sarj-python-lint 1.40.2__tar.gz → 1.41.2__tar.gz

{sarj_python_lint-1.40.2 → sarj_python_lint-1.41.2}/PKG-INFO

@@ -1,6 +1,6 @@
 Metadata-Version: 2.5
 Name: sarj-python-lint
-Version: 1.40.2
+Version: 1.41.2
 Summary: Custom Python lint rules — AST-based, pre-commit-friendly, hypermodern defaults
 Project-URL: Homepage, https://code-standards.sarj.ai/rules/python/
 Project-URL: Documentation, https://code-standards.sarj.ai/rules/python/

{sarj_python_lint-1.40.2 → sarj_python_lint-1.41.2}/pyproject.toml

@@ -1,6 +1,6 @@
 [project]
 name = "sarj-python-lint"
-version = "1.40.2"
+version = "1.41.2"
 description = "Custom Python lint rules — AST-based, pre-commit-friendly, hypermodern defaults"
 readme = "README.md"
 authors = [{ name = "sarj-ai" }]

{sarj_python_lint-1.40.2 → sarj_python_lint-1.41.2}/src/sarj_python_lint/rules/_nominal_project.py

@@ -12,6 +12,7 @@ from packaging.requirements import InvalidRequirement, Requirement
 from packaging.utils import canonicalize_name
 
 from sarj_python_lint._source import read_python_source
+from sarj_python_lint.rules._ast_index import NodeIndex
 from sarj_python_lint.rules._first_party import distribution_root
 from sarj_python_lint.rules._imports import ImportIndex
 from sarj_python_lint.rules._paths import is_generated
@@ -33,6 +34,11 @@ class NominalSource:
     path: Path
     text: str
 
+    @cached_property
+    def node_index(self) -> NodeIndex | None:
+        tree = self.tree
+        return NodeIndex(tree) if tree is not None else None
+
     @cached_property
     def tree(self) -> ast.Module | None:
         try:
@@ -49,12 +55,13 @@ class NominalSource:
     @cached_property
     def imports(self) -> ImportIndex:
         tree = self.tree
-        if tree is None:
+        node_index = self.node_index
+        if tree is None or node_index is None:
             return ImportIndex(MappingProxyType({}), frozenset())
         imports = ImportIndex.from_tree(tree)
         mutated = {
             ast.unparse(node).partition(".")[0]
-            for node in ast.walk(tree)
+            for node in node_index.query((ast.Attribute,))
             if isinstance(node, ast.Attribute) and isinstance(node.ctx, (ast.Store, ast.Del))
         }
         return ImportIndex(

{sarj_python_lint-1.40.2 → sarj_python_lint-1.41.2}/src/sarj_python_lint/rules/_resource_provenance.py

@@ -95,9 +95,22 @@ class ResourceProvenance:
 
     def scope(self, node: ast.AST) -> ast.AST | None:
         parent = self.context.parents.get(node)
-        while parent is not None and not isinstance(parent, _SCOPES):
+        while parent is not None:
+            if isinstance(parent, ast.arguments) and (node in parent.defaults or node in parent.kw_defaults):
+                parent = self.context.parents.get(parent)
+            elif isinstance(parent, _SCOPES) and not (
+                (
+                    isinstance(parent, ast.FunctionDef | ast.AsyncFunctionDef | ast.ClassDef)
+                    and node in parent.decorator_list
+                )
+                or (isinstance(parent, ast.ClassDef) and (node in parent.bases or node in parent.keywords))
+            ):
+                return parent
+            if parent is None:
+                return None
+            node = parent
             parent = self.context.parents.get(parent)
-        return parent
+        return None
 
     def _binding_scope(self, node: ast.AST) -> ast.AST | None:
         scope = self.scope(node)

{sarj_python_lint-1.40.2 → sarj_python_lint-1.41.2}/src/sarj_python_lint/rules/no_cors_wildcard_with_credentials.py

@@ -14,7 +14,6 @@ from sarj_python_lint.rule_base import (
     RuleDocumentation,
     RuleExample,
 )
-from sarj_python_lint.rules._ast_index import walk
 
 
 if TYPE_CHECKING:
@@ -37,8 +36,8 @@ class NoCorsWildcardWithCredentials(Rule):
         category=RuleCategory.SECURITY,
         autofix=AutofixPolicy.NONE,
         limitations=(
-            'The rule requires literal `True` for `allow_credentials` and either a literal `"*"` below `allow_origins` or an exact universal `allow_origin_regex` literal.',
-            "Dynamically computed credential flags and origin collections are not resolved.",
+            'The rule requires literal `True` for `allow_credentials` and either a direct `"*"` origin in a literal collection or an exact universal `allow_origin_regex` literal. Literal keyword dictionaries and their effective nested unpacks are inspected.',
+            "Conditional origin collections are checked in each possible branch. Calls, comprehensions, nested non-string elements, dynamic keyword unpacks, computed credential flags, and variable origin collections are not resolved.",
         ),
         examples=(
             RuleExample(
@@ -86,7 +85,7 @@ class NoCorsWildcardWithCredentials(Rule):
         for node in context.nodes(ast.Call):
             if not _is_cors_construction(node, imports):
                 continue
-            keywords = {arg: kw.value for kw in node.keywords if (arg := kw.arg) is not None}
+            keywords = _effective_keywords(node)
             credentials = keywords.get("allow_credentials")
             origins = keywords.get("allow_origins")
             origin_regex = keywords.get("allow_origin_regex")
@@ -121,7 +120,52 @@ def _is_true_literal(node: ast.expr) -> bool:
 
 
 def _contains_star_literal(node: ast.expr) -> bool:
-    return any(isinstance(child, ast.Constant) and child.value == "*" for child in walk(node))
+    match node:
+        case ast.Constant(value="*"):
+            return True
+        case ast.List(elts=elements) | ast.Tuple(elts=elements) | ast.Set(elts=elements):
+            return any(
+                (isinstance(element, ast.Constant) and element.value == "*")
+                or (isinstance(element, ast.Starred) and _contains_star_literal(element.value))
+                for element in elements
+            )
+        case ast.IfExp(body=body, orelse=orelse):
+            return _contains_star_literal(body) or _contains_star_literal(orelse)
+        case ast.BoolOp(values=values):
+            return any(_contains_star_literal(value) for value in values)
+        case _:
+            return False
+
+
+def _effective_keywords(node: ast.Call) -> dict[str, ast.expr]:
+    values: dict[str, ast.expr] = {}
+    for keyword in node.keywords:
+        if keyword.arg is not None:
+            values[keyword.arg] = keyword.value
+        elif isinstance(keyword.value, ast.Dict):
+            literal_values = _literal_dictionary_values(keyword.value)
+            if literal_values is None:
+                values.clear()
+            else:
+                values.update(literal_values)
+        else:
+            values.clear()
+    return values
+
+
+def _literal_dictionary_values(node: ast.Dict) -> dict[str, ast.expr] | None:
+    values: dict[str, ast.expr] = {}
+    for key, value in zip(node.keys, node.values, strict=True):
+        if isinstance(key, ast.Constant) and isinstance(key.value, str):
+            values[key.value] = value
+        elif key is None and isinstance(value, ast.Dict):
+            nested_values = _literal_dictionary_values(value)
+            if nested_values is None:
+                return None
+            values.update(nested_values)
+        else:
+            return None
+    return values
 
 
 def _is_cors_construction(node: ast.Call, imports: ImportIndex) -> bool:

{sarj_python_lint-1.40.2 → sarj_python_lint-1.41.2}/src/sarj_python_lint/rules/no_loguru_printf_format.py

@@ -49,7 +49,7 @@ class NoLoguruPrintfFormat(Rule):
         autofix=AutofixPolicy.NONE,
         limitations=(
             "Only unambiguous module-level Loguru imports and immediate bind/opt chains with a literal message and supplied positional formatting arguments are checked.",
-            "The message must contain a valid percent conversion and no brace fields. Escaped percent signs alone, malformed templates, dynamic messages and expanded arguments are excluded.",
+            "The decoded literal message must contain a valid percent conversion and no brace fields; Unicode and hex escapes preserve conversions. Escaped percent signs alone, malformed templates, dynamic messages and expanded arguments are excluded.",
             "Standard logging, unknown receivers, stored aliases, shadowed or escaped imports, custom wrapper chains, keyword-only fields and generated files are excluded.",
             "Visible namespace or logger mutations invalidate import proof. Interprocedural effects and runtime monkeypatches are not resolved.",
             "Argument types and printf arity are not inferred. The warning requests review; no automatic conversion changes formatting or structured logging contracts.",
@@ -89,7 +89,7 @@ class NoLoguruPrintfFormat(Rule):
 
     @override
     def check_context(self, context: PythonFileContext) -> list[Diagnostic]:
-        if "%" not in context.source or "loguru" not in context.source or context.generated or context.tree is None:
+        if "loguru" not in context.source or context.generated or context.tree is None:
             return []
         provenance: ResourceProvenance | None = None
         diagnostics: list[Diagnostic] = []

{sarj_python_lint-1.40.2 → sarj_python_lint-1.41.2}/src/sarj_python_lint/rules/no_offset_pagination.py

@@ -30,6 +30,13 @@ _OFFSET_PAGINATION = re.compile(
     re.IGNORECASE,
 )
 _MYSQL_OFFSET_PAGINATION = re.compile(rf"\bLIMIT\s+{_DYNAMIC_VALUE}\s*,", re.IGNORECASE)
+_OFFSET_START = re.compile(r"\bOFFSET\b\s+", re.IGNORECASE)
+_NUMERIC_OFFSET_TOKEN = re.compile(
+    rf"{_DYNAMIC_VALUE}|\d+(?:\.\d+)?|(?:GREATEST|LEAST|COALESCE|ABS|CEIL|CEILING|FLOOR)\b|[-()+*/%,]",
+    re.IGNORECASE,
+)
+_DYNAMIC_TOKEN = re.compile(_DYNAMIC_VALUE)
+_OFFSET_END = re.compile(r"\s*(?:ROWS?\b|FETCH\b|FOR\b|LIMIT\b|[);]|$)", re.IGNORECASE)
 _QUERY_SHAPE = re.compile(r"\bSELECT\b[\s\S]*?\bFROM\b", re.IGNORECASE)
 _MIGRATION_PARTS = frozenset({"migration", "migrations"})
 _QUOTED_IDENTIFIER = re.compile(r"`[^`\n]*`|\[[^\]\n]*\]")
@@ -55,6 +62,7 @@ class NoOffsetPagination(Rule):
         limitations=(
             "Only SQL string literals in recognized store modules are analyzed.",
             "Only dynamic OFFSET values in credible SELECT queries are reported; fixed ordinal offsets are excluded.",
+            "Parenthesized arithmetic and common numeric wrappers such as GREATEST, LEAST, and COALESCE preserve the dynamic driver marker. Arbitrary SQL functions and procedural values remain opaque.",
             "Generated files, migrations, docstrings, comments, quoted identifiers, and BigQuery `WITH OFFSET AS` array indexing are excluded.",
             "ORM pagination APIs are outside this embedded-SQL rule.",
         ),
@@ -117,7 +125,7 @@ class NoOffsetPagination(Rule):
 
             sql = _mask_dialect_noise(strip_sql_noise(text))
             if _QUERY_SHAPE.search(sql) is None or (
-                _OFFSET_PAGINATION.search(sql) is None and _MYSQL_OFFSET_PAGINATION.search(sql) is None
+                not _has_dynamic_numeric_offset(sql) and _MYSQL_OFFSET_PAGINATION.search(sql) is None
             ):
                 continue
 
@@ -138,6 +146,27 @@ class NoOffsetPagination(Rule):
         return diags
 
 
+def _has_dynamic_numeric_offset(sql: str) -> bool:
+    if _OFFSET_PAGINATION.search(sql) is not None:
+        return True
+    for start in _OFFSET_START.finditer(sql):
+        cursor, depth, dynamic = start.end(), 0, False
+        while cursor < len(sql):
+            if sql[cursor].isspace():
+                cursor += 1
+                continue
+            token = _NUMERIC_OFFSET_TOKEN.match(sql, cursor)
+            if token is None or (token.group() == ")" and depth == 0):
+                break
+            value = token.group()
+            depth += int(value == "(") - int(value == ")")
+            dynamic |= _DYNAMIC_TOKEN.fullmatch(value) is not None
+            cursor = token.end()
+        if dynamic and depth == 0 and _OFFSET_END.match(sql, cursor) is not None:
+            return True
+    return False
+
+
 def _sql_value(node: ast.expr) -> str | None:
     if isinstance(node, ast.JoinedStr):
         pieces: list[str] = []

{sarj_python_lint-1.40.2 → sarj_python_lint-1.41.2}/src/sarj_python_lint/rules/no_random_uuid_in_sql.py

@@ -22,7 +22,7 @@ if TYPE_CHECKING:
     from sarj_python_lint._file_context import PythonFileContext
 
 
-_RANDOM_UUID_RE = re.compile(r"\b(?:gen_random_uuid|uuid_generate_v4)\s*\(", re.IGNORECASE)
+_RANDOM_UUID_RE = re.compile(r"(?<![\w$])(?:gen_random_uuid|uuid_generate_v4)\s*\(", re.IGNORECASE)
 
 
 @dataclass(frozen=True, slots=True)
@@ -155,7 +155,7 @@ def _inside_uuidv7_builder(sql: str, position: int) -> bool:
 
 def _identifier_end(sql: str, index: int, position: int) -> _IdentifierEnd:
     end = index + 1
-    while end < position and (sql[end].isalnum() or sql[end] == "_"):
+    while end < position and (sql[end].isalnum() or sql[end] in {"_", "$"}):
         end += 1
     after = end
     while after < position and sql[after].isspace():

{sarj_python_lint-1.40.2 → sarj_python_lint-1.41.2}/src/sarj_python_lint/rules/no_secret_in_log.py

@@ -18,6 +18,7 @@ from sarj_python_lint.rules._logging import LOG_METHODS, is_logger_expr
 
 
 if TYPE_CHECKING:
+    from collections.abc import Iterable
     from pathlib import Path
 
     from sarj_python_lint._file_context import PythonFileContext
@@ -53,19 +54,31 @@ def _is_secret_keyword(name: str) -> bool:
 
 
 def _unsafe_message_values(value: ast.expr) -> tuple[ast.expr, ...]:
+    if _is_raw_secret_reference(value):
+        return (value,)
     match value:
         case ast.JoinedStr(values=parts):
             return _unsafe_formatted_values(parts)
+        case ast.BinOp(op=ast.Add(), left=left, right=right):
+            return (*_unsafe_message_values(left), *_unsafe_message_values(right))
+        case ast.List(elts=elements) | ast.Tuple(elts=elements) | ast.Set(elts=elements):
+            return tuple(secret for element in elements for secret in _unsafe_message_values(element))
+        case ast.Dict():
+            return _literal_mapping_secret_values(value)
         case ast.BinOp(op=ast.Mod(), right=right):
             values = right.elts if isinstance(right, (ast.Tuple, ast.List)) else (right,)
-            return tuple(item for item in values if _is_raw_secret_reference(item))
+            return _raw_secret_values(values)
         case ast.Call(func=ast.Attribute(value=ast.Constant(value=str()), attr="format"), args=args, keywords=keywords):
             values = (*args, *(keyword.value for keyword in keywords))
-            return tuple(item for item in values if _is_raw_secret_reference(item))
+            return _raw_secret_values(values)
         case _:
             return ()
 
 
+def _raw_secret_values(values: Iterable[ast.expr]) -> tuple[ast.expr, ...]:
+    return tuple(value for value in values if _is_raw_secret_reference(value))
+
+
 class NoSecretInLog(Rule):
     id: str = "no-secret-in-log"
     code: str = "SARJ012"
@@ -75,7 +88,7 @@ class NoSecretInLog(Rule):
         remediation="Omit the credential or log only approved non-sensitive metadata through a centralized sanitizer.",
         category=RuleCategory.SECURITY,
         limitations=(
-            "Detection covers direct secret-named names, terminal attributes, constant secret-key subscripts, identity slices, f-string and literal format arguments, nested literal extra mappings, literal keyword unpacking, and immediate structured-logger bindings.",
+            "Detection covers direct secret-named message and argument values, terminal attributes, constant secret-key subscripts, identity slices, f-string and literal format arguments, string concatenation, nested literal containers, literal keyword unpacking, and immediate structured-logger bindings.",
             "Logger recognition and secret classification are lexical; general aliases, arbitrary calls, dynamic containers, and interprocedural dataflow are not inspected.",
         ),
         examples=(
@@ -118,7 +131,7 @@ class NoSecretInLog(Rule):
             if not isinstance(function, ast.Attribute) or not _is_logging_call(node):
                 continue
             message_index = 1 if function.attr == "log" else 0
-            for arg in node.args:
+            for arg in node.args[message_index:]:
                 diags.extend(
                     Diagnostic(
                         path=path,
@@ -129,11 +142,6 @@ class NoSecretInLog(Rule):
                     )
                     for unsafe in _unsafe_message_values(arg)
                 )
-            diags.extend(
-                _diagnostic(path, arg, self.code, "positional logging argument")
-                for arg in node.args[message_index + 1 :]
-                if _is_raw_secret_reference(arg)
-            )
             _collect_keyword_secrets(path, node, self.code, diags)
             diags.extend(
                 _diagnostic(path, value, self.code, "structured logger binding")
@@ -147,7 +155,7 @@ def _bound_logger_values(receiver: ast.expr) -> tuple[ast.expr, ...]:
         return ()
     if receiver.func.attr not in {"bind", "contextualize"}:
         return ()
-    return tuple(keyword.value for keyword in receiver.keywords if _is_raw_secret_reference(keyword.value))
+    return tuple(secret for keyword in receiver.keywords for secret in _unsafe_message_values(keyword.value))
 
 
 def _diagnostic(path: Path, value: ast.expr, code: str, context: str) -> Diagnostic:
@@ -189,22 +197,15 @@ def _collect_keyword_secrets(path: Path, node: ast.Call, code: str, diags: list[
                 _diagnostic(path, value, code, "literal `extra` field")
                 for value in _literal_mapping_secret_values(kw.value)
             )
-        elif _is_raw_secret_reference(kw.value):
-            diags.append(_diagnostic(path, kw.value, code, f"`{kw.arg}` logging field"))
+        else:
+            diags.extend(
+                _diagnostic(path, value, code, f"`{kw.arg}` logging field")
+                for value in _unsafe_message_values(kw.value)
+            )
 
 
 def _literal_mapping_secret_values(mapping: ast.Dict) -> tuple[ast.expr, ...]:
-    return tuple(
-        secret
-        for _, value in _literal_mapping_items(mapping)
-        for secret in (
-            _literal_mapping_secret_values(value)
-            if isinstance(value, ast.Dict)
-            else (value,)
-            if _is_raw_secret_reference(value)
-            else ()
-        )
-    )
+    return tuple(secret for _, value in _literal_mapping_items(mapping) for secret in _unsafe_message_values(value))
 
 
 def _literal_mapping_items(mapping: ast.Dict) -> tuple[tuple[str, ast.expr], ...]:

{sarj_python_lint-1.40.2 → sarj_python_lint-1.41.2}/src/sarj_python_lint/rules/prefer_constant_time_secret_compare.py

@@ -63,6 +63,7 @@ _ENV_CALLS = frozenset({"getenv"})
 _ENV_MAPPINGS = frozenset({"environ"})
 _EQUALITY_DUNDERS = frozenset({"__eq__", "__ne__"})
 _PAIR_OPERAND_COUNT = 2
+_ENCODE_ARGUMENT_LIMIT = 2
 _SCOPE_NODES = (ast.FunctionDef, ast.AsyncFunctionDef, ast.ClassDef, ast.Lambda)
 
 
@@ -108,7 +109,7 @@ class PreferConstantTimeSecretCompare(Rule):
         category=RuleCategory.SECURITY,
         limitations=(
             "The diagnostic requires evidence of an externally supplied credential and configured or stored secret state.",
-            "Only direct equality and unambiguous same-scope aliases from headers, cookies, settings, or environment are traced.",
+            "Adjacent equality pairs, literal encode normalization, and unambiguous same-scope aliases from headers, cookies, settings, or environment are traced.",
             "Generated files, tests, test-support modules, equality methods, public sentinels, and type-like values are excluded.",
             "`compare_digest` requires compatible ASCII string or bytes-like operands and may still reveal type or length.",
         ),
@@ -162,9 +163,7 @@ class PreferConstantTimeSecretCompare(Rule):
         dunder_compares = _equality_dunder_compares(tree, source, node_index=context.node_index)
         diagnostics: list[Diagnostic] = []
         for comparison in context.nodes(ast.Compare):
-            if id(comparison) in dunder_compares or len(comparison.ops) != 1:
-                continue
-            if not isinstance(comparison.ops[0], (ast.Eq, ast.NotEq)):
+            if id(comparison) in dunder_compares:
                 continue
             operands = [comparison.left, *comparison.comparators]
             if _is_password_confirmation_pair(operands):
@@ -176,7 +175,8 @@ class PreferConstantTimeSecretCompare(Rule):
             position = (comparison.lineno, comparison.col_offset)
             dominant_roles = _dominating_walrus_roles(comparison, parents, roles, position)
             operand_roles = [_operand_role(operand, roles, position, dominant_roles) for operand in operands]
-            if not _has_authentication_pair(operand_roles):
+            unsafe_pair = _unsafe_authentication_pair(comparison, operands, operand_roles)
+            if unsafe_pair is None:
                 continue
             diagnostics.append(
                 Diagnostic(
@@ -185,12 +185,24 @@ class PreferConstantTimeSecretCompare(Rule):
                     col=comparison.col_offset + 1,
                     code=self.code,
                     severity=Severity.ERROR,
-                    message=_message(operand_roles),
+                    message=_message(unsafe_pair),
                 )
             )
         return sorted(diagnostics, key=lambda item: (item.line, item.col))
 
 
+def _unsafe_authentication_pair(
+    comparison: ast.Compare, operands: list[ast.expr], operand_roles: list[_Role]
+) -> list[_Role] | None:
+    for index, operation in enumerate(comparison.ops):
+        if not isinstance(operation, (ast.Eq, ast.NotEq)):
+            continue
+        pair = operand_roles[index : index + 2]
+        if _has_authentication_pair(pair) and not _is_password_confirmation_pair(operands[index : index + 2]):
+            return pair
+    return None
+
+
 def _message(roles: list[_Role]) -> str:
     if any(role.password for role in roles):
         return "password equality may leak information; use the password-hashing library's verification API"
@@ -274,6 +286,11 @@ def _operand_role(
                 for value in node.values
                 if isinstance(value, ast.FormattedValue)
             )
+        case ast.Call(func=ast.Attribute(value=value, attr="encode"), args=arguments, keywords=[]):
+            if len(arguments) <= _ENCODE_ARGUMENT_LIMIT and all(
+                isinstance(argument, ast.Constant) and isinstance(argument.value, str) for argument in arguments
+            ):
+                return _operand_role(value, roles, position, dominant_roles)
         case _:
             pass
     if _is_external_lookup(node):