codeaudit 1.9.2__tar.gz → 1.9.3__tar.gz

{codeaudit-1.9.2 → codeaudit-1.9.3}/CHANGELOG.md

@@ -1,5 +1,21 @@
 # Change Log
 
+## Version 1.9.3:
+
+**Changed**
+
+* Updated functions `weaknesses_overview` and `total_weaknesses`.
+
+**Fixed**
+
+* Fixed issue in API function `get_weakness_counts` and included extra tests.
+* Corrected severity for the `input` function.
+
+**Documentation**
+* Validated and documented correct working and compatibility for Python 3.15.
+
+
+
 ## Version 1.9.2:
 
 * Fixed issue for API scan

{codeaudit-1.9.2 → codeaudit-1.9.3}/PKG-INFO

@@ -1,6 +1,6 @@
-Metadata-Version: 2.4
+Metadata-Version: 2.5
 Name: codeaudit
-Version: 1.9.2
+Version: 1.9.3
 Summary: A modern Python security source code analyzer (SAST) based on distrust.
 Project-URL: Homepage, https://codeaudit.nocomplexity.com
 Project-URL: Documentation, https://github.com/nocomplexity/codeaudit#readme
@@ -18,6 +18,7 @@ Classifier: Programming Language :: Python
 Classifier: Programming Language :: Python :: 3.12
 Classifier: Programming Language :: Python :: 3.13
 Classifier: Programming Language :: Python :: 3.14
+Classifier: Programming Language :: Python :: 3.15
 Classifier: Topic :: Security
 Classifier: Topic :: Software Development :: Quality Assurance
 Requires-Python: >=3.12

{codeaudit-1.9.2 → codeaudit-1.9.3}/docs/codeauditcommands.md

@@ -1,6 +1,6 @@
 % THIS FILE IS GENERATED! - Use CLIcommands.ipynb to make it better!
 # Commands Overview
-Python Code Audit commands for: version: 1.9.2
+Python Code Audit commands for: version: 1.9.3
 ```
 ----------------------------------------------------
  _                    __             _

{codeaudit-1.9.2 → codeaudit-1.9.3}/docs/examples/ca_api_example_scanning.ipynb

@@ -197,7 +197,7 @@
    "name": "python",
    "nbconvert_exporter": "python",
    "pygments_lexer": "ipython3",
-   "version": "3.14.7"
+   "version": "3.14.8"
   }
  },
  "nbformat": 4,

{codeaudit-1.9.2 → codeaudit-1.9.3}/docs/examples/codeauditchecks.html

@@ -422,7 +422,7 @@ footer {
     <tr>
       <td>Input Function</td>
       <td>input</td>
-      <td>Low</td>
+      <td>High</td>
       <td>User input must be strictly sanitized and validated to prevent injection vulnerabilities.</td>
     </tr>
     <tr>
@@ -774,4 +774,4 @@ footer {
       <td>Vulnerable to path traversal attacks if used with untrusted archives.</td>
     </tr>
   </tbody>
-</table><br><p>Number of implemented security validations:<b>89</b></p><p>Version of codeaudit: <b>1.9.2</b><p>Because Python and cybersecurity are constantly changing, issue reports <b>SHOULD</b> specify the codeaudit version used.</p><p><b>Disclaimer:</b> <i>This SAST tool <a href="https://github.com/nocomplexity/codeaudit" target="_blank"><b>Python Code Audit</b></a> provides a powerful, automatic security analysis for Python source code. However, it's not a substitute for human review in combination with business knowledge. Undetected vulnerabilities may still exist.</i></p><p>This Python security report was created on: <b>2026-10-09 19:31</b> with <a href="https://github.com/nocomplexity/codeaudit" target="_blank"><b>Python Code Audit</b></a> version <b>1.9.2</b></p><hr><footer><div class="footer-links">Check the <a href="https://nocomplexity.com/documents/codeaudit/intro.html" target="_blank">documentation</a> for help on found issues.<br>Codeaudit is made with <span class="heart">&#10084;</span> by cyber security professionals who advocate for <a href="https://nocomplexity.com/simplify-security/" target="_blank">open simple security solutions</a>.<br><a href="https://nocomplexity.com/documents/codeaudit/CONTRIBUTE.html" target="_blank">Join the community</a> and contribute to make this tool better!</div></footer></div></body></html>
+</table><br><p>Number of implemented security validations:<b>89</b></p><p>Version of codeaudit: <b>1.9.3</b><p>Because Python and cybersecurity are constantly changing, issue reports <b>SHOULD</b> specify the codeaudit version used.</p><p><b>Disclaimer:</b> <i>This SAST tool <a href="https://github.com/nocomplexity/codeaudit" target="_blank"><b>Python Code Audit</b></a> provides a powerful, automatic security analysis for Python source code. However, it's not a substitute for human review in combination with business knowledge. Undetected vulnerabilities may still exist.</i></p><p>This Python security report was created on: <b>2026-10-30 18:27</b> with <a href="https://github.com/nocomplexity/codeaudit" target="_blank"><b>Python Code Audit</b></a> version <b>1.9.3</b></p><hr><footer><div class="footer-links">Check the <a href="https://nocomplexity.com/documents/codeaudit/intro.html" target="_blank">documentation</a> for help on found issues.<br>Codeaudit is made with <span class="heart">&#10084;</span> by cyber security professionals who advocate for <a href="https://nocomplexity.com/simplify-security/" target="_blank">open simple security solutions</a>.<br><a href="https://nocomplexity.com/documents/codeaudit/CONTRIBUTE.html" target="_blank">Join the community</a> and contribute to make this tool better!</div></footer></div></body></html>

{codeaudit-1.9.2 → codeaudit-1.9.3}/docs/examples/demoscan.json

@@ -1,7 +1,7 @@
 {
   "name": "Python_Code_Audit",
-  "version": "1.9.2",
-  "generated_on": "2026-10-09 19:31",
+  "version": "1.9.3",
+  "generated_on": "2026-10-30 18:27",
   "file_security_info": {
     "0": {
       "FileName": "demofile.py",

{codeaudit-1.9.2 → codeaudit-1.9.3}/docs/makeitbetter.md

@@ -38,6 +38,16 @@ To lower the barrier for new contributors, I'd make the tone more welcoming, red
 
 Welcome! This guide will help you set up a local development environment for Python Code Audit and start contributing to the project.
 
+### 0. Create and activate an new environment
+
+I prefer using [`conda`](https://nocomplexity.com/documents/pythonbook/environments.html#environments) but use what you want.
+
+Set up a new environment:
+```bash
+conda create --name codeaudit_dev python=3.15
+```
+
+
 ### 1. Clone the repository
 
 We recommend working in a dedicated virtual environment to avoid conflicts with other Python projects.
@@ -48,14 +58,16 @@ The Python Code Audit source code is hosted on GitHub.
 ```bash
 git clone https://github.com/nocomplexity/codeaudit
 cd codeaudit
+pip install -e .
 ```
 
+
 ### 2. Install development dependencies
 
 Install `pytest`, which is used for running the test suite:
 
 ```bash
-pip install pytest
+pip install -U pytest
 ```
 
 ### 3. Install Hatch

{codeaudit-1.9.2 → codeaudit-1.9.3}/pyproject.toml

@@ -25,6 +25,7 @@ classifiers = [
   "Programming Language :: Python :: 3.12",
   "Programming Language :: Python :: 3.13",
   "Programming Language :: Python :: 3.14",
+  "Programming Language :: Python :: 3.15",
 ]
 
 [project.optional-dependencies]
@@ -57,14 +58,14 @@ extra-dependencies = [
 check = "mypy --install-types --non-interactive {args:src/codeaudit tests}"
 
 [[tool.hatch.envs.hatch-test.matrix]]
-python = ["3.14", "3.13", "3.12"]
+python = ["3.15", "3.14", "3.13", "3.12"]
 
 [tool.hatch.envs.hatch-test]
 randomize = true
 dependencies = ["pytest", "pytest-cov", "coverage"]
 
 [tool.black]
-target-version = ["py311", "py312", "py313", "py314"]
+target-version = ["py312", "py313", "py314","py315"]
 extend-exclude ='(python2_file_willnotwork|dunderexec_with_parsing_error).py|validationfiles|suppression|spytestdir'
 
 [tool.coverage.run]
@@ -78,8 +79,8 @@ show_missing = true
 dependencies = ["black", "pylint"]
 
 [tool.hatch.envs.hatch-static-analysis.scripts]
-format-check = "black --target-version py313 --check src tests"
-format-fix = "black --target-version py313 src tests"
+format-check = "black --target-version py314 --check src tests"
+format-fix = "black --target-version py314 src tests"
 lint-check = "pylint src tests"
 
 [tool.pytest]

{codeaudit-1.9.2 → codeaudit-1.9.3}/src/codeaudit/__about__.py

@@ -1,4 +1,4 @@
 # SPDX-FileCopyrightText: 2025-present Maikel Mardjan
 #
 # SPDX-License-Identifier: GPL-3.0-or-later
-__version__ = "1.9.2"
+__version__ = "1.9.3"

{codeaudit-1.9.2 → codeaudit-1.9.3}/src/codeaudit/altairplots.py

@@ -18,7 +18,8 @@ import pandas as pd
 
 from collections import Counter
 from pathlib import Path
-
+from codeaudit.api_interfaces import get_weakness_counts
+from codeaudit.api_reporting import total_weaknesses
 
 def module_count_barchart(scanresult):
     """Create a bar chart showing module counts by category.
@@ -689,20 +690,8 @@ def weaknesses_overview(scanresult):
             .mark_text()
             .encode(text="msg:N")
         )
-
-    # --- Count every 'validation' across all files ---
-    counter = Counter()
-    for file_info in file_security_info.values():
-        if not isinstance(file_info, dict):
-            continue
-        sast_result = file_info.get("sast_result")
-        if not isinstance(sast_result, dict):
-            continue
-        for finding in sast_result.values():
-            if isinstance(finding, dict):
-                validation = finding.get("validation")
-                if validation and isinstance(validation, str):
-                    counter[validation] += 1
+    # --- Count every validation across all files ---
+    counter = Counter(get_weakness_counts(scanresult))    
 
     if not counter:
         return (
@@ -875,7 +864,7 @@ def sast_files_overview(scanresult):
                 "base_name": base_name,
                 "parent_folder": parent_folder,
                 "full_path": str(filepath),
-                "issues": len(sast_result),
+                "issues": total_weaknesses(scanresult),
                 "complexity": file_info.get("Complexity_Score", 0),
             }
         )
@@ -977,19 +966,8 @@ def weaknesses_radial_overview(scanresult):
         )
 
     # --- Count every 'validation' across all files ---
-    counter = Counter()
-    for file_info in file_security_info.values():
-        if not isinstance(file_info, dict):
-            continue
-        sast_result = file_info.get("sast_result")
-        if not isinstance(sast_result, dict):
-            continue
-        for finding in sast_result.values():
-            if isinstance(finding, dict):
-                validation = finding.get("validation")
-                if validation and isinstance(validation, str):
-                    counter[validation] += 1
-
+    counter = Counter(get_weakness_counts(scanresult))    
+   
     if not counter:
         return (
             alt.Chart(

{codeaudit-1.9.2 → codeaudit-1.9.3}/src/codeaudit/api_interfaces.py

@@ -315,38 +315,56 @@ def read_input_file(filename, safe_directory="data_folder"):
 
 def get_weakness_counts(input_file, nosec=False):
     """
-    Analyze a Python file or package and count occurrences of code weaknesses.
+    Count SAST weaknesses.
+
+    Accepts either:
+    - A scan result dictionary.
+    - A file/package path that will be scanned.
     """
-    # Assuming filescan is imported from codeaudit.api_interfaces
-    scan_result = filescan(input_file, nosec)
+
+    # Accept an existing scan result or scan a file/package
+    if isinstance(input_file, dict):
+        scan_result = input_file
+    else:
+        scan_result = filescan(input_file, nosec)
 
     if not isinstance(scan_result, dict):
-        raise ValueError("filescan() did not return a valid result dictionary")
+        raise ValueError("Invalid scan result")
 
     if "Error" in scan_result:
         raise ValueError(scan_result["Error"])
 
     file_security_info = scan_result.get("file_security_info")
+
     if not isinstance(file_security_info, dict):
         return {}
 
     counter = Counter()
 
     for file_info in file_security_info.values():
+
         if not isinstance(file_info, dict):
             continue
 
         sast_result = file_info.get("sast_result", {})
+
         if not isinstance(sast_result, dict):
             continue
 
-        # Based on your data: sast_result keys are line numbers (e.g., 171)
-        # and values are dicts containing the 'validation' type.
-        for issue_details in sast_result.values():
-            if isinstance(issue_details, dict):
-                # We use the 'validation' field to identify the type of weakness
-                weakness_type = issue_details.get("validation", "Unknown")
-                counter[weakness_type] += 1
+        for finding in sast_result.values():
+
+            # Support individual findings and lists of findings
+            findings = finding if isinstance(finding, list) else [finding]
+
+            for issue in findings:
+
+                if not isinstance(issue, dict):
+                    continue
+
+                weakness_type = issue.get("validation", "Unknown")
+
+                if isinstance(weakness_type, str) and weakness_type:
+                    counter[weakness_type] += 1
 
     return dict(counter)
 

{codeaudit-1.9.2 → codeaudit-1.9.3}/src/codeaudit/api_reporting.py

@@ -19,17 +19,33 @@ So all results are returned as Pandas Dataframe. This makes things easier for fu
 
 """
 
-
 def total_weaknesses(scan_result):
-    """Returns the total weaknesses found
-    input: scan_result (dict): Scan output containing "file_security_info" with
-            per-file SAST findings. Each finding should include a "validation" field.
+    """Count all individual weaknesses in a scan result.
+
+    Walks through each file's SAST findings and adds up every
+    individual weakness found.
+
+    Args:
+        scan_result (dict): Scan output with a "file_security_info" key
+            mapping file names to their per-file results. Each file's
+            "sast_result" maps check names to either a single finding
+            or a list of findings.
 
-    """
+    Returns:
+        int: Total number of individual weaknesses across all files.
+    """    
     total = 0
 
-    for file_info in scan_result.get("file_security_info", {}).values():
+    file_security_info = scan_result.get("file_security_info", {})
+
+    for file_info in file_security_info.values():
         sast_result = file_info.get("sast_result", {})
-        total += len(sast_result)
+
+        for finding in sast_result.values():
+            if isinstance(finding, list):
+                total += len(finding)
+            else:
+                total += 1
 
     return total
+

{codeaudit-1.9.2 → codeaudit-1.9.3}/src/codeaudit/data/sastchecks.csv

@@ -9,7 +9,7 @@ Directory Creation,os.mknod,Low,Direct file system calls require careful input v
 Directory Creation,os.makedev,Low,Direct file system calls require careful input validation to prevent vulnerabilities.
 OS Forking,os.fork,Low,"On macOS use of this function is unsafe when mixed with using higher-level system APIs, and that includes using urllib.request."
 Dangerous Built-in: eval,eval,High,This function can execute arbitrary code. Never safe with untrusted input.
-Input Function,input,Low,User input must be strictly sanitized and validated to prevent injection vulnerabilities.
+Input Function,input,High,User input must be strictly sanitized and validated to prevent injection vulnerabilities.
 Overly Broad Exception Handling,pass,Low,Using `pass` in an `except` block can silently ignore critical security exceptions.
 Overly Broad Exception Handling,continue,Low,Skipping over exceptions can mask critical errors and security risks.
 Dangerous Built-in: exec,exec,High,This function can execute arbitrary code and should be used only with validated constructs.

{codeaudit-1.9.2 → codeaudit-1.9.3}/src/dashboard/dashboardapp.py

@@ -88,42 +88,60 @@ async def get_pypi_download_info_wasm(package_name):
 
 
 async def get_package_source_wasm(url):
-    import gzip
-    import tarfile
+    import os
     import tempfile
-    import zlib
-
     from pyodide.http import pyfetch
 
+    tmpdir_obj = None
     try:
         response = await pyfetch(url)
         if not response.ok:
             return None
 
-        content = await response.bytes()
-        content_encoding = response.headers.get("Content-Encoding")
-
-        if content_encoding == "gzip":
-            content = gzip.decompress(content)
-        elif content_encoding == "deflate":
-            content = zlib.decompress(content, -zlib.MAX_WBITS)
-
         tmpdir_obj = tempfile.TemporaryDirectory(prefix="codeaudit_")
         temp_dir = tmpdir_obj.name
+        extract_dir = os.path.join(temp_dir, "extracted")
+        os.makedirs(extract_dir, exist_ok=True) #nosec
+
+        # Recommended Pyodide way – works reliably in MEMFS
+        await response.unpack_archive(extract_dir=extract_dir, format="gztar")
+
+        # Locate the actual package root (same logic as before)
+        entries = os.listdir(extract_dir)
+        directories = [
+            os.path.join(extract_dir, entry)
+            for entry in entries
+            if os.path.isdir(os.path.join(extract_dir, entry))
+        ]
+        files = [
+            entry
+            for entry in entries
+            if os.path.isfile(os.path.join(extract_dir, entry))
+        ]
+
+        if len(directories) == 1 and not files:
+            source_dir = directories[0]
+        else:
+            source_dir = extract_dir
+
+        # Verify that the extracted source contains Python files
+        has_python_files = any(
+            filename.endswith(".py")
+            for root, _, filenames in os.walk(source_dir)
+            for filename in filenames
+        )
+
+        if not has_python_files:
+            print(f"WASM extraction found no .py files under {source_dir}")
+            tmpdir_obj.cleanup()
+            return None
 
-        tar_path = f"{temp_dir}/package.tar.gz"
-        with open(tar_path, "wb") as f:
-            f.write(content)
-
-        with tarfile.open(tar_path, "r:gz") as tar:
-            tar.extractall(
-                path=temp_dir, filter="data"
-            )  # nosec Possible risks are mitigated and this happens in the WASM context.
-
-        return temp_dir, tmpdir_obj
+        return source_dir, tmpdir_obj
 
     except Exception as e:
-        print(f"WASM fetch error: {e}")
+        print(f"WASM fetch/extraction error: {e}")
+        if tmpdir_obj is not None:
+            tmpdir_obj.cleanup()
         return None
 
 
@@ -175,12 +193,28 @@ async def filescan_wasm(input_path, nosec=False):
             try:
                 scan_output = _codeaudit_directory_scan_wasm(src_dir, nosec_flag=nosec)
                 output |= scan_output
-                # correct statistics for imported modules and modules count
-                correct_imported_modules = package_imports(output)
-                output["module_overview"]["imported_modules"] = correct_imported_modules
-                output["statistics_overview"]["External Modules"] = len(
-                    correct_imported_modules
+                # Normalize optional sections before updating them.
+                # The WASM scanner may omit these sections for some packages.
+                module_overview = output.setdefault(
+                    "module_overview",
+                    {"core_modules": [], "imported_modules": []},
                 )
+                if not isinstance(module_overview, dict):
+                    module_overview = {
+                        "core_modules": [],
+                        "imported_modules": [],
+                    }
+                    output["module_overview"] = module_overview
+
+                # package_imports() can return None when module data is absent.
+                correct_imported_modules = package_imports(output) or []
+                module_overview["imported_modules"] = correct_imported_modules
+
+                statistics_overview = output.setdefault("statistics_overview", {})
+                if not isinstance(statistics_overview, dict):
+                    statistics_overview = {}
+                    output["statistics_overview"] = statistics_overview
+                statistics_overview["External Modules"] = len(correct_imported_modules)
             finally:
                 if tmp_handle:
                     tmp_handle.cleanup()
@@ -190,6 +224,68 @@ async def filescan_wasm(input_path, nosec=False):
     return {"Error": "Package not found on PyPI.org."}
 
 
+# async def filescan_wasm(input_path, nosec=False):
+#     """
+#     WASM-compatible PyPI-only version of filescan function.
+#     Matches the behaviour of the original implementation for PyPI scans.
+
+#     PYPI PACKAGE ONLY (for now)
+#     """
+#     ca_version_info = version()
+#     now = datetime.datetime.now()
+#     timestamp_str = now.strftime("%Y-%m-%d %H:%M")
+#     output = ca_version_info | {"generated_on": timestamp_str}
+#     pypi_data = await get_pypi_download_info_wasm(input_path)
+
+#     if pypi_data:
+#         package_name = input_path
+#         url = pypi_data.get("download_url")
+#         release = pypi_data.get("release")
+
+#         if url is not None:
+#             # WASM-safe
+#             if IS_PYODIDE:
+#                 decoded_res = await get_package_source_wasm(url)
+#             else:
+#                 source_res = get_package_source(url)
+
+#                 if inspect.isawaitable(source_res):
+#                     decoded_res = await source_res
+#                 else:
+#                     decoded_res = source_res
+#             # Validation
+#             if decoded_res is None:
+#                 return {
+#                     "Error": f"Could not download or extract package from {url}. "
+#                     f"This may be due to browser restrictions."
+#                 }
+
+#             src_dir, tmp_handle = decoded_res
+
+#             # Match original structure EXACTLY
+#             output |= {
+#                 "package_name": package_name,
+#                 "package_release": release,
+#             }
+
+#             try:
+#                 scan_output = _codeaudit_directory_scan_wasm(src_dir, nosec_flag=nosec)
+#                 output |= scan_output
+#                 # correct statistics for imported modules and modules count
+#                 correct_imported_modules = package_imports(output)
+#                 output["module_overview"]["imported_modules"] = correct_imported_modules
+#                 output["statistics_overview"]["External Modules"] = len(
+#                     correct_imported_modules
+#                 )
+#             finally:
+#                 if tmp_handle:
+#                     tmp_handle.cleanup()
+
+#             return output
+#     # ---------------------------------------------------------
+#     return {"Error": "Package not found on PyPI.org."}
+
+
 # - END of specific HELPERS to do CA things -#
 
 
@@ -213,13 +309,18 @@ loading = pn.indicators.LoadingSpinner(
     value=False, size=60, color="primary", bgcolor="light", name="Scanning..."
 )
 
+placeholder = pn.pane.Markdown(
+    "*Run a scan to populate this tab.*",
+    sizing_mode="stretch_width",
+)
+
+overview_content = pn.Column(placeholder)
+modules_content = pn.Column(placeholder)
+complexity_content = pn.Column(placeholder)
+weaknesses_content = pn.Column(placeholder)
+weaknesses_files_content = pn.Column(placeholder)
+weaknesses_details_content = pn.Column(placeholder)
 
-overview_content = pn.Column()
-modules_content = pn.Column()
-complexity_content = pn.Column()
-weaknesses_content = pn.Column()
-weaknesses_files_content = pn.Column()
-weaknesses_details_content = pn.Column()
 
 tabs = pn.Tabs(
     ("Package Overview", overview_content),
@@ -259,7 +360,7 @@ async def run_scan(event):
 
     try:
         # ✅ Allow UI to update (spinner renders)
-        await asyncio.sleep(0.1)
+        await asyncio.sleep(0.5)
 
         # ✅ WASM-safe: no threads, no nested event loops
         result = await filescan_wasm(package_name, respect_marker)
@@ -310,7 +411,7 @@ async def run_scan(event):
             ]
 
     except Exception as e:
-        status.object = f"❌ Error: {str(e)}"
+        status.object = f"❌ Exception(!): {str(e)}"
 
     finally:
         # --- Reset UI state ---