codeaudit 1.9.2__py3-none-any.whl → 1.9.4__py3-none-any.whl

codeaudit/__about__.py

@@ -1,4 +1,4 @@
 # SPDX-FileCopyrightText: 2025-present Maikel Mardjan
 #
 # SPDX-License-Identifier: GPL-3.0-or-later
-__version__ = "1.9.2"
+__version__ = "1.9.4"

codeaudit/altairplots.py

@@ -18,7 +18,8 @@ import pandas as pd
 
 from collections import Counter
 from pathlib import Path
-
+from codeaudit.api_interfaces import get_weakness_counts
+from codeaudit.api_reporting import total_weaknesses
 
 def module_count_barchart(scanresult):
     """Create a bar chart showing module counts by category.
@@ -689,20 +690,8 @@ def weaknesses_overview(scanresult):
             .mark_text()
             .encode(text="msg:N")
         )
-
-    # --- Count every 'validation' across all files ---
-    counter = Counter()
-    for file_info in file_security_info.values():
-        if not isinstance(file_info, dict):
-            continue
-        sast_result = file_info.get("sast_result")
-        if not isinstance(sast_result, dict):
-            continue
-        for finding in sast_result.values():
-            if isinstance(finding, dict):
-                validation = finding.get("validation")
-                if validation and isinstance(validation, str):
-                    counter[validation] += 1
+    # --- Count every validation across all files ---
+    counter = Counter(get_weakness_counts(scanresult))    
 
     if not counter:
         return (
@@ -875,7 +864,7 @@ def sast_files_overview(scanresult):
                 "base_name": base_name,
                 "parent_folder": parent_folder,
                 "full_path": str(filepath),
-                "issues": len(sast_result),
+                "issues": total_weaknesses(scanresult),
                 "complexity": file_info.get("Complexity_Score", 0),
             }
         )
@@ -977,19 +966,8 @@ def weaknesses_radial_overview(scanresult):
         )
 
     # --- Count every 'validation' across all files ---
-    counter = Counter()
-    for file_info in file_security_info.values():
-        if not isinstance(file_info, dict):
-            continue
-        sast_result = file_info.get("sast_result")
-        if not isinstance(sast_result, dict):
-            continue
-        for finding in sast_result.values():
-            if isinstance(finding, dict):
-                validation = finding.get("validation")
-                if validation and isinstance(validation, str):
-                    counter[validation] += 1
-
+    counter = Counter(get_weakness_counts(scanresult))    
+   
     if not counter:
         return (
             alt.Chart(

codeaudit/api_interfaces.py

@@ -138,8 +138,8 @@ def filescan(input_path, nosec=False):
         output |= {"package_name": package_name}
         scan_output = _codeaudit_directory_scan(input_path, nosec_flag=nosec)
         output |= scan_output
-        return output
-    elif is_ast_parsable(input_path):  # check on parseable single Python file
+        return output    
+    elif file_path.name.endswith(".py") and is_ast_parsable(input_path): # check on parsable single Python file    
         # do a file check
         file_information = overview_per_file(input_path)
         module_information = get_modules(input_path)  # modules per file
@@ -312,41 +312,68 @@ def read_input_file(filename, safe_directory="data_folder"):
     except json.JSONDecodeError as e:
         raise json.JSONDecodeError(f"Invalid JSON in file: {file_path}", e.doc, e.pos)
 
-
 def get_weakness_counts(input_file, nosec=False):
-    """
-    Analyze a Python file or package and count occurrences of code weaknesses.
-    """
-    # Assuming filescan is imported from codeaudit.api_interfaces
-    scan_result = filescan(input_file, nosec)
+    """Count SAST weaknesses from a scan result or by scanning a file/package.
+
+    Accepts either a pre-computed scan result dictionary or a path to a file
+    or package. In the latter case the path is scanned with `filescan`.
+
+    Args:
+        input_file: Path to a file/package to scan, or an existing scan result
+            dictionary.
+        nosec: Whether to pass the `nosec` flag to `filescan`. Defaults to False.
+
+    Returns:
+        A dictionary mapping each weakness type (str) to its total occurrence
+        count (int) across all scanned files. Returns an empty dict if no
+        valid security information is present.
+
+    Raises:
+        ValueError: If the scan result is invalid or contains an error.
+    """    
+    # Accept an existing scan result or scan a file/package
+    if isinstance(input_file, dict):
+        scan_result = input_file
+    else:
+        scan_result = filescan(input_file, nosec)
 
     if not isinstance(scan_result, dict):
-        raise ValueError("filescan() did not return a valid result dictionary")
+        raise ValueError("Invalid scan result")
 
     if "Error" in scan_result:
         raise ValueError(scan_result["Error"])
 
     file_security_info = scan_result.get("file_security_info")
+
     if not isinstance(file_security_info, dict):
         return {}
 
     counter = Counter()
 
     for file_info in file_security_info.values():
+
         if not isinstance(file_info, dict):
             continue
 
         sast_result = file_info.get("sast_result", {})
+
         if not isinstance(sast_result, dict):
             continue
 
-        # Based on your data: sast_result keys are line numbers (e.g., 171)
-        # and values are dicts containing the 'validation' type.
-        for issue_details in sast_result.values():
-            if isinstance(issue_details, dict):
-                # We use the 'validation' field to identify the type of weakness
-                weakness_type = issue_details.get("validation", "Unknown")
-                counter[weakness_type] += 1
+        for finding in sast_result.values():
+
+            # Support individual findings and lists of findings
+            findings = finding if isinstance(finding, list) else [finding]
+
+            for issue in findings:
+
+                if not isinstance(issue, dict):
+                    continue
+
+                weakness_type = issue.get("validation", "Unknown")
+
+                if isinstance(weakness_type, str) and weakness_type:
+                    counter[weakness_type] += 1
 
     return dict(counter)
 
@@ -511,6 +538,50 @@ def get_default_validations():
     return output
 
 
+def get_weakness_counts_per_file(scanresult):
+    """Creates an overview of the SAST scan: Number of weaknesses per file.
+
+    Aggregates SAST findings 
+
+    Args:
+        scanresult (dict): Scan result containing "file_security_info"
+            with per-file SAST findings and metadata.
+
+    Returns:
+        result (dict): Just number of weaknesses per file scanned
+    """    
+    file_security_info = scanresult.get("file_security_info")
+    if not isinstance(file_security_info, dict) or not file_security_info:
+        return None
+
+    records = []
+    for file_info in file_security_info.values():
+        if not isinstance(file_info, dict):
+            continue
+
+        sast_result = file_info.get("sast_result")
+        if not isinstance(sast_result, dict):
+            continue
+
+        filepath = file_info.get("FilePath") or file_info.get("file_name", "")
+        path_obj = Path(str(filepath))
+
+        base_name = file_info.get("FileName") or path_obj.name or "Unknown"
+        parent_folder = path_obj.parent.name if len(path_obj.parts) > 1 else None
+        if parent_folder in ("", ".", "/"):
+            parent_folder = None
+
+        records.append(
+            {
+                "base_name": base_name,                                
+                "issues": len(sast_result),                
+            }
+        )
+    if not records:
+        return None
+    return records
+
+
 def _generation_info():
     """Internal function to retrieve generation info for APIs output"""
     ca_version_info = {"name": "Python_Code_Audit", "version": __version__}
@@ -638,43 +709,6 @@ def egress_check(input_path):
     return output
 
 
-def get_construct_counts(input_file):
-    """
-    Analyze a Python file or package(directory) and count occurrences of code constructs (aka weaknesses).
-
-    This function uses `filescan` API call to retrieve security-related information
-    about the input file. This returns a dict. Then it counts how many times each code construct
-    appears across all scanned files.
-
-    Args:
-        input_file (str): Path to the file or directory(package) to scan.
-
-    Returns:
-        dict: A dictionary mapping each construct name (str) to the total
-              number of occurrences (int) across all scanned files.
-
-    Notes:
-        - The `filescan` function is expected to return a dictionary with
-          a 'file_security_info' key, containing per-file information.
-        - Each file's 'sast_result' should be a dictionary mapping
-          construct names to lists of occurrences.
-    """
-    scan_result = filescan(input_file)
-    counter = Counter()
-
-    for file_info in scan_result.get("file_security_info", {}).values():
-        sast_result = file_info.get("sast_result", {})
-        for (
-            construct,
-            occurence,
-        ) in (
-            sast_result.items()
-        ):  # occurence is times the construct appears in a single file
-            counter[construct] += len(occurence)
-
-    return dict(counter)
-
-
 def _build_weakness_details(sastresult, filename_location):
     """
     Builds a mapping of line numbers to SAST issue details.

codeaudit/api_reporting.py

@@ -19,17 +19,33 @@ So all results are returned as Pandas Dataframe. This makes things easier for fu
 
 """
 
-
 def total_weaknesses(scan_result):
-    """Returns the total weaknesses found
-    input: scan_result (dict): Scan output containing "file_security_info" with
-            per-file SAST findings. Each finding should include a "validation" field.
+    """Count all individual weaknesses in a scan result.
+
+    Walks through each file's SAST findings and adds up every
+    individual weakness found.
+
+    Args:
+        scan_result (dict): Scan output with a "file_security_info" key
+            mapping file names to their per-file results. Each file's
+            "sast_result" maps check names to either a single finding
+            or a list of findings.
 
-    """
+    Returns:
+        int: Total number of individual weaknesses across all files.
+    """    
     total = 0
 
-    for file_info in scan_result.get("file_security_info", {}).values():
+    file_security_info = scan_result.get("file_security_info", {})
+
+    for file_info in file_security_info.values():
         sast_result = file_info.get("sast_result", {})
-        total += len(sast_result)
+
+        for finding in sast_result.values():
+            if isinstance(finding, list):
+                total += len(finding)
+            else:
+                total += 1
 
     return total
+

codeaudit/benchmark_helpfunctions.py

@@ -0,0 +1,325 @@
+"""
+License GPLv3 or higher.
+
+(C) 2026 Created by Maikel Mardjan - https://nocomplexity.com/
+
+This program is free software: you can redistribute it and/or modify it under the terms of the GNU General Public License as published by the Free Software Foundation, either version 3 of the License, or (at your option) any later version.
+
+This program is distributed in the hope that it will be useful, but WITHOUT ANY WARRANTY; without even the implied warranty of MERCHANTABILITY or FITNESS FOR A PARTICULAR PURPOSE. See the GNU General Public License for more details.
+
+You should have received a copy of the GNU General Public License along with this program. If not, see <https://www.gnu.org/licenses/>.
+
+API functions: Helpers for SAST Benchmark suite
+"""
+from pathlib import Path
+import re
+import ast
+import pandas as pd
+import panel as pn
+from codeaudit.api_interfaces import filescan , get_weakness_counts_per_file
+from codeaudit.filehelpfunctions import collect_python_source_files
+
+
+def get_project_root():
+    current = Path(__file__).resolve()
+    # Walk up the directory tree looking for project markers
+    for parent in [current, *current.parents]:
+        if (parent / "pyproject.toml").exists() and (parent / "tests").exists():
+            return parent
+    raise FileNotFoundError("Could not find project root.")
+
+# Build the path dynamically
+PROJECT_ROOT = get_project_root()
+BENCHMARK_FILES = PROJECT_ROOT / "tests" / "benchmarkfiles" / "validpython"
+
+import ast
+from pathlib import Path
+
+
+def extract_sast_meta(source):
+    """
+    Extract the top-level SAST_META dictionary from a Python file or source string.
+
+    Args:
+        source: A file path (str or Path) or Python source code string.
+
+    Returns:
+        The SAST_META value as a Python dict, or None if not found / invalid.
+    """
+    if isinstance(source, (str, Path)):
+        try:
+            path = Path(source)
+        except (ValueError, TypeError) as exc:
+            # Input cannot be a path (e.g. null byte in string, wrong type).
+            # This is expected for source-code strings, so stay quiet-ish,
+            # but still report the reason instead of swallowing it.
+            print(f"extract_sast_meta: not a valid path ({type(exc).__name__}: {exc})")
+        else:
+            try:
+                if path.is_file():
+                    source = path.read_text(encoding="utf-8")
+            except ValueError as exc:
+                # e.g. embedded null byte in the path.
+                print(
+                    f"extract_sast_meta: invalid path "
+                    f"({type(exc).__name__}: {exc}); treating as source"
+                )
+            except OSError as exc:
+                # Permissions, broken symlink, I/O error, etc.
+                print(
+                    f"extract_sast_meta: could not read file "
+                    f"({type(exc).__name__}: {exc.strerror or 'I/O error'}); "
+                    f"falling back to treating input as source"
+                )
+
+    try:
+        tree = ast.parse(source)
+    except (SyntaxError, ValueError):
+        return None
+
+    for node in tree.body:
+        value_node = None
+
+        # Normal assignment: SAST_META = {...}
+        if isinstance(node, ast.Assign):
+            for target in node.targets:
+                if isinstance(target, ast.Name) and target.id == "SAST_META":
+                    value_node = node.value
+                    break
+
+        # Annotated assignment: SAST_META: dict = {...}
+        elif isinstance(node, ast.AnnAssign):
+            if (
+                isinstance(node.target, ast.Name)
+                and node.target.id == "SAST_META"
+                and node.value is not None
+            ):
+                value_node = node.value
+
+        if value_node is not None:
+            try:
+                data = ast.literal_eval(value_node)
+            except (ValueError, TypeError, SyntaxError, MemoryError, RecursionError):
+                return None
+            return data if isinstance(data, dict) else None
+
+    return None
+
+
+def create_sast_meta_overview(directory):
+    """Creates a list which contains the SAST_META data of all files in a directory
+    
+    Returns:
+        list[dict]: A list of dictionaries, one per Python source file found.
+        
+    """
+    files_to_check = collect_python_source_files(directory)
+    all_sast_info = []
+    file_info = {}
+    for file in files_to_check:
+        file_name = Path(file).name
+        file_info = { "filename" :file_name } | extract_sast_meta(file) 
+        all_sast_info.append(file_info)
+    return all_sast_info
+
+
+def create_issues_with_titles(issues_data, titles_data):
+    """
+    Create a list of dicts containing filename, weaknesses, and title.
+    
+    Args:
+        issues_data: list of dicts with 'base_name' and 'weaknesses'
+        titles_data: list of dicts with 'filename' and 'title' (plus other fields)
+    
+    Returns:
+        list of dicts: [{'filename': ..., 'weaknesses': ..., 'title': ...}, ...]
+    """
+    # Build a lookup from filename -> title
+    title_lookup = {item['filename']: item['title'] for item in titles_data}
+    
+    result = []
+    for item in issues_data:
+        filename = item['base_name']
+        result.append({
+            'filename': filename,            
+            'title': title_lookup.get(filename) , # None if no matching title found
+            'weaknesses': item['issues'],
+        })
+    
+    return result
+
+def benchmark_overview_issues_per_file(benchmark_files=BENCHMARK_FILES):
+    """Creates a overview of weaknesses per benchmark file"""    
+    benchmark_results = filescan(benchmark_files)
+    benchmark_list = get_weakness_counts_per_file(benchmark_results)
+    titles = create_sast_meta_overview(benchmark_files)
+    overview = create_issues_with_titles(benchmark_list , titles)
+    df = pd.DataFrame(overview)
+    df = df.sort_values(by='filename').reset_index(drop=True)
+    formatters = {                        
+            "title":       {"type": "textarea"},
+        }
+
+    table = pn.widgets.Tabulator(
+        df,
+        header_filters=False,
+        show_index=False,
+        formatters=formatters,
+        pagination="local",
+        page_size=50,
+        layout='fit_columns',
+        selectable=True,
+        theme="semantic-ui",        
+        # --- fixed column width ---
+        widths={'weaknesses': 150 ,
+                'title': 350,
+                'filename': 200},         # pixels
+    )   
+    return table
+
+def cwe_to_html(cwe_value, column_name="cwe_id"):
+    """
+    Convert a CWE value (single int, or list of ints) into an HTML clickable string.
+    Each CWE number N becomes <a href="https://cwe.mitre.org/data/definitions/N.html">N</a>.
+    Lists are rendered as comma-separated clickable links.
+    Empty / NaN values are returned unchanged (as empty string).
+    """
+    if cwe_value is None:
+        return ""
+
+    # Handle NaN (float) safely.  pd.isna raises TypeError/ValueError for
+    # array-like inputs (lists, tuples, sets), which we handle explicitly
+    # below — so those are expected.  Anything else is reported rather than
+    # silently swallowed.
+    try:
+        if pd.isna(cwe_value):
+            return ""
+    except (TypeError, ValueError) as exc:
+        # Only report if the input isn't one of the shapes we already know
+        # how to handle; otherwise list inputs would print on every row.
+        if not isinstance(cwe_value, (list, tuple, set)):
+            print(
+                f"cwe_to_html[{column_name}]: pd.isna() failed unexpectedly "
+                f"({type(exc).__name__}: {exc})"
+            )
+
+    def make_link(n):
+        n = str(n).strip()
+        if not n.isdigit():
+            print(
+                f"cwe_to_html[{column_name}]: refusing non-numeric CWE value {n!r}"
+            )
+            return ""
+        return (
+            f'<a href="https://cwe.mitre.org/data/definitions/{n}.html" '
+            f'target="_blank">{n}</a>'
+        )
+
+    # List / tuple / set of CWEs
+    if isinstance(cwe_value, (list, tuple, set)):
+        return ", ".join(make_link(n) for n in cwe_value)
+
+    # Single value (int, numpy int, or string)
+    return make_link(cwe_value)
+
+
+
+def owasp_to_html(value):
+    """
+    Convert an OWASP Top 10 string like "A04:2021 - Insecure Design"
+    or "A02:2025 - Security Misconfiguration" into an HTML clickable link.
+
+    URL pattern:
+        https://top10.owasp.org/{year}/{Axx}_{year}-{Name_With_Underscores}/
+    """
+    if value is None:
+        return ""
+    try:
+        if pd.isna(value):
+            return ""
+    except (TypeError, ValueError) as e:
+        print(f"Warning: Could not evaluate pd.isna() on value due to {e}. Continuing.")
+
+    if value is None:
+        return ""
+    text = str(value).strip()
+
+    # Match "A04:2021 - Insecure Design" / "A02:2025 - Security Misconfiguration"
+    match = re.match(
+        r"^\s*(A\d{2})\s*:\s*(\d{4})\s*[-–—]\s*(.+?)\s*$",
+        text,
+        flags=re.IGNORECASE,
+    )
+    if not match:
+        # Return original text unchanged if it doesn't match the expected format
+        return text
+
+    category, year, name = match.groups()
+    category = category.upper()
+    year = year.strip()
+    name = name.strip()
+
+    # Convert "Security Misconfiguration" -> "Security_Misconfiguration"
+    # Collapse whitespace to single underscores
+    name_slug = re.sub(r"\s+", "_", name)
+
+    url = f"https://top10.owasp.org/{year}/{category}_{year}-{name_slug}/"
+
+    return f'<a href="{url}" target="_blank">{text}</a>'
+
+
+def transform_owasp_column(df, column="owasp", inplace=False):
+    """
+    Apply owasp_to_html to every value in the specified column.
+    """
+    if not inplace:
+        df = df.copy()
+    df[column] = df[column].apply(owasp_to_html)
+    return df
+
+
+def transform_cwe_column(df, column="cwe_id", inplace=False):
+    """
+    Apply cwe_to_html to every value in the given column of a DataFrame.
+    """
+    if not inplace:
+        df = df.copy()
+    df[column] = df[column].apply(cwe_to_html)
+    return df
+
+def benchmark_suite_overview(benchmarklist=BENCHMARK_FILES):
+    """Creates a Tabulator to display the benchmark suite collection of Python files
+    These files contain SAST meta information
+    
+    input: benchmarklist , type list
+    """    
+    benchmarklist = create_sast_meta_overview(BENCHMARK_FILES)
+    df = pd.DataFrame(benchmarklist)
+
+    df = transform_cwe_column(df)
+    df = transform_owasp_column(df) #transform owasp column    
+    df = df[['filename', 'title', 'cwe_id', 'weakness', 'owasp', 'severity']].copy()    
+
+    formatters = {
+        "cwe_id": {"type": "html", "field": "html"},
+        "owasp":   {"type": "html", "field": "html"},
+        "title":       {"type": "textarea"},
+        "weakness":       {"type": "textarea"},
+        "tags":       {"type": "textarea"},
+    }
+    table = pn.widgets.Tabulator(
+    df,
+    header_filters=False,
+    show_index=False, 
+    formatters=formatters,
+    pagination="local",
+    page_size=50,
+    layout='fit_columns',        
+    selectable=True,
+    theme="simple",
+    sizing_mode='stretch_width',  # Add this line
+    )
+    
+    return table
+
+

codeaudit/data/sastchecks.csv

@@ -9,7 +9,7 @@ Directory Creation,os.mknod,Low,Direct file system calls require careful input v
 Directory Creation,os.makedev,Low,Direct file system calls require careful input validation to prevent vulnerabilities.
 OS Forking,os.fork,Low,"On macOS use of this function is unsafe when mixed with using higher-level system APIs, and that includes using urllib.request."
 Dangerous Built-in: eval,eval,High,This function can execute arbitrary code. Never safe with untrusted input.
-Input Function,input,Low,User input must be strictly sanitized and validated to prevent injection vulnerabilities.
+Input Function,input,High,User input must be strictly sanitized and validated to prevent injection vulnerabilities.
 Overly Broad Exception Handling,pass,Low,Using `pass` in an `except` block can silently ignore critical security exceptions.
 Overly Broad Exception Handling,continue,Low,Skipping over exceptions can mask critical errors and security risks.
 Dangerous Built-in: exec,exec,High,This function can execute arbitrary code and should be used only with validated constructs.

codeaudit/filehelpfunctions.py

@@ -71,7 +71,7 @@ def collect_python_source_files(directory):
                 full_path = os.path.join(root, file)
                 if os.path.isfile(full_path):
                     python_files.append(os.path.abspath(full_path))
-    # check if the file can be parsed using the AST
+    # check if the found python file can be parsed using the AST - so extra security check to keep SAST scanning highly secure!
     final_file_list = []
     for python_file in python_files:
         if is_ast_parsable(python_file):
@@ -98,17 +98,38 @@ def get_filename_from_path(file_path):
 
 
 def is_ast_parsable(file_path):
-    """
-    Checks whether a Python file can be validated and parsed.
-    Uses the extensive security checker for valid Python files of the module https://github.com/nocomplexity/fileaudit
+    """Check whether a Python source file passes validation.
+
+    Uses the security-focused Python validation functionality provided by
+    the `fileaudit` module to check whether the file contains valid,
+    parsable Python code.
+
+    Note:
+        This function is intended for Python source files only.
+        Passing a non-Python file may raise an exception. Ensure that
+        the file has a `.py` extension before calling this function.
 
     Args:
         file_path (str | Path): Path to the Python source file.
 
     Returns:
-        bool: True if the file passes Python validation, False otherwise.
+        bool: True if the Python file passes validation
+
+    Raises:
+        Exception: If check fails. The underlying validation functionality raises
+            an exception, for example, when processing an unsupported
+            file type or invalid Python file
+
+    References:
+        https://github.com/nocomplexity/fileaudit
     """
-    return validate_python(Path(file_path))
+    try:
+        return bool(validate_python(Path(file_path)))
+    except Exception as e:
+        print(f'Python security check failed for file:{file_path}: {e}') # Exception should not be passed silently.
+        return False
+    
+
 
 
 def has_python_files(input_path):

codeaudit/pypi_package_scan.py

@@ -24,7 +24,7 @@ from urllib.error import HTTPError, URLError
 from urllib.request import Request, urlopen
 
 from datetime import date, datetime
-from fileaudit.targz_check import validate_tar_gz
+from fileaudit.targz_check import validate_tar_gz , TarValidationError
 
 from codeaudit import __version__
 
@@ -94,26 +94,23 @@ def is_valid_tar_gz(path):
     try:
         path = os.fspath(path)
 
-        return (
-            path.endswith(".tar.gz")
-            and validate_tar_gz(
-                path,
-                max_file_size=15 * 1024 * 1024,
-                max_tar_members=12000,
-            )
-            and tarfile.is_tarfile(path)
+        validate_tar_gz(
+            path,
+            max_file_size=15 * 1024 * 1024,
+            max_tar_members=12000,
         )
-    except (OSError, ValueError, TypeError, AttributeError, tarfile.TarError):
-        return False
 
+        return tarfile.is_tarfile(path)
 
-# def is_valid_tar_gz(path):
-#     """Return True if the given path is a valid .tar.gz file.
-#     Custom validation values for validate_tar_gz are used. So note that NOT all tar.gz files will be accepted. Use PyPI package scan instead if possible.
-#     """
-#     return bool(
-#         validate_tar_gz(path, max_file_size=15 * 1024 * 1024, max_tar_members=12000)
-#     )
+    except (
+        OSError,
+        ValueError,
+        TypeError,
+        AttributeError,
+        tarfile.TarError,
+        TarValidationError,
+    ):
+        return False
 
 
 def get_targz_package_source(

codeaudit/reporting.py

@@ -22,7 +22,7 @@ import pandas as pd
 import html
 import datetime
 from importlib.resources import files
-from fileaudit.targz_check import validate_tar_gz
+from fileaudit.targz_check import validate_tar_gz , TarValidationError
 
 from codeaudit import __version__
 
@@ -79,6 +79,24 @@ SIMPLE_CSS_FILE = files("codeaudit") / "simple.css"
 DEFAULT_OUTPUT_FILE = "codeaudit-report.html"
 
 
+def safe_validate_tar_gz(directory, **kwargs):
+    """Safely validates a TAR.GZ archive.
+
+    Returns False if validation raises an exception. 
+    validate_tar_gz gives True or raises an exception is the check fails. See fileaudit apidocs.
+
+    Args:
+        directory: Path to the TAR.GZ archive.
+        **kwargs: Additional keyword arguments passed to validate_tar_gz().
+
+    Returns:
+        bool: True if validation succeeds, False otherwise.
+    """
+    try:
+        return validate_tar_gz(directory, **kwargs)
+    except Exception:
+        return False
+
 def overview_report(directory, filename=DEFAULT_OUTPUT_FILE):
     """Generate an overview report of code complexity and security indicators.
 
@@ -159,9 +177,9 @@ def overview_report(directory, filename=DEFAULT_OUTPUT_FILE):
         if not has_python_files(directory):
             print(f"ERROR: Directory '{directory}' contains no Python files.")
             exit(1)
-    elif file_path.name.endswith(".tar.gz") and validate_tar_gz(
+    elif file_path.name.endswith(".tar.gz") and safe_validate_tar_gz(
         directory, max_file_size=15 * 1024 * 1024, max_tar_members=12000
-    ):  # for local tar.gz or remote tar.gz scans
+    ):  # for local tar.gz or remote tar.gz scans - mind checking extension first MUST be done!
         package_name = directory
         advice = f'<p>&#128073; To perform a SAST scan on the source code, run:<pre><code class="language-python">codeaudit filescan {directory}</code></pre></p>'
         release = "N.A."
@@ -378,8 +396,8 @@ def scan_report(input_path, filename=DEFAULT_OUTPUT_FILE, nosec=False):
     if file_path.is_dir():
         directory_scan_report(
             input_path, nosec_flag=nosec, filename=filename
-        )  # create a package aka directory scan report
-    elif is_ast_parsable(input_path):
+        )  # create a package aka directory scan report        
+    elif file_path.name.endswith(".py") and is_ast_parsable(input_path):
         # create a sast file check report
         if not nosec:  # no filtering on reviewed items with markers in code
             scan_output = perform_validations(
@@ -404,10 +422,9 @@ def scan_report(input_path, filename=DEFAULT_OUTPUT_FILE, nosec=False):
         html_output += "<br>"
         html_output += DISCLAIMER_TEXT
         create_htmlfile(html_output, filename)
-
-    elif file_path.name.endswith(".tar.gz") and validate_tar_gz(
+    elif file_path.name.endswith(".tar.gz") and safe_validate_tar_gz(
         input_path, max_file_size=15 * 1024 * 1024, max_tar_members=12000
-    ):  # for local tar.gz or remote tar.gz scans
+    ):  # for local tar.gz or remote tar.gz scans - mind checking extension first MUST be done!
         src_dir, tmp_handle = get_targz_package_source(input_path)
         directory_scan_report(
             src_dir,

codeaudit/suppression.py

@@ -117,33 +117,6 @@ def get_start_to_end_lines(filename):
 
     return end_lines
 
-
-# def get_start_to_end_lines(filename):
-#     """
-#     Parse AST once and build mapping: start_line → highest end_line found for nodes
-#     starting on that line.
-#     """
-#     end_lines = {}
-
-#     try:
-#         with open(filename, 'r', encoding='utf-8') as f:
-#             source = f.read()
-#         tree = ast.parse(source)
-
-#         for node in ast.walk(tree):
-#             if not hasattr(node, 'lineno'):
-#                 continue
-#             start = node.lineno
-#             end = getattr(node, 'end_lineno', start)
-#             # Take the maximum end line if multiple nodes start on same line
-#             if start not in end_lines or end > end_lines[start]:
-#                 end_lines[start] = end
-#     except Exception:
-#         pass
-
-#     return end_lines
-
-
 def is_suppressed(line, comments_by_line, start_to_end, match_func):
     """
     Check if the statement starting at `line` is suppressed by looking at comments
@@ -225,6 +198,7 @@ def match_suppression_keyword(comment_line):
         "false-positive",
         "falsepositive",
         "risk-accepted",
+        "ruff:ignore",
         "security-accepted",
         "security-reviewed",
         "security-exception",
@@ -234,5 +208,5 @@ def match_suppression_keyword(comment_line):
         return False
 
     normalized = " ".join(word.lstrip("#").lower() for word in comment_line.split())
-    tokens = re.split(r"[^\w\-]+", normalized)
+    tokens = re.split(r"[^\w\-:]+", normalized)    
     return any(marker.lower() in tokens for marker in MARKER_LIST)

{codeaudit-1.9.2.dist-info → codeaudit-1.9.4.dist-info}/METADATA

@@ -1,6 +1,6 @@
-Metadata-Version: 2.4
+Metadata-Version: 2.5
 Name: codeaudit
-Version: 1.9.2
+Version: 1.9.4
 Summary: A modern Python security source code analyzer (SAST) based on distrust.
 Project-URL: Homepage, https://codeaudit.nocomplexity.com
 Project-URL: Documentation, https://github.com/nocomplexity/codeaudit#readme
@@ -18,11 +18,12 @@ Classifier: Programming Language :: Python
 Classifier: Programming Language :: Python :: 3.12
 Classifier: Programming Language :: Python :: 3.13
 Classifier: Programming Language :: Python :: 3.14
+Classifier: Programming Language :: Python :: 3.15
 Classifier: Topic :: Security
 Classifier: Topic :: Software Development :: Quality Assurance
 Requires-Python: >=3.12
 Requires-Dist: altair==6.0.0
-Requires-Dist: fileaudit
+Requires-Dist: fileaudit==0.2.5
 Requires-Dist: fire==0.7.1
 Requires-Dist: pandas>=2.3
 Provides-Extra: test

{codeaudit-1.9.2.dist-info → codeaudit-1.9.4.dist-info}/RECORD

@@ -1,28 +1,29 @@
-codeaudit/__about__.py,sha256=lEwjjJlm2CvFjGxH6luX5N-xGFvuupCM1jTTMibyA_w,122
+codeaudit/__about__.py,sha256=hKR4cqCW7w3epN3pUpdc-rArbI3mirHoz6l_BDd2xUw,122
 codeaudit/__init__.py,sha256=vrz_p2yfDBQD-LBiT2hS0Nl6Da896DjCF4tBeg-3zmU,163
-codeaudit/altairplots.py,sha256=WsLmKqZ_sEysAv7q668WDnOlENk7YyHax24AwRihHC8,35906
+codeaudit/altairplots.py,sha256=mKM2JApYE5yDwV4qygAK1eDj3ykZ-YgXFnekH7iWyo0,35131
 codeaudit/api_helpers.py,sha256=-B7XneWSfmYPfHnYRI149DtYTLjRf2Np3l0Tu6rNDQI,3810
-codeaudit/api_interfaces.py,sha256=yCkoIIWaHuF7QCxz2Z2ufbIGcvCrUEdolQirg-zfjxk,31193
-codeaudit/api_reporting.py,sha256=WRXPsS0t9ljdD_6gN5uN-t0xqNOuE9k5oqSmxaYWTf8,1585
+codeaudit/api_interfaces.py,sha256=4a-cTQRhRkcbdosEYNxR14D58gtTZUxE_T73BMcPBl4,32023
+codeaudit/api_reporting.py,sha256=cHAv5FkwGzTfNI-4n5qNR-t7ZegpqBZjw1kUq8lpaVI,2054
+codeaudit/benchmark_helpfunctions.py,sha256=Ju3RBrKJQpOkucOxiGFcIOzskuHu6fDjO3DfKBOPeHc,11151
 codeaudit/checkmodules.py,sha256=gDQXD1D79zUPgbTtATy-CG7FQuZYLjrukbmXSF-eL08,6505
 codeaudit/ci_workflowscan.py,sha256=ccA_38wTXPyGfWuGgaU9hGtt-HuX3f6cTh_EkaGRaWA,14285
 codeaudit/complexitycheck.py,sha256=7ILf2wYho6DDiC-Q3ZjuJGbUZb1TaGfkTkWKtLO8_RU,4236
 codeaudit/corecli.py,sha256=LRYPGhuPIpYwc_-fNq0wQITAPIoa6nIY0doHejS6q38,3958
 codeaudit/dashboard_reports.py,sha256=A9e76T65ye158HQeqJHpuGzaaqx_oOnc5ChFfTXMz1A,17814
-codeaudit/filehelpfunctions.py,sha256=oYdCoAMeNlik7KeaQ7tHs-lM0jdXjEfWykW0M9wtcE8,4221
+codeaudit/filehelpfunctions.py,sha256=7DA3QuTNiLyO7JFetoAIwDMK4oy6c3vHmZDqe04kCCY,5001
 codeaudit/htmlhelpfunctions.py,sha256=z8vRqw9esLnk9Bsb7moOTLus5DSO34mQb4TYQfX6vd0,3247
 codeaudit/issuevalidations.py,sha256=55QL-cZqdU7SH2ZiHniKtphsgeXZrEOoFJeRZyp1X5E,6437
 codeaudit/privacy_lint.py,sha256=5t7Od16JNnb8SIGlEQy52c8vCxswnGO3SQbe-ilvqww,12439
-codeaudit/pypi_package_scan.py,sha256=iqpFcG3-UHeGrOrDwNIP8SQOnEpLmcXYj9fKq3bepO8,9518
-codeaudit/reporting.py,sha256=ZCc-NY4h9WwY7_Nfm6WjPyfWQ8s6eArNA0_hn9pF4vQ,42961
+codeaudit/pypi_package_scan.py,sha256=htE-MBRzQT2qf-kvNFesohTeWfSzrGZl9ndJTEx-JOk,9152
+codeaudit/reporting.py,sha256=Yg7UuFcn3ryhDiEv2vCJ6W_EhD_fWMpfspDAnQkCzWw,43688
 codeaudit/security_checks.py,sha256=7nTlolMtI5MW-fhnOQonsp9W6-1QI1KDvNYO-NL5Am0,2149
 codeaudit/simple.css,sha256=H7KT61oXJkVr9qXVrC5ME_Zph9jI-uR2IxOsXG1xs5k,4013
-codeaudit/suppression.py,sha256=8ZX8NAoWxJjgP3ZruvuQz5G_XFmPvyjOAYF84Q6bT2M,7755
+codeaudit/suppression.py,sha256=Ku5EkFW6PlVZJ3vVCLkgvowXfYr8uELN_XVX95nvCas,6993
 codeaudit/totals.py,sha256=i7Y5gXEk52p93Mo_usK2VATq1LmtBkFVKNGvT8AjJzw,6401
-codeaudit/data/sastchecks.csv,sha256=qljGNtwDff-GypMhiSK2KYABWUzpOH5aetrzFbU7PDA,11100
+codeaudit/data/sastchecks.csv,sha256=9hhZun778xfQPRKl_b-i-HJ-KfDW0SmvBYh0FUL1Mws,11101
 codeaudit/data/secretslist.txt,sha256=Vb-kuliUcuQHWAeuxIq3hZ-RNeKNXPNYIWoQe5SCTW4,1962
-codeaudit-1.9.2.dist-info/METADATA,sha256=w4M3E7DmLwvLMfFgA0wdlhtQmmzMvWY6vcoiJXNuphc,9023
-codeaudit-1.9.2.dist-info/WHEEL,sha256=QccIxa26bgl1E6uMy58deGWi-0aeIkkangHcxk2kWfw,87
-codeaudit-1.9.2.dist-info/entry_points.txt,sha256=LSpeBIiwDjyffyx_YQIUzmBOnmdCJ_V42onGC_5Nv5E,53
-codeaudit-1.9.2.dist-info/licenses/LICENSE.txt,sha256=-5gWaMGKJ54oX8TYP7oeg2zITdTapzyWl9PP0tispuA,34674
-codeaudit-1.9.2.dist-info/RECORD,,
+codeaudit-1.9.4.dist-info/METADATA,sha256=KH3HsiilLjHpIH2bCALKoquUC5VIGSTrtfV_TU2Pzwo,9081
+codeaudit-1.9.4.dist-info/WHEEL,sha256=2iZrJkDIkeDh0k9SikKMqFuRP-ua6mb4Ir1AsER4BEw,87
+codeaudit-1.9.4.dist-info/entry_points.txt,sha256=LSpeBIiwDjyffyx_YQIUzmBOnmdCJ_V42onGC_5Nv5E,53
+codeaudit-1.9.4.dist-info/licenses/LICENSE.txt,sha256=-5gWaMGKJ54oX8TYP7oeg2zITdTapzyWl9PP0tispuA,34674
+codeaudit-1.9.4.dist-info/RECORD,,

{codeaudit-1.9.2.dist-info → codeaudit-1.9.4.dist-info}/WHEEL

@@ -1,4 +1,4 @@
 Wheel-Version: 1.0
-Generator: hatchling 1.29.0
+Generator: hatchling 1.33.0
 Root-Is-Purelib: true
 Tag: py3-none-any