Skip to content
New issue

Have a question about this project? Sign up for a free GitHub account to open an issue and contact its maintainers and the community.

By clicking “Sign up for GitHub”, you agree to our terms of service and privacy statement. We’ll occasionally send you account related emails.

Already on GitHub? Sign in to your account

Fix default path include/exclude behavior; update codemod hierarchy #780

Merged
merged 6 commits into from
Aug 8, 2024

Conversation

drdavella
Copy link
Member

@drdavella drdavella commented Aug 7, 2024

Overview

Update default path include/exclude behavior; update codemod hierarchy

Description

  • Remediation codemods should not use default exclude paths: this would cause us to potentially ignore paths that are explicitly called out in tool findings
    • Find and fix codemods, on the other hand, should retain reasonable defaults wrt files to be excluded from analysis (e.g. .git, *.pyc, etc.)
    • In both cases, the include and exclude paths should remain configurable by the user
  • This PR refactors the base codemod hierarchy into two branches: one for find and fix, and one for remediation
  • Each respective base class defines appropriate behavior for path inclusion/exclusion
  • Both classes respect explicit settings
  • Much of the path includes/excludes state has been moved to CodemodExecutionContext where it can be easily cached and reused
  • This is a big, breaking change. We will likely release v2.0 as a result
  • This closes Default path includes/excludes should not be used for remediation codemods #761

@drdavella drdavella marked this pull request as ready for review August 7, 2024 21:24
@@ -6,7 +6,9 @@
"pixee:python/add-requests-timeouts",
"pixee:python/secure-random",
"pixee:python/sandbox-process-creation",
"pixee:python/subprocess-shell-false",
Copy link
Member Author

Choose a reason for hiding this comment

The reason will be displayed to describe this comment to others. Learn more.

This one is a result of adding --dry-run (which I was using locally while testing).

"pixee:python/django-session-cookie-secure-off",
"pixee:python/django-model-without-dunder-str",
Copy link
Member Author

Choose a reason for hiding this comment

The reason will be displayed to describe this comment to others. Learn more.

I'm not really sure how to account for this change 😅

Copy link
Contributor

Choose a reason for hiding this comment

The reason will be displayed to describe this comment to others. Learn more.

this is really surprising... I can see pygoat django Model classes that would merit this codemod, but why this wasn't getting triggered before 🤷

# run codemods one at a time making sure to respect the given sequence
for codemod in codemods_to_run:
# NOTE: this may be used as a progress indicator by upstream tools
logger.info("running codemod %s", codemod.id)

if isinstance(codemod.detector, SemgrepRuleDetector):
Copy link
Member Author

Choose a reason for hiding this comment

The reason will be displayed to describe this comment to others. Learn more.

This filtering logic is now handled by the codemod itself.

Copy link

sonarcloud bot commented Aug 7, 2024

Quality Gate Passed Quality Gate passed

Issues
1 New issue
0 Accepted issues

Measures
0 Security Hotspots
0.0% Coverage on New Code
0.0% Duplication on New Code

See analysis details on SonarCloud

Copy link
Contributor

@clavedeluna clavedeluna left a comment

Choose a reason for hiding this comment

The reason will be displayed to describe this comment to others. Learn more.

the changes and tests all look as expected, awesome work!

"pixee:python/django-session-cookie-secure-off",
"pixee:python/django-model-without-dunder-str",
Copy link
Contributor

Choose a reason for hiding this comment

The reason will be displayed to describe this comment to others. Learn more.

this is really surprising... I can see pygoat django Model classes that would merit this codemod, but why this wasn't getting triggered before 🤷

@drdavella drdavella added this pull request to the merge queue Aug 8, 2024
Merged via the queue into main with commit 2c63203 Aug 8, 2024
13 checks passed
@drdavella drdavella deleted the fix-path-include-exclude branch August 8, 2024 14:33
Sign up for free to join this conversation on GitHub. Already have an account? Sign in to comment
Labels
None yet
Projects
None yet
Development

Successfully merging this pull request may close these issues.

Default path includes/excludes should not be used for remediation codemods
2 participants