Display position in TransformDuplicate errors

[abishekvashok]

Pre-submission checklist

• I've ran the linters locally and fixed lint errors related to the files I modified in this PR. You can install the linters by running pip install -r requirements-dev.txt && pre-commit install
• pre-commit run

Summary

Previously when TransformDuplicate errors occured, we just left a note specifying the duplicate name of the transform. Now we can specify the locations where the duplicates occur.

Modifies taintTransform to have a new type that holds location information (for parsed transforms, it is made None). The location information will only be present for transform node definitions in taint.config.

Modifies and updates tests to confirm and check the new type of TransformDuplicate error.

Test Plan

• After the changes, ran on documentation/pysa_tutorial/exercise1 with default taint.config:

• Changed taint.config to:

{
  "sources": [
    {
      "name": "CustomUserControlled",
      "comment": "use to annotate user input"
    }
  ],

  "sinks": [
    {
      "name": "CodeExecution",
      "comment": "use to annotate execution of python code"
    }
  ],

  "transforms": [
    {
      "name": "Test",
      "comment": "Test transform"
    },
    {
      "name": "Test",
      "comment": "Test tranform duplicate"
    }
  ],

  "features": [],

  "rules": [
    {
      "name": "Possible RCE:",
      "code": 5001,
      "sources": [ "CustomUserControlled" ],
      "sinks": [ "CodeExecution" ],
      "message_format": "User specified data may reach a code execution sink"
    }
  ]
}

Before the changes

After the changes

• Ran tests with make test

Fixes part of MLH-Fellowship#82
Signed-off-by: Abishek V Ashok [email protected]

[arthaud]

You shouldn't change this, since this is the actual transform used during the analysis. We don't need to keep the location around during the analysis.
We do something similar for sources and sinks: we use AnnotationParser.source_or_sink during model parsing but we actually use Sources.t or Sinks.t in the analysis.
TL, DR: I would define a new type in annotationParser.ml to represent those. or just use AnnotationParser.source_or_sink?

[abishekvashok]

Ah, yes! Will make the change :)