sourcecode 5.2.0__py3-none-any.whl → 5.3.0__py3-none-any.whl

sourcecode/remedies.py

@@ -63,11 +63,19 @@ class Remedy:
     #: the read-only form of a remedy that writes is the same question asked under
     #: a constraint, and leaving the reader to assemble it is the C4 shape (C4-13).
     also: tuple = ()
+    #: The value the option takes, as a placeholder the reader replaces. Separate
+    #: from `option` because the battery checks options against the CLI's own
+    #: parameter names, and `--profile-from` with no value is a pointer to an
+    #: invocation that errors out — the exact defect this registry exists to
+    #: prevent.
+    argument: str = ""
 
     @property
     def invocation(self) -> str:
         return " ".join(
-            part for part in ("ask", self.command, ".", self.option, *self.also) if part
+            part for part in
+            ("ask", self.command, ".", self.option, self.argument, *self.also)
+            if part
         )
 
     def to_dict(self, root=None) -> dict:
@@ -107,6 +115,48 @@ REMEDIES: "dict[str, Remedy]" = {
             ),
             headline="which profile set actually runs",
         ),
+        Remedy(
+            key="which_profile_set_the_deployment_decides",
+            command="posture",
+            option="--profile-from",
+            argument="<file>",
+            answers=(
+                "the artefact that decides the profile set lives outside the code; "
+                "name it — a Kubernetes manifest, compose file, deployment plan, "
+                "Dockerfile, dotenv or launch script — and every answer is given under "
+                "the profile set it sets, with the file:line that decided it. An "
+                "artefact that decides nothing leaves this repository's own verdict "
+                "exactly as it was"
+            ),
+            headline="the deployment's own profile set",
+        ),
+        Remedy(
+            key="who_calls_the_routes_this_repository_serves",
+            command="endpoints",
+            option="--consumer",
+            argument="<repo>",
+            answers=(
+                "which routes anybody calls is decided by the consumers, and they are "
+                "other repositories; name them and the census becomes a "
+                "surface-reduction plan — of the routes a readable rule leaves open, "
+                "the ones a consumer calls are work and the ones nobody calls are "
+                "surface to delete rather than guard"
+            ),
+            headline="which open routes anybody calls",
+        ),
+        Remedy(
+            key="since_when_has_it_been_exposed",
+            command="timeline",
+            option="--since",
+            argument="<ref>",
+            answers=(
+                "a finding without a date is an argument and a finding with one is a "
+                "work item; to walk the commit series and publish where these numbers "
+                "moved, with the commit each transition was observed at and the window "
+                "it could have happened in"
+            ),
+            headline="since when, and in which commit window",
+        ),
         Remedy(
             key="no_data_labels_declared",
             command="data-exposure",

sourcecode/risk.py

@@ -93,6 +93,13 @@ _WRITE_FACTOR = {"writes": 1.8, "reads": 1.0, "unknown": 1.0}
 #: never a claim that the query is safely parameterised — a fact this module does
 #: not have.
 _QUERY_FACTOR = {
+    # F-BF: request input reaches a MyBatis `${}` interpolation — the value is
+    # spliced into the statement, so it changes the query's structure. Weighted
+    # the same as the Java-concatenation case on purpose: both mean "request
+    # input decides the shape of a query", and the distinction between them is
+    # the evidence, not the severity. A second severity would be a claim this
+    # module has no measurement for.
+    "http_input_reaches_sql_interpolation": 2.2,
     "http_input_concatenated": 2.2,
     "concatenated": 1.5,
     "not_observed": 1.0,
@@ -368,7 +375,18 @@ def _has_http_input_parameter(root: Path, cir: "CanonicalRepositoryIR") -> bool:
     return False
 
 
+#: Where the method parse is remembered on the CIR it was taken from. Two callers
+#: now need it in one run — the query-sink walk and F-BF's spliced-SQL join — and
+#: this parse is the expensive half of both (measured: 12,7 s of a 16 s run on
+#: jobrunr). Keyed on the CIR object, so a second CIR re-parses and a scoped one
+#: never serves a repository-wide question (C3-94).
+_METHODS_CACHE_ATTR = "_ask_java_methods_cache"
+
+
 def _java_methods(root: Path, cir: "CanonicalRepositoryIR") -> list[_MethodSource]:
+    cached = getattr(cir, _METHODS_CACHE_ATTR, None)
+    if isinstance(cached, list):
+        return cached
     methods: list[_MethodSource] = []
     for rel in getattr(cir, "files", []) or []:
         if not str(rel).endswith(".java"):
@@ -401,6 +419,10 @@ def _java_methods(root: Path, cir: "CanonicalRepositoryIR") -> list[_MethodSourc
                 body=text[body_start + 1:body_end],
                 file=str(rel),
             ))
+    try:
+        object.__setattr__(cir, _METHODS_CACHE_ATTR, methods)
+    except Exception:
+        pass  # frozen or slotted CIR — re-parse rather than fail
     return methods
 
 
@@ -511,10 +533,24 @@ def _http_input_query_sinks(
     return out
 
 
+def _sql_taint(root: Path, cir: "CanonicalRepositoryIR") -> dict:
+    """F-BF, imported at the seam that uses it (the module imports `risk` back)."""
+    from sourcecode.sql_taint import build_sql_taint
+
+    return build_sql_taint(root, cir)
+
+
+def _sql_reached_files(payload: "Optional[dict]") -> "dict[str, str]":
+    from sourcecode.sql_taint import reached_files
+
+    return reached_files(payload)
+
+
 def _query_axis(
     symbol: str,
     owners: "Optional[dict[str, list[str]]]",
     http_input_sinks: "Optional[dict[str, str]]" = None,
+    sql_interpolation_sinks: "Optional[dict[str, str]]" = None,
 ) -> "tuple[str, str]":
     """Does the defect's own code assemble a query string by concatenation?
 
@@ -522,6 +558,14 @@ def _query_axis(
     class-level one for any member of the class — the same scope `reach_scope`
     already publishes for the reach figure.
     """
+    # F-BF: a SEC-008 defect is recorded against the mapper file, and the sink it
+    # names lives in that file — so this join needs no second identity. Checked
+    # before the Java-owner lookup because a mapper file is never a Java owner:
+    # without this the axis returned `not_observed` (×1,0) on every row of a
+    # repository whose SQL is in mapper XML, which is what the field measured.
+    reached_sql = (sql_interpolation_sinks or {}).get(symbol)
+    if reached_sql:
+        return "http_input_reaches_sql_interpolation", reached_sql
     if owners is None:
         return "unknown", ""
     if "#" in symbol:
@@ -744,6 +788,8 @@ def _statement(row: "dict[str, Any]") -> str:
     auth = row["auth"]
     write = row["write"]
     adjacent = []
+    if row.get("query") == "http_input_reaches_sql_interpolation":
+        adjacent.append("passes HTTP input to SQL that splices it into the statement")
     if row.get("query") == "http_input_concatenated":
         adjacent.append("passes HTTP input to a concatenated query sink")
     if row.get("query") == "concatenated":
@@ -755,7 +801,9 @@ def _statement(row: "dict[str, Any]") -> str:
         + (
             "; the HTTP-input claim is bounded to annotated request parameters, "
             "positional calls in repository Java sources and known query sinks"
-            if row.get("query") == "http_input_concatenated" else
+            if row.get("query") in (
+                "http_input_concatenated", "http_input_reaches_sql_interpolation",
+            ) else
             ", which is an adjacency, not a dataflow claim: nothing here follows "
             "request input to a sink (NC-001)"
         )
@@ -860,6 +908,16 @@ class RiskComposer:
                     progress=self._rule_progress("security rules"),
                 ).findings
             )
+        # F-BI: `risk` ranks defects, and a finding the repository adjudicated as
+        # not-a-defect-here is not one. Applied over the whole population, after
+        # both rule passes, for the same reason the audit applies it there.
+        try:
+            from sourcecode.waivers import apply_waivers as _apply_waivers
+
+            findings = _apply_waivers(findings, self.root).kept
+        except Exception:
+            pass  # a malformed waivers file is reported by `spring-audit`
+
         self.findings = findings
 
         # C3-85: everything from here to the composition is repository-wide work
@@ -934,6 +992,16 @@ class RiskComposer:
             if self.concat_owners and _named("reading HTTP-input query sinks")
             else None
         )
+        # F-BF: the other end of the same question, over the sink family this
+        # repository class actually uses. Guarded the same way and for the same
+        # reason: `build_sql_taint` returns before parsing when the repository has
+        # no spliced statement or no annotated HTTP input at all, so the walk is
+        # paid only where it can conclude something.
+        self.sql_taint = (
+            _sql_taint(self.root, self.cir)
+            if _named("reading spliced SQL statements") else None
+        )
+        self.sql_interpolation_sinks = _sql_reached_files(self.sql_taint)
         self.constraint_index = (
             _constraint_index(self.root, self.cir, extract_java_endpoints(self.root))
             if _named("indexing the validation surface") else None
@@ -1162,7 +1230,8 @@ class RiskComposer:
         if write == "unknown":
             blind.append("write_effect: the declaring type's source was not read")
         query, query_evidence = _query_axis(
-            symbol, self.concat_owners, self.http_input_query_sinks
+            symbol, self.concat_owners, self.http_input_query_sinks,
+            self.sql_interpolation_sinks,
         )
         if query == "unknown":
             blind.append("query_construction: this build carries no body facts to read the shape from")
@@ -1270,12 +1339,21 @@ class RiskComposer:
                     "value": query,
                     "factor": _QUERY_FACTOR.get(query, 1.0),
                     "authority": (
+                        "bounded HTTP-input-to-spliced-SQL propagation (sql-taint-v1)"
+                        if query == "http_input_reaches_sql_interpolation" else
                         "bounded HTTP-input-to-query-sink propagation + "
                         "argument-shape atoms (dynamic_argument_surface)"
                         if query == "http_input_concatenated" else
                         "argument-shape atoms (dynamic_argument_surface)"
                     ),
                     "basis": (
+                        "an annotated HTTP input parameter reaches, through bounded "
+                        "positional propagation, a MyBatis statement that splices "
+                        "that value into its SQL with `${...}` — so request input "
+                        "decides the structure of the query, not only its values. "
+                        "The verdict lattice is reaches / does_not_reach / "
+                        "undecidable, and only the first is claimed here"
+                        if query == "http_input_reaches_sql_interpolation" else
                         "an annotated HTTP input parameter reaches a known query "
                         "construction sink through bounded positional propagation "
                         "over repository Java sources, and the sink receives a "
@@ -1379,6 +1457,18 @@ def _assemble_payload(
         # that sentence, and it belongs where the composition is, not one command away.
         "non_coverage": non_coverage.block("security_surface"),
     }
+    # F-BF: the census behind the `query_construction` axis, published so the
+    # multiplier is auditable rather than asserted — and so the two states the
+    # axis does NOT act on are visible. Present only where the repository has a
+    # spliced statement at all, which keeps every other payload byte-identical.
+    _taint = getattr(composer, "sql_taint", None)
+    if isinstance(_taint, dict) and _taint.get("sinks_total"):
+        payload["sql_taint"] = {
+            key: _taint[key]
+            for key in ("schema_version", "answered", "sinks_total", "summary",
+                        "statement", "verdict_lattice", "basis")
+            if key in _taint
+        }
     # F-AY: three of this command's six axes are Spring-shaped (access, the
     # transaction boundary, the declarative security model), so on a repository
     # with no Spring the factors they contribute are `unknown` by construction

sourcecode/spring_findings.py

@@ -177,6 +177,14 @@ class SpringAuditResult:
     summary: dict = field(default_factory=dict)
     # C2-5: one row per defect, each naming the findings that witnessed it.
     defects: list = field(default_factory=list)
+    # F-BI: findings this repository adjudicated as not-defects-here, each with
+    # the reason and the file that declared it. They are removed from `findings`
+    # and published in full — a count that drops with nothing to read is the
+    # failure mode adjudication would otherwise introduce.
+    waived: list = field(default_factory=list)
+    # The waivers block: what was declared, what applied, what expired, what
+    # matched nothing. Empty when the repository declares no waivers file.
+    waivers: dict = field(default_factory=dict)
 
     def finalize(self) -> "SpringAuditResult":
         """Compute summary stats. Call after all findings are added."""
@@ -265,6 +273,17 @@ class SpringAuditResult:
             "confidence_level": conf_level,
             "confidence_basis": _conf_basis,
         }
+        # F-BI: the count that says the population above is not the whole one.
+        # Only ever present beside the block that says what left and why, so a
+        # smaller number can never be read without its adjudication.
+        if self.waivers:
+            self.summary["waived_findings"] = len(self.waived)
+            self.summary["waived_basis"] = (
+                "This repository adjudicated the findings above as not defects "
+                "here. They are not counted in total_findings and are published "
+                "in full under `waived`, each with its reason and the file that "
+                "declared it (see `waivers`)."
+            )
         # C2-31 (second half): the truncation was declared only in `_partial`, at
         # the root of the payload, while the numbers a consumer actually reads live
         # here. `summary.total_defects: 15` with `confidence_level: high` reads as a
@@ -315,8 +334,18 @@ class SpringAuditResult:
         # A non-empty posture wins: it is produced by exactly one scope (security),
         # so there is no cross-scope conflict to resolve.
         posture: dict = {}
+        # F-BI: adjudication is applied over the *merged* population, never
+        # inside one scope — a waiver naming a security finding is not
+        # "unmatched" because the transaction scope did not find it. So these are
+        # normally empty here; they are carried rather than dropped for the case
+        # a caller merges results that were already adjudicated.
+        waived: list = []
+        waivers: dict = {}
         for r in results:
             findings.extend(r.findings)
+            waived.extend(r.waived)
+            if r.waivers and not waivers:
+                waivers = r.waivers
             limitations.extend(r.limitations)
             metadata.update(r.metadata)
             # C1-42: `update` is right for every key that belongs to one scope and
@@ -361,6 +390,8 @@ class SpringAuditResult:
             limitations=limitations,
             metadata=metadata,
             security_posture=posture,
+            waived=waived,
+            waivers=waivers,
             # C2-31: one cut scope makes the joined answer a floor. Losing the flag
             # in the merge would restore the exact defect — a truncated report that
             # presents itself as a complete one.
@@ -378,6 +409,11 @@ class SpringAuditResult:
             "summary": self.summary,
             "defects": self.defects,
             "findings": [f.to_dict() for f in self.findings],
+            # F-BI: present only when the repository declares waivers, so a
+            # payload from a repository that adjudicates nothing is unchanged
+            # byte for byte.
+            **({"waived": self.waived} if self.waivers else {}),
+            **({"waivers": self.waivers} if self.waivers else {}),
             "limitations": self.limitations,
             "metadata": self.metadata,
             "security_posture": self.security_posture,
@@ -439,6 +475,9 @@ class SpringAuditResult:
             }
 
         _cap(compact, "findings", key=lambda f: SEVERITY_ORDER.get(f.get("severity"), 3))
+        # F-BI: capped by the same rule as the rest. The `waivers` block beside it
+        # keeps the counts, so a sampled list never hides how much was waived.
+        _cap(compact, "waived", key=lambda f: SEVERITY_ORDER.get(f.get("severity"), 3))
         # C2-5: the defect rows are the shorter list and the decision-grade one,
         # so they are capped with the same rule rather than exempted from it.
         _cap(compact, "defects", key=lambda d: SEVERITY_ORDER.get(d.get("severity"), 3))

sourcecode/spring_impact.py

@@ -1597,6 +1597,16 @@ def _run_audit_for_chain(
         posture = getattr(sec_result, "security_posture", None) or {}
     except Exception:
         pass
+    # F-BI: the same adjudication the audit publishes, applied to the findings
+    # this command attaches to an impact. A row the repository decided is not a
+    # defect here must not come back attached to a pull request.
+    try:
+        from sourcecode.waivers import apply_waivers as _apply_waivers
+
+        findings = _apply_waivers(findings, root).kept
+    except Exception:
+        pass  # a malformed waivers file is reported by `spring-audit`, not here
+
     answer = (findings, posture)
     try:
         if not isinstance(cache, dict):