jcloude/press-semgrep-rules.yml
2025-12-23 19:25:50 +08:00

140 lines
3.5 KiB
YAML

rules:
- id: possible-mutable-default-args
pattern-either:
- pattern: |
def $FUNC(..., $ARG = $FUNC2(...), ...):
...
- pattern: |
def $FUNC(..., $ARG = $FUNC2(...).$ATTR, ...):
...
- pattern: |
def $FUNC(..., $ARG = frappe.$ATTR, ...):
...
message: |
`$ARG` is possibly a mutable default argument. May not work as expected during subsequent calls of `$FUNC` without $ARG.
languages:
- python
severity: WARNING
metadata:
category: correctness
technology:
- python
references:
- https://docs.python-guide.org/writing/gotchas/#mutable-default-arguments
- id: frappe-using-db-sql
pattern-either:
- pattern: frappe.db.sql(...)
- pattern: frappe.db.sql_ddl(...)
- pattern: frappe.db.sql_list(...)
paths:
exclude:
- "test_*.py"
message: |
The PR contains a SQL query that may be re-written with frappe.qb (https://frappeframework.com/docs/user/en/api/query-builder) or the Database API (https://frappeframework.com/docs/user/en/api/database)
languages: [python]
severity: WARNING
- id: except-with-db-code
languages:
- python
patterns:
- pattern-inside: |
try:
...
except ...:
$ERR_HANDL_BLK
- pattern-either:
- pattern: |
try:
...
except ...:
...
$PG.save(...)
...
raise
...
- pattern: |
try:
...
except ...:
...
frappe. ... .set_value(...)
...
raise
...
- pattern: |
try:
...
except ...:
...
$PG.db_set(...)
...
raise
...
- pattern-not: |
try:
...
except ...:
...
$PG.save(...)
...
frappe.db.commit(...)
raise
...
- pattern-not: |
try:
...
except ...:
...
frappe. ... .set_value(...)
...
frappe.db.commit(...)
raise
...
- pattern-not: |
try:
...
except ...:
...
$PG.db_set(...)
...
frappe.db.commit(...)
...
raise
...
- focus-metavariable: $ERR_HANDL_BLK
message: except block has no db commit before raise. The db changes made won't persist assuming innodb tables.
severity: ERROR
- id: retries-without-until
languages:
- yaml
patterns:
- pattern: |
...
retries: $RETRIES
delay: $DELAY
...
- pattern-not: |
...
retries: $RETRIES
delay: $DELAY
until: $UNTIL
...
paths:
include:
- 'press/playbooks/**/*.yml'
message: retry block doesn't have until condition. Only works with ansible 2.16 and above.
severity: ERROR
metadata:
category: correctness
references:
- https://docs.ansible.com/ansible/latest/playbook_guide/playbooks_loops.html#retrying-a-task-until-a-condition-is-met
- https://docs.ansible.com/ansible/latest/reference_appendices/release_and_maintenance.html#ansible-community-changelogs