ballpython 2.0.4__tar.gz → 2.0.5__tar.gz

{ballpython-2.0.4 → ballpython-2.0.5}/PKG-INFO

@@ -1,6 +1,6 @@
 Metadata-Version: 2.4
 Name: ballpython
-Version: 2.0.4
+Version: 2.0.5
 Summary: The Ultimate Static Python Intelligence, Healing, Type Verification, and Security Suite
 Author: Developer
 License-Expression: MIT
@@ -78,7 +78,7 @@ Add `ballpython` to your `.pre-commit-config.yaml`:
 ```yaml
 repos:
   - repo: https://github.com/moonrox420/ball-python
-    rev: v2.0.4
+    rev: v2.0.5
     hooks:
       - id: pycleaner
         args: ["check"]

{ballpython-2.0.4 → ballpython-2.0.5}/README.md

@@ -59,7 +59,7 @@ Add `ballpython` to your `.pre-commit-config.yaml`:
 ```yaml
 repos:
   - repo: https://github.com/moonrox420/ball-python
-    rev: v2.0.4
+    rev: v2.0.5
     hooks:
       - id: pycleaner
         args: ["check"]

{ballpython-2.0.4 → ballpython-2.0.5}/ballpython.egg-info/PKG-INFO

@@ -1,6 +1,6 @@
 Metadata-Version: 2.4
 Name: ballpython
-Version: 2.0.4
+Version: 2.0.5
 Summary: The Ultimate Static Python Intelligence, Healing, Type Verification, and Security Suite
 Author: Developer
 License-Expression: MIT
@@ -78,7 +78,7 @@ Add `ballpython` to your `.pre-commit-config.yaml`:
 ```yaml
 repos:
   - repo: https://github.com/moonrox420/ball-python
-    rev: v2.0.4
+    rev: v2.0.5
     hooks:
       - id: pycleaner
         args: ["check"]

{ballpython-2.0.4 → ballpython-2.0.5}/pycleaner/__init__.py

@@ -18,7 +18,7 @@ from pycleaner.discovery import (
     is_protected_file,
 )
 
-__version__ = "2.0.4"
+__version__ = "2.0.5"
 __all__ = [
     "BaselineFingerprint",
     "BaselineManager",

{ballpython-2.0.4 → ballpython-2.0.5}/pycleaner/security_scanner.py

@@ -190,6 +190,24 @@ class _DangerousCallDetector(ast.NodeVisitor):
         self.filepath = filepath
         self.source_lines = source_lines
         self.findings: list[SecurityFinding] = []
+        self._is_test_module: bool = False
+
+    def check_tree(self, tree: ast.AST) -> None:
+        """Inspect imports to determine if module is a test file."""
+        for node in ast.walk(tree):
+            if isinstance(node, ast.Import):
+                for alias in node.names:
+                    if alias.name.split(".")[0] in ("pytest", "unittest", "mock"):
+                        self._is_test_module = True
+                        return
+            elif isinstance(node, ast.ImportFrom):
+                if node.module and node.module.split(".")[0] in (
+                    "pytest",
+                    "unittest",
+                    "mock",
+                ):
+                    self._is_test_module = True
+                    return
 
     def _get_snippet(self, lineno: int) -> str:
         if 1 <= lineno <= len(self.source_lines):
@@ -245,8 +263,11 @@ class _DangerousCallDetector(ast.NodeVisitor):
         parts = [p.lower() for p in Path(filepath).parts[:-1]]
         return any(p in ("tests", "test", "testing") for p in parts)
 
+    def _is_test(self) -> bool:
+        return self._is_test_module or self._is_test_path(self.filepath)
+
     def visit_Assert(self, node: ast.Assert) -> None:
-        if self._is_test_path(self.filepath):
+        if self._is_test():
             return
         self._add_finding(
             SecurityFinding(
@@ -429,7 +450,20 @@ class _DangerousCallDetector(ast.NodeVisitor):
         if isinstance(arg, ast.BinOp) and isinstance(arg.op, ast.Add):
             return True
         if isinstance(arg, ast.Call):
-            return isinstance(arg.func, ast.Attribute) and arg.func.attr == "format"
+            if isinstance(arg.func, ast.Attribute) and arg.func.attr == "format":
+                # Check for psycopg safe sql.SQL(...).format(...) query composition
+                val = arg.func.value
+                if isinstance(val, ast.Call):
+                    func = val.func
+                    func_id = ""
+                    if isinstance(func, ast.Name):
+                        func_id = func.id
+                    elif isinstance(func, ast.Attribute):
+                        func_id = func.attr
+                    if func_id == "SQL":
+                        return False
+                return True
+            return False
         if isinstance(arg, ast.BinOp) and isinstance(arg.op, ast.Mod):
             return isinstance(arg.left, ast.Constant) and isinstance(
                 arg.left.value, str
@@ -483,6 +517,7 @@ class SecurityScanner:
             tree = ast.parse(source, filename=filename)
             source_lines = source.splitlines()
             detector = _DangerousCallDetector(filename, source_lines)
+            detector.check_tree(tree)
             detector.visit(tree)
             findings.extend(detector.findings)
         except SyntaxError:

{ballpython-2.0.4 → ballpython-2.0.5}/pyproject.toml

@@ -4,7 +4,7 @@ build-backend = "setuptools.build_meta"
 
 [project]
 name = "ballpython"
-version = "2.0.4"
+version = "2.0.5"
 description = "The Ultimate Static Python Intelligence, Healing, Type Verification, and Security Suite"
 readme = "README.md"
 requires-python = ">=3.10"

{ballpython-2.0.4 → ballpython-2.0.5}/tests/test_security_scanner.py

@@ -210,3 +210,29 @@ class TestSecurityScanner:
     def test_security_report_by_category(self) -> None:
         report = SecurityReport(findings=[])
         assert len(report.by_category("dangerous-eval")) == 0
+
+    def test_assert_suppressed_in_module_importing_pytest(self) -> None:
+        source = textwrap.dedent("""
+            import pytest
+
+            def test_feature():
+                assert 1 + 1 == 2
+        """)
+        scanner = SecurityScanner(severity_threshold="LOW")
+        report = scanner.scan_source(source, filename="test_root_file.py")
+        categories = {f.category for f in report.findings}
+        assert "assert-in-production" not in categories
+
+    def test_safe_sql_composition_not_flagged(self) -> None:
+        source = textwrap.dedent("""
+            from psycopg import sql
+
+            def get_data(conn, tbl):
+                with conn.cursor() as cur:
+                    cur.execute(sql.SQL("SELECT count(*) FROM {}").format(sql.Identifier(tbl)))
+        """)
+        scanner = SecurityScanner()
+        report = scanner.scan_source(source, filename="query.py")
+        categories = {f.category for f in report.findings}
+        assert "sql-injection" not in categories
+