7ee5300d43
AST-aware, stdlib-only static checks: swallowed-exception-around-write (C1), undefined-name (C2), hardcoded-secret-literal (C3), fail-open-flag (C4), rotated-secret-captured-once (C5). Tests + CI + examples included. Co-Authored-By: Claude Fable 5 <noreply@anthropic.com>
42 lines
1.2 KiB
Python
42 lines
1.2 KiB
Python
"""Clean fixture — the corrected version of every pattern in buggy_sample.py.
|
|
The detector should report ZERO findings here (false-positive guard)."""
|
|
import os
|
|
import logging
|
|
import redis
|
|
|
|
log = logging.getLogger(__name__)
|
|
DB_PASSWORD = os.environ["DB_PASSWORD"] # read from env, not inline
|
|
|
|
|
|
def record_metric(name, value):
|
|
try:
|
|
r = redis.Redis(host=os.environ.get("CACHE_HOST", "localhost"))
|
|
r.hset("metrics", name, value)
|
|
except Exception:
|
|
log.exception("metric write failed for %s", name) # logs, not swallowed
|
|
raise
|
|
|
|
|
|
def compute_total(items):
|
|
running = 0 # initialized
|
|
for item in items:
|
|
running += item
|
|
return running
|
|
|
|
|
|
def is_killed():
|
|
client = redis.from_url(os.environ.get("FLAG_REDIS_URL", "redis://localhost"))
|
|
val = client.get("kill_switch")
|
|
if val is None: # presence assert -> fail CLOSED
|
|
raise RuntimeError("kill flag missing; refusing to arm")
|
|
return val == b"1"
|
|
|
|
|
|
def daemon():
|
|
while True:
|
|
token = os.environ.get("API_TOKEN") # re-read each loop, rotation-safe
|
|
call_api(token)
|
|
|
|
|
|
def call_api(token):
|
|
...
|