djcheckup 0.2.1__tar.gz → 0.2.3__tar.gz

{djcheckup-0.2.1 → djcheckup-0.2.3}/PKG-INFO

@@ -1,6 +1,6 @@
 Metadata-Version: 2.3
 Name: djcheckup
-Version: 0.2.1
+Version: 0.2.3
 Summary: DJ Checkup is a security scanner for Django sites.
 Author: Stuart Maxwell
 Author-email: Stuart Maxwell <stuart@amanzi.nz>
@@ -35,7 +35,7 @@ License: BSD 3-Clause License
 Requires-Dist: httpx>=0.28.1
 Requires-Dist: rich>=14.1.0
 Requires-Dist: typer>=0.17.4
-Requires-Python: >=3.13
+Requires-Python: >=3.10
 Project-URL: Homepage, https://github.com/stuartmaxwell/djcheckup
 Project-URL: Repository, https://github.com/stuartmaxwell/djcheckup
 Description-Content-Type: text/markdown

{djcheckup-0.2.1 → djcheckup-0.2.3}/pyproject.toml

@@ -1,10 +1,10 @@
 [project]
 name = "djcheckup"
-version = "0.2.1"
+version = "0.2.3"
 description = "DJ Checkup is a security scanner for Django sites."
 readme = "README.md"
 authors = [{ name = "Stuart Maxwell", email = "stuart@amanzi.nz" }]
-requires-python = ">=3.13"
+requires-python = ">=3.10"
 dependencies = ["httpx>=0.28.1", "rich>=14.1.0", "typer>=0.17.4"]
 license = { file = "LICENSE" }
 
@@ -26,5 +26,25 @@ target-version = "py313"
 [tool.ruff.lint]
 select = ["ALL"]
 
+[tool.ruff.lint.extend-per-file-ignores]
+"tests/**" = ["S101", "ANN201", "ANN001", "ARG001"]
+
 [tool.ruff.lint.pydocstyle]
 convention = "google" # Accepts: "google", "numpy", or "pep257".
+
+[dependency-groups]
+dev = ["nox>=2025.5.1", "pytest>=8.4.2", "pytest-cov>=7.0.0"]
+
+[tool.pytest.ini_options]
+pythonpath = "."
+python_files = "test_*.py"
+
+[tool.coverage.html]
+show_contexts = true
+
+[tool.coverage.run]
+branch = true
+include = ["src/djcheckup/*"]
+
+[tool.coverage.report]
+# exclude_lines = ["if TYPE_CHECKING:", "# pragma: no cover"]

{djcheckup-0.2.1 → djcheckup-0.2.3}/src/djcheckup/check_defs.py

@@ -56,7 +56,7 @@ csrf_httponly_check = CookieHttpOnlyCheck(
     depends_on="csrf_check",
     name="Is the CSRF cookie HttpOnly?",
     cookie_name="csrftoken",
-    success=False,
+    success=True,
     severity=SeverityWeight.MEDIUM,
     success_message="Your CSRF cookie is marked as HttpOnly, which helps prevent some XSS attacks.",
     failure_message="""
@@ -211,7 +211,7 @@ Reference:
 login_check = PathCheck(
     check_id="login_check",
     name="Is your login page exposed at a default or guessable URL?",
-    path="/accounts/login/",
+    path="/accounts/login",
     success=False,
     severity=SeverityWeight.MEDIUM,
     success_message="Login page is not exposed at the default URL. This reduces the risk of automated attacks.",

{djcheckup-0.2.1 → djcheckup-0.2.3}/src/djcheckup/checks.py

@@ -4,7 +4,7 @@ from abc import ABC, abstractmethod
 from dataclasses import dataclass
 from enum import Enum
 from http.cookiejar import CookieJar
-from typing import Literal, Self
+from typing import Literal
 
 import httpx
 
@@ -99,25 +99,6 @@ class _BaseCheck(ABC):
         )
 
 
-@dataclass
-class HeaderCheck(_BaseCheck):
-    """A header check."""
-
-    header_name: str
-    header_value: str = ""
-
-    def check(self, context: SiteCheckContext) -> bool:
-        """Check if a specific header is present and optionally if it matches a given value."""
-        # Normalize header names to lowercase for case-insensitive comparison
-        headers = {k.lower(): v for k, v in context.headers.items()}
-        actual_value = headers.get(self.header_name.lower())
-        if actual_value is None:
-            return False
-
-        # Compare header values case-insensitively if header_value is provided
-        return not (self.header_value and actual_value.lower() != self.header_value.lower())
-
-
 @dataclass
 class ContentCheck(_BaseCheck):
     """A content check.
@@ -230,6 +211,25 @@ class CookieSecureCheck(_BaseCheck):
         return False
 
 
+@dataclass
+class HeaderCheck(_BaseCheck):
+    """A header check."""
+
+    header_name: str
+    header_value: str = ""
+
+    def check(self, context: SiteCheckContext) -> bool:
+        """Check if a specific header is present and optionally if it matches a given value."""
+        # Normalize header names to lowercase for case-insensitive comparison
+        headers = {k.lower(): v for k, v in context.headers.items()}
+        actual_value = headers.get(self.header_name.lower())
+        if actual_value is None:
+            return False
+
+        # Compare header values case-insensitively if header_value is provided
+        return not (self.header_value and actual_value.lower() != self.header_value.lower())
+
+
 @dataclass
 class PathCheck(_BaseCheck):
     """A path check.
@@ -274,8 +274,8 @@ class SchemeCheck(_BaseCheck):
     def check(self, context: SiteCheckContext) -> bool:
         """Check if the scheme of the URL in the request matches the final scheme."""
         # If the start scheme matches the original URL scheme, then we don't need a new request.
-        if context.url.scheme == self.start_scheme and context.response_url.scheme == self.end_scheme:
-            return True
+        if context.url.scheme == self.start_scheme:
+            return context.response_url.scheme == self.end_scheme
 
         # Need to create a new URL with the specified start scheme
         new_url = context.url.copy_with(scheme=self.start_scheme)
@@ -286,6 +286,27 @@ class SchemeCheck(_BaseCheck):
         return response.url.scheme == self.end_scheme
 
 
+def create_context(url: httpx.URL, client: httpx.Client, response: httpx.Response) -> SiteCheckContext:
+    """Create a SiteCheckContext context object.
+
+    Args:
+        url: The URL to check.
+        client: The HTTPX client to use for requests.
+        response: The HTTPX response object from the initial request.
+
+    Returns:
+        A SiteCheckContext object containing the provided parameters.
+    """
+    return SiteCheckContext(
+        url=url,
+        client=client,
+        headers=response.headers,
+        cookies=response.cookies.jar,
+        content=response.text,
+        response_url=response.url,
+    )
+
+
 class SiteChecker:
     """Run all the checks for a given site."""
 
@@ -328,7 +349,7 @@ class SiteChecker:
             self.client.close()
 
     # Context manager support for automatic cleanup
-    def __enter__(self) -> Self:
+    def __enter__(self) -> "SiteChecker":
         """Context manager entry."""
         return self
 
@@ -351,7 +372,7 @@ class SiteChecker:
             response = self.client.get(self.url)
             response.raise_for_status()
 
-        except httpx.RequestError:
+        except httpx.HTTPStatusError:
             return CheckResponse(
                 name=check_name,
                 result=CheckResult.FAILURE,
@@ -359,14 +380,7 @@ class SiteChecker:
                 message=error_message,
             )
 
-        self.context = SiteCheckContext(
-            url=self.url,
-            client=self.client,
-            headers=response.headers,
-            cookies=response.cookies.jar,
-            content=response.text,
-            response_url=response.url,
-        )
+        self.context = create_context(self.url, self.client, response)
 
         return CheckResponse(
             name=check_name,