ikanban 0.3.2 → 0.3.3

package/package.json

@@ -1,6 +1,6 @@
 {
   "name": "ikanban",
-  "version": "0.3.2",
+  "version": "0.3.3",
   "description": "iKanban CLI: AI and security scans of your own repo, with results filed into iKanban",
   "bin": { "ikanban": "bin/ikanban.js" },
   "files": ["bin", "lib", "hooks", "scanners", "README.md"],

package/scanners/ikanban-secscan.py

@@ -64,7 +64,7 @@ from pathlib import Path
 # that npm no longer hosts the package. Starting at 1.0.0 rather than continuing
 # the npm package's 0.1.x line: that counter belonged to the wrapper, not to
 # this file, and reusing it would suggest a continuity that does not exist.
-SECSCAN_VERSION = "1.2.1"
+SECSCAN_VERSION = "1.3.0"
 
 SEVERITIES = ["critical", "high", "medium", "low", "info"]
 SEVERITY_RANK = {s: i for i, s in enumerate(SEVERITIES)}
@@ -430,6 +430,50 @@ def git_ignored(root: Path, rels: list) -> set:
     return {l.strip() for l in p.stdout.splitlines() if l.strip()}
 
 
+# Plan 11 G6: test code inside a normal file holds fake keys as often as a test folder
+# does (a Rust #[cfg(test)] module, a #[test] fn, a Python test_ function). Its lines are
+# suppressed and counted like a test path.
+# ponytail: braces are counted without parsing strings or comments, so a brace inside a
+# string can end a Rust block early; a real parser is the upgrade if that misses cases.
+RUST_TEST_ATTR = re.compile(r"^\s*#\[(cfg\(test\)|test)\]")
+PY_TEST_DEF = re.compile(r"^(\s*)(async\s+)?def test_\w*\s*\(")
+
+
+def test_code_lines(rel: str, text: str) -> set:
+    lines = text.splitlines()
+    out = set()
+    if rel.endswith(".rs"):
+        i = 0
+        while i < len(lines):
+            if not RUST_TEST_ATTR.match(lines[i]):
+                i += 1
+                continue
+            depth, opened, j = 0, False, i
+            while j < len(lines):
+                depth += lines[j].count("{") - lines[j].count("}")
+                opened = opened or "{" in lines[j]
+                out.add(j + 1)
+                if opened and depth <= 0:
+                    break
+                j += 1
+            i = j + 1
+    elif rel.endswith(".py"):
+        i = 0
+        while i < len(lines):
+            m = PY_TEST_DEF.match(lines[i])
+            if not m:
+                i += 1
+                continue
+            indent = len(m.group(1))
+            out.add(i + 1)
+            j = i + 1
+            while j < len(lines) and (not lines[j].strip() or len(lines[j]) - len(lines[j].lstrip()) > indent):
+                out.add(j + 1)
+                j += 1
+            i = j
+    return out
+
+
 def scan_secrets(root: Path) -> Section:
     sec = Section("Committed secrets")
     sec.ran.append(f"{len(SECRET_RULES)} high-confidence patterns")
@@ -441,13 +485,16 @@ def scan_secrets(root: Path) -> Section:
             text = path.read_text(errors="ignore")
         except OSError:
             continue
+        in_test = None
         for _id, severity, rx, desc in SECRET_RULES:
             for m in rx.finditer(text):
                 line_no = text.count("\n", 0, m.start()) + 1
                 line = text.splitlines()[line_no - 1] if line_no <= len(text.splitlines()) else ""
                 if EXAMPLE_MARKERS.search(line):
                     continue
-                if is_fixture:
+                if in_test is None:
+                    in_test = test_code_lines(rel, text)
+                if is_fixture or line_no in in_test:
                     suppressed += 1
                     continue
                 hit = m.group(0)
@@ -477,7 +524,7 @@ def scan_secrets(root: Path) -> Section:
 
     if suppressed:
         sec.skipped.append(
-            f"{suppressed} match(es) in test/fixture/doc paths were suppressed "
+            f"{suppressed} match(es) in test code, test/fixture/doc paths were suppressed "
             "as expected fake credentials — re-check by hand if a real secret "
             "could have been committed to a test file")
     return sec