aike-code-sentinel 0.1.0__py3-none-any.whl

code_sentinel/fixer.py

@@ -0,0 +1,329 @@
+"""
+自动修复引擎 — Code Sentinel 修复模块
+======================================
+对 scanner.py 检测到的问题生成修复建议和 diff。
+
+集成 Genome Core 四层自审 (full_review) 对修复代码进行验证。
+"""
+
+import os
+import difflib
+from dataclasses import dataclass, field
+from pathlib import Path
+from typing import List, Optional
+
+# ── Genome Core 集成 ──
+try:
+    from genome_core.security import full_review, check_dangerous
+    HAS_GENOME_CORE = True
+except ImportError:
+    HAS_GENOME_CORE = False
+
+
+@dataclass
+class FixAction:
+    """单个修复操作"""
+    file: str
+    line: int
+    description: str
+    original_code: str
+    fixed_code: str
+    category: str  # security / performance / smell / dependency
+    confidence: float = 0.0
+
+    def to_diff(self) -> str:
+        """生成统一 diff 格式"""
+        original_lines = self.original_code.split("\n")
+        fixed_lines = self.fixed_code.split("\n")
+        diff = difflib.unified_diff(
+            original_lines,
+            fixed_lines,
+            fromfile=f"a/{self.file}",
+            tofile=f"b/{self.file}",
+            lineterm="",
+        )
+        return "\n".join(diff)
+
+
+@dataclass
+class FixResult:
+    """修复结果"""
+    file: str
+    actions: List[FixAction]
+    genome_review_passed: bool = False
+    genome_review_details: dict = field(default_factory=dict)
+
+    def to_dict(self) -> dict:
+        return {
+            "file": self.file,
+            "actions": [
+                {
+                    "file": a.file,
+                    "line": a.line,
+                    "description": a.description,
+                    "category": a.category,
+                    "confidence": a.confidence,
+                    "diff": a.to_diff(),
+                }
+                for a in self.actions
+            ],
+            "genome_review_passed": self.genome_review_passed,
+        }
+
+
+# ── 修复模式库 ──
+
+FIX_TEMPLATES = {
+    "eval": {
+        "description": "将 eval() 替换为安全替代方案（ast.literal_eval 或 json.loads）",
+        "fix": "ast.literal_eval({arg})",
+        "import_add": "import ast",
+    },
+    "exec": {
+        "description": "避免使用 exec()，改用函数封装或字典映射",
+        "fix": "# TODO: 重构 exec() 调用 — 改用函数封装或字典映射\n# 原代码: {original}",
+        "import_add": None,
+    },
+    "os.system": {
+        "description": "将 os.system() 替换为 subprocess.run(..., check=True) 并过滤输入",
+        "fix": "subprocess.run({args!r}, shell=True, check=True)",
+        "import_add": "import subprocess",
+    },
+    "bare_except": {
+        "description": "为裸 except 指定具体的异常类型",
+        "fix": "except Exception as e:",
+    },
+    "file_read": {
+        "description": "对大文件使用分块读取模式",
+        "fix": "for chunk in iter(lambda: {fp}.read(8192), b''):\n    process(chunk)",
+    },
+}
+
+
+class CodeFixer:
+    """Code Sentinel 修复引擎
+
+    根据扫描结果自动生成修复建议和 diff，
+    并通过 Genome Core 的四层自审对修复代码进行验证。
+    """
+
+    def __init__(self):
+        self._results: List[FixResult] = []
+
+    def generate_fixes(self, scan_results: dict) -> List[FixResult]:
+        """根据扫描结果生成所有修复"""
+        self._results.clear()
+
+        for category_key in ("security", "performance", "smell"):
+            for issue in scan_results.get(category_key, []):
+                fix = self._generate_single_fix(category_key, issue)
+                if fix:
+                    self._results.append(fix)
+
+        # 依赖问题：生成 requirements.txt 修复
+        for dep_issue in scan_results.get("dependency", []):
+            fix = self._fix_dependency(dep_issue)
+            if fix:
+                self._results.append(fix)
+
+        return self._results
+
+    def _generate_single_fix(self, category: str, issue: dict) -> Optional[FixResult]:
+        """为单个问题生成修复"""
+        filepath = issue.get("file", "")
+        line = issue.get("line", 0)
+        code = issue.get("code", "")
+        description = issue.get("description", "")
+
+        # 安全检查修复
+        if category == "security":
+            fix_action = self._fix_security_issue(issue)
+            if fix_action:
+                # 通过 Genome Core 四层自审验证修复
+                review_passed = True
+                review_details = {}
+                if HAS_GENOME_CORE:
+                    review_passed, review_details = full_review(fix_action.fixed_code)
+
+                return FixResult(
+                    file=filepath,
+                    actions=[fix_action],
+                    genome_review_passed=review_passed,
+                    genome_review_details=review_details,
+                )
+
+        # 代码异味修复
+        if category == "smell":
+            fix_action = self._fix_smell_issue(issue)
+            if fix_action:
+                return FixResult(file=filepath, actions=[fix_action])
+
+        # 性能问题修复
+        if category == "performance":
+            fix_action = self._fix_performance_issue(issue)
+            if fix_action:
+                return FixResult(file=filepath, actions=[fix_action])
+
+        return None
+
+    def _fix_security_issue(self, issue: dict) -> Optional[FixAction]:
+        """生成安全修复"""
+        code = issue.get("code", "")
+        filepath = issue.get("file", "")
+        line = issue.get("line", 0)
+
+        # 检测危险函数类型
+        for keyword, template in FIX_TEMPLATES.items():
+            if keyword in code:
+                if keyword in ("eval", "exec"):
+                    if keyword == "eval":
+                        # 提取 eval 的参数
+                        arg_match = code[code.find("(") + 1 : code.rfind(")")].strip()
+                        if arg_match:
+                            fixed = f"ast.literal_eval({arg_match})"
+                            return FixAction(
+                                file=filepath,
+                                line=line,
+                                description=template["description"],
+                                original_code=code,
+                                fixed_code=fixed,
+                                category="security",
+                                confidence=0.85,
+                            )
+                    else:
+                        # exec 无法直接替换，加注释提示
+                        fixed = f"# FIXME: 避免使用 exec()\n# " + code
+                        return FixAction(
+                            file=filepath,
+                            line=line,
+                            description=template["description"],
+                            original_code=code,
+                            fixed_code=fixed,
+                            category="security",
+                            confidence=0.7,
+                        )
+
+                if "os.system" in code:
+                    import re
+                    args_match = re.search(r"os\.system\((.+)\)", code)
+                    if args_match:
+                        args = args_match.group(1)
+                        fixed = f"subprocess.run({args}, shell=True, check=True)"
+                        return FixAction(
+                            file=filepath,
+                            line=line,
+                            description=template["description"],
+                            original_code=code,
+                            fixed_code=fixed,
+                            category="security",
+                            confidence=0.8,
+                        )
+
+        return None
+
+    def _fix_smell_issue(self, issue: dict) -> Optional[FixAction]:
+        """生成代码异味修复"""
+        description = issue.get("description", "")
+        filepath = issue.get("file", "")
+        line = issue.get("line", 0)
+        code = issue.get("code", "")
+
+        if "裸 except" in description:
+            # 修复裸 except
+            fixed = "except Exception as e:"
+            return FixAction(
+                file=filepath,
+                line=line,
+                description="为裸 except 指定具体的异常类型 Exception",
+                original_code=code,
+                fixed_code=fixed,
+                category="smell",
+                confidence=0.95,
+            )
+
+        if "参数过多" in description:
+            fixed = code + "\n    # TODO: 考虑使用 *args, **kwargs 或数据类重构签名"
+            return FixAction(
+                file=filepath,
+                line=line,
+                description="参数过多，建议使用数据类或 *args/**kwargs",
+                original_code=code,
+                fixed_code=fixed,
+                category="smell",
+                confidence=0.6,
+            )
+
+        return None
+
+    def _fix_performance_issue(self, issue: dict) -> Optional[FixAction]:
+        """生成性能修复"""
+        description = issue.get("description", "")
+        filepath = issue.get("file", "")
+        line = issue.get("line", 0)
+        code = issue.get("code", "")
+
+        if "文件一次性读取" in code or "文件一次性读取" in description:
+            # 修复大文件读取
+            fixed = "# 使用分块读取替代:\nfor chunk in iter(lambda: f.read(8192), b''):\n    process(chunk)"
+            return FixAction(
+                file=filepath,
+                line=line,
+                description="大文件应使用分块读取（chunked reading）",
+                original_code=code,
+                fixed_code=fixed,
+                category="performance",
+                confidence=0.8,
+            )
+
+        return None
+
+    def _fix_dependency(self, issue: dict) -> Optional[FixResult]:
+        """生成依赖修复"""
+        filepath = issue.get("file", "")
+        line = issue.get("line", 0)
+        package = issue.get("package", "")
+        version = issue.get("version", "")
+
+        if not package:
+            return None
+
+        # 生成修复后的版本行
+        safe_versions = {
+            "requests": ">=2.31.0",
+            "urllib3": ">=1.26.18",
+            "cryptography": ">=41.0.0",
+            "django": ">=4.2.7",
+            "flask": ">=2.3.3",
+            "pillow": ">=10.0.1",
+            "pyyaml": ">=6.0",
+            "jinja2": ">=3.1.3",
+            "werkzeug": ">=3.0.3",
+            "numpy": ">=1.26.0",
+            "protobuf": ">=3.18.3",
+        }
+
+        safe_ver = safe_versions.get(package.lower())
+        if not safe_ver:
+            return None
+
+        original_line = f"{package}{version}" if version else package
+        fixed_line = f"{package}{safe_ver}"
+
+        action = FixAction(
+            file=filepath,
+            line=line,
+            description=f"升级 {package} 至安全版本（{safe_ver}）",
+            original_code=original_line,
+            fixed_code=fixed_line,
+            category="dependency",
+            confidence=0.9,
+        )
+
+        return FixResult(
+            file=filepath,
+            actions=[action],
+            genome_review_passed=True,
+        )
+
+    def get_results(self) -> List[FixResult]:
+        return self._results