ballpython 2.1.0__py3-none-any.whl → 2.1.2__py3-none-any.whl

pycleaner/pipeline.py

@@ -18,6 +18,7 @@ from pycleaner.dead_code_detector import DeadCodeFixer
 from pycleaner.import_resolver import ImportResolver
 from pycleaner.linter_formatter import LinterFormatter
 from pycleaner.modernizer import Modernizer
+from pycleaner.security_scanner import SecurityFinding, SecurityScanner
 from pycleaner.syntax_healer import SyntaxHealer
 from pycleaner.verifier import (
     CounterExample,
@@ -48,6 +49,7 @@ class CleanResult:
     format_changed: bool = False
     error: str | None = None
     diagnostics: list[dict[str, str]] = field(default_factory=list)
+    security_findings: list[SecurityFinding] = field(default_factory=list)
     proof_receipts: list[ProofReceipt] = field(default_factory=list)
     refused_changes: list[CounterExample] = field(default_factory=list)
     verification_tier: VerificationTier | None = None
@@ -139,6 +141,7 @@ class CleanPipeline:
         self.dead_code_fixer = DeadCodeFixer()
         self.import_resolver = ImportResolver(custom_import_map=import_map)
         self.linter_formatter = LinterFormatter()
+        self.security_scanner = SecurityScanner(severity_threshold="HIGH")
 
     def _stage_heal(
         self, current_code: str, filename: str, syntax_repairs: list[str]
@@ -318,6 +321,21 @@ class CleanPipeline:
                 else:
                     verification_tier = VerificationTier.TIER_B_SUGGESTED
 
+        # Scan for dangerous calls and security findings
+        sec_report = self.security_scanner.scan_source(current_code, filename=filename)
+        security_findings = list(sec_report.findings)
+        for sf in security_findings:
+            diagnostics.append(
+                {
+                    "file": filename,
+                    "line": str(sf.lineno),
+                    "severity": sf.severity,
+                    "category": sf.category,
+                    "message": sf.message,
+                    "suggestion": sf.suggestion,
+                }
+            )
+
         return CleanResult(
             path=Path(filename),
             original_code=source,
@@ -334,6 +352,7 @@ class CleanPipeline:
             format_changed=format_changed,
             error=final_error,
             diagnostics=diagnostics,
+            security_findings=security_findings,
             proof_receipts=proof_receipts,
             refused_changes=refused_changes,
             verification_tier=verification_tier,
@@ -376,24 +395,58 @@ class CleanPipeline:
     ) -> CleanResult:
         """Process a single file on disk and optionally write back updates."""
         path = Path(filepath).resolve()
-        content = path.read_text(encoding="utf-8", errors="replace")
+        try:
+            content = path.read_text(encoding="utf-8", errors="replace")
+        except OSError as err:
+            return CleanResult(
+                path=path,
+                original_code="",
+                cleaned_code="",
+                changed=False,
+                is_valid_python=False,
+                error=f"Permission denied (read-only?): {err}",
+            )
 
         if self.cache is not None:
             cached_result = self.cache.get(path, content)
             if cached_result is not None:
-                if (
+                can_apply_cached = (
                     apply_changes
                     and cached_result.changed
-                    and cached_result.is_valid_python
+                    and (
+                        cached_result.is_valid_python
+                        or bool(cached_result.syntax_repairs)
+                    )
                     and (
                         cached_result.verification_tier
                         != VerificationTier.TIER_C_REFUSED
                     )
-                ):
+                )
+                if can_apply_cached:
                     if backup:
                         bak_path = path.with_name(path.name + ".pycleaner.bak")
-                        shutil.copy2(path, bak_path)
-                    path.write_text(cached_result.cleaned_code, encoding="utf-8")
+                        try:
+                            shutil.copy2(path, bak_path)
+                        except OSError as err:
+                            return CleanResult(
+                                path=path,
+                                original_code=content,
+                                cleaned_code=content,
+                                changed=False,
+                                is_valid_python=cached_result.is_valid_python,
+                                error=f"Permission denied creating backup (read-only?): {err}",
+                            )
+                    try:
+                        path.write_text(cached_result.cleaned_code, encoding="utf-8")
+                    except OSError as err:
+                        return CleanResult(
+                            path=path,
+                            original_code=content,
+                            cleaned_code=content,
+                            changed=False,
+                            is_valid_python=cached_result.is_valid_python,
+                            error=f"Permission denied (read-only?): {err}",
+                        )
                 return cached_result
 
         result = self.process_source(content, filename=str(path))
@@ -414,16 +467,51 @@ class CleanPipeline:
                     diff=result.diff,
                 )
 
-        if (
+        can_apply = (
             apply_changes
             and result.changed
-            and result.is_valid_python
+            and (result.is_valid_python or bool(result.syntax_repairs))
             and (result.verification_tier != VerificationTier.TIER_C_REFUSED)
-        ):
+        )
+        if can_apply:
             if backup:
                 bak_path = path.with_name(path.name + ".pycleaner.bak")
-                shutil.copy2(path, bak_path)
-            path.write_text(result.cleaned_code, encoding="utf-8")
+                try:
+                    shutil.copy2(path, bak_path)
+                except OSError as err:
+                    return CleanResult(
+                        path=path,
+                        original_code=content,
+                        cleaned_code=content,
+                        changed=False,
+                        is_valid_python=result.is_valid_python,
+                        error=f"Permission denied creating backup (read-only?): {err}",
+                        syntax_repairs=result.syntax_repairs,
+                        modernize_transforms=result.modernize_transforms,
+                        dead_code_pruned=result.dead_code_pruned,
+                        resolved_imports=result.resolved_imports,
+                        unresolved_symbols=result.unresolved_symbols,
+                        diagnostics=result.diagnostics,
+                        security_findings=result.security_findings,
+                    )
+            try:
+                path.write_text(result.cleaned_code, encoding="utf-8")
+            except OSError as err:
+                return CleanResult(
+                    path=path,
+                    original_code=content,
+                    cleaned_code=content,
+                    changed=False,
+                    is_valid_python=result.is_valid_python,
+                    error=f"Permission denied (read-only?): {err}",
+                    syntax_repairs=result.syntax_repairs,
+                    modernize_transforms=result.modernize_transforms,
+                    dead_code_pruned=result.dead_code_pruned,
+                    resolved_imports=result.resolved_imports,
+                    unresolved_symbols=result.unresolved_symbols,
+                    diagnostics=result.diagnostics,
+                    security_findings=result.security_findings,
+                )
 
         return result
 

pycleaner/security_scanner.py

@@ -103,7 +103,7 @@ _SECRET_PATTERNS: list[tuple[str, re.Pattern[str], str]] = [
     ),
     (
         "GitHub Token",
-        re.compile(r"gh[ps]_[A-Za-z0-9_]{36}"),
+        re.compile(r"gh[ps]_[A-Za-z0-9_]{20,}"),
         "Use environment variables or GitHub's OIDC",
     ),
     (
@@ -111,9 +111,49 @@ _SECRET_PATTERNS: list[tuple[str, re.Pattern[str], str]] = [
         re.compile(r"xox[bpras]-[A-Za-z0-9\-]{10,}"),
         "Use environment variables for Slack tokens",
     ),
+    (
+        "Stripe Secret Key",
+        re.compile(r"sk_(?:live|test)_[A-Za-z0-9]{20,}"),
+        "Use environment variables or Stripe's secret manager",
+    ),
+    (
+        "SendGrid API Key",
+        re.compile(r"SG\.[A-Za-z0-9_-]{20,}\.[A-Za-z0-9_-]{20,}"),
+        "Use environment variables for SendGrid keys",
+    ),
+    (
+        "Credentialed Database URL",
+        re.compile(
+            r"(?i)(?:postgres|postgresql|mysql|mongodb|redis|amqp)://[^:]+:[^@]+@[^/\s]+"
+        ),
+        "Never embed credentials in connection strings; use secret stores",
+    ),
 ]
 
 
+def is_secret_literal(value: str) -> bool:
+    """Check if a string literal matches any known secret pattern."""
+    if not isinstance(value, str) or len(value) < 8:
+        return False
+    for _, pattern, _ in _SECRET_PATTERNS:
+        if pattern.search(value):
+            return True
+    return False
+
+
+def is_secret_ast_node(node: ast.AST | None) -> bool:
+    """Recursively check if an AST node contains any hardcoded secret string."""
+    if node is None:
+        return False
+    if isinstance(node, ast.Constant) and isinstance(node.value, str):
+        return is_secret_literal(node.value)
+    for child in ast.walk(node):
+        if isinstance(child, ast.Constant) and isinstance(child.value, str):
+            if is_secret_literal(child.value):
+                return True
+    return False
+
+
 _DANGEROUS_CALL_SPECS: dict[str, tuple[str, str, str, str]] = {
     "eval": (
         "CRITICAL",
@@ -176,7 +216,7 @@ _DANGEROUS_CALL_SPECS: dict[str, tuple[str, str, str, str]] = {
         "Use json.loads() for data interchange",
     ),
     "os.system": (
-        "HIGH",
+        "CRITICAL",
         "shell-injection",
         "os.system() passes commands through the shell and is vulnerable to injection",
         "Use subprocess.run() with a list of arguments (no shell=True)",
@@ -432,7 +472,12 @@ class _DangerousCallDetector(ast.NodeVisitor):
                     )
                 ):
                     has_safe_loader = True
-            if not has_safe_loader and func_name == "yaml.load":
+            if func_name == "yaml.unsafe_load" or not has_safe_loader:
+                msg = (
+                    "yaml.unsafe_load() can execute arbitrary Python objects"
+                    if func_name == "yaml.unsafe_load"
+                    else "yaml.load() without SafeLoader can execute arbitrary Python objects"
+                )
                 self._add_finding(
                     SecurityFinding(
                         filepath=self.filepath,
@@ -440,7 +485,7 @@ class _DangerousCallDetector(ast.NodeVisitor):
                         end_lineno=getattr(node, "end_lineno", None),
                         severity="CRITICAL",
                         category="insecure-deserialization",
-                        message="yaml.load() without SafeLoader can execute arbitrary Python objects",
+                        message=msg,
                         suggestion="Use yaml.safe_load() or yaml.load(data, Loader=yaml.SafeLoader)",
                         code_snippet=self._get_snippet(node.lineno),
                     )
@@ -494,6 +539,52 @@ class _DangerousCallDetector(ast.NodeVisitor):
             )
 
 
+_FALLBACK_DANGEROUS_PATTERNS: list[tuple[re.Pattern[str], str, str, str, str]] = [
+    (
+        re.compile(r"\beval\s*\("),
+        "CRITICAL",
+        "dangerous-eval",
+        "eval() executes arbitrary Python code",
+        "Avoid eval() with untrusted input; use safe alternatives",
+    ),
+    (
+        re.compile(r"\bexec\s*\("),
+        "CRITICAL",
+        "dangerous-exec",
+        "exec() executes arbitrary Python code",
+        "Avoid exec() with untrusted input; use safe alternatives",
+    ),
+    (
+        re.compile(r"\bos\.system\s*\("),
+        "CRITICAL",
+        "shell-injection",
+        "os.system() passes commands through the shell and is vulnerable to injection",
+        "Use subprocess.run() with a list of arguments (no shell=True)",
+    ),
+    (
+        re.compile(r"\b(?:pickle|cPickle)\.(?:loads?)\s*\("),
+        "CRITICAL",
+        "insecure-deserialization",
+        "pickle.loads() deserializes arbitrary objects and can execute arbitrary code",
+        "Use json.loads() or a restricted deserializer instead",
+    ),
+    (
+        re.compile(r"\byaml\.unsafe_load\s*\("),
+        "CRITICAL",
+        "insecure-deserialization",
+        "yaml.unsafe_load() can execute arbitrary Python objects",
+        "Use yaml.safe_load() instead",
+    ),
+    (
+        re.compile(r"\byaml\.load\s*\("),
+        "CRITICAL",
+        "insecure-deserialization",
+        "yaml.load() without SafeLoader can execute arbitrary Python objects",
+        "Use yaml.safe_load() or yaml.load(data, Loader=yaml.SafeLoader)",
+    ),
+]
+
+
 class SecurityScanner:
     """Scans Python source code for security vulnerabilities."""
 
@@ -526,6 +617,7 @@ class SecurityScanner:
         except SyntaxError:
             # Code with syntax errors cannot be AST-parsed; regex checks still run
             logging.getLogger(__name__).debug("Suppressed exception", exc_info=True)
+            findings.extend(self._detect_dangerous_calls_fallback(source, filename))
 
         findings.extend(self._detect_secrets(source, filename))
 
@@ -536,26 +628,59 @@ class SecurityScanner:
 
         return SecurityReport(findings=filtered, files_scanned=1)
 
+    def _detect_dangerous_calls_fallback(
+        self, source: str, filename: str
+    ) -> list[SecurityFinding]:
+        """Regex-based fallback for dangerous calls when AST cannot be parsed."""
+        findings: list[SecurityFinding] = []
+        for i, line in enumerate(source.splitlines(), 1):
+            stripped = line.strip()
+            if stripped.startswith("#"):
+                continue
+            if "#" in line:
+                comment = line.split("#", 1)[1].strip().lower()
+                if (
+                    "nosec" in comment
+                    or "noqa" in comment
+                    or "pycleaner: ignore" in comment
+                ):
+                    continue
+
+            for pat, sev, cat, msg, sugg in _FALLBACK_DANGEROUS_PATTERNS:
+                if pat.search(line):
+                    if cat == "insecure-deserialization" and "yaml.load" in pat.pattern:
+                        if "SafeLoader" in line or "BaseLoader" in line:
+                            continue
+                    findings.append(
+                        SecurityFinding(
+                            filepath=filename,
+                            lineno=i,
+                            end_lineno=i,
+                            severity=sev,
+                            category=cat,
+                            message=msg,
+                            suggestion=sugg,
+                            code_snippet=stripped[:120],
+                        )
+                    )
+        return findings
+
     def _discover_project_py_files(
         self, root: Path, exclude_patterns: Sequence[str] = ()
     ) -> list[Path]:
         return collect_project_python_files(root, exclude_patterns=exclude_patterns)
 
-    def scan_project(
-        self, root_dir: Path | str, exclude_patterns: Sequence[str] = ()
-    ) -> SecurityReport:
-        """Scan all Python files in a project for security issues."""
-        root = Path(root_dir).resolve()
-        py_files = self._discover_project_py_files(
-            root, exclude_patterns=exclude_patterns
-        )
+    def scan_files(self, target_files: Sequence[Path]) -> SecurityReport:
+        """Scan a specific sequence of Python files for security issues."""
         all_findings: list[SecurityFinding] = []
+        scanned_count = 0
 
-        for fpath in py_files:
+        for fpath in target_files:
             try:
                 content = fpath.read_text(encoding="utf-8", errors="replace")
                 report = self.scan_source(content, filename=str(fpath))
                 all_findings.extend(report.findings)
+                scanned_count += 1
             except OSError:
                 continue
 
@@ -566,7 +691,17 @@ class SecurityScanner:
                 f.lineno,
             )
         )
-        return SecurityReport(findings=all_findings, files_scanned=len(py_files))
+        return SecurityReport(findings=all_findings, files_scanned=scanned_count)
+
+    def scan_project(
+        self, root_dir: Path | str, exclude_patterns: Sequence[str] = ()
+    ) -> SecurityReport:
+        """Scan all Python files in a project for security issues."""
+        root = Path(root_dir).resolve()
+        py_files = self._discover_project_py_files(
+            root, exclude_patterns=exclude_patterns
+        )
+        return self.scan_files(py_files)
 
     @staticmethod
     def _is_test_placeholder_line(filename: str, line_lower: str) -> bool: