attackmap 0.3.0__tar.gz → 0.3.2__tar.gz

{attackmap-0.3.0/src/attackmap.egg-info → attackmap-0.3.2}/PKG-INFO

@@ -1,6 +1,6 @@
 Metadata-Version: 2.4
 Name: attackmap
-Version: 0.3.0
+Version: 0.3.2
 Summary: AI-assisted defensive security analyzer for codebases — scans a repository, models assets and controls, finds cross-cutting weaknesses, and generates an evidence-grounded review with MITRE ATT&CK mappings and detection-engineering hints.
 Author: AttackMap Contributors
 Author-email: Matthew Davis <matthewd@matthewd.xyz>
@@ -75,7 +75,7 @@ managers who need to triage an unfamiliar codebase.
 [![Python: 3.11+](https://img.shields.io/badge/Python-3.11%2B-blue.svg)](https://www.python.org/)
 [![PyPI](https://img.shields.io/pypi/v/attackmap.svg)](https://pypi.org/project/attackmap/)
 
-> **Status: beta (v0.3.0).** Core engine and 14 analyzer plugins are published
+> **Status: beta (v0.3.2).** Core engine and 14 analyzer plugins are published
 > to PyPI, Homebrew, and GHCR and validated against real-world codebases.
 > AttackMap is heuristic by design — findings are confidence-tiered evidence,
 > not proof. See [Project status](#project-status) for what's solid and what's
@@ -541,7 +541,7 @@ introduces a new HIGH finding.
 
 ## Project status
 
-AttackMap is **beta** (v0.3.0) — published and validated on real codebases, but
+AttackMap is **beta** (v0.3.2) — published and validated on real codebases, but
 pre-1.0 and heuristic.
 
 **Solid today:**

{attackmap-0.3.0 → attackmap-0.3.2}/README.md

@@ -16,7 +16,7 @@ managers who need to triage an unfamiliar codebase.
 [![Python: 3.11+](https://img.shields.io/badge/Python-3.11%2B-blue.svg)](https://www.python.org/)
 [![PyPI](https://img.shields.io/pypi/v/attackmap.svg)](https://pypi.org/project/attackmap/)
 
-> **Status: beta (v0.3.0).** Core engine and 14 analyzer plugins are published
+> **Status: beta (v0.3.2).** Core engine and 14 analyzer plugins are published
 > to PyPI, Homebrew, and GHCR and validated against real-world codebases.
 > AttackMap is heuristic by design — findings are confidence-tiered evidence,
 > not proof. See [Project status](#project-status) for what's solid and what's
@@ -482,7 +482,7 @@ introduces a new HIGH finding.
 
 ## Project status
 
-AttackMap is **beta** (v0.3.0) — published and validated on real codebases, but
+AttackMap is **beta** (v0.3.2) — published and validated on real codebases, but
 pre-1.0 and heuristic.
 
 **Solid today:**

{attackmap-0.3.0 → attackmap-0.3.2}/pyproject.toml

@@ -4,7 +4,7 @@ build-backend = "setuptools.build_meta"
 
 [project]
 name = "attackmap"
-version = "0.3.0"
+version = "0.3.2"
 description = "AI-assisted defensive security analyzer for codebases — scans a repository, models assets and controls, finds cross-cutting weaknesses, and generates an evidence-grounded review with MITRE ATT&CK mappings and detection-engineering hints."
 readme = "README.md"
 requires-python = ">=3.11"

{attackmap-0.3.0 → attackmap-0.3.2}/src/attackmap/__init__.py

@@ -1,2 +1,2 @@
 __all__ = ["__version__"]
-__version__ = "0.3.0"
+__version__ = "0.3.2"

{attackmap-0.3.0 → attackmap-0.3.2}/src/attackmap/scanner.py

@@ -14,7 +14,7 @@ from .anomalies import find_anomalies
 from .authz import analyze_authz
 from .crypto import find_crypto_weaknesses
 from .sbom import analyze_sbom
-from .srcpaths import is_test_file
+from .srcpaths import is_test_file, is_vendored_file
 from .weaknesses import find_code_weaknesses
 from .webhardening import find_web_hardening_issues
 from .sdk.models import AuthHint, DatabaseHint, ExternalCall, Route, ScanResult, SecretHint
@@ -594,9 +594,11 @@ def scan_repo(
 
         _append_hardcoded_secret_hints(result, relative, content)
 
-        # The weakness passes below are noise in test scaffolding, so skip
-        # test/spec files by default (#67; ATTACKMAP_INCLUDE_TESTS opts in).
-        if not is_test_file(relative):
+        # The weakness passes below are noise in test scaffolding (#67) and in
+        # vendored/minified third-party code (#95) — a bug in a dependency the
+        # project doesn't maintain isn't this repo's finding. Skip both by
+        # default (ATTACKMAP_INCLUDE_TESTS / ATTACKMAP_INCLUDE_VENDORED opt in).
+        if not is_test_file(relative) and not is_vendored_file(relative):
             # Insecure crypto / weak randomness (#70). Content is already
             # read, so this rides the per-file pass rather than re-walking.
             result.crypto_weaknesses.extend(find_crypto_weaknesses(content, relative))
@@ -724,6 +726,8 @@ def _append_hardcoded_secret_hints(result: ScanResult, relative: str, content: s
             continue
         if not _looks_like_secret_candidate(literal):
             continue
+        if _looks_like_charset(literal):
+            continue  # base64/base32/hex alphabet constant, not a secret (#96)
         if _shannon_entropy(literal) < _ENTROPY_THRESHOLD:
             continue
         line = _line_of(content, pos)
@@ -743,6 +747,20 @@ def _append_hardcoded_secret_hints(result: ScanResult, relative: str, content: s
         )
 
 
+# Sequential alphabet runs that mark a well-known charset/alphabet constant
+# (base64/base32/base16 digit strings) — high-entropy but not a secret (#96).
+_CHARSET_MARKERS = (
+    "abcdefghijklmnop",  # lowercase alphabet run (base64/base32/base36)
+    "ABCDEFGHIJKLMNOP",  # uppercase alphabet run
+    "0123456789abcdef",  # lower hex
+    "0123456789ABCDEF",  # upper hex
+)
+
+
+def _looks_like_charset(value: str) -> bool:
+    return any(marker in value for marker in _CHARSET_MARKERS)
+
+
 def _is_jwt_shape(literal: str) -> bool:
     """Verify the header segment of a candidate JWT decodes to a JSON
     object with an `alg` field. Cheap and precise enough to keep the

{attackmap-0.3.0 → attackmap-0.3.2}/src/attackmap/srcpaths.py

@@ -80,4 +80,41 @@ def is_infra_route(path: str) -> bool:
     return _INFRA_ROUTE_RE.search(path) is not None
 
 
-__all__ = ["is_test_file", "is_infra_route"]
+# Directory segments that hold third-party / vendored code the project doesn't
+# maintain. Flagging weaknesses here is noise about someone else's dependency.
+_VENDORED_DIR_SEGMENTS = frozenset(
+    {
+        "node_modules",
+        "bower_components",
+        "vendor",
+        "vendored",
+        "third_party",
+        "third-party",
+        "thirdparty",
+        "external",
+        "externals",
+        "site-packages",
+        "jspm_packages",
+    }
+)
+
+# Minified / bundled build artifacts — not human-authored source.
+_MINIFIED_FILE_RE = re.compile(r"\.min\.(?:js|css|mjs|cjs)$|\.bundle\.js$", re.IGNORECASE)
+
+
+def is_vendored_file(rel_path: str) -> bool:
+    """Return True if ``rel_path`` is vendored third-party or minified/bundled
+    code (e.g. ``UserInterface/External/three.js``, ``vendor/…``, ``*.min.js``).
+
+    Honors ``ATTACKMAP_INCLUDE_VENDORED`` to scan it anyway (e.g. auditing a
+    pinned/forked dependency)."""
+    if os.environ.get("ATTACKMAP_INCLUDE_VENDORED"):
+        return False
+    norm = rel_path.replace("\\", "/")
+    parts = norm.split("/")
+    if any(segment.lower() in _VENDORED_DIR_SEGMENTS for segment in parts[:-1]):
+        return True
+    return _MINIFIED_FILE_RE.search(parts[-1]) is not None
+
+
+__all__ = ["is_test_file", "is_infra_route", "is_vendored_file"]

{attackmap-0.3.0 → attackmap-0.3.2}/src/attackmap/taint.py

@@ -268,7 +268,13 @@ def analyze_taint(scan: ScanResult, root: str | Path | None = None) -> list[Tain
 def _index_repo(root: Path) -> dict[str, Path]:
     """Return {rel_path: abs_path} for every taint-relevant source file."""
     out: dict[str, Path] = {}
-    skip_dirs = {".git", "node_modules", "__pycache__", "dist", "build", ".venv", "venv"}
+    skip_dirs = {
+        ".git", "node_modules", "__pycache__", "dist", "build", ".venv", "venv",
+        # Vendored third-party trees (#95) — import-walking someone else's
+        # bundled library adds sinks the project doesn't own.
+        "bower_components", "vendor", "third_party", "third-party",
+        "external", "externals", "jspm_packages", "site-packages",
+    }
     for path in root.rglob("*"):
         if not path.is_file() or path.suffix not in _SUPPORTED_SUFFIXES:
             continue
@@ -391,6 +397,59 @@ def _resolve_js_target(target: Path, files: dict[str, Path], root: Path) -> str
     return None
 
 
+# Sink families that fire on reachability alone (no request-token gate),
+# because the operation is dangerous regardless of the argument's shape.
+# But that over-fires when the argument is provably STATIC/local — e.g.
+# `yaml.load(fs.readFileSync('./swagger.yml'))` loads a shipped config at
+# boot, not attacker bytes. Left ungated, one such call in a hub module
+# fans out to a chain from every route (observed: 113/123 chains on a real
+# app collapsing to one benign `yaml.load` of a static file). We suppress
+# these kinds when the call argument is a bare string literal or a
+# literal-path file read with no dynamic/attacker component.
+_STATIC_GATED_KINDS = frozenset({"unsafe_deserialization", "eval", "exec"})
+
+# A quoted string literal appears in the argument.
+_ARG_STRING_LITERAL = re.compile(r"""['"][^'"]*['"]""")
+# Signals the argument is (or may be) dynamic / attacker-influenced:
+# string concatenation, template/f-string interpolation, or a request /
+# runtime-input container. If any appears, we do NOT treat the arg as static.
+_ARG_DYNAMIC = re.compile(
+    r"\+|\$\{|`|\b(?:req|request|body|query|params|payload|argv|input|stdin)\b|process\."
+)
+
+
+def _extract_call_arg(content: str, open_paren: int, cap: int = 400) -> str:
+    """Return the text inside the balanced parens starting at ``open_paren``
+    (the index of the ``(``), bounded to ``cap`` chars."""
+    depth = 0
+    end = min(len(content), open_paren + cap)
+    for i in range(open_paren, end):
+        ch = content[i]
+        if ch == "(":
+            depth += 1
+        elif ch == ")":
+            depth -= 1
+            if depth == 0:
+                return content[open_paren + 1 : i]
+    return content[open_paren + 1 : end]
+
+
+def _is_static_local_arg(content: str, match: re.Match[str]) -> bool:
+    """True if the sink call's argument is provably static/local — a string
+    literal or a literal-path file read — with no dynamic/attacker component."""
+    paren = content.find("(", match.start())
+    if paren == -1:
+        return False
+    arg = _extract_call_arg(content, paren)
+    if not _ARG_STRING_LITERAL.search(arg):
+        return False  # no literal → provenance unknown → keep flagging
+    # Strip quoted spans before the dynamic check so a `+`/`${`/token that is
+    # DATA inside a literal (e.g. `eval('1 + 1')`, `yaml.load('a: b+c')`)
+    # doesn't read as concatenation/interpolation of the argument.
+    residual = _ARG_STRING_LITERAL.sub("", arg)
+    return _ARG_DYNAMIC.search(residual) is None
+
+
 def _find_sinks(
     files: dict[str, Path], root: Path
 ) -> dict[str, list[tuple[str, int, str]]]:
@@ -404,6 +463,10 @@ def _find_sinks(
         hits: list[tuple[str, int, str]] = []
         for kind, pattern in _SINK_PATTERNS:
             for match in pattern.finditer(content):
+                # Suppress ungated "dangerous-regardless" sinks whose argument
+                # is a static literal / local-file read (#88 follow-up).
+                if kind in _STATIC_GATED_KINDS and _is_static_local_arg(content, match):
+                    continue
                 line = content.count("\n", 0, match.start()) + 1
                 snippet = _line_snippet(content, match.start())
                 hits.append((kind, line, snippet))

{attackmap-0.3.0 → attackmap-0.3.2}/src/attackmap/weaknesses.py

@@ -32,8 +32,19 @@ _PATTERNS: tuple[tuple[str, str, re.Pattern[str]], ...] = (
     (
         "prototype_pollution",
         "high",
-        # Literal __proto__ / constructor.prototype write.
-        _rx(r"\[\s*['\"]__proto__['\"]\s*\]|\.__proto__\s*[=.]|['\"]constructor['\"]\s*\]\s*\[\s*['\"]prototype['\"]"),
+        # Literal __proto__ / constructor.prototype *write* (assignment target).
+        # Requiring a trailing `=` (not `==`) avoids flagging prototype-chain
+        # *reads* like `x.prototype.__proto__.constructor` (#94).
+        _rx(
+            r"(?:"
+            r"\.__proto__"
+            r"|\[\s*['\"]__proto__['\"]\s*\]"
+            r"|\[\s*['\"]constructor['\"]\s*\]\s*\[\s*['\"]prototype['\"]\s*\]"
+            r"|\.constructor\s*\.\s*prototype"
+            r")"
+            r"(?:\s*\.\s*\w+|\s*\[[^\]]*\])*"  # optional further member/subscript access
+            r"\s*=(?!=)"
+        ),
     ),
     (
         "prototype_pollution",
@@ -158,6 +169,8 @@ def find_code_weaknesses(content: str, rel_file: str) -> list[CodeWeakness]:
     out: list[CodeWeakness] = []
     for kind, severity, pattern in _PATTERNS:
         for match in pattern.finditer(content):
+            if _in_line_comment(content, match.start()):
+                continue  # a pattern inside a `//` comment isn't real code (#94)
             line = content.count("\n", 0, match.start()) + 1
             key = (kind, line)
             if key in seen:
@@ -176,6 +189,14 @@ def find_code_weaknesses(content: str, rel_file: str) -> list[CodeWeakness]:
     return out
 
 
+def _in_line_comment(content: str, offset: int) -> bool:
+    """True if ``offset`` falls after a `//` line comment on its line. Cheap
+    heuristic (ignores `//` inside strings), used only to drop obvious
+    comment-embedded matches like `// x.__proto__.y = z`."""
+    line_start = content.rfind("\n", 0, offset) + 1
+    return "//" in content[line_start:offset]
+
+
 def _snippet(content: str, offset: int, radius: int = 120) -> str:
     start = max(0, content.rfind("\n", 0, offset) + 1)
     end = content.find("\n", offset)

{attackmap-0.3.0 → attackmap-0.3.2/src/attackmap.egg-info}/PKG-INFO

@@ -1,6 +1,6 @@
 Metadata-Version: 2.4
 Name: attackmap
-Version: 0.3.0
+Version: 0.3.2
 Summary: AI-assisted defensive security analyzer for codebases — scans a repository, models assets and controls, finds cross-cutting weaknesses, and generates an evidence-grounded review with MITRE ATT&CK mappings and detection-engineering hints.
 Author: AttackMap Contributors
 Author-email: Matthew Davis <matthewd@matthewd.xyz>
@@ -75,7 +75,7 @@ managers who need to triage an unfamiliar codebase.
 [![Python: 3.11+](https://img.shields.io/badge/Python-3.11%2B-blue.svg)](https://www.python.org/)
 [![PyPI](https://img.shields.io/pypi/v/attackmap.svg)](https://pypi.org/project/attackmap/)
 
-> **Status: beta (v0.3.0).** Core engine and 14 analyzer plugins are published
+> **Status: beta (v0.3.2).** Core engine and 14 analyzer plugins are published
 > to PyPI, Homebrew, and GHCR and validated against real-world codebases.
 > AttackMap is heuristic by design — findings are confidence-tiered evidence,
 > not proof. See [Project status](#project-status) for what's solid and what's
@@ -541,7 +541,7 @@ introduces a new HIGH finding.
 
 ## Project status
 
-AttackMap is **beta** (v0.3.0) — published and validated on real codebases, but
+AttackMap is **beta** (v0.3.2) — published and validated on real codebases, but
 pre-1.0 and heuristic.
 
 **Solid today:**

{attackmap-0.3.0 → attackmap-0.3.2}/tests/test_scanner.py

@@ -803,3 +803,23 @@ def refresh():
     # separate exposures). But the same line must not double-emit.
     lines = [h.line for h in aws_hints]
     assert len(lines) == len(set(lines))
+
+
+def test_base64_alphabet_constant_not_flagged_as_secret(tmp_path: Path) -> None:
+    """A base64/hex alphabet constant is high-entropy but not a secret (#96)."""
+    (tmp_path / "sourcemap.js").write_text(
+        'var base64Digits = '
+        '"ABCDEFGHIJKLMNOPQRSTUVWXYZabcdefghijklmnopqrstuvwxyz0123456789+/";\n',
+        encoding="utf-8",
+    )
+    result = scan_repo(tmp_path)
+    assert not [s for s in result.secret_hints if s.kind == "high_entropy"]
+
+
+def test_real_high_entropy_secret_still_flagged(tmp_path: Path) -> None:
+    (tmp_path / "cfg.js").write_text(
+        'const apiToken = "s3cr3tR4nd0mK3yZ9xQvB2mNw8LpT4hJ7";\n',
+        encoding="utf-8",
+    )
+    result = scan_repo(tmp_path)
+    assert any(s.kind == "high_entropy" for s in result.secret_hints)

{attackmap-0.3.0 → attackmap-0.3.2}/tests/test_srcpaths.py

@@ -7,7 +7,7 @@ from pathlib import Path
 import pytest
 
 from attackmap.scanner import scan_repo
-from attackmap.srcpaths import is_test_file
+from attackmap.srcpaths import is_test_file, is_vendored_file
 
 
 # ---------------------------------------------------------------------------
@@ -58,6 +58,68 @@ def test_include_tests_env_disables_exclusion(monkeypatch: pytest.MonkeyPatch) -
     assert is_test_file("pkg/foo.test.ts") is False
 
 
+# ---------------------------------------------------------------------------
+# is_vendored_file classification (#95)
+# ---------------------------------------------------------------------------
+
+
+@pytest.mark.parametrize(
+    "rel",
+    [
+        "node_modules/lodash/merge.js",
+        "UserInterface/External/three.js/three.js",
+        "vendor/github.com/x/y.go",
+        "third_party/zlib/zlib.js",
+        "src/bower_components/jquery/jquery.js",
+        "app/static/app.min.js",
+        "app/main.bundle.js",
+    ],
+)
+def test_vendored_paths_detected(rel: str) -> None:
+    assert is_vendored_file(rel) is True
+
+
+@pytest.mark.parametrize(
+    "rel",
+    [
+        "src/app.js",
+        "UserInterface/Models/PropertyPath.js",  # not under External/
+        "services/external_api.py",              # 'external_api' file, not an 'external' dir
+        "vendored_notes.md",                     # not a dir segment
+    ],
+)
+def test_non_vendored_paths_not_detected(rel: str) -> None:
+    assert is_vendored_file(rel) is False
+
+
+def test_include_vendored_env_disables_exclusion(monkeypatch: pytest.MonkeyPatch) -> None:
+    monkeypatch.setenv("ATTACKMAP_INCLUDE_VENDORED", "1")
+    assert is_vendored_file("node_modules/x/y.js") is False
+    assert is_vendored_file("a/b.min.js") is False
+
+
+def test_weakness_in_vendored_file_excluded_by_default(tmp_path: Path) -> None:
+    ext = tmp_path / "External" / "three.js"
+    ext.mkdir(parents=True)
+    # A ReDoS-shaped regex living in a vendored library.
+    (ext / "three.js").write_text(
+        "const re = /((?:WC+[\\/:])*)/\n", encoding="utf-8"
+    )
+    scan = scan_repo(tmp_path)
+    assert not [w for w in scan.code_weaknesses if w.kind == "redos"]
+
+
+def test_weakness_in_vendored_file_included_with_env(
+    tmp_path: Path, monkeypatch: pytest.MonkeyPatch
+) -> None:
+    monkeypatch.setenv("ATTACKMAP_INCLUDE_VENDORED", "1")
+    ext = tmp_path / "External"
+    ext.mkdir(parents=True)
+    (ext / "lib.js").write_text("const re = /^(a+)+$/\n", encoding="utf-8")
+    scan = scan_repo(tmp_path)
+    assert any(w.kind == "redos" for w in scan.code_weaknesses)
+
+
 # ---------------------------------------------------------------------------
 # Integration: weakness passes skip test files by default
 # ---------------------------------------------------------------------------

{attackmap-0.3.0 → attackmap-0.3.2}/tests/test_taint.py

@@ -216,7 +216,7 @@ def test_analyze_taint_uses_scan_routes_directly(tmp_path: Path) -> None:
         "import worker\ndef h(): return worker.run()\n", encoding="utf-8"
     )
     (tmp_path / "worker.py").write_text(
-        "def run(): eval('1+1')\n", encoding="utf-8"
+        "def run(x): eval(x)\n", encoding="utf-8"
     )
     scan = ScanResult(
         root=str(tmp_path),
@@ -228,6 +228,77 @@ def test_analyze_taint_uses_scan_routes_directly(tmp_path: Path) -> None:
     assert chains[0].route_path == "/synthetic"
 
 
+def test_static_local_deserialization_not_flagged(tmp_path: Path) -> None:
+    """`yaml.load` of a static local file (shipped config at boot) is not an
+    unsafe deserialization of untrusted data — must not seed a chain. This is
+    the juice-shop `yaml.load(readFileSync('./swagger.yml'))` fan-out FP."""
+    (tmp_path / "server.js").write_text(
+        "const fs = require('fs')\n"
+        "const yaml = require('js-yaml')\n"
+        "const express = require('express')\n"
+        "const app = express()\n"
+        "const swaggerDocument = yaml.load(fs.readFileSync('./swagger.yml', 'utf8'))\n"
+        "app.get('/status', (req, res) => res.json(swaggerDocument))\n",
+        encoding="utf-8",
+    )
+    scan = scan_repo(tmp_path)
+    assert not [c for c in scan.taint_chains if c.sink_kind == "unsafe_deserialization"]
+
+
+def test_dynamic_deserialization_still_flagged(tmp_path: Path) -> None:
+    # request-derived bytes into yaml.load → real, still flagged.
+    (tmp_path / "app.py").write_text(
+        "from flask import Flask, request\n"
+        "import yaml\n"
+        "app = Flask(__name__)\n"
+        "@app.route('/load', methods=['POST'])\n"
+        "def load():\n"
+        "    return yaml.load(request.data)\n",
+        encoding="utf-8",
+    )
+    scan = scan_repo(tmp_path)
+    assert any(c.sink_kind == "unsafe_deserialization" for c in scan.taint_chains)
+
+
+def test_concatenated_path_deserialization_still_flagged(tmp_path: Path) -> None:
+    # literal path + a variable (potential traversal) is NOT purely static.
+    (tmp_path / "app.py").write_text(
+        "from flask import Flask, request\n"
+        "import yaml\n"
+        "app = Flask(__name__)\n"
+        "@app.route('/hint/<key>')\n"
+        "def hint(key):\n"
+        "    return yaml.load(open('./data/' + key + '.yml').read())\n",
+        encoding="utf-8",
+    )
+    scan = scan_repo(tmp_path)
+    assert any(c.sink_kind == "unsafe_deserialization" for c in scan.taint_chains)
+
+
+def test_constant_eval_not_flagged_but_variable_eval_is(tmp_path: Path) -> None:
+    # Separate files so hop-0 file-locality doesn't cross-link the routes.
+    (tmp_path / "constant.py").write_text(
+        "from flask import Flask\n"
+        "app = Flask(__name__)\n"
+        "@app.route('/const')\n"
+        "def c():\n"
+        "    return eval('1 + 1')\n",  # constant → benign, suppressed
+        encoding="utf-8",
+    )
+    (tmp_path / "dynamic.py").write_text(
+        "from flask import Flask, request\n"
+        "app = Flask(__name__)\n"
+        "@app.route('/dyn')\n"
+        "def d():\n"
+        "    return eval(request.args['x'])\n",  # variable → dangerous
+        encoding="utf-8",
+    )
+    scan = scan_repo(tmp_path)
+    eval_routes = {c.route_path for c in scan.taint_chains if c.sink_kind == "eval"}
+    assert "/dyn" in eval_routes
+    assert "/const" not in eval_routes
+
+
 @pytest.mark.parametrize("sink_kind", ["eval", "exec", "subprocess_shell", "dynamic_open"])
 def test_all_sink_kinds_are_detectable(tmp_path: Path, sink_kind: str) -> None:
     (tmp_path / "route.py").write_text(
@@ -236,8 +307,10 @@ def test_all_sink_kinds_are_detectable(tmp_path: Path, sink_kind: str) -> None:
         encoding="utf-8",
     )
     bodies = {
-        "eval": "def go(): eval('1+1')\n",
-        "exec": "def go(): exec('a=1')\n",
+        # eval/exec use a variable arg (not a constant) — a constant eval is
+        # benign and is now suppressed by the static-arg gate (see below).
+        "eval": "def go(x): eval(x)\n",
+        "exec": "def go(x): exec(x)\n",
         "subprocess_shell": "import subprocess\ndef go(): subprocess.run('ls', shell=True)\n",
         "dynamic_open": "def go(req): return open(req.path)\n",
     }

{attackmap-0.3.0 → attackmap-0.3.2}/tests/test_weaknesses.py

@@ -40,6 +40,27 @@ def test_safe_merge_of_constant_not_flagged() -> None:
     assert "prototype_pollution" not in _kinds("_.merge(target, { a: 1 })\n")
 
 
+def test_prototype_chain_read_not_flagged() -> None:
+    # Reading up the prototype chain (parent-constructor lookup) is not a write.
+    assert "prototype_pollution" not in _kinds(
+        "constructor = constructor.prototype.__proto__.constructor;\n"
+    )
+    assert "prototype_pollution" not in _kinds("const p = obj.__proto__.foo\n")
+
+
+def test_proto_in_comment_not_flagged() -> None:
+    assert "prototype_pollution" not in _kinds(
+        '// The path for "foo.__proto__.bar.__proto__.x" is shown as "foo.bar.x".\n'
+    )
+    # even a write-shaped example inside a line comment is ignored
+    assert "prototype_pollution" not in _kinds("// obj.__proto__.polluted = true\n")
+
+
+def test_proto_write_still_flagged() -> None:
+    assert "prototype_pollution" in _kinds("target.__proto__.polluted = true\n")
+    assert "prototype_pollution" in _kinds("obj['__proto__']['x'] = 1\n")
+
+
 # ---------------------------------------------------------------------------
 # Mass assignment
 # ---------------------------------------------------------------------------