diffsense 2.2.12__tar.gz → 2.2.13__tar.gz

{diffsense-2.2.12/diffsense.egg-info → diffsense-2.2.13}/PKG-INFO

@@ -1,6 +1,6 @@
 Metadata-Version: 2.4
 Name: diffsense
-Version: 2.2.12
+Version: 2.2.13
 Summary: MR/PR risk audit: semantic diff + rule engine. Run in CI as image or pip.
 License: Apache-2.0
 Requires-Python: >=3.10

diffsense-2.2.13/config/absolute/concurrency.yaml

@@ -0,0 +1,22 @@
+rules:
+  - id: absolute.concurrency.new_thread
+    rule_type: absolute
+    is_blocking: true
+    match: 'new\s+Thread\(.*\)'
+    severity: high
+    impact: runtime
+    rationale: "Using 'new Thread()' bypasses managed thread pools, risking resource exhaustion."
+
+  - id: absolute.concurrency.fixed_threadpool_1
+    rule_type: absolute
+    match: 'Executors\.newFixedThreadPool\(1\)'
+    severity: medium
+    impact: runtime
+    rationale: "FixedThreadPool(1) can lead to request queuing and latency spikes under load."
+
+  - id: absolute.concurrency.sleep_long
+    rule_type: absolute
+    match: 'Thread\.sleep\(\d{4,}\)'
+    severity: high
+    impact: runtime
+    rationale: "Thread.sleep() for more than 1s detected. Potential for blocking I/O or deadlock."

diffsense-2.2.13/config/absolute/security.yaml

@@ -0,0 +1,24 @@
+rules:
+  - id: absolute.security.sql_injection
+    rule_type: absolute
+    is_blocking: true
+    match: 'SELECT\s+.*\s+FROM\s+.*\s+WHERE\s+.*\s+\+\s+\w+'
+    severity: critical
+    impact: security
+    rationale: "SQL concatenation detected. Risk of SQL Injection. Use PreparedStatement instead."
+
+  - id: absolute.security.plaintext_token
+    rule_type: absolute
+    is_blocking: true
+    case_insensitive: true
+    match: '(token|password|secret|key)\s*=\s*["''][a-zA-Z0-9_\-]{16,}["'']'
+    severity: critical
+    impact: security
+    rationale: "Potential plaintext secret/token hardcoded in source code."
+
+  - id: absolute.security.http_url
+    rule_type: absolute
+    match: 'http://[a-zA-Z0-9\.\-]+'
+    severity: high
+    impact: security
+    rationale: "Plain HTTP URL detected. Use HTTPS for secure communication."

diffsense-2.2.13/config/absolute/stability.yaml

@@ -0,0 +1,15 @@
+rules:
+  - id: absolute.stability.catch_exception
+    rule_type: absolute
+    match: 'catch\s*\(\s*Exception\s+\w+\s*\)'
+    severity: medium
+    impact: maintenance
+    rationale: "Catching 'Exception' may hide critical runtime errors (e.g., NullPointerException)."
+
+  - id: absolute.stability.optional_get
+    rule_type: absolute
+    match: '\.get\(\)'
+    file: "**.java"
+    severity: high
+    impact: runtime
+    rationale: "Using Optional.get() without isPresent() check can cause NoSuchElementException."

diffsense-2.2.13/config/rules/cpp/exception_noexcept.yaml

@@ -0,0 +1,8 @@
+rules:
+  - id: cpp.exception.noexcept
+    language: cpp
+    severity: medium
+    impact: runtime
+    file: "**/*.cpp"
+    match: 'noexcept'
+    rationale: "noexcept"

diffsense-2.2.13/config/rules/cpp/exception_swallowed.yaml

@@ -0,0 +1,8 @@
+rules:
+  - id: cpp.exception.swallowed
+    language: cpp
+    severity: high
+    impact: runtime
+    file: "**/*.cpp"
+    match: 'catch\(\)'
+    rationale: "Empty catch"

diffsense-2.2.13/config/rules/cpp/maintenance_magic_number.yaml

@@ -0,0 +1,8 @@
+rules:
+  - id: cpp.maintenance.magic_number
+    language: cpp
+    severity: low
+    impact: maintenance
+    file: "**/*.cpp"
+    match: '1000'
+    rationale: "Magic number"

diffsense-2.2.13/config/rules/cpp/null_dereference.yaml

@@ -0,0 +1,8 @@
+rules:
+  - id: cpp.null.dereference
+    language: cpp
+    severity: high
+    impact: runtime
+    file: "**/*.cpp"
+    match: '->'
+    rationale: "Null deref"

diffsense-2.2.13/config/rules/cpp/performance_inefficient_copy.yaml

@@ -0,0 +1,8 @@
+rules:
+  - id: cpp.performance.inefficient_copy
+    language: cpp
+    severity: low
+    impact: performance
+    file: "**/*.cpp"
+    match: 'push_back'
+    rationale: "Inefficient copy"

diffsense-2.2.13/config/rules/cpp/performance_unbounded_vector.yaml

@@ -0,0 +1,8 @@
+rules:
+  - id: cpp.performance.unbounded_vector
+    language: cpp
+    severity: low
+    impact: performance
+    file: "**/*.cpp"
+    match: 'push_back'
+    rationale: "Unbounded vector"

diffsense-2.2.13/config/rules/cpp/resource_leak.yaml

@@ -0,0 +1,8 @@
+rules:
+  - id: cpp.resource.leak
+    language: cpp
+    severity: high
+    impact: runtime
+    file: "**/*.cpp"
+    match: 'fopen'
+    rationale: "Resource leak"

diffsense-2.2.13/config/rules/cpp/resource_memory_leak.yaml

@@ -0,0 +1,8 @@
+rules:
+  - id: cpp.resource.memory_leak
+    language: cpp
+    severity: high
+    impact: runtime
+    file: "**/*.cpp"
+    match: '\bnew\b'
+    rationale: "Memory leak"

diffsense-2.2.13/config/rules/cpp/resource_raw_pointer.yaml

@@ -0,0 +1,8 @@
+rules:
+  - id: cpp.resource.raw_pointer
+    language: cpp
+    severity: medium
+    impact: security
+    file: "**/*.cpp"
+    match: 'int\*'
+    rationale: "Raw pointer"

diffsense-2.2.13/config/rules/cpp/runtime_data_race.yaml

@@ -0,0 +1,8 @@
+rules:
+  - id: cpp.runtime.data_race
+    language: cpp
+    severity: high
+    impact: runtime
+    file: "**/*.cpp"
+    match: 'std::'
+    rationale: "Data race"

diffsense-2.2.13/config/rules/cpp/runtime_uninitialized.yaml

@@ -0,0 +1,8 @@
+rules:
+  - id: cpp.runtime.uninitialized
+    language: cpp
+    severity: high
+    impact: runtime
+    file: "**/*.cpp"
+    match: 'int x;'
+    rationale: "Uninitialized"

diffsense-2.2.13/config/rules/cpp/security_buffer_overflow.yaml

@@ -0,0 +1,8 @@
+rules:
+  - id: cpp.security.buffer_overflow
+    language: cpp
+    severity: critical
+    impact: security
+    file: "**/*.cpp"
+    match: 'strcpy'
+    rationale: "Buffer overflow"

diffsense-2.2.13/config/rules/cpp/security_command_injection.yaml

@@ -0,0 +1,8 @@
+rules:
+  - id: cpp.security.command_injection
+    language: cpp
+    severity: critical
+    impact: security
+    file: "**/*.cpp"
+    match: 'system\('
+    rationale: "Command injection"

diffsense-2.2.13/config/rules/cpp/security_hardcoded_secret.yaml

@@ -0,0 +1,8 @@
+rules:
+  - id: cpp.security.hardcoded_secret
+    language: cpp
+    severity: critical
+    impact: security
+    file: "**/*.cpp"
+    match: 'password'
+    rationale: "Hardcoded secret"

diffsense-2.2.13/config/rules/cpp/security_integer_overflow.yaml

@@ -0,0 +1,8 @@
+rules:
+  - id: cpp.security.integer_overflow
+    language: cpp
+    severity: high
+    impact: security
+    file: "**/*.cpp"
+    match: '\+\+'
+    rationale: "Integer overflow"

diffsense-2.2.13/config/rules/cpp/security_sql_injection.yaml

@@ -0,0 +1,8 @@
+rules:
+  - id: cpp.security.sql_injection
+    language: cpp
+    severity: critical
+    impact: security
+    file: "**/*.cpp"
+    match: 'execute\('
+    rationale: "SQL injection"

diffsense-2.2.13/config/rules/cpp/security_unsafe_cast.yaml

@@ -0,0 +1,8 @@
+rules:
+  - id: cpp.security.unsafe_cast
+    language: cpp
+    severity: high
+    impact: security
+    file: "**/*.cpp"
+    match: 'reinterpret_cast'
+    rationale: "Unsafe cast"

diffsense-2.2.13/config/rules/go/exception_error_ignored.yaml

@@ -0,0 +1,8 @@
+rules:
+  - id: exception.error_ignored
+    language: go
+    severity: medium
+    impact: maintenance
+    file: "**/*.go"
+    match: '_\s*=\s*\w+\s*\([^)]*\)'
+    rationale: "Error result is discarded in Go code; silent failures can hide operational issues and data corruption."

diffsense-2.2.13/config/rules/go/null_nil_dereference.yaml

@@ -0,0 +1,8 @@
+rules:
+  - id: null.nil_dereference
+    language: go
+    severity: high
+    impact: runtime
+    file: "**/*.go"
+    match: '\*\s*\w+|\w+\s*\.\s*\w+\s*\('
+    rationale: "Potential nil dereference pattern introduced; verify pointer and receiver nil checks near call site."

diffsense-2.2.13/config/rules/go/resource_channel_leak.yaml

@@ -0,0 +1,8 @@
+rules:
+  - id: resource.channel_leak
+    language: go
+    severity: high
+    impact: runtime
+    file: "**/*.go"
+    match: 'make\s*\(\s*chan|chan\s+\w+\s*='
+    rationale: "Channel allocation introduced; verify close semantics and ownership to avoid goroutine blocking or leaks."

diffsense-2.2.13/config/rules/go/resource_defer_misuse.yaml

@@ -0,0 +1,8 @@
+rules:
+  - id: resource.defer_misuse
+    language: go
+    severity: medium
+    impact: runtime
+    file: "**/*.go"
+    match: 'for\s*\{[\s\S]{0,200}\bdefer\s+|defer\s+\w+\s*\(\s*\w+\s*[+\-*/]'
+    rationale: "Defer in loop or defer with eager-evaluated expressions may cause resource retention and delayed release."

diffsense-2.2.13/config/rules/go/resource_goroutine_leak.yaml

@@ -0,0 +1,8 @@
+rules:
+  - id: resource.goroutine_leak
+    language: go
+    severity: high
+    impact: runtime
+    file: "**/*.go"
+    match: '\bgo\s+\w+\.?\w*\s*\('
+    rationale: "Goroutine started without clear lifecycle constraints may leak and accumulate runtime pressure."

diffsense-2.2.13/config/rules/go/runtime_goroutine_in_loop.yaml

@@ -0,0 +1,8 @@
+rules:
+  - id: go.runtime.goroutine_in_loop
+    language: go
+    severity: high
+    impact: runtime
+    file: "**/*.go"
+    match: 'for\s*\{[\s\S]{0,200}\bgo\s+\w'
+    rationale: "Goroutine launched inside loop may create unbounded concurrency; add backpressure or worker-pool controls."

diffsense-2.2.13/config/rules/go/runtime_panic_added.yaml

@@ -0,0 +1,8 @@
+rules:
+  - id: go.runtime.panic_added
+    language: go
+    severity: medium
+    impact: runtime
+    file: "**/*.go"
+    match: '\bpanic\s*\('
+    rationale: "panic() added in Go code; ensure panic is not used for recoverable errors in request paths."

diffsense-2.2.13/config/rules/go/runtime_race_condition.yaml

@@ -0,0 +1,8 @@
+rules:
+  - id: runtime.race_condition
+    language: go
+    severity: high
+    impact: runtime
+    file: "**/*.go"
+    match: '\bgo\s+\w+|\bmap\[|\bslice\b|\bchan\b'
+    rationale: "Concurrent access patterns introduced without explicit synchronization can cause race conditions."

diffsense-2.2.13/config/rules/go/security_command_injection.yaml

@@ -0,0 +1,8 @@
+rules:
+  - id: go.security.command_injection
+    language: go
+    severity: high
+    impact: security
+    file: "**/*.go"
+    match: 'exec\.Command\('
+    rationale: "Command execution introduced in Go code; verify user input is sanitized to avoid command injection."

diffsense-2.2.13/config/rules/go/security_hardcoded_secret.yaml

@@ -0,0 +1,9 @@
+rules:
+  - id: go.security.hardcoded_secret
+    language: go
+    severity: critical
+    impact: security
+    file: "**/*.go"
+    case_insensitive: true
+    match: '(password|passwd|secret|token|api[_-]?key)\s*[:=]\s*"[^"]{8,}"'
+    rationale: "Hardcoded secrets detected in Go source; move credentials to environment variables or secret managers."

diffsense-2.2.13/config/rules/go/security_http_vulnerability.yaml

@@ -0,0 +1,8 @@
+rules:
+  - id: security.http_vulnerability
+    language: go
+    severity: high
+    impact: security
+    file: "**/*.go"
+    match: 'http\.(Get|Post)\s*\([^)]*\+|http\.ListenAndServe\s*\('
+    rationale: "HTTP flow with path concatenation or direct ListenAndServe exposure may introduce security vulnerabilities."

diffsense-2.2.13/config/rules/go/security_path_traversal.yaml

@@ -0,0 +1,8 @@
+rules:
+  - id: go.security.path_traversal
+    language: go
+    severity: high
+    impact: security
+    file: "**/*.go"
+    match: '(?:os\.Open|os\.ReadFile|ioutil\.ReadFile)\([^)]*\+'
+    rationale: "File path concatenation with external input can lead to path traversal; use filepath.Clean and strict allowlists."

diffsense-2.2.13/config/rules/go/security_sql_injection.yaml

@@ -0,0 +1,8 @@
+rules:
+  - id: go.security.sql_injection
+    language: go
+    severity: critical
+    impact: security
+    file: "**/*.go"
+    match: 'fmt\.Sprintf\(\s*"(?:SELECT|INSERT|UPDATE|DELETE)\b'
+    rationale: "Dynamic SQL composition via fmt.Sprintf in Go introduces SQL injection risk; use parameterized queries."

diffsense-2.2.13/config/rules/go/security_unsafe_usage.yaml

@@ -0,0 +1,8 @@
+rules:
+  - id: security.unsafe_usage
+    language: go
+    severity: high
+    impact: security
+    file: "**/*.go"
+    match: '\bunsafe\.(Pointer|Sizeof|Alignof|Offsetof)\s*\('
+    rationale: "Unsafe package usage bypasses type and memory safety guarantees; review pointer arithmetic and casting carefully."

diffsense-2.2.13/config/rules/javascript/exception_promise_reject.yaml

@@ -0,0 +1,8 @@
+rules:
+  - id: javascript.exception.promise_reject
+    language: javascript
+    severity: medium
+    impact: runtime
+    file: "**/*.js"
+    match: '\.reject\('
+    rationale: "Promise reject"

diffsense-2.2.13/config/rules/javascript/maintenance_debug_code.yaml

@@ -0,0 +1,8 @@
+rules:
+  - id: javascript.maintenance.debug_code
+    language: javascript
+    severity: low
+    impact: maintenance
+    file: "**/*.js"
+    match: 'console.log'
+    rationale: "Debug code"

diffsense-2.2.13/config/rules/javascript/maintenance_debugger.yaml

@@ -0,0 +1,8 @@
+rules:
+  - id: javascript.maintenance.debugger
+    language: javascript
+    severity: low
+    impact: maintenance
+    file: "**/*.js"
+    match: 'debugger'
+    rationale: "Debugger"

diffsense-2.2.13/config/rules/javascript/maintenance_deprecated_api.yaml

@@ -0,0 +1,8 @@
+rules:
+  - id: javascript.maintenance.deprecated_api
+    language: javascript
+    severity: low
+    impact: maintenance
+    file: "**/*.js"
+    match: 'defineGetter'
+    rationale: "Deprecated API"

diffsense-2.2.13/config/rules/javascript/null_type_assertion.yaml

@@ -0,0 +1,8 @@
+rules:
+  - id: javascript.null.type_assertion
+    language: javascript
+    severity: medium
+    impact: runtime
+    file: "**/*.js"
+    match: ' as '
+    rationale: "Type assertion"

diffsense-2.2.13/config/rules/javascript/performance_dynamic_import.yaml

@@ -0,0 +1,8 @@
+rules:
+  - id: javascript.performance.dynamic_import
+    language: javascript
+    severity: low
+    impact: performance
+    file: "**/*.js"
+    match: 'import\('
+    rationale: "Dynamic import"

diffsense-2.2.13/config/rules/javascript/performance_regex_dos.yaml

@@ -0,0 +1,8 @@
+rules:
+  - id: javascript.performance.regex_dos
+    language: javascript
+    severity: medium
+    impact: performance
+    file: "**/*.js"
+    match: '/.**/'
+    rationale: "ReDoS"

diffsense-2.2.13/config/rules/javascript/security_code_injection.yaml

@@ -0,0 +1,8 @@
+rules:
+  - id: javascript.security.code_injection
+    language: javascript
+    severity: critical
+    impact: security
+    file: "**/*.js"
+    match: 'eval\('
+    rationale: "Code injection"

diffsense-2.2.13/config/rules/javascript/security_command_injection.yaml

@@ -0,0 +1,8 @@
+rules:
+  - id: javascript.security.command_injection
+    language: javascript
+    severity: critical
+    impact: security
+    file: "**/*.js"
+    match: 'exec\('
+    rationale: "Command injection"

diffsense-2.2.13/config/rules/javascript/security_hardcoded_secret.yaml

@@ -0,0 +1,8 @@
+rules:
+  - id: javascript.security.hardcoded_secret
+    language: javascript
+    severity: critical
+    impact: security
+    file: "**/*.js"
+    match: 'password'
+    rationale: "Hardcoded secret"

diffsense-2.2.13/config/rules/javascript/security_open_redirect.yaml

@@ -0,0 +1,8 @@
+rules:
+  - id: javascript.security.open_redirect
+    language: javascript
+    severity: medium
+    impact: security
+    file: "**/*.js"
+    match: 'location='
+    rationale: "Open redirect"

diffsense-2.2.13/config/rules/javascript/security_prototype_pollution.yaml

@@ -0,0 +1,8 @@
+rules:
+  - id: javascript.security.prototype_pollution
+    language: javascript
+    severity: high
+    impact: security
+    file: "**/*.js"
+    match: '__proto__'
+    rationale: "Prototype pollution"

diffsense-2.2.13/config/rules/javascript/security_sensitive_storage.yaml

@@ -0,0 +1,8 @@
+rules:
+  - id: javascript.security.sensitive_storage
+    language: javascript
+    severity: medium
+    impact: security
+    file: "**/*.js"
+    match: 'localStorage'
+    rationale: "Sensitive storage"

diffsense-2.2.13/config/rules/javascript/security_xss.yaml

@@ -0,0 +1,8 @@
+rules:
+  - id: javascript.security.xss
+    language: javascript
+    severity: high
+    impact: security
+    file: "**/*.js"
+    match: 'innerHTML'
+    rationale: "XSS"

diffsense-2.2.13/config/rules/python/exception_swallowed.yaml

@@ -0,0 +1,8 @@
+rules:
+  - id: python.exception.swallowed
+    language: python
+    severity: high
+    impact: runtime
+    file: "**/*.py"
+    match: 'except:'
+    rationale: "Exception swallowed"

diffsense-2.2.13/config/rules/python/exception_too_generic.yaml

@@ -0,0 +1,8 @@
+rules:
+  - id: python.exception.too_generic
+    language: python
+    severity: medium
+    impact: maintenance
+    file: "**/*.py"
+    match: 'except Exception'
+    rationale: "Broad exception"

diffsense-2.2.13/config/rules/python/maintenance_debug_code.yaml

@@ -0,0 +1,8 @@
+rules:
+  - id: python.maintenance.debug_code
+    language: python
+    severity: low
+    impact: maintenance
+    file: "**/*.py"
+    match: 'print\('
+    rationale: "Debug code"

diffsense-2.2.13/config/rules/python/null_none_check.yaml

@@ -0,0 +1,8 @@
+rules:
+  - id: python.null.none_check
+    language: python
+    severity: high
+    impact: runtime
+    file: "**/*.py"
+    match: '\.\w+\('
+    rationale: "Null check"

diffsense-2.2.13/config/rules/python/null_type_confusion.yaml

@@ -0,0 +1,8 @@
+rules:
+  - id: python.null.type_confusion
+    language: python
+    severity: medium
+    impact: runtime
+    file: "**/*.py"
+    match: 'cast\('
+    rationale: "Type confusion"

diffsense-2.2.13/config/rules/python/performance_inefficient_loop.yaml

@@ -0,0 +1,8 @@
+rules:
+  - id: python.performance.inefficient_loop
+    language: python
+    severity: low
+    impact: performance
+    file: "**/*.py"
+    match: 'for.*range'
+    rationale: "Inefficient loop"

diffsense-2.2.13/config/rules/python/performance_memory.yaml

@@ -0,0 +1,8 @@
+rules:
+  - id: python.performance.memory
+    language: python
+    severity: medium
+    impact: performance
+    file: "**/*.py"
+    match: '\.read\(\)'
+    rationale: "Memory issue"

diffsense-2.2.13/config/rules/python/resource_file_leak.yaml

@@ -0,0 +1,8 @@
+rules:
+  - id: python.resource.file_leak
+    language: python
+    severity: high
+    impact: security
+    file: "**/*.py"
+    match: 'open\('
+    rationale: "File leak"

diffsense-2.2.13/config/rules/python/runtime_mutable_default.yaml

@@ -0,0 +1,8 @@
+rules:
+  - id: python.runtime.mutable_default
+    language: python
+    severity: high
+    impact: maintenance
+    file: "**/*.py"
+    match: 'def.*='
+    rationale: "Mutable default"

diffsense-2.2.13/config/rules/python/security_code_injection.yaml

@@ -0,0 +1,8 @@
+rules:
+  - id: python.security.code_injection
+    language: python
+    severity: high
+    impact: security
+    file: "**/*.py"
+    match: 'eval\('
+    rationale: "Code injection"

diffsense-2.2.13/config/rules/python/security_command_injection.yaml

@@ -0,0 +1,8 @@
+rules:
+  - id: python.security.command_injection
+    language: python
+    severity: critical
+    impact: security
+    file: "**/*.py"
+    match: 'os.system'
+    rationale: "Command injection"

diffsense-2.2.13/config/rules/python/security_hardcoded_secret.yaml

@@ -0,0 +1,8 @@
+rules:
+  - id: python.security.hardcoded_secret
+    language: python
+    severity: critical
+    impact: security
+    file: "**/*.py"
+    match: 'password'
+    rationale: "Hardcoded credentials"