bmsdna-devtools 0.26.0__tar.gz → 0.27.0__tar.gz

{bmsdna_devtools-0.26.0 → bmsdna_devtools-0.27.0}/PKG-INFO

@@ -1,6 +1,6 @@
 Metadata-Version: 2.5
 Name: bmsdna-devtools
-Version: 0.26.0
+Version: 0.27.0
 Summary: Shared Azure DevOps / GitHub / git / Azure Monitor developer tooling for BMS projects
 Requires-Python: >=3.14
 Requires-Dist: pgdevkit[db]>=0.7.1
@@ -607,7 +607,11 @@ code 0 unless `--strict`).
   `staticwebapp.config.json`, nginx/web.config, ...); `csp-weakened` for `'unsafe-inline'`,
   `'unsafe-eval'` or a wildcard `script-src`. The CSP lookup always covers the whole repo, even with `--diff`.
 
-Test files and generated code are skipped. Silence a confirmed-safe finding with
+Skipped automatically: test files, generated code, `*.min.js` files, the usual build/vendor directories (`node_modules`, `.venv`, `dist`, ...) and,
+inside a git repo, anything ignored by `.gitignore` (pass `--no-gitignore` to scan it anyway).
+Add more with `--exclude` (repeatable; a directory name at any depth, a root-relative path, or a glob
+such as `'assets/**/*.js'`) or `[tool.bdt.lint] exclude_dirs = [...]` in `pyproject.toml`.
+Identical findings on the same line are reported once. Silence a confirmed-safe finding with
 `# bdt-lint: ignore <rule>` (Python) or `// bdt-lint: ignore <rule>` (TS/JS) on, or directly above, the line.
 
 ## Releasing

{bmsdna_devtools-0.26.0 → bmsdna_devtools-0.27.0}/README.md

@@ -594,7 +594,11 @@ code 0 unless `--strict`).
   `staticwebapp.config.json`, nginx/web.config, ...); `csp-weakened` for `'unsafe-inline'`,
   `'unsafe-eval'` or a wildcard `script-src`. The CSP lookup always covers the whole repo, even with `--diff`.
 
-Test files and generated code are skipped. Silence a confirmed-safe finding with
+Skipped automatically: test files, generated code, `*.min.js` files, the usual build/vendor directories (`node_modules`, `.venv`, `dist`, ...) and,
+inside a git repo, anything ignored by `.gitignore` (pass `--no-gitignore` to scan it anyway).
+Add more with `--exclude` (repeatable; a directory name at any depth, a root-relative path, or a glob
+such as `'assets/**/*.js'`) or `[tool.bdt.lint] exclude_dirs = [...]` in `pyproject.toml`.
+Identical findings on the same line are reported once. Silence a confirmed-safe finding with
 `# bdt-lint: ignore <rule>` (Python) or `// bdt-lint: ignore <rule>` (TS/JS) on, or directly above, the line.
 
 ## Releasing

{bmsdna_devtools-0.26.0 → bmsdna_devtools-0.27.0}/bmsdna/devtools/cli.py

@@ -933,13 +933,20 @@ def find_injection_cmd(
     diff: bool = typer.Option(False, "--diff", help="Scan only files changed on this branch vs --base, plus uncommitted and untracked files."),
     base: str = typer.Option(None, "--base", help="Branch/ref to diff against with --diff (default: origin's default branch)."),
     strict: bool = typer.Option(False, "--strict", help="Also exit 1 when there are items to review (default: only definite errors fail)."),
+    exclude: list[str] = typer.Option(
+        None,
+        "--exclude",
+        help="Directory name (any depth), root-relative path, or glob to skip (repeatable), e.g. --exclude vendor --exclude 'assets/**/*.js'. "
+        "Also configurable via [tool.bdt.lint] exclude_dirs in pyproject.toml.",
+    ),
+    no_gitignore: bool = typer.Option(False, "--no-gitignore", help="Also scan files ignored by .gitignore (default: they are skipped)."),
 ) -> None:
     """Find injection risks (bmsuisse/devtools#54) in backend and frontend code: SQL built from f-strings/
     concatenation or from an unverifiable function call, eval/exec/shell/unsafe deserialization in Python,
     innerHTML/dangerouslySetInnerHTML/eval/new Function/un-sandboxed iframes in the frontend, and a missing
     or weakened Content-Security-Policy. Definite problems are errors; the rest are listed for a human/AI to verify.
     """
-    result = find_injection_mod.run(paths or [], diff=diff, base=base)
+    result = find_injection_mod.run(paths or [], diff=diff, base=base, exclude=exclude or [], respect_gitignore=not no_gitignore)
     raise typer.Exit(find_injection_mod.print_report(result, strict=strict))
 
 

{bmsdna_devtools-0.26.0 → bmsdna_devtools-0.27.0}/bmsdna/devtools/find_injection.py

@@ -14,11 +14,13 @@ from __future__ import annotations
 
 import os
 import re
+from fnmatch import fnmatch
 import subprocess
 import sys
 from dataclasses import dataclass
 from pathlib import Path
 
+from .bdt_config import load_bdt_table
 from .injection_frontend import (
     FRONTEND_SUFFIXES,
     check_frontend_file,
@@ -165,21 +167,79 @@ def _scan_python(path: Path) -> list[Finding]:
     return sql + check_python_sinks(path)
 
 
-def _walk_repo_text_files(root: Path, exclude_dirs: frozenset[str]):
+_GLOB_CHARS = frozenset("*?[")
+
+
+class _ScanFilter:
+    """Which files are in scope: not under an excluded directory name, not matching an `--exclude`
+    path/glob (relative to the repo root), and -- in a git repo, unless disabled -- not gitignored
+    (tracked files always count, like git itself)."""
+
+    def __init__(self, root: Path, exclude: list[str], respect_gitignore: bool) -> None:
+        self.root = root
+        self.dir_names = _DEFAULT_EXCLUDE_DIR_NAMES | {".next", "coverage", "storybook-static"}
+        self._patterns: list[str] = []
+        for entry in exclude:
+            entry = entry.replace("\\", "/").strip().strip("/")
+            if entry.startswith("./"):
+                entry = entry[2:]
+            if not entry:
+                continue
+            if "/" not in entry and not _GLOB_CHARS & set(entry):
+                self.dir_names = self.dir_names | {entry}
+            else:
+                self._patterns.append(entry)
+        self._visible = _git_visible_files(root) if respect_gitignore else None
+
+    def allows(self, path: Path) -> bool:
+        resolved = path.resolve()
+        try:
+            rel = resolved.relative_to(self.root)
+        except ValueError:
+            return True
+        if any(part in self.dir_names for part in rel.parts[:-1]):
+            return False
+        posix = rel.as_posix()
+        if any(fnmatch(posix, pat) or fnmatch(posix, pat + "/*") for pat in self._patterns):
+            return False
+        return self._visible is None or resolved in self._visible
+
+
+def _git_visible_files(root: Path) -> set[Path] | None:
+    """Tracked plus untracked-but-not-ignored files under `root`, or None outside a git repo."""
+    try:
+        out = subprocess.run(
+            ["git", "ls-files", "-z", "--cached", "--others", "--exclude-standard"],
+            cwd=root,
+            capture_output=True,
+            encoding="utf-8",
+        )
+    except FileNotFoundError:
+        return None
+    if out.returncode != 0:
+        return None
+    return {(root / name).resolve() for name in out.stdout.split("\0") if name}
+
+
+def _is_minified(path: Path) -> bool:
+    return path.name.endswith(".min.js")
+
+
+def _walk_repo_text_files(root: Path, scope: _ScanFilter):
     for dirpath, dirnames, filenames in os.walk(root):
-        dirnames[:] = [d for d in dirnames if d not in exclude_dirs]
+        dirnames[:] = [d for d in dirnames if d not in scope.dir_names]
         for name in filenames:
             if name in _SKIP_NAMES or name.endswith(".min.js") or not (name in _CONFIG_NAMES or name.endswith(_CONFIG_SUFFIXES)):
                 continue
             candidate = Path(dirpath, name)
             try:
-                if candidate.stat().st_size <= _MAX_CSP_FILE_BYTES:
+                if candidate.stat().st_size <= _MAX_CSP_FILE_BYTES and scope.allows(candidate):
                     yield candidate
             except OSError:
                 continue
 
 
-def check_csp(root: Path, scanned: list[Path], exclude_dirs: frozenset[str], only: set[Path] | None = None) -> list[Finding]:
+def check_csp(root: Path, scanned: list[Path], scope: _ScanFilter, only: set[Path] | None = None) -> list[Finding]:
     """Warns when the project serves a web UI/API (frontend files scanned, or a Python web framework
     imported) but no file anywhere under `root` mentions a Content-Security-Policy. Always searches the
     whole repo -- a diff that doesn't touch the header config mustn't look like "no CSP configured".
@@ -198,7 +258,7 @@ def check_csp(root: Path, scanned: list[Path], exclude_dirs: frozenset[str], onl
         return []
     weakened: list[Finding] = []
     found = False
-    for candidate in _walk_repo_text_files(root, exclude_dirs):
+    for candidate in _walk_repo_text_files(root, scope):
         try:
             text = candidate.read_text(encoding="utf-8")
         except OSError, UnicodeDecodeError:
@@ -227,36 +287,31 @@ def run(
     root: Path | None = None,
     diff: bool = False,
     base: str | None = None,
+    exclude: list[str] | None = None,
+    respect_gitignore: bool = True,
 ) -> InjectionResult:
+    """`exclude`: directory names or root-relative paths/globs to skip, on top of `[tool.bdt.lint] exclude_dirs`
+    in pyproject.toml and the built-in list (node_modules, .venv, dist, ...)."""
     root = (root or Path.cwd()).resolve()
-    exclude_dirs = _DEFAULT_EXCLUDE_DIR_NAMES | {
-        ".next",
-        "coverage",
-        "storybook-static",
-    }
+    configured = [str(d) for d in load_bdt_table("lint", root).get("exclude_dirs", []) or []]
+    scope = _ScanFilter(root, configured + list(exclude or []), respect_gitignore)
     findings: list[Finding] = []
     changed: list[Path] = []
 
     if diff:
-        changed = [p for p in diff_files(root, base) if not _in_excluded_dir(p, root, exclude_dirs)]
+        changed = [p for p in diff_files(root, base) if scope.allows(p)]
         py_files = [p for p in changed if p.suffix == ".py"]
         fe_files = [p for p in changed if p.suffix.lower() in FRONTEND_SUFFIXES]
     else:
         targets = [Path(p).resolve() for p in paths] if paths else [root]
-        py_files, missing = _iter_files(targets, exclude_dirs, (".py",))
-        fe_files, _ = _iter_files(targets, exclude_dirs, FRONTEND_SUFFIXES)
-        findings.extend(
-            Finding(
-                p,
-                0,
-                "path-not-found",
-                f"'{p}' doesn't exist -- nothing was scanned for it.",
-            )
-            for p in missing
-        )
+        py_files, missing = _iter_files(targets, scope.dir_names, (".py",))
+        fe_files, _ = _iter_files(targets, scope.dir_names, FRONTEND_SUFFIXES)
+        py_files = [p for p in py_files if scope.allows(p)]
+        fe_files = [p for p in fe_files if scope.allows(p)]
+        findings.extend(Finding(p, 0, "path-not-found", f"'{p}' doesn't exist -- nothing was scanned for it.") for p in missing)
 
     py_files = [p for p in py_files if not _is_test_file(p, root)]
-    fe_files = [p for p in fe_files if not _is_test_file(p, root)]
+    fe_files = [p for p in fe_files if not _is_test_file(p, root) and not _is_minified(p)]
 
     if py_files:
         require_sqlglot()
@@ -265,16 +320,19 @@ def run(
     for path in fe_files:
         findings.extend(check_frontend_file(path))
 
-    findings.extend(check_csp(root, py_files + fe_files, exclude_dirs, {p.resolve() for p in changed} if diff else None))
-    return InjectionResult(findings=_filter_ignored(findings))
+    findings.extend(check_csp(root, py_files + fe_files, scope, {p.resolve() for p in changed} if diff else None))
+    return InjectionResult(findings=_dedupe(_filter_ignored(findings)))
 
 
-def _in_excluded_dir(path: Path, root: Path, exclude_dirs: frozenset[str]) -> bool:
-    try:
-        parts = path.relative_to(root).parts[:-1]
-    except ValueError:
-        parts = path.parts[:-1]
-    return any(part in exclude_dirs for part in parts)
+def _dedupe(findings: list[Finding]) -> list[Finding]:
+    seen: set[tuple[Path, int, str]] = set()
+    unique: list[Finding] = []
+    for f in findings:
+        key = (f.path, f.line, f.rule)
+        if key not in seen:
+            seen.add(key)
+            unique.append(f)
+    return unique
 
 
 def _is_test_file(path: Path, root: Path) -> bool:

{bmsdna_devtools-0.26.0 → bmsdna_devtools-0.27.0}/pyproject.toml

@@ -10,7 +10,7 @@ packages = ["bmsdna"]
 
 [project]
 name = "bmsdna-devtools"
-version = "0.26.0"
+version = "0.27.0"
 description = "Shared Azure DevOps / GitHub / git / Azure Monitor developer tooling for BMS projects"
 readme = "README.md"
 requires-python = ">=3.14"  # pgdevkit>=0.7.1 requires 3.14; was >=3.11 before adding it as a dependency

{bmsdna_devtools-0.26.0 → bmsdna_devtools-0.27.0}/tests/test_find_injection.py

@@ -236,3 +236,65 @@ def test_diff_mode_from_subdirectory_finds_untracked_files(tmp_path: Path) -> No
     (tmp_path / "backend" / "café.py").write_text("eval(y)\n")
     result = find_injection.run([], root=tmp_path / "backend", diff=True, base="main")
     assert [f.path.name for f in result.findings] == ["café.py"]
+
+
+def _rules_by_file(result) -> set[str]:
+    return {f.path.name for f in result.findings}
+
+
+def test_exclude_dir_name_path_and_glob(tmp_path: Path) -> None:
+    for d in ("vendor", "lib/generated", "web"):
+        (tmp_path / d).mkdir(parents=True)
+        (tmp_path / d / "bad.py").write_text("eval(x)\n")
+    (tmp_path / "web" / "bundle.js").write_text("eval(x);\n")
+    (tmp_path / "web.config").write_text("Content-Security-Policy: default-src 'self'")
+    assert len(find_injection.run([], root=tmp_path).findings) == 4
+    assert len(find_injection.run([], root=tmp_path, exclude=["vendor"]).findings) == 3
+    assert len(find_injection.run([], root=tmp_path, exclude=["lib/generated"]).findings) == 3
+    assert len(find_injection.run([], root=tmp_path, exclude=["web/*.js", "vendor/"]).findings) == 2
+    assert [f.path.name for f in find_injection.run([], root=tmp_path, exclude=["vendor", "lib", "web/*.js"]).findings] == ["bad.py"]
+
+
+def test_exclude_dirs_from_pyproject(tmp_path: Path) -> None:
+    (tmp_path / "pyproject.toml").write_text('[tool.bdt.lint]\nexclude_dirs = ["legacy"]\n')
+    (tmp_path / "legacy").mkdir()
+    (tmp_path / "legacy" / "bad.py").write_text("eval(x)\n")
+    assert find_injection.run([], root=tmp_path).findings == []
+
+
+def test_gitignored_files_are_skipped_unless_disabled(tmp_path: Path) -> None:
+    subprocess.run(["git", "init", "-b", "main"], cwd=tmp_path, check=True, capture_output=True)
+    (tmp_path / ".gitignore").write_text("built/\n")
+    (tmp_path / "built").mkdir()
+    (tmp_path / "built" / "bad.py").write_text("eval(x)\n")
+    (tmp_path / "src.py").write_text("eval(y)\n")
+    assert [f.path.name for f in find_injection.run([], root=tmp_path).findings] == ["src.py"]
+    assert len(find_injection.run([], root=tmp_path, respect_gitignore=False).findings) == 2
+
+
+def test_min_js_is_skipped_long_lines_are_not_and_findings_deduplicated(tmp_path: Path) -> None:
+    (tmp_path / "app.min.js").write_text("eval(x);")
+    (tmp_path / "bundle.js").write_text("a=1;" * 400 + "eval(x);\n")
+    (tmp_path / "dup.js").write_text("el.innerHTML = a; el.innerHTML = b;\n")
+    (tmp_path / "web.config").write_text("Content-Security-Policy: default-src 'self'")
+    result = find_injection.run([], root=tmp_path)
+    assert [(f.path.name, f.rule) for f in result.findings] == [("bundle.js", "fe-eval"), ("dup.js", "fe-inner-html")]
+
+
+def test_sqlglot_expression_sql_is_not_flagged(tmp_path: Path) -> None:
+    (tmp_path / "a.py").write_text(
+        """import sqlglot
+from sqlglot import exp, select
+from typing import cast, LiteralString
+
+
+def run(conn, t):
+    expr = select("a").from_(t).where(exp.column("b").eq(1))
+    conn.execute(expr.sql())
+    conn.execute(sqlglot.parse_one("select 1").sql(dialect="postgres"))
+    sql = exp.select("*").from_(exp.to_table(t)).sql("tsql")
+    conn.execute(sql)
+    conn.execute(cast(LiteralString, select("a").from_(t).sql(pretty=True)))
+"""
+    )
+    assert find_injection.run([], root=tmp_path).findings == []

{bmsdna_devtools-0.26.0 → bmsdna_devtools-0.27.0}/uv.lock

@@ -22,7 +22,7 @@ wheels = [
 
 [[package]]
 name = "bmsdna-devtools"
-version = "0.26.0"
+version = "0.27.0"
 source = { editable = "." }
 dependencies = [
     { name = "pgdevkit", extra = ["db"] },