hackscan 0.1.0__py3-none-any.whl

hackscan/plugins/rules/sqli.py

@@ -0,0 +1,127 @@
+"""SQL injection: non-constant SQL reaching a DB execution sink.
+
+Candidates:
+- string formatting/concatenation at the sink, when the receiver looks like a DB object
+  or the literal parts look like SQL (confidence 70);
+- any other non-constant query (variable, call result, attribute) passed to a DB-looking
+  receiver (confidence 40). The taint pass confirms or suppresses these.
+"""
+
+from __future__ import annotations
+
+import ast
+import re
+from collections.abc import Iterable
+
+from hackscan.core.models import Severity
+from hackscan.plugins.base import (
+    FileContext,
+    Match,
+    RulePlugin,
+    first_arg,
+    has_sql_text,
+    is_constant,
+    is_string_formatting,
+)
+
+# Method names that execute raw SQL on DB-API cursors/connections, Django and pandas.
+SQL_METHODS = frozenset(
+    {"execute", "executemany", "executescript", "raw", "read_sql", "read_sql_query"}
+)
+# Fully-qualified functions that take raw SQL text.
+SQL_FUNCTIONS = frozenset(
+    {"sqlalchemy.text", "sqlalchemy.sql.text", "pandas.read_sql", "pandas.read_sql_query"}
+)
+DB_MODULES = (
+    "sqlite3",
+    "psycopg2",
+    "psycopg",
+    "pymysql",
+    "MySQLdb",
+    "mysql.connector",
+    "cx_Oracle",
+    "oracledb",
+    "sqlalchemy",
+    "django.db",
+    "asyncpg",
+    "aiosqlite",
+)
+_DB_NAME_RE = re.compile(
+    r"(^|_)(cur|curs|cursor|conn|connection|db|database|session|engine|objects|tx|transaction)s?$",
+    re.IGNORECASE,
+)
+
+
+class SqlInjection(RulePlugin):
+    rule_id = "HS-SQLI-001"
+    name = "sql-injection"
+    description = "Non-constant SQL is passed to a database execution call."
+    severity = Severity.HIGH
+    cwe = ("CWE-89",)
+    default_confidence = 70
+
+    def check(self, node: ast.AST, ctx: FileContext) -> Iterable[Match]:
+        assert isinstance(node, ast.Call)
+        strong = bool(ctx.call_names(node) & SQL_FUNCTIONS)
+        method = isinstance(node.func, ast.Attribute) and node.func.attr in SQL_METHODS
+        if not (strong or method):
+            return
+        query = first_arg(node, "sql") or first_arg(node, "query")
+        if query is None or is_constant(query):
+            return
+        if isinstance(query, ast.Call) and ctx.call_names(query) & SQL_FUNCTIONS:
+            return  # e.g. session.execute(text(...)): reported at the inner text() call
+        db_receiver = strong or _is_db_receiver(node.func, ctx)
+
+        if is_string_formatting(query):
+            if db_receiver or has_sql_text(query):
+                yield Match(
+                    node, "SQL query is built with string formatting/concatenation.", arg=query
+                )
+            return
+        if db_receiver:
+            yield Match(
+                node,
+                f"Non-constant query `{_short(ctx.segment(query))}` reaches a SQL sink.",
+                confidence=40,
+                arg=query,
+            )
+
+
+def _is_db_receiver(func: ast.expr, ctx: FileContext) -> bool:
+    if not isinstance(func, ast.Attribute):
+        return False
+    receiver = func.value
+    if _chain_has_db_call(receiver, ctx):
+        return True
+    # handle = sqlite3.connect(...); handle.execute(...)
+    if isinstance(receiver, ast.Name) and any(
+        _chain_has_db_call(value, ctx) for value in ctx.binding_values(receiver.id, func)
+    ):
+        return True
+    last = receiver
+    if isinstance(last, ast.Call):
+        last = last.func
+    ident = last.attr if isinstance(last, ast.Attribute) else getattr(last, "id", "")
+    return bool(_DB_NAME_RE.search(ident))
+
+
+def _chain_has_db_call(expr: ast.AST, ctx: FileContext) -> bool:
+    """sqlite3.connect(...).execute(...), psycopg.connect(...).cursor().execute(...)"""
+    while isinstance(expr, (ast.Call, ast.Attribute)):
+        if isinstance(expr, ast.Call):
+            if any(_in_db_module(n) for n in ctx.call_names(expr)):
+                return True
+            expr = expr.func
+        else:
+            expr = expr.value
+    return False
+
+
+def _in_db_module(name: str) -> bool:
+    return any(name == m or name.startswith(m + ".") for m in DB_MODULES)
+
+
+def _short(text: str, limit: int = 40) -> str:
+    text = " ".join(text.split())
+    return text if len(text) <= limit else text[: limit - 1] + "…"

hackscan/plugins/rules/weak_crypto.py

@@ -0,0 +1,53 @@
+"""Weak cryptography: MD5/SHA-1 hashing, unless explicitly marked non-security."""
+
+from __future__ import annotations
+
+import ast
+from collections.abc import Iterable
+
+from hackscan.core.models import Severity
+from hackscan.plugins.base import FileContext, Match, RulePlugin, first_arg, keyword
+
+WEAK_ALGORITHMS = frozenset({"md5", "sha1", "md4", "md2"})
+WEAK_CONSTRUCTORS = {f"hashlib.{alg}": alg for alg in WEAK_ALGORITHMS}
+
+
+class WeakHash(RulePlugin):
+    rule_id = "HS-CRYPTO-001"
+    name = "weak-hash"
+    description = "A cryptographically broken hash (MD5/SHA-1) is used."
+    severity = Severity.LOW
+    cwe = ("CWE-328",)
+    default_confidence = 80
+
+    def check(self, node: ast.AST, ctx: FileContext) -> Iterable[Match]:
+        assert isinstance(node, ast.Call)
+        names = ctx.call_names(node)
+        confidence = None
+        if constructors := sorted(names & WEAK_CONSTRUCTORS.keys()):
+            algorithm = WEAK_CONSTRUCTORS[constructors[0]]
+        elif "hashlib.new" in names:
+            arg = first_arg(node, "name")
+            literals = [arg]
+            if isinstance(arg, ast.Name):
+                # Find a literal algorithm name bound locally (never used to dismiss).
+                literals = ctx.assignments_before(arg.id, node)
+                confidence = 60
+            weak = sorted({_normalize(v.value) for v in literals if _is_str(v)} & WEAK_ALGORITHMS)
+            if not weak:
+                return
+            algorithm = weak[0]
+        else:
+            return
+        flag = keyword(node, "usedforsecurity")
+        if isinstance(flag, ast.Constant) and flag.value is False:
+            return
+        yield Match(node, f"Weak hash algorithm {algorithm.upper()} is used.", confidence)
+
+
+def _is_str(node: ast.AST | None) -> bool:
+    return isinstance(node, ast.Constant) and isinstance(node.value, str)
+
+
+def _normalize(name: str) -> str:
+    return name.lower().replace("-", "").replace("_", "")

hackscan/plugins/scopes.py

@@ -0,0 +1,263 @@
+"""Lexical scopes and name bindings, following Python's scoping rules closely enough
+for sink resolution (and, from M2, taint tracking).
+
+- Function bodies (def/async def/lambda) and comprehensions are scopes. Decorators,
+  default values, annotations and a comprehension's first iterable are evaluated in the
+  *enclosing* scope.
+- Class bodies are scopes visible only to code directly in the class body (not to
+  methods or comprehensions inside the class).
+- `global` redirects a name to the module scope; `nonlocal` to the enclosing function.
+  An assignment expression (`:=`) inside a comprehension binds in the enclosing scope.
+- Bindings are flow-insensitive *may* sets: a scope records every way it binds a name.
+  Resolution is recall-oriented: if the binding scope imports the name anywhere
+  (`import os` ... `os = fallback`, try/except or conditional imports), the name may be
+  that module and resolves to it. Only names bound exclusively by non-import bindings
+  (parameters, assignments, loop targets) resolve to "local value" (empty set).
+- Unbound names resolve to themselves (builtins) and, if a `from m import *` is in scope,
+  also to `m.<name>`.
+"""
+
+from __future__ import annotations
+
+import ast
+from collections.abc import Iterator
+from dataclasses import dataclass, field
+
+FUNCTION_TYPES = (ast.FunctionDef, ast.AsyncFunctionDef, ast.Lambda)
+COMPREHENSION_TYPES = (ast.ListComp, ast.SetComp, ast.DictComp, ast.GeneratorExp)
+_NESTED_SCOPES = (*FUNCTION_TYPES, ast.ClassDef, *COMPREHENSION_TYPES)
+
+IMPORT = "import"
+LOCAL = "local"
+
+
+@dataclass(eq=False)
+class Scope:
+    node: ast.AST
+    parent: Scope | None
+    # name -> set of (kind, import target or None)
+    bindings: dict[str, set[tuple[str, str | None]]] = field(default_factory=dict)
+    globals_: set[str] = field(default_factory=set)
+    nonlocals: set[str] = field(default_factory=set)
+    star_imports: list[str] = field(default_factory=list)
+
+    @property
+    def is_function(self) -> bool:
+        return isinstance(self.node, FUNCTION_TYPES)
+
+    @property
+    def is_comprehension(self) -> bool:
+        return isinstance(self.node, COMPREHENSION_TYPES)
+
+    def bind(self, name: str, kind: str, target: str | None = None) -> None:
+        self.bindings.setdefault(name, set()).add((kind, target))
+
+
+class ScopeIndex:
+    def __init__(self, tree: ast.Module) -> None:
+        self.module = Scope(tree, None)
+        self._scope_of: dict[int, Scope] = {}
+        self._walrus_targets: set[int] = set()
+        self._pending_nonlocal: list[tuple[Scope, str, str, str | None]] = []
+        self._visit_body(self.module, tree.body)
+        # Enclosing bindings may appear after the nested def, so resolve owners last.
+        for scope, name, kind, target in self._pending_nonlocal:
+            self._nonlocal_owner(scope, name).bind(name, kind, target)
+
+    # -- queries -------------------------------------------------------------------------
+
+    def scope_of(self, node: ast.AST) -> Scope:
+        """Scope in which `node` executes."""
+        return self._scope_of.get(id(node), self.module)
+
+    def enclosing_function(self, node: ast.AST) -> ast.AST | None:
+        scope: Scope | None = self.scope_of(node)
+        while scope is not None and not scope.is_function:
+            scope = scope.parent
+        return scope.node if scope is not None else None
+
+    def resolve_name(self, name: str, node: ast.AST) -> frozenset[str]:
+        """All dotted paths `name` may refer to at `node`; empty for local values."""
+        star: list[str] = []
+        scope: Scope | None = self.scope_of(node)
+        first = True
+        while scope is not None:
+            star.extend(scope.star_imports)
+            if isinstance(scope.node, ast.ClassDef) and not first:
+                scope = scope.parent  # class scope invisible to nested scopes
+                continue
+            first = False
+            if name in scope.globals_ and scope is not self.module:
+                star.extend(self.module.star_imports)
+                return self._resolve_in(self.module, name, star)
+            if name in scope.nonlocals:
+                scope = scope.parent
+                while scope is not None and not scope.is_function:
+                    scope = scope.parent
+                continue
+            if name in scope.bindings:
+                return self._resolve_in(scope, name, star)
+            scope = scope.parent
+        return frozenset({name, *(f"{m}.{name}" for m in star)})
+
+    def _resolve_in(self, scope: Scope, name: str, star: list[str]) -> frozenset[str]:
+        kinds = scope.bindings.get(name)
+        if not kinds:
+            return frozenset({name, *(f"{m}.{name}" for m in star)})
+        imports = {t for k, t in kinds if k == IMPORT and t}
+        # A local binding may be conditional, so a star import can still supply the name.
+        return frozenset(imports | {f"{m}.{name}" for m in star})
+
+    # -- construction ----------------------------------------------------------------------
+
+    def _visit_body(self, scope: Scope, body: list[ast.AST]) -> None:
+        for stmt in body:
+            for node in _same_scope_nodes(stmt):
+                if isinstance(node, ast.Global):
+                    scope.globals_.update(node.names)
+                elif isinstance(node, ast.Nonlocal):
+                    scope.nonlocals.update(node.names)
+        for stmt in body:
+            self._visit(stmt, scope)
+
+    def _visit(self, node: ast.AST, scope: Scope) -> None:
+        self._scope_of[id(node)] = scope
+        if isinstance(node, COMPREHENSION_TYPES):
+            self._enter_comprehension(node, scope)
+            return
+        if isinstance(node, _NESTED_SCOPES):
+            self._enter_nested(node, scope)
+            return
+        self._bind(node, scope)
+        for child in ast.iter_child_nodes(node):
+            self._visit(child, scope)
+
+    def _enter_nested(self, node: ast.AST, scope: Scope) -> None:
+        outer: list[ast.AST] = list(getattr(node, "decorator_list", []))
+        if isinstance(node, FUNCTION_TYPES):
+            outer += list(node.args.defaults)
+            outer += [d for d in node.args.kw_defaults if d is not None]
+            if not isinstance(node, ast.Lambda):
+                outer += _annotations(node)
+        if isinstance(node, ast.ClassDef):
+            outer += [*node.bases, *(k.value for k in node.keywords)]
+        for part in outer:
+            self._visit(part, scope)
+        if not isinstance(node, ast.Lambda):
+            self._bind_store(scope, node.name)  # type: ignore[attr-defined]
+
+        inner = Scope(node, scope)
+        if isinstance(node, FUNCTION_TYPES):
+            for arg in _all_args(node.args):
+                inner.bind(arg, LOCAL)
+            body = [node.body] if isinstance(node, ast.Lambda) else node.body
+        else:
+            body = node.body  # type: ignore[attr-defined]
+        self._visit_body(inner, body)
+
+    def _enter_comprehension(self, node: ast.AST, scope: Scope) -> None:
+        generators: list[ast.comprehension] = node.generators  # type: ignore[attr-defined]
+        self._visit(generators[0].iter, scope)  # first iterable: enclosing scope
+        inner = Scope(node, scope)
+        for gen in generators:
+            for target in ast.walk(gen.target):
+                if isinstance(target, ast.Name):
+                    inner.bind(target.id, LOCAL)
+        rest: list[ast.AST] = []
+        for i, gen in enumerate(generators):
+            rest.append(gen.target)
+            if i:
+                rest.append(gen.iter)
+            rest.extend(gen.ifs)
+        if isinstance(node, ast.DictComp):
+            rest += [node.key, node.value]
+        else:
+            rest.append(node.elt)  # type: ignore[attr-defined]
+        for part in rest:
+            self._visit(part, inner)
+
+    def _bind(self, node: ast.AST, scope: Scope) -> None:
+        if isinstance(node, ast.Import):
+            for a in node.names:
+                if a.asname:
+                    self._bind_import(scope, a.asname, a.name)
+                else:
+                    top = a.name.split(".")[0]
+                    self._bind_import(scope, top, top)
+        elif isinstance(node, ast.ImportFrom):
+            if node.module and node.level == 0:
+                for a in node.names:
+                    if a.name == "*":
+                        scope.star_imports.append(node.module)
+                    else:
+                        self._bind_import(scope, a.asname or a.name, f"{node.module}.{a.name}")
+            else:  # relative import: project-local module, unknown to us
+                for a in node.names:
+                    if a.name != "*":
+                        self._bind_store(scope, a.asname or a.name)
+        elif isinstance(node, ast.NamedExpr):
+            target_scope = scope
+            while target_scope.is_comprehension and target_scope.parent is not None:
+                target_scope = target_scope.parent
+            self._bind_store(target_scope, node.target.id)
+            self._walrus_targets.add(id(node.target))
+        elif isinstance(node, ast.Name) and isinstance(node.ctx, (ast.Store, ast.Del)):
+            if id(node) not in self._walrus_targets:
+                self._bind_store(scope, node.id)
+        elif isinstance(node, ast.ExceptHandler) and node.name:
+            self._bind_store(scope, node.name)
+
+    def _owner(self, scope: Scope, name: str) -> Scope:
+        """Scope that actually receives a binding of `name` made in `scope`."""
+        if name in scope.globals_:
+            return self.module
+        return scope
+
+    def _nonlocal_owner(self, scope: Scope, name: str) -> Scope:
+        parent = scope.parent
+        fallback = None
+        while parent is not None:
+            if parent.is_function:
+                if name in parent.bindings and name not in parent.nonlocals:
+                    return parent
+                fallback = fallback or parent
+            parent = parent.parent
+        return fallback or scope
+
+    def _bind_store(self, scope: Scope, name: str) -> None:
+        self._add(scope, name, LOCAL, None)
+
+    def _bind_import(self, scope: Scope, name: str, target: str) -> None:
+        self._add(scope, name, IMPORT, target)
+
+    def _add(self, scope: Scope, name: str, kind: str, target: str | None) -> None:
+        if name in scope.nonlocals and name not in scope.globals_:
+            self._pending_nonlocal.append((scope, name, kind, target))
+        else:
+            self._owner(scope, name).bind(name, kind, target)
+
+
+def _same_scope_nodes(node: ast.AST) -> Iterator[ast.AST]:
+    """`node` and its descendants, not descending into nested scopes (even if `node` is one)."""
+    stack = [node]
+    while stack:
+        current = stack.pop()
+        yield current
+        if isinstance(current, _NESTED_SCOPES):
+            continue
+        stack.extend(ast.iter_child_nodes(current))
+
+
+def _all_args(args: ast.arguments) -> list[str]:
+    names = [a.arg for a in (*args.posonlyargs, *args.args, *args.kwonlyargs)]
+    names += [a.arg for a in (args.vararg, args.kwarg) if a is not None]
+    return names
+
+
+def _annotations(func: ast.FunctionDef | ast.AsyncFunctionDef) -> list[ast.AST]:
+    args = func.args
+    every = (*args.posonlyargs, *args.args, *args.kwonlyargs, args.vararg, args.kwarg)
+    anns: list[ast.AST] = [a.annotation for a in every if a is not None and a.annotation]
+    if func.returns is not None:
+        anns.append(func.returns)
+    return anns

hackscan/sarif/__init__.py

@@ -0,0 +1 @@
+"""SARIF 2.1.0 export."""

hackscan/sarif/generator.py

@@ -0,0 +1,205 @@
+"""SARIF 2.1.0 export (validated against the OASIS schema in tests).
+
+- One run, tool driver `HackScan` with a `reportingDescriptor` per rule that occurs.
+- Every finding is emitted, including suppressed ones (with `suppressions[]`), so code
+  scanning platforms can show them as dismissed rather than losing them.
+- `partialFingerprints["hackscan/v1"]` carries the stable finding id. (GitHub code
+  scanning only reads `primaryLocationLineHash`, which `upload-sarif` computes itself.)
+- Artifact URIs are relative to the repository root when the scan root is inside a git
+  work tree (GitHub resolves them that way), otherwise to the scan root; URI-escaped.
+- GitHub does not document support for `suppressions`, so a suppressed result would
+  still become an alert there: pass `omit_suppressed=True` (`--sarif-omit-suppressed`)
+  for uploads, keep them (default) for audit trails.
+- Columns are Unicode code points (`columnKind`), matching the engine's char columns.
+"""
+
+from __future__ import annotations
+
+from collections.abc import Iterable
+from pathlib import Path
+from typing import Any
+from urllib.parse import quote
+
+from hackscan import __version__
+from hackscan.core.models import Finding, Severity, Status
+from hackscan.core.pipeline import ScanResult
+from hackscan.plugins.base import RulePlugin
+
+SCHEMA_URI = "https://json.schemastore.org/sarif-2.1.0.json"
+INFORMATION_URI = "https://pypi.org/project/hackscan/"
+FINGERPRINT_KEY = "hackscan/v1"
+SRCROOT = "%SRCROOT%"
+
+LEVEL = {
+    Severity.CRITICAL: "error",
+    Severity.HIGH: "error",
+    Severity.MEDIUM: "warning",
+    Severity.LOW: "note",
+}
+# GitHub code scanning reads `security-severity` (CVSS-like) to bucket alerts.
+SECURITY_SEVERITY = {
+    Severity.CRITICAL: "9.5",
+    Severity.HIGH: "8.0",
+    Severity.MEDIUM: "5.5",
+    Severity.LOW: "3.0",
+}
+
+
+def export_sarif(
+    result: ScanResult, plugins: Iterable[RulePlugin] = (), *, omit_suppressed: bool = False
+) -> dict[str, Any]:
+    by_id = {p.rule_id: p for p in plugins}
+    findings = sorted(result.findings, key=Finding.sort_key)
+    if omit_suppressed:
+        findings = [f for f in findings if f.status is not Status.SUPPRESSED]
+    base = repository_root(result.root) or result.root.resolve()
+    prefix = result.root.resolve().relative_to(base).as_posix()
+    prefix = "" if prefix == "." else prefix + "/"
+    rule_ids = sorted({f.rule_id for f in findings})
+    rule_index = {rule_id: i for i, rule_id in enumerate(rule_ids)}
+    rules = [_rule(rule_id, by_id.get(rule_id), findings) for rule_id in rule_ids]
+    notifications = [{"level": "error", "message": {"text": e}} for e in result.errors] + [
+        {"level": "warning", "message": {"text": w}} for w in result.warnings
+    ]
+    return {
+        "$schema": SCHEMA_URI,
+        "version": "2.1.0",
+        "runs": [
+            {
+                "tool": {
+                    "driver": {
+                        "name": "HackScan",
+                        "version": __version__,
+                        "semanticVersion": __version__,
+                        "informationUri": INFORMATION_URI,
+                        "rules": rules,
+                    }
+                },
+                "originalUriBaseIds": {SRCROOT: {"uri": base.as_uri() + "/"}},
+                "columnKind": "unicodeCodePoints",
+                "invocations": [
+                    {
+                        # False when files or requested reports could not be analyzed:
+                        # results are incomplete (errors are listed as notifications).
+                        "executionSuccessful": not result.errors,
+                        "toolExecutionNotifications": notifications,
+                    }
+                ],
+                "results": [_result(f, rule_index[f.rule_id], prefix) for f in findings],
+            }
+        ],
+    }
+
+
+def _rule(rule_id: str, plugin: RulePlugin | None, findings: list[Finding]) -> dict[str, Any]:
+    sample = next(f for f in findings if f.rule_id == rule_id)
+    severity = plugin.severity if plugin is not None else sample.severity
+    cwes = plugin.cwe if plugin is not None else sample.cwe
+    name = plugin.name if plugin is not None else rule_id.split(":", 1)[-1]
+    description = plugin.description if plugin is not None else sample.message
+    tags = ["security", *(f"external/cwe/{c.lower()}" for c in cwes)]
+    return {
+        "id": rule_id,
+        "name": _pascal(name),
+        "shortDescription": {"text": description[:200]},
+        "fullDescription": {"text": description},
+        "defaultConfiguration": {"level": LEVEL[severity]},
+        "help": {"text": f"{description} Vulnerability class: {sample.vuln_class}."},
+        "properties": {
+            "tags": tags,
+            "security-severity": SECURITY_SEVERITY[severity],
+            "precision": "high" if plugin is not None else "medium",
+        },
+    }
+
+
+def _result(f: Finding, index: int, prefix: str) -> dict[str, Any]:
+    uri = _uri(prefix + f.location.path)
+    out: dict[str, Any] = {
+        "ruleId": f.rule_id,
+        "ruleIndex": index,
+        "level": LEVEL[f.severity],
+        "message": {"text": f.message},
+        "locations": [{"physicalLocation": _physical(f, uri)}],
+        "partialFingerprints": {FINGERPRINT_KEY: f.id},
+        "properties": {
+            "severity": f.severity.value,
+            "security-severity": SECURITY_SEVERITY[f.severity],
+            "confidence": f.confidence,
+            "status": f.status.value,
+            "vulnClass": f.vuln_class,
+            "cwe": list(f.cwe),
+            "sources": list(f.sources),
+            "relatedRules": list(f.related_rules),
+            "function": f.function,
+            "evidence": [
+                {"producer": e.producer, "kind": e.kind, "message": e.message} for e in f.evidence
+            ],
+        },
+    }
+    if f.status is Status.SUPPRESSED:
+        out["suppressions"] = [
+            {
+                "kind": "inSource" if (f.suppression or "").startswith("inline:") else "external",
+                "status": "accepted",
+                "justification": f.suppression or "",
+            }
+        ]
+    if f.fix is not None:
+        out["fixes"] = [
+            {
+                "description": {"text": f.fix.description},
+                "artifactChanges": [
+                    {
+                        "artifactLocation": {"uri": uri, "uriBaseId": SRCROOT},
+                        "replacements": [
+                            {
+                                "deletedRegion": _region(edit.region),
+                                "insertedContent": {"text": edit.replacement},
+                            }
+                            for edit in f.fix.edits
+                        ],
+                    }
+                ],
+            }
+        ]
+    return out
+
+
+def _physical(f: Finding, uri: str) -> dict[str, Any]:
+    region = _region(f.location)
+    if f.snippet:
+        region["snippet"] = {"text": f.snippet}
+    return {
+        "artifactLocation": {"uri": uri, "uriBaseId": SRCROOT},
+        "region": region,
+    }
+
+
+def _region(r) -> dict[str, Any]:
+    region: dict[str, Any] = {
+        "startLine": r.start_line,
+        "startColumn": r.start_column,
+        "endLine": r.end_line,
+    }
+    if r.end_column is not None:
+        region["endColumn"] = r.end_column
+    return region
+
+
+def _uri(path: str) -> str:
+    return quote(path, safe="/-_.~")
+
+
+def repository_root(start: Path) -> Path | None:
+    """Nearest enclosing directory containing `.git` (a work tree), if any."""
+    current = start.resolve()
+    for candidate in (current, *current.parents):
+        if (candidate / ".git").exists():
+            return candidate
+    return None
+
+
+def _pascal(name: str) -> str:
+    parts = [p for p in name.replace("_", "-").replace(".", "-").replace("/", "-").split("-") if p]
+    return "".join(p[:1].upper() + p[1:] for p in parts) or "Rule"

hackscan/taint/__init__.py

@@ -0,0 +1 @@
+"""Taint models: sources and sanitizers."""