@neralabs/rerail-pack-python 0.1.2 → 0.1.3
This diff represents the content of publicly available package versions that have been released to one of the supported registries. The information contained in this diff is provided for informational purposes only and reflects changes between package versions as they appear in their respective public registries.
- package/README.md +3 -3
- package/licenses/bandit/UPSTREAM.md +10 -0
- package/licenses/ruff/UPSTREAM.md +56 -0
- package/pack.json +7 -20
- package/package.json +1 -1
- package/rules/ruff-b030-except-with-non-exception-classes.json +406 -0
- package/rules/bandit-b406-import-xml-sax.json +0 -73
- package/rules/bandit-b610-django-extra-used.json +0 -268
- package/rules/ruff-f722-forward-annotation-syntax-error.json +0 -654
|
@@ -0,0 +1,406 @@
|
|
|
1
|
+
{
|
|
2
|
+
"format": "rerail.policy/v1",
|
|
3
|
+
"id": "ruff-b030-except-with-non-exception-classes",
|
|
4
|
+
"revision": 2,
|
|
5
|
+
"mode": "steer",
|
|
6
|
+
"description": "Port of Ruff's B030 (except-with-non-exception-classes): flattens an `except`/`except*` type as Ruff's `flatten_iterables` does (a top-level tuple's elements; `*` unpacking of tuples and lists; both sides of `+`, splicing tuple sides and unpacking starred sides) and reports each resulting expression that is not a name, attribute, subscript or call. Parentheses and an `as` binding (`except E as e`, tree-sitter's as_pattern) are transparent.",
|
|
7
|
+
"scope": {
|
|
8
|
+
"include": [
|
|
9
|
+
"**/*"
|
|
10
|
+
],
|
|
11
|
+
"exclude": []
|
|
12
|
+
},
|
|
13
|
+
"clauses": [
|
|
14
|
+
{
|
|
15
|
+
"id": "except-with-non-exception-classes",
|
|
16
|
+
"forbid": {
|
|
17
|
+
"ast": {
|
|
18
|
+
"language": "python",
|
|
19
|
+
"utils": {
|
|
20
|
+
"type-slot": {
|
|
21
|
+
"any": [
|
|
22
|
+
{
|
|
23
|
+
"follows": {
|
|
24
|
+
"stopBy": "neighbor",
|
|
25
|
+
"regex": "^(except|\\*)$"
|
|
26
|
+
},
|
|
27
|
+
"not": {
|
|
28
|
+
"precedes": {
|
|
29
|
+
"stopBy": "neighbor",
|
|
30
|
+
"regex": "^,$"
|
|
31
|
+
}
|
|
32
|
+
},
|
|
33
|
+
"inside": {
|
|
34
|
+
"stopBy": "neighbor",
|
|
35
|
+
"kind": "except_clause"
|
|
36
|
+
}
|
|
37
|
+
},
|
|
38
|
+
{
|
|
39
|
+
"not": {
|
|
40
|
+
"follows": {
|
|
41
|
+
"stopBy": "neighbor",
|
|
42
|
+
"regex": "(?s)."
|
|
43
|
+
}
|
|
44
|
+
},
|
|
45
|
+
"inside": {
|
|
46
|
+
"stopBy": "neighbor",
|
|
47
|
+
"kind": "as_pattern",
|
|
48
|
+
"matches": "type-slot"
|
|
49
|
+
}
|
|
50
|
+
},
|
|
51
|
+
{
|
|
52
|
+
"inside": {
|
|
53
|
+
"stopBy": "neighbor",
|
|
54
|
+
"kind": "parenthesized_expression",
|
|
55
|
+
"matches": "type-slot"
|
|
56
|
+
}
|
|
57
|
+
}
|
|
58
|
+
]
|
|
59
|
+
},
|
|
60
|
+
"plus": {
|
|
61
|
+
"kind": "binary_operator",
|
|
62
|
+
"has": {
|
|
63
|
+
"stopBy": "neighbor",
|
|
64
|
+
"regex": "^\\+$"
|
|
65
|
+
}
|
|
66
|
+
},
|
|
67
|
+
"core": {
|
|
68
|
+
"not": {
|
|
69
|
+
"any": [
|
|
70
|
+
{
|
|
71
|
+
"kind": "parenthesized_expression"
|
|
72
|
+
},
|
|
73
|
+
{
|
|
74
|
+
"kind": "comment"
|
|
75
|
+
},
|
|
76
|
+
{
|
|
77
|
+
"regex": "^[(),*+:\\[\\]]$"
|
|
78
|
+
},
|
|
79
|
+
{
|
|
80
|
+
"kind": "as_pattern"
|
|
81
|
+
}
|
|
82
|
+
]
|
|
83
|
+
}
|
|
84
|
+
},
|
|
85
|
+
"comma-elem": {
|
|
86
|
+
"any": [
|
|
87
|
+
{
|
|
88
|
+
"inside": {
|
|
89
|
+
"stopBy": "neighbor",
|
|
90
|
+
"kind": "except_clause"
|
|
91
|
+
},
|
|
92
|
+
"any": [
|
|
93
|
+
{
|
|
94
|
+
"precedes": {
|
|
95
|
+
"stopBy": "neighbor",
|
|
96
|
+
"regex": "^,$"
|
|
97
|
+
}
|
|
98
|
+
},
|
|
99
|
+
{
|
|
100
|
+
"follows": {
|
|
101
|
+
"stopBy": "neighbor",
|
|
102
|
+
"regex": "^,$"
|
|
103
|
+
}
|
|
104
|
+
}
|
|
105
|
+
]
|
|
106
|
+
},
|
|
107
|
+
{
|
|
108
|
+
"inside": {
|
|
109
|
+
"stopBy": "neighbor",
|
|
110
|
+
"kind": "parenthesized_expression",
|
|
111
|
+
"matches": "comma-elem"
|
|
112
|
+
}
|
|
113
|
+
}
|
|
114
|
+
]
|
|
115
|
+
},
|
|
116
|
+
"queued-splat": {
|
|
117
|
+
"kind": "list_splat",
|
|
118
|
+
"matches": "queued"
|
|
119
|
+
},
|
|
120
|
+
"queued-plus": {
|
|
121
|
+
"matches": "plus",
|
|
122
|
+
"all": [
|
|
123
|
+
{
|
|
124
|
+
"matches": "queued"
|
|
125
|
+
}
|
|
126
|
+
]
|
|
127
|
+
},
|
|
128
|
+
"elem-of-type-tuple": {
|
|
129
|
+
"any": [
|
|
130
|
+
{
|
|
131
|
+
"inside": {
|
|
132
|
+
"stopBy": "neighbor",
|
|
133
|
+
"kind": "tuple",
|
|
134
|
+
"matches": "type-slot"
|
|
135
|
+
}
|
|
136
|
+
},
|
|
137
|
+
{
|
|
138
|
+
"inside": {
|
|
139
|
+
"stopBy": "neighbor",
|
|
140
|
+
"kind": "parenthesized_expression",
|
|
141
|
+
"matches": "elem-of-type-tuple"
|
|
142
|
+
}
|
|
143
|
+
}
|
|
144
|
+
]
|
|
145
|
+
},
|
|
146
|
+
"elem-of-splat-seq": {
|
|
147
|
+
"any": [
|
|
148
|
+
{
|
|
149
|
+
"inside": {
|
|
150
|
+
"stopBy": "neighbor",
|
|
151
|
+
"any": [
|
|
152
|
+
{
|
|
153
|
+
"kind": "tuple"
|
|
154
|
+
},
|
|
155
|
+
{
|
|
156
|
+
"kind": "list"
|
|
157
|
+
}
|
|
158
|
+
],
|
|
159
|
+
"inside": {
|
|
160
|
+
"stopBy": "neighbor",
|
|
161
|
+
"matches": "queued-splat"
|
|
162
|
+
}
|
|
163
|
+
}
|
|
164
|
+
},
|
|
165
|
+
{
|
|
166
|
+
"inside": {
|
|
167
|
+
"stopBy": "neighbor",
|
|
168
|
+
"kind": "parenthesized_expression",
|
|
169
|
+
"matches": "elem-of-splat-seq"
|
|
170
|
+
}
|
|
171
|
+
}
|
|
172
|
+
]
|
|
173
|
+
},
|
|
174
|
+
"value-of-queued-splat": {
|
|
175
|
+
"any": [
|
|
176
|
+
{
|
|
177
|
+
"inside": {
|
|
178
|
+
"stopBy": "neighbor",
|
|
179
|
+
"matches": "queued-splat"
|
|
180
|
+
}
|
|
181
|
+
},
|
|
182
|
+
{
|
|
183
|
+
"inside": {
|
|
184
|
+
"stopBy": "neighbor",
|
|
185
|
+
"kind": "parenthesized_expression",
|
|
186
|
+
"matches": "value-of-queued-splat"
|
|
187
|
+
}
|
|
188
|
+
}
|
|
189
|
+
]
|
|
190
|
+
},
|
|
191
|
+
"side-of-queued-plus": {
|
|
192
|
+
"any": [
|
|
193
|
+
{
|
|
194
|
+
"inside": {
|
|
195
|
+
"stopBy": "neighbor",
|
|
196
|
+
"matches": "queued-plus"
|
|
197
|
+
}
|
|
198
|
+
},
|
|
199
|
+
{
|
|
200
|
+
"inside": {
|
|
201
|
+
"stopBy": "neighbor",
|
|
202
|
+
"kind": "parenthesized_expression",
|
|
203
|
+
"matches": "side-of-queued-plus"
|
|
204
|
+
}
|
|
205
|
+
}
|
|
206
|
+
]
|
|
207
|
+
},
|
|
208
|
+
"elem-of-side-tuple": {
|
|
209
|
+
"any": [
|
|
210
|
+
{
|
|
211
|
+
"inside": {
|
|
212
|
+
"stopBy": "neighbor",
|
|
213
|
+
"kind": "tuple",
|
|
214
|
+
"matches": "side-of-queued-plus"
|
|
215
|
+
}
|
|
216
|
+
},
|
|
217
|
+
{
|
|
218
|
+
"inside": {
|
|
219
|
+
"stopBy": "neighbor",
|
|
220
|
+
"kind": "parenthesized_expression",
|
|
221
|
+
"matches": "elem-of-side-tuple"
|
|
222
|
+
}
|
|
223
|
+
}
|
|
224
|
+
]
|
|
225
|
+
},
|
|
226
|
+
"value-of-side-splat": {
|
|
227
|
+
"any": [
|
|
228
|
+
{
|
|
229
|
+
"inside": {
|
|
230
|
+
"stopBy": "neighbor",
|
|
231
|
+
"kind": "list_splat",
|
|
232
|
+
"matches": "side-of-queued-plus"
|
|
233
|
+
}
|
|
234
|
+
},
|
|
235
|
+
{
|
|
236
|
+
"inside": {
|
|
237
|
+
"stopBy": "neighbor",
|
|
238
|
+
"kind": "parenthesized_expression",
|
|
239
|
+
"matches": "value-of-side-splat"
|
|
240
|
+
}
|
|
241
|
+
}
|
|
242
|
+
]
|
|
243
|
+
},
|
|
244
|
+
"queued": {
|
|
245
|
+
"matches": "core",
|
|
246
|
+
"any": [
|
|
247
|
+
{
|
|
248
|
+
"matches": "type-slot",
|
|
249
|
+
"not": {
|
|
250
|
+
"kind": "tuple"
|
|
251
|
+
}
|
|
252
|
+
},
|
|
253
|
+
{
|
|
254
|
+
"matches": "elem-of-type-tuple"
|
|
255
|
+
},
|
|
256
|
+
{
|
|
257
|
+
"matches": "comma-elem"
|
|
258
|
+
},
|
|
259
|
+
{
|
|
260
|
+
"matches": "elem-of-splat-seq"
|
|
261
|
+
},
|
|
262
|
+
{
|
|
263
|
+
"matches": "plus",
|
|
264
|
+
"all": [
|
|
265
|
+
{
|
|
266
|
+
"matches": "value-of-queued-splat"
|
|
267
|
+
}
|
|
268
|
+
]
|
|
269
|
+
},
|
|
270
|
+
{
|
|
271
|
+
"matches": "plus",
|
|
272
|
+
"all": [
|
|
273
|
+
{
|
|
274
|
+
"matches": "side-of-queued-plus"
|
|
275
|
+
}
|
|
276
|
+
]
|
|
277
|
+
},
|
|
278
|
+
{
|
|
279
|
+
"matches": "elem-of-side-tuple"
|
|
280
|
+
},
|
|
281
|
+
{
|
|
282
|
+
"matches": "plus",
|
|
283
|
+
"all": [
|
|
284
|
+
{
|
|
285
|
+
"matches": "value-of-side-splat"
|
|
286
|
+
}
|
|
287
|
+
]
|
|
288
|
+
}
|
|
289
|
+
]
|
|
290
|
+
},
|
|
291
|
+
"flat": {
|
|
292
|
+
"matches": "core",
|
|
293
|
+
"any": [
|
|
294
|
+
{
|
|
295
|
+
"matches": "queued",
|
|
296
|
+
"not": {
|
|
297
|
+
"any": [
|
|
298
|
+
{
|
|
299
|
+
"kind": "list_splat"
|
|
300
|
+
},
|
|
301
|
+
{
|
|
302
|
+
"matches": "plus"
|
|
303
|
+
}
|
|
304
|
+
]
|
|
305
|
+
}
|
|
306
|
+
},
|
|
307
|
+
{
|
|
308
|
+
"all": [
|
|
309
|
+
{
|
|
310
|
+
"matches": "value-of-queued-splat"
|
|
311
|
+
}
|
|
312
|
+
],
|
|
313
|
+
"not": {
|
|
314
|
+
"any": [
|
|
315
|
+
{
|
|
316
|
+
"kind": "tuple"
|
|
317
|
+
},
|
|
318
|
+
{
|
|
319
|
+
"kind": "list"
|
|
320
|
+
},
|
|
321
|
+
{
|
|
322
|
+
"matches": "plus"
|
|
323
|
+
}
|
|
324
|
+
]
|
|
325
|
+
}
|
|
326
|
+
},
|
|
327
|
+
{
|
|
328
|
+
"all": [
|
|
329
|
+
{
|
|
330
|
+
"matches": "side-of-queued-plus"
|
|
331
|
+
}
|
|
332
|
+
],
|
|
333
|
+
"not": {
|
|
334
|
+
"any": [
|
|
335
|
+
{
|
|
336
|
+
"kind": "tuple"
|
|
337
|
+
},
|
|
338
|
+
{
|
|
339
|
+
"kind": "list_splat"
|
|
340
|
+
},
|
|
341
|
+
{
|
|
342
|
+
"matches": "plus"
|
|
343
|
+
}
|
|
344
|
+
]
|
|
345
|
+
}
|
|
346
|
+
},
|
|
347
|
+
{
|
|
348
|
+
"all": [
|
|
349
|
+
{
|
|
350
|
+
"matches": "value-of-side-splat"
|
|
351
|
+
}
|
|
352
|
+
],
|
|
353
|
+
"not": {
|
|
354
|
+
"any": [
|
|
355
|
+
{
|
|
356
|
+
"kind": "list_splat"
|
|
357
|
+
},
|
|
358
|
+
{
|
|
359
|
+
"matches": "plus"
|
|
360
|
+
}
|
|
361
|
+
]
|
|
362
|
+
}
|
|
363
|
+
}
|
|
364
|
+
]
|
|
365
|
+
}
|
|
366
|
+
},
|
|
367
|
+
"rule": {
|
|
368
|
+
"matches": "flat",
|
|
369
|
+
"not": {
|
|
370
|
+
"any": [
|
|
371
|
+
{
|
|
372
|
+
"kind": "identifier"
|
|
373
|
+
},
|
|
374
|
+
{
|
|
375
|
+
"kind": "attribute"
|
|
376
|
+
},
|
|
377
|
+
{
|
|
378
|
+
"kind": "subscript"
|
|
379
|
+
},
|
|
380
|
+
{
|
|
381
|
+
"kind": "call"
|
|
382
|
+
}
|
|
383
|
+
]
|
|
384
|
+
},
|
|
385
|
+
"inside": {
|
|
386
|
+
"stopBy": "end",
|
|
387
|
+
"kind": "except_clause"
|
|
388
|
+
}
|
|
389
|
+
}
|
|
390
|
+
}
|
|
391
|
+
},
|
|
392
|
+
"violation": {
|
|
393
|
+
"anchor": "witness.span",
|
|
394
|
+
"code": "B030",
|
|
395
|
+
"message": "`except` handlers should only be exception classes or tuples of exception classes",
|
|
396
|
+
"suppress": {
|
|
397
|
+
"noqa": {
|
|
398
|
+
"codes": [
|
|
399
|
+
"B030"
|
|
400
|
+
]
|
|
401
|
+
}
|
|
402
|
+
}
|
|
403
|
+
}
|
|
404
|
+
}
|
|
405
|
+
]
|
|
406
|
+
}
|
|
@@ -1,73 +0,0 @@
|
|
|
1
|
-
{
|
|
2
|
-
"format": "rerail.policy/v1",
|
|
3
|
-
"id": "bandit-b406-import-xml-sax",
|
|
4
|
-
"revision": 2,
|
|
5
|
-
"mode": "steer",
|
|
6
|
-
"description": "Detect direct imports of xml.sax. Port of Bandit 1.9.4's B406 import_xml_sax. Divergence: an import of only xml.sax.saxutils (`from xml.sax.saxutils import ...`, `from xml.sax import saxutils`, aliased or parenthesised) is not reported. saxutils holds XML writing and escaping helpers (escape, quoteattr, unescape, XMLGenerator) and no parser, so defusedxml, which the steer points to, has nothing to replace it with. `import xml.sax.saxutils` is still reported, since it also binds xml.sax and its parse functions (NER-1827).",
|
|
7
|
-
"scope": {
|
|
8
|
-
"include": [
|
|
9
|
-
"**/*.py"
|
|
10
|
-
],
|
|
11
|
-
"exclude": []
|
|
12
|
-
},
|
|
13
|
-
"clauses": [
|
|
14
|
-
{
|
|
15
|
-
"id": "B406",
|
|
16
|
-
"forbid": {
|
|
17
|
-
"ast": {
|
|
18
|
-
"language": "python",
|
|
19
|
-
"rule": {
|
|
20
|
-
"any": [
|
|
21
|
-
{
|
|
22
|
-
"pattern": "import xml.sax"
|
|
23
|
-
},
|
|
24
|
-
{
|
|
25
|
-
"pattern": "import xml.sax as $ALIAS"
|
|
26
|
-
},
|
|
27
|
-
{
|
|
28
|
-
"pattern": "from xml.sax import $$$NAMES"
|
|
29
|
-
},
|
|
30
|
-
{
|
|
31
|
-
"pattern": "from xml import sax"
|
|
32
|
-
},
|
|
33
|
-
{
|
|
34
|
-
"pattern": "from xml import sax as $ALIAS"
|
|
35
|
-
}
|
|
36
|
-
],
|
|
37
|
-
"not": {
|
|
38
|
-
"any": [
|
|
39
|
-
{
|
|
40
|
-
"pattern": "from xml.sax.saxutils import $$$NAMES"
|
|
41
|
-
},
|
|
42
|
-
{
|
|
43
|
-
"pattern": "from xml.sax import saxutils"
|
|
44
|
-
},
|
|
45
|
-
{
|
|
46
|
-
"pattern": "from xml.sax import saxutils as $ALIAS"
|
|
47
|
-
},
|
|
48
|
-
{
|
|
49
|
-
"pattern": "from xml.sax import (saxutils)"
|
|
50
|
-
},
|
|
51
|
-
{
|
|
52
|
-
"pattern": "from xml.sax import (saxutils as $ALIAS)"
|
|
53
|
-
}
|
|
54
|
-
]
|
|
55
|
-
}
|
|
56
|
-
}
|
|
57
|
-
}
|
|
58
|
-
},
|
|
59
|
-
"violation": {
|
|
60
|
-
"code": "B406",
|
|
61
|
-
"anchor": "witness.span",
|
|
62
|
-
"message": "xml.sax parsing may be vulnerable to XML attacks; use defusedxml or defuse the standard library.",
|
|
63
|
-
"suppress": {
|
|
64
|
-
"nosec": {
|
|
65
|
-
"codes": [
|
|
66
|
-
"B406"
|
|
67
|
-
]
|
|
68
|
-
}
|
|
69
|
-
}
|
|
70
|
-
}
|
|
71
|
-
}
|
|
72
|
-
]
|
|
73
|
-
}
|