sarj-python-lint 1.26.1__tar.gz → 1.26.3__tar.gz

{sarj_python_lint-1.26.1 → sarj_python_lint-1.26.3}/PKG-INFO

@@ -1,6 +1,6 @@
 Metadata-Version: 2.5
 Name: sarj-python-lint
-Version: 1.26.1
+Version: 1.26.3
 Summary: Custom Python lint rules — AST-based, pre-commit-friendly, hypermodern defaults
 Project-URL: Homepage, https://code-standards.sarj.ai/rules/python/
 Project-URL: Documentation, https://code-standards.sarj.ai/rules/python/

{sarj_python_lint-1.26.1 → sarj_python_lint-1.26.3}/pyproject.toml

@@ -1,6 +1,6 @@
 [project]
 name = "sarj-python-lint"
-version = "1.26.1"
+version = "1.26.3"
 description = "Custom Python lint rules — AST-based, pre-commit-friendly, hypermodern defaults"
 readme = "README.md"
 authors = [{ name = "sarj-ai" }]

{sarj_python_lint-1.26.1 → sarj_python_lint-1.26.3}/src/sarj_python_lint/interpreter_argv.py

@@ -139,6 +139,10 @@ def _value_wrapper_index(arguments: Sequence[str], command: str) -> int:
     return index + int(command == "timeout")
 
 
+def is_python_executable(executable: str) -> bool:
+    return re.fullmatch(r"python(?:[23](?:\.\d+)?)?", PurePosixPath(executable).name) is not None
+
+
 def classify_interpreter(argv: Sequence[str]) -> InterpreterInvocation:
     try:
         arguments = unwrap_command(argv)
@@ -147,7 +151,7 @@ def classify_interpreter(argv: Sequence[str]) -> InterpreterInvocation:
     if not arguments:
         return InterpreterInvocation("other")
     executable = PurePosixPath(arguments[0]).name
-    if re.fullmatch(r"python(?:[23](?:\.\d+)?)?", executable):
+    if is_python_executable(executable):
         return _python(arguments[1:])
     if executable in _SHELLS:
         return _short_options(arguments[1:], source="c", values=frozenset({"o", "O"}), shell_mode=True)

{sarj_python_lint-1.26.1 → sarj_python_lint-1.26.3}/src/sarj_python_lint/rule_base.py

@@ -37,7 +37,7 @@ TESTS_DIR: Final = "packages/python/tests/rules"
 
 # Keep SARJ suppressions separate because Ruff removes unknown `noqa` codes.
 _SARJ_NOQA_RE = re.compile(
-    r"#\s*sarj-noqa(?::\s*([A-Za-z0-9_, ]+))?",
+    r"#\s*sarj-noqa\b(?::\s*([A-Za-z0-9_, ]+))?",
     re.IGNORECASE,
 )
 
@@ -49,12 +49,25 @@ def is_suppressed(source_lines: Sequence[str], line: int, code: str) -> bool:
     m = _SARJ_NOQA_RE.search(text)
     if not m:
         return False
+    from sarj_python_lint.rules._suppression_comments import comment_lines  # ruff: ignore[import-outside-top-level] -- comment scanner depends on rule_base.
+
+    comment = comment_lines(tuple(source_lines)).get(line, "")
+    m = _SARJ_NOQA_RE.search(comment)
+    if m is None:
+        return False
     codes_str = m.group(1)
-    if not codes_str:
-        # A bare sarj-noqa intentionally suppresses every SARJ code on its line.
-        return True
-    codes = {val.upper() for c in codes_str.split(",") if (val := c.strip())}
-    return code.upper() in codes
+    trailing = comment[m.end() :]
+    if codes_str is None:
+        # A complete bare marker preserves the existing all-codes waiver contract.
+        return not (trailing and (not trailing[0].isspace() or trailing.lstrip().startswith(":")))
+    reason = trailing.lstrip()
+    single_dash_reason = reason.startswith("-") and (codes_str[-1:].isspace() or trailing[:1].isspace())
+    if reason and not reason.startswith(("--", "—", "–")) and not single_dash_reason:
+        return False
+    parts = tuple(part.strip() for part in codes_str.split(","))
+    if any(not part for part in parts):
+        return False
+    return code.upper() in {part.upper() for part in parts}
 
 
 class ColumnEncoding(StrEnum):

{sarj_python_lint-1.26.1 → sarj_python_lint-1.26.3}/src/sarj_python_lint/rules/_suppression_comments.py

@@ -1,11 +1,18 @@
 from __future__ import annotations
 
 from dataclasses import dataclass
+from functools import lru_cache
 import tokenize
+from types import MappingProxyType
+from typing import TYPE_CHECKING
 
 from sarj_python_lint.rules._comments import all_comments
 
 
+if TYPE_CHECKING:
+    from collections.abc import Mapping
+
+
 @dataclass(frozen=True, slots=True)
 class Comment:
     line: int
@@ -34,3 +41,10 @@ def scan_comments_or_none(source: str) -> list[Comment] | None:
         return scan_comments(source)
     except tokenize.TokenError, SyntaxError:
         return None
+
+
+@lru_cache(maxsize=1)
+def comment_lines(source_lines: tuple[str, ...]) -> Mapping[int, str]:
+    return MappingProxyType(
+        {comment.line: "# " + comment.body for comment in scan_comments_or_none("\n".join(source_lines)) or ()}
+    )

{sarj_python_lint-1.26.1 → sarj_python_lint-1.26.3}/src/sarj_python_lint/rules/no_interpreter_source_arguments.py

@@ -2,10 +2,11 @@ from __future__ import annotations
 
 import ast
 from dataclasses import dataclass
+import io
 from pathlib import PurePosixPath
 from typing import TYPE_CHECKING, ClassVar, final, override
 
-from sarj_python_lint.interpreter_argv import classify_interpreter
+from sarj_python_lint.interpreter_argv import classify_interpreter, is_python_executable, unwrap_command
 from sarj_python_lint.rule_base import (
     AutofixPolicy,
     Diagnostic,
@@ -45,8 +46,8 @@ class NoInterpreterSourceArguments(ProjectRule):
     code = "SARJ484"
     documentation: ClassVar[RuleDocumentation | None] = RuleDocumentation(
         default_level=Severity.ERROR,
-        summary="Keep interpreter programs in linted files or modules, outside process argv.",
-        rationale="Moving deployment logic from YAML into Python still bypasses language checks when the Python wrapper passes program source through interpreter flags or jq/awk argv.",
+        summary="Keep interpreter programs in linted files or modules, outside process argv and literal Python stdin.",
+        rationale="Moving deployment logic from YAML into Python still bypasses language checks when the Python wrapper passes program source through interpreter flags, jq/awk argv, or literal Python stdin.",
         remediation="Invoke a repository-owned file or module covered by the normal language checks; pass configuration as arguments rather than interpreter source.",
         category=RuleCategory.ARCHITECTURE,
         autofix=AutofixPolicy.NONE,
@@ -54,6 +55,7 @@ class NoInterpreterSourceArguments(ProjectRule):
             "Only import-proven subprocess process APIs, asyncio.create_subprocess_exec, and os exec/spawn argv APIs with literal string vectors are checked. Import aliases are followed; shadowed or reassigned imports and methods abstain.",
             "Script/module and interpreter option boundaries use the shared dependency-free classifier, including env/sudo/timeout wrappers and jq/awk file flags.",
             "Dynamic argv, shell strings and shell=True, recursive shell payloads, receiver-based remote execution, and unknown interpreter option grammars are outside this narrow rule. A clean result does not prove those programs are linted.",
+            "Literal str/bytes input to subprocess.run/check_output is checked only for proven Python stdin invocations and compatible constant text/binary modes. Dynamic input, Popen.communicate, and asyncio stdin abstain.",
             "Generated/vendor sources are excluded; maintained tests are checked. Source-checker fixtures may use an exact reasoned suppression.",
         ),
         examples=(
@@ -85,6 +87,36 @@ class NoInterpreterSourceArguments(ProjectRule):
                 expected_count=0,
                 public=True,
             ),
+            RuleExample(
+                example_id="literal-python-stdin",
+                scenario="stdin",
+                title="Process stdin contains unchecked Python source",
+                outcome=ExampleOutcome.MATCH,
+                files=(
+                    ExampleFile.python(
+                        "tools/check.py",
+                        "import subprocess\nsubprocess.run(['python3', '-'], input='print(1)', text=True)\n",
+                    ),
+                ),
+                focus_path=PurePosixPath("tools/check.py"),
+                expected_count=1,
+                public=True,
+            ),
+            RuleExample(
+                example_id="external-module-stdin-data",
+                scenario="stdin",
+                title="An external module receives stdin as data",
+                outcome=ExampleOutcome.NO_MATCH,
+                files=(
+                    ExampleFile.python(
+                        "tools/check.py",
+                        "import subprocess\nsubprocess.run(['python3', '-m', 'tools.verify'], input='print(1)', text=True)\n",
+                    ),
+                ),
+                focus_path=PurePosixPath("tools/check.py"),
+                expected_count=0,
+                public=True,
+            ),
         ),
     )
     description = documentation.summary
@@ -106,7 +138,13 @@ class NoInterpreterSourceArguments(ProjectRule):
             if sink is None or sink in replaced or is_suppressed(context.source_lines, call.lineno, self.code):
                 continue
             argv = _literal_argv(call, sink)
-            if argv is None or classify_interpreter(argv).kind != "inline":
+            if argv is None:
+                continue
+            kind = classify_interpreter(argv).kind
+            channel = "process argv" if kind == "inline" else None
+            if kind == "stdin" and _literal_python_stdin(call, sink, argv):
+                channel = "process stdin"
+            if channel is None:
                 continue
             findings.append(
                 Diagnostic(
@@ -114,13 +152,65 @@ class NoInterpreterSourceArguments(ProjectRule):
                     line=call.lineno,
                     col=call.col_offset + 1,
                     code=self.code,
-                    message="Interpreter source is embedded in process argv; invoke a linted repository-owned file or module instead.",
+                    message=f"Interpreter source is embedded in {channel}; invoke a linted repository-owned file or module instead.",
                     severity=Severity.ERROR,
                 )
             )
         return findings
 
 
+def _literal_python_stdin(call: ast.Call, sink: str, argv: tuple[str, ...]) -> bool:
+    if sink not in {"subprocess.run", "subprocess.check_output"}:
+        return False
+    arguments = unwrap_command(argv)  # The shared classifier already proved these wrappers.
+    if not arguments or not is_python_executable(arguments[0]):
+        return False
+    literal = _argument(call, "input", len(call.args))
+    if not isinstance(literal, ast.Constant) or not isinstance(literal.value, (str, bytes)):
+        return False
+    if not _compatible_stdin(call, literal.value):
+        return False
+    try:
+        return bool(ast.parse(literal.value).body)
+    except SyntaxError, ValueError:
+        return True
+
+
+def _compatible_stdin(call: ast.Call, payload: str | bytes) -> bool:
+    modes: dict[str, object] = {}
+    for name in ("stdin", "text", "universal_newlines", "encoding", "errors"):
+        option = _argument(call, name, len(call.args))
+        if option is not None and not isinstance(option, ast.Constant):
+            return False
+        modes[name] = option.value if isinstance(option, ast.Constant) else None
+    if modes["stdin"] is not None:
+        return False
+    text, universal = modes["text"], modes["universal_newlines"]
+    if text not in {None, True, False} or universal not in {None, True, False}:
+        return False
+    if text is not None and universal is not None and bool(text) != bool(universal):
+        return False
+    encoding, errors = modes["encoding"], modes["errors"]
+    if encoding is not None and not isinstance(encoding, str):
+        return False
+    if errors is not None and not isinstance(errors, str):
+        return False
+    text_mode = bool(text or universal or encoding or errors)
+    if isinstance(payload, str) != text_mode:
+        return False
+    return not isinstance(payload, str) or _text_input_valid(payload, encoding, errors)
+
+
+def _text_input_valid(payload: str, encoding: str | None, errors: str | None) -> bool:
+    try:
+        with io.TextIOWrapper(io.BytesIO(), encoding=encoding, errors=errors) as stream:
+            stream.write(payload)
+            stream.flush()
+    except LookupError, UnicodeError, ValueError:
+        return False
+    return True
+
+
 def _literal_argv(call: ast.Call, sink: str) -> tuple[str, ...] | None:
     if any(keyword.arg is None for keyword in call.keywords):
         return None  # Expanded options can replace the executable or enable shell=True.