chunk-your-tools 1.0.1__tar.gz

chunk_your_tools-1.0.1/.ast-grep/rule-tests/Test.md

@@ -0,0 +1,3 @@
+# Test the rule
+
+<https://github.com/ast-grep/ast-grep.github.io/blob/main/website/guide/test-rule.md>

chunk_your_tools-1.0.1/.ast-grep/rules/Lint.md

@@ -0,0 +1,12 @@
+# Lint Rule
+
+<https://github.com/ast-grep/ast-grep.github.io/blob/main/website/guide/project/lint-rule.md>
+
+## Rule Catalog
+
+<https://github.com/ast-grep/ast-grep.github.io/tree/main/website/catalog/python>
+<https://github.com/ast-grep/ast-grep.github.io/tree/main/website/catalog/yaml>
+<https://github.com/ast-grep/ast-grep.github.io/tree/main/website/catalog/typescript>
+<https://github.com/ast-grep/ast-grep.github.io/tree/main/website/catalog/html>
+
+<https://github.com/coderabbitai/ast-grep-essentials/tree/main/rules>

chunk_your_tools-1.0.1/.ast-grep/rules/avoid-mktemp-python.yml

@@ -0,0 +1,75 @@
+id: avoid-mktemp-python
+language: python
+severity: warning
+message: >-
+  The function `mktemp` is deprecated. When using this function, it is
+  possible for an attacker to modify the created file before the filename is
+  returned. Use `NamedTemporaryFile()` instead and pass it the
+  `delete=False` parameter.
+note: >-
+  [CWE-377]: Insecure Temporary File
+  [OWASP A01:2021]: Broken Access Control
+  [REFERENCES]
+       https://docs.python.org/3/library/tempfile.html#tempfile.mktemp
+       https://owasp.org/Top10/A01_2021-Broken_Access_Control
+ast-grep-essentials: true
+utils:
+  match_call:
+    kind: call
+    all:
+      - has:
+          stopBy: end
+          kind: attribute
+          field: function
+          all:
+            - has:
+                stopBy: end
+                kind: identifier
+                field: object
+                regex: "^tempfile$"
+            - has:
+                stopBy: end
+                kind: identifier
+                field: attribute
+                regex: "^mktemp$"
+      - has:
+          stopBy: end
+          kind: argument_list
+          field: arguments
+  match_second_call:
+    kind: call
+    all:
+      - has:
+          stopBy: end
+          kind: identifier
+          field: function
+          regex: "^mktemp$"
+      - has:
+          stopBy: end
+          kind: argument_list
+          field: arguments
+    inside:
+      stopBy: end
+      kind: expression_statement
+      follows:
+        stopBy: end
+        kind: import_from_statement
+        all:
+          - has:
+              kind: dotted_name
+              field: module_name
+              has:
+                kind: identifier
+                regex: "^tempfile$"
+          - has:
+              stopBy: end
+              kind: dotted_name
+              field: name
+              has:
+                stopBy: end
+                kind: identifier
+                regex: "^mktemp$"
+rule:
+  any:
+    - matches: match_call
+    - matches: match_second_call

chunk_your_tools-1.0.1/.ast-grep/rules/avoid-nested-links-tsx.yml

@@ -0,0 +1,8 @@
+id: no-nested-links
+language: tsx
+severity: error
+rule:
+  pattern: <a $$$>$$$A</a>
+  has:
+    pattern: <a $$$>$$$</a>
+    stopBy: end

chunk_your_tools-1.0.1/.ast-grep/rules/avoid_app_run_with_bad_host-python.yml

@@ -0,0 +1,74 @@
+id: avoid_app_run_with_bad_host-python
+language: python
+severity: warning
+message: >-
+  Running flask app with host 0.0.0.0 could expose the server publicly.
+note: >-
+  [CWE-668]: Exposure of Resource to Wrong Sphere
+  [OWASP A01:2021]: Broken Access Control
+  [REFERENCES]
+       https://owasp.org/Top10/A01_2021-Broken_Access_Control
+ast-grep-essentials: true
+utils:
+  MATCH_PATTERN_app.run:
+    kind: call
+    all:
+      - has:
+          stopBy: neighbor
+          kind: attribute
+          all:
+            - has:
+                stopBy: neighbor
+                kind: identifier
+                regex: "^app$"
+            - has:
+                stopBy: neighbor
+                kind: identifier
+                regex: "^run$"
+      - has:
+          stopBy: neighbor
+          kind: argument_list
+          has:
+            stopBy: neighbor
+            kind: string
+            regex: ^"0.0.0.0"$
+
+  MATCH_PATTERN_app.run_HOST:
+    kind: call
+    all:
+      - has:
+          stopBy: neighbor
+          kind: attribute
+          all:
+            - has:
+                stopBy: neighbor
+                kind: identifier
+                regex: "^app$"
+            - has:
+                stopBy: neighbor
+                kind: identifier
+                regex: "^run$"
+      - has:
+          stopBy: neighbor
+          kind: argument_list
+          has:
+            stopBy: neighbor
+            kind: keyword_argument
+            all:
+              - has:
+                  stopBy: neighbor
+                  kind: identifier
+                  regex: "^host$"
+              - has:
+                  stopBy: neighbor
+                  kind: string
+                  regex: ^"0.0.0.0"$
+              - has:
+                  stopBy: neighbor
+                  regex: "^=$"
+
+rule:
+  kind: call
+  any:
+    - matches: MATCH_PATTERN_app.run
+    - matches: MATCH_PATTERN_app.run_HOST

chunk_your_tools-1.0.1/.ast-grep/rules/debug-enabled-python.yml

@@ -0,0 +1,93 @@
+id: debug-enabled-python
+severity: warning
+language: python
+message: >-
+  Detected Flask app with debug=True. Do not deploy to production with
+  this flag enabled as it will leak sensitive information. Instead, consider
+  using Flask configuration variables or setting 'debug' using system
+  environment variables.
+note: >-
+  [CWE-489] Active Debug Code.
+  [REFERENCES]
+      - https://labs.detectify.com/2015/10/02/how-patreon-got-hacked-publicly-exposed-werkzeug-debugger/
+ast-grep-essentials: true
+utils:
+  MATCH_PATTERN_debug=True:
+    kind: call
+    all:
+      - has:
+          stopBy: neighbor
+          kind: attribute
+          all:
+            - has:
+                stopBy: neighbor
+                kind: identifier
+                regex: "^app$"
+            - has:
+                stopBy: neighbor
+                kind: identifier
+                regex: "^run$"
+      - has:
+          stopBy: neighbor
+          kind: argument_list
+          has:
+            stopBy: neighbor
+            kind: keyword_argument
+            regex: "^debug=True$"
+      - any:
+          - inside:
+              stopBy: end
+              kind: if_statement
+              follows:
+                stopBy: end
+                kind: import_from_statement
+                has:
+                  stopBy: end
+                  kind: dotted_name
+                  has:
+                    stopBy: neighbor
+                    kind: identifier
+                    regex: "^Flask$"
+          - inside:
+              stopBy: end
+              kind: function_definition
+              follows:
+                stopBy: end
+                kind: import_from_statement
+                has:
+                  stopBy: end
+                  kind: dotted_name
+                  has:
+                    stopBy: neighbor
+                    kind: identifier
+                    regex: "^Flask$"
+          - inside:
+              stopBy: end
+              kind: expression_statement
+              follows:
+                stopBy: end
+                kind: import_from_statement
+                has:
+                  stopBy: end
+                  kind: dotted_name
+                  has:
+                    stopBy: neighbor
+                    kind: identifier
+                    regex: "^Flask$"
+          - inside:
+              stopBy: end
+              kind: decorated_definition
+              follows:
+                stopBy: end
+                kind: import_from_statement
+                has:
+                  stopBy: end
+                  kind: dotted_name
+                  has:
+                    stopBy: neighbor
+                    kind: identifier
+                    regex: "^Flask$"
+rule:
+  kind: call
+  any:
+    - matches: MATCH_PATTERN_debug=True

chunk_your_tools-1.0.1/.ast-grep/rules/find-import-file-without-extension-ts.yml

@@ -0,0 +1,17 @@
+id: find-import-file
+message: Local file imports should include file extensions (.ts, .js, etc). Exclude npm packages.
+language: js
+severity: info
+rule:
+  regex: "^\\./[^.]+[^/]$"
+  kind: string_fragment
+  any:
+    - inside:
+        stopBy: end
+        kind: import_statement
+    - inside:
+        stopBy: end
+        kind: call_expression
+        has:
+          field: function
+          regex: "^import$"

chunk_your_tools-1.0.1/.ast-grep/rules/hashids-with-django-secret-python.yml

@@ -0,0 +1,284 @@
+id: hashids-with-django-secret-python
+language: python
+severity: warning
+message: >-
+  The Django secret key is used as salt in HashIDs. The HashID mechanism
+  is not secure. By observing sufficient HashIDs, the salt used to construct
+  them can be recovered. This means the Django secret key can be obtained by
+  attackers, through the HashIDs.
+note: >-
+  [CWE-327]: Use of a Broken or Risky Cryptographic Algorithm
+  [OWASP A02:2021]: Cryptographic Failures
+  [REFERENCES]
+       https://docs.djangoproject.com/en/4.2/ref/settings/#std-setting-SECRET_KEY
+       http://carnage.github.io/2015/08/cryptanalysis-of-hashids
+ast-grep-essentials: true
+utils:
+  Hashids(salt=settings.SECRET_KEY, min_length=settings.ID_HASH_MIN_LENGTH):
+    kind: call
+    all:
+      - has:
+          kind: identifier
+          nthChild: 1
+          regex: ^Hashids$
+      - has:
+          kind: argument_list
+          nthChild: 2
+          has:
+            kind: keyword_argument
+            all:
+              - has:
+                  kind: identifier
+                  regex: ^salt$
+              - has:
+                  kind: attribute
+                  all:
+                    - has:
+                        kind: identifier
+                        regex: ^settings$
+                        nthChild: 1
+                    - has:
+                        kind: identifier
+                        nthChild: 2
+                        regex: ^SECRET_KEY$
+      - all:
+          - any:
+              - inside:
+                  stopBy: end
+                  follows:
+                    stopBy: end
+                    kind: import_from_statement
+                    pattern: from django.conf import settings
+              - follows:
+                  stopBy: end
+                  kind: import_from_statement
+                  pattern: from django.conf import settings
+          - any:
+              - inside:
+                  stopBy: end
+                  follows:
+                    stopBy: end
+                    kind: import_from_statement
+                    pattern: from hashids import Hashids
+              - follows:
+                  stopBy: end
+                  kind: import_from_statement
+                  pattern: from hashids import Hashids
+
+  Hashids(settings.SECRET_KEY, min_length=length, alphabet=alphabet):
+    kind: call
+    all:
+      - has:
+          kind: identifier
+          nthChild: 1
+          regex: ^Hashids$
+      - has:
+          kind: argument_list
+          nthChild: 2
+          has:
+            kind: attribute
+            all:
+              - has:
+                  kind: identifier
+                  regex: ^settings$
+                  nthChild: 1
+              - has:
+                  kind: identifier
+                  nthChild: 2
+                  regex: ^SECRET_KEY$
+      - all:
+          - any:
+              - inside:
+                  stopBy: end
+                  follows:
+                    stopBy: end
+                    kind: import_from_statement
+                    pattern: from django.conf import settings
+              - follows:
+                  stopBy: end
+                  kind: import_from_statement
+                  pattern: from django.conf import settings
+          - any:
+              - inside:
+                  stopBy: end
+                  follows:
+                    stopBy: end
+                    kind: import_from_statement
+                    pattern: from hashids import Hashids
+              - follows:
+                  stopBy: end
+                  kind: import_from_statement
+                  pattern: from hashids import Hashids
+
+  hashids.Hashids(salt=settings.SECRET_KEY, min_length=settings.ID_HASH_MIN_LENGTH):
+    kind: call
+    all:
+      - has:
+          kind: attribute
+          regex: ^hashids.Hashids$
+      - has:
+          kind: argument_list
+          nthChild: 2
+          has:
+            kind: keyword_argument
+            all:
+              - has:
+                  kind: identifier
+                  regex: ^salt$
+              - has:
+                  kind: attribute
+                  all:
+                    - has:
+                        kind: identifier
+                        regex: ^settings$
+                        nthChild: 1
+                    - has:
+                        kind: identifier
+                        nthChild: 2
+                        regex: ^SECRET_KEY$
+      - any:
+          - inside:
+              stopBy: end
+              follows:
+                stopBy: end
+                kind: import_from_statement
+                pattern: from django.conf import settings
+          - follows:
+              stopBy: end
+              kind: import_from_statement
+              pattern: from django.conf import settings
+
+  hashids.Hashids(settings.SECRET_KEY, min_length=length, alphabet=alphabet):
+    kind: call
+    all:
+      - has:
+          kind: attribute
+          nthChild: 1
+          regex: ^hashids.Hashids$
+      - has:
+          kind: argument_list
+          nthChild: 2
+          has:
+            kind: attribute
+            all:
+              - has:
+                  kind: identifier
+                  regex: ^settings$
+                  nthChild: 1
+              - has:
+                  kind: identifier
+                  nthChild: 2
+                  regex: ^SECRET_KEY$
+      - all:
+          - any:
+              - inside:
+                  stopBy: end
+                  follows:
+                    stopBy: end
+                    kind: import_from_statement
+                    pattern: from django.conf import settings
+              - follows:
+                  stopBy: end
+                  kind: import_from_statement
+                  pattern: from django.conf import settings
+
+  hashids.Hashids(salt=django.conf.settings.SECRET_KEY, min_length=settings.ID_HASH_MIN_LENGTH):
+    kind: call
+    all:
+      - has:
+          kind: attribute
+          nthChild: 1
+          regex: ^hashids.Hashids$
+      - has:
+          kind: argument_list
+          nthChild: 2
+          has:
+            kind: keyword_argument
+            all:
+              - has:
+                  kind: identifier
+                  regex: ^salt$
+              - has:
+                  kind: attribute
+                  regex: ^django.conf.settings.SECRET_KEY$
+
+  hashids.Hashids(django.conf.settings.SECRET_KEY, min_length=length, alphabet=alphabet):
+    kind: call
+    all:
+      - has:
+          kind: attribute
+          nthChild: 1
+          regex: ^hashids.Hashids$
+      - has:
+          kind: argument_list
+          nthChild: 2
+          has:
+            kind: attribute
+            regex: ^django.conf.settings.SECRET_KEY$
+
+  Hashids(django.conf.settings.SECRET_KEY, min_length=length, alphabet=alphabet):
+    kind: call
+    all:
+      - has:
+          kind: identifier
+          nthChild: 1
+          regex: ^Hashids$
+      - has:
+          kind: argument_list
+          nthChild: 2
+          has:
+            kind: attribute
+            regex: ^django.conf.settings.SECRET_KEY$
+      - any:
+          - inside:
+              stopBy: end
+              follows:
+                stopBy: end
+                kind: import_from_statement
+                pattern: from hashids import Hashids
+          - follows:
+              stopBy: end
+              kind: import_from_statement
+              pattern: from hashids import Hashids
+
+  Hashids(salt=django.conf.settings.SECRET_KEY, min_length=settings.ID_HASH_MIN_LENGTH):
+    kind: call
+    all:
+      - has:
+          kind: identifier
+          nthChild: 1
+          regex: ^Hashids$
+      - has:
+          kind: argument_list
+          nthChild: 2
+          has:
+            kind: keyword_argument
+            all:
+              - has:
+                  kind: identifier
+                  regex: ^salt$
+              - has:
+                  kind: attribute
+                  regex: ^django.conf.settings.SECRET_KEY$
+      - any:
+          - inside:
+              stopBy: end
+              follows:
+                stopBy: end
+                kind: import_from_statement
+                pattern: from hashids import Hashids
+          - follows:
+              stopBy: end
+              kind: import_from_statement
+              pattern: from hashids import Hashids
+
+rule:
+  any:
+    - matches: Hashids(salt=settings.SECRET_KEY, min_length=settings.ID_HASH_MIN_LENGTH)
+    - matches: Hashids(settings.SECRET_KEY, min_length=length, alphabet=alphabet)
+    - matches: hashids.Hashids(salt=settings.SECRET_KEY, min_length=settings.ID_HASH_MIN_LENGTH)
+    - matches: hashids.Hashids(settings.SECRET_KEY, min_length=length, alphabet=alphabet)
+    - matches: hashids.Hashids(salt=django.conf.settings.SECRET_KEY, min_length=settings.ID_HASH_MIN_LENGTH)
+    - matches: hashids.Hashids(django.conf.settings.SECRET_KEY, min_length=length, alphabet=alphabet)
+    - matches: Hashids(django.conf.settings.SECRET_KEY, min_length=length, alphabet=alphabet)
+    - matches: Hashids(salt=django.conf.settings.SECRET_KEY, min_length=settings.ID_HASH_MIN_LENGTH)