Expand description
Dynamic-code risk detection for the Python frontend.
detect walks a function’s own body for dangerous Python patterns and
emits a RiskFeature per signal. This is the libcst analog of
fxrank-lang-ts’s detect/risk.rs.
§Dedup note — type.escape is NOT detected here
The Any-family type.escape risk is OWNED by the coverage gate in
analyze_unit (Task 9). This module detects type.escape only for the
non-null-assertion signal in the TS frontend — there is no direct Python
analog. Do not emit type.escape here.
§Signals detected
| signal | RiskKind | tier |
|---|---|---|
eval(…) | DynamicCode | exact |
exec(…) | DynamicCode | exact |
compile(…) | DynamicCode | exact |
__import__(…) | DynamicCode | exact |
pickle.load(…) / pickle.loads(…) | DynamicCode | path |
yaml.load(…) (not yaml.safe_load) | DynamicCode | path |
importlib.import_module(…) | DynamicCode | path |
setattr(<imported module/class>, …) | DynamicCode | heuristic |
subprocess(…, shell=True) | DynamicCode | path |
§Shell=True companion note
Task 6 (calls::detect) already emits a process.control EFFECT for any
subprocess.* call. This module adds the RISK (dynamic.code class 7) only
when shell=True is a keyword argument — signalling shell-injection surface.
Do NOT emit a second process.control effect here.
§Setattr guard
Only setattr whose first argument is a name that resolves to an imported
module or imported class-like (i.e. present in the import table) is flagged
as monkey-patching. Ordinary setattr(obj, "x", v) on a non-imported
name is NOT flagged.
Functions§
- detect
- Detect dynamic-code risk features in
unit’s own body.