sarj-python-lint 0.37.0__tar.gz → 0.38.0__tar.gz

{sarj_python_lint-0.37.0 → sarj_python_lint-0.38.0}/PKG-INFO

@@ -1,6 +1,6 @@
 Metadata-Version: 2.4
 Name: sarj-python-lint
-Version: 0.37.0
+Version: 0.38.0
 Summary: Custom Python lint rules — AST-based, pre-commit-friendly, hypermodern defaults
 Project-URL: Homepage, https://github.com/sarj-ai/standards/tree/main/packages/python
 Project-URL: Repository, https://github.com/sarj-ai/standards

{sarj_python_lint-0.37.0 → sarj_python_lint-0.38.0}/pyproject.toml

@@ -1,6 +1,6 @@
 [project]
 name = "sarj-python-lint"
-version = "0.37.0"
+version = "0.38.0"
 description = "Custom Python lint rules — AST-based, pre-commit-friendly, hypermodern defaults"
 readme = "README.md"
 authors = [{ name = "sarj-ai" }]

{sarj_python_lint-0.37.0 → sarj_python_lint-0.38.0}/src/sarj_python_lint/_secret_names.py

@@ -42,7 +42,7 @@ from itertools import pairwise
 import re
 
 
-_SECRET_WORDS = frozenset(
+SECRET_WORDS = frozenset(
     {
         "token",
         "secret",
@@ -59,9 +59,16 @@ _SECRET_WORDS = frozenset(
         "digest",
         "hash",
         "apikey",
+        # `bearer` is in the TypeScript twin's SECRET_WORDS and was in neither
+        # Python set, so `bearer == provided` was a flagged timing attack in one
+        # engine and silent in the other. The lists are otherwise identical,
+        # which is exactly what made the gap invisible.
+        "bearer",
     }
 )
 
+_SECRET_WORDS = SECRET_WORDS
+
 # Tokens that mark a counter, row-id, feature flag, or boolean presence/state
 # marker. As the TRAILING token they mean the identifier is metadata *about* a
 # secret, not the secret itself, so it is not a leak / timing surface even when a
@@ -165,7 +172,7 @@ def is_secret_name(identifier: str) -> bool:
         return False
     if leading_word(identifier) in _FLAG_PREFIXES:
         return False
-    if any(tok in _SECRET_WORDS for tok in tokens):
+    if any(tok in SECRET_WORDS for tok in tokens):
         return True
     return _has_api_key(tokens)
 

{sarj_python_lint-0.37.0 → sarj_python_lint-0.38.0}/src/sarj_python_lint/rules/_logging.py

@@ -17,6 +17,29 @@ _LOGGER_NAMES = frozenset({"logger", "log", "logging", "loguru", "_logger", "_lo
 LOGGER_FACTORIES = frozenset({"getlogger", "get_logger"})
 _LOGGER_FACTORIES = LOGGER_FACTORIES
 
+# Public: the `.attr` of a logging call. SARJ012 (secret-in-log) once carried a
+# SHORTER list than SARJ017 (f-string-in-log) -- 7 names against 11 -- so
+# `logger.success("auth", token=token)` was a log call to one rule and not to
+# the other, and the SECURITY rule was the one that could not see it. `success`,
+# `trace` and `log` are documented loguru levels and `loguru` is already in
+# `_LOGGER_NAMES`, so the omission was a silent false negative on a real idiom.
+# One set, imported everywhere, is what stops that recurring.
+LOG_METHODS = frozenset(
+    {
+        "critical",
+        "debug",
+        "error",
+        "exception",
+        "fatal",
+        "info",
+        "log",
+        "success",
+        "trace",
+        "warn",
+        "warning",
+    }
+)
+
 
 def is_logger_expr(expr: ast.expr) -> bool:
     """Report whether `expr` evaluates to a logger.

{sarj_python_lint-0.37.0 → sarj_python_lint-0.38.0}/src/sarj_python_lint/rules/no_fstring_in_log.py

@@ -11,29 +11,13 @@ from typing import TYPE_CHECKING, override
 
 from sarj_python_lint.rule_base import Diagnostic, Rule, parse_or_none
 from sarj_python_lint.rules._ast_index import nodes
-from sarj_python_lint.rules._logging import LOGGER_FACTORIES, is_logger_expr
+from sarj_python_lint.rules._logging import LOG_METHODS, LOGGER_FACTORIES, is_logger_expr
 
 
 if TYPE_CHECKING:
     from pathlib import Path
 
 
-_LOG_METHODS = frozenset(
-    {
-        "debug",
-        "info",
-        "warning",
-        "warn",
-        "error",
-        "exception",
-        "critical",
-        "fatal",
-        "trace",
-        "success",
-        "log",
-    }
-)
-
 # Keyword arguments defined by stdlib `logging` (and never structured fields).
 # Their presence marks the call as a stdlib logger, for which the loguru-style
 # structured-keyword rewrite is wrong.
@@ -97,7 +81,7 @@ def _candidates(tree: ast.Module) -> list[tuple[ast.Call, ast.JoinedStr]]:
 
 def _is_logging_call(node: ast.Call) -> bool:
     func = node.func
-    if not isinstance(func, ast.Attribute) or func.attr not in _LOG_METHODS:
+    if not isinstance(func, ast.Attribute) or func.attr not in LOG_METHODS:
         return False
     return is_logger_expr(func.value)
 

{sarj_python_lint-0.37.0 → sarj_python_lint-0.38.0}/src/sarj_python_lint/rules/no_secret_in_log.py

@@ -13,16 +13,13 @@ from typing import TYPE_CHECKING, override
 from sarj_python_lint._secret_names import identifier_tokens, is_secret_name
 from sarj_python_lint.rule_base import Diagnostic, Rule, parse_or_none
 from sarj_python_lint.rules._ast_index import nodes
-from sarj_python_lint.rules._logging import is_logger_expr
+from sarj_python_lint.rules._logging import LOG_METHODS, is_logger_expr
 
 
 if TYPE_CHECKING:
     from pathlib import Path
 
 
-# Logging method names (the `.attr` of the call's func).
-_LOG_METHODS = frozenset({"debug", "info", "warning", "warn", "error", "exception", "critical"})
-
 # A redaction marker (`token_prefix`, `password_hash`, `secret_masked`,
 # `api_key_tag`) means the keyword carries a masked/derived value, not the raw
 # secret — the intended safe form.
@@ -88,6 +85,6 @@ def _is_logging_call(node: ast.Call) -> bool:
     func = node.func
     if not isinstance(func, ast.Attribute):
         return False
-    if func.attr not in _LOG_METHODS:
+    if func.attr not in LOG_METHODS:
         return False
     return is_logger_expr(func.value)

{sarj_python_lint-0.37.0 → sarj_python_lint-0.38.0}/src/sarj_python_lint/rules/no_sentinel_return_on_except.py

@@ -12,6 +12,7 @@ from typing import TYPE_CHECKING, override
 
 from sarj_python_lint.rule_base import Diagnostic, Rule, parse_or_none
 from sarj_python_lint.rules._ast_index import children, nodes, walk
+from sarj_python_lint.rules._logging import LOG_METHODS
 
 
 if TYPE_CHECKING:
@@ -375,20 +376,6 @@ def _is_sentinel(value: ast.expr) -> bool:
     return False
 
 
-_LOG_METHODS: frozenset[str] = frozenset(
-    {
-        "debug",
-        "info",
-        "warning",
-        "warn",
-        "error",
-        "exception",
-        "critical",
-        "fatal",
-    }
-)
-
-
 def _handler_logs_before_return(handler: ast.ExceptHandler) -> bool:
     """Report whether some logging call can reach the handler's final sentinel return."""
     _, logged_fallthrough = _list_props(handler.body[:-1])
@@ -502,7 +489,7 @@ def _is_logging_call(node: ast.AST) -> bool:
     if not isinstance(node, ast.Call):
         return False
     func = node.func
-    if not isinstance(func, ast.Attribute) or func.attr not in _LOG_METHODS:
+    if not isinstance(func, ast.Attribute) or func.attr not in LOG_METHODS:
         return False
     return _is_logger_receiver(func.value)
 

{sarj_python_lint-0.37.0 → sarj_python_lint-0.38.0}/src/sarj_python_lint/rules/prefer_constant_time_secret_compare.py

@@ -57,6 +57,11 @@ _AUTH_WORDS = frozenset(
         "signature",
         "hmac",
         "apikey",
+        # `bearer` was in the TypeScript twin's AUTH_WORDS and in neither Python
+        # list, so `bearer == provided` was a flagged timing attack in TS and a
+        # silent one here. The two lists are otherwise identical, which is what
+        # made the gap invisible.
+        "bearer",
     }
 )
 

{sarj_python_lint-0.37.0 → sarj_python_lint-0.38.0}/src/sarj_python_lint/rules/prefer_fstring_over_concat.py

@@ -14,7 +14,7 @@ from typing import TYPE_CHECKING, override
 
 from sarj_python_lint.rule_base import Diagnostic, Rule, parse_or_none
 from sarj_python_lint.rules._ast_index import nodes, walk
-from sarj_python_lint.rules._logging import is_logger_expr
+from sarj_python_lint.rules._logging import LOG_METHODS, is_logger_expr
 from sarj_python_lint.rules._paths import is_generated
 
 
@@ -24,21 +24,6 @@ if TYPE_CHECKING:
 
 # Method names that make a logger-receiver call a logging call. Kept in sync by
 # construction with SARJ017's list; the receiver test is the shared helper.
-_LOG_METHODS = frozenset(
-    {
-        "debug",
-        "info",
-        "warning",
-        "warn",
-        "error",
-        "exception",
-        "critical",
-        "fatal",
-        "trace",
-        "success",
-        "log",
-    }
-)
 
 # A literal ENDING in an UPPERCASE SQL keyword is a query fragment awaiting
 # interpolation — ruff's S608 and SARJ021 own that shape. Anchored at the end,
@@ -174,7 +159,7 @@ def _comment_lines(source: str) -> frozenset[int]:
 def _is_logging_call(node: ast.Call) -> bool:
     """Report whether `node` is a logging call, using SARJ017's receiver resolver."""
     func = node.func
-    if not isinstance(func, ast.Attribute) or func.attr not in _LOG_METHODS:
+    if not isinstance(func, ast.Attribute) or func.attr not in LOG_METHODS:
         return False
     return is_logger_expr(func.value)