proofctl 0.1.8__tar.gz → 0.1.9__tar.gz

{proofctl-0.1.8 → proofctl-0.1.9}/PKG-INFO

@@ -1,6 +1,6 @@
 Metadata-Version: 2.4
 Name: proofctl
-Version: 0.1.8
+Version: 0.1.9
 Summary: Zero-dependency linter for Python, Terraform, Dockerfiles, Kubernetes, and GitHub Actions — catches AI slop and security misconfigurations pre-commit
 Author-email: Kolawolu Odunola <kolawolu.o@gmail.com>
 License: MIT

{proofctl-0.1.8 → proofctl-0.1.9}/proofctl/checkers/hcl_utils.py

@@ -77,12 +77,29 @@ def parse_blocks(source: str) -> list[HclBlock]:
     return _parse(source.splitlines(), base=1, skip_outer=False)
 
 
+def _is_escaped(line: str, idx: int) -> bool:
+    """True if `line[idx]` is preceded by an odd run of backslashes.
+
+    Counting the run is the only correct way to tell `\\"` (escaped backslash
+    followed by an unescaped quote) from `\"` (escaped quote). The previous
+    one-character lookback `line[i-1] == '\\\\'` got this wrong: in
+    `password = "my\\\\\\"secret"`, it treated the closing quote as escaped
+    and tokenisation silently broke for every rule that walked block bodies.
+    """
+    n = 0
+    j = idx - 1
+    while j >= 0 and line[j] == "\\":
+        n += 1
+        j -= 1
+    return n % 2 == 1
+
+
 def _strip_comment(line: str) -> str:
     in_str = False
     i = 0
     while i < len(line):
         c = line[i]
-        if c == '"' and (i == 0 or line[i - 1] != '\\'):
+        if c == '"' and not _is_escaped(line, i):
             in_str = not in_str
         if not in_str:
             if c == '#':
@@ -137,7 +154,12 @@ def _parse(lines: list[str], base: int, skip_outer: bool) -> list[HclBlock]:
 
         # ── heredoc passthrough ──
         if heredoc_end:
-            if line.strip() == heredoc_end or line.strip().rstrip("-~") == heredoc_end:
+            # The end label must appear on a line of its own (whitespace either
+            # side allowed for `<<-` indented heredocs). The previous loose
+            # `rstrip("-~")` matched lines like `EOF~~~` as terminators, which
+            # could prematurely close a heredoc whose body legitimately ended
+            # with `~`. C-11 fix: strict whole-line match after .strip().
+            if line.strip() == heredoc_end:
                 heredoc_end = None
             continue
         hm = _HEREDOC_START_RE.search(line)

{proofctl-0.1.8 → proofctl-0.1.9}/proofctl/checkers/terraform.py

@@ -266,21 +266,28 @@ class TerraformChecker(HclFileChecker):
 
     @staticmethod
     def _has_lifecycle_attr(block: HclBlock, attr: str) -> bool:
-        """True if the block contains lifecycle { <attr> = true }."""
+        """True if the block contains lifecycle { <attr> = true }.
+
+        Strips inline comments before counting braces so a comment containing
+        `}` (e.g. ``# closing the lifecycle block }``) doesn't prematurely end
+        the lifecycle scope. The same rule applies for `{`.
+        """
+        from .hcl_utils import _strip_comment
         lc_re = re.compile(r'lifecycle\s*\{')
         attr_re = re.compile(rf'{re.escape(attr)}\s*=\s*true')
         in_lifecycle = False
         depth = 0
         for line in block.raw_lines:
-            if not in_lifecycle and lc_re.search(line):
+            stripped = _strip_comment(line)
+            if not in_lifecycle and lc_re.search(stripped):
                 in_lifecycle = True
                 depth = 1
-                if attr_re.search(line):
+                if attr_re.search(stripped):
                     return True
                 continue
             if in_lifecycle:
-                depth += line.count('{') - line.count('}')
-                if attr_re.search(line):
+                depth += stripped.count('{') - stripped.count('}')
+                if attr_re.search(stripped):
                     return True
                 if depth <= 0:
                     in_lifecycle = False
@@ -699,9 +706,15 @@ class TerraformChecker(HclFileChecker):
                     hint='Pin to a commit SHA or semver tag: source = "git::https://…?ref=v1.2.3"',
                 ))
             else:
-                # Extract the ref value (stop at / & or end)
+                # Extract the ref value (stop at & or end of query string).
+                # URL-decode so percent-encoded chars (`v1%2E0` → `v1.0`,
+                # `release%2Fv1` → `release/v1`) are evaluated as the user
+                # intended; without this, `?ref=v1%2E0` failed both the SHA
+                # and semver patterns and reported as a mutable ref.
+                from urllib.parse import unquote
                 ref_part = src.split("?ref=", 1)[1]
-                ref = re.split(r'[/&?]', ref_part)[0]
+                ref_raw = re.split(r'[&?]', ref_part)[0]
+                ref = unquote(ref_raw)
                 if _GIT_SHA_RE.match(ref) or _SEMVER_TAG_RE.match(ref):
                     continue  # immutable SHA or semver tag — clean
                 out.append(self._f(
@@ -788,24 +801,43 @@ class TerraformChecker(HclFileChecker):
         return out
 
     def _g004(self, path: Path, blocks: list[HclBlock]) -> list[Finding]:
-        """G-004 — Default service account with cloud-platform scope."""
-        out = []
+        """G-004 — Default service account with cloud-platform scope.
+
+        The real default Compute SA email format is
+        ``<PROJECT_NUMBER>-compute@developer.gserviceaccount.com``. The
+        previous regex looked for ``compute@developer`` which only matched
+        the suffix in isolation; legitimate user-typed default-SA emails
+        like ``123456-compute@developer.gserviceaccount.com`` were missed.
+        Match the canonical suffix instead.
+        """
+        out = []
+        # Canonical default-SA suffix (project-scoped Compute Engine default SA).
+        default_sa_re = re.compile(
+            r'email\s*=\s*"(?:"|[\d]+-compute@developer\.gserviceaccount\.com)',
+        )
+        empty_email_re = re.compile(r'email\s*=\s*""')
+        any_email_re = re.compile(r'email\s*=')
         for b in blocks:
             if b.kind != "resource" or b.label1 != "google_compute_instance":
                 continue
-            # Detect: service_account block with empty email + cloud-platform scope
-            if b.contains(r'service_account') and b.contains(r'cloud-platform'):
-                # Check email is empty or uses the default SA pattern
-                if b.contains(r'email\s*=\s*(?:""|compute@developer)') or not b.contains(r'email\s*='):
-                    out.append(self._f(
-                        path, b.any_line_matches(r'cloud-platform') or b.start_line,
-                        "PROOFCTL-TF-G004", "Default SA with cloud-platform scope",
-                        Severity.ERROR,
-                        f'Instance "{b.label2}" uses the default service account with cloud-platform scope',
-                        hint="Create a dedicated SA with only required roles and use granular scopes.",
-                        authority="CIS GCP Benchmark 4.1",
-                        docs_url="https://www.cisecurity.org/benchmark/google_cloud_computing_platform",
-                    ))
+            block_src = "\n".join(b.raw_lines)
+            if not (b.contains(r'service_account') and b.contains(r'cloud-platform')):
+                continue
+            uses_default_sa = (
+                default_sa_re.search(block_src) is not None
+                or empty_email_re.search(block_src) is not None
+                or any_email_re.search(block_src) is None  # implicit default
+            )
+            if uses_default_sa:
+                out.append(self._f(
+                    path, b.any_line_matches(r'cloud-platform') or b.start_line,
+                    "PROOFCTL-TF-G004", "Default SA with cloud-platform scope",
+                    Severity.ERROR,
+                    f'Instance "{b.label2}" uses the default service account with cloud-platform scope',
+                    hint="Create a dedicated SA with only required roles and use granular scopes.",
+                    authority="CIS GCP Benchmark 4.1",
+                    docs_url="https://www.cisecurity.org/benchmark/google_cloud_computing_platform",
+                ))
         return out
 
     def _g005(self, path: Path, blocks: list[HclBlock]) -> list[Finding]:
@@ -2018,13 +2050,26 @@ class TerraformChecker(HclFileChecker):
         return out
 
     def _ai002(self, path: Path, lines: list[str], blocks: list[HclBlock]) -> list[Finding]:
-        """AI-002 — AWS region format in a GCP-context file."""
+        """AI-002 — AWS region format in a GCP-context file.
+
+        Ignores matches that fall on comment lines (``#`` or ``//``) so legitimate
+        migration notes like ``# was us-east-1, now us-east1`` don't false-positive.
+        """
         source = "\n".join(lines)
         if not _GCP_RESOURCE_RE.search(source):
             return []
         out = []
+        from .hcl_utils import _strip_comment
         for m in _AWS_REGION_RE.finditer(source):
             lineno = source[: m.start()].count("\n") + 1
+            full_line = lines[lineno - 1] if lineno <= len(lines) else ""
+            # Compute the column where the match starts within the line.
+            line_start = source.rfind("\n", 0, m.start()) + 1
+            col = m.start() - line_start
+            # If the match falls inside a comment portion of the line, skip it.
+            non_comment = _strip_comment(full_line)
+            if col >= len(non_comment):
+                continue
             out.append(self._f(
                 path, lineno,
                 "PROOFCTL-TF-AI-002", "AWS region format in GCP context",

{proofctl-0.1.8 → proofctl-0.1.9}/proofctl.egg-info/PKG-INFO

@@ -1,6 +1,6 @@
 Metadata-Version: 2.4
 Name: proofctl
-Version: 0.1.8
+Version: 0.1.9
 Summary: Zero-dependency linter for Python, Terraform, Dockerfiles, Kubernetes, and GitHub Actions — catches AI slop and security misconfigurations pre-commit
 Author-email: Kolawolu Odunola <kolawolu.o@gmail.com>
 License: MIT

{proofctl-0.1.8 → proofctl-0.1.9}/proofctl.egg-info/SOURCES.txt

@@ -46,6 +46,7 @@ tests/test_llm.py
 tests/test_local_packages.py
 tests/test_phase1_audit_fixes.py
 tests/test_phase2_audit_fixes.py
+tests/test_phase3_audit_fixes.py
 tests/test_placeholders.py
 tests/test_quality.py
 tests/test_quality_ext.py

{proofctl-0.1.8 → proofctl-0.1.9}/pyproject.toml

@@ -4,7 +4,7 @@ build-backend = "setuptools.build_meta"
 
 [project]
 name = "proofctl"
-version = "0.1.8"
+version = "0.1.9"
 description = "Zero-dependency linter for Python, Terraform, Dockerfiles, Kubernetes, and GitHub Actions — catches AI slop and security misconfigurations pre-commit"
 readme = "README.md"
 license = { text = "MIT" }

proofctl-0.1.9/tests/test_phase3_audit_fixes.py

@@ -0,0 +1,277 @@
+"""Regression tests for AUDIT_AND_ROADMAP Phase 3 (HCL parser hardening).
+
+Covers:
+  C-10: even-backslash check for escaped-quote handling in `_strip_comment`
+  C-11: strict heredoc end-marker matching (no `rstrip("-~")`)
+  C-12: brace counter respects string state and `${}` interpolations
+  C-13: `_t004` port parse handles variable references without crashing
+  HCL HIGH: `_v004` URL-decode, `_g004` canonical default-SA, `_ai002` skips comments
+  HCL MEDIUM: `_has_lifecycle_attr` strips comments
+"""
+from __future__ import annotations
+
+from pathlib import Path
+
+import pytest
+
+from proofctl.checkers.hcl_utils import (
+    HclBlock,
+    _brace_delta,
+    _is_escaped,
+    _strip_comment,
+    parse_blocks,
+)
+from proofctl.checkers.terraform import TerraformChecker
+from proofctl.config import ProofctlConfig
+from proofctl.engine import run_check
+
+
+# ── C-10: escaped-quote handling ──────────────────────────────────────────────
+
+def test_c10_is_escaped_recognises_odd_run():
+    # \" — single backslash before quote → escaped
+    assert _is_escaped(r'"\""', 2) is True
+
+
+def test_c10_is_escaped_recognises_even_run():
+    # \\" — escaped backslash followed by an unescaped quote → not escaped
+    line = r'"\\""'  # opens, escaped backslash, closes, opens again
+    # Index 3 is the quote that closes the string after the escaped backslash
+    assert _is_escaped(line, 3) is False
+
+
+def test_c10_strip_comment_does_not_eat_string_with_escaped_backslash():
+    """The previous one-char lookback treated the closing quote in
+    `password = "my\\\\\\"secret#actualpassword"` as escaped, so `#` looked
+    like the start of a comment and tokenisation broke. The fix counts the
+    run of backslashes."""
+    line = 'password = "my\\\\\\"secret#actualpassword"  # real comment'
+    stripped = _strip_comment(line)
+    # The `#` inside the string must NOT be treated as a comment start.
+    assert "secret#actualpassword" in stripped
+    # The trailing real comment IS stripped.
+    assert "real comment" not in stripped
+
+
+def test_c10_strip_comment_simple_escaped_quote_still_works():
+    """Sanity: a single `\\"` inside a string keeps the string open."""
+    line = 'msg = "say \\"hi\\" please"  # comment'
+    stripped = _strip_comment(line)
+    assert "comment" not in stripped
+    assert 'say \\"hi\\"' in stripped
+
+
+# ── C-11: heredoc end-marker matching ─────────────────────────────────────────
+
+def test_c11_heredoc_strict_end_only_label_alone_terminates():
+    """A line `EOF~~~` must NOT terminate a heredoc opened with `<<EOF`.
+    The previous `rstrip("-~")` accepted any line whose stripped suffix
+    matched the label."""
+    src = '''locals {
+  policy = <<EOF
+{
+  "trailing_tilde_in_body": "EOF~~~"
+}
+EOF
+}
+resource "aws_s3_bucket" "after" {
+  bucket = "test"
+}
+'''
+    blocks = parse_blocks(src)
+    # If the heredoc was prematurely closed at `EOF~~~`, the brace counter
+    # would have desynced and we'd lose either the `locals` or the
+    # `aws_s3_bucket` block.
+    kinds = sorted((b.kind, b.label1) for b in blocks)
+    assert ("locals", "") in kinds
+    assert ("resource", "aws_s3_bucket") in kinds
+
+
+def test_c11_indented_heredoc_end_with_leading_whitespace_works():
+    """`<<-EOF` form allows the end label to be indented; we must still close it."""
+    src = '''locals {
+  policy = <<-EOF
+    {"hello": "world"}
+    EOF
+}
+resource "aws_s3_bucket" "after" {
+  bucket = "x"
+}
+'''
+    blocks = parse_blocks(src)
+    kinds = sorted((b.kind, b.label1) for b in blocks)
+    assert ("resource", "aws_s3_bucket") in kinds
+
+
+# ── C-12: brace counter handles ${} interpolations ────────────────────────────
+
+@pytest.mark.parametrize("line,expected", [
+    ('a = "x${count.index}y"', 0),         # interpolation inside string
+    ('tags = { Name = "x${i}" }', 0),       # block with interpolation
+    ('description = "value with } brace"', 0),
+    ('foo = bar', 0),
+    ('resource "x" "y" {', 1),
+    ('}', -1),
+    ('resource "x" "y" { foo = "bar" }', 0),  # single-line block
+])
+def test_c12_brace_delta(line: str, expected: int):
+    assert _brace_delta(line) == expected
+
+
+def test_c12_block_parser_handles_interpolation_in_tags():
+    """A nested map with string interpolations was the audit's worry case."""
+    src = '''resource "aws_instance" "x" {
+  tags = {
+    Name = "ec2-${var.env}-app"
+    Env  = var.env
+  }
+}
+'''
+    blocks = parse_blocks(src)
+    assert len(blocks) == 1
+    assert blocks[0].kind == "resource"
+    assert blocks[0].label2 == "x"
+
+
+# ── C-13: _t004 port parse stays defensive on variable refs ───────────────────
+
+def test_c13_t004_no_crash_on_variable_port(tmp_path):
+    """`from_port = var.ssh_port` must not crash _t004; the rule should
+    silently skip blocks where ports aren't literal."""
+    (tmp_path / "main.tf").write_text(
+        'resource "aws_security_group_rule" "open" {\n'
+        '  type        = "ingress"\n'
+        '  from_port   = var.ssh_port\n'
+        '  to_port     = var.ssh_port\n'
+        '  cidr_blocks = ["0.0.0.0/0"]\n'
+        '}\n'
+    )
+    findings = run_check(tmp_path, ProofctlConfig(), families=["TF"])
+    # No PROOFCTL-INTERNAL-001 (would mean a checker crashed).
+    assert all(f.rule_id != "PROOFCTL-INTERNAL-001" for f in findings), (
+        f"engine crashed: {[(f.rule_id, f.message) for f in findings if f.rule_id == 'PROOFCTL-INTERNAL-001']}"
+    )
+
+
+def test_c13_t004_still_fires_on_literal_sensitive_port(tmp_path):
+    """Sanity: a literal sensitive port + 0.0.0.0/0 still triggers T-004."""
+    (tmp_path / "main.tf").write_text(
+        'resource "aws_security_group_rule" "open" {\n'
+        '  type        = "ingress"\n'
+        '  from_port   = 22\n'
+        '  to_port     = 22\n'
+        '  cidr_blocks = ["0.0.0.0/0"]\n'
+        '}\n'
+    )
+    findings = run_check(tmp_path, ProofctlConfig(), families=["TF"])
+    assert any(f.rule_id == "PROOFCTL-TF-T004" for f in findings)
+
+
+# ── HCL HIGH: _v004 URL-decode ────────────────────────────────────────────────
+
+def test_v004_percent_encoded_semver_recognised_as_immutable(tmp_path):
+    """`?ref=v1%2E2%2E3` must decode to `v1.2.3` and pass the semver check."""
+    (tmp_path / "main.tf").write_text(
+        'module "x" {\n'
+        '  source = "git::https://github.com/foo/bar.git?ref=v1%2E2%2E3"\n'
+        '}\n'
+    )
+    findings = run_check(tmp_path, ProofctlConfig(), families=["TF"])
+    assert all(f.rule_id != "PROOFCTL-TF-V004" for f in findings), (
+        f"V-004 should accept percent-encoded semver; got: {[(f.rule_id, f.message) for f in findings]}"
+    )
+
+
+def test_v004_branch_ref_still_flagged(tmp_path):
+    """A branch ref (mutable) is still flagged."""
+    (tmp_path / "main.tf").write_text(
+        'module "x" {\n'
+        '  source = "git::https://github.com/foo/bar.git?ref=main"\n'
+        '}\n'
+    )
+    findings = run_check(tmp_path, ProofctlConfig(), families=["TF"])
+    assert any(f.rule_id == "PROOFCTL-TF-V004" for f in findings)
+
+
+# ── HCL HIGH: _g004 canonical default-SA suffix ───────────────────────────────
+
+def test_g004_canonical_default_sa_email_recognised(tmp_path):
+    """The fully-qualified default-SA email
+    `<projnum>-compute@developer.gserviceaccount.com` must trigger G-004
+    when paired with cloud-platform scope."""
+    (tmp_path / "main.tf").write_text(
+        'resource "google_compute_instance" "x" {\n'
+        '  service_account {\n'
+        '    email  = "123456-compute@developer.gserviceaccount.com"\n'
+        '    scopes = ["cloud-platform"]\n'
+        '  }\n'
+        '}\n'
+    )
+    findings = run_check(tmp_path, ProofctlConfig(), families=["TF"])
+    assert any(f.rule_id == "PROOFCTL-TF-G004" for f in findings)
+
+
+def test_g004_dedicated_sa_does_not_trigger(tmp_path):
+    """A non-default SA email must not fire G-004."""
+    (tmp_path / "main.tf").write_text(
+        'resource "google_compute_instance" "x" {\n'
+        '  service_account {\n'
+        '    email  = "my-app-sa@my-project.iam.gserviceaccount.com"\n'
+        '    scopes = ["cloud-platform"]\n'
+        '  }\n'
+        '}\n'
+    )
+    findings = run_check(tmp_path, ProofctlConfig(), families=["TF"])
+    assert all(f.rule_id != "PROOFCTL-TF-G004" for f in findings)
+
+
+# ── HCL HIGH: _ai002 ignores comment lines ────────────────────────────────────
+
+def test_ai002_ignores_aws_region_in_comment(tmp_path):
+    """A `# was us-east-1` migration note must not trigger AI-002 inside a
+    GCP-context file."""
+    (tmp_path / "main.tf").write_text(
+        '# Migrated from us-east-1 to us-central1 on 2026-01-15\n'
+        'resource "google_compute_instance" "x" {\n'
+        '  zone = "us-central1-a"\n'
+        '}\n'
+    )
+    findings = run_check(tmp_path, ProofctlConfig(), families=["TF"])
+    assert all(f.rule_id != "PROOFCTL-TF-AI-002" for f in findings), (
+        f"AI-002 should ignore comments; got: {[(f.rule_id, f.message) for f in findings]}"
+    )
+
+
+def test_ai002_still_fires_on_real_aws_region_in_gcp_file(tmp_path):
+    """Sanity: a non-comment AWS region in a GCP file still fires AI-002."""
+    (tmp_path / "main.tf").write_text(
+        'resource "google_compute_instance" "x" {\n'
+        '  zone = "us-east-1"\n'
+        '}\n'
+    )
+    findings = run_check(tmp_path, ProofctlConfig(), families=["TF"])
+    assert any(f.rule_id == "PROOFCTL-TF-AI-002" for f in findings)
+
+
+# ── HCL MEDIUM: _has_lifecycle_attr strips comments ───────────────────────────
+
+def test_has_lifecycle_attr_ignores_brace_in_comment(tmp_path):
+    """A `}` inside a comment must not be counted as ending the lifecycle block."""
+    (tmp_path / "main.tf").write_text(
+        'resource "aws_s3_bucket" "x" {\n'
+        '  bucket = "stateful"\n'
+        '  lifecycle {\n'
+        '    # the closing brace below is real, this comment has } in it\n'
+        '    prevent_destroy = true\n'
+        '  }\n'
+        '}\n'
+    )
+    findings = run_check(tmp_path, ProofctlConfig(), families=["TF"])
+    # If the lifecycle scope was prematurely ended by the `}` in the comment,
+    # `_has_lifecycle_attr(b, "prevent_destroy")` would have returned False
+    # and a "stateful resource without prevent_destroy" finding would surface.
+    # Confirm we DON'T see that finding.
+    msgs = [f.message for f in findings]
+    assert not any("prevent_destroy" in m and "stateful" in m.lower() for m in msgs), (
+        f"unexpected stateful finding: {msgs}"
+    )