zerum 0.1.0

Deterministic-first Python code governance: native checks (ZR001–ZR010), CLI, and SARIF/JSON reporters
Documentation 
1
2
3
4
5
6
7
8
9
10
11
12
13
14
15
16
17
18
19
20
21
22
23
24
25
26
27
28
29
30
31
32
33
34
35
36
37
38
39
40
41
42
43
44
45
46
47
48
49
50
51
52
53
54
55
56
57
58
59
60
61
62
63
64
65
66
67
68
69
70
71
72
73
74
75
76
77
78
79
80
81
82
83
84
85
86
87
88
89
90
91
92

use crate::core::ast_util::walk_stmts_for_try;
use crate::core::{Category, Check, CheckContext, Issue, Severity};
use crate::parser::line_col;
use rustpython_ast::{ExceptHandler, Ranged};

pub struct BroadExcept;

impl Check for BroadExcept {
    fn id(&self) -> &'static str {
        "ZR005"
    }

    fn name(&self) -> &'static str {
        "broad-except"
    }

    fn category(&self) -> Category {
        Category::Warning
    }

    fn severity(&self) -> Severity {
        Severity::High
    }

    fn explanation(&self) -> &'static str {
        "Catching Exception or using bare except hides bugs and makes failures silent."
    }

    fn remediation(&self) -> &'static str {
        "Catch specific exception types and re-raise or log unexpected errors."
    }

    fn run(&self, ctx: &CheckContext) -> Vec<Issue> {
        if !ctx.config.is_check_enabled(self.id()) {
            return Vec::new();
        }

        let mut issues = Vec::new();
        walk_stmts_for_try(ctx.parsed, &mut |handler| {
            if crate::core::ast_util::is_broad_except_handler(handler) {
                let ExceptHandler::ExceptHandler(h) = handler;
                let (line, column) = line_col(&ctx.parsed.source, h.start().into());
                issues.push(Issue::from_check(
                    self,
                    "broad or bare except handler swallows errors",
                    ctx.file_path(),
                    line,
                    column,
                ));
            }
        });
        issues
    }
}

#[cfg(test)]
mod tests {
    use super::*;
    use crate::config::Config;
    use crate::parser::{PythonParser, RustPythonParser};
    use std::path::Path;

    #[test]
    fn flags_bare_except() {
        let source = "try:\n    pass\nexcept:\n    pass\n";
        let path = Path::new("t.py");
        let parsed = RustPythonParser.parse_file(source, path).unwrap();
        let config = Config::default();
        let ctx = CheckContext {
            path,
            source,
            parsed: &parsed,
            config: &config,
        };
        assert_eq!(BroadExcept.run(&ctx).len(), 1);
    }

    #[test]
    fn specific_except_is_clean() {
        let source = "try:\n    pass\nexcept ValueError:\n    pass\n";
        let path = Path::new("t.py");
        let parsed = RustPythonParser.parse_file(source, path).unwrap();
        let config = Config::default();
        let ctx = CheckContext {
            path,
            source,
            parsed: &parsed,
            config: &config,
        };
        assert!(BroadExcept.run(&ctx).is_empty());
    }
}