use super::{RuleConfigurability, RuleDefaultSeverity, RuleDefinition, RuleLanguage, RuleStatus};
pub(crate) const RULE_DEFINITIONS: &[RuleDefinition] = &[
RuleDefinition {
id: "async_lock_held_across_await",
language: RuleLanguage::Python,
family: "quality",
default_severity: RuleDefaultSeverity::Contextual,
status: RuleStatus::Stable,
configurability: &[
RuleConfigurability::Disable,
RuleConfigurability::Ignore,
RuleConfigurability::SeverityOverride,
],
description: "Async lock scopes or explicit acquire/release regions that continue across unrelated await points.",
binding_location: super::bindings::PYTHON_QUALITY,
},
RuleDefinition {
id: "async_retry_sleep_without_backoff",
language: RuleLanguage::Python,
family: "quality",
default_severity: RuleDefaultSeverity::Contextual,
status: RuleStatus::Stable,
configurability: &[
RuleConfigurability::Disable,
RuleConfigurability::Ignore,
RuleConfigurability::SeverityOverride,
],
description: "Retry-style async loops that sleep a fixed interval without visible backoff, jitter, or bounded retry policy.",
binding_location: super::bindings::PYTHON_QUALITY,
},
RuleDefinition {
id: "background_task_exception_unobserved",
language: RuleLanguage::Python,
family: "quality",
default_severity: RuleDefaultSeverity::Contextual,
status: RuleStatus::Stable,
configurability: &[
RuleConfigurability::Disable,
RuleConfigurability::Ignore,
RuleConfigurability::SeverityOverride,
],
description: "Background task bindings with no obvious await, callback, supervisor, or observation path.",
binding_location: super::bindings::PYTHON_QUALITY,
},
RuleDefinition {
id: "dataclass_heavy_post_init",
language: RuleLanguage::Python,
family: "quality",
default_severity: RuleDefaultSeverity::Contextual,
status: RuleStatus::Stable,
configurability: &[
RuleConfigurability::Disable,
RuleConfigurability::Ignore,
RuleConfigurability::SeverityOverride,
],
description: "Dataclass __post_init__ methods that perform I/O, subprocess, network, or heavyweight client setup.",
binding_location: super::bindings::PYTHON_QUALITY,
},
RuleDefinition {
id: "dataclass_mutable_default",
language: RuleLanguage::Python,
family: "quality",
default_severity: RuleDefaultSeverity::Contextual,
status: RuleStatus::Stable,
configurability: &[
RuleConfigurability::Disable,
RuleConfigurability::Ignore,
RuleConfigurability::SeverityOverride,
],
description: "Dataclass fields that use mutable defaults instead of default_factory.",
binding_location: super::bindings::PYTHON_QUALITY,
},
RuleDefinition {
id: "import_time_config_load",
language: RuleLanguage::Python,
family: "quality",
default_severity: RuleDefaultSeverity::Contextual,
status: RuleStatus::Stable,
configurability: &[
RuleConfigurability::Disable,
RuleConfigurability::Ignore,
RuleConfigurability::SeverityOverride,
],
description: "Module-scope configuration or secret loading that runs during import instead of an explicit startup path.",
binding_location: super::bindings::PYTHON_QUALITY,
},
RuleDefinition {
id: "import_time_file_io",
language: RuleLanguage::Python,
family: "quality",
default_severity: RuleDefaultSeverity::Contextual,
status: RuleStatus::Stable,
configurability: &[
RuleConfigurability::Disable,
RuleConfigurability::Ignore,
RuleConfigurability::SeverityOverride,
],
description: "Module-scope file reads, writes, or directory scans that happen during import.",
binding_location: super::bindings::PYTHON_QUALITY,
},
RuleDefinition {
id: "import_time_network_call",
language: RuleLanguage::Python,
family: "quality",
default_severity: RuleDefaultSeverity::Contextual,
status: RuleStatus::Stable,
configurability: &[
RuleConfigurability::Disable,
RuleConfigurability::Ignore,
RuleConfigurability::SeverityOverride,
],
description: "Module-scope HTTP or socket calls executed while the module is imported.",
binding_location: super::bindings::PYTHON_QUALITY,
},
RuleDefinition {
id: "import_time_subprocess",
language: RuleLanguage::Python,
family: "quality",
default_severity: RuleDefaultSeverity::Contextual,
status: RuleStatus::Stable,
configurability: &[
RuleConfigurability::Disable,
RuleConfigurability::Ignore,
RuleConfigurability::SeverityOverride,
],
description: "Subprocess launches triggered from module scope during import.",
binding_location: super::bindings::PYTHON_QUALITY,
},
RuleDefinition {
id: "module_singleton_client_side_effect",
language: RuleLanguage::Python,
family: "quality",
default_severity: RuleDefaultSeverity::Contextual,
status: RuleStatus::Stable,
configurability: &[
RuleConfigurability::Disable,
RuleConfigurability::Ignore,
RuleConfigurability::SeverityOverride,
],
description: "Eagerly constructed network, database, or cloud clients bound at module scope.",
binding_location: super::bindings::PYTHON_QUALITY,
},
RuleDefinition {
id: "mutable_default_argument",
language: RuleLanguage::Python,
family: "quality",
default_severity: RuleDefaultSeverity::Contextual,
status: RuleStatus::Stable,
configurability: &[
RuleConfigurability::Disable,
RuleConfigurability::Ignore,
RuleConfigurability::SeverityOverride,
],
description: "Function parameters that use mutable defaults such as [], {}, or set() directly in the signature.",
binding_location: super::bindings::PYTHON_QUALITY,
},
RuleDefinition {
id: "mutable_module_global_state",
language: RuleLanguage::Python,
family: "quality",
default_severity: RuleDefaultSeverity::Contextual,
status: RuleStatus::Stable,
configurability: &[
RuleConfigurability::Disable,
RuleConfigurability::Ignore,
RuleConfigurability::SeverityOverride,
],
description: "Mutable module globals updated from multiple functions.",
binding_location: super::bindings::PYTHON_QUALITY,
},
RuleDefinition {
id: "option_bag_model",
language: RuleLanguage::Python,
family: "quality",
default_severity: RuleDefaultSeverity::Contextual,
status: RuleStatus::Stable,
configurability: &[
RuleConfigurability::Disable,
RuleConfigurability::Ignore,
RuleConfigurability::SeverityOverride,
],
description: "Dataclass or TypedDict models that accumulate many optional fields and boolean switches.",
binding_location: super::bindings::PYTHON_QUALITY,
},
RuleDefinition {
id: "pickle_deserialization_boundary",
language: RuleLanguage::Python,
family: "quality",
default_severity: RuleDefaultSeverity::Contextual,
status: RuleStatus::Stable,
configurability: &[
RuleConfigurability::Disable,
RuleConfigurability::Ignore,
RuleConfigurability::SeverityOverride,
],
description: "pickle.load(s) or dill.load(s) style deserialization in production code.",
binding_location: super::bindings::PYTHON_QUALITY,
},
RuleDefinition {
id: "public_any_type_leak",
language: RuleLanguage::Python,
family: "quality",
default_severity: RuleDefaultSeverity::Contextual,
status: RuleStatus::Stable,
configurability: &[
RuleConfigurability::Disable,
RuleConfigurability::Ignore,
RuleConfigurability::SeverityOverride,
],
description: "Public functions or model fields that expose Any, object, or similarly wide contracts.",
binding_location: super::bindings::PYTHON_QUALITY,
},
RuleDefinition {
id: "subprocess_shell_true",
language: RuleLanguage::Python,
family: "quality",
default_severity: RuleDefaultSeverity::Contextual,
status: RuleStatus::Stable,
configurability: &[
RuleConfigurability::Disable,
RuleConfigurability::Ignore,
RuleConfigurability::SeverityOverride,
],
description: "Subprocess boundaries that enable shell=True.",
binding_location: super::bindings::PYTHON_QUALITY,
},
RuleDefinition {
id: "tar_extractall_unfiltered",
language: RuleLanguage::Python,
family: "quality",
default_severity: RuleDefaultSeverity::Contextual,
status: RuleStatus::Stable,
configurability: &[
RuleConfigurability::Disable,
RuleConfigurability::Ignore,
RuleConfigurability::SeverityOverride,
],
description: "tarfile.extractall(...) without an obvious filter, members list, or path-validation helper.",
binding_location: super::bindings::PYTHON_QUALITY,
},
RuleDefinition {
id: "tempfile_without_cleanup",
language: RuleLanguage::Python,
family: "quality",
default_severity: RuleDefaultSeverity::Contextual,
status: RuleStatus::Stable,
configurability: &[
RuleConfigurability::Disable,
RuleConfigurability::Ignore,
RuleConfigurability::SeverityOverride,
],
description: "Temporary files or directories created without a visible cleanup or context-manager ownership path.",
binding_location: super::bindings::PYTHON_QUALITY,
},
RuleDefinition {
id: "typeddict_unchecked_access",
language: RuleLanguage::Python,
family: "quality",
default_severity: RuleDefaultSeverity::Contextual,
status: RuleStatus::Stable,
configurability: &[
RuleConfigurability::Disable,
RuleConfigurability::Ignore,
RuleConfigurability::SeverityOverride,
],
description: "Direct indexing of optional TypedDict keys without an obvious guard path.",
binding_location: super::bindings::PYTHON_QUALITY,
},
RuleDefinition {
id: "unsafe_yaml_loader",
language: RuleLanguage::Python,
family: "quality",
default_severity: RuleDefaultSeverity::Contextual,
status: RuleStatus::Stable,
configurability: &[
RuleConfigurability::Disable,
RuleConfigurability::Ignore,
RuleConfigurability::SeverityOverride,
],
description: "yaml.load(...) or full_load(...) style loaders used where safe loading is more appropriate.",
binding_location: super::bindings::PYTHON_QUALITY,
},
RuleDefinition {
id: "untracked_asyncio_task",
language: RuleLanguage::Python,
family: "quality",
default_severity: RuleDefaultSeverity::Contextual,
status: RuleStatus::Stable,
configurability: &[
RuleConfigurability::Disable,
RuleConfigurability::Ignore,
RuleConfigurability::SeverityOverride,
],
description: "asyncio.create_task(...) or similar task creation whose handle is discarded immediately.",
binding_location: super::bindings::PYTHON_QUALITY,
},
];