cycode 3.16.2.dev1__tar.gz → 3.16.3.dev1__tar.gz

{cycode-3.16.2.dev1 → cycode-3.16.3.dev1}/PKG-INFO

@@ -1,6 +1,6 @@
 Metadata-Version: 2.4
 Name: cycode
-Version: 3.16.2.dev1
+Version: 3.16.3.dev1
 Summary: Boost security in your dev lifecycle via SAST, SCA, Secrets & IaC scanning.
 License-Expression: MIT
 License-File: LICENCE

{cycode-3.16.2.dev1 → cycode-3.16.3.dev1}/cycode/__init__.py

@@ -5,4 +5,4 @@ import time as _time
 # end-to-end scan duration from the moment the user actually triggered it.
 _BOOT_WALL: float = _time.time()
 
-__version__ = '3.16.2.dev1'  # DON'T TOUCH. Placeholder. Will be filled automatically on poetry build from Git Tag
+__version__ = '3.16.3.dev1'  # DON'T TOUCH. Placeholder. Will be filled automatically on poetry build from Git Tag

{cycode-3.16.2.dev1 → cycode-3.16.3.dev1}/cycode/cli/apps/configure/configure_command.py

@@ -1,7 +1,12 @@
 from typing import Optional
 
 from cycode.cli.apps.configure.consts import CONFIGURATION_MANAGER, CREDENTIALS_MANAGER
-from cycode.cli.apps.configure.messages import get_credentials_update_result_message, get_urls_update_result_message
+from cycode.cli.apps.configure.messages import (
+    get_credentials_environment_variables_override_warning,
+    get_credentials_update_result_message,
+    get_urls_environment_variables_override_warning,
+    get_urls_update_result_message,
+)
 from cycode.cli.apps.configure.prompts import (
     get_api_url_input,
     get_app_url_input,
@@ -73,3 +78,14 @@ def configure_command() -> None:
         console.print(get_urls_update_result_message())
     if credentials_updated or oidc_credentials_updated:
         console.print(get_credentials_update_result_message())
+
+    # Warn about environment variables that override the configured file values, regardless of whether anything was
+    # updated. The env vars take precedence on every subsequent call, so configuring the file alone has no effect while
+    # they are set.
+    urls_override_warning = get_urls_environment_variables_override_warning()
+    if urls_override_warning:
+        console.print(f'[yellow]Warning:[/] {urls_override_warning}')
+
+    credentials_override_warning = get_credentials_environment_variables_override_warning()
+    if credentials_override_warning:
+        console.print(f'[yellow]Warning:[/] {credentials_override_warning}')

{cycode-3.16.2.dev1 → cycode-3.16.3.dev1}/cycode/cli/apps/configure/messages.py

@@ -1,3 +1,5 @@
+from typing import Optional
+
 from cycode.cli.apps.configure.consts import (
     CONFIGURATION_MANAGER,
     CREDENTIALS_ARE_SET_IN_ENVIRONMENT_VARIABLES_MESSAGE,
@@ -14,11 +16,14 @@ def _are_credentials_exist_in_environment_variables() -> bool:
 
 
 def get_credentials_update_result_message() -> str:
-    success_message = CREDENTIALS_UPDATED_SUCCESSFULLY_MESSAGE.format(filename=CREDENTIALS_MANAGER.get_filename())
+    return CREDENTIALS_UPDATED_SUCCESSFULLY_MESSAGE.format(filename=CREDENTIALS_MANAGER.get_filename())
+
+
+def get_credentials_environment_variables_override_warning() -> Optional[str]:
     if _are_credentials_exist_in_environment_variables():
-        return f'{success_message}. {CREDENTIALS_ARE_SET_IN_ENVIRONMENT_VARIABLES_MESSAGE}'
+        return CREDENTIALS_ARE_SET_IN_ENVIRONMENT_VARIABLES_MESSAGE
 
-    return success_message
+    return None
 
 
 def _are_urls_exist_in_environment_variables() -> bool:
@@ -28,10 +33,13 @@ def _are_urls_exist_in_environment_variables() -> bool:
 
 
 def get_urls_update_result_message() -> str:
-    success_message = URLS_UPDATED_SUCCESSFULLY_MESSAGE.format(
+    return URLS_UPDATED_SUCCESSFULLY_MESSAGE.format(
         filename=CONFIGURATION_MANAGER.global_config_file_manager.get_filename()
     )
+
+
+def get_urls_environment_variables_override_warning() -> Optional[str]:
     if _are_urls_exist_in_environment_variables():
-        return f'{success_message}. {URLS_ARE_SET_IN_ENVIRONMENT_VARIABLES_MESSAGE}'
+        return URLS_ARE_SET_IN_ENVIRONMENT_VARIABLES_MESSAGE
 
-    return success_message
+    return None

{cycode-3.16.2.dev1 → cycode-3.16.3.dev1}/cycode/cli/consts.py

@@ -53,6 +53,30 @@ SECRET_SCAN_FILE_EXTENSIONS_TO_IGNORE = (
     '.iso',
 )
 
+# Fallback block-list used for SAST only when the server does not return scannable extensions
+# (e.g. when the customer has custom rules, any text file is scannable). These are non-source
+# data formats that can slip past binary detection (the EICAR test file and ClamAV signature
+# databases are plain ASCII) and may be quarantined by object-storage antivirus after upload.
+SAST_SCAN_FILE_EXTENSIONS_TO_IGNORE = (
+    '.bin',
+    '.cvd',
+    '.cld',
+    '.cud',
+    '.hdb',
+    '.hsb',
+    '.mdb',
+    '.msb',
+    '.ndb',
+    '.ndu',
+    '.ldb',
+    '.ldu',
+    '.idb',
+    '.fp',
+    '.sfp',
+    '.ign',
+    '.ign2',
+)
+
 SCA_CONFIGURATION_SCAN_SUPPORTED_FILES = (  # keep in lowercase
     'cargo.lock',
     'cargo.toml',

{cycode-3.16.2.dev1 → cycode-3.16.3.dev1}/cycode/cli/files_collector/file_excluder.py

@@ -63,7 +63,10 @@ class Excluder:
         }
         self._non_scannable_extensions: dict[str, tuple[str, ...]] = {
             consts.SECRET_SCAN_TYPE: consts.SECRET_SCAN_FILE_EXTENSIONS_TO_IGNORE,
+            consts.SAST_SCAN_TYPE: consts.SAST_SCAN_FILE_EXTENSIONS_TO_IGNORE,
         }
+        # Tracks scan types for which the SAST fallback log has already been emitted (log once, not per file)
+        self._logged_sast_fallback = False
 
     def apply_scan_config(self, scan_type: str, scan_config: 'models.ScanConfiguration') -> None:
         if scan_config.scannable_extensions:
@@ -86,6 +89,11 @@ class Excluder:
 
         non_scannable_extensions = self._non_scannable_extensions.get(scan_type)
         if non_scannable_extensions:
+            # For SAST, reaching the block-list means the server returned no scannable extensions
+            # (e.g. custom rules, or no remote config). Log once so this is diagnosable.
+            if scan_type == consts.SAST_SCAN_TYPE and not self._logged_sast_fallback:
+                self._logged_sast_fallback = True
+                logger.debug('No scannable extensions provided for SAST; falling back to the built-in ignore list')
             return not filename.endswith(non_scannable_extensions)
 
         return True

{cycode-3.16.2.dev1 → cycode-3.16.3.dev1}/pyproject.toml

@@ -21,7 +21,7 @@ classifiers = [
     "Programming Language :: Python :: 3.14",
 ]
 dynamic = ["dependencies"]
-version = "3.16.2.dev1"
+version = "3.16.3.dev1"
 
 [project.scripts]
 cycode = "cycode.cli.app:app"