codeguard-cli 2.0.0__py3-none-any.whl

codeguard/rules/security/cg_sec_003_eval_exec.py

@@ -0,0 +1,104 @@
+# SPDX-License-Identifier: Apache-2.0
+"""CG-SEC-003 — eval() / exec() called with a non-literal argument.
+
+Detects calls to ``eval``, ``exec``, or ``compile`` where the first argument
+is not a string literal — meaning the code being executed is dynamic and may
+be attacker-controlled.
+
+Why this matters
+----------------
+``eval()`` and ``exec()`` execute arbitrary Python.  When called with
+user-controlled or externally-sourced input they allow remote code execution
+(CWE-78, CWE-95, OWASP A03:2021).
+
+AI models frequently generate ``eval(user_input)`` or ``exec(command)``
+patterns because they look like concise solutions to dynamic-dispatch problems.
+
+False-positive guidance
+-----------------------
+``eval("1 + 1")`` with a *literal* string is intentionally excluded — that is
+a code smell but not the dangerous case.  If your codebase legitimately calls
+``eval`` on trusted, internally-constructed strings, suppress with:
+``# codeguard: ignore[CG-SEC-003]``
+"""
+
+from __future__ import annotations
+
+import ast
+
+from codeguard.engine.finding import Category, Finding, Severity
+from codeguard.engine.registry import REGISTRY
+from codeguard.engine.rule import AstRule
+
+_DANGEROUS_BUILTINS = frozenset({"eval", "exec", "compile"})
+
+_FIX = (
+    "Avoid eval/exec on dynamic input. Use a safe dispatch mechanism "
+    "(a dict of callables, importlib, or ast.literal_eval for data parsing)."
+)
+
+
+class EvalExecRule(AstRule):
+    """Detect eval/exec/compile called with a non-literal argument."""
+
+    id = "CG-SEC-003"
+    title = "eval() / exec() on dynamic input"
+    description = (
+        "eval(), exec(), or compile() is called with a non-literal argument. "
+        "If the argument can be influenced by external input this is a remote "
+        "code execution vulnerability."
+    )
+    severity = Severity.HIGH
+    category = Category.SECURITY
+    cwe = "CWE-95"
+    owasp = "A03:2021 - Injection"
+
+    def check_ast(self, tree: ast.AST, source: str, filename: str) -> list[Finding]:
+        """Find eval/exec/compile calls with dynamic first arguments."""
+        findings: list[Finding] = []
+
+        for node in ast.walk(tree):
+            if not isinstance(node, ast.Call):
+                continue
+
+            func_name = self._func_name(node)
+            if func_name not in _DANGEROUS_BUILTINS:
+                continue
+
+            # No arguments at all — unusual but not our concern
+            if not node.args:
+                continue
+
+            first_arg = node.args[0]
+            # Safe case: literal string — eval("1+1") is a code smell, not RCE
+            if isinstance(first_arg, ast.Constant) and isinstance(first_arg.value, str):
+                continue
+
+            findings.append(
+                self._make_finding(
+                    node=node,
+                    filename=filename,
+                    description=(
+                        f"{func_name}() is called with a non-literal argument. "
+                        "If this value is attacker-controlled it enables arbitrary "
+                        "code execution."
+                    ),
+                    fix_suggestion=_FIX,
+                )
+            )
+
+        return findings
+
+    # ------------------------------------------------------------------
+    # Helpers
+    # ------------------------------------------------------------------
+
+    @staticmethod
+    def _func_name(node: ast.Call) -> str:
+        """Return the bare function name for simple Name calls, else ''."""
+        if isinstance(node.func, ast.Name):
+            return node.func.id
+        return ""
+
+
+REGISTRY.register(EvalExecRule())

codeguard/rules/security/cg_sec_004_unsafe_deserialization.py

@@ -0,0 +1,156 @@
+# SPDX-License-Identifier: Apache-2.0
+"""CG-SEC-004 — Unsafe deserialization via pickle or yaml.load.
+
+Detects:
+  - ``pickle.loads(...)`` / ``pickle.load(...)``
+  - ``_pickle.loads(...)`` (CPython internal alias)
+  - ``marshal.loads(...)``
+  - ``yaml.load(...)`` without ``Loader=SafeLoader`` (or ``Loader=yaml.SafeLoader``)
+
+Why this matters
+----------------
+Deserializing data from untrusted sources using pickle or unsafe yaml is a
+critical vulnerability (CWE-502, OWASP A08:2021).  Pickle can execute
+arbitrary Python during deserialization; yaml.load() with the default
+(FullLoader or older unsafe Loader) can instantiate arbitrary Python objects.
+
+AI models commonly generate ``pickle.loads(data)`` and ``yaml.load(config)``
+because the documentation examples often omit the Loader parameter.
+
+False-positive guidance
+-----------------------
+``pickle.loads`` on *internally-generated, trusted* data is still risky (any
+attacker who can modify your data store gets RCE) but you can suppress if
+you've audited the data provenance:
+``# codeguard: ignore[CG-SEC-004]``
+
+``yaml.load`` with ``Loader=yaml.SafeLoader`` or ``Loader=SafeLoader`` is safe
+and will NOT be flagged.
+"""
+
+from __future__ import annotations
+
+import ast
+
+from codeguard.engine.finding import Category, Finding, Severity
+from codeguard.engine.registry import REGISTRY
+from codeguard.engine.rule import AstRule
+from codeguard.rules._pyimports import ImportMap
+
+# (module, method) pairs that are always unsafe
+_UNSAFE_CALLS: frozenset[tuple[str, str]] = frozenset(
+    {
+        ("pickle", "loads"),
+        ("pickle", "load"),
+        ("_pickle", "loads"),
+        ("_pickle", "load"),
+        ("marshal", "loads"),
+        ("marshal", "load"),
+    }
+)
+
+_SAFE_LOADERS = frozenset({"SafeLoader", "CSafeLoader"})
+
+_FIX_PICKLE = (
+    "Never unpickle data from untrusted sources. "
+    "Consider JSON, msgpack, or protobuf for cross-process serialization."
+)
+
+_FIX_YAML = (
+    "Pass Loader=yaml.SafeLoader: yaml.load(data, Loader=yaml.SafeLoader), "
+    "or use yaml.safe_load(data)."
+)
+
+
+class UnsafeDeserializationRule(AstRule):
+    """Detect pickle.loads, marshal.loads, and yaml.load without SafeLoader."""
+
+    id = "CG-SEC-004"
+    title = "Unsafe deserialization"
+    description = (
+        "Deserializing data with pickle, marshal, or yaml.load (without SafeLoader) "
+        "can execute arbitrary code if the data source is attacker-controlled."
+    )
+    severity = Severity.HIGH
+    category = Category.SECURITY
+    cwe = "CWE-502"
+    owasp = "A08:2021 - Software and Data Integrity Failures"
+
+    def check_ast(self, tree: ast.AST, source: str, filename: str) -> list[Finding]:
+        """Find unsafe deserialization calls."""
+        findings: list[Finding] = []
+        imports = ImportMap.from_tree(tree)
+
+        for node in ast.walk(tree):
+            if not isinstance(node, ast.Call):
+                continue
+
+            module, method = imports.resolve_call(node.func)
+            if not module or not method:
+                continue
+
+            # pickle.loads / marshal.loads — always unsafe
+            if (module, method) in _UNSAFE_CALLS:
+                findings.append(
+                    self._make_finding(
+                        node=node,
+                        filename=filename,
+                        description=(
+                            f"{module}.{method}() deserializes arbitrary Python objects. "
+                            "This is a critical vulnerability if the data is attacker-controlled."
+                        ),
+                        fix_suggestion=_FIX_PICKLE,
+                    )
+                )
+
+            # yaml.load — only unsafe without SafeLoader
+            elif module == "yaml" and method == "load":
+                if not self._has_safe_loader(node):
+                    findings.append(
+                        self._make_finding(
+                            node=node,
+                            filename=filename,
+                            description=(
+                                "yaml.load() without Loader=SafeLoader can instantiate "
+                                "arbitrary Python objects from the YAML input."
+                            ),
+                            fix_suggestion=_FIX_YAML,
+                        )
+                    )
+
+        return findings
+
+    # ------------------------------------------------------------------
+    # Helpers
+    # ------------------------------------------------------------------
+
+    @staticmethod
+    def _has_safe_loader(node: ast.Call) -> bool:
+        """Return True if Loader=SafeLoader (or equivalent) is present."""
+        # Keyword argument: yaml.load(data, Loader=yaml.SafeLoader)
+        for kw in node.keywords:
+            if kw.arg == "Loader":
+                val = kw.value
+                loader_name = (
+                    val.attr
+                    if isinstance(val, ast.Attribute)
+                    else (val.id if isinstance(val, ast.Name) else "")
+                )
+                if loader_name in _SAFE_LOADERS:
+                    return True
+
+        # Positional argument: yaml.load(data, yaml.SafeLoader)
+        if len(node.args) >= 2:
+            arg = node.args[1]
+            loader_name = (
+                arg.attr
+                if isinstance(arg, ast.Attribute)
+                else (arg.id if isinstance(arg, ast.Name) else "")
+            )
+            if loader_name in _SAFE_LOADERS:
+                return True
+
+        return False
+
+
+REGISTRY.register(UnsafeDeserializationRule())

codeguard/rules/security/cg_sec_005_shell_injection.py

@@ -0,0 +1,157 @@
+# SPDX-License-Identifier: Apache-2.0
+"""CG-SEC-005 — a non-literal command run through a shell.
+
+Two cases, both CWE-78 / OWASP A03:2021:
+
+- ``subprocess.run`` / ``call`` / ``Popen`` / ``check_output`` / ``check_call``
+  with ``shell=True`` and a non-literal command.
+- ``os.system`` / ``os.popen`` / ``subprocess.getoutput`` /
+  ``subprocess.getstatusoutput`` with a non-literal command — these always use
+  a shell, there is no ``shell=`` keyword to check.
+
+Import aliases are resolved, so ``from os import system`` and
+``import subprocess as sp`` are covered.
+
+Why this matters
+----------------
+When a command string is interpreted by the OS shell and any part of it is
+attacker-controlled, the attacker can inject arbitrary shell commands.
+
+AI models routinely generate ``subprocess.run(f"git {user_arg}", shell=True)``
+because it looks clean and concise.  It is not.
+
+Safe patterns NOT flagged
+-------------------------
+- ``subprocess.run("ls -la", shell=True)``  — literal string, no injection vector
+- ``subprocess.run(["git", "status"])``       — list form without shell=True
+- ``subprocess.run(cmd, shell=False)``        — shell disabled
+
+False-positive guidance
+-----------------------
+If the command is constructed from entirely trusted, validated values you can
+suppress: ``# codeguard: ignore[CG-SEC-005]``
+
+Better: switch to the list form (``shell=False``).
+"""
+
+from __future__ import annotations
+
+import ast
+
+from codeguard.engine.finding import Category, Finding, Severity
+from codeguard.engine.registry import REGISTRY
+from codeguard.engine.rule import AstRule
+from codeguard.rules._pyimports import ImportMap
+
+# subprocess entry points where a shell is only used when shell=True is passed.
+_SHELL_OPTIONAL: frozenset[tuple[str, str]] = frozenset(
+    {
+        ("subprocess", "run"),
+        ("subprocess", "call"),
+        ("subprocess", "Popen"),
+        ("subprocess", "check_output"),
+        ("subprocess", "check_call"),
+    }
+)
+
+# Calls that ALWAYS run their argument through a shell -- no shell= keyword.
+_ALWAYS_SHELL: frozenset[tuple[str, str]] = frozenset(
+    {
+        ("os", "system"),
+        ("os", "popen"),
+        ("subprocess", "getoutput"),
+        ("subprocess", "getstatusoutput"),
+    }
+)
+
+_FIX = (
+    "Pass the command as a list with shell=False: "
+    "subprocess.run(['git', 'status'], shell=False). "
+    "If a shell is required, validate and sanitize every interpolated value with shlex.quote()."
+)
+
+
+class ShellInjectionRule(AstRule):
+    """Detect subprocess calls with shell=True and a non-literal command."""
+
+    id = "CG-SEC-005"
+    title = "subprocess with shell=True and dynamic command"
+    description = (
+        "subprocess is called with shell=True and the command argument is not a "
+        "string literal. If any part of the command is attacker-controlled, this "
+        "enables shell command injection."
+    )
+    severity = Severity.HIGH
+    category = Category.SECURITY
+    cwe = "CWE-78"
+    owasp = "A03:2021 - Injection"
+
+    def check_ast(self, tree: ast.AST, source: str, filename: str) -> list[Finding]:
+        """Find shell command injection via subprocess / os.system."""
+        findings: list[Finding] = []
+        imports = ImportMap.from_tree(tree)
+
+        for node in ast.walk(tree):
+            if not isinstance(node, ast.Call):
+                continue
+
+            target = imports.resolve_call(node.func)
+            always_shell = target in _ALWAYS_SHELL
+            shell_optional = target in _SHELL_OPTIONAL
+
+            if not always_shell and not shell_optional:
+                continue
+            if shell_optional and not self._has_shell_true(node):
+                continue
+            if self._command_is_literal(node):
+                continue
+
+            module, method = target
+            findings.append(
+                self._make_finding(
+                    node=node,
+                    filename=filename,
+                    description=(
+                        f"{module}.{method}() runs a non-literal command through a shell. "
+                        "If any part of the command is attacker-controlled, this enables "
+                        "shell command injection."
+                    ),
+                    fix_suggestion=_FIX,
+                )
+            )
+
+        return findings
+
+    # ------------------------------------------------------------------
+    # Helpers
+    # ------------------------------------------------------------------
+
+    @staticmethod
+    def _has_shell_true(node: ast.Call) -> bool:
+        """Return True if shell=True is explicitly passed."""
+        for kw in node.keywords:
+            if kw.arg == "shell":
+                val = kw.value
+                # shell=True  or  shell=1
+                if isinstance(val, ast.Constant) and val.value:
+                    return True
+        return False
+
+    @staticmethod
+    def _command_is_literal(node: ast.Call) -> bool:
+        """Return True if the command arg is a plain string literal (safe case)."""
+        if not node.args:
+            # All keyword args — look for args=
+            for kw in node.keywords:
+                if kw.arg == "args":
+                    return isinstance(kw.value, ast.Constant)
+            return True  # no command at all — not our concern
+
+        first = node.args[0]
+        # List of literals is fine too: ["ls", "-la"]
+        if isinstance(first, ast.List):
+            return all(isinstance(elt, ast.Constant) for elt in first.elts)
+        return isinstance(first, ast.Constant)
+
+
+REGISTRY.register(ShellInjectionRule())

codeguard_cli-2.0.0.dist-info/METADATA

@@ -0,0 +1,210 @@
+Metadata-Version: 2.5
+Name: codeguard-cli
+Version: 2.0.0
+Summary: Fast, offline multi-language static analysis for security anti-patterns (Python, JS, TS)
+Project-URL: Homepage, https://github.com/mevichitra/codeguard
+Project-URL: Bug Tracker, https://github.com/mevichitra/codeguard/issues
+Project-URL: Security, https://github.com/mevichitra/codeguard/security
+Project-URL: Documentation, https://github.com/mevichitra/codeguard/tree/main/docs
+Author: CodeGuard Contributors
+License-Expression: Apache-2.0
+License-File: LICENSE
+Keywords: ast,linting,sarif,sast,security,static-analysis
+Classifier: Development Status :: 4 - Beta
+Classifier: Intended Audience :: Developers
+Classifier: Operating System :: OS Independent
+Classifier: Programming Language :: Python :: 3
+Classifier: Programming Language :: Python :: 3.10
+Classifier: Programming Language :: Python :: 3.11
+Classifier: Programming Language :: Python :: 3.12
+Classifier: Programming Language :: Python :: 3.13
+Classifier: Topic :: Security
+Classifier: Topic :: Software Development :: Quality Assurance
+Classifier: Typing :: Typed
+Requires-Python: >=3.10
+Requires-Dist: click>=8.1
+Requires-Dist: pathspec>=0.12
+Requires-Dist: platformdirs>=4.0
+Requires-Dist: rich>=13.0
+Requires-Dist: tomli>=2.0; python_version < '3.11'
+Requires-Dist: tree-sitter-javascript>=0.23
+Requires-Dist: tree-sitter-typescript>=0.23
+Requires-Dist: tree-sitter>=0.23
+Provides-Extra: dev
+Requires-Dist: build>=1.2; extra == 'dev'
+Requires-Dist: mypy>=1.7; extra == 'dev'
+Requires-Dist: pip-audit>=2.7; extra == 'dev'
+Requires-Dist: pre-commit>=3.6; extra == 'dev'
+Requires-Dist: pytest-cov>=4.1; extra == 'dev'
+Requires-Dist: pytest>=7.4; extra == 'dev'
+Requires-Dist: ruff>=0.4; extra == 'dev'
+Requires-Dist: towncrier>=24.8; extra == 'dev'
+Provides-Extra: docs
+Requires-Dist: mkdocs-gen-files>=0.5; extra == 'docs'
+Requires-Dist: mkdocs-material>=9.5; extra == 'docs'
+Description-Content-Type: text/markdown
+
+# CodeGuard
+
+Fast, offline static analysis that finds security anti-patterns in **Python, JavaScript, and TypeScript** — and drops into every gate of your workflow (editor, pre-commit, PR/CI, scheduled audit) from a single config file.
+
+**Status: 2.0 (beta).** Rule IDs, the `Finding`/JSON schema, config keys, and exit codes are a stable contract from 2.0. See [migration notes](docs/migration-v2.md) if you used the 0.1 alpha.
+
+[![License](https://img.shields.io/badge/license-Apache--2.0-blue.svg)](LICENSE)
+[![Python](https://img.shields.io/badge/python-3.10%2B-blue.svg)](https://python.org)
+[![CI](https://github.com/mevichitra/codeguard/actions/workflows/ci.yml/badge.svg)](https://github.com/mevichitra/codeguard/actions)
+[![PyPI](https://img.shields.io/pypi/v/codeguard-cli.svg)](https://pypi.org/project/codeguard-cli/)
+
+---
+
+## What it does
+
+CodeGuard scans **Python, JavaScript, and TypeScript** and reports security findings. Each finding has a stable rule ID, severity, CWE/OWASP mapping, and a plain-English fix suggestion.
+
+Current rules (see [docs/rules/](docs/rules/) for detail):
+
+| ID | What it catches | Severity | CWE | Languages |
+|---|---|---|---|---|
+| CG-SEC-001 | SQL built with f-strings / `%` / `.format()` | HIGH | CWE-89 | Python |
+| CG-SEC-002 | Hardcoded passwords, API keys, tokens | HIGH | CWE-798 | Python |
+| CG-SEC-003 | `eval()` / `exec()` on non-literal input | HIGH | CWE-95 | Python |
+| CG-SEC-004 | `pickle.loads` / `yaml.load` without SafeLoader | HIGH | CWE-502 | Python |
+| CG-SEC-005 | `subprocess(..., shell=True)` with non-literal args | HIGH | CWE-78 | Python |
+| CG-SEC-101 | `eval` / `new Function` / string timers on dynamic input | HIGH | CWE-95 | JS, TS |
+| CG-SEC-102 | `child_process.exec` with a dynamic command | HIGH | CWE-78 | JS, TS |
+| CG-SEC-103 | `innerHTML` / `document.write` assigned a non-literal | HIGH | CWE-79 | JS, TS |
+| CG-SEC-104 | `dangerouslySetInnerHTML` with a non-literal value | HIGH | CWE-79 | JS, TS |
+| CG-SEC-105 | Hardcoded passwords, API keys, tokens | HIGH | CWE-798 | JS, TS |
+| CG-SEC-106 | `Math.random()` used for a token / secret / id | MEDIUM | CWE-338 | JS, TS |
+
+### What it does not do (yet)
+
+- Baseline / diff scanning, a CI-native command, packaged distribution (planned for v2.0)
+- AI-generated-code detection (deferred to a post-2.0 experimental module)
+- Web dashboard or REST API
+
+---
+
+## Install
+
+```bash
+pipx install codeguard-cli      # or: uv tool install codeguard-cli
+pip install codeguard-cli       # into the current environment
+
+# or from source:
+git clone https://github.com/mevichitra/codeguard
+cd codeguard
+pip install -e ".[dev]"
+```
+
+The PyPI project is `codeguard-cli`; the installed command is `codeguard`.
+
+Requires Python 3.10+. No database, no Redis, no Docker needed.
+
+---
+
+## Usage
+
+```bash
+# Scan a file or directory
+codeguard scan myproject/
+
+# Output as JSON
+codeguard scan myproject/ --format json
+
+# Output as SARIF (for GitHub code scanning)
+codeguard scan myproject/ --format sarif > results.sarif
+
+# Only run specific rules
+codeguard scan myproject/ --rule CG-SEC-001 --rule CG-SEC-002
+
+# Only report HIGH and above
+codeguard scan myproject/ --severity high
+```
+
+Example output (human format):
+
+```
+myproject/auth.py:12:4  [CG-SEC-001] HIGH  SQL query built with string formatting
+  → Use parameterized queries: cursor.execute("SELECT ... WHERE id = %s", (user_id,))
+
+myproject/config.py:5:0  [CG-SEC-002] HIGH  Hardcoded secret: password
+  → Load secrets from environment variables or a secrets manager.
+
+2 findings  (2 high, 0 medium, 0 low)
+```
+
+Exit codes: `0` = no findings, `1` = findings found, `2` = error.
+
+### Inline suppression
+
+```python
+query = f"SELECT * FROM users WHERE id = {uid}"  # codeguard: ignore[CG-SEC-001]
+```
+
+Suppressed findings still appear with `suppressed: true` in JSON/SARIF output.
+
+### Config file
+
+Place a `codeguard.toml` in your project root:
+
+```toml
+[codeguard]
+exclude = ["tests/", "migrations/"]
+severity = "medium"   # ignore findings below this level
+
+[codeguard.rules]
+disabled = ["CG-SEC-002"]  # not yet
+```
+
+_(Config file support is on the roadmap; not yet implemented.)_
+
+---
+
+## CI integration
+
+### GitHub Actions
+
+```yaml
+- name: Run CodeGuard
+  run: |
+    pip install codeguard-cli
+    codeguard scan src/ --format sarif > codeguard.sarif
+
+- name: Upload SARIF
+  uses: github/codeql-action/upload-sarif@v3
+  with:
+    sarif_file: codeguard.sarif
+```
+
+---
+
+## Contributing
+
+See [CONTRIBUTING.md](CONTRIBUTING.md) for how to add a rule or file a bug.  
+Adding a rule requires: one rule file + two test fixtures (vulnerable + safe). See the [rule authoring guide](CONTRIBUTING.md#adding-a-rule).
+
+---
+
+## Project status and roadmap
+
+**2.0 (beta).** Rule IDs, the `Finding` / JSON schema, config keys, and the exit-code
+contract are stable. Full details in [the changelog](CHANGELOG.md) and
+[docs/](https://mevichitra.github.io/codeguard/).
+
+On the roadmap:
+
+1. Light intraprocedural taint tracking (source → sink, sanitizer-aware) to cut false positives further
+2. A Semgrep-compatible YAML rule subset for custom rules
+3. Autofix (`--fix`) for the safe-fix rules
+4. Standalone single-file binaries and a Homebrew tap
+5. An LSP server for editor integration
+6. Optional, offline AI-assisted triage (confidence + rationale, no code leaves the machine)
+
+---
+
+## License
+
+Apache-2.0. See [LICENSE](LICENSE).
+
+Contributions are accepted under the [Developer Certificate of Origin](https://developercertificate.org/) (DCO). Sign your commits with `git commit -s`.

codeguard_cli-2.0.0.dist-info/RECORD

@@ -0,0 +1,52 @@
+codeguard/__init__.py,sha256=rSpNWh22tyLJb077nuoPh0_u-88k3arwSFUtAktUpzU,205
+codeguard/py.typed,sha256=hnBZ2f5aEYic_FIpxxOxTCC1g1rZ2U4caFMSikgm170,57
+codeguard/cli/__init__.py,sha256=RWO3W_psF33Drjj6RmfHeDVJE_Ws6lN6n9sN5tnoOA4,67
+codeguard/cli/_run.py,sha256=Vj63yfWXhhhchXqtZjEU5wwmGMipbQy-wS0L1oWrcTE,8313
+codeguard/cli/commands.py,sha256=OyUocW-INriCV_fvubxOHGhTtTMKlA_VtdY38Gdxfkw,13679
+codeguard/cli/formatters.py,sha256=CKsN8tV_LDRIeyKzCkWZUuunyA3lNyxQZDpLnI0JVRs,14869
+codeguard/cli/main.py,sha256=jTUR1ZCI7sl6IjwpTPhy2KMvNyFXgB7tiTh_LAWiPV4,6004
+codeguard/config/__init__.py,sha256=Evh6UYwdh4FBhp6HYMEHp-XwwM9ei8zttZeWM8i04z4,393
+codeguard/config/loader.py,sha256=3R4ElUqOX9TuN-bAZa-70QwjlNqqnLkWuqEKorOgzCA,2627
+codeguard/config/schema.py,sha256=m5CliVIMFy6TCKFHaj0SjmgD3fufEVaNwttzQCxGQEY,6813
+codeguard/engine/__init__.py,sha256=W3eQbTLlHaQPEiCkpdvzIjh4Xlvz75wbz28kxwvnPow,556
+codeguard/engine/baseline.py,sha256=zzEVkLAMQO2ezftWkt361D_-Aqiz9HOFU4Rx26pi1io,4577
+codeguard/engine/context.py,sha256=Eaum1v8lGjCc0tFoNuJPoYnjsvuLOaU0p5M3uM7LTn8,1766
+codeguard/engine/discovery.py,sha256=mUONVr4TmcK_5MkfkPtQhdZ1x7nivU3KnDODrWzequI,4806
+codeguard/engine/finding.py,sha256=s-9DH5jAS75iaqXj99D5hYykyHXD8N5fSehrGMwkCkc,6301
+codeguard/engine/fingerprint.py,sha256=kGOq2hvov-gZSvLkm5KPDIF5V2vAUnCai14jKBrJeMs,3178
+codeguard/engine/gitdiff.py,sha256=NJOXPLK7LZ30gWcxBGoQXIQbJ1Uk1MKcVYRzv2IBUKE,2418
+codeguard/engine/policy.py,sha256=Zv9iNGNFA3xnOEm_gZB59emLchD4dIObVxrxsz8Frz4,2574
+codeguard/engine/registry.py,sha256=161GqYUkZZvTb8q5CG4HjT-LDkdLyS3aIDxFXQYJDQU,2439
+codeguard/engine/rule.py,sha256=Mk_K_z2fJSUGLO7GzhuUvKyb9g3zPanEEg0f1hLDqLg,6657
+codeguard/engine/runner.py,sha256=SFM5_ls2UkXzSwtzi4QU5I71sGSMO28Vjzd9B38qmQg,9949
+codeguard/engine/suppressions.py,sha256=MsN8yqLbOMzxvkYoSzlj0Zywo_cLRnP8knk-ewCbUx4,4053
+codeguard/lang/__init__.py,sha256=OE27PN1n9kIZsCSc9u6R4LT6zvXjznuCGIQPXzi9ZZQ,1160
+codeguard/lang/base.py,sha256=WKVolBMOrPh-lbuABuHFnFsnkgHtmSJ7A4NKk-v-d4E,2266
+codeguard/lang/javascript.py,sha256=-WavoLvHOvsHv0zSAGKne_HUEMfTyhz1oNc_Gg9Gv14,536
+codeguard/lang/node.py,sha256=Nv7sw3TIovgQyJBdRQXtnU_de9sgdYE48ngbqCmhMw0,5341
+codeguard/lang/python_ast.py,sha256=KGjOntGqygKVPuspHEWrJw2zrniOLeq7VZmAtd03JQM,933
+codeguard/lang/registry.py,sha256=w949r0nZbBmymDPAEm7_Bh6iBy4jm39pgPbkAqcHsPw,1156
+codeguard/lang/treesitter.py,sha256=rZh4Fxs5rNj_UEiwlzTaaU2hRAMX_du3uBRsKFpVVOE,3151
+codeguard/lang/typescript.py,sha256=LIJSnmXOWgljOQNbs07IJ6DsKoaexivwW-WJnZimpJY,686
+codeguard/rules/__init__.py,sha256=iuF7srUvwALv71dWwcWtzwcQ01rLlRbKctZKOADiniI,264
+codeguard/rules/_jsnodes.py,sha256=mSPAMrgwBANF6ayuHsQGi0FB_A7v2eTZlXr9Bofg1pE,2439
+codeguard/rules/_pyimports.py,sha256=tiPgyb3sDmmja87MNWUb-L8FqchFoy6qcjjn8m0yLig,2475
+codeguard/rules/javascript/__init__.py,sha256=_pyPrFeDzfgih0BhL4xMYKGUCSnOqC0g2-kPJeIyUcc,479
+codeguard/rules/javascript/cg_sec_101_dynamic_code.py,sha256=HAxCUM1wkRSKzD-dKPXHq9IZD1OUhNQZ47I-L5cUtU0,3505
+codeguard/rules/javascript/cg_sec_102_child_process.py,sha256=ThorafEt6U6SW4s6ArwiSTnO7OHSMl07CG3lnn8Q7sM,2238
+codeguard/rules/javascript/cg_sec_103_dom_xss.py,sha256=AJs-qtPyT_uGlDNs08rDnE-omb2VRAoGsB4pVluYNqE,2728
+codeguard/rules/javascript/cg_sec_104_react_dangerous_html.py,sha256=XA5Vyy9x9Jt_lwOJUJi6rD7roOhiFN1Wcy3iB-93HDY,1985
+codeguard/rules/javascript/cg_sec_105_hardcoded_secret.py,sha256=kR6nOPOx2WXbtEi052qb5TNE5CAJ6TFT--kvyZkOGl8,2750
+codeguard/rules/javascript/cg_sec_106_weak_random.py,sha256=JeSDbFmQvcvuQMCYLk9GsqcYZ78k9ZqotYhz52WYUJU,3028
+codeguard/rules/meta/__init__.py,sha256=KWvs-SmJg5BmvOPZWLZVNIB1x6R86p7_vOmoSRe9w70,1964
+codeguard/rules/security/__init__.py,sha256=2XrbMlU0eXPO3ZgHPt_ccPqkjEhkJllbfirnSkGsSPM,438
+codeguard/rules/security/cg_sec_001_sql_injection.py,sha256=49QCPIiwXNTTa48Oh7knhSlHt6eHUspIdWzTfCJSEKw,4025
+codeguard/rules/security/cg_sec_002_hardcoded_secrets.py,sha256=aLlKaCTDuYDON6CWEy18UNG4qPeQF_R5kD8PHOJZvlA,7423
+codeguard/rules/security/cg_sec_003_eval_exec.py,sha256=EiP_oak51iwURYu6mR5KEDI0csO-pxUohiMu6Q-7m2Y,3625
+codeguard/rules/security/cg_sec_004_unsafe_deserialization.py,sha256=kYSftvwI49pYraOPBtReqcejLAoxUxresY4hihqD-nw,5559
+codeguard/rules/security/cg_sec_005_shell_injection.py,sha256=tUn6m2bmZ1zGpWXDRJOJQm-DALcUmPpefWlLiu2qcAM,5590
+codeguard_cli-2.0.0.dist-info/METADATA,sha256=vD1jmTm0uCvlrShjwGyuwihMdCAkgZ4mO2b5sLqFT9Q,7496
+codeguard_cli-2.0.0.dist-info/WHEEL,sha256=zOwg4jB6zX2kU910N-cMawjivD6tO8NEWvE12je1bVk,87
+codeguard_cli-2.0.0.dist-info/entry_points.txt,sha256=XOpCnyTVSj3IGv_BjHUBz6VvLV1HTWqFYi4M6FOHxw4,53
+codeguard_cli-2.0.0.dist-info/licenses/LICENSE,sha256=8MbEbZBqWFGR5HLQoPl6VQcU5WOT027U_9PD0bTsXmo,10316
+codeguard_cli-2.0.0.dist-info/RECORD,,

codeguard_cli-2.0.0.dist-info/WHEEL

@@ -0,0 +1,4 @@
+Wheel-Version: 1.0
+Generator: hatchling 1.32.0
+Root-Is-Purelib: true
+Tag: py3-none-any

codeguard_cli-2.0.0.dist-info/entry_points.txt

@@ -0,0 +1,2 @@
+[console_scripts]
+codeguard = codeguard.cli.main:cli