looks great, thanks!

[facebook-github-bot]

@arthaud has imported this pull request. If you are a Meta employee, you can view this diff on Phabricator.

[arthaud]

Do you plan to work on the same thing for sink/transform/features?

[abishekvashok]

Do you plan to work on the same thing for sink/transform/features?

Yes - @arthaud Is it okay if I do?

[arthaud]

Of course :)

[facebook-github-bot]

@arthaud merged this pull request in 1003a5e.