Semgrep: Matching Python annotations containing "." characters

[MCOffSec]

Describe the bug
When trying to match an annotation on a python method that contains a "." character the match fails

To Reproduce

In the following code snippet:

@ns.route('/store/<int:checklist_type>/<int:maturity>')
@api.response(404, 'Validation error', message)
class QuestionSprintStoreCollection(Resource):

    @api.expect(authorization, store_list_items)
    @api.marshal_with(message, 'Success')
    @api.response(400, 'No results found', message)
    def put(self, checklist_type, maturity):
        """
        Store list of question sprint items.

This pattern will match the class annotator:

- pattern: |
      @ns.route($ROUTE)
      class $C(...):

but a similar pattern to match the class annotator "@api.response" fails:

- pattern: |
        @api.response(...)
        def $METH(...):
          ...

If I remove the . in the api.response string I can write a match pattern that works.

Expected behavior
Pattern should match the annotation

Environment
docker and semgrep.live

[mschwager]

Hi @MCOffSec,

Thanks for bringing this to our attention. I'll look into it and get back to you.

[mschwager]

Okay, I was able to reproduce your issue. Here's a minimally reproducible case I came up with:

$ cat test.yaml
rules:
- id: test-id
  languages: [python]
  pattern: |
      @dec.two
      class $CLS(...):
          ...
  message: Test message
  severity: WARNING

$ cat test.py
@dec.one
@dec.two
class Cls:
    pass

$ python -m semgrep --config test.yaml test.py 
running 1 rules...

If we switch the second decorator's . to a _ it works as expected:

$ cat test.yaml
rules:
- id: test-id
  languages: [python]
  pattern: |
      @dec_two
      class $CLS(...):
          ...
  message: Test message
  severity: WARNING

$ cat test.py
@dec.one
@dec_two
class Cls:
    pass

$ python -m semgrep --config test.yaml test.py 
running 1 rules...
test.py
severity:warning rule:test-id: Test message
1:@dec.one
2:@dec_two
3:class Cls:
4:    pass

I've confirmed the same bug exists for function decorators too. I'm going to move this to a bug and we'll track it accordingly. cc @aryx @mjambon

Is this a major blocker for your Semgrep adoption, or can you work around it for now?

[MCOffSec]

its not a major problem, I've managed to work round it in a way that i'm happy with