pycodegate 0.1.0__py3-none-any.whl

pycodegate/rules/django.py

@@ -0,0 +1,144 @@
+"""Django-specific rules: raw SQL, DEBUG=True, N+1 queries, secret key exposure."""
+
+from __future__ import annotations
+
+import ast
+
+from pycodegate.rules.base import BaseRules
+from pycodegate.types import Category, Diagnostic, Severity
+
+
+class DjangoRules(BaseRules):
+    """Django framework-specific checks."""
+
+    def check(self, source: str, filename: str) -> list[Diagnostic]:
+        tree = self._parse(source)
+        if tree is None:
+            return []
+
+        diags: list[Diagnostic] = []
+        diags.extend(self._check_raw_sql(tree, filename))
+        diags.extend(self._check_debug_true(tree, filename))
+        diags.extend(self._check_n_plus_one(tree, source, filename))
+        diags.extend(self._check_secret_key(tree, filename))
+        return diags
+
+    def _check_raw_sql(self, tree: ast.Module, filename: str) -> list[Diagnostic]:
+        diags: list[Diagnostic] = []
+        for node in ast.walk(tree):
+            if isinstance(node, ast.Call) and isinstance(node.func, ast.Attribute):
+                if node.func.attr == "execute" and node.args:
+                    arg = node.args[0]
+                    if isinstance(arg, ast.BinOp) and isinstance(arg.op, ast.Add):
+                        diags.append(
+                            Diagnostic(
+                                file_path=filename,
+                                rule="no-raw-sql-injection",
+                                severity=Severity.ERROR,
+                                category=Category.DJANGO,
+                                message="SQL query built with string concatenation — SQL injection risk",
+                                help="Use parameterized queries: cursor.execute('SELECT ... WHERE id = %s', [user_id])",
+                                line=node.lineno,
+                                column=node.col_offset,
+                                cost=3.0,
+                            )
+                        )
+        return diags
+
+    def _check_debug_true(self, tree: ast.Module, filename: str) -> list[Diagnostic]:
+        if "settings" not in filename:
+            return []
+        diags: list[Diagnostic] = []
+        for node in ast.walk(tree):
+            if isinstance(node, ast.Assign):
+                for target in node.targets:
+                    if (
+                        isinstance(target, ast.Name)
+                        and target.id == "DEBUG"
+                        and isinstance(node.value, ast.Constant)
+                        and node.value.value is True
+                    ):
+                        diags.append(
+                            Diagnostic(
+                                file_path=filename,
+                                rule="no-debug-true",
+                                severity=Severity.ERROR,
+                                category=Category.DJANGO,
+                                message="DEBUG = True should not be hardcoded in settings",
+                                help="Use environment variable: DEBUG = os.environ.get('DEBUG', 'False') == 'True'",
+                                line=node.lineno,
+                                column=node.col_offset,
+                                cost=3.0,
+                            )
+                        )
+        return diags
+
+    def _check_n_plus_one(self, tree: ast.Module, source: str, filename: str) -> list[Diagnostic]:
+        diags: list[Diagnostic] = []
+        for node in ast.walk(tree):
+            if not isinstance(node, ast.For) or not self._is_queryset_iter(node.iter):
+                continue
+            if not isinstance(node.target, ast.Name):
+                continue
+            var_name = node.target.id
+            if self._has_related_access(node, var_name):
+                diags.append(
+                    Diagnostic(
+                        file_path=filename,
+                        rule="no-n-plus-one-query",
+                        severity=Severity.WARNING,
+                        category=Category.DJANGO,
+                        message="Potential N+1 query — accessing related object in a loop",
+                        help="Use select_related() or prefetch_related() on the queryset",
+                        line=node.lineno,
+                        column=node.col_offset,
+                        cost=1.0,
+                    )
+                )
+        return diags
+
+    @staticmethod
+    def _has_related_access(loop_node: ast.For, var_name: str) -> bool:
+        for child in ast.walk(loop_node):
+            if (
+                isinstance(child, ast.Attribute)
+                and isinstance(child.value, ast.Attribute)
+                and isinstance(child.value.value, ast.Name)
+                and child.value.value.id == var_name
+            ):
+                return True
+        return False
+
+    def _is_queryset_iter(self, node: ast.expr) -> bool:
+        if isinstance(node, ast.Call) and isinstance(node.func, ast.Attribute):
+            if node.func.attr in ("all", "filter", "exclude", "values", "values_list"):
+                return True
+        return False
+
+    def _check_secret_key(self, tree: ast.Module, filename: str) -> list[Diagnostic]:
+        if "settings" not in filename:
+            return []
+        diags: list[Diagnostic] = []
+        for node in ast.walk(tree):
+            if isinstance(node, ast.Assign):
+                for target in node.targets:
+                    if (
+                        isinstance(target, ast.Name)
+                        and target.id == "SECRET_KEY"
+                        and isinstance(node.value, ast.Constant)
+                        and isinstance(node.value.value, str)
+                    ):
+                        diags.append(
+                            Diagnostic(
+                                file_path=filename,
+                                rule="no-secret-key-in-source",
+                                severity=Severity.ERROR,
+                                category=Category.DJANGO,
+                                message="SECRET_KEY hardcoded in settings — use environment variable",
+                                help="Use os.environ['SECRET_KEY'] or django-environ",
+                                line=node.lineno,
+                                column=node.col_offset,
+                                cost=3.0,
+                            )
+                        )
+        return diags

pycodegate/rules/fastapi.py

@@ -0,0 +1,70 @@
+"""FastAPI-specific rules: sync endpoints, missing response_model."""
+
+from __future__ import annotations
+
+import ast
+
+from pycodegate.rules.base import BaseRules
+from pycodegate.types import Category, Diagnostic, Severity
+
+_ROUTE_METHODS = {"get", "post", "put", "patch", "delete", "head", "options"}
+
+
+class FastAPIRules(BaseRules):
+    """FastAPI framework-specific checks."""
+
+    def check(self, source: str, filename: str) -> list[Diagnostic]:
+        tree = self._parse(source)
+        if tree is None:
+            return []
+
+        diags: list[Diagnostic] = []
+        for node in ast.walk(tree):
+            if isinstance(node, (ast.FunctionDef, ast.AsyncFunctionDef)):
+                route_decorator = self._get_route_decorator(node)
+                if route_decorator is not None:
+                    diags.extend(self._check_sync_endpoint(node, route_decorator, filename))
+                    diags.extend(self._check_response_model(node, route_decorator, filename))
+        return diags
+
+    def _get_route_decorator(self, node: ast.FunctionDef | ast.AsyncFunctionDef) -> ast.Call | None:
+        for dec in node.decorator_list:
+            if isinstance(dec, ast.Call) and isinstance(dec.func, ast.Attribute):
+                if dec.func.attr in _ROUTE_METHODS:
+                    return dec
+        return None
+
+    def _check_sync_endpoint(self, node, decorator, filename):
+        if isinstance(node, ast.FunctionDef):
+            return [
+                Diagnostic(
+                    file_path=filename,
+                    rule="prefer-async-endpoint",
+                    severity=Severity.WARNING,
+                    category=Category.FASTAPI,
+                    message=f"Endpoint '{node.name}' is synchronous — blocks the event loop",
+                    help="Use 'async def' for I/O-bound endpoints",
+                    line=node.lineno,
+                    column=node.col_offset,
+                    cost=1.0,
+                )
+            ]
+        return []
+
+    def _check_response_model(self, node, decorator, filename):
+        has_response_model = any(kw.arg == "response_model" for kw in decorator.keywords)
+        if not has_response_model:
+            return [
+                Diagnostic(
+                    file_path=filename,
+                    rule="missing-response-model",
+                    severity=Severity.WARNING,
+                    category=Category.FASTAPI,
+                    message=f"Endpoint '{node.name}' missing response_model — no response validation",
+                    help="Add response_model parameter to the route decorator",
+                    line=node.lineno,
+                    column=node.col_offset,
+                    cost=1.0,
+                )
+            ]
+        return []

pycodegate/rules/flask.py

@@ -0,0 +1,115 @@
+"""Flask-specific rules: secret key in source, debug mode, SQL via string format."""
+
+from __future__ import annotations
+
+import ast
+import re
+
+from pycodegate.rules.base import BaseRules
+from pycodegate.types import Category, Diagnostic, Severity
+
+_SQL_PATTERN = re.compile(
+    r"(SELECT|INSERT|UPDATE|DELETE|DROP|CREATE|ALTER)\s+",
+    re.IGNORECASE,
+)
+
+
+class FlaskRules(BaseRules):
+    """Flask framework-specific checks."""
+
+    def check(self, source: str, filename: str) -> list[Diagnostic]:
+        tree = self._parse(source)
+        if tree is None:
+            return []
+
+        diags: list[Diagnostic] = []
+        diags.extend(self._check_secret_key(tree, filename))
+        diags.extend(self._check_debug_mode(tree, filename))
+        diags.extend(self._check_sql_string_format(tree, filename))
+        return diags
+
+    def _check_secret_key(self, tree: ast.Module, filename: str) -> list[Diagnostic]:
+        diags: list[Diagnostic] = []
+        for node in ast.walk(tree):
+            if isinstance(node, ast.Assign):
+                for target in node.targets:
+                    if (
+                        isinstance(target, ast.Attribute)
+                        and target.attr == "secret_key"
+                        and isinstance(node.value, ast.Constant)
+                        and isinstance(node.value.value, str)
+                    ):
+                        diags.append(
+                            Diagnostic(
+                                file_path=filename,
+                                rule="no-flask-secret-in-source",
+                                severity=Severity.ERROR,
+                                category=Category.FLASK,
+                                message="Flask secret_key hardcoded in source",
+                                help="Use os.environ['SECRET_KEY'] or a config file",
+                                line=node.lineno,
+                                column=node.col_offset,
+                                cost=3.0,
+                            )
+                        )
+        return diags
+
+    def _check_debug_mode(self, tree: ast.Module, filename: str) -> list[Diagnostic]:
+        diags: list[Diagnostic] = []
+        for node in ast.walk(tree):
+            if not (isinstance(node, ast.Call) and isinstance(node.func, ast.Attribute)):
+                continue
+            if node.func.attr != "run":
+                continue
+            if self._has_debug_true(node):
+                diags.append(
+                    Diagnostic(
+                        file_path=filename,
+                        rule="no-flask-debug-mode",
+                        severity=Severity.ERROR,
+                        category=Category.FLASK,
+                        message="Debug mode enabled — exposes debugger and reloader in production",
+                        help="Use environment variable: app.run(debug=os.environ.get('FLASK_DEBUG'))",
+                        line=node.lineno,
+                        column=node.col_offset,
+                        cost=3.0,
+                    )
+                )
+        return diags
+
+    @staticmethod
+    def _has_debug_true(call_node: ast.Call) -> bool:
+        return any(
+            kw.arg == "debug" and isinstance(kw.value, ast.Constant) and kw.value.value is True
+            for kw in call_node.keywords
+        )
+
+    def _check_sql_string_format(self, tree: ast.Module, filename: str) -> list[Diagnostic]:
+        diags: list[Diagnostic] = []
+        for node in ast.walk(tree):
+            if not isinstance(node, ast.Assign) or not isinstance(node.value, ast.JoinedStr):
+                continue
+            if self._fstring_contains_sql(node.value):
+                diags.append(
+                    Diagnostic(
+                        file_path=filename,
+                        rule="no-sql-string-format",
+                        severity=Severity.ERROR,
+                        category=Category.FLASK,
+                        message="SQL query built with f-string — SQL injection risk",
+                        help="Use parameterized queries with placeholders",
+                        line=node.lineno,
+                        column=node.col_offset,
+                        cost=3.0,
+                    )
+                )
+        return diags
+
+    @staticmethod
+    def _fstring_contains_sql(joined_str: ast.JoinedStr) -> bool:
+        return any(
+            isinstance(val, ast.Constant)
+            and isinstance(val.value, str)
+            and _SQL_PATTERN.search(val.value)
+            for val in joined_str.values
+        )

pycodegate/rules/imports.py

@@ -0,0 +1,96 @@
+"""Import rules: circular dependency detection."""
+
+from __future__ import annotations
+
+import ast
+import os
+from collections import defaultdict
+from pathlib import Path
+
+from pycodegate.types import Category, Diagnostic, Severity
+
+
+class ImportsRules:
+    """Project-level import analysis."""
+
+    def check_project(self, project_path: str, source_files: list[str]) -> list[Diagnostic]:
+        """Detect circular imports across the project."""
+        return self._check_circular_imports(project_path, source_files)
+
+    def _check_circular_imports(
+        self, project_path: str, source_files: list[str]
+    ) -> list[Diagnostic]:
+        # Build import graph: module_name -> set of imported module_names
+        graph: dict[str, set[str]] = defaultdict(set)
+        file_map: dict[str, str] = {}  # module_name -> file_path
+
+        root = Path(project_path).resolve()
+
+        for filepath in source_files:
+            try:
+                source = Path(filepath).read_text()
+                tree = ast.parse(source)
+            except (SyntaxError, OSError, UnicodeDecodeError):
+                continue
+
+            module_name = self._file_to_module(filepath, str(root))
+            if not module_name:
+                continue
+            file_map[module_name] = filepath
+
+            for node in ast.walk(tree):
+                if isinstance(node, ast.Import):
+                    for alias in node.names:
+                        graph[module_name].add(alias.name)
+                elif isinstance(node, ast.ImportFrom):
+                    if node.module and node.level == 0:
+                        graph[module_name].add(node.module)
+
+        # Detect direct A↔B cycles
+        diags: list[Diagnostic] = []
+        seen_pairs: set[tuple[str, str]] = set()
+
+        for mod_a, imports in graph.items():
+            for mod_b in imports:
+                if mod_b in graph and mod_a in graph[mod_b]:
+                    pair = tuple(sorted([mod_a, mod_b]))
+                    if pair not in seen_pairs:
+                        seen_pairs.add(pair)
+                        file_a = file_map.get(mod_a, mod_a)
+                        diags.append(
+                            Diagnostic(
+                                file_path=file_a,
+                                rule="imports/circular",
+                                severity=Severity.ERROR,
+                                category=Category.IMPORTS,
+                                message=f"Circular import between '{mod_a}' and '{mod_b}'",
+                                help="Break the cycle by moving shared code to a third module",
+                                line=1,
+                                cost=3.0,
+                            )
+                        )
+
+        return diags
+
+    def _file_to_module(self, filepath: str, root: str) -> str | None:
+        """Convert a file path to a dotted module name."""
+        try:
+            rel = os.path.relpath(filepath, root)
+        except ValueError:
+            return None
+
+        # Remove .py extension
+        if rel.endswith(".py"):
+            rel = rel[:-3]
+        else:
+            return None
+
+        # Remove __init__ suffix
+        if rel.endswith("__init__"):
+            rel = rel[:-9].rstrip(os.sep)
+
+        if not rel:
+            return None
+
+        # Convert path separators to dots
+        return rel.replace(os.sep, ".").replace("/", ".")

pycodegate/rules/performance.py

@@ -0,0 +1,104 @@
+"""Performance rules: string concat in loops, imports in functions, star imports."""
+
+from __future__ import annotations
+
+import ast
+
+from pycodegate.rules.base import BaseRules
+from pycodegate.types import Category, Diagnostic, Severity
+
+
+class PerformanceRules(BaseRules):
+    """Performance-related checks."""
+
+    def check(self, source: str, filename: str) -> list[Diagnostic]:
+        tree = self._parse(source)
+        if tree is None:
+            return []
+
+        diags: list[Diagnostic] = []
+        diags.extend(self._check_string_concat_in_loop(tree, filename))
+        diags.extend(self._check_import_in_function(tree, filename))
+        diags.extend(self._check_star_imports(tree, filename))
+        return diags
+
+    def _check_string_concat_in_loop(self, tree: ast.Module, filename: str) -> list[Diagnostic]:
+        string_vars = self._find_string_vars(tree)
+
+        diags: list[Diagnostic] = []
+        for node in ast.walk(tree):
+            if isinstance(node, (ast.For, ast.While)):
+                for child in ast.walk(node):
+                    if (
+                        isinstance(child, ast.AugAssign)
+                        and isinstance(child.op, ast.Add)
+                        and isinstance(child.target, ast.Name)
+                        and child.target.id in string_vars
+                    ):
+                        diags.append(
+                            Diagnostic(
+                                file_path=filename,
+                                rule="no-string-concat-in-loop",
+                                severity=Severity.WARNING,
+                                category=Category.PERFORMANCE,
+                                message="String concatenation in a loop — O(n^2) memory",
+                                help="Collect items in a list and use ''.join() at the end",
+                                line=child.lineno,
+                                column=child.col_offset,
+                                cost=0.5,
+                            )
+                        )
+        return diags
+
+    @staticmethod
+    def _find_string_vars(tree: ast.Module) -> set[str]:
+        names: set[str] = set()
+        for node in ast.walk(tree):
+            if not isinstance(node, ast.Assign):
+                continue
+            if not (isinstance(node.value, ast.Constant) and isinstance(node.value.value, str)):
+                continue
+            for target in node.targets:
+                if isinstance(target, ast.Name):
+                    names.add(target.id)
+        return names
+
+    def _check_import_in_function(self, tree: ast.Module, filename: str) -> list[Diagnostic]:
+        diags: list[Diagnostic] = []
+        for node in ast.walk(tree):
+            if isinstance(node, (ast.FunctionDef, ast.AsyncFunctionDef)):
+                for child in ast.walk(node):
+                    if isinstance(child, (ast.Import, ast.ImportFrom)):
+                        diags.append(
+                            Diagnostic(
+                                file_path=filename,
+                                rule="no-import-in-function",
+                                severity=Severity.WARNING,
+                                category=Category.PERFORMANCE,
+                                message="Import inside function body — re-imported on every call",
+                                help="Move imports to the top of the module",
+                                line=child.lineno,
+                                column=child.col_offset,
+                                cost=0.5,
+                            )
+                        )
+        return diags
+
+    def _check_star_imports(self, tree: ast.Module, filename: str) -> list[Diagnostic]:
+        diags: list[Diagnostic] = []
+        for node in ast.walk(tree):
+            if isinstance(node, ast.ImportFrom) and any(alias.name == "*" for alias in node.names):
+                diags.append(
+                    Diagnostic(
+                        file_path=filename,
+                        rule="no-star-import",
+                        severity=Severity.WARNING,
+                        category=Category.PERFORMANCE,
+                        message=f"Star import from {node.module} pollutes namespace and hides dependencies",
+                        help="Import specific names instead",
+                        line=node.lineno,
+                        column=node.col_offset,
+                        cost=0.5,
+                    )
+                )
+        return diags