@neralabs/rerail-pack-python 0.1.1

This diff represents the content of publicly available package versions that have been released to one of the supported registries. The information contained in this diff is provided for informational purposes only and reflects changes between package versions as they appear in their respective public registries.
Files changed (147) hide show
  1. package/LICENSE +202 -0
  2. package/NOTICE +7 -0
  3. package/README.md +36 -0
  4. package/licenses/bandit/LICENSE +175 -0
  5. package/licenses/bandit/UPSTREAM.md +100 -0
  6. package/licenses/ruff/LICENSE +430 -0
  7. package/licenses/ruff/UPSTREAM.md +338 -0
  8. package/pack.json +912 -0
  9. package/package.json +30 -0
  10. package/rules/bandit-b101-assert-used.json +38 -0
  11. package/rules/bandit-b102-exec-used.json +125 -0
  12. package/rules/bandit-b110-try-except-pass.json +109 -0
  13. package/rules/bandit-b112-try-except-continue.json +109 -0
  14. package/rules/bandit-b113-request-without-timeout.json +138 -0
  15. package/rules/bandit-b301-pickle.json +58 -0
  16. package/rules/bandit-b302-marshal.json +48 -0
  17. package/rules/bandit-b303-md5.json +79 -0
  18. package/rules/bandit-b305-cipher-modes.json +47 -0
  19. package/rules/bandit-b306-mktemp-q.json +54 -0
  20. package/rules/bandit-b307-eval.json +125 -0
  21. package/rules/bandit-b308-mark-safe.json +47 -0
  22. package/rules/bandit-b310-urllib-urlopen.json +54 -0
  23. package/rules/bandit-b311-random.json +57 -0
  24. package/rules/bandit-b312-telnetlib.json +47 -0
  25. package/rules/bandit-b313-xml-bad-celementtree.json +50 -0
  26. package/rules/bandit-b314-xml-bad-elementtree.json +50 -0
  27. package/rules/bandit-b315-xml-bad-expatreader.json +47 -0
  28. package/rules/bandit-b316-xml-bad-expatbuilder.json +48 -0
  29. package/rules/bandit-b317-xml-bad-sax.json +58 -0
  30. package/rules/bandit-b318-xml-bad-minidom.json +48 -0
  31. package/rules/bandit-b319-xml-bad-pulldom.json +48 -0
  32. package/rules/bandit-b321-ftplib.json +47 -0
  33. package/rules/bandit-b323-unverified-context.json +47 -0
  34. package/rules/bandit-b401-import-telnetlib.json +48 -0
  35. package/rules/bandit-b402-import-ftplib.json +48 -0
  36. package/rules/bandit-b405-import-xml-etree.json +69 -0
  37. package/rules/bandit-b406-import-xml-sax.json +73 -0
  38. package/rules/bandit-b407-import-xml-expat.json +54 -0
  39. package/rules/bandit-b408-import-xml-minidom.json +54 -0
  40. package/rules/bandit-b409-import-xml-pulldom.json +54 -0
  41. package/rules/bandit-b411-import-xmlrpclib.json +48 -0
  42. package/rules/bandit-b413-import-pycrypto.json +159 -0
  43. package/rules/bandit-b415-import-pyghmi.json +48 -0
  44. package/rules/bandit-b502-ssl-with-bad-version.json +90 -0
  45. package/rules/bandit-b505-weak-cryptographic-key.json +166 -0
  46. package/rules/bandit-b507-ssh-no-host-key-verification.json +210 -0
  47. package/rules/bandit-b606-start-process-with-no-shell.json +63 -0
  48. package/rules/bandit-b610-django-extra-used.json +268 -0
  49. package/rules/bandit-b615-huggingface-unsafe-download.json +1152 -0
  50. package/rules/ruff-async100-cancel-scope-no-checkpoint.json +357 -0
  51. package/rules/ruff-async105-trio-sync-call.json +199 -0
  52. package/rules/ruff-async115-async-zero-sleep.json +264 -0
  53. package/rules/ruff-async116-long-sleep-not-forever.json +267 -0
  54. package/rules/ruff-async210-blocking-http-call-in-async-function.json +161 -0
  55. package/rules/ruff-async221-run-process-in-async-function.json +342 -0
  56. package/rules/ruff-async222-wait-for-process-in-async-function.json +144 -0
  57. package/rules/ruff-async230-blocking-open-call-in-async-function.json +339 -0
  58. package/rules/ruff-async250-blocking-input-in-async-function.json +143 -0
  59. package/rules/ruff-async251-blocking-sleep-in-async-function.json +140 -0
  60. package/rules/ruff-b002-unary-prefix-increment-decrement.json +54 -0
  61. package/rules/ruff-b003-assignment-to-os-environ.json +54 -0
  62. package/rules/ruff-b004-unreliable-callable-check.json +171 -0
  63. package/rules/ruff-b005-strip-with-multi-characters.json +131 -0
  64. package/rules/ruff-b007-unused-loop-control-variable.json +368 -0
  65. package/rules/ruff-b009-get-attr-with-constant.json +190 -0
  66. package/rules/ruff-b010-set-attr-with-constant.json +219 -0
  67. package/rules/ruff-b011-assert-false.json +62 -0
  68. package/rules/ruff-b013-redundant-tuple-in-exception-handler.json +94 -0
  69. package/rules/ruff-b014-duplicate-handler-exception.json +126 -0
  70. package/rules/ruff-b016-raise-literal.json +47 -0
  71. package/rules/ruff-b020-loop-variable-overrides-iterator.json +341 -0
  72. package/rules/ruff-b021-f-string-docstring.json +48 -0
  73. package/rules/ruff-b022-useless-contextlib-suppress.json +95 -0
  74. package/rules/ruff-b023-function-uses-loop-variable.json +560 -0
  75. package/rules/ruff-b025-duplicate-try-block-exception.json +182 -0
  76. package/rules/ruff-b026-star-arg-unpacking-after-keyword-arg.json +57 -0
  77. package/rules/ruff-b028-no-explicit-stacklevel.json +177 -0
  78. package/rules/ruff-b029-except-with-empty-tuple.json +102 -0
  79. package/rules/ruff-b032-unintentional-type-annotation.json +157 -0
  80. package/rules/ruff-b033-duplicate-value.json +129 -0
  81. package/rules/ruff-b034-re-sub-positional-args.json +159 -0
  82. package/rules/ruff-b039-mutable-contextvar-default.json +281 -0
  83. package/rules/ruff-b904-raise-without-from-inside-except.json +194 -0
  84. package/rules/ruff-b905-zip-without-explicit-strict.json +429 -0
  85. package/rules/ruff-e711-none-comparison.json +199 -0
  86. package/rules/ruff-e721-type-comparison.json +293 -0
  87. package/rules/ruff-e722-bare-except.json +57 -0
  88. package/rules/ruff-e742-ambiguous-class-name.json +47 -0
  89. package/rules/ruff-e743-ambiguous-function-name.json +47 -0
  90. package/rules/ruff-f403-undefined-local-with-import-star.json +73 -0
  91. package/rules/ruff-f405-undefined-local-with-import-star-usage.json +87 -0
  92. package/rules/ruff-f406-undefined-local-with-nested-import-star-usage.json +39 -0
  93. package/rules/ruff-f407-future-feature-not-defined.json +56 -0
  94. package/rules/ruff-f501-percent-format-invalid-format.json +88 -0
  95. package/rules/ruff-f502-percent-format-expected-mapping.json +127 -0
  96. package/rules/ruff-f503-percent-format-expected-sequence.json +127 -0
  97. package/rules/ruff-f504-percent-format-extra-named-arguments.json +46 -0
  98. package/rules/ruff-f505-percent-format-missing-argument.json +49 -0
  99. package/rules/ruff-f506-percent-format-mixed-positional-and-named.json +114 -0
  100. package/rules/ruff-f507-percent-format-positional-count-mismatch.json +78 -0
  101. package/rules/ruff-f508-percent-format-star-requires-sequence.json +112 -0
  102. package/rules/ruff-f509-percent-format-unsupported-format-character.json +86 -0
  103. package/rules/ruff-f521-string-dot-format-invalid-format.json +83 -0
  104. package/rules/ruff-f522-string-dot-format-extra-named-arguments.json +46 -0
  105. package/rules/ruff-f523-string-dot-format-extra-positional-arguments.json +48 -0
  106. package/rules/ruff-f524-string-dot-format-missing-arguments.json +46 -0
  107. package/rules/ruff-f525-string-dot-format-mixing-automatic.json +99 -0
  108. package/rules/ruff-f541-f-string-missing-placeholders.json +52 -0
  109. package/rules/ruff-f601-multi-value-repeated-key-literal.json +215 -0
  110. package/rules/ruff-f602-multi-value-repeated-key-variable.json +123 -0
  111. package/rules/ruff-f622-multiple-starred-expressions.json +57 -0
  112. package/rules/ruff-f632-is-literal.json +232 -0
  113. package/rules/ruff-f633-invalid-print-syntax.json +299 -0
  114. package/rules/ruff-f701-break-outside-loop.json +64 -0
  115. package/rules/ruff-f702-continue-outside-loop.json +64 -0
  116. package/rules/ruff-f706-return-outside-function.json +61 -0
  117. package/rules/ruff-f707-default-except-not-last.json +50 -0
  118. package/rules/ruff-f722-forward-annotation-syntax-error.json +654 -0
  119. package/rules/ruff-f822-undefined-export.json +55 -0
  120. package/rules/ruff-f823-undefined-local.json +42 -0
  121. package/rules/ruff-f842-unused-annotation.json +51 -0
  122. package/rules/ruff-f901-raise-not-implemented.json +97 -0
  123. package/rules/ruff-pie794-duplicate-class-field-definition.json +157 -0
  124. package/rules/ruff-pie796-non-unique-enums.json +460 -0
  125. package/rules/ruff-pie800-unnecessary-spread.json +62 -0
  126. package/rules/ruff-pie804-unnecessary-dict-kwargs.json +179 -0
  127. package/rules/ruff-pie807-reimplemented-container-builtin.json +100 -0
  128. package/rules/ruff-pie810-multiple-starts-ends-with.json +585 -0
  129. package/rules/ruff-ret501-unnecessary-return-none.json +256 -0
  130. package/rules/ruff-ret502-implicit-return-value.json +163 -0
  131. package/rules/ruff-ret505-superfluous-else-return.json +211 -0
  132. package/rules/ruff-ret506-superfluous-else-raise.json +211 -0
  133. package/rules/ruff-ret507-superfluous-else-continue.json +211 -0
  134. package/rules/ruff-ret508-superfluous-else-break.json +211 -0
  135. package/rules/ruff-sim101-duplicate-isinstance-call.json +384 -0
  136. package/rules/ruff-sim107-return-in-try-except-finally.json +82 -0
  137. package/rules/ruff-sim109-compare-with-tuple.json +205 -0
  138. package/rules/ruff-sim112-uncapitalized-environment-variables.json +168 -0
  139. package/rules/ruff-sim113-enumerate-for-loop.json +562 -0
  140. package/rules/ruff-sim208-double-negation.json +58 -0
  141. package/rules/ruff-sim210-if-expr-with-true-false.json +90 -0
  142. package/rules/ruff-sim211-if-expr-with-false-true.json +90 -0
  143. package/rules/ruff-sim212-if-expr-with-twisted-arms.json +95 -0
  144. package/rules/ruff-sim300-yoda-conditions.json +487 -0
  145. package/rules/ruff-sim905-split-static-string.json +579 -0
  146. package/rules/ruff-sim910-dict-get-with-none-default.json +518 -0
  147. package/rules/ruff-t100-debugger.json +197 -0
package/rules/bandit-b615-huggingface-unsafe-download.json ADDED
@@ -0,0 +1,1152 @@
1
+ {
2
+ "format": "rerail.policy/v1",
3
+ "id": "bandit-b615-huggingface-unsafe-download",
4
+ "revision": 5,
5
+ "mode": "steer",
6
+ "description": "Require a transformers, datasets, or huggingface_hub-like import; resolve the supported download/load APIs; allow nonliteral revisions, hexadecimal revisions of at least seven characters, or local-path first arguments, and flag all other unpinned downloads.",
7
+ "scope": {
8
+ "include": [
9
+ "**/*.py"
10
+ ],
11
+ "exclude": []
12
+ },
13
+ "clauses": [
14
+ {
15
+ "id": "b615",
16
+ "forbid": {
17
+ "ast": {
18
+ "language": "python",
19
+ "rule": {
20
+ "kind": "call",
21
+ "all": [
22
+ {
23
+ "has": {
24
+ "field": "function",
25
+ "matches": "hf-callee"
26
+ }
27
+ },
28
+ {
29
+ "not": {
30
+ "matches": "nonconstant-revision"
31
+ }
32
+ },
33
+ {
34
+ "not": {
35
+ "matches": "pinned-revision"
36
+ }
37
+ },
38
+ {
39
+ "not": {
40
+ "matches": "local-path-first-argument"
41
+ }
42
+ },
43
+ {
44
+ "matches": "after-hf-import"
45
+ }
46
+ ]
47
+ },
48
+ "utils": {
49
+ "ast-constant": {
50
+ "any": [
51
+ {
52
+ "kind": "string",
53
+ "not": {
54
+ "has": {
55
+ "stopBy": "neighbor",
56
+ "kind": "string_start",
57
+ "regex": "[fFtT]"
58
+ }
59
+ }
60
+ },
61
+ {
62
+ "kind": "concatenated_string",
63
+ "not": {
64
+ "has": {
65
+ "stopBy": "neighbor",
66
+ "kind": "string",
67
+ "has": {
68
+ "stopBy": "neighbor",
69
+ "kind": "string_start",
70
+ "regex": "[fFtT]"
71
+ }
72
+ }
73
+ }
74
+ },
75
+ {
76
+ "kind": "integer"
77
+ },
78
+ {
79
+ "kind": "float"
80
+ },
81
+ {
82
+ "kind": "true"
83
+ },
84
+ {
85
+ "kind": "false"
86
+ },
87
+ {
88
+ "kind": "none"
89
+ },
90
+ {
91
+ "kind": "ellipsis"
92
+ },
93
+ {
94
+ "kind": "parenthesized_expression",
95
+ "has": {
96
+ "stopBy": "neighbor",
97
+ "not": {
98
+ "kind": "comment"
99
+ },
100
+ "matches": "ast-constant"
101
+ }
102
+ }
103
+ ]
104
+ },
105
+ "hf-import": {
106
+ "any": [
107
+ {
108
+ "kind": "import_statement"
109
+ },
110
+ {
111
+ "kind": "import_from_statement"
112
+ }
113
+ ],
114
+ "has": {
115
+ "stopBy": "end",
116
+ "kind": "identifier",
117
+ "regex": "transformers|datasets|huggingface_hub",
118
+ "inside": {
119
+ "stopBy": "neighbor",
120
+ "kind": "dotted_name"
121
+ }
122
+ }
123
+ },
124
+ "hf-import-within": {
125
+ "any": [
126
+ {
127
+ "matches": "hf-import"
128
+ },
129
+ {
130
+ "has": {
131
+ "stopBy": "end",
132
+ "matches": "hf-import"
133
+ }
134
+ }
135
+ ]
136
+ },
137
+ "after-hf-import": {
138
+ "any": [
139
+ {
140
+ "follows": {
141
+ "stopBy": "end",
142
+ "matches": "hf-import-within"
143
+ }
144
+ },
145
+ {
146
+ "inside": {
147
+ "stopBy": "end",
148
+ "follows": {
149
+ "stopBy": "end",
150
+ "matches": "hf-import-within"
151
+ }
152
+ }
153
+ }
154
+ ]
155
+ },
156
+ "alias-writer": {
157
+ "any": [
158
+ {
159
+ "kind": "aliased_import",
160
+ "has": {
161
+ "field": "alias",
162
+ "pattern": "$HEAD"
163
+ }
164
+ },
165
+ {
166
+ "kind": "dotted_name",
167
+ "pattern": "$HEAD",
168
+ "not": {
169
+ "inside": {
170
+ "stopBy": "neighbor",
171
+ "field": "module_name",
172
+ "kind": "import_from_statement"
173
+ }
174
+ },
175
+ "inside": {
176
+ "stopBy": "neighbor",
177
+ "kind": "import_from_statement",
178
+ "has": {
179
+ "field": "module_name",
180
+ "any": [
181
+ {
182
+ "kind": "dotted_name"
183
+ },
184
+ {
185
+ "has": {
186
+ "stopBy": "neighbor",
187
+ "kind": "dotted_name"
188
+ }
189
+ }
190
+ ]
191
+ }
192
+ }
193
+ }
194
+ ]
195
+ },
196
+ "writer-transformers": {
197
+ "matches": "alias-writer",
198
+ "any": [
199
+ {
200
+ "kind": "dotted_name",
201
+ "regex": "^transformers$"
202
+ },
203
+ {
204
+ "kind": "aliased_import",
205
+ "has": {
206
+ "field": "name",
207
+ "has": {
208
+ "stopBy": "neighbor",
209
+ "kind": "identifier",
210
+ "regex": "^transformers$"
211
+ }
212
+ }
213
+ },
214
+ {
215
+ "inside": {
216
+ "stopBy": "neighbor",
217
+ "kind": "import_from_statement",
218
+ "has": {
219
+ "field": "module_name",
220
+ "has": {
221
+ "stopBy": "end",
222
+ "kind": "identifier",
223
+ "regex": "^transformers$"
224
+ }
225
+ }
226
+ }
227
+ }
228
+ ]
229
+ },
230
+ "writer-datasets": {
231
+ "matches": "alias-writer",
232
+ "any": [
233
+ {
234
+ "kind": "dotted_name",
235
+ "regex": "^datasets$"
236
+ },
237
+ {
238
+ "kind": "aliased_import",
239
+ "has": {
240
+ "field": "name",
241
+ "has": {
242
+ "stopBy": "neighbor",
243
+ "kind": "identifier",
244
+ "regex": "^datasets$"
245
+ }
246
+ }
247
+ },
248
+ {
249
+ "inside": {
250
+ "stopBy": "neighbor",
251
+ "kind": "import_from_statement",
252
+ "has": {
253
+ "field": "module_name",
254
+ "has": {
255
+ "stopBy": "end",
256
+ "kind": "identifier",
257
+ "regex": "^datasets$"
258
+ }
259
+ }
260
+ }
261
+ }
262
+ ]
263
+ },
264
+ "writer-huggingface-hub": {
265
+ "matches": "alias-writer",
266
+ "any": [
267
+ {
268
+ "kind": "dotted_name",
269
+ "regex": "^huggingface_hub$"
270
+ },
271
+ {
272
+ "kind": "aliased_import",
273
+ "has": {
274
+ "field": "name",
275
+ "has": {
276
+ "stopBy": "neighbor",
277
+ "kind": "identifier",
278
+ "regex": "^huggingface_hub$"
279
+ }
280
+ }
281
+ },
282
+ {
283
+ "inside": {
284
+ "stopBy": "neighbor",
285
+ "kind": "import_from_statement",
286
+ "has": {
287
+ "field": "module_name",
288
+ "has": {
289
+ "stopBy": "end",
290
+ "kind": "identifier",
291
+ "regex": "^huggingface_hub$"
292
+ }
293
+ }
294
+ }
295
+ }
296
+ ]
297
+ },
298
+ "segment-transformers": {
299
+ "any": [
300
+ {
301
+ "kind": "parenthesized_expression",
302
+ "has": {
303
+ "stopBy": "neighbor",
304
+ "not": {
305
+ "kind": "comment"
306
+ },
307
+ "matches": "segment-transformers"
308
+ }
309
+ },
310
+ {
311
+ "kind": "attribute",
312
+ "has": {
313
+ "field": "attribute",
314
+ "regex": "^transformers$"
315
+ }
316
+ },
317
+ {
318
+ "kind": "attribute",
319
+ "has": {
320
+ "field": "object",
321
+ "matches": "segment-transformers"
322
+ }
323
+ },
324
+ {
325
+ "kind": "identifier",
326
+ "regex": "^transformers$",
327
+ "not": {
328
+ "resolves": {
329
+ "binding": {
330
+ "site": {
331
+ "kind": "aliased_import"
332
+ }
333
+ }
334
+ }
335
+ }
336
+ },
337
+ {
338
+ "kind": "identifier",
339
+ "resolves": {
340
+ "binding": {
341
+ "site": {
342
+ "kind": "aliased_import",
343
+ "has": {
344
+ "field": "name",
345
+ "has": {
346
+ "stopBy": "neighbor",
347
+ "kind": "identifier",
348
+ "regex": "^transformers$"
349
+ }
350
+ }
351
+ }
352
+ }
353
+ }
354
+ },
355
+ {
356
+ "kind": "identifier",
357
+ "resolves": {
358
+ "binding": {
359
+ "site": {
360
+ "inside": {
361
+ "stopBy": "end",
362
+ "kind": "import_from_statement",
363
+ "has": {
364
+ "field": "module_name",
365
+ "has": {
366
+ "stopBy": "end",
367
+ "kind": "identifier",
368
+ "regex": "^transformers$"
369
+ }
370
+ }
371
+ }
372
+ }
373
+ }
374
+ }
375
+ },
376
+ {
377
+ "kind": "identifier",
378
+ "pattern": "$HEAD",
379
+ "not": {
380
+ "resolves": {
381
+ "binding": {
382
+ "form": "import"
383
+ }
384
+ }
385
+ },
386
+ "inside": {
387
+ "stopBy": "end",
388
+ "follows": {
389
+ "stopBy": "end",
390
+ "has": {
391
+ "stopBy": "end",
392
+ "matches": "writer-transformers"
393
+ }
394
+ }
395
+ }
396
+ }
397
+ ]
398
+ },
399
+ "segment-datasets": {
400
+ "any": [
401
+ {
402
+ "kind": "parenthesized_expression",
403
+ "has": {
404
+ "stopBy": "neighbor",
405
+ "not": {
406
+ "kind": "comment"
407
+ },
408
+ "matches": "segment-datasets"
409
+ }
410
+ },
411
+ {
412
+ "kind": "attribute",
413
+ "has": {
414
+ "field": "attribute",
415
+ "regex": "^datasets$"
416
+ }
417
+ },
418
+ {
419
+ "kind": "attribute",
420
+ "has": {
421
+ "field": "object",
422
+ "matches": "segment-datasets"
423
+ }
424
+ },
425
+ {
426
+ "kind": "identifier",
427
+ "regex": "^datasets$",
428
+ "not": {
429
+ "resolves": {
430
+ "binding": {
431
+ "site": {
432
+ "kind": "aliased_import"
433
+ }
434
+ }
435
+ }
436
+ }
437
+ },
438
+ {
439
+ "kind": "identifier",
440
+ "resolves": {
441
+ "binding": {
442
+ "site": {
443
+ "kind": "aliased_import",
444
+ "has": {
445
+ "field": "name",
446
+ "has": {
447
+ "stopBy": "neighbor",
448
+ "kind": "identifier",
449
+ "regex": "^datasets$"
450
+ }
451
+ }
452
+ }
453
+ }
454
+ }
455
+ },
456
+ {
457
+ "kind": "identifier",
458
+ "resolves": {
459
+ "binding": {
460
+ "site": {
461
+ "inside": {
462
+ "stopBy": "end",
463
+ "kind": "import_from_statement",
464
+ "has": {
465
+ "field": "module_name",
466
+ "has": {
467
+ "stopBy": "end",
468
+ "kind": "identifier",
469
+ "regex": "^datasets$"
470
+ }
471
+ }
472
+ }
473
+ }
474
+ }
475
+ }
476
+ },
477
+ {
478
+ "kind": "identifier",
479
+ "pattern": "$HEAD",
480
+ "not": {
481
+ "resolves": {
482
+ "binding": {
483
+ "form": "import"
484
+ }
485
+ }
486
+ },
487
+ "inside": {
488
+ "stopBy": "end",
489
+ "follows": {
490
+ "stopBy": "end",
491
+ "has": {
492
+ "stopBy": "end",
493
+ "matches": "writer-datasets"
494
+ }
495
+ }
496
+ }
497
+ }
498
+ ]
499
+ },
500
+ "segment-huggingface-hub": {
501
+ "any": [
502
+ {
503
+ "kind": "parenthesized_expression",
504
+ "has": {
505
+ "stopBy": "neighbor",
506
+ "not": {
507
+ "kind": "comment"
508
+ },
509
+ "matches": "segment-huggingface-hub"
510
+ }
511
+ },
512
+ {
513
+ "kind": "attribute",
514
+ "has": {
515
+ "field": "attribute",
516
+ "regex": "^huggingface_hub$"
517
+ }
518
+ },
519
+ {
520
+ "kind": "attribute",
521
+ "has": {
522
+ "field": "object",
523
+ "matches": "segment-huggingface-hub"
524
+ }
525
+ },
526
+ {
527
+ "kind": "identifier",
528
+ "regex": "^huggingface_hub$",
529
+ "not": {
530
+ "resolves": {
531
+ "binding": {
532
+ "site": {
533
+ "kind": "aliased_import"
534
+ }
535
+ }
536
+ }
537
+ }
538
+ },
539
+ {
540
+ "kind": "identifier",
541
+ "resolves": {
542
+ "binding": {
543
+ "site": {
544
+ "kind": "aliased_import",
545
+ "has": {
546
+ "field": "name",
547
+ "has": {
548
+ "stopBy": "neighbor",
549
+ "kind": "identifier",
550
+ "regex": "^huggingface_hub$"
551
+ }
552
+ }
553
+ }
554
+ }
555
+ }
556
+ },
557
+ {
558
+ "kind": "identifier",
559
+ "resolves": {
560
+ "binding": {
561
+ "site": {
562
+ "inside": {
563
+ "stopBy": "end",
564
+ "kind": "import_from_statement",
565
+ "has": {
566
+ "field": "module_name",
567
+ "has": {
568
+ "stopBy": "end",
569
+ "kind": "identifier",
570
+ "regex": "^huggingface_hub$"
571
+ }
572
+ }
573
+ }
574
+ }
575
+ }
576
+ }
577
+ },
578
+ {
579
+ "kind": "identifier",
580
+ "pattern": "$HEAD",
581
+ "not": {
582
+ "resolves": {
583
+ "binding": {
584
+ "form": "import"
585
+ }
586
+ }
587
+ },
588
+ "inside": {
589
+ "stopBy": "end",
590
+ "follows": {
591
+ "stopBy": "end",
592
+ "has": {
593
+ "stopBy": "end",
594
+ "matches": "writer-huggingface-hub"
595
+ }
596
+ }
597
+ }
598
+ }
599
+ ]
600
+ },
601
+ "named-from-pretrained": {
602
+ "any": [
603
+ {
604
+ "kind": "attribute",
605
+ "has": {
606
+ "field": "attribute",
607
+ "regex": "^from_pretrained$",
608
+ "pattern": "$API"
609
+ }
610
+ },
611
+ {
612
+ "kind": "identifier",
613
+ "all": [
614
+ {
615
+ "regex": "^from_pretrained$",
616
+ "pattern": "$API"
617
+ },
618
+ {
619
+ "not": {
620
+ "resolves": {
621
+ "binding": {
622
+ "site": {
623
+ "kind": "aliased_import"
624
+ }
625
+ }
626
+ }
627
+ }
628
+ }
629
+ ]
630
+ },
631
+ {
632
+ "kind": "identifier",
633
+ "resolves": {
634
+ "binding": {
635
+ "site": {
636
+ "kind": "aliased_import",
637
+ "has": {
638
+ "field": "name",
639
+ "has": {
640
+ "stopBy": "neighbor",
641
+ "kind": "identifier",
642
+ "nthChild": {
643
+ "position": 1,
644
+ "reverse": true,
645
+ "ofRule": {
646
+ "kind": "identifier"
647
+ }
648
+ },
649
+ "regex": "^from_pretrained$",
650
+ "pattern": "$API"
651
+ }
652
+ }
653
+ }
654
+ }
655
+ }
656
+ },
657
+ {
658
+ "kind": "identifier",
659
+ "pattern": "$CALLEE",
660
+ "all": [
661
+ {
662
+ "resolves": {
663
+ "binding": {
664
+ "bindings": {
665
+ "min": 2
666
+ }
667
+ }
668
+ }
669
+ },
670
+ {
671
+ "not": {
672
+ "resolves": {
673
+ "binding": {
674
+ "form": "import"
675
+ }
676
+ }
677
+ }
678
+ }
679
+ ],
680
+ "inside": {
681
+ "stopBy": "end",
682
+ "follows": {
683
+ "stopBy": "end",
684
+ "has": {
685
+ "stopBy": "end",
686
+ "kind": "aliased_import",
687
+ "all": [
688
+ {
689
+ "has": {
690
+ "field": "alias",
691
+ "pattern": "$CALLEE"
692
+ }
693
+ },
694
+ {
695
+ "has": {
696
+ "field": "name",
697
+ "has": {
698
+ "stopBy": "neighbor",
699
+ "kind": "identifier",
700
+ "nthChild": {
701
+ "position": 1,
702
+ "reverse": true,
703
+ "ofRule": {
704
+ "kind": "identifier"
705
+ }
706
+ },
707
+ "regex": "^from_pretrained$",
708
+ "pattern": "$API"
709
+ }
710
+ }
711
+ }
712
+ ]
713
+ }
714
+ }
715
+ }
716
+ }
717
+ ]
718
+ },
719
+ "named-load-dataset": {
720
+ "any": [
721
+ {
722
+ "kind": "attribute",
723
+ "has": {
724
+ "field": "attribute",
725
+ "regex": "^load_dataset$",
726
+ "pattern": "$API"
727
+ }
728
+ },
729
+ {
730
+ "kind": "identifier",
731
+ "all": [
732
+ {
733
+ "regex": "^load_dataset$",
734
+ "pattern": "$API"
735
+ },
736
+ {
737
+ "not": {
738
+ "resolves": {
739
+ "binding": {
740
+ "site": {
741
+ "kind": "aliased_import"
742
+ }
743
+ }
744
+ }
745
+ }
746
+ }
747
+ ]
748
+ },
749
+ {
750
+ "kind": "identifier",
751
+ "resolves": {
752
+ "binding": {
753
+ "site": {
754
+ "kind": "aliased_import",
755
+ "has": {
756
+ "field": "name",
757
+ "has": {
758
+ "stopBy": "neighbor",
759
+ "kind": "identifier",
760
+ "nthChild": {
761
+ "position": 1,
762
+ "reverse": true,
763
+ "ofRule": {
764
+ "kind": "identifier"
765
+ }
766
+ },
767
+ "regex": "^load_dataset$",
768
+ "pattern": "$API"
769
+ }
770
+ }
771
+ }
772
+ }
773
+ }
774
+ },
775
+ {
776
+ "kind": "identifier",
777
+ "pattern": "$CALLEE",
778
+ "all": [
779
+ {
780
+ "resolves": {
781
+ "binding": {
782
+ "bindings": {
783
+ "min": 2
784
+ }
785
+ }
786
+ }
787
+ },
788
+ {
789
+ "not": {
790
+ "resolves": {
791
+ "binding": {
792
+ "form": "import"
793
+ }
794
+ }
795
+ }
796
+ }
797
+ ],
798
+ "inside": {
799
+ "stopBy": "end",
800
+ "follows": {
801
+ "stopBy": "end",
802
+ "has": {
803
+ "stopBy": "end",
804
+ "kind": "aliased_import",
805
+ "all": [
806
+ {
807
+ "has": {
808
+ "field": "alias",
809
+ "pattern": "$CALLEE"
810
+ }
811
+ },
812
+ {
813
+ "has": {
814
+ "field": "name",
815
+ "has": {
816
+ "stopBy": "neighbor",
817
+ "kind": "identifier",
818
+ "nthChild": {
819
+ "position": 1,
820
+ "reverse": true,
821
+ "ofRule": {
822
+ "kind": "identifier"
823
+ }
824
+ },
825
+ "regex": "^load_dataset$",
826
+ "pattern": "$API"
827
+ }
828
+ }
829
+ }
830
+ ]
831
+ }
832
+ }
833
+ }
834
+ }
835
+ ]
836
+ },
837
+ "named-hub-download": {
838
+ "any": [
839
+ {
840
+ "kind": "attribute",
841
+ "has": {
842
+ "field": "attribute",
843
+ "regex": "^(hf_hub_download|snapshot_download|repository_id)$",
844
+ "pattern": "$API"
845
+ }
846
+ },
847
+ {
848
+ "kind": "identifier",
849
+ "all": [
850
+ {
851
+ "regex": "^(hf_hub_download|snapshot_download|repository_id)$",
852
+ "pattern": "$API"
853
+ },
854
+ {
855
+ "not": {
856
+ "resolves": {
857
+ "binding": {
858
+ "site": {
859
+ "kind": "aliased_import"
860
+ }
861
+ }
862
+ }
863
+ }
864
+ }
865
+ ]
866
+ },
867
+ {
868
+ "kind": "identifier",
869
+ "resolves": {
870
+ "binding": {
871
+ "site": {
872
+ "kind": "aliased_import",
873
+ "has": {
874
+ "field": "name",
875
+ "has": {
876
+ "stopBy": "neighbor",
877
+ "kind": "identifier",
878
+ "nthChild": {
879
+ "position": 1,
880
+ "reverse": true,
881
+ "ofRule": {
882
+ "kind": "identifier"
883
+ }
884
+ },
885
+ "regex": "^(hf_hub_download|snapshot_download|repository_id)$",
886
+ "pattern": "$API"
887
+ }
888
+ }
889
+ }
890
+ }
891
+ }
892
+ },
893
+ {
894
+ "kind": "identifier",
895
+ "pattern": "$CALLEE",
896
+ "all": [
897
+ {
898
+ "resolves": {
899
+ "binding": {
900
+ "bindings": {
901
+ "min": 2
902
+ }
903
+ }
904
+ }
905
+ },
906
+ {
907
+ "not": {
908
+ "resolves": {
909
+ "binding": {
910
+ "form": "import"
911
+ }
912
+ }
913
+ }
914
+ }
915
+ ],
916
+ "inside": {
917
+ "stopBy": "end",
918
+ "follows": {
919
+ "stopBy": "end",
920
+ "has": {
921
+ "stopBy": "end",
922
+ "kind": "aliased_import",
923
+ "all": [
924
+ {
925
+ "has": {
926
+ "field": "alias",
927
+ "pattern": "$CALLEE"
928
+ }
929
+ },
930
+ {
931
+ "has": {
932
+ "field": "name",
933
+ "has": {
934
+ "stopBy": "neighbor",
935
+ "kind": "identifier",
936
+ "nthChild": {
937
+ "position": 1,
938
+ "reverse": true,
939
+ "ofRule": {
940
+ "kind": "identifier"
941
+ }
942
+ },
943
+ "regex": "^(hf_hub_download|snapshot_download|repository_id)$",
944
+ "pattern": "$API"
945
+ }
946
+ }
947
+ }
948
+ ]
949
+ }
950
+ }
951
+ }
952
+ }
953
+ ]
954
+ },
955
+ "hf-callee": {
956
+ "any": [
957
+ {
958
+ "kind": "parenthesized_expression",
959
+ "has": {
960
+ "stopBy": "neighbor",
961
+ "not": {
962
+ "kind": "comment"
963
+ },
964
+ "matches": "hf-callee"
965
+ }
966
+ },
967
+ {
968
+ "all": [
969
+ {
970
+ "matches": "named-from-pretrained"
971
+ },
972
+ {
973
+ "matches": "segment-transformers"
974
+ }
975
+ ]
976
+ },
977
+ {
978
+ "all": [
979
+ {
980
+ "matches": "named-load-dataset"
981
+ },
982
+ {
983
+ "matches": "segment-datasets"
984
+ }
985
+ ]
986
+ },
987
+ {
988
+ "all": [
989
+ {
990
+ "matches": "named-hub-download"
991
+ },
992
+ {
993
+ "matches": "segment-huggingface-hub"
994
+ }
995
+ ]
996
+ }
997
+ ]
998
+ },
999
+ "revision-keyword": {
1000
+ "kind": "keyword_argument",
1001
+ "has": {
1002
+ "field": "name",
1003
+ "regex": "^revision$"
1004
+ }
1005
+ },
1006
+ "commit-id-keyword": {
1007
+ "kind": "keyword_argument",
1008
+ "has": {
1009
+ "field": "name",
1010
+ "regex": "^commit_id$"
1011
+ }
1012
+ },
1013
+ "hex-revision": {
1014
+ "matches": "ast-constant",
1015
+ "value": {
1016
+ "regex": "^[\"']*[0-9A-Fa-f]{7,}[\"']*$"
1017
+ }
1018
+ },
1019
+ "bandit-truthy": {
1020
+ "matches": "ast-constant",
1021
+ "any": [
1022
+ {
1023
+ "value": {
1024
+ "truthy": true
1025
+ }
1026
+ },
1027
+ {
1028
+ "value": {
1029
+ "type": [
1030
+ "bool",
1031
+ "NoneType"
1032
+ ]
1033
+ }
1034
+ }
1035
+ ]
1036
+ },
1037
+ "nonconstant-revision": {
1038
+ "has": {
1039
+ "field": "arguments",
1040
+ "kind": "argument_list",
1041
+ "has": {
1042
+ "stopBy": "neighbor",
1043
+ "kind": "keyword_argument",
1044
+ "all": [
1045
+ {
1046
+ "has": {
1047
+ "field": "name",
1048
+ "regex": "^(revision|commit_id)$"
1049
+ }
1050
+ },
1051
+ {
1052
+ "has": {
1053
+ "field": "value",
1054
+ "not": {
1055
+ "matches": "ast-constant"
1056
+ }
1057
+ }
1058
+ }
1059
+ ]
1060
+ }
1061
+ }
1062
+ },
1063
+ "pinned-revision": {
1064
+ "has": {
1065
+ "field": "arguments",
1066
+ "kind": "argument_list",
1067
+ "any": [
1068
+ {
1069
+ "has": {
1070
+ "stopBy": "neighbor",
1071
+ "matches": "revision-keyword",
1072
+ "has": {
1073
+ "field": "value",
1074
+ "matches": "hex-revision"
1075
+ }
1076
+ }
1077
+ },
1078
+ {
1079
+ "all": [
1080
+ {
1081
+ "has": {
1082
+ "stopBy": "neighbor",
1083
+ "matches": "commit-id-keyword",
1084
+ "has": {
1085
+ "field": "value",
1086
+ "matches": "hex-revision"
1087
+ }
1088
+ }
1089
+ },
1090
+ {
1091
+ "not": {
1092
+ "has": {
1093
+ "stopBy": "neighbor",
1094
+ "matches": "revision-keyword",
1095
+ "has": {
1096
+ "field": "value",
1097
+ "matches": "bandit-truthy"
1098
+ }
1099
+ }
1100
+ }
1101
+ }
1102
+ ]
1103
+ }
1104
+ ]
1105
+ }
1106
+ },
1107
+ "local-path-first-argument": {
1108
+ "has": {
1109
+ "field": "arguments",
1110
+ "kind": "argument_list",
1111
+ "has": {
1112
+ "stopBy": "neighbor",
1113
+ "not": {
1114
+ "kind": "comment"
1115
+ },
1116
+ "nthChild": {
1117
+ "position": 1,
1118
+ "ofRule": {
1119
+ "not": {
1120
+ "kind": "comment"
1121
+ }
1122
+ }
1123
+ },
1124
+ "matches": "ast-constant",
1125
+ "value": {
1126
+ "startsWith": [
1127
+ "./",
1128
+ "/",
1129
+ "../"
1130
+ ]
1131
+ }
1132
+ }
1133
+ }
1134
+ }
1135
+ }
1136
+ }
1137
+ },
1138
+ "violation": {
1139
+ "code": "B615",
1140
+ "anchor": "witness.span",
1141
+ "message": "Unsafe Hugging Face Hub download without revision pinning in ${API}()",
1142
+ "suppress": {
1143
+ "nosec": {
1144
+ "codes": [
1145
+ "B615"
1146
+ ]
1147
+ }
1148
+ }
1149
+ }
1150
+ }
1151
+ ]
1152
+ }