codefence 1.0.0__py3-none-any.whl

codefence-1.0.0.data/data/share/codefence/samples/bad_javascript.js

@@ -0,0 +1,30 @@
+// bad_javascript.js
+const express = require('express');
+const jwt = require('jsonwebtoken');
+const app = express();
+
+app.get('/admin/users', (req, res) => {
+  res.json([]);
+});
+
+app.post('/login', (req, res) => {
+  const token = jwt.sign({ sub: req.body.user }, 'secret');
+  res.json({ token });
+});
+
+function render(data) {
+  document.getElementById('x').innerHTML = data;
+  el.innerHTML = '<b>safe</b>';
+}
+
+function setProto(obj, evil) {
+  obj.__proto__ = evil;
+}
+
+function go(req, res) {
+  res.redirect(req.query.next);
+  res.redirect('/home');
+}
+
+fetch('/api/data').then(r => r.json());
+fetch('/api/safe').then(r => r.json()).catch(handleErr);

codefence-1.0.0.data/data/share/codefence/samples/bad_python.py

@@ -0,0 +1,38 @@
+import os
+import random
+import subprocess
+
+
+API_KEY = "sk-abcdef1234567890"
+
+
+def get_user(conn, user_id):
+    cursor = conn.cursor()
+    cursor.execute("SELECT * FROM users WHERE id = " + user_id)
+    cursor.execute(f"SELECT * FROM orders WHERE uid = {user_id}")
+    return cursor.fetchall()
+
+
+def calc(expr):
+    return eval(expr)
+
+
+def run(cmd):
+    subprocess.run(cmd, shell=True)
+    os.system("echo " + cmd)
+
+
+def new_token():
+    token = random.randint(1000, 999999)
+    return token
+
+
+def do_stuff():
+    try:
+        risky()
+    except:
+        pass
+    try:
+        risky()
+    except Exception:
+        pass

codefence-1.0.0.data/data/share/codefence/samples/clean_example.js

@@ -0,0 +1,46 @@
+// Example of clean, safe JavaScript code.
+// This file shows patterns that AI Code Sanitizer should NOT flag.
+'use strict';
+
+const express = require('express');
+const helmet = require('helmet');
+const jwt = require('jsonwebtoken');
+
+const app = express();
+app.use(helmet());
+
+const JWT_SECRET = process.env.JWT_SECRET_KEY;
+
+function renderName(el, name) {
+  // textContent escapes automatically
+  el.textContent = name;
+}
+
+function issueToken(userId) {
+  // exp is set explicitly
+  return jwt.sign({ sub: userId, exp: Math.floor(Date.now() / 1000) + 3600 },
+                  JWT_SECRET);
+}
+
+function validateKey(key) {
+  if (key === '__proto__' || key === 'constructor') {
+    throw new Error('invalid key');
+  }
+  return key;
+}
+
+async function fetchSafe(url) {
+  try {
+    const res = await fetch(url);
+    return await res.json();
+  } catch (err) {
+    console.error('fetch failed:', err.message);
+    return null;
+  }
+}
+
+function goHome(res) {
+  res.redirect('/home');
+}
+
+module.exports = { app, renderName, issueToken, validateKey, fetchSafe, goHome };

codefence-1.0.0.data/data/share/codefence/samples/clean_example.py

@@ -0,0 +1,47 @@
+"""Example of clean, safe Python code.
+
+This file shows patterns that CodeFence should NOT flag.
+It is included as a reference for safe coding patterns.
+"""
+from __future__ import annotations
+
+import hashlib
+import hmac
+import os
+import secrets
+from pathlib import Path
+
+
+API_KEY = os.environ["API_KEY"]
+JWT_SECRET = os.environ["JWT_SECRET_KEY"]
+
+
+def hash_password(password: str, salt: bytes) -> bytes:
+    """Use PBKDF2-HMAC-SHA256 for password hashing."""
+    return hashlib.pbkdf2_hmac("sha256", password.encode(), salt, 200_000)
+
+
+def verify_password(password: str, salt: bytes, expected: bytes) -> bool:
+    candidate = hash_password(password, salt)
+    return hmac.compare_digest(candidate, expected)
+
+
+def new_session_token() -> str:
+    """Use the secrets module for cryptographic tokens."""
+    return secrets.token_urlsafe(32)
+
+
+def read_user_file(base_dir: str, user_path: str) -> str:
+    """Safely read a file under a fixed base directory."""
+    base = Path(base_dir).resolve()
+    target = (base / user_path).resolve()
+    if not str(target).startswith(str(base)):
+        raise ValueError("path traversal detected")
+    return target.read_text(encoding="utf-8")
+
+
+def safe_divide(a: float, b: float) -> float | None:
+    try:
+        return a / b
+    except ZeroDivisionError:
+        return None

codefence-1.0.0.dist-info/METADATA

@@ -0,0 +1,524 @@
+Metadata-Version: 2.4
+Name: codefence
+Version: 1.0.0
+Summary: A tiny offline policy gate for code. Check AI-generated code before it reaches Git.
+Author: CodeFence
+License: CODEFENCE
+        END USER LICENSE AGREEMENT (EULA)
+        Version 1.0.0
+        
+        Copyright (c) 2026 CodeFence. All rights reserved.
+        
+        PLEASE READ THIS AGREEMENT CAREFULLY BEFORE USING THIS SOFTWARE.
+        BY USING THIS SOFTWARE, YOU AGREE TO BE BOUND BY ITS TERMS.
+        
+        --------------------------------------------------------------------
+        1. DEFINITIONS
+        --------------------------------------------------------------------
+        
+        "Software" means the CodeFence command-line tool, its source
+        code, documentation, rules file (rules.json), sample files, and any
+        accompanying materials delivered together.
+        
+        "Licensor" means the copyright holder of the Software.
+        
+        "You" or "Licensee" means the individual person who purchased or
+        acquired the Software.
+        
+        "Personal Use" means use of the Software by a single individual, on
+        computers that the individual owns or controls, for that individual's
+        own development work. Personal Use does not include use on behalf of
+        a commercial entity as a service to third parties.
+        
+        --------------------------------------------------------------------
+        2. GRANT OF LICENSE
+        --------------------------------------------------------------------
+        
+        Subject to your compliance with this Agreement, the Licensor grants
+        You a non-exclusive, non-transferable, worldwide, perpetual license
+        to:
+        
+          (a) install and use the Software on up to three (3) devices that
+              You personally own or control;
+          (b) read, study, and audit the source code for Your own personal
+              understanding of its behavior;
+          (c) create private modifications of the source code for Your own
+              personal use, provided such modifications remain strictly
+              private and are not distributed.
+        
+        This is a license, not a sale. The Licensor retains all right, title,
+        and interest in and to the Software.
+        
+        --------------------------------------------------------------------
+        3. RESTRICTIONS
+        --------------------------------------------------------------------
+        
+        You may NOT:
+        
+          (a) redistribute, sublicense, sell, resell, rent, lease, lend, or
+              otherwise transfer the Software or any modification of it;
+          (b) publish, share, or make available the source code, in original
+              or modified form, on any public or private repository, forum,
+              chat, file-sharing service, or bundle;
+          (c) include the Software in any commercial product, bundle, or
+              service offering;
+          (d) remove, alter, or obscure any copyright, license, or
+              attribution notice in the Software;
+          (e) use the Software for any unlawful purpose;
+          (f) use the Software to provide scanning-as-a-service to third
+              parties on a commercial basis.
+        
+        --------------------------------------------------------------------
+        4. SOURCE CODE AVAILABILITY
+        --------------------------------------------------------------------
+        
+        The Software is delivered in human-readable source form. This is done
+        intentionally so that any user can inspect exactly what the tool does,
+        confirm that it performs no network calls, and verify that it does not
+        touch files outside the scope documented in SECURITY.md.
+        
+        Availability of the source code under this Agreement does NOT make
+        the Software open source. Open-source licenses grant redistribution
+        rights; this Agreement does not.
+        
+        --------------------------------------------------------------------
+        5. NO SUPPORT, NO UPDATES
+        --------------------------------------------------------------------
+        
+        The Software is provided as-is at the time of purchase. The Licensor
+        has no obligation to:
+        
+          (a) provide technical support, bug fixes, or updates;
+          (b) maintain compatibility with future Python versions, operating
+              systems, or third-party libraries;
+          (c) respond to any communication regarding the Software.
+        
+        Any future updates, if ever released, are provided at the Licensor's
+        sole discretion and do not extend the obligations of this Agreement.
+        
+        --------------------------------------------------------------------
+        6. CONSUMER RIGHTS (EU/UK)
+        --------------------------------------------------------------------
+        
+        If You are a consumer resident in the European Union or the United
+        Kingdom, nothing in this Agreement limits or excludes any statutory
+        right or remedy You have under applicable mandatory consumer law.
+        
+        In particular:
+        
+          (a) RIGHT OF WITHDRAWAL (EU): You have the right to withdraw from
+              the purchase within fourteen (14) days of delivery, without
+              giving any reason, provided that You have not downloaded the
+              Software file. Once digital content has been downloaded, the
+              withdrawal right is typically waived under the EU Consumer
+              Rights Directive (2011/83/EU), Article 16(m), unless the
+              vendor has obtained Your prior express consent and
+              acknowledgement of that waiver.
+        
+          (b) CONFORMITY: If the Software does not conform to its
+              description, You may be entitled to a remedy under the
+              applicable EU/UK consumer legislation.
+        
+        To exercise the right of withdrawal, follow the process documented
+        in REFUND_POLICY.md.
+        
+        --------------------------------------------------------------------
+        7. DISCLAIMER OF WARRANTY
+        --------------------------------------------------------------------
+        
+        THE SOFTWARE IS PROVIDED "AS IS" AND "AS AVAILABLE", WITHOUT WARRANTY
+        OF ANY KIND, EXPRESS OR IMPLIED, INCLUDING BUT NOT LIMITED TO THE
+        WARRANTIES OF MERCHANTABILITY, FITNESS FOR A PARTICULAR PURPOSE, AND
+        NON-INFRINGEMENT.
+        
+        THE LICENSOR DOES NOT WARRANT THAT:
+        
+          (a) the Software will detect every issue in the scanned code;
+          (b) the Software will produce no false positives or false negatives;
+          (c) a clean scan means the scanned code is secure, correct, or
+              complete;
+          (d) the Software will run uninterrupted or error-free on every
+              environment.
+        
+        The Software is a pattern-based sanity checker. It is NOT a security
+        audit, NOT a substitute for professional security review, and NOT a
+        guarantee of code quality.
+        
+        --------------------------------------------------------------------
+        8. LIMITATION OF LIABILITY
+        --------------------------------------------------------------------
+        
+        TO THE MAXIMUM EXTENT PERMITTED BY APPLICABLE LAW, THE TOTAL
+        AGGREGATE LIABILITY OF THE LICENSOR ARISING OUT OF OR RELATING TO
+        THIS AGREEMENT OR THE SOFTWARE SHALL NOT EXCEED THE AMOUNT ACTUALLY
+        PAID BY YOU FOR THE SOFTWARE.
+        
+        IN NO EVENT SHALL THE LICENSOR BE LIABLE FOR ANY INDIRECT,
+        INCIDENTAL, SPECIAL, CONSEQUENTIAL, OR PUNITIVE DAMAGES, OR FOR ANY
+        LOSS OF PROFITS, DATA, BUSINESS, OR GOODWILL, ARISING OUT OF OR
+        RELATING TO THE USE OR INABILITY TO USE THE SOFTWARE.
+        
+        NOTHING IN THIS SECTION EXCLUDES OR LIMITS LIABILITY THAT CANNOT BE
+        EXCLUDED OR LIMITED UNDER APPLICABLE MANDATORY LAW.
+        
+        --------------------------------------------------------------------
+        9. TERMINATION
+        --------------------------------------------------------------------
+        
+        This Agreement is effective until terminated. Your rights under this
+        Agreement terminate automatically if You materially breach any of its
+        terms. Upon termination, You must stop using the Software and delete
+        all copies in Your possession or control.
+        
+        Sections 3, 4, 7, 8, 10, and 11 survive termination.
+        
+        --------------------------------------------------------------------
+        10. GOVERNING LAW
+        --------------------------------------------------------------------
+        
+        This Agreement is governed by the laws of England and Wales, without
+        regard to its conflict of law rules. Any dispute that cannot be
+        resolved amicably shall be subject to the exclusive jurisdiction of
+        the courts of England and Wales, except that mandatory consumer
+        protections in Your country of residence may grant You the right to
+        bring proceedings in Your local courts.
+        
+        --------------------------------------------------------------------
+        11. ENTIRE AGREEMENT
+        --------------------------------------------------------------------
+        
+        This Agreement, together with TERMS_OF_USE.md, REFUND_POLICY.md, and
+        SECURITY.md, constitutes the entire agreement between You and the
+        Licensor concerning the Software.
+        
+        If any provision is held unenforceable, the remaining provisions
+        remain in full force and effect.
+        
+        --------------------------------------------------------------------
+        END OF LICENSE
+        --------------------------------------------------------------------
+        
+Project-URL: Homepage, https://codefence.dev
+Project-URL: Source, https://github.com/USERNAME/codefence
+Project-URL: Issues, https://github.com/USERNAME/codefence/issues
+Project-URL: Changelog, https://github.com/USERNAME/codefence/blob/main/CHANGELOG.md
+Keywords: security,static-analysis,pre-commit,git-hook,ai-generated-code,sast,sarif,offline,policy
+Classifier: Development Status :: 5 - Production/Stable
+Classifier: Environment :: Console
+Classifier: Intended Audience :: Developers
+Classifier: License :: Other/Proprietary License
+Classifier: Operating System :: OS Independent
+Classifier: Programming Language :: Python :: 3
+Classifier: Programming Language :: Python :: 3.10
+Classifier: Programming Language :: Python :: 3.11
+Classifier: Programming Language :: Python :: 3.12
+Classifier: Programming Language :: Python :: 3.13
+Classifier: Topic :: Software Development :: Quality Assurance
+Classifier: Topic :: Software Development :: Testing
+Classifier: Topic :: Security
+Requires-Python: >=3.10
+Description-Content-Type: text/markdown
+License-File: LICENSE.txt
+License-File: LICENSE_FAQ.md
+License-File: NOTICE.md
+Dynamic: license-file
+
+# CodeFence
+
+**A tiny offline policy gate for code.**
+
+Check AI-generated code before it reaches Git.
+
+---
+
+## What it does
+
+CodeFence is a single-file, zero-dependency Python CLI that scans
+source code for selected dangerous patterns before you commit. It
+runs a curated set of rules and reports findings with:
+
+- severity (critical / high / medium / low / info)
+- exact location (file:line:column)
+- code snippet
+- short remediation
+- typical before/after fix example
+
+It is designed around the risks commonly encountered in AI-assisted
+development, but scans ordinary source code regardless of how it
+was written.
+
+**The gate workflow:**
+
+    AI writes code
+         |
+         v
+    CodeFence runs on staged files
+         |
+         v
+    policy evaluation (allow / warn / block)
+         |
+         v
+    PASS or BLOCKED
+         |
+         v
+    git commit
+
+## What it does NOT do
+
+- Not an autofixer. It shows a typical fix; it does not edit files.
+- Not a security audit. It is a pattern-based sanity checker.
+- Not a replacement for Semgrep, CodeQL, or professional review.
+- Not interprocedural. No dataflow, no taint analysis.
+- Not a guarantee. A clean scan does not mean the code is secure.
+
+## Install
+
+    pip install codefence
+
+Or run it directly:
+
+    python3 codefence.py app.py
+
+## Quick start
+
+**One-time setup in a git repository:**
+
+    codefence init
+
+This installs a pre-commit hook and creates .codefence/config.json.
+Every commit is then gated automatically.
+
+**Daily usage:**
+
+    codefence --staged          # scan only what is staged
+    codefence --staged --diff   # only NEW findings since baseline
+    codefence baseline          # snapshot current findings
+
+**One-off scans:**
+
+    codefence src/
+    codefence --format json --output report.json src/
+    codefence --format html --output report.html src/
+    codefence --format sarif --output results.sarif .
+
+**Policy-as-code:**
+
+    codefence --policy company-policy.json --staged
+    codefence policy validate company-policy.json
+
+**Explanation:**
+
+    codefence explain R002
+## The 30 rules
+
+Rules are shipped in rules.json (human-readable JSON). You can
+inspect them, and you can add or disable rules for your own use.
+
+### Secrets
+- R001 - Hardcoded API keys / secrets
+- R011 - Hardcoded database credentials
+- R028 - Env var with hardcoded fallback secret
+
+### Injection
+- R002 - SQL injection via string concatenation (Python)
+- R003 - eval() / exec() on untrusted input (Python)
+- R004 - Command injection via shell=True (Python)
+- R005 - innerHTML with unsanitized data (JavaScript)
+- R010 - Path traversal
+- R014 - Prototype pollution (JavaScript)
+- R019 - Unsafe deserialization (pickle, yaml.load)
+
+### Authentication
+- R006 - Missing authentication on endpoints
+- R015 - Missing rate limiting on public endpoints
+- R018 - Open redirect
+- R020 - Never-expiring tokens / JWT
+
+### Cryptography
+- R008 - Insecure random for security tokens (Python)
+- R009 - Disabled TLS/SSL verification
+- R016 - MD5 / SHA1 for password hashing
+
+### Configuration
+- R007 - Overly permissive CORS (*)
+- R017 - Debug mode left enabled
+- R021 - Missing security headers (Express)
+
+### Reliability
+- R022 - Race conditions (check-then-act)
+- R026 - HTTP request without timeout
+- R027 - Naive datetime (no timezone, context-aware)
+
+### Quality
+- R012 - Broad except: pass
+- R013 - Mutable default arguments
+- R023 - Logging sensitive data
+- R024 - Unused imports / dead code
+- R025 - Promise rejection ignored (JavaScript)
+
+### AI-specific
+- R030 - Typosquatted package imports
+- R031 - TODO / FIXME / HACK in new code
+
+Each rule carries a confidence level and a stable rule_version +
+fingerprint for baseline stability.
+
+## Configuration
+
+Options can be passed as CLI flags or through a JSON config file
+(auto-discovered at .codefence/config.json after 'codefence init').
+
+Example .codefence/config.json:
+
+    {
+      "schema": "codefence/config-v1",
+      "format": "json",
+      "severity": "medium",
+      "include": ["*.py", "*.js"],
+      "exclude": ["node_modules", ".git", "venv", "samples"],
+      "max_size": 2097152,
+      "cache": false
+    }
+
+Priority: CLI flags > config file > built-in defaults.
+
+### Optional cache
+
+Pass --cache to enable a local cache at ~/.cache/codefence/. The
+cache is keyed by SHA-256 of the file content plus a fingerprint
+of rules.json. It is off by default. See SECURITY.md for how the
+cache is protected.
+
+### Optional history
+
+Pass --history to record this scan in a local SQLite database at
+~/.local/share/codefence/history.db. Off by default.
+
+Set CODEFENCE_NO_HISTORY=1 to disable history entirely, even when
+--history is set.
+
+Query history:
+
+    codefence history
+    codefence stats
+## Security and privacy
+
+- Zero network calls. Zero.
+- Zero telemetry.
+- Zero data upload.
+- Writes only to --output, and optionally to:
+    ~/.cache/codefence/            (only when --cache is set)
+    ~/.local/share/codefence/      (only when --history is set)
+- Never writes to the files you scan.
+- Never executes the code you scan.
+
+The full threat model is documented in SECURITY.md.
+
+## Verifying the download
+
+Every shipped file is hashed in CHECKSUMS.txt. To verify:
+
+    sha256sum codefence.py rules.json
+
+Compare the output with the corresponding lines in CHECKSUMS.txt.
+If the hashes do not match, do not use the file.
+
+## Payment and pricing
+
+**$12 USD, one-time.**
+
+Includes the current major version (v1.x) and its maintenance
+releases. No subscription. No support. No account.
+
+Payments are available in cryptocurrency only:
+
+- USDT (TRC20 or BEP20)
+- USDC
+- BTC
+- TRX
+- XRP
+
+Official purchase channels:
+
+- Getly
+- SilkRoadx402
+- ctlx.cc
+
+If you find CodeFence on any other site claiming to sell it,
+treat that site as unofficial.
+
+## License
+
+Source-available. Not open source.
+
+Summary:
+
+- Personal use on up to 3 devices that you own or control.
+- Read, study, and privately modify the source.
+- No redistribution. No resale. No bundling.
+- No scanning-as-a-service on a commercial basis.
+
+For plain-language answers to common questions, see LICENSE_FAQ.md.
+For the full legal terms, see LICENSE.txt and TERMS_OF_USE.md.
+
+**Governing law:** England and Wales. Mandatory consumer
+protections in your country of residence remain fully applicable.
+
+## Support
+
+There is no support.
+
+- No email. No chat. No issue tracker.
+- No guaranteed updates.
+- No bug-fix commitments.
+
+If you need a product with ongoing support, please look elsewhere.
+
+## FAQ
+
+**Q: Will this find every security issue in my code?**
+A: No. It finds a curated set of dangerous patterns. It is a
+   sanity check, not a security audit.
+
+**Q: Can I use it in CI?**
+A: Yes. JSON and SARIF outputs are pure on stdout. Exit codes are
+   stable.
+
+**Q: Does it phone home?**
+A: No. Zero network calls. You can verify by reading the source
+   or by running it under strace.
+
+**Q: Does it fix my code?**
+A: No. It shows a typical before/after fix. You apply it yourself.
+
+**Q: Does it support TypeScript?**
+A: No. Python, JavaScript (.js, .mjs, .cjs).
+
+**Q: What about false positives?**
+A: Pattern-based scanners always produce some. Rules with lower
+   confidence are flagged as such. You can disable any rule in
+   rules.json or via policy overrides.
+
+**Q: Can I modify the source?**
+A: Yes, privately. See LICENSE_FAQ.md.
+
+**Q: Can my team use it?**
+A: Each developer using CodeFence on their own machine needs
+   their own license. One license covers one individual on up to
+   three devices.
+
+**Q: How do I get updates?**
+A: There are no guaranteed updates.
+
+**Q: Can I get a refund?**
+A: See REFUND_POLICY.md.
+
+## A note on honesty
+
+This product is built to do a specific, limited thing well. It
+does not overstate what it can do. Every claim in this README is
+traceable to a line of code or a test. If you find a claim that
+is not supported by what the tool actually does, please report
+it.
+
+*End of README.*