codeaudit 1.9.0__tar.gz → 1.9.2__tar.gz

{codeaudit-1.9.0 → codeaudit-1.9.2}/CHANGELOG.md

@@ -1,5 +1,35 @@
 # Change Log
 
+## Version 1.9.2:
+
+* Fixed issue for API scan
+
+## Version 1.9.1:
+
+**Added**
+
+* Extra badge in the `README.md` for direct launch of the WASM version.
+* A switch option in the UI for the WASM version to use or suppress markers in code when scanning.
+* AI policy section for contributions in the manual.
+
+**Changed**
+
+* Adjusted validation values for checking `targz` files (`max_file_size = 15 * 1024 * 1024`, `max_tar_members = 12000`).
+* Tightened security for validating Python files using `validate_python` from the `fileaudit` Python module.
+* Dashboard version: Improved validation for valid PyPI names on the client side.
+* Improved handling and status of tabs in the WASM version.
+* Minor updates to the CLI help text.
+* Changed the manual title from **Python Security Code Audit** to **Python Code Audit**.
+
+**Fixed**
+
+* Improved and updated unit tests for validating the correct working of excluded directories during scans (`test_excluded_dirs`).
+
+**Documentation**
+
+* General updates and fixes for the manual.
+
+
 ## Version 1.9.0:
 
 **Added**

{codeaudit-1.9.0 → codeaudit-1.9.2}/PKG-INFO

@@ -1,6 +1,6 @@
 Metadata-Version: 2.4
 Name: codeaudit
-Version: 1.9.0
+Version: 1.9.2
 Summary: A modern Python security source code analyzer (SAST) based on distrust.
 Project-URL: Homepage, https://codeaudit.nocomplexity.com
 Project-URL: Documentation, https://github.com/nocomplexity/codeaudit#readme
@@ -35,7 +35,7 @@ Description-Content-Type: text/markdown
 
 # Codeaudit
 
-![CodeauditLogo](https://github.com/nocomplexity/codeaudit/raw/main/docs/images/codeauditlogo.png)
+[![CodeauditLogo](https://github.com/nocomplexity/codeaudit/raw/main/docs/images/codeauditlogo.png)](https://codeaudit.nocomplexity.com/)
 
 [![PythonCodeAudit Badge](https://img.shields.io/badge/Python%20Code%20Audit-Security%20Verified-FF0000?style=flat-square)](https://github.com/nocomplexity/codeaudit)
 [![PyPI - Version](https://img.shields.io/pypi/v/codeaudit.svg)](https://pypi.org/project/codeaudit)
@@ -43,6 +43,7 @@ Description-Content-Type: text/markdown
 [![OpenSSF Best Practices](https://www.bestpractices.dev/projects/10970/badge)](https://www.bestpractices.dev/projects/10970)
 [![Documentation](https://img.shields.io/badge/Python%20Code%20Audit%20Handbook-Available-blue)](https://nocomplexity.com/documents/codeaudit/intro.html)
 [![License](https://img.shields.io/badge/License-GPLv3-FFD700)](https://nocomplexity.com/documents/codeaudit/license.html)
+[![Try WebAssembly Version](https://img.shields.io/badge/Try_Live-In%20Your%20Browser-8A2BE2)](https://nocomplexity.com/codeauditapp/dashboardapp.html)
 [![PyPI Downloads](https://static.pepy.tech/badge/codeaudit)](https://pepy.tech/projects/codeaudit)
 
 Python Code Audit - A modern Python security source code analyzer based on distrust.
@@ -51,6 +52,15 @@ Python Code Audit is a static application security testing (SAST) tool designed
 
 This tool is designed for anyone who uses or creates Python programs and wants to understand and mitigate potential security risks.
 
+> [!TIP]
+> **Try it instantly — no installs, no setup, no excuses.**
+> 
+> 👉 [Launch the browser version](https://nocomplexity.com/codeauditapp/dashboardapp.html)
+
+It runs **100% locally** in your browser via WebAssembly (WASM). See the full power of **Python Code Audit** within 60 seconds.
+No downloads. No dependencies. Just click and run a security audit on any Python package on PyPI!
+
+
 This tool is created for:
 
 - Python Users who want to assess the security risks in the Python code they use.
@@ -82,14 +92,6 @@ Python Code Audit has the following features:
 
 ## Installation
 
-> [!TIP]
-> Try it instantly—no installs, no setup, no excuses.
->
-> 👉 Launch the browser version [here](https://nocomplexity.com/codeauditapp/dashboardapp.html)
-
-It runs 100% locally in your browser using WebAssembly (WASM). See the power of the tool in under 60 seconds.
-No downloads. No dependencies. Just click and do a security audit on Python Code.
-
 Loved the browser version? Unlock the full power. For advanced security code inspections, CI/CD integration, and all professional features, install the complete Python package:
 
 ```console

{codeaudit-1.9.0 → codeaudit-1.9.2}/README.md

@@ -1,6 +1,6 @@
 # Codeaudit
 
-![CodeauditLogo](https://github.com/nocomplexity/codeaudit/raw/main/docs/images/codeauditlogo.png)
+[![CodeauditLogo](https://github.com/nocomplexity/codeaudit/raw/main/docs/images/codeauditlogo.png)](https://codeaudit.nocomplexity.com/)
 
 [![PythonCodeAudit Badge](https://img.shields.io/badge/Python%20Code%20Audit-Security%20Verified-FF0000?style=flat-square)](https://github.com/nocomplexity/codeaudit)
 [![PyPI - Version](https://img.shields.io/pypi/v/codeaudit.svg)](https://pypi.org/project/codeaudit)
@@ -8,6 +8,7 @@
 [![OpenSSF Best Practices](https://www.bestpractices.dev/projects/10970/badge)](https://www.bestpractices.dev/projects/10970)
 [![Documentation](https://img.shields.io/badge/Python%20Code%20Audit%20Handbook-Available-blue)](https://nocomplexity.com/documents/codeaudit/intro.html)
 [![License](https://img.shields.io/badge/License-GPLv3-FFD700)](https://nocomplexity.com/documents/codeaudit/license.html)
+[![Try WebAssembly Version](https://img.shields.io/badge/Try_Live-In%20Your%20Browser-8A2BE2)](https://nocomplexity.com/codeauditapp/dashboardapp.html)
 [![PyPI Downloads](https://static.pepy.tech/badge/codeaudit)](https://pepy.tech/projects/codeaudit)
 
 Python Code Audit - A modern Python security source code analyzer based on distrust.
@@ -16,6 +17,15 @@ Python Code Audit is a static application security testing (SAST) tool designed
 
 This tool is designed for anyone who uses or creates Python programs and wants to understand and mitigate potential security risks.
 
+> [!TIP]
+> **Try it instantly — no installs, no setup, no excuses.**
+> 
+> 👉 [Launch the browser version](https://nocomplexity.com/codeauditapp/dashboardapp.html)
+
+It runs **100% locally** in your browser via WebAssembly (WASM). See the full power of **Python Code Audit** within 60 seconds.
+No downloads. No dependencies. Just click and run a security audit on any Python package on PyPI!
+
+
 This tool is created for:
 
 - Python Users who want to assess the security risks in the Python code they use.
@@ -47,14 +57,6 @@ Python Code Audit has the following features:
 
 ## Installation
 
-> [!TIP]
-> Try it instantly—no installs, no setup, no excuses.
->
-> 👉 Launch the browser version [here](https://nocomplexity.com/codeauditapp/dashboardapp.html)
-
-It runs 100% locally in your browser using WebAssembly (WASM). See the power of the tool in under 60 seconds.
-No downloads. No dependencies. Just click and do a security audit on Python Code.
-
 Loved the browser version? Unlock the full power. For advanced security code inspections, CI/CD integration, and all professional features, install the complete Python package:
 
 ```console

{codeaudit-1.9.0 → codeaudit-1.9.2}/docs/CONTRIBUTE.md

@@ -63,6 +63,58 @@ See the [section Development](makeitbetter) for to get a head start when making
 
 :::
 
+(AI-policy)=
+## Generative AI / LLM Policy
+
+Everyone is free to make contributions with or without AI assistence. Especially since English is not the native language of many people and users.
+
+**BUT:** Due to both legal and human reasons, we have to establish boundaries.
+
+:::{caution}
+- We take the responsibility for this project very seriously and we expect you to take your responsibility for your contributions seriously, too.
+- Every contribution has to be backed by a human who unequivocally owns the copyright for all changes.
+
+No LLM bots in `Co-authored-by:`s.
+- Absolutely **no** unsupervised agentic tools like OpenClaw.
+
+By submitting a pull request, you declare that:
+- You are the author of the contribution.
+- You **understand** the code.
+- You accept full responsibility for it.
+:::
+
+### Legal
+
+When you contribute to **Python Code Audit** (On PyPI `codeaudit`), your contributions (with or without AI support) are made under the same license as the file you are working on. You retain your copyright to your changes to this project.
+
+
+### Human
+
+We take responsibility to our users very serious. Every code change is reviewed manually before merging because it's our responsibility to keep the project **stable and secure**.
+
+Please understand that by opening low-quality pull requests generated by AI you're not helping. Make small pull request that are easy to review and merge. 
+:::{note}
+Every pull request must be created by a Human or reviewed by a human. A human is responsible for all text in an issue or pull request. 
+:::
+
+We have no time to become part of your vibe coding loop where you drop LLM slop and we spend time and energy to review it, and you just feed it back into the LLM for another iteration.
+
+In practice, this means:
+
+- Pull requests that have an LLM product listed as co-author can't be merged and will be closed without further discussion.
+
+If you used LLM tools during development, you may still submit. But you must remove all LLM author tags and take full ownership of every line.
+
+- By submitting a pull request, **you** take full responsibility for the contents of the pull request.
+
+*"An LLM wrote it"* is **not** an acceptable response to questions or review remarks.
+
+So:
+- Do **not** post LLM-generated review comments.
+- Do **not** post summaries unless you've fact-checked them and take responsibility for 100% of their content.
+
+*Attribution: This AI policy is based on [attrs' AI_POLICY.md](https://github.com/python-attrs/attrs/blob/main/.github/AI_POLICY.md).*
+
 (CoC-label)=
 ## Code of Conduct
 

{codeaudit-1.9.0 → codeaudit-1.9.2}/docs/_config.yml

@@ -99,6 +99,6 @@ sphinx:
       use_issues_button: True       
       home_page_in_toc: True 
       logo:
-           text: <b>Python Security Code Audit</b>
+           text: <b>Python Code Audit</b>
       extra_footer: '<p><a rel="license" href="http://creativecommons.org/licenses/by-sa/4.0/"><img alt="Creative Commons License" style="border-width:0" src="https://i.creativecommons.org/l/by-sa/4.0/88x31.png" /></a> This work is licensed under a <a rel="license" href="http://creativecommons.org/licenses/by-sa/4.0/">Creative Commons Attribution-ShareAlike 4.0 International License</a>.</p>'
       

{codeaudit-1.9.0 → codeaudit-1.9.2}/docs/checks/exception_check.md

@@ -1,4 +1,4 @@
-## Exception Statements
+# Exception Statements
 
 Python Code Audit  detects the use of `pass` within an `except` block.
 

{codeaudit-1.9.0 → codeaudit-1.9.2}/docs/codeauditcommands.md

@@ -1,6 +1,6 @@
 % THIS FILE IS GENERATED! - Use CLIcommands.ipynb to make it better!
 # Commands Overview
-Python Code Audit commands for: version: 1.9.0
+Python Code Audit commands for: version: 1.9.2
 ```
 ----------------------------------------------------
  _                    __             _
@@ -23,7 +23,7 @@ Commands:
   checks               Creates an HTML report of all implemented security checks.
   version              Prints the module version. Or use codeaudit [-v] [--v] [-version] or [--version].
 
-Use the Python Code Audit documentation (https://codeaudit.nocomplexity.com) to audit and secure your Python programmes. Explore further essential open-source security tools at https://simplifysecurity.nocomplexity.com/
+Use the Python Code Audit documentation (https://codeaudit.nocomplexity.com) to audit and secure your Python programmes. Explore further essential open-source security tools at https://pythonsecurity.nocomplexity.com/
 
 ```
 ## codeaudit overview

{codeaudit-1.9.0 → codeaudit-1.9.2}/docs/examples/ca_api_example_scanning.ipynb

@@ -33,7 +33,15 @@
    "execution_count": 3,
    "id": "bbcc805d-0f4d-49fc-a0f5-3ad863fe6da8",
    "metadata": {},
-   "outputs": [],
+   "outputs": [
+    {
+     "name": "stdout",
+     "output_type": "stream",
+     "text": [
+      "Exception: FileAudit Security Validation Failed - Only .py files are accepted (got extension ''): linkaudit\n"
+     ]
+    }
+   ],
    "source": [
     "result = filescan(packagename)  # linkaudit is a package that is present on PyPI.org"
    ]
@@ -48,18 +56,20 @@
      "data": {
       "text/plain": [
        "{'name': 'Python_Code_Audit',\n",
-       " 'version': '1.6.2',\n",
-       " 'generated_on': '2026-04-10 16:09',\n",
+       " 'version': '1.9.1',\n",
+       " 'generated_on': '2026-10-09 19:26',\n",
        " 'package_name': 'linkaudit',\n",
-       " 'package_release': '0.9.8',\n",
+       " 'package_release': '0.9.10',\n",
+       " 'update_date': '2026-10-08',\n",
+       " 'days_since_last_update': 1,\n",
        " 'statistics_overview': {'Number_Of_Files': 6,\n",
-       "  'Number_Of_Lines': 523,\n",
-       "  'AST_Nodes': 225,\n",
+       "  'Number_Of_Lines': 527,\n",
+       "  'AST_Nodes': 222,\n",
        "  'Core Modules': 6,\n",
-       "  'External Modules': 3,\n",
+       "  'External Modules': 1,\n",
        "  'Functions': 16,\n",
        "  'Classes': 0,\n",
-       "  'Comment_Lines': 194,\n",
+       "  'Comment_Lines': 189,\n",
        "  'Median_Complexity': 9.3,\n",
        "  'Maximum_Complexity': 26},\n",
        " 'module_overview': {'core_modules': ['asyncio',\n",
@@ -68,9 +78,9 @@
        "   'sys',\n",
        "   'urllib.error',\n",
        "   'urllib.request'],\n",
-       "  'imported_modules': ['_version', 'fire', 'linkaudit']},\n",
+       "  'imported_modules': ['fire']},\n",
        " 'file_security_info': {0: {'FileName': '__init__.py',\n",
-       "   'FilePath': '/tmp/codeaudit_sviyoehh/linkaudit-0.9.8/src/linkaudit/__init__.py',\n",
+       "   'FilePath': '/tmp/codeaudit_aftxsa3p/linkaudit-0.9.10/src/linkaudit/__init__.py',\n",
        "   'Number_Of_Lines': 10,\n",
        "   'AST_Nodes': 2,\n",
        "   'Std-Modules': 0,\n",
@@ -85,14 +95,14 @@
        "   'file_name': '__init__.py',\n",
        "   'sast_result': {}},\n",
        "  1: {'FileName': 'html_result.py',\n",
-       "   'FilePath': '/tmp/codeaudit_sviyoehh/linkaudit-0.9.8/src/linkaudit/html_result.py',\n",
-       "   'Number_Of_Lines': 83,\n",
-       "   'AST_Nodes': 28,\n",
+       "   'FilePath': '/tmp/codeaudit_aftxsa3p/linkaudit-0.9.10/src/linkaudit/html_result.py',\n",
+       "   'Number_Of_Lines': 84,\n",
+       "   'AST_Nodes': 29,\n",
        "   'Std-Modules': 1,\n",
        "   'External-Modules': 0,\n",
        "   'Functions': 2,\n",
        "   'Classes': 0,\n",
-       "   'Comment_Lines': 46,\n",
+       "   'Comment_Lines': 50,\n",
        "   'Complexity_Score': 6,\n",
        "   'warnings': 0,\n",
        "   'core_modules': ['os'],\n",
@@ -100,14 +110,14 @@
        "   'file_name': 'html_result.py',\n",
        "   'sast_result': {}},\n",
        "  2: {'FileName': 'markdownhelpers.py',\n",
-       "   'FilePath': '/tmp/codeaudit_sviyoehh/linkaudit-0.9.8/src/linkaudit/markdownhelpers.py',\n",
-       "   'Number_Of_Lines': 128,\n",
+       "   'FilePath': '/tmp/codeaudit_aftxsa3p/linkaudit-0.9.10/src/linkaudit/markdownhelpers.py',\n",
+       "   'Number_Of_Lines': 129,\n",
        "   'AST_Nodes': 50,\n",
        "   'Std-Modules': 2,\n",
        "   'External-Modules': 0,\n",
        "   'Functions': 4,\n",
        "   'Classes': 0,\n",
-       "   'Comment_Lines': 37,\n",
+       "   'Comment_Lines': 38,\n",
        "   'Complexity_Score': 20,\n",
        "   'warnings': 0,\n",
        "   'core_modules': ['os', 're'],\n",
@@ -115,26 +125,22 @@
        "   'file_name': 'markdownhelpers.py',\n",
        "   'sast_result': {}},\n",
        "  3: {'FileName': 'linkaudit.py',\n",
-       "   'FilePath': '/tmp/codeaudit_sviyoehh/linkaudit-0.9.8/src/linkaudit/linkaudit.py',\n",
-       "   'Number_Of_Lines': 271,\n",
-       "   'AST_Nodes': 135,\n",
+       "   'FilePath': '/tmp/codeaudit_aftxsa3p/linkaudit-0.9.10/src/linkaudit/linkaudit.py',\n",
+       "   'Number_Of_Lines': 273,\n",
+       "   'AST_Nodes': 131,\n",
        "   'Std-Modules': 5,\n",
        "   'External-Modules': 2,\n",
        "   'Functions': 9,\n",
        "   'Classes': 0,\n",
-       "   'Comment_Lines': 84,\n",
+       "   'Comment_Lines': 74,\n",
        "   'Complexity_Score': 26,\n",
        "   'warnings': 0,\n",
        "   'core_modules': ['asyncio', 'os', 'sys', 'urllib.error', 'urllib.request'],\n",
        "   'imported_modules': ['fire', 'linkaudit'],\n",
        "   'file_name': 'linkaudit.py',\n",
-       "   'sast_result': {171: {'line': 171,\n",
-       "     'validation': 'input',\n",
-       "     'severity': 'Low',\n",
-       "     'info': 'User input must be strictly sanitized and validated to prevent injection vulnerabilities.',\n",
-       "     'code': \"<pre><code class='language-python'>    files_tocheck = markdownhelpers.collect_markdown_files(bookdirectory)\\n    result_output = input(&quot;HTML output [H] (=Default) or TXT output [T]? )&quot;)\\n    txtoutput = &quot;# Result of Link Audit for markdown files (URL checker) \\\\n\\\\n&quot;</code></pre>\"}}},\n",
+       "   'sast_result': {}},\n",
        "  4: {'FileName': '_version.py',\n",
-       "   'FilePath': '/tmp/codeaudit_sviyoehh/linkaudit-0.9.8/src/linkaudit/_version.py',\n",
+       "   'FilePath': '/tmp/codeaudit_aftxsa3p/linkaudit-0.9.10/src/linkaudit/_version.py',\n",
        "   'Number_Of_Lines': 1,\n",
        "   'AST_Nodes': 1,\n",
        "   'Std-Modules': 0,\n",
@@ -149,7 +155,7 @@
        "   'file_name': '_version.py',\n",
        "   'sast_result': {}},\n",
        "  5: {'FileName': 'nocxhelpers.py',\n",
-       "   'FilePath': '/tmp/codeaudit_sviyoehh/linkaudit-0.9.8/src/linkaudit/nocxhelpers.py',\n",
+       "   'FilePath': '/tmp/codeaudit_aftxsa3p/linkaudit-0.9.10/src/linkaudit/nocxhelpers.py',\n",
        "   'Number_Of_Lines': 30,\n",
        "   'AST_Nodes': 9,\n",
        "   'Std-Modules': 0,\n",
@@ -191,7 +197,7 @@
    "name": "python",
    "nbconvert_exporter": "python",
    "pygments_lexer": "ipython3",
-   "version": "3.14.3"
+   "version": "3.14.7"
   }
  },
  "nbformat": 4,

{codeaudit-1.9.0 → codeaudit-1.9.2}/docs/examples/codeauditchecks.html

@@ -774,4 +774,4 @@ footer {
       <td>Vulnerable to path traversal attacks if used with untrusted archives.</td>
     </tr>
   </tbody>
-</table><br><p>Number of implemented security validations:<b>89</b></p><p>Version of codeaudit: <b>1.9.0</b><p>Because Python and cybersecurity are constantly changing, issue reports <b>SHOULD</b> specify the codeaudit version used.</p><p><b>Disclaimer:</b> <i>This SAST tool <a href="https://github.com/nocomplexity/codeaudit" target="_blank"><b>Python Code Audit</b></a> provides a powerful, automatic security analysis for Python source code. However, it's not a substitute for human review in combination with business knowledge. Undetected vulnerabilities may still exist.</i></p><p>This Python security report was created on: <b>2026-08-23 12:20</b> with <a href="https://github.com/nocomplexity/codeaudit" target="_blank"><b>Python Code Audit</b></a> version <b>1.9.0</b></p><hr><footer><div class="footer-links">Check the <a href="https://nocomplexity.com/documents/codeaudit/intro.html" target="_blank">documentation</a> for help on found issues.<br>Codeaudit is made with <span class="heart">&#10084;</span> by cyber security professionals who advocate for <a href="https://nocomplexity.com/simplify-security/" target="_blank">open simple security solutions</a>.<br><a href="https://nocomplexity.com/documents/codeaudit/CONTRIBUTE.html" target="_blank">Join the community</a> and contribute to make this tool better!</div></footer></div></body></html>
+</table><br><p>Number of implemented security validations:<b>89</b></p><p>Version of codeaudit: <b>1.9.2</b><p>Because Python and cybersecurity are constantly changing, issue reports <b>SHOULD</b> specify the codeaudit version used.</p><p><b>Disclaimer:</b> <i>This SAST tool <a href="https://github.com/nocomplexity/codeaudit" target="_blank"><b>Python Code Audit</b></a> provides a powerful, automatic security analysis for Python source code. However, it's not a substitute for human review in combination with business knowledge. Undetected vulnerabilities may still exist.</i></p><p>This Python security report was created on: <b>2026-10-09 19:31</b> with <a href="https://github.com/nocomplexity/codeaudit" target="_blank"><b>Python Code Audit</b></a> version <b>1.9.2</b></p><hr><footer><div class="footer-links">Check the <a href="https://nocomplexity.com/documents/codeaudit/intro.html" target="_blank">documentation</a> for help on found issues.<br>Codeaudit is made with <span class="heart">&#10084;</span> by cyber security professionals who advocate for <a href="https://nocomplexity.com/simplify-security/" target="_blank">open simple security solutions</a>.<br><a href="https://nocomplexity.com/documents/codeaudit/CONTRIBUTE.html" target="_blank">Join the community</a> and contribute to make this tool better!</div></footer></div></body></html>

{codeaudit-1.9.0 → codeaudit-1.9.2}/docs/examples/demoscan.json

@@ -1,7 +1,7 @@
 {
   "name": "Python_Code_Audit",
-  "version": "1.9.0",
-  "generated_on": "2026-08-23 12:20",
+  "version": "1.9.2",
+  "generated_on": "2026-10-09 19:31",
   "file_security_info": {
     "0": {
       "FileName": "demofile.py",

{codeaudit-1.9.0 → codeaudit-1.9.2}/docs/intro.md

@@ -5,6 +5,8 @@
 [![PyPI - Version](https://img.shields.io/pypi/v/codeaudit.svg)](https://pypi.org/project/codeaudit)
 [![Documentation](https://img.shields.io/badge/Python%20Code%20Audit%20Handbook-Available-blue)](https://nocomplexity.com/documents/codeaudit/intro.html)
 [![License](https://img.shields.io/badge/License-GPLv3-FFD700)](https://nocomplexity.com/documents/codeaudit/license.html)
+[![Try WebAssembly Version](https://img.shields.io/badge/Try_Live-In%20Your%20Browser-8A2BE2)](https://nocomplexity.com/codeauditapp/dashboardapp.html)
+
 
 ![CodeauditLogo](images/codeauditlogo.png)
 

{codeaudit-1.9.0 → codeaudit-1.9.2}/docs/makeitbetter.md

@@ -18,7 +18,7 @@ When you contribute text or code to Python Code Audit, your contributions are ma
 
 :::{tip}
 All contributions are welcome!
-Think of corrections on the manual, code and more, or better tests.
+Think of corrections on the manual, code and more, or better tests. But be careful with [AI contributions](AI-policy).
 
 * Questions, Feature Requests, Bug Reports should all be reported on the [Github Issue Tracker](https://github.com/nocomplexity/codeaudit/issues) .
 

{codeaudit-1.9.0 → codeaudit-1.9.2}/src/codeaudit/__about__.py

@@ -1,4 +1,4 @@
 # SPDX-FileCopyrightText: 2025-present Maikel Mardjan
 #
 # SPDX-License-Identifier: GPL-3.0-or-later
-__version__ = "1.9.0"
+__version__ = "1.9.2"

{codeaudit-1.9.0 → codeaudit-1.9.2}/src/codeaudit/api_interfaces.py

@@ -139,11 +139,7 @@ def filescan(input_path, nosec=False):
         scan_output = _codeaudit_directory_scan(input_path, nosec_flag=nosec)
         output |= scan_output
         return output
-    elif (
-        file_path.suffix.lower() == ".py"
-        and file_path.is_file()
-        and is_ast_parsable(input_path)
-    ):  # check on parseable single Python file
+    elif is_ast_parsable(input_path):  # check on parseable single Python file
         # do a file check
         file_information = overview_per_file(input_path)
         module_information = get_modules(input_path)  # modules per file
@@ -464,11 +460,7 @@ def get_overview(input_path):
         else:
             output_msg = f"Directory path {input_path} contains no Python files."
             return {"Error": output_msg}
-    elif (
-        file_path.suffix.lower() == ".py"
-        and file_path.is_file()
-        and is_ast_parsable(input_path)
-    ):
+    elif is_ast_parsable(input_path):
         security_statistics = overview_per_file(input_path)
         return security_statistics
     else:

{codeaudit-1.9.0 → codeaudit-1.9.2}/src/codeaudit/corecli.py

@@ -73,7 +73,7 @@ def display_help():
         summary = docstring.split("\n", 1)[0]
         print(f"  {command:<20} {summary}")
     print(
-        "\nUse the Python Code Audit documentation (https://codeaudit.nocomplexity.com) to audit and secure your Python programmes. Explore further essential open-source security tools at https://simplifysecurity.nocomplexity.com/\n"
+        "\nUse the Python Code Audit documentation (https://codeaudit.nocomplexity.com) to audit and secure your Python programmes. Explore further essential open-source security tools at https://pythonsecurity.nocomplexity.com/\n"
     )
 
 

{codeaudit-1.9.0 → codeaudit-1.9.2}/src/codeaudit/filehelpfunctions.py

@@ -18,6 +18,8 @@ import sys
 import warnings
 from pathlib import Path
 
+from fileaudit.python_check import validate_python
+
 
 def read_in_source_file(file_path):
     # Ensure file_path is a Path object
@@ -97,24 +99,16 @@ def get_filename_from_path(file_path):
 
 def is_ast_parsable(file_path):
     """
-    Checks whether a Python file can be parsed using the AST module.
+    Checks whether a Python file can be validated and parsed.
+    Uses the extensive security checker for valid Python files of the module https://github.com/nocomplexity/fileaudit
 
     Args:
-        file_path (str): Path to the Python source file.
+        file_path (str | Path): Path to the Python source file.
 
     Returns:
-        bool: True if the file can be parsed without syntax errors, False otherwise.
+        bool: True if the file passes Python validation, False otherwise.
     """
-    try:
-        with open(file_path, "r", encoding="utf-8") as f:
-            source = f.read()
-
-        with warnings.catch_warnings():
-            warnings.simplefilter("ignore", category=SyntaxWarning)
-            ast.parse(source, filename=file_path)
-        return True
-    except (SyntaxError, UnicodeDecodeError, ValueError) as e:
-        return False
+    return validate_python(Path(file_path))
 
 
 def has_python_files(input_path):

{codeaudit-1.9.0 → codeaudit-1.9.2}/src/codeaudit/pypi_package_scan.py

@@ -14,6 +14,7 @@ Public API functions for Python Code Audit aka codeaudit on pypi.org
 """
 
 import gzip
+import os
 import json
 import tarfile
 import tempfile
@@ -84,10 +85,35 @@ def get_pypi_download_info(package_name):
 
 
 def is_valid_tar_gz(path):
-    """Return True if the given path is a valid .tar.gz file.
-    Default values for validate_tar_gz are used! So note that NOT all tar.gz files will be accepted. Use PyPI tar.gz instead if possible.
+    """Return True only if the path points to a valid .tar.gz archive.
+
+    Archives must pass custom validation limits:
+    - Maximum file size: 15 MiB
+    - Maximum number of tar members: 12,000
     """
-    return bool(validate_tar_gz(path, max_tar_members=3000))
+    try:
+        path = os.fspath(path)
+
+        return (
+            path.endswith(".tar.gz")
+            and validate_tar_gz(
+                path,
+                max_file_size=15 * 1024 * 1024,
+                max_tar_members=12000,
+            )
+            and tarfile.is_tarfile(path)
+        )
+    except (OSError, ValueError, TypeError, AttributeError, tarfile.TarError):
+        return False
+
+
+# def is_valid_tar_gz(path):
+#     """Return True if the given path is a valid .tar.gz file.
+#     Custom validation values for validate_tar_gz are used. So note that NOT all tar.gz files will be accepted. Use PyPI package scan instead if possible.
+#     """
+#     return bool(
+#         validate_tar_gz(path, max_file_size=15 * 1024 * 1024, max_tar_members=12000)
+#     )
 
 
 def get_targz_package_source(

{codeaudit-1.9.0 → codeaudit-1.9.2}/src/codeaudit/reporting.py

@@ -160,7 +160,7 @@ def overview_report(directory, filename=DEFAULT_OUTPUT_FILE):
             print(f"ERROR: Directory '{directory}' contains no Python files.")
             exit(1)
     elif file_path.name.endswith(".tar.gz") and validate_tar_gz(
-        directory
+        directory, max_file_size=15 * 1024 * 1024, max_tar_members=12000
     ):  # for local tar.gz or remote tar.gz scans
         package_name = directory
         advice = f'<p>&#128073; To perform a SAST scan on the source code, run:<pre><code class="language-python">codeaudit filescan {directory}</code></pre></p>'
@@ -379,11 +379,7 @@ def scan_report(input_path, filename=DEFAULT_OUTPUT_FILE, nosec=False):
         directory_scan_report(
             input_path, nosec_flag=nosec, filename=filename
         )  # create a package aka directory scan report
-    elif (
-        file_path.suffix == ".py"
-        and file_path.is_file()
-        and is_ast_parsable(input_path)
-    ):
+    elif is_ast_parsable(input_path):
         # create a sast file check report
         if not nosec:  # no filtering on reviewed items with markers in code
             scan_output = perform_validations(
@@ -410,7 +406,7 @@ def scan_report(input_path, filename=DEFAULT_OUTPUT_FILE, nosec=False):
         create_htmlfile(html_output, filename)
 
     elif file_path.name.endswith(".tar.gz") and validate_tar_gz(
-        input_path
+        input_path, max_file_size=15 * 1024 * 1024, max_tar_members=12000
     ):  # for local tar.gz or remote tar.gz scans
         src_dir, tmp_handle = get_targz_package_source(input_path)
         directory_scan_report(
@@ -744,9 +740,7 @@ def report_module_information(inputfile, reportname=DEFAULT_OUTPUT_FILE):
             "See codeaudit modulescan -h or check the manual https://codeaudit.nocomplexity.com"
         )
         exit(1)
-    elif (
-        file_path.suffix == ".py" and file_path.is_file() and is_ast_parsable(inputfile)
-    ):
+    elif is_ast_parsable(inputfile):
         source = read_in_source_file(inputfile)
         used_modules = get_imported_modules(source)
         # Initial call to print 0% progress