Add Getting Started guide to README, with a walkthrough of running it on a Django repo

[lfatty]

I discovered many SyntaxError during setup.py installation.

build/bdist.macosx-10.12-x86_64/egg/pyt/__main__.py", line 323
    if args.print:
                ^
SyntaxError: invalid syntax

File "build/bdist.macosx-10.12-x86_64/egg/pyt/analysis_base.py", line 9
    class AnalysisBase(metaclass=ABCMeta):
                                ^
SyntaxError: invalid syntax

File "build/bdist.macosx-10.12-x86_64/egg/pyt/fixed_point.py", line 32
    def analyse(cfg_list, *, analysis_type):
                           ^
SyntaxError: invalid syntax

File "build/bdist.macosx-10.12-x86_64/egg/pyt/github_search.py", line 124
    class Search(metaclass=ABCMeta):
                          ^
SyntaxError: invalid syntax

yield from get_vulnerability_chains(
             ^
SyntaxError: invalid syntax

[KevinHock]

Ahh so this is due to you running in under Python 2, under Python 3, (especially 3.6), everything will run well :)

[cclauss]

https://travis-ci.org/python-security/pyt/builds/366758979#L509

[lfatty]

Thanks @KevinHock. What is the best way to test a whole repo or a directory that holds all the python files.

[cclauss]

python3 -m tests

[KevinHock]

Thanks for the PR @cclauss, I will check it out tomorrow night :)

@lfatty which web framework is the repo? You can use find to list all the files and then run PyT on them with -f but the framework matters a little bit.

[lfatty]

Lets say it is django

[lfatty]

I also when running a test against django.nV, I got the following:

python -m pyt -f examples/django.nV/taskManager/views.py 
/bla/bla/python/3.6.5/Frameworks/Python.framework/Versions/3.6/lib/python3.6/runpy.py:125: RuntimeWarning: 'pyt.__main__' found in sys.modules after import of package 'pyt', but prior to execution of 'pyt.__main__'; this may result in unpredictable behaviour
  warn(RuntimeWarning(msg))
No vulnerabilities found.

Is this expected or normal?

[KevinHock]

Try -a E or -a D, it's the framework adaptor option.

[lfatty]

Ok, i am not being successful. Can you please write down the commands for that? thx

[lfatty]

Thanks @KevinHock, I think this tool is very promising especially if we can make it very easy to use. Also we need think about a new option such as -r, --recursive find and process files in subdirectories. Just a suggestion.

[KevinHock]

Thank for the kind words @lfatty, I'll definitely work on that too, I've been overly focused on fixing the false positive and negative problems from our last evaluation, I'll also work on de duplicating any duplicate vulnerabilities as a post-processing step until I fix the root cause.

[KevinHock]

You can try this python -m pyt -a E -f examples/django.nV/taskManager/views.py --interactive before I implement the -r and de-duping options.

[KevinHock]

python -m pyt -a E -f examples/django.nV/taskManager/upload_controller.py --interactive has slightly less worse findings, you can edit the sink information by editing pyt/vulnerability_definitions/all_trigger_words.pyt