Adds verify taint config only option

[abishekvashok]

Adds verify_taint_config_only option to the analyze command that just verifies taint.config files and skips the analysis. This can be useful in the future when we want to verify taint config files via the vs code extension without performing analysis or even any other sort of preprocessing.

Modifies the ocaml server and the python client to pass options for the same.

Pre-submission checklist

• I've ran the linters locally and fixed lint errors related to the files I modified in this PR. You can install the linters by running pip install -r requirements-dev.txt && pre-commit install
• pre-commit run

Summary

Test Plan

• Ran pysa with the default taint.config on documentation/pysa_tutorial/exercise1/:

• Command: python3 -m pyre-check.client.pyre -n analyze --verify-taint-config-only

• Modify taint.config to induce a TaintConfigurationError:

{
  "sources": [
    {
      "name": "CustomUserControlled",
      "comment": "use to annotate user input"
    }
  ],

  "sinks": [
    {
      "name": "CodeExecution",
      "comment": "use to annotate execution of python code"
    }
  ],

  "features": [],

  "rules": [
    {
      "name": "Possible RCE:",
      "code": 5001,
      "sources": [ "CustomUserControlled" ],
      "sinks": [ "CodeExecution" ],
      "message_format": "User specified data may reach a code execution sink"
    },
    {
      "name": "test-duplicate",
      "code": 5001,
      "sources": [ "CustomUserControlled" ],
      "sinks": [ "CodeExecution" ],
      "message_format": "duplicate"
    }
  ]
}

Command: python3 -m pyre-check.client.pyre -n analyze --verify-taint-config-only

• Github actions. (pysa action was failing before this PR)

Fixes part of MLH-Fellowship#82
Signed-off-by: Abishek V Ashok [email protected]

[tianhan0]

Thanks for proposing this! I just noted a few minor things

[tianhan0]

@arthaud Do you have a second opinion if we can do better for the logging?

[abishekvashok]

@tianhan0 thanks for the review. Made the changes, hopefully, as suggested. Back to you if it pleases you :)

[tianhan0]

Looks good! Just left a nitpick that hope you can address.

Also, do you know why this test failed: https://github.com/facebook/pyre-check/actions/runs/5141096156/jobs/9253212045?pr=740? Is this expected?

[abishekvashok]

@tianhan0

Also, do you know why this test failed: https://github.com/facebook/pyre-check/actions/runs/5141096156/jobs/9253212045?pr=740? Is this expected?

That test has been failing for a long time and is unrelated to this PR. I think, from some tests that I did that the setup ocaml action actually uses caches which need to be invalidated now. I tried to run the action by manually setting up opam with a package manager instead of the actions and the build doesn't error out as it does in the main repo. But then without the action, setting up the switch takes a large chunk of time. I think there is a way to specify a cache key that is invalidated for a specific amount of time. I can look into this further if you want.

Just left a nitpick that hope you can address.

Ofcourse, I can address it. Thanks for the valuable suggestions and reviews. Made the change!

[arthaud]

LGTM!

[facebook-github-bot]

@arthaud has imported this pull request. If you are a Meta employee, you can view this diff on Phabricator.

[facebook-github-bot]

@arthaud merged this pull request in 0877a76.