@oculum/scanner 1.0.11 → 1.0.13

package/src/__tests__/regression/known-false-positives.test.ts

@@ -8,9 +8,9 @@
  * Run: npx jest src/__tests__/regression/known-false-positives.test.ts
  */
 
-import { runLayer1Scan } from '../../layer1'
-import { runLayer2Scan } from '../../layer2'
-import type { ScanFile, Vulnerability, Severity } from '../../types'
+import { runLayer1Scan } from '../../detect/secrets'
+import { runLayer2Scan } from '../../detect/structural'
+import type { ScanFile, Vulnerability, Severity } from '../../shared/types'
 
 // Helper to run both layers and get all findings
 async function scanFile(file: ScanFile): Promise<Vulnerability[]> {
@@ -464,4 +464,802 @@ describe('API tests', () => {
       }
     })
   })
+
+  describe('8. Sprint 4 FP Fixes', () => {
+    it('should skip Math.random in template placeholders', async () => {
+      // Template placeholder generators use Math.random for non-security purposes
+      const file: ScanFile = {
+        path: 'src/utils/templates.ts',
+        content: `
+const templates = {
+  random: () => Math.random().toString(),
+  random_hex: () => Math.random().toString(16).slice(2),
+  timestamp: () => Date.now().toString(),
+}
+
+export function generatePlaceholder(type: string) {
+  const generator = templates[type]
+  return generator ? generator() : '{{' + type + '}}'
+}
+`,
+        language: 'typescript',
+        size: 300,
+      }
+
+      const findings = await scanFile(file)
+      const mathRandomFindings = findByCategory(findings, 'dangerous_function').filter(f =>
+        f.title?.toLowerCase().includes('math.random')
+      )
+
+      // Template placeholder Math.random should be skipped entirely or INFO at most
+      expect(mathRandomFindings.length).toBe(0)
+    })
+
+    it('should skip Math.random in Three.js animation', async () => {
+      // Three.js uses Math.random for visual effects, not security
+      const file: ScanFile = {
+        path: 'src/components/ParticleField.tsx',
+        content: `
+import { useFrame } from '@react-three/fiber'
+import { useMemo } from 'react'
+
+export function ParticleField() {
+  const offset = useMemo(() => Math.random() * Math.PI * 2, [])
+  const speed = useMemo(() => 0.5 + Math.random() * 0.5, [])
+
+  useFrame((state) => {
+    // Animation logic using random offset
+    meshRef.current.rotation.y = state.clock.elapsedTime * speed + offset
+  })
+
+  return <mesh ref={meshRef}><sphereGeometry /></mesh>
+}
+`,
+        language: 'typescript',
+        size: 400,
+      }
+
+      const findings = await scanFile(file)
+      const mathRandomFindings = findByCategory(findings, 'dangerous_function').filter(f =>
+        f.title?.toLowerCase().includes('math.random')
+      )
+
+      // Three.js animation Math.random should be skipped entirely
+      expect(mathRandomFindings.length).toBe(0)
+    })
+
+    it('should skip regex with same-line escaping', async () => {
+      // Escaping on the same line as RegExp is safe
+      const file: ScanFile = {
+        path: 'src/utils/search.ts',
+        content: `
+export function createSearchRegex(input: string) {
+  // Same-line escaping pattern - escapeRegExp function
+  return new RegExp(escapeRegExp(input), 'gi')
+}
+
+export function escapeAndCreate(pattern: string) {
+  const escaped = escapeRegExp(pattern)
+  return new RegExp(escaped)
+}
+
+function escapeRegExp(str: string) {
+  return str.replace(/[.*+?^\${}()|[\\]\\\\]/g, '\\\\$&')
+}
+`,
+        language: 'typescript',
+        size: 300,
+      }
+
+      const findings = await scanFile(file)
+      const regexFindings = findByCategory(findings, 'dangerous_function').filter(f =>
+        f.title?.toLowerCase().includes('regex')
+      )
+
+      // Escaped regex should be skipped
+      expect(regexFindings.length).toBe(0)
+    })
+
+    it('should downgrade file path in desktop app to INFO', async () => {
+      // Desktop apps legitimately access filesystem
+      const file: ScanFile = {
+        path: 'apps/desktop/src/main/fileService.ts',
+        content: `
+import fs from 'fs'
+import path from 'path'
+
+export function readUserFile(filename: string) {
+  const userPath = path.join(app.getPath('userData'), filename)
+  return fs.readFileSync(userPath, 'utf-8')
+}
+`,
+        language: 'typescript',
+        size: 200,
+      }
+
+      const findings = await scanFile(file)
+      const filePathFindings = findByCategory(findings, 'dangerous_function').filter(f =>
+        f.title?.toLowerCase().includes('file path') || f.title?.toLowerCase().includes('path traversal')
+      )
+
+      // Desktop app file paths should be INFO (not MEDIUM/HIGH)
+      for (const f of filePathFindings) {
+        expect(['info', 'low']).toContain(f.severity)
+      }
+    })
+
+    it('should downgrade child_process in desktop app to MEDIUM', async () => {
+      // Desktop apps legitimately spawn processes
+      const file: ScanFile = {
+        path: 'packages/electron-app/src/ipcHandlers.ts',
+        content: `
+import { ipcMain } from 'electron'
+import { spawn } from 'child_process'
+
+ipcMain.handle('run-command', async (event, command, args) => {
+  // Spawning processes in Electron is expected
+  const process = spawn(command, args)
+  return new Promise((resolve, reject) => {
+    let output = ''
+    process.stdout.on('data', (data) => output += data)
+    process.on('close', (code) => resolve({ code, output }))
+    process.on('error', reject)
+  })
+})
+`,
+        language: 'typescript',
+        size: 400,
+      }
+
+      const findings = await scanFile(file)
+      const childProcessFindings = findByCategory(findings, 'dangerous_function').filter(f =>
+        f.title?.toLowerCase().includes('child_process')
+      )
+
+      // Desktop app child_process should be MEDIUM (not HIGH/CRITICAL)
+      for (const f of childProcessFindings) {
+        expect(['info', 'low', 'medium']).toContain(f.severity)
+      }
+    })
+
+    it('should skip Math.random in load balancing context', async () => {
+      // Load balancing/selection uses Math.random for distribution, not security
+      const file: ScanFile = {
+        path: 'src/utils/loadBalancer.ts',
+        content: `
+export function selectEndpoint(endpoints: string[], mode: 'random' | 'round-robin') {
+  if (mode === 'random') {
+    const index = Math.floor(Math.random() * endpoints.length)
+    return endpoints[index]
+  }
+  return endpoints[currentIndex++ % endpoints.length]
+}
+
+export function pickRandomServer(servers: Server[]) {
+  const keys = Object.keys(servers)
+  return servers[keys[Math.floor(Math.random() * keys.length)]]
+}
+`,
+        language: 'typescript',
+        size: 400,
+      }
+
+      const findings = await scanFile(file)
+      const mathRandomFindings = findByCategory(findings, 'dangerous_function').filter(f =>
+        f.title?.toLowerCase().includes('math.random')
+      )
+
+      // Load balancing Math.random should have info/low severity or be skipped
+      for (const f of mathRandomFindings) {
+        expect(['info', 'low']).toContain(f.severity)
+      }
+    })
+  })
+
+  describe('9. Security Headers Regressions', () => {
+    it('should NOT flag Express app with helmet as missing headers', async () => {
+      const file: ScanFile = {
+        path: 'src/server/app.ts',
+        content: `
+import express from 'express'
+import helmet from 'helmet'
+
+const app = express()
+app.use(helmet())
+app.use(express.json())
+
+app.get('/api/data', (req, res) => {
+  res.json({ ok: true })
+})
+`,
+        language: 'typescript',
+        size: 200,
+      }
+
+      const findings = await scanFile(file)
+      const headerFindings = findByCategory(findings, 'missing_security_headers')
+      // Express with helmet should have no medium+ findings
+      for (const f of headerFindings) {
+        expect(['info', 'low']).toContain(f.severity)
+      }
+    })
+
+    it('should NOT flag Next.js config with proper headers', async () => {
+      const file: ScanFile = {
+        path: 'next.config.mjs',
+        content: `
+const nextConfig = {
+  async headers() {
+    return [
+      {
+        source: '/:path*',
+        headers: [
+          { key: 'X-Frame-Options', value: 'DENY' },
+          { key: 'Strict-Transport-Security', value: 'max-age=31536000' },
+        ],
+      },
+    ]
+  },
+}
+export default nextConfig
+`,
+        language: 'javascript',
+        size: 300,
+      }
+
+      const findings = await scanFile(file)
+      const headerFindings = findByCategory(findings, 'missing_security_headers')
+      expect(headerFindings.length).toBe(0)
+    })
+
+    it('should NOT flag client-side React component for server headers', async () => {
+      const file: ScanFile = {
+        path: 'src/components/App.tsx',
+        content: `
+'use client'
+
+export function App() {
+  return <div>Hello</div>
+}
+`,
+        language: 'typescript',
+        size: 100,
+      }
+
+      const findings = await scanFile(file)
+      const headerFindings = findByCategory(findings, 'missing_security_headers')
+      expect(headerFindings.length).toBe(0)
+    })
+  })
+
+  describe('10. SSRF Regressions', () => {
+    it('should NOT flag fetch with env var URL', async () => {
+      const file: ScanFile = {
+        path: 'src/api/internal.ts',
+        content: `
+const API_URL = process.env.API_URL
+
+export async function getData() {
+  const response = await fetch(API_URL + '/data')
+  return response.json()
+}
+`,
+        language: 'typescript',
+        size: 150,
+      }
+
+      const findings = await scanFile(file)
+      const ssrfFindings = findByCategory(findings, 'ssrf')
+      expect(ssrfFindings.length).toBe(0)
+    })
+
+    it('should NOT flag client-side fetch as SSRF', async () => {
+      const file: ScanFile = {
+        path: 'src/components/Search.tsx',
+        content: `
+'use client'
+
+import { useState } from 'react'
+
+export function Search() {
+  const [q, setQ] = useState('')
+
+  const search = async () => {
+    const res = await fetch(\`/api/search?q=\${q}\`)
+    return res.json()
+  }
+
+  return <input value={q} onChange={(e) => setQ(e.target.value)} />
+}
+`,
+        language: 'typescript',
+        size: 250,
+      }
+
+      const findings = await scanFile(file)
+      const ssrfFindings = findByCategory(findings, 'ssrf')
+      expect(ssrfFindings.length).toBe(0)
+    })
+
+    it('should NOT flag fetch with allowlist validation', async () => {
+      const file: ScanFile = {
+        path: 'src/api/proxy.ts',
+        content: `
+import express from 'express'
+const allowedDomains = ['api.example.com']
+const app = express()
+
+app.post('/proxy', async (req, res) => {
+  const url = req.body.url
+  const parsed = new URL(url)
+  if (!allowedDomains.includes(parsed.hostname)) {
+    return res.status(403).json({ error: 'blocked' })
+  }
+  const response = await fetch(url)
+  res.json(await response.json())
+})
+`,
+        language: 'typescript',
+        size: 300,
+      }
+
+      const findings = await scanFile(file)
+      const ssrfFindings = findByCategory(findings, 'ssrf')
+      expect(ssrfFindings.length).toBe(0)
+    })
+  })
+
+  describe('11. Log Injection Regressions', () => {
+    it('should NOT flag console.error(err) in catch block', async () => {
+      const file: ScanFile = {
+        path: 'src/services/api.ts',
+        content: `
+export async function fetchData() {
+  try {
+    return await fetch('/api').then(r => r.json())
+  } catch (err) {
+    console.error(err)
+    throw err
+  }
+}
+`,
+        language: 'typescript',
+        size: 150,
+      }
+
+      const findings = await scanFile(file)
+      const logFindings = findByCategory(findings, 'log_injection')
+      expect(logFindings.length).toBe(0)
+    })
+
+    it('should NOT flag static string logging', async () => {
+      const file: ScanFile = {
+        path: 'src/server/init.ts',
+        content: `
+const logger = require('pino')()
+
+logger.info('Server started on port 3000')
+logger.info('Environment: production')
+console.log('Ready')
+`,
+        language: 'typescript',
+        size: 100,
+      }
+
+      const findings = await scanFile(file)
+      const logFindings = findByCategory(findings, 'log_injection')
+      expect(logFindings.length).toBe(0)
+    })
+
+    it('should NOT flag logging internal IDs', async () => {
+      const file: ScanFile = {
+        path: 'src/services/user.ts',
+        content: `
+const logger = require('pino')()
+
+export function processUser(user: { id: string }) {
+  logger.info({ userId: user.id })
+  console.log('Processing user:', user.id)
+}
+`,
+        language: 'typescript',
+        size: 150,
+      }
+
+      const findings = await scanFile(file)
+      const logFindings = findByCategory(findings, 'log_injection')
+      expect(logFindings.length).toBe(0)
+    })
+
+    it('should NOT flag Morgan middleware', async () => {
+      const file: ScanFile = {
+        path: 'src/server/app.ts',
+        content: `
+import express from 'express'
+import morgan from 'morgan'
+
+const app = express()
+app.use(morgan('combined'))
+
+app.get('/api/data', (req, res) => {
+  res.json({ ok: true })
+})
+`,
+        language: 'typescript',
+        size: 150,
+      }
+
+      const findings = await scanFile(file)
+      const logFindings = findByCategory(findings, 'log_injection')
+      expect(logFindings.length).toBe(0)
+    })
+  })
+
+  describe('12. XXE Regressions', () => {
+    it('should NOT flag Python file with defusedxml import', async () => {
+      const file: ScanFile = {
+        path: 'src/parser.py',
+        content: `
+import defusedxml.ElementTree as ET
+
+def parse_xml(data):
+    tree = ET.parse(data)
+    return tree.getroot()
+`,
+        language: 'python',
+        size: 100,
+      }
+
+      const findings = await scanFile(file)
+      const xxeFindings = findByCategory(findings, 'xxe')
+      expect(xxeFindings.length).toBe(0)
+    })
+
+    it('should NOT flag Java with DTD disabled', async () => {
+      const file: ScanFile = {
+        path: 'src/XmlService.java',
+        content: `
+import javax.xml.parsers.DocumentBuilderFactory;
+
+public class SafeXml {
+    public void parse(String xml) throws Exception {
+        DocumentBuilderFactory factory = DocumentBuilderFactory.newInstance();
+        factory.setFeature("http://apache.org/xml/features/disallow-doctype-decl", true);
+        factory.newDocumentBuilder().parse(xml);
+    }
+}
+`,
+        language: 'java',
+        size: 200,
+      }
+
+      const findings = await scanFile(file)
+      const xxeFindings = findByCategory(findings, 'xxe')
+      expect(xxeFindings.length).toBe(0)
+    })
+
+    it('should produce info at most for XML parsing in test file', async () => {
+      const file: ScanFile = {
+        path: 'src/__tests__/xml.test.ts',
+        content: `
+import xml2js from 'xml2js'
+
+describe('XML parsing', () => {
+  it('parses XML', () => {
+    xml2js.parseString('<root/>', (err, result) => {
+      expect(result).toBeDefined()
+    })
+  })
+})
+`,
+        language: 'typescript',
+        size: 150,
+      }
+
+      const findings = await scanFile(file)
+      const xxeFindings = findByCategory(findings, 'xxe')
+      for (const f of xxeFindings) {
+        expect(f.severity).toBe('info')
+      }
+    })
+  })
+
+  describe('13. Sprint 5 FP Fixes', () => {
+    it('should skip regex with multi-line .replaceAll escaping', async () => {
+      // Multi-line escaping pattern - escaping happens on previous lines before RegExp
+      const file: ScanFile = {
+        path: 'src/utils/matcher.ts',
+        content: `
+const regexStr = pattern
+  .replaceAll(/[$()*+.?[\\]^{|}]/g, '\\\\$&')
+  .replaceAll('\\\\(.*\\\\)', '.*');
+return new RegExp(\`^\${regexStr}$\`);
+`,
+        language: 'typescript',
+        size: 200,
+      }
+      const findings = await scanFile(file)
+      const regexFindings = findByCategory(findings, 'dangerous_function')
+        .filter(f => f.title?.toLowerCase().includes('regex'))
+      expect(regexFindings.length).toBe(0)
+    })
+
+    it('should skip new RegExp(existingRegex.source)', async () => {
+      // Using .source from an existing RegExp is safe - it's already validated
+      const file: ScanFile = {
+        path: 'src/utils/regex.ts',
+        content: `
+const globalPattern = pattern.global
+  ? pattern
+  : new RegExp(pattern.source, pattern.flags + 'g');
+`,
+        language: 'typescript',
+        size: 150,
+      }
+      const findings = await scanFile(file)
+      const regexFindings = findByCategory(findings, 'dangerous_function')
+        .filter(f => f.title?.toLowerCase().includes('regex'))
+      expect(regexFindings.length).toBe(0)
+    })
+
+    it('should skip readdir + pMap iteration', async () => {
+      // Paths from fs.readdir iterated via pMap are filesystem-controlled
+      const file: ScanFile = {
+        path: 'src/cache/reader.ts',
+        content: `
+import fs from 'fs/promises'
+import pMap from 'p-map'
+
+const files = await fs.readdir(cachePath);
+const results = await pMap(files, async (file) => {
+  return fs.readFile(\`\${cachePath}/\${file}\`);
+});
+`,
+        language: 'typescript',
+        size: 200,
+      }
+      const findings = await scanFile(file)
+      const pathFindings = findByCategory(findings, 'dangerous_function')
+        .filter(f => f.title?.toLowerCase().includes('file path') || f.title?.toLowerCase().includes('path traversal'))
+      expect(pathFindings.length).toBe(0)
+    })
+
+    it('should skip readdir + .map() iteration', async () => {
+      // Paths from fs.readdir iterated via .map() are filesystem-controlled
+      const file: ScanFile = {
+        path: 'src/cache/loader.ts',
+        content: `
+import fs from 'fs/promises'
+
+const files = await fs.readdir(cachePath);
+const results = files.map((file) => {
+  return \`\${cachePath}/\${file}\`;
+});
+`,
+        language: 'typescript',
+        size: 200,
+      }
+      const findings = await scanFile(file)
+      const pathFindings = findByCategory(findings, 'dangerous_function')
+        .filter(f => f.title?.toLowerCase().includes('file path') || f.title?.toLowerCase().includes('path traversal'))
+      expect(pathFindings.length).toBe(0)
+    })
+
+    it('should skip readdir + Promise.all iteration', async () => {
+      // Paths from fs.readdir with Promise.all mapping are filesystem-controlled
+      const file: ScanFile = {
+        path: 'src/cache/processor.ts',
+        content: `
+import fs from 'fs/promises'
+
+const files = await fs.readdir(cachePath);
+const results = await Promise.all(files.map(async (file) => {
+  return fs.readFile(\`\${cachePath}/\${file}\`);
+}));
+`,
+        language: 'typescript',
+        size: 200,
+      }
+      const findings = await scanFile(file)
+      const pathFindings = findByCategory(findings, 'dangerous_function')
+        .filter(f => f.title?.toLowerCase().includes('file path') || f.title?.toLowerCase().includes('path traversal'))
+      expect(pathFindings.length).toBe(0)
+    })
+
+    it('should skip Object.entries over hardcoded object', async () => {
+      // Iterating over hardcoded objects is safe - not user input
+      const file: ScanFile = {
+        path: 'src/fonts/loader.ts',
+        content: `
+import fs from 'fs/promises'
+
+const fontFiles = {
+  'font1.ttf': 'https://example.com/font1.ttf',
+  'font2.ttf': 'https://example.com/font2.ttf',
+};
+for (const [filename, url] of Object.entries(fontFiles)) {
+  await fs.writeFile(\`/fonts/\${filename}\`, await fetch(url).then(r => r.arrayBuffer()));
+}
+`,
+        language: 'typescript',
+        size: 250,
+      }
+      const findings = await scanFile(file)
+      const pathFindings = findByCategory(findings, 'dangerous_function')
+        .filter(f => f.title?.toLowerCase().includes('file path') || f.title?.toLowerCase().includes('path traversal'))
+      expect(pathFindings.length).toBe(0)
+    })
+
+    it('should skip static subprocess list args split across multiple lines', async () => {
+      // Multi-line subprocess.Popen(["xprop", "-root", ...]) is safe — all static strings
+      const file: ScanFile = {
+        path: 'utils/wtf.py',
+        content: `
+import subprocess
+
+def get_active_window():
+    output = subprocess.Popen(
+        ["xprop", "-root", "_NET_ACTIVE_WINDOW"],
+        stdout=subprocess.PIPE
+    ).communicate()[0]
+    return output
+`,
+        language: 'python',
+        size: 200,
+      }
+      const findings = await scanFile(file)
+      const subprocessFindings = findByCategory(findings, 'dangerous_function')
+        .filter(f => f.title?.toLowerCase().includes('subprocess') || f.title?.toLowerCase().includes('os.system'))
+      // Static multi-line list args should produce no HIGH finding
+      for (const f of subprocessFindings) {
+        expect(['info', 'low']).toContain(f.severity)
+      }
+      // Actually should be fully skipped (all static)
+      expect(subprocessFindings.length).toBe(0)
+    })
+
+    it('should produce LOW for multi-line subprocess list with variable args', async () => {
+      // subprocess.Popen(["xwininfo", "-id", window_id]) — list with a variable
+      const file: ScanFile = {
+        path: 'utils/wtf.py',
+        content: `
+import subprocess
+
+def get_window_info(window_id):
+    output = subprocess.Popen(
+        ["xwininfo", "-id", window_id],
+        stdout=subprocess.PIPE
+    ).communicate()[0]
+    return output
+`,
+        language: 'python',
+        size: 200,
+      }
+      const findings = await scanFile(file)
+      const subprocessFindings = findByCategory(findings, 'dangerous_function')
+        .filter(f => f.title?.toLowerCase().includes('subprocess') || f.title?.toLowerCase().includes('os.system'))
+      // List args with variables should be LOW at most
+      for (const f of subprocessFindings) {
+        expect(['info', 'low']).toContain(f.severity)
+      }
+    })
+
+    it('should produce LOW for subprocess called with a variable that resolves to a list', async () => {
+      // args = ["osascript", "-e", script]; subprocess.check_output(args, ...)
+      const file: ScanFile = {
+        path: 'utils/run_applescript.py',
+        content: `
+import subprocess
+
+def run_applescript(script):
+    args = ["osascript", "-e", script]
+    return subprocess.check_output(args, stderr=subprocess.PIPE).decode()
+`,
+        language: 'python',
+        size: 200,
+      }
+      const findings = await scanFile(file)
+      const subprocessFindings = findByCategory(findings, 'dangerous_function')
+        .filter(f => f.title?.toLowerCase().includes('subprocess') || f.title?.toLowerCase().includes('os.system'))
+      // Variable resolving to list with dynamic element → LOW
+      for (const f of subprocessFindings) {
+        expect(['info', 'low']).toContain(f.severity)
+      }
+    })
+
+    it('should preserve HIGH for f-string direct arg to subprocess', async () => {
+      // subprocess.check_output(f"curl {api_base}") — real command injection risk
+      const file: ScanFile = {
+        path: 'utils/system_debug_info.py',
+        content: `
+import subprocess
+
+def check_api(api_base):
+    result = subprocess.check_output(f"curl {api_base}", shell=False)
+    return result.decode()
+`,
+        language: 'python',
+        size: 150,
+      }
+      const findings = await scanFile(file)
+      const subprocessFindings = findByCategory(findings, 'dangerous_function')
+        .filter(f => f.title?.toLowerCase().includes('subprocess') || f.title?.toLowerCase().includes('os.system'))
+      // f-string direct arg → HIGH (true positive)
+      const hasSevere = subprocessFindings.some(f => f.severity === 'high' || f.severity === 'critical')
+      expect(hasSevere).toBe(true)
+    })
+
+    it('should preserve HIGH for subprocess with shell=True', async () => {
+      // subprocess.run(f"cd {path} && semgrep", shell=True) — real injection risk
+      const file: ScanFile = {
+        path: 'utils/scan_code.py',
+        content: `
+import subprocess
+
+def scan(path):
+    result = subprocess.run(
+        f"cd {path} && semgrep --config auto",
+        shell=True,
+        capture_output=True
+    )
+    return result.stdout.decode()
+`,
+        language: 'python',
+        size: 200,
+      }
+      const findings = await scanFile(file)
+      const subprocessFindings = findByCategory(findings, 'dangerous_function')
+        .filter(f => f.title?.toLowerCase().includes('subprocess') || f.title?.toLowerCase().includes('os.system'))
+      // shell=True → HIGH (true positive)
+      const hasSevere = subprocessFindings.some(f => f.severity === 'high' || f.severity === 'critical')
+      expect(hasSevere).toBe(true)
+    })
+
+    it('should skip subprocess.run with static list args on single line', async () => {
+      // subprocess.run(["ollama", "list"], ...) — fully static, single line
+      const file: ScanFile = {
+        path: 'utils/local_setup.py',
+        content: `
+import subprocess
+
+def check_ollama():
+    result = subprocess.run(
+        ["ollama", "list"],
+        capture_output=True, text=True
+    )
+    return result.stdout
+`,
+        language: 'python',
+        size: 150,
+      }
+      const findings = await scanFile(file)
+      const subprocessFindings = findByCategory(findings, 'dangerous_function')
+        .filter(f => f.title?.toLowerCase().includes('subprocess') || f.title?.toLowerCase().includes('os.system'))
+      expect(subprocessFindings.length).toBe(0)
+    })
+
+    it('should skip Object.keys over hardcoded object for file paths', async () => {
+      // Object.keys over const object is also safe
+      const file: ScanFile = {
+        path: 'src/assets/loader.ts',
+        content: `
+import fs from 'fs/promises'
+
+const assetPaths = {
+  logo: '/assets/logo.png',
+  icon: '/assets/icon.svg',
+};
+for (const key of Object.keys(assetPaths)) {
+  await fs.access(\`/public/\${key}\`);
+}
+`,
+        language: 'typescript',
+        size: 200,
+      }
+      const findings = await scanFile(file)
+      const pathFindings = findByCategory(findings, 'dangerous_function')
+        .filter(f => f.title?.toLowerCase().includes('file path') || f.title?.toLowerCase().includes('path traversal'))
+      expect(pathFindings.length).toBe(0)
+    })
+  })
 })