hackscan 0.1.0__py3-none-any.whl

hackscan/importers/sarif.py

@@ -0,0 +1,164 @@
+"""SARIF 2.1.0 import (Semgrep, Bandit, CodeQL, or any SARIF producer)."""
+
+from __future__ import annotations
+
+import json
+from pathlib import Path
+from typing import Any
+
+from hackscan.core.models import Evidence, Finding, Severity
+from hackscan.core.taxonomy import classify, normalize_cwes
+from hackscan.importers.common import (
+    SEVERITY_FROM_LEVEL,
+    ImportResult,
+    ReportError,
+    SourceIndex,
+    make_region,
+    normalize_path,
+    severity_from_score,
+)
+
+# Tool driver names -> source label used in findings.
+KNOWN_DRIVERS = {
+    "semgrep": "semgrep",
+    "semgrep oss": "semgrep",
+    "semgrep pro": "semgrep",
+    "bandit": "bandit",
+    "codeql": "codeql",
+}
+DEFAULT_CONFIDENCE = {"semgrep": 60, "bandit": 60, "codeql": 75}
+BANDIT_CONFIDENCE = {"HIGH": 80, "MEDIUM": 60, "LOW": 40}
+BANDIT_SEVERITY = {"HIGH": Severity.HIGH, "MEDIUM": Severity.MEDIUM, "LOW": Severity.LOW}
+
+
+def load_sarif(path: Path) -> dict[str, Any]:
+    try:
+        data = json.loads(path.read_text(encoding="utf-8-sig"))
+    except (OSError, UnicodeDecodeError, json.JSONDecodeError) as exc:
+        raise ReportError(f"{path}: not a readable SARIF/JSON file: {exc}") from exc
+    if not isinstance(data, dict) or not isinstance(data.get("runs"), list):
+        raise ReportError(f"{path}: not a SARIF log (missing `runs`)")
+    return data
+
+
+def import_sarif(
+    data: dict[str, Any], root: Path, index: SourceIndex, label: str | None = None
+) -> ImportResult:
+    """Convert every result of every run. `label` forces the source label."""
+    result = ImportResult(tool=label or "sarif")
+    for run in data.get("runs", []):
+        if not isinstance(run, dict):
+            continue
+        driver = run.get("tool", {}).get("driver", {}) or {}
+        source = label or KNOWN_DRIVERS.get(str(driver.get("name", "")).lower(), "sarif")
+        result.tool = source
+        rules = _rules_by_id(driver)
+        base_uris = {
+            k: v.get("uri")
+            for k, v in (run.get("originalUriBaseIds") or {}).items()
+            if isinstance(v, dict)
+        }
+        for raw in run.get("results", []) or []:
+            try:
+                finding = _convert(raw, source, rules, base_uris, root, index, result.warnings)
+            except (AttributeError, KeyError, TypeError, ValueError) as exc:
+                result.warnings.append(f"{source}: skipped malformed result: {exc}")
+                continue
+            if finding is not None:
+                result.findings.append(finding)
+    return result
+
+
+def _rules_by_id(driver: dict[str, Any]) -> dict[str, dict[str, Any]]:
+    rules = {}
+    for rule in driver.get("rules", []) or []:
+        if isinstance(rule, dict) and rule.get("id"):
+            rules[str(rule["id"])] = rule
+    return rules
+
+
+def _convert(
+    raw: dict[str, Any],
+    source: str,
+    rules: dict[str, dict[str, Any]],
+    base_uris: dict[str, str | None],
+    root: Path,
+    index: SourceIndex,
+    warn: list[str],
+) -> Finding | None:
+    rule_key = str(raw.get("ruleId") or raw.get("rule", {}).get("id") or "unknown")
+    rule = rules.get(rule_key, {})
+    locations = raw.get("locations") or []
+    if not locations:
+        warn.append(f"{source}: result for {rule_key} has no location; skipped")
+        return None
+    physical = locations[0].get("physicalLocation", {})
+    artifact = physical.get("artifactLocation", {})
+    uri = artifact.get("uri")
+    if not uri:
+        warn.append(f"{source}: result for {rule_key} has no file; skipped")
+        return None
+    rel = normalize_path(uri, root, base_uris.get(artifact.get("uriBaseId", "")))
+    if rel is None:
+        warn.append(f"{source}: {uri} is outside the scan root; skipped")
+        return None
+    reg = physical.get("region", {}) or {}
+    region = make_region(
+        rel,
+        reg.get("startLine"),
+        reg.get("startColumn"),
+        reg.get("endLine"),
+        reg.get("endColumn"),
+    )
+
+    props = {**(rule.get("properties") or {}), **(raw.get("properties") or {})}
+    cwes = normalize_cwes([*_strings(props.get("tags")), *_strings(props.get("cwe"))])
+    rule_id = f"{source}:{rule_key}"
+    severity, confidence = _severity_confidence(raw, rule, props, source)
+    message = (raw.get("message") or {}).get("text") or rule.get("shortDescription", {}).get(
+        "text", rule_key
+    )
+    snippet = (reg.get("snippet") or {}).get("text") or index.line_text(rel, region.start_line)
+    sink, function = index.enrich(region)
+    return Finding(
+        id="",
+        vuln_class=classify(rule_id, cwes),
+        rule_id=rule_id,
+        severity=severity,
+        location=region,
+        message=str(message).strip(),
+        snippet=str(snippet).rstrip("\n"),
+        sink=sink,
+        function=function,
+        cwe=cwes,
+        sources=(source,),
+        confidence=confidence,
+        evidence=(Evidence(source, "tool_message", str(message).strip()),),
+    )
+
+
+def _severity_confidence(
+    raw: dict[str, Any], rule: dict[str, Any], props: dict[str, Any], source: str
+) -> tuple[Severity, int]:
+    confidence = DEFAULT_CONFIDENCE.get(source, 50)
+    score = props.get("security-severity")
+    if source == "bandit":
+        severity = BANDIT_SEVERITY.get(str(props.get("issue_severity", "")).upper())
+        confidence = BANDIT_CONFIDENCE.get(str(props.get("issue_confidence", "")).upper(), 60)
+        if severity is not None:
+            return severity, confidence
+    if score is not None:
+        try:
+            return severity_from_score(float(score)), confidence
+        except (TypeError, ValueError):
+            pass
+    level = raw.get("level") or (rule.get("defaultConfiguration") or {}).get("level") or "warning"
+    return SEVERITY_FROM_LEVEL.get(str(level), Severity.MEDIUM), confidence
+
+
+def _strings(value: Any) -> list[str]:
+    if isinstance(value, str):
+        return [value]
+    if isinstance(value, list):
+        return [str(v) for v in value]
+    return []

hackscan/plugins/__init__.py

@@ -0,0 +1,5 @@
+"""Rule plugin API: built-in rules and user plugins share the same interface."""
+
+from hackscan.plugins.base import FileContext, Match, RulePlugin
+
+__all__ = ["FileContext", "Match", "RulePlugin"]

hackscan/plugins/base.py

@@ -0,0 +1,261 @@
+"""Rule plugin interface and the per-file context rules query.
+
+A rule declares which AST node types it inspects and yields `Match`es for sink nodes.
+The AST pass turns matches into `Finding`s (location, sink text, enclosing function,
+vuln_class), so rules only decide *whether* a node is a candidate and how confident.
+"""
+
+from __future__ import annotations
+
+import ast
+import re
+from abc import ABC, abstractmethod
+from collections.abc import Iterable, Iterator
+from dataclasses import dataclass, field
+
+from hackscan.core.models import Severity
+from hackscan.plugins.scopes import ScopeIndex
+
+_NEWLINE_RE = re.compile(r"\r\n|\r|\n")
+
+FunctionNode = ast.FunctionDef | ast.AsyncFunctionDef | ast.Lambda
+
+SQL_KEYWORD_RE = re.compile(
+    r"^\s*(select|insert|update|delete|with|create|drop|alter|replace|merge|truncate|grant)\b"
+    r"|\b(from|where|order\s+by|group\s+by|values|into|join|set)\b",
+    re.IGNORECASE,
+)
+
+
+@dataclass(frozen=True)
+class Match:
+    node: ast.AST  # the sink (reported location)
+    message: str
+    confidence: int | None = None  # None -> rule default
+    # The value flowing into the sink (e.g. the query argument). When set and the rule's
+    # class is modeled by the taint pass, taint decides confirm/suppress/keep.
+    arg: ast.AST | None = None
+
+
+class RulePlugin(ABC):
+    rule_id: str
+    name: str
+    description: str
+    severity: Severity
+    cwe: tuple[str, ...] = ()
+    default_confidence: int = 50
+    node_types: tuple[type[ast.AST], ...] = (ast.Call,)
+
+    @abstractmethod
+    def check(self, node: ast.AST, ctx: FileContext) -> Iterable[Match]:
+        """Yield matches for `node` (one of `node_types`)."""
+
+
+@dataclass
+class FileContext:
+    """Parsed file plus the lookups rules need: scoped name resolution and source text.
+
+    Data-flow questions (is this variable constant/sanitized/tainted?) are deliberately
+    *not* answered here: rules report candidates, the taint pass (M2) decides.
+    """
+
+    path: str  # POSIX, relative to scan root
+    source: str
+    tree: ast.Module
+    lines: list[str] = field(init=False)
+    scopes: ScopeIndex = field(init=False)
+
+    def __post_init__(self) -> None:
+        self.lines = _NEWLINE_RE.split(self.source)
+        self.scopes = ScopeIndex(self.tree)
+
+    # -- names -------------------------------------------------------------------------
+
+    def resolve_all(self, expr: ast.AST) -> frozenset[str]:
+        """Every dotted name `expr` may refer to (see `plugins.scopes`); empty if unknown."""
+        if isinstance(expr, ast.Name):
+            return self.scopes.resolve_name(expr.id, expr)
+        if isinstance(expr, ast.Attribute):
+            return frozenset(f"{base}.{expr.attr}" for base in self.resolve_all(expr.value))
+        return frozenset()
+
+    def call_names(self, call: ast.Call) -> frozenset[str]:
+        return self.resolve_all(call.func)
+
+    def resolve(self, expr: ast.AST) -> str | None:
+        """Dotted name of `expr`, resolved in the scope where `expr` appears.
+
+        `sp.run` after `import subprocess as sp` -> `subprocess.run`;
+        `system` after `from os import system` -> `os.system`; builtins stay bare.
+        Local values (parameters, assignments) resolve to None: `os.system` where `os`
+        is a parameter is not the `os` module. When several names are possible (star
+        imports, import fallbacks) this returns one deterministically; rules matching sinks
+        should use `call_names` / `resolve_all`.
+        """
+        names = self.resolve_all(expr)
+        return min(names) if names else None
+
+    def call_name(self, call: ast.Call) -> str | None:
+        return self.resolve(call.func)
+
+    # -- scopes ------------------------------------------------------------------------
+
+    def enclosing_function(self, node: ast.AST) -> FunctionNode | None:
+        return self.scopes.enclosing_function(node)  # type: ignore[return-value]
+
+    def assignments_before(self, name: str, node: ast.AST) -> list[ast.expr]:
+        """Values assigned to local `name` textually before `node` in the same scope.
+
+        Flow-insensitive: use only to *find* candidate values (e.g. a literal algorithm
+        name), never to dismiss a finding.
+        """
+        scope = self.enclosing_function(node) or self.tree
+        line = getattr(node, "lineno", 0)
+        values: list[ast.expr] = []
+        for stmt in _walk_same_scope(scope):
+            if getattr(stmt, "lineno", line) >= line:
+                continue
+            if isinstance(stmt, ast.Assign):
+                if any(_binds(t, name) for t in stmt.targets):
+                    values.append(stmt.value)
+            elif (
+                isinstance(stmt, (ast.AugAssign, ast.AnnAssign))
+                and _binds(stmt.target, name)
+                and stmt.value is not None
+            ):
+                values.append(stmt.value)
+        return values
+
+    def binding_values(self, name: str, node: ast.AST) -> list[ast.expr]:
+        """Values assigned to `name` in the scope it is bound in, as seen from `node`:
+        local assignments before `node`, else all module-level assignments (module code
+        runs before the function is called). Flow-insensitive: for *finding* candidates.
+        """
+        local = self.assignments_before(name, node)
+        if local or self.enclosing_function(node) is None:
+            return local
+        values: list[ast.expr] = []
+        for stmt in _walk_same_scope(self.tree):
+            if isinstance(stmt, ast.Assign) and any(_binds(t, name) for t in stmt.targets):
+                values.append(stmt.value)
+        return values
+
+    # -- source text -------------------------------------------------------------------
+
+    def segment(self, node: ast.AST) -> str:
+        return ast.get_source_segment(self.source, node) or ""
+
+    def char_column(self, line: int, byte_offset: int) -> int:
+        """Convert an AST UTF-8 byte offset to a 1-based character column."""
+        text = self.lines[line - 1] if 0 < line <= len(self.lines) else ""
+        prefix = text.encode("utf-8")[:byte_offset].decode("utf-8", errors="replace")
+        return len(prefix) + 1
+
+
+# -- expression classification helpers (shared by rules) ----------------------------------
+
+
+def is_constant(expr: ast.AST) -> bool:
+    """True for expressions whose value is fixed at write time."""
+    if isinstance(expr, ast.Constant):
+        return True
+    if isinstance(expr, ast.JoinedStr):
+        return all(isinstance(v, ast.Constant) for v in expr.values)
+    if isinstance(expr, (ast.Tuple, ast.List, ast.Set)):
+        return all(is_constant(e) for e in expr.elts)
+    if isinstance(expr, ast.BinOp):
+        return is_constant(expr.left) and is_constant(expr.right)
+    return False
+
+
+def _is_str_literal(expr: ast.AST) -> bool:
+    return isinstance(expr, ast.JoinedStr) or (
+        isinstance(expr, ast.Constant) and isinstance(expr.value, str)
+    )
+
+
+def _flatten_add(expr: ast.AST) -> Iterator[ast.AST]:
+    if isinstance(expr, ast.BinOp) and isinstance(expr.op, ast.Add):
+        yield from _flatten_add(expr.left)
+        yield from _flatten_add(expr.right)
+    else:
+        yield expr
+
+
+def is_dynamic_string(expr: ast.AST) -> bool:
+    """String built from non-constant parts: f-string, `%`, `+`, `.format()`, `.join()`."""
+    if isinstance(expr, ast.JoinedStr):
+        return not is_constant(expr)
+    if isinstance(expr, ast.BinOp) and isinstance(expr.op, ast.Mod):
+        return _is_str_literal(expr.left) and not is_constant(expr.right)
+    if isinstance(expr, ast.BinOp) and isinstance(expr.op, ast.Add):
+        parts = list(_flatten_add(expr))
+        has_str = any(_is_str_literal(p) or is_dynamic_string(p) for p in parts)
+        return has_str and not all(is_constant(p) for p in parts)
+    if (
+        isinstance(expr, ast.Call)
+        and isinstance(expr.func, ast.Attribute)
+        and expr.func.attr in {"format", "join", "format_map"}
+        and _is_str_literal(expr.func.value)
+    ):
+        args = [*expr.args, *(k.value for k in expr.keywords)]
+        return any(not is_constant(a) for a in args)
+    return False
+
+
+def is_string_formatting(expr: ast.AST) -> bool:
+    """Looser than `is_dynamic_string`: also `%`/`.format()` applied to a template
+    variable (`template % user`, `template.format(user)`). Only meaningful at sinks
+    that expect a string, since `a % b` is also integer modulo."""
+    if is_dynamic_string(expr):
+        return True
+    if isinstance(expr, ast.BinOp) and isinstance(expr.op, ast.Mod):
+        return not is_constant(expr.right)
+    if (
+        isinstance(expr, ast.Call)
+        and isinstance(expr.func, ast.Attribute)
+        and expr.func.attr in {"format", "format_map"}
+    ):
+        return any(not is_constant(a) for a in [*expr.args, *(k.value for k in expr.keywords)])
+    return False
+
+
+def has_sql_text(expr: ast.AST) -> bool:
+    """Any string literal inside `expr` that looks like SQL."""
+    return any(
+        isinstance(node, ast.Constant)
+        and isinstance(node.value, str)
+        and SQL_KEYWORD_RE.search(node.value)
+        for node in ast.walk(expr)
+    )
+
+
+def keyword(call: ast.Call, name: str) -> ast.expr | None:
+    return next((k.value for k in call.keywords if k.arg == name), None)
+
+
+def first_arg(call: ast.Call, kw: str | None = None) -> ast.expr | None:
+    if call.args and not isinstance(call.args[0], ast.Starred):
+        return call.args[0]
+    return keyword(call, kw) if kw else None
+
+
+# -- internals ----------------------------------------------------------------------------
+
+
+def _walk_same_scope(scope: ast.AST) -> Iterator[ast.AST]:
+    """Walk `scope` without descending into nested functions or classes."""
+    stack = list(ast.iter_child_nodes(scope))
+    while stack:
+        node = stack.pop()
+        yield node
+        if not isinstance(node, (ast.FunctionDef, ast.AsyncFunctionDef, ast.Lambda, ast.ClassDef)):
+            stack.extend(ast.iter_child_nodes(node))
+
+
+def _binds(target: ast.AST, name: str) -> bool:
+    if isinstance(target, ast.Name):
+        return target.id == name
+    if isinstance(target, (ast.Tuple, ast.List)):
+        return any(_binds(t, name) for t in target.elts)
+    return False

hackscan/plugins/loader.py

@@ -0,0 +1,98 @@
+"""Built-in rule registry and user plugin discovery.
+
+User plugins are `.py` files in a directory passed via `--plugins`; every concrete
+`RulePlugin` subclass they define is instantiated. Loading a plugin executes its code, so
+it is strictly opt-in.
+"""
+
+from __future__ import annotations
+
+import ast
+import importlib.util
+import inspect
+import sys
+from pathlib import Path
+
+from hackscan.core.models import Severity
+from hackscan.plugins.base import RulePlugin
+from hackscan.plugins.rules.cmdi import CommandInjection
+from hackscan.plugins.rules.codei import CodeInjection
+from hackscan.plugins.rules.sqli import SqlInjection
+from hackscan.plugins.rules.weak_crypto import WeakHash
+
+BUILTIN_RULES: tuple[type[RulePlugin], ...] = (
+    SqlInjection,
+    CommandInjection,
+    CodeInjection,
+    WeakHash,
+)
+
+
+class PluginError(Exception):
+    pass
+
+
+def builtin_plugins() -> list[RulePlugin]:
+    return [cls() for cls in BUILTIN_RULES]
+
+
+def load_plugins(directory: Path) -> list[RulePlugin]:
+    """Instantiate every concrete RulePlugin defined in `directory/*.py` (sorted by file)."""
+    if not directory.is_dir():
+        raise PluginError(f"plugin directory not found: {directory}")
+    plugins: list[RulePlugin] = []
+    for path in sorted(directory.glob("*.py")):
+        module_name = f"hackscan_user_plugin_{path.stem}"
+        spec = importlib.util.spec_from_file_location(module_name, path)
+        if spec is None or spec.loader is None:
+            raise PluginError(f"cannot load plugin file: {path}")
+        module = importlib.util.module_from_spec(spec)
+        sys.modules[module_name] = module
+        try:
+            spec.loader.exec_module(module)
+        except Exception as exc:  # surface any import-time failure with the file name
+            raise PluginError(f"error loading plugin {path.name}: {exc}") from exc
+        for _, obj in inspect.getmembers(module, inspect.isclass):
+            if (
+                issubclass(obj, RulePlugin)
+                and obj is not RulePlugin
+                and obj.__module__ == module_name
+                and not inspect.isabstract(obj)
+            ):
+                plugins.append(_validated(obj(), path))
+    return plugins
+
+
+def _validated(plugin: RulePlugin, path: Path) -> RulePlugin:
+    cls = type(plugin).__name__
+    for attr in ("rule_id", "name", "description"):
+        value = getattr(plugin, attr, None)
+        if not isinstance(value, str) or not value.strip():
+            raise PluginError(f"{path.name}: {cls}.{attr} must be a non-empty string")
+    if not isinstance(getattr(plugin, "severity", None), Severity):
+        raise PluginError(f"{path.name}: {cls}.severity must be a hackscan Severity")
+    node_types = getattr(plugin, "node_types", None)
+    if (
+        not isinstance(node_types, tuple)
+        or not node_types
+        or not all(isinstance(t, type) and issubclass(t, ast.AST) for t in node_types)
+    ):
+        raise PluginError(f"{path.name}: {cls}.node_types must be a tuple of ast node classes")
+    if not isinstance(plugin.cwe, tuple) or not all(isinstance(c, str) for c in plugin.cwe):
+        raise PluginError(f"{path.name}: {cls}.cwe must be a tuple of strings")
+    if not isinstance(plugin.default_confidence, int) or not 0 <= plugin.default_confidence <= 100:
+        raise PluginError(f"{path.name}: {cls}.default_confidence must be an int 0-100")
+    if plugin.rule_id.startswith("HS-"):
+        raise PluginError(f"{path.name}: rule id prefix `HS-` is reserved for built-in rules")
+    return plugin
+
+
+def resolve_plugins(extra_dir: Path | None = None) -> list[RulePlugin]:
+    plugins = builtin_plugins()
+    if extra_dir is not None:
+        plugins.extend(load_plugins(extra_dir))
+    ids = [p.rule_id for p in plugins]
+    duplicates = sorted({i for i in ids if ids.count(i) > 1})
+    if duplicates:
+        raise PluginError(f"duplicate rule ids: {', '.join(duplicates)}")
+    return plugins

hackscan/plugins/rules/__init__.py

@@ -0,0 +1 @@
+"""Built-in detection rules."""

hackscan/plugins/rules/cmdi.py

@@ -0,0 +1,80 @@
+"""Command injection: non-constant commands run through a shell.
+
+Any non-constant command at a shell sink is a candidate; the taint pass decides whether
+it is attacker-controlled, constant or sanitized.
+"""
+
+from __future__ import annotations
+
+import ast
+from collections.abc import Iterable
+
+from hackscan.core.models import Severity
+from hackscan.plugins.base import (
+    FileContext,
+    Match,
+    RulePlugin,
+    first_arg,
+    is_constant,
+    is_dynamic_string,
+    keyword,
+)
+
+# Always interpreted by a shell.
+SHELL_FUNCTIONS = frozenset(
+    {
+        "os.system",
+        "os.popen",
+        "subprocess.getoutput",
+        "subprocess.getstatusoutput",
+        "commands.getoutput",
+        "commands.getstatusoutput",
+        "asyncio.create_subprocess_shell",
+    }
+)
+# Shell only when called with shell=True (or a non-constant shell flag).
+SUBPROCESS_FUNCTIONS = frozenset(
+    {
+        "subprocess.call",
+        "subprocess.run",
+        "subprocess.Popen",
+        "subprocess.check_call",
+        "subprocess.check_output",
+    }
+)
+
+
+class CommandInjection(RulePlugin):
+    rule_id = "HS-CMDI-001"
+    name = "command-injection"
+    description = "A non-constant command string is executed through a system shell."
+    severity = Severity.HIGH
+    cwe = ("CWE-78",)
+    default_confidence = 70
+
+    def check(self, node: ast.AST, ctx: FileContext) -> Iterable[Match]:
+        assert isinstance(node, ast.Call)
+        names = ctx.call_names(node)
+        if shell := sorted(names & SHELL_FUNCTIONS):
+            via = shell[0]
+        elif (proc := sorted(names & SUBPROCESS_FUNCTIONS)) and _shell_enabled(node):
+            via = f"{proc[0]}(shell=True)"
+        else:
+            return
+        command = first_arg(node, "args") or first_arg(node, "cmd")
+        if command is None or is_constant(command):
+            return
+        if is_dynamic_string(command):
+            message = f"Command built from non-constant parts is executed via {via}."
+            yield Match(node, message, arg=command)
+        else:
+            label = ctx.segment(command)
+            message = f"Non-constant command `{label}` is executed via {via}."
+            yield Match(node, message, confidence=50, arg=command)
+
+
+def _shell_enabled(call: ast.Call) -> bool:
+    shell = keyword(call, "shell")
+    if shell is None:
+        return False
+    return not (isinstance(shell, ast.Constant) and not shell.value)

hackscan/plugins/rules/codei.py

@@ -0,0 +1,50 @@
+"""Code injection: non-constant input to eval/exec/compile.
+
+Any non-constant argument is a candidate; the taint pass decides.
+"""
+
+from __future__ import annotations
+
+import ast
+from collections.abc import Iterable
+
+from hackscan.core.models import Severity
+from hackscan.plugins.base import (
+    FileContext,
+    Match,
+    RulePlugin,
+    first_arg,
+    is_constant,
+    is_dynamic_string,
+)
+
+CODE_FUNCTIONS = frozenset(
+    {"eval", "exec", "compile", "builtins.eval", "builtins.exec", "builtins.compile"}
+)
+
+
+class CodeInjection(RulePlugin):
+    rule_id = "HS-CODEI-001"
+    name = "code-injection"
+    description = "Non-constant input is evaluated as Python code."
+    severity = Severity.HIGH
+    cwe = ("CWE-95",)
+    default_confidence = 70
+
+    def check(self, node: ast.AST, ctx: FileContext) -> Iterable[Match]:
+        assert isinstance(node, ast.Call)
+        matched = sorted(ctx.call_names(node) & CODE_FUNCTIONS)
+        if not matched:
+            return
+        name = matched[0]
+        code = first_arg(node, "source")
+        if code is None or is_constant(code):
+            return
+        func = name.rsplit(".", 1)[-1]
+        if is_dynamic_string(code):
+            message = f"String built from non-constant parts is passed to {func}()."
+            yield Match(node, message, arg=code)
+        else:
+            label = ctx.segment(code)
+            message = f"Non-constant `{label}` is passed to {func}()."
+            yield Match(node, message, confidence=55, arg=code)