mirror of
https://github.com/anthropics/claude-plugins-official.git
synced 2026-08-24 09:17:08 -03:00
33 lines
1.2 KiB
Python
33 lines
1.2 KiB
Python
"""The snippet of a hard-coded credential finding, withheld from what the products carry.
|
|
|
|
The line such a finding quotes is the credential itself, and the JSONL and
|
|
SARIF files exist to leave the machine (a code scanning upload, a CI
|
|
artifact), so neither file quotes it: the finding's file, line and symbol
|
|
still locate the code, and the SARIF result's message says why no line is
|
|
quoted. Only the emitted copy changes: the finding is still placed on the
|
|
snippet as the researcher quoted it, and its fingerprint hashes no text of
|
|
the file (see sarif.fingerprint).
|
|
"""
|
|
|
|
from __future__ import annotations
|
|
|
|
from typing import TYPE_CHECKING
|
|
|
|
from . import cwe
|
|
|
|
if TYPE_CHECKING:
|
|
from .finding import Finding
|
|
|
|
# CWE's Simplified Mapping entry Use of Hard-coded Credentials; CWE-259, 321 and 671 roll up to it.
|
|
CREDENTIALS = 798
|
|
|
|
|
|
def is_credential(finding: Finding) -> bool:
|
|
"""Whether the finding's CWE rolls up to Use of Hard-coded Credentials."""
|
|
return cwe.catalog.category_of.get(cwe.id_number(finding["cwe_id"])) == CREDENTIALS
|
|
|
|
|
|
def withheld(finding: Finding) -> Finding:
|
|
"""`finding` as the products carry it: a hard-coded credential's snippet is empty."""
|
|
return {**finding, "snippet": ""} if is_credential(finding) else finding
|