hackscan 0.3.0__tar.gz → 0.3.1__tar.gz

{hackscan-0.3.0 → hackscan-0.3.1}/PKG-INFO

@@ -1,6 +1,6 @@
 Metadata-Version: 2.5
 Name: hackscan
-Version: 0.3.0
+Version: 0.3.1
 Summary: Python SAST orchestrator: own AST + taint engine, imports Semgrep/Bandit/CodeQL/Gitleaks, dedupes, emits SARIF.
 Project-URL: Source, https://github.com/kahledawad2019-netizen/hackscan
 Project-URL: Issues, https://github.com/kahledawad2019-netizen/hackscan/issues
@@ -241,7 +241,7 @@ jobs:
     runs-on: ubuntu-latest
     steps:
       - uses: actions/checkout@v4
-      - uses: kahledawad2019-netizen/hackscan@v0.3.0
+      - uses: kahledawad2019-netizen/hackscan@v0.3.1
         with:
           path: src
           fail-on: high
@@ -273,7 +273,7 @@ Python 3.12 on the runner. Without the action:
 ```yaml
 repos:
   - repo: https://github.com/kahledawad2019-netizen/hackscan
-    rev: v0.3.0
+    rev: v0.3.1
     hooks:
       - id: hackscan
 ```

{hackscan-0.3.0 → hackscan-0.3.1}/PROJECT.md

@@ -452,3 +452,10 @@ hackscan/
   re-run so the HackScan rows show 0.3.0 (numbers unchanged). Next ideas (not started):
   weak-cipher detection (DES/RC4/ECB/unauthenticated modes; largest benchmark gap),
   taint through `self` attributes, further pass-2 aliasing hardening.
+- 2026-10-12 (v0.3.1): template fixes only, found by the security agent's held-out evaluation
+  (8 of 13 true findings had no template). A call copied verbatim from the original call
+  (`params.get("id")`, `re.sub(...)`) no longer counts as introduced code (multiset count, so
+  no duplication); SQL fixes now decompose `"...'{}'...".format(args)` (plain auto-numbered
+  fields, positional args used exactly once; never for command argv, where a non-str value would
+  crash). Detection is unchanged, so the benchmark tables still show the 0.3.0 measurement (Bandit,
+  Semgrep and CodeQL are not installed on the release machine to re-run every row).

{hackscan-0.3.0 → hackscan-0.3.1}/README.md

@@ -215,7 +215,7 @@ jobs:
     runs-on: ubuntu-latest
     steps:
       - uses: actions/checkout@v4
-      - uses: kahledawad2019-netizen/hackscan@v0.3.0
+      - uses: kahledawad2019-netizen/hackscan@v0.3.1
         with:
           path: src
           fail-on: high
@@ -247,7 +247,7 @@ Python 3.12 on the runner. Without the action:
 ```yaml
 repos:
   - repo: https://github.com/kahledawad2019-netizen/hackscan
-    rev: v0.3.0
+    rev: v0.3.1
     hooks:
       - id: hackscan
 ```

{hackscan-0.3.0 → hackscan-0.3.1}/src/hackscan/__init__.py

@@ -1,3 +1,3 @@
 """HackScan: Python SAST orchestrator and verifier."""
 
-__version__ = "0.3.0"
+__version__ = "0.3.1"

{hackscan-0.3.0 → hackscan-0.3.1}/src/hackscan/analyzers/llm_pass.py

@@ -779,7 +779,7 @@ def _same_sql(original: ast.Call, new: ast.Call, ctx: FileContext) -> bool:
         return False
     if not isinstance(params, (ast.Tuple, ast.List)):
         return False
-    parts = _sql_parts(original.args[0])
+    parts = _sql_parts(original.args[0], sql=True)
     if parts is None:
         return False
     # The placeholder style must be the one the file's driver uses (`?` breaks psycopg);

{hackscan-0.3.0 → hackscan-0.3.1}/src/hackscan/analyzers/remediate.py

@@ -15,6 +15,7 @@ from __future__ import annotations
 import ast
 import difflib
 import re
+import string
 from collections.abc import Callable
 from dataclasses import replace
 
@@ -157,7 +158,7 @@ def _sqli(call: ast.Call, ctx: FileContext):
     placeholder = _placeholder(ctx)
     if placeholder is None:
         return None
-    parts = _sql_parts(call.args[0])
+    parts = _sql_parts(call.args[0], sql=True)
     if parts is None or not any(isinstance(p, ast.AST) for p in parts):
         return None
     sql, params = _parameterize(parts, placeholder)
@@ -193,8 +194,13 @@ def _placeholder(ctx: FileContext) -> str | None:
     return "?" if qmark else "%s"
 
 
-def _sql_parts(expr: ast.AST) -> list[str | ast.AST] | None:
-    """Literal text and value expressions, in order, for f-strings, `+` and `%`."""
+def _sql_parts(expr: ast.AST, *, sql: bool = False) -> list[str | ast.AST] | None:
+    """Literal text and value expressions, in order, for f-strings, `+` and `%`.
+
+    `sql=True` also decomposes `"...".format(...)`. A bound SQL value skips the text conversion
+    (`__format__("")` for `{}`, like `__str__` for `%s` and f-strings) and keeps its type, as the
+    SQL fix description already says. Command argv must stay text, so `_argv` never uses it
+    (`"cmd {}".format(1)` would become a non-str argument and crash)."""
     if isinstance(expr, ast.JoinedStr):
         parts: list[str | ast.AST] = []
         for v in expr.values:
@@ -210,7 +216,7 @@ def _sql_parts(expr: ast.AST) -> list[str | ast.AST] | None:
                 return None
         return parts
     if isinstance(expr, ast.BinOp) and isinstance(expr.op, ast.Add):
-        left, right = _operand(expr.left), _operand(expr.right)
+        left, right = _operand(expr.left, sql=sql), _operand(expr.right, sql=sql)
         if left is None or right is None:
             return None
         return [*left, *right]
@@ -230,17 +236,49 @@ def _sql_parts(expr: ast.AST) -> list[str | ast.AST] | None:
             else:
                 out.append(values[i // 2])
         return out
+    if (
+        sql
+        and isinstance(expr, ast.Call)
+        and isinstance(expr.func, ast.Attribute)
+        and expr.func.attr == "format"
+        and isinstance(expr.func.value, ast.Constant)
+        and isinstance(expr.func.value.value, str)
+        and not expr.keywords
+        and not any(isinstance(a, ast.Starred) for a in expr.args)
+    ):
+        return _format_parts(expr.func.value.value, expr.args)
     if isinstance(expr, ast.Constant) and isinstance(expr.value, str):
         return [expr.value]
     return None
 
 
-def _operand(expr: ast.AST) -> list[str | ast.AST] | None:
+def _format_parts(template: str, values: list[ast.AST]) -> list[str | ast.AST] | None:
+    """`"...{}...".format(a, b)`: only auto-numbered `{}` fields without a conversion or
+    format spec, each argument used exactly once in order. Each field calls the value's
+    `__format__("")`, which usually equals `str()` (as `%s` does) but a custom type may differ."""
+    try:
+        fields = list(string.Formatter().parse(template))
+    except ValueError:
+        return None
+    out: list[str | ast.AST] = []
+    used = 0
+    for literal, name, spec, conversion in fields:
+        out.append(literal)
+        if name is None:
+            continue
+        if name != "" or spec or conversion is not None or used >= len(values):
+            return None
+        out.append(values[used])
+        used += 1
+    return out if used == len(values) else None
+
+
+def _operand(expr: ast.AST, *, sql: bool = False) -> list[str | ast.AST] | None:
     """An operand of `+`: string-building expressions decompose, anything else is a value."""
     if isinstance(expr, (ast.JoinedStr, ast.BinOp)) or (
         isinstance(expr, ast.Constant) and isinstance(expr.value, str)
     ):
-        return _sql_parts(expr)
+        return _sql_parts(expr, sql=sql)
     if isinstance(expr, ast.Constant):
         return None  # e.g. "id = " + 5: not a str concatenation
     return [expr]

{hackscan-0.3.0 → hackscan-0.3.1}/src/hackscan/plugins/scopes.py

@@ -21,6 +21,7 @@ from __future__ import annotations
 
 import ast
 import builtins
+from collections import Counter
 from collections.abc import Iterator
 from dataclasses import dataclass, field
 
@@ -186,9 +187,17 @@ class ScopeIndex:
         for name in replacement_names - original_names:
             if not self._safe_fix_name(name, original, imports):
                 return False
+        # A call copied verbatim from the original (a value such as `params.get("id")`) is
+        # not introduced: same callee, same scope. Count copies so none can be duplicated.
+        copied = Counter(
+            ast.dump(n) for n in ast.walk(original) if isinstance(n, ast.Call) and n is not original
+        )
         for node in ast.walk(replacement):
             if not isinstance(node, ast.Call):
                 continue
+            if node is not replacement and copied[ast.dump(node)] > 0:
+                copied[ast.dump(node)] -= 1
+                continue
             # SQL fixes keep the original receiver; it can be a local cursor.
             if (
                 sql_receiver

{hackscan-0.3.0 → hackscan-0.3.1}/tests/test_remediate.py

@@ -75,6 +75,91 @@ def test_sqli_forms(tmp_path: Path, query: str, expected: str):
     assert expected in new
 
 
+def test_sqli_str_format_becomes_parameterized_and_is_safe(tmp_path: Path):
+    _, new = fixed_source(
+        tmp_path,
+        """
+        import sqlite3
+
+        def login(cur, user, pw):
+            return cur.execute(
+                "SELECT id FROM users WHERE name = '{}' AND pw = '{}'".format(user, pw)
+            ).fetchall()
+        """,
+    )
+    assert "WHERE name = ? AND pw = ?', (user, pw))" in new
+    namespace: dict = {}
+    exec(compile(new, "m.py", "exec"), namespace)
+    db = sqlite3.connect(":memory:")
+    db.execute("CREATE TABLE users (id INTEGER, name TEXT, pw TEXT)")
+    db.execute("INSERT INTO users VALUES (1, 'alice', 's3')")
+    cur = db.cursor()
+    assert namespace["login"](cur, "alice", "s3") == [(1,)]
+    assert namespace["login"](cur, "alice", "x' OR '1'='1") == []
+
+
+@pytest.mark.parametrize(
+    "query",
+    [
+        "\"SELECT * FROM t WHERE a = '{0}'\".format(x)",  # numbered field
+        "\"SELECT * FROM t WHERE a = '{a}'\".format(a=x)",  # named field / keyword
+        "\"SELECT * FROM t WHERE a = '{!r}'\".format(x)",  # conversion
+        "\"SELECT * FROM t WHERE a = '{:>5}'\".format(x)",  # format spec
+        "\"SELECT * FROM t WHERE a = '{}'\".format(x, y)",  # unused argument
+        "\"SELECT * FROM t WHERE a = '{}'\".format(x, extra=y)",  # unused keyword is still evaluated
+        "\"SELECT * FROM t WHERE a = '{}' AND b = '{}'\".format(*x)",  # starred
+        "\"SELECT * FROM t WHERE a = '{}'\".format",  # not a call of the template
+    ],
+)
+def test_sqli_str_format_refuses_non_plain_fields(tmp_path: Path, query: str):
+    _, findings = fixes_for(
+        tmp_path, f"import sqlite3\n\ndef f(cur, x, y):\n    cur.execute({query})\n"
+    )
+    assert all(f.fix is None for f in findings)
+
+
+def test_sqli_values_with_calls_are_copied_verbatim(tmp_path: Path):
+    _, new = fixed_source(
+        tmp_path,
+        """
+        import re
+        import sqlite3
+
+        def login(cur, params):
+            cur.execute(
+                "SELECT * FROM users WHERE name='" + re.sub(r"[^a-z]", "", params.get("name", ""))
+                + "' AND pw='" + params.get("pw", "") + "'"
+            )
+        """,
+    )
+    assert (
+        "'SELECT * FROM users WHERE name=? AND pw=?', "
+        '(re.sub(r"[^a-z]", "", params.get("name", "")), params.get("pw", "")))' in new
+    )
+
+
+def test_copied_calls_cannot_be_duplicated_or_invented():
+    from hackscan.plugins.base import FileContext
+
+    source = "import sqlite3\n\ndef f(cur, g):\n    cur.execute('SELECT ' + g())\n"
+    tree = ast.parse(source)
+    ctx = FileContext("m.py", source, tree)
+    (call,) = [
+        n
+        for n in ast.walk(tree)
+        if isinstance(n, ast.Call) and getattr(n.func, "attr", "") == "execute"
+    ]
+
+    def ok(replacement: str) -> bool:
+        return ctx.scopes.safe_introduced_names(
+            call, ast.parse(replacement, mode="eval").body, sql_receiver=True
+        )
+
+    assert ok("cur.execute('SELECT ?', (g(),))")
+    assert not ok("cur.execute('SELECT ?, ?', (g(), g()))")  # a second evaluation is new code
+    assert not ok("cur.execute('SELECT ?', (h(),))")  # a call the original never made
+
+
 def test_sqli_psycopg_uses_format_placeholders(tmp_path: Path):
     _, new = fixed_source(
         tmp_path,
@@ -309,6 +394,19 @@ def test_os_system_percent_conversion_fix(tmp_path: Path, conversion: str, has_f
         assert "subprocess.call(['ls', str(n)])" in apply_edits(source, fixes[0].edits)
 
 
+@pytest.mark.parametrize(
+    "call",
+    [
+        'subprocess.run("whoami {}".format(n), shell=True, capture_output=True)',
+        'os.system("whoami {}".format(n))',
+    ],
+)
+def test_command_str_format_has_no_template_fix(tmp_path: Path, call: str):
+    # argv must stay text: "whoami {}".format(123) works, ["whoami", 123] raises TypeError.
+    _, findings = fixes_for(tmp_path, f"import os\nimport subprocess\n\ndef f(n):\n    {call}\n")
+    assert findings and all(f.fix is None for f in findings)
+
+
 def test_shell_true_drops_shell(tmp_path: Path):
     _, new = fixed_source(
         tmp_path,