feat: attribute access as taint source for dataflow analysis (GAP-006)

[shivasurya]

Summary

• Add AttributeAccess field to core.Statement to capture full dotted attribute chains on RHS of assignments (e.g., request.url, file.filename, self.config.SECRET)
• New attribute_matcher IR type and AttributeMatcherExecutor in DSL layer, wired into resolveMatchers() for use inside flows() as source/sink/sanitizer
• VDG matches AttributeAccess against taint source/sanitizer/sink patterns alongside existing CallTarget matching
• Python SDK: attribute() matcher function and QueryType.attr() for type-constrained attribute matching
• Unlocks ~40 detection rules where web frameworks expose user input as properties, not function calls

CVE Verification

Verified end-to-end with Python SDK rules against 3 real CVE patterns:

CVE	Pattern	Source → Sink	Result
GHSA-527m-2xhr-j27g (LLaMA Factory)	SSRF	request.url → requests.get()	Detected
GHSA-ph9w-r52h-28p7 (langflow)	Path traversal	uploaded.filename → os.path.join()	Detected
GHSA-vwmf-pq79-vjvx (langflow)	RCE	request.data → eval()	Detected

Test plan

• 10 unit tests for extractFullAttributeChain (simple, deep, negative cases)
• 4 VDG tests for attribute-based taint marking (source, flow, sanitizer, negative)
• 6 AttributeMatcherExecutor tests (exact, suffix, multi-pattern, nil safety)
• 1 dataflow integration test (attribute source → call sink end-to-end)
• 7 Python SDK verification tests (IR serialization, flows integration, QueryType.attr)
• Full regression: gradle lintGo, buildGo, testGo all pass

🤖 Generated with Claude Code

[safedep]

SafeDep Report Summary

No dependency changes detected. Nothing to scan.

View complete scan results →

_{This report is generated by SafeDep Github App}

[github-actions]

Code Pathfinder Security Scan

No security issues detected.

Metric	Value
Files Scanned	23
Rules	88

---

_{Powered by Code Pathfinder}

[codecov]

Codecov Report

❌ Patch coverage is 98.09524% with 2 lines in your changes missing coverage. Please review.
✅ Project coverage is 83.84%. Comparing base (4dffef2) to head (9f470ce).
⚠️ Report is 1 commits behind head on main.

Files with missing lines	Patch %	Lines
...st-engine/graph/callgraph/extraction/statements.go	88.23%	2 Missing ⚠️

Additional details and impacted files

@@            Coverage Diff             @@
##             main     #620      +/-   ##
==========================================
+ Coverage   83.77%   83.84%   +0.06%     
==========================================
  Files         155      156       +1     
  Lines       21298    21397      +99     
==========================================
+ Hits        17843    17940      +97     
- Misses       2801     2803       +2     
  Partials      654      654              

☔ View full report in Codecov by Sentry.
📢 Have feedback on the report? Share it here.

🚀 New features to boost your workflow:

• ❄️ Test Analytics: Detect flaky tests, report on failures, and find test suite problems.
• 📦 JS Bundle Analysis: Save yourself from yourself by tracking and limiting bundle sizes in JS merges.