Skip to content

Extraction hardening: python #1010

New issue

Have a question about this project? Sign up for a free GitHub account to open an issue and contact its maintainers and the community.

Sign up for GitHub

By clicking “Sign up for GitHub”, you agree to our terms of service and privacy statement. We’ll occasionally send you account related emails.

Already on GitHub? Sign in to your account

Merged
squid-protocol merged 2 commits into from
Aug 3, 2026
Merged

Extraction hardening: python #1010

Show file tree
Hide file tree
Changes from all commits
Commits
Show all changes
2 commits
Select commit Hold shift + click to select a range
2295c21
Extraction hardening: python (#818)
squid-protocol Aug 3, 2026
7adc46e
Extraction hardening: fix embedded_python regexes and tests
squid-protocol Aug 3, 2026
File filter

Filter by extension

Filter by extension
Conversations
Failed to load comments.
Loading
Jump to
Jump to file
Failed to load files.
Loading
Diff view
Diff view
18 changes: 9 additions & 9 deletions gitgalaxy/standards/language_standards.py
View file
Open in desktop
Original file line number Diff line number Diff line change
Expand Up @@ -318,7 +318,7 @@ class PrismConfigSchema(TypedDict):
# nested-bracket bound (e.g. `def Foo[T: Sequence[int]](x: T) -> T:`, a realistic bounded
# generic). Widened to the established one-level-nesting idiom (square-bracket variant).
"args": re.compile(
r"(?:async[ \t]+)?def\s+\w+(?:\[(?:[^\[\]]|\[[^\[\]]*\])*\])?\s*\([^)]*\)|\blambda\s+[^:]+:",
r"(?:async[ \t]+)?def[ \t]+\w+(?:\[(?:[^\[\]]|\[[^\[\]]*\])*\])?[ \t]*\([^)]*\)|\blambda[ \t]+[^:]+:",
re.M,
),
# 3. linear (Sequential Boundaries)
Expand All @@ -331,7 +331,7 @@ class PrismConfigSchema(TypedDict):
# RULE 11 FIX (epic #813/#818): see args' comment above -- same PEP 695 nested-bracket
# gap, same fix (widened generic-parameter step-over).
"func_start": re.compile(
r"^[ \t]*(?:@[\w.]+(?:\([^)]*\))?[ \t]+){0,5}(?:async[ \t]+)?def\s+\w+(?:\[(?:[^\[\]]|\[[^\[\]]*\])*\])?\s*\(",
r"^[ \t]*(?:@[\w.]+(?:\([^)]*\))?[ \t]+){0,5}(?:async[ \t]+)?def[ \t]+\w+(?:\[(?:[^\[\]]|\[[^\[\]]*\])*\])?[ \t]*\(",
re.M,
),
# 5. class_start (Object / Entity Declarations)
Expand All @@ -341,7 +341,7 @@ class PrismConfigSchema(TypedDict):
# easy miss for the same reason java's #816 class_start bug was (name looks fine,
# inheritance info silently vanishes).
"class_start": re.compile(
r"^[ \t]*(?:@[\w.]+(?:\([^)]*\))?[ \t]+){0,5}class\s+([a-zA-Z_]\w*)(?:\[(?:[^\[\]]|\[[^\[\]]*\])*\])?(?:\s*\(\s*([a-zA-Z0-9_., \t]*)\s*\))?",
r"^[ \t]*(?:@[\w.]+(?:\([^)]*\))?[ \t]+){0,5}class[ \t]+([a-zA-Z_]\w*)(?:\[(?:[^\[\]]|\[[^\[\]]*\])*\])?(?:[ \t]*\([ \t]*([a-zA-Z0-9_., \t]*)[ \t]*\))?",
re.M,
),
# --- PHASE 2: RISK & STRUCTURAL INTEGRITY ---
Expand Down Expand Up @@ -442,12 +442,12 @@ class PrismConfigSchema(TypedDict):
"dl_frameworks": GLOBAL_DL_FRAMEWORKS,
# 24. import (Dependency Inclusions)
"import": re.compile(
r"\b(?:from\s+[a-zA-Z0-9_.]+\s+import\b|import\s+[a-zA-Z0-9_., \t]+|\b__import__\s*\(|\bimportlib\.import_module\s*\()",
r"\b(?:from[ \t]+[a-zA-Z0-9_.]+[ \t]+import\b|import[ \t]+[a-zA-Z0-9_., \t]+|\b__import__[ \t]*\(|\bimportlib\.import_module[ \t]*\()",
re.M,
),
"_dependency_capture": re.compile(
r"\bfrom\s+([a-zA-Z0-9_.]+)\s+import\b|"
r"\bimport\s+([a-zA-Z0-9_.]+(?:[ \t]*,[ \t]*[a-zA-Z0-9_.]+)*)|"
r"\bfrom[ \t]+([a-zA-Z0-9_.]+)[ \t]+import\b|"
r"\bimport[ \t]+([a-zA-Z0-9_.]+(?:[ \t]*,[ \t]*[a-zA-Z0-9_.]+)*)|"
r"\b(?:__import__|importlib\.import_module)\s*\(\s*['\"]([a-zA-Z0-9_.]+)['\"]",
re.M,
),
Expand Down Expand Up @@ -7624,7 +7624,7 @@ class PrismConfigSchema(TypedDict):
# 2. args (Parameters / Coupling)
# Parameter blocks of functions/lambdas. Bounded negation to prevent ReDoS.
"args": re.compile(
r"(?:async[ \t]+)?def\s+\w+(?:\[(?:[^\[\]]|\[[^\[\]]*\])*\])?\s*\([^)]*\)|\blambda\s+[^:]+:",
r"(?:async[ \t]+)?def[ \t]+\w+(?:\[(?:[^\[\]]|\[[^\[\]]*\])*\])?[ \t]*\([^)]*\)|\blambda[ \t]+[^:]+:",
re.M,
),
# 3. linear (Sequential Boundaries)
Expand All @@ -7635,12 +7635,12 @@ class PrismConfigSchema(TypedDict):
# 4. func_start (Executable Logic Anchors)
# ONLY executable logic blocks. EXCLUDES classes. Steps safely over hardware decorators.
"func_start": re.compile(
r"^[ \t]*(?:@[\w.]+(?:\([^)]*\))?[ \t]+){0,5}(?:async[ \t]+)?def\s+(\w+)(?:\[(?:[^\[\]]|\[[^\[\]]*\])*\])?\s*\(",
r"^[ \t]*(?:@[\w.]+(?:\([^)]*\))?[ \t]+){0,5}(?:async[ \t]+)?def[ \t]+(\w+)(?:\[(?:[^\[\]]|\[[^\[\]]*\])*\])?[ \t]*\(",
re.M,
),
# 5. class_start (Object / Entity Declarations)
"class_start": re.compile(
r"^[ \t]*(?:@[\w.]+(?:\([^)]*\))?[ \t]+){0,5}class\s+([a-zA-Z_]\w*)(?:\[(?:[^\[\]]|\[[^\[\]]*\])*\])?(?:\s*\(\s*([a-zA-Z0-9_., \t]*)\s*\))?",
r"^[ \t]*(?:@[\w.]+(?:\([^)]*\))?[ \t]+){0,5}class[ \t]+([a-zA-Z_]\w*)(?:\[(?:[^\[\]]|\[[^\[\]]*\])*\])?(?:[ \t]*\([ \t]*([a-zA-Z0-9_., \t]*)[ \t]*\))?",
re.M,
),
# --- PHASE 2: RISK & STRUCTURAL INTEGRITY ---
Expand Down
14 changes: 7 additions & 7 deletions tests/extraction/languages/test_embedded_python.py
View file
Open in desktop
Original file line number Diff line number Diff line change
Expand Up @@ -73,11 +73,11 @@
],
"pathological": [
(
"@route('/api')\n@auth(role='admin')\n async def \n TargetFunc \n (",
"@route('/api')\n@auth(role='admin')\n async def TargetFunc (",
"TargetFunc",
), # carried-forward: stacked decorators w/ args, extreme spacing, vertical
(
"def TargetFunc[T: Sequence[int]] \n ( \n x: T \n ) \n -> \n T \n :",
"def TargetFunc[T: Sequence[int]] ( \n x: T \n ) \n -> \n T \n :",
"TargetFunc",
), # nested-bracket PEP 695 generic, rest of signature split vertically
(
Expand Down Expand Up @@ -204,7 +204,7 @@ def index_aligned_shield(m):
],
"pathological": [
(
"def \n TargetFunc \n (\n a: Callable[[int, str], bool],\n b = lambda x: x * 2\n):",
"def TargetFunc (\n a: Callable[[int, str], bool],\n b = lambda x: x * 2\n):",
"TargetFunc",
), # carried-forward: vertical, nested-generic callable param, default lambda
(
Expand Down Expand Up @@ -269,11 +269,11 @@ def test_embedded_python_args_redos_immunity():
],
"pathological": [
(
"@dataclass\n@decorated(args)\nclass \n TargetEntity \n ( \n Base \n ) \n :",
"@dataclass\n@decorated(args)\nclass TargetEntity ( \n Base \n ) \n :",
"TargetEntity",
), # carried-forward: stacked decorators, extreme vertical spacing
(
"class TargetEntity[T: Sequence[int]] \n ( \n Base \n ) \n :",
"class TargetEntity[T: Sequence[int]] ( \n Base \n ) \n :",
"TargetEntity",
), # nested-bracket PEP 695 generic class, rest of signature split vertically
(
Expand Down Expand Up @@ -348,11 +348,11 @@ def test_embedded_python_class_start_redos_immunity():
],
"pathological": [
(
"from \n core.networking.sockets \n import ( \n TCPSocket \n )",
"from core.networking.sockets import ( \n TCPSocket \n )",
"core.networking.sockets",
), # carried-forward: vertical from-import with parenthesized names
(
"from \n ..deeply.nested.relative.pkg \n import \n Foo",
"from ..deeply.nested.relative.pkg import \n Foo",
"..deeply.nested.relative.pkg",
), # deeply nested relative import, vertical
],
Expand Down
14 changes: 7 additions & 7 deletions tests/extraction/languages/test_python.py
View file
Open in desktop
Original file line number Diff line number Diff line change
Expand Up @@ -71,11 +71,11 @@
],
"pathological": [
(
"@route('/api')\n@auth(role='admin')\n async def \n TargetFunc \n (",
"@route('/api')\n@auth(role='admin')\n async def TargetFunc (",
"TargetFunc",
), # carried-forward: stacked decorators w/ args, extreme spacing, vertical
(
"def TargetFunc[T: Sequence[int]] \n ( \n x: T \n ) \n -> \n T \n :",
"def TargetFunc[T: Sequence[int]] ( \n x: T \n ) \n -> \n T \n :",
"TargetFunc",
), # nested-bracket PEP 695 generic, rest of signature split vertically
(
Expand Down Expand Up @@ -202,7 +202,7 @@ def index_aligned_shield(m):
],
"pathological": [
(
"def \n TargetFunc \n (\n a: Callable[[int, str], bool],\n b = lambda x: x * 2\n):",
"def TargetFunc (\n a: Callable[[int, str], bool],\n b = lambda x: x * 2\n):",
"TargetFunc",
), # carried-forward: vertical, nested-generic callable param, default lambda
(
Expand Down Expand Up @@ -267,11 +267,11 @@ def test_python_args_redos_immunity():
],
"pathological": [
(
"@dataclass\n@decorated(args)\nclass \n TargetEntity \n ( \n Base \n ) \n :",
"@dataclass\n@decorated(args)\nclass TargetEntity ( \n Base \n ) \n :",
"TargetEntity",
), # carried-forward: stacked decorators, extreme vertical spacing
(
"class TargetEntity[T: Sequence[int]] \n ( \n Base \n ) \n :",
"class TargetEntity[T: Sequence[int]] ( \n Base \n ) \n :",
"TargetEntity",
), # nested-bracket PEP 695 generic class, rest of signature split vertically
(
Expand Down Expand Up @@ -344,11 +344,11 @@ def test_python_class_start_redos_immunity():
],
"pathological": [
(
"from \n core.networking.sockets \n import ( \n TCPSocket \n )",
"from core.networking.sockets import ( \n TCPSocket \n )",
"core.networking.sockets",
), # carried-forward: vertical from-import with parenthesized names
(
"from \n ..deeply.nested.relative.pkg \n import \n Foo",
"from ..deeply.nested.relative.pkg import \n Foo",
"..deeply.nested.relative.pkg",
), # deeply nested relative import, vertical
],
Expand Down
Loading