mirror of
https://github.com/pewdiepie-archdaemon/odysseus.git
synced 2026-10-30 17:52:26 +01:00
Compare commits
1
Commits
| Author | SHA1 | Date | |
|---|---|---|---|
 dependabot[bot]
|
c06c29b716 |
@@ -76,7 +76,7 @@ jobs:
|
|||||||
- uses: actions/checkout@3d3c42e5aac5ba805825da76410c181273ba90b1 # v7.0.1
|
- uses: actions/checkout@3d3c42e5aac5ba805825da76410c181273ba90b1 # v7.0.1
|
||||||
with:
|
with:
|
||||||
persist-credentials: false
|
persist-credentials: false
|
||||||
- uses: actions/setup-python@5fda3b95a4ea91299a34e894583c3862153e4b97 # v7.0.0
|
- uses: actions/setup-python@6d4fd22b20465ccc0f7354476588e8df7c9ca0e0 # v7.1.0
|
||||||
with:
|
with:
|
||||||
python-version: "3.11"
|
python-version: "3.11"
|
||||||
# Byte-compile sources — catches syntax errors without installing deps.
|
# Byte-compile sources — catches syntax errors without installing deps.
|
||||||
@@ -91,7 +91,7 @@ jobs:
|
|||||||
- uses: actions/checkout@3d3c42e5aac5ba805825da76410c181273ba90b1 # v7.0.1
|
- uses: actions/checkout@3d3c42e5aac5ba805825da76410c181273ba90b1 # v7.0.1
|
||||||
with:
|
with:
|
||||||
persist-credentials: false
|
persist-credentials: false
|
||||||
- uses: actions/setup-node@820762786026740c76f36085b0efc47a31fe5020 # v7.0.0
|
- uses: actions/setup-node@949feb2413d6458794dcd2491c4babbbce0c15c1 # v7.1.0
|
||||||
with:
|
with:
|
||||||
node-version: "22.23.4"
|
node-version: "22.23.4"
|
||||||
- run: npm ci --ignore-scripts --no-audit --no-fund
|
- run: npm ci --ignore-scripts --no-audit --no-fund
|
||||||
@@ -151,7 +151,7 @@ jobs:
|
|||||||
echo "docs_only=false" >> "$GITHUB_OUTPUT"
|
echo "docs_only=false" >> "$GITHUB_OUTPUT"
|
||||||
fi
|
fi
|
||||||
|
|
||||||
- uses: actions/setup-python@5fda3b95a4ea91299a34e894583c3862153e4b97 # v7.0.0
|
- uses: actions/setup-python@6d4fd22b20465ccc0f7354476588e8df7c9ca0e0 # v7.1.0
|
||||||
if: steps.docs-check.outputs.docs_only != 'true'
|
if: steps.docs-check.outputs.docs_only != 'true'
|
||||||
with:
|
with:
|
||||||
python-version: "3.11"
|
python-version: "3.11"
|
||||||
@@ -168,7 +168,7 @@ jobs:
|
|||||||
|
|
||||||
# uv resolves the same versions as pip but installs ~5x faster, and its
|
# uv resolves the same versions as pip but installs ~5x faster, and its
|
||||||
# cache keeps each shard from re-downloading the whole requirement set.
|
# cache keeps each shard from re-downloading the whole requirement set.
|
||||||
- uses: astral-sh/setup-uv@c18668ad3cf93ea998bef934396af7bb5c839dc7 # v10.2.0
|
- uses: astral-sh/setup-uv@07a047e608db84b3d8c06cd9a7c7dcc9c355c18e # v10.3.2
|
||||||
if: steps.docs-check.outputs.docs_only != 'true'
|
if: steps.docs-check.outputs.docs_only != 'true'
|
||||||
with:
|
with:
|
||||||
version: "0.13.5"
|
version: "0.13.5"
|
||||||
@@ -180,7 +180,7 @@ jobs:
|
|||||||
python scripts/check_ca_trust.py --python
|
python scripts/check_ca_trust.py --python
|
||||||
uv pip install --system -r requirements.txt
|
uv pip install --system -r requirements.txt
|
||||||
if: steps.docs-check.outputs.docs_only != 'true'
|
if: steps.docs-check.outputs.docs_only != 'true'
|
||||||
- uses: actions/setup-node@820762786026740c76f36085b0efc47a31fe5020 # v7.0.0
|
- uses: actions/setup-node@949feb2413d6458794dcd2491c4babbbce0c15c1 # v7.1.0
|
||||||
if: steps.docs-check.outputs.docs_only != 'true'
|
if: steps.docs-check.outputs.docs_only != 'true'
|
||||||
with:
|
with:
|
||||||
node-version: "22.23.4"
|
node-version: "22.23.4"
|
||||||
|
|||||||
@@ -31,11 +31,11 @@ jobs:
|
|||||||
with:
|
with:
|
||||||
persist-credentials: false
|
persist-credentials: false
|
||||||
- name: Initialize CodeQL
|
- name: Initialize CodeQL
|
||||||
uses: github/codeql-action/init@ff2f1c621b7f889edc0d3c761ac2e6a3f8cdb0dd # v4.37.7
|
uses: github/codeql-action/init@9b3254085494b55a0f7c4c2b3d2d52cc712ce370 # v4.39.1
|
||||||
with:
|
with:
|
||||||
languages: ${{ matrix.language }}
|
languages: ${{ matrix.language }}
|
||||||
build-mode: none
|
build-mode: none
|
||||||
- name: Perform CodeQL Analysis
|
- name: Perform CodeQL Analysis
|
||||||
uses: github/codeql-action/analyze@ff2f1c621b7f889edc0d3c761ac2e6a3f8cdb0dd # v4.37.7
|
uses: github/codeql-action/analyze@9b3254085494b55a0f7c4c2b3d2d52cc712ce370 # v4.39.1
|
||||||
with:
|
with:
|
||||||
category: "/language:${{ matrix.language }}"
|
category: "/language:${{ matrix.language }}"
|
||||||
|
|||||||
@@ -42,7 +42,7 @@ jobs:
|
|||||||
persist-credentials: false
|
persist-credentials: false
|
||||||
|
|
||||||
- name: Lint Dockerfile
|
- name: Lint Dockerfile
|
||||||
uses: hadolint/hadolint-action@2a66e89f53d0771bb131a7fa31f3136336094aa6 # v3.4.0
|
uses: hadolint/hadolint-action@06be81baf89a55ffd0e24b8f04a4185738dd3387 # v3.5.0
|
||||||
with:
|
with:
|
||||||
dockerfile: Dockerfile
|
dockerfile: Dockerfile
|
||||||
# DL3008: pinning apt package versions is impractical on a -slim base
|
# DL3008: pinning apt package versions is impractical on a -slim base
|
||||||
|
|||||||
@@ -61,14 +61,14 @@ jobs:
|
|||||||
persist-credentials: false
|
persist-credentials: false
|
||||||
|
|
||||||
- name: Set up Buildx
|
- name: Set up Buildx
|
||||||
uses: docker/setup-buildx-action@37fe631027851001ddb9b187196cc803df7f5f0e # v4.3.0
|
uses: docker/setup-buildx-action@f87e5991a6d7451dcb8d9637bfbc97413f497069 # v4.4.1
|
||||||
with:
|
with:
|
||||||
driver: docker
|
driver: docker
|
||||||
|
|
||||||
# Build without pushing so a broken Dockerfile is caught here, and the
|
# Build without pushing so a broken Dockerfile is caught here, and the
|
||||||
# exact image we ship is what gets scanned.
|
# exact image we ship is what gets scanned.
|
||||||
- name: Build image
|
- name: Build image
|
||||||
uses: docker/build-push-action@53b7df96c91f9c12dcc8a07bcb9ccacbed38856a # v7.3.0
|
uses: docker/build-push-action@c3c9e263c25d99ce0380d002d59b67737d91b0dc # v7.4.0
|
||||||
with:
|
with:
|
||||||
context: .
|
context: .
|
||||||
push: false
|
push: false
|
||||||
@@ -107,12 +107,12 @@ jobs:
|
|||||||
persist-credentials: false
|
persist-credentials: false
|
||||||
|
|
||||||
- name: Set up Buildx
|
- name: Set up Buildx
|
||||||
uses: docker/setup-buildx-action@37fe631027851001ddb9b187196cc803df7f5f0e # v4.3.0
|
uses: docker/setup-buildx-action@f87e5991a6d7451dcb8d9637bfbc97413f497069 # v4.4.1
|
||||||
with:
|
with:
|
||||||
driver: docker
|
driver: docker
|
||||||
|
|
||||||
- name: Build image
|
- name: Build image
|
||||||
uses: docker/build-push-action@53b7df96c91f9c12dcc8a07bcb9ccacbed38856a # v7.3.0
|
uses: docker/build-push-action@c3c9e263c25d99ce0380d002d59b67737d91b0dc # v7.4.0
|
||||||
with:
|
with:
|
||||||
context: .
|
context: .
|
||||||
push: false
|
push: false
|
||||||
@@ -133,7 +133,7 @@ jobs:
|
|||||||
TRIVY_DB_REPOSITORY: ghcr.io/aquasecurity/trivy-db:2
|
TRIVY_DB_REPOSITORY: ghcr.io/aquasecurity/trivy-db:2
|
||||||
|
|
||||||
- name: Upload Trivy results
|
- name: Upload Trivy results
|
||||||
uses: github/codeql-action/upload-sarif@ff2f1c621b7f889edc0d3c761ac2e6a3f8cdb0dd # v4.37.7
|
uses: github/codeql-action/upload-sarif@9b3254085494b55a0f7c4c2b3d2d52cc712ce370 # v4.39.1
|
||||||
with:
|
with:
|
||||||
sarif_file: trivy-results.sarif
|
sarif_file: trivy-results.sarif
|
||||||
category: trivy-image
|
category: trivy-image
|
||||||
|
|||||||
@@ -63,7 +63,7 @@ jobs:
|
|||||||
persist-credentials: false
|
persist-credentials: false
|
||||||
|
|
||||||
- name: Set up Python
|
- name: Set up Python
|
||||||
uses: actions/setup-python@5fda3b95a4ea91299a34e894583c3862153e4b97 # v7.0.0
|
uses: actions/setup-python@6d4fd22b20465ccc0f7354476588e8df7c9ca0e0 # v7.1.0
|
||||||
with:
|
with:
|
||||||
python-version: '3.12'
|
python-version: '3.12'
|
||||||
|
|
||||||
|
|||||||
@@ -47,4 +47,4 @@ jobs:
|
|||||||
steps:
|
steps:
|
||||||
- name: Deploy to GitHub Pages
|
- name: Deploy to GitHub Pages
|
||||||
id: deployment
|
id: deployment
|
||||||
uses: actions/deploy-pages@cd2ce8fcbc39b97be8ca5fce6e763baed58fa128 # v5.0.0
|
uses: actions/deploy-pages@368f82528645a54fb793d4d04e342629a3f51346 # v5.0.1
|
||||||
|
|||||||
@@ -55,16 +55,16 @@ jobs:
|
|||||||
shell: bash
|
shell: bash
|
||||||
run: echo "IMAGE_NAME=${GITHUB_REPOSITORY,,}" >> "$GITHUB_ENV"
|
run: echo "IMAGE_NAME=${GITHUB_REPOSITORY,,}" >> "$GITHUB_ENV"
|
||||||
- name: Set up Buildx
|
- name: Set up Buildx
|
||||||
uses: docker/setup-buildx-action@37fe631027851001ddb9b187196cc803df7f5f0e # v4.3.0
|
uses: docker/setup-buildx-action@f87e5991a6d7451dcb8d9637bfbc97413f497069 # v4.4.1
|
||||||
- name: Log in to GHCR
|
- name: Log in to GHCR
|
||||||
uses: docker/login-action@dbcb813823bdd20940b903addbd779551569679f # v4.6.0
|
uses: docker/login-action@81c6f93d4bc991e510b342a00b419b3bb4efc5c6 # v4.7.0
|
||||||
with:
|
with:
|
||||||
registry: ${{ env.REGISTRY }}
|
registry: ${{ env.REGISTRY }}
|
||||||
username: ${{ github.actor }}
|
username: ${{ github.actor }}
|
||||||
password: ${{ secrets.GITHUB_TOKEN }}
|
password: ${{ secrets.GITHUB_TOKEN }}
|
||||||
- name: Build and push by digest
|
- name: Build and push by digest
|
||||||
id: build
|
id: build
|
||||||
uses: docker/build-push-action@53b7df96c91f9c12dcc8a07bcb9ccacbed38856a # v7.3.0
|
uses: docker/build-push-action@c3c9e263c25d99ce0380d002d59b67737d91b0dc # v7.4.0
|
||||||
with:
|
with:
|
||||||
context: .
|
context: .
|
||||||
pull: true
|
pull: true
|
||||||
@@ -78,7 +78,7 @@ jobs:
|
|||||||
digest="${{ steps.build.outputs.digest }}"
|
digest="${{ steps.build.outputs.digest }}"
|
||||||
touch "/tmp/digests/${digest#sha256:}"
|
touch "/tmp/digests/${digest#sha256:}"
|
||||||
- name: Upload digest
|
- name: Upload digest
|
||||||
uses: actions/upload-artifact@043fb46d1a93c77aae656e7c1c64a875d1fc6a0a # v7.0.1
|
uses: actions/upload-artifact@cf430e030ddbb5b0abf93d22962f4752f3646cd9 # v7.0.2
|
||||||
with:
|
with:
|
||||||
name: digest-${{ matrix.arch }}
|
name: digest-${{ matrix.arch }}
|
||||||
path: /tmp/digests/*
|
path: /tmp/digests/*
|
||||||
@@ -107,15 +107,15 @@ jobs:
|
|||||||
echo "version=$v" >> "$GITHUB_OUTPUT"
|
echo "version=$v" >> "$GITHUB_OUTPUT"
|
||||||
echo "short=${GITHUB_SHA::7}" >> "$GITHUB_OUTPUT"
|
echo "short=${GITHUB_SHA::7}" >> "$GITHUB_OUTPUT"
|
||||||
- name: Download digests
|
- name: Download digests
|
||||||
uses: actions/download-artifact@3e5f45b2cfb9172054b4087a40e8e0b5a5461e7c # v8.0.1
|
uses: actions/download-artifact@9000827ccba6bdab643e8b6fd33ac0654aef8333 # v8.0.2
|
||||||
with:
|
with:
|
||||||
path: /tmp/digests
|
path: /tmp/digests
|
||||||
pattern: digest-*
|
pattern: digest-*
|
||||||
merge-multiple: true
|
merge-multiple: true
|
||||||
- name: Set up Buildx
|
- name: Set up Buildx
|
||||||
uses: docker/setup-buildx-action@37fe631027851001ddb9b187196cc803df7f5f0e # v4.3.0
|
uses: docker/setup-buildx-action@f87e5991a6d7451dcb8d9637bfbc97413f497069 # v4.4.1
|
||||||
- name: Log in to GHCR
|
- name: Log in to GHCR
|
||||||
uses: docker/login-action@dbcb813823bdd20940b903addbd779551569679f # v4.6.0
|
uses: docker/login-action@81c6f93d4bc991e510b342a00b419b3bb4efc5c6 # v4.7.0
|
||||||
with:
|
with:
|
||||||
registry: ${{ env.REGISTRY }}
|
registry: ${{ env.REGISTRY }}
|
||||||
username: ${{ github.actor }}
|
username: ${{ github.actor }}
|
||||||
|
|||||||
@@ -62,9 +62,9 @@ jobs:
|
|||||||
env:
|
env:
|
||||||
SEARXNG_TEST_IMAGE: ${{ steps.image.outputs.image }}
|
SEARXNG_TEST_IMAGE: ${{ steps.image.outputs.image }}
|
||||||
run: docker pull "$SEARXNG_TEST_IMAGE"
|
run: docker pull "$SEARXNG_TEST_IMAGE"
|
||||||
- uses: docker/setup-buildx-action@37fe631027851001ddb9b187196cc803df7f5f0e # v4.3.0
|
- uses: docker/setup-buildx-action@f87e5991a6d7451dcb8d9637bfbc97413f497069 # v4.4.1
|
||||||
- name: Check unmodified upstream trust and actual entrypoint offline
|
- name: Check unmodified upstream trust and actual entrypoint offline
|
||||||
uses: docker/build-push-action@53b7df96c91f9c12dcc8a07bcb9ccacbed38856a # v7.3.0
|
uses: docker/build-push-action@c3c9e263c25d99ce0380d002d59b67737d91b0dc # v7.4.0
|
||||||
with:
|
with:
|
||||||
context: .
|
context: .
|
||||||
file: docker/searxng/Dockerfile
|
file: docker/searxng/Dockerfile
|
||||||
|
|||||||
@@ -66,7 +66,7 @@ jobs:
|
|||||||
persist-credentials: false
|
persist-credentials: false
|
||||||
|
|
||||||
- name: Set up Python
|
- name: Set up Python
|
||||||
uses: actions/setup-python@5fda3b95a4ea91299a34e894583c3862153e4b97 # v7.0.0
|
uses: actions/setup-python@6d4fd22b20465ccc0f7354476588e8df7c9ca0e0 # v7.1.0
|
||||||
with:
|
with:
|
||||||
python-version: '3.12'
|
python-version: '3.12'
|
||||||
|
|
||||||
|
|||||||
@@ -93,7 +93,7 @@ def test_custom_filter_reuses_convolve_kernel():
|
|||||||
assert "convolve(readSource(snap), k, divisor, bias, 1)" in EFFECTS
|
assert "convolve(readSource(snap), k, divisor, bias, 1)" in EFFECTS
|
||||||
|
|
||||||
|
|
||||||
def test_blur_and_custom_filter_aliases_registered():
|
def test_new_filter_aliases_registered():
|
||||||
assert "'box-blur': 'blur-box'" in EDITOR
|
assert "'box-blur': 'blur-box'" in EDITOR
|
||||||
assert "'surface-blur': 'blur-surface'" in EDITOR
|
assert "'surface-blur': 'blur-surface'" in EDITOR
|
||||||
assert "custom: 'other-custom'" in EDITOR
|
assert "custom: 'other-custom'" in EDITOR
|
||||||
|
|||||||
+27
-148
@@ -12,8 +12,6 @@ exercising every procfs-touching code path on both a Linux and a non-Linux
|
|||||||
host. ``test_cookbook_stop_without_procfs.py`` covers the behaviour itself.
|
host. ``test_cookbook_stop_without_procfs.py`` covers the behaviour itself.
|
||||||
"""
|
"""
|
||||||
import ast
|
import ast
|
||||||
|
|
||||||
import pytest
|
|
||||||
from pathlib import Path
|
from pathlib import Path
|
||||||
|
|
||||||
REPO_ROOT = Path(__file__).resolve().parent.parent
|
REPO_ROOT = Path(__file__).resolve().parent.parent
|
||||||
@@ -77,112 +75,37 @@ def _scan_sites(tree: ast.AST) -> list[ast.Call]:
|
|||||||
return sites
|
return sites
|
||||||
|
|
||||||
|
|
||||||
def _condition_requires_procfs(node: ast.AST, truth: bool) -> bool:
|
def _guard_lines(tree: ast.AST) -> list[int]:
|
||||||
"""Whether this Boolean outcome proves a direct procfs check succeeded.
|
"""Line numbers of calls that test whether procfs is present."""
|
||||||
|
lines = []
|
||||||
An ignored call, another function's check, or a check on only one possible
|
for node in ast.walk(tree):
|
||||||
OR branch provides no proof. Keep unknown expressions conservative.
|
|
||||||
"""
|
|
||||||
if isinstance(node, ast.UnaryOp) and isinstance(node.op, ast.Not):
|
|
||||||
return _condition_requires_procfs(node.operand, not truth)
|
|
||||||
if isinstance(node, ast.BoolOp):
|
|
||||||
facts = [_condition_requires_procfs(value, truth) for value in node.values]
|
|
||||||
all_values_required = isinstance(node.op, ast.And) == truth
|
|
||||||
return any(facts) if all_values_required else all(facts)
|
|
||||||
if not isinstance(node, ast.Call):
|
if not isinstance(node, ast.Call):
|
||||||
return False
|
continue
|
||||||
func = node.func
|
func = node.func
|
||||||
name = func.attr if isinstance(func, ast.Attribute) else getattr(func, "id", "")
|
name = func.attr if isinstance(func, ast.Attribute) else getattr(func, "id", "")
|
||||||
|
if name not in _GUARD_FUNCS:
|
||||||
|
continue
|
||||||
subject_is_procfs = (
|
subject_is_procfs = (
|
||||||
name == "has_procfs"
|
name in {"has_procfs", "is_wsl"}
|
||||||
or (isinstance(func, ast.Attribute) and _is_procfs_root(func.value))
|
or (isinstance(func, ast.Attribute) and _is_procfs_root(func.value))
|
||||||
or any(_is_procfs_root(arg) for arg in node.args)
|
or any(_is_procfs_root(arg) for arg in node.args)
|
||||||
)
|
)
|
||||||
return truth and name in _GUARD_FUNCS and subject_is_procfs
|
if subject_is_procfs:
|
||||||
|
lines.append(node.lineno)
|
||||||
|
return lines
|
||||||
|
|
||||||
|
|
||||||
def _guarded_scan_ids(tree: ast.AST) -> set[int]:
|
def _enclosing_scope(tree: ast.AST, node: ast.AST) -> ast.AST:
|
||||||
"""Follow conditional/early-exit paths instead of comparing line numbers.
|
"""Smallest function/module scope containing ``node``."""
|
||||||
|
best = tree
|
||||||
Each function starts with no procfs assumption. Facts from a loop or try
|
for candidate in ast.walk(tree):
|
||||||
body cannot escape to code which may run without that body completing.
|
if not isinstance(candidate, (ast.FunctionDef, ast.AsyncFunctionDef)):
|
||||||
This intentionally requires direct checks; arbitrary aliases/call graphs
|
continue
|
||||||
are not a proof that procfs exists at the enumeration site.
|
end = getattr(candidate, "end_lineno", None) or candidate.lineno
|
||||||
"""
|
if candidate.lineno <= node.lineno <= end:
|
||||||
scans = {id(site) for site in _scan_sites(tree)}
|
if best is tree or candidate.lineno > best.lineno:
|
||||||
guarded = set()
|
best = candidate
|
||||||
|
return best
|
||||||
def expression(node, present):
|
|
||||||
if node is None:
|
|
||||||
return
|
|
||||||
if id(node) in scans and present:
|
|
||||||
guarded.add(id(node))
|
|
||||||
if isinstance(node, ast.BoolOp):
|
|
||||||
for value in node.values:
|
|
||||||
expression(value, present)
|
|
||||||
# Later AND operands run only after a true prefix; later OR
|
|
||||||
# operands run only after a false prefix.
|
|
||||||
present = present or _condition_requires_procfs(value, isinstance(node.op, ast.And))
|
|
||||||
elif isinstance(node, ast.IfExp):
|
|
||||||
expression(node.test, present)
|
|
||||||
expression(node.body, present or _condition_requires_procfs(node.test, True))
|
|
||||||
expression(node.orelse, present or _condition_requires_procfs(node.test, False))
|
|
||||||
elif isinstance(node, (ast.ListComp, ast.SetComp, ast.GeneratorExp, ast.DictComp)):
|
|
||||||
for generator in node.generators:
|
|
||||||
expression(generator.iter, present)
|
|
||||||
for condition in generator.ifs:
|
|
||||||
expression(condition, present)
|
|
||||||
present = present or _condition_requires_procfs(condition, True)
|
|
||||||
for attr in ("elt", "key", "value"):
|
|
||||||
expression(getattr(node, attr, None), present)
|
|
||||||
elif isinstance(node, ast.Lambda):
|
|
||||||
expression(node.body, False)
|
|
||||||
else:
|
|
||||||
for child in ast.iter_child_nodes(node):
|
|
||||||
expression(child, present)
|
|
||||||
|
|
||||||
def block(statements, present):
|
|
||||||
for statement in statements:
|
|
||||||
if isinstance(statement, (ast.FunctionDef, ast.AsyncFunctionDef)):
|
|
||||||
block(statement.body, False)
|
|
||||||
for value in statement.decorator_list + statement.args.defaults:
|
|
||||||
expression(value, present)
|
|
||||||
elif isinstance(statement, ast.ClassDef):
|
|
||||||
block(statement.body, present)
|
|
||||||
elif isinstance(statement, ast.If):
|
|
||||||
expression(statement.test, present)
|
|
||||||
yes = block(statement.body, present or _condition_requires_procfs(statement.test, True))
|
|
||||||
no = block(statement.orelse, present or _condition_requires_procfs(statement.test, False))
|
|
||||||
continuing = [fact for fact in (yes, no) if fact is not None]
|
|
||||||
if not continuing:
|
|
||||||
return None
|
|
||||||
present = all(continuing)
|
|
||||||
elif isinstance(statement, (ast.Return, ast.Raise, ast.Break, ast.Continue)):
|
|
||||||
for child in ast.iter_child_nodes(statement):
|
|
||||||
expression(child, present)
|
|
||||||
return None
|
|
||||||
elif isinstance(statement, (ast.For, ast.AsyncFor, ast.While)):
|
|
||||||
condition = statement.test if isinstance(statement, ast.While) else statement.iter
|
|
||||||
expression(condition, present)
|
|
||||||
body_present = present or (isinstance(statement, ast.While) and _condition_requires_procfs(condition, True))
|
|
||||||
block(statement.body, body_present)
|
|
||||||
block(statement.orelse, present)
|
|
||||||
elif isinstance(statement, (ast.Try, getattr(ast, "TryStar", ast.Try))):
|
|
||||||
block(statement.body, present)
|
|
||||||
block(statement.orelse, present)
|
|
||||||
block(statement.finalbody, present)
|
|
||||||
for handler in statement.handlers:
|
|
||||||
block(handler.body, present)
|
|
||||||
elif isinstance(statement, (ast.With, ast.AsyncWith)):
|
|
||||||
for item in statement.items:
|
|
||||||
expression(item.context_expr, present)
|
|
||||||
block(statement.body, present)
|
|
||||||
else:
|
|
||||||
expression(statement, present)
|
|
||||||
return present
|
|
||||||
|
|
||||||
block(tree.body, False)
|
|
||||||
return guarded
|
|
||||||
|
|
||||||
|
|
||||||
def _app_python_files() -> list[Path]:
|
def _app_python_files() -> list[Path]:
|
||||||
@@ -216,10 +139,12 @@ def _collect_sites() -> tuple[list[str], list[str]]:
|
|||||||
sites = _scan_sites(tree)
|
sites = _scan_sites(tree)
|
||||||
if not sites:
|
if not sites:
|
||||||
continue
|
continue
|
||||||
guards = _guarded_scan_ids(tree)
|
guards = _guard_lines(tree)
|
||||||
for site in sites:
|
for site in sites:
|
||||||
|
scope = _enclosing_scope(tree, site)
|
||||||
|
start = getattr(scope, "lineno", 0)
|
||||||
label = f"{path.relative_to(REPO_ROOT)}:{site.lineno}"
|
label = f"{path.relative_to(REPO_ROOT)}:{site.lineno}"
|
||||||
if id(site) in guards:
|
if any(start <= g < site.lineno for g in guards):
|
||||||
guarded.append(label)
|
guarded.append(label)
|
||||||
else:
|
else:
|
||||||
unguarded.append(label)
|
unguarded.append(label)
|
||||||
@@ -229,7 +154,7 @@ def _collect_sites() -> tuple[list[str], list[str]]:
|
|||||||
def test_every_procfs_scan_is_guarded_by_an_existence_check():
|
def test_every_procfs_scan_is_guarded_by_an_existence_check():
|
||||||
_guarded, unguarded = _collect_sites()
|
_guarded, unguarded = _collect_sites()
|
||||||
assert not unguarded, (
|
assert not unguarded, (
|
||||||
"procfs pid scans without an effective conditional existence guard — "
|
"procfs pid scans with no existence check in the enclosing function — "
|
||||||
"these raise FileNotFoundError on macOS and Windows: "
|
"these raise FileNotFoundError on macOS and Windows: "
|
||||||
+ ", ".join(unguarded)
|
+ ", ".join(unguarded)
|
||||||
)
|
)
|
||||||
@@ -251,49 +176,3 @@ def test_the_guard_detector_still_sees_the_known_scans():
|
|||||||
f"root was renamed. Found: {sorted(found)}"
|
f"root was renamed. Found: {sorted(found)}"
|
||||||
)
|
)
|
||||||
assert len(found) >= 3, f"expected at least 3 procfs scans, found {sorted(found)}"
|
assert len(found) >= 3, f"expected at least 3 procfs scans, found {sorted(found)}"
|
||||||
|
|
||||||
|
|
||||||
@pytest.mark.parametrize("body", [
|
|
||||||
'Path("/proc").exists(); os.listdir("/proc")',
|
|
||||||
'if Path("/proc").exists():\n pass\nos.listdir("/proc")',
|
|
||||||
'if not Path("/proc").exists():\n os.listdir("/proc")',
|
|
||||||
'if ready or Path("/proc").exists():\n os.listdir("/proc")',
|
|
||||||
'if ready:\n Path("/proc").exists()\nos.listdir("/proc")',
|
|
||||||
'os.listdir("/proc"); Path("/proc").exists()',
|
|
||||||
'if Path("/tmp").exists():\n os.listdir("/proc")',
|
|
||||||
'def other():\n Path("/proc").exists()\nos.listdir("/proc")',
|
|
||||||
'if not has_procfs():\n pass\nos.listdir("/proc")',
|
|
||||||
'for x in []:\n if not has_procfs():\n return\nos.listdir("/proc")',
|
|
||||||
'if has_procfs():\n return\nelse:\n os.listdir("/proc")',
|
|
||||||
'[pid for pid in os.listdir("/proc") if has_procfs()]',
|
|
||||||
], ids=["ignored", "expired-branch", "inverted", "unsafe-or", "sibling-branch",
|
|
||||||
"too-late", "wrong-path", "other-function", "no-early-exit", "loop-may-not-run",
|
|
||||||
"wrong-else", "late-comprehension-filter"])
|
|
||||||
def test_guard_detector_rejects_ineffective_checks(body):
|
|
||||||
tree = ast.parse("def scan():\n" + "\n".join(" " + line for line in body.splitlines()))
|
|
||||||
sites = _scan_sites(tree)
|
|
||||||
assert sites, "negative control must contain a recognized enumeration"
|
|
||||||
assert any(id(site) not in _guarded_scan_ids(tree) for site in sites)
|
|
||||||
|
|
||||||
|
|
||||||
@pytest.mark.parametrize("body", [
|
|
||||||
'if Path("/proc").exists():\n os.listdir("/proc")',
|
|
||||||
'if not Path("/proc").exists():\n return\nos.listdir("/proc")',
|
|
||||||
'if not has_procfs():\n raise RuntimeError()\nos.listdir(PROC_ROOT)',
|
|
||||||
'if has_procfs():\n pass\nelse:\n return\nPROC_ROOT.iterdir()',
|
|
||||||
'if ready and has_procfs():\n os.scandir("/proc")',
|
|
||||||
'if not has_procfs() or disabled:\n return\nPROC_ROOT.glob("*")',
|
|
||||||
'if sys.platform == "linux" and has_procfs():\n PROC_ROOT.iterdir()',
|
|
||||||
'for item in items:\n if not has_procfs():\n continue\n os.listdir("/proc")',
|
|
||||||
'if os.path.isdir("/proc"):\n os.listdir("/proc")',
|
|
||||||
'if has_procfs() and list(PROC_ROOT.iterdir()):\n pass',
|
|
||||||
'if not has_procfs() or list(PROC_ROOT.iterdir()):\n pass',
|
|
||||||
'[pid for item in items if has_procfs() for pid in os.listdir("/proc")]',
|
|
||||||
], ids=["positive-branch", "early-return", "early-raise", "else-exits", "and",
|
|
||||||
"negative-or", "platform-and-procfs", "loop-continue", "isdir",
|
|
||||||
"short-circuit-and", "short-circuit-or", "guarded-comprehension"])
|
|
||||||
def test_guard_detector_preserves_effective_checks(body):
|
|
||||||
tree = ast.parse("def scan():\n" + "\n".join(" " + line for line in body.splitlines()))
|
|
||||||
sites = _scan_sites(tree)
|
|
||||||
assert sites, "positive control must contain a recognized enumeration"
|
|
||||||
assert all(id(site) in _guarded_scan_ids(tree) for site in sites)
|
|
||||||
|
|||||||
Reference in New Issue
Block a user