sourcecode 4.10.2__tar.gz → 4.10.3__tar.gz

{sourcecode-4.10.2 → sourcecode-4.10.3}/CHANGELOG.md

@@ -2,6 +2,29 @@
 
 ## [Unreleased]
 
+## [4.10.3] — 2026-08-05
+
+### Fixed
+
+- **`GATE-001` no longer reads Java control keywords as method calls.** The regex
+  body scan behind the gated-endpoint audit treated `if(...)`, `for(...)`,
+  `while(...)`, `switch(...)`, `catch(...)` and `synchronized(...)` as same-class
+  invocations, so a handler could be reported as `Controller#if`. Those symbols
+  reached the `risk` critical band and `audit-report` top risks. Control keywords
+  are now excluded from method-name matches; the real private-method gate finding
+  stays covered.
+- **`SEC-007` reports JavaMelody descriptor credentials in their field shape.**
+  `authorized-users` is now read directly from the named descriptor parameter even
+  when the value carries a digest (`{SHA-256}…`), spans multiple lines, or is
+  wrapped in `CDATA`, and the generic descriptor-value fallback is deduplicated so
+  one credential yields exactly one finding. The evidence line stays redacted.
+
+### Tests
+
+- Regression coverage binds both fixes through the full `spring-audit` CLI path,
+  including a `options/DPA/WEB-INF/web.xml` descriptor and a controller whose
+  handler body contains the control constructs that produced the false positive.
+
 ## [4.10.2] — 2026-08-05
 
 ### Fixed

{sourcecode-4.10.2 → sourcecode-4.10.3}/PKG-INFO

@@ -1,6 +1,6 @@
 Metadata-Version: 2.4
 Name: sourcecode
-Version: 4.10.2
+Version: 4.10.3
 Summary: Persistent structural context and ultra-fast repeated analysis for AI coding agents
 License-File: LICENSE
 Keywords: agents,ai,codebase,context,developer-tools,llm
@@ -42,7 +42,7 @@ Description-Content-Type: text/markdown
 
 **Context · Impact · Migration · Architecture · Review — everything from one structural model.**
 
-![Version](https://img.shields.io/badge/version-4.10.2-blue)
+![Version](https://img.shields.io/badge/version-4.10.3-blue)
 ![Python](https://img.shields.io/badge/python-3.9%2B-green)
 
 > **ASK Engine** is the product. The CLI command is **`ask`**. The legacy **`sourcecode`**
@@ -106,7 +106,7 @@ brew tap haroundominique/sourcecode && brew install sourcecode
 # pip / pipx
 pipx install sourcecode        # or: pip install sourcecode
 
-ask version                    # ask 4.10.2 — and, on a build that has aged,
+ask version                    # ask 4.10.3 — and, on a build that has aged,
                                # how many releases have probably shipped since
 ```
 

{sourcecode-4.10.2 → sourcecode-4.10.3}/README.md

@@ -4,7 +4,7 @@
 
 **Context · Impact · Migration · Architecture · Review — everything from one structural model.**
 
-![Version](https://img.shields.io/badge/version-4.10.2-blue)
+![Version](https://img.shields.io/badge/version-4.10.3-blue)
 ![Python](https://img.shields.io/badge/python-3.9%2B-green)
 
 > **ASK Engine** is the product. The CLI command is **`ask`**. The legacy **`sourcecode`**
@@ -68,7 +68,7 @@ brew tap haroundominique/sourcecode && brew install sourcecode
 # pip / pipx
 pipx install sourcecode        # or: pip install sourcecode
 
-ask version                    # ask 4.10.2 — and, on a build that has aged,
+ask version                    # ask 4.10.3 — and, on a build that has aged,
                                # how many releases have probably shipped since
 ```
 

{sourcecode-4.10.2 → sourcecode-4.10.3}/pyproject.toml

@@ -4,7 +4,7 @@ build-backend = "hatchling.build"
 
 [project]
 name = "sourcecode"
-version = "4.10.2"
+version = "4.10.3"
 description = "Persistent structural context and ultra-fast repeated analysis for AI coding agents"
 readme = "README.md"
 requires-python = ">=3.9"

{sourcecode-4.10.2 → sourcecode-4.10.3}/src/sourcecode/__init__.py

@@ -4,4 +4,4 @@ ASK Engine is the product. ``ask`` is the canonical CLI command; ``sourcecode``
 the legacy compatibility alias and the Python/PyPI package name. See
 docs/PRODUCT_IDENTITY.md (normative)."""
 
-__version__ = "4.10.2"
+__version__ = "4.10.3"

{sourcecode-4.10.2 → sourcecode-4.10.3}/src/sourcecode/security_config_scan.py

@@ -111,8 +111,8 @@ _IS_REFERENCE = re.compile(r"[$@]\{[^}]+\}|^\s*$|^\s*ENC\(|^\s*\*+\s*$")
 #: XML elements whose text is a configured VALUE. Servlet/JEE spec vocabulary.
 _DESCRIPTOR_VALUE = re.compile(
     r"<(?P<tag>param-value|env-entry-value|value|property|password)\b[^>]*>"
-    r"(?P<value>[^<]*)</(?P=tag)>",
-    re.IGNORECASE,
+    r"(?P<value>.*?)</(?P=tag)>",
+    re.IGNORECASE | re.DOTALL,
 )
 
 _DESCRIPTOR_INIT_PARAM = re.compile(
@@ -124,8 +124,8 @@ _DESCRIPTOR_PARAM_NAME = re.compile(
     re.IGNORECASE,
 )
 _DESCRIPTOR_PARAM_VALUE = re.compile(
-    r"<param-value\b[^>]*>(?P<value>[^<]*)</param-value>",
-    re.IGNORECASE,
+    r"<param-value\b[^>]*>(?P<value>.*?)</param-value>",
+    re.IGNORECASE | re.DOTALL,
 )
 _JAVAMELODY_CREDENTIAL_PARAMS: frozenset[str] = frozenset({
     "authorized-users",
@@ -364,7 +364,14 @@ def _scan_descriptor(text: str, rel: str) -> "list[SecurityConfigObservation]":
     holds a reference and is not reported; one that carries a digest literal
     holds the credential itself, in a file under version control.
     """
+    def _xml_value(raw: str) -> str:
+        value = raw.strip()
+        if value.startswith("<![CDATA[") and value.endswith("]]>"):
+            value = value[len("<![CDATA["):-len("]]>")]
+        return value.strip()
+
     out: "list[SecurityConfigObservation]" = []
+    javamelody_value_offsets: set[int] = set()
     for param in _DESCRIPTOR_INIT_PARAM.finditer(text):
         body = param.group("body")
         name_m = _DESCRIPTOR_PARAM_NAME.search(body)
@@ -372,22 +379,29 @@ def _scan_descriptor(text: str, rel: str) -> "list[SecurityConfigObservation]":
         if name_m is None or value_m is None:
             continue
         name = name_m.group("value").strip().lower()
-        value = value_m.group("value").strip()
+        value = _xml_value(value_m.group("value"))
         if name not in _JAVAMELODY_CREDENTIAL_PARAMS:
             continue
         if not value or _IS_REFERENCE.search(value):
             continue
         if ":" not in value:
             continue
-        if _DIGEST_LITERAL.search(value):
-            continue
         user = value.split(":", 1)[0].strip() or "user"
+        value_offset = param.start("body") + value_m.start("value")
+        javamelody_value_offsets.add(value_offset)
+        digest = _DIGEST_LITERAL.search(value)
+        evidence = (
+            f"<param-value>{user}:…{{{digest.group('algo')}}}"
+            f"{digest.group('digest')[:8]}…</param-value>"
+            if digest is not None
+            else f"<param-value>{user}:…</param-value>"
+        )
         out.append(SecurityConfigObservation(
             rule="SEC-007",
             file=rel,
-            line=_line_of(text, param.start() + value_m.start()),
+            line=_line_of(text, value_offset),
             symbol=rel,
-            evidence=f"<param-value>{user}:…</param-value>",
+            evidence=evidence,
             detail=(
                 "JavaMelody authorized-users stores a monitoring-console credential "
                 "directly in the deployment descriptor. The value is redacted here; "
@@ -395,7 +409,9 @@ def _scan_descriptor(text: str, rel: str) -> "list[SecurityConfigObservation]":
             ),
         ))
     for match in _DESCRIPTOR_VALUE.finditer(text):
-        value = match.group("value").strip()
+        if match.start("value") in javamelody_value_offsets:
+            continue
+        value = _xml_value(match.group("value"))
         if not value or _IS_REFERENCE.search(value):
             continue
         digest = _DIGEST_LITERAL.search(value)

{sourcecode-4.10.2 → sourcecode-4.10.3}/src/sourcecode/spring_security_audit.py

@@ -508,7 +508,8 @@ def _line_of(source: str, offset: int) -> int:
 _JAVA_METHOD_RE = re.compile(
     r"(?P<mods>(?:(?:public|protected|private|static|final|synchronized|abstract|native)\s+)*)"
     r"(?P<ret>[\w.$<>\[\], ?]+)\s+"
-    r"(?P<name>[a-zA-Z_][\w$]*)\s*\([^;{}]*\)\s*(?:throws\s+[^{]+)?\{",
+    r"(?P<name>(?!(?:if|for|while|switch|catch|synchronized|return|new|throw|try|else|do)\b)"
+    r"[a-zA-Z_][\w$]*)\s*\([^;{}]*\)\s*(?:throws\s+[^{]+)?\{",
     re.MULTILINE,
 )