diff --git a/README.md b/README.md index 156c0c3..8ffba34 100644 --- a/README.md +++ b/README.md @@ -69,7 +69,7 @@ Create a `.pre-commit-config.yaml` file in your project root: ```yaml repos: - repo: https://github.com/TriaFed/pre-commit-library - rev: v1.1.5 + rev: v1.1.6 hooks: # Security hooks (recommended for all projects) - id: detect_secrets @@ -176,7 +176,7 @@ For projects using GenAI tools, start with these essential security hooks: ```yaml repos: - repo: https://github.com/TriaFed/pre-commit-library - rev: v1.1.5 + rev: v1.1.6 hooks: - id: detect_secrets - id: hardcoded_credentials @@ -193,7 +193,7 @@ repos: ```yaml repos: - repo: https://github.com/TriaFed/pre-commit-library - rev: v1.1.5 + rev: v1.1.6 hooks: # Security - id: detect_secrets @@ -223,7 +223,7 @@ repos: ```yaml repos: - repo: https://github.com/TriaFed/pre-commit-library - rev: v1.1.5 + rev: v1.1.6 hooks: # Security - id: detect_secrets @@ -251,7 +251,7 @@ repos: ```yaml repos: - repo: https://github.com/TriaFed/pre-commit-library - rev: v1.1.5 + rev: v1.1.6 hooks: # Security - id: detect_secrets @@ -280,7 +280,7 @@ repos: ```yaml repos: - repo: https://github.com/TriaFed/pre-commit-library - rev: v1.1.5 + rev: v1.1.6 hooks: # Security - id: detect_secrets @@ -307,7 +307,7 @@ repos: ```yaml repos: - repo: https://github.com/TriaFed/pre-commit-library - rev: v1.1.5 + rev: v1.1.6 hooks: # Security - id: detect_secrets @@ -334,7 +334,7 @@ repos: ```yaml repos: - repo: https://github.com/TriaFed/pre-commit-library - rev: v1.1.5 + rev: v1.1.6 hooks: # Security - id: detect_secrets @@ -360,7 +360,7 @@ repos: ```yaml repos: - repo: https://github.com/TriaFed/pre-commit-library - rev: v1.1.5 + rev: v1.1.6 hooks: # Security - id: detect_secrets @@ -388,7 +388,7 @@ repos: ```yaml repos: - repo: https://github.com/TriaFed/pre-commit-library - rev: v1.1.5 + rev: v1.1.6 hooks: # Security (essential for GenAI projects) - id: detect_secrets @@ -677,7 +677,7 @@ For large repositories: ```yaml repos: - repo: https://github.com/TriaFed/pre-commit-library - rev: v1.1.5 + rev: v1.1.6 hooks: - id: detect_secrets exclude: ^(docs/|tests/fixtures/) diff --git a/examples/ansible-project.yaml b/examples/ansible-project.yaml index da70ff7..7e0efeb 100644 --- a/examples/ansible-project.yaml +++ b/examples/ansible-project.yaml @@ -2,8 +2,8 @@ # Setup for Ansible playbooks and roles with security focus repos: - - repo: https://github.com/TriaFed/pre-commit-library - rev: v1.1.5 # Use the latest version + - repo: https://github.com/david-parker-softrams/pre-commit-library + rev: v1.1.6 # Use the latest version hooks: # Security hooks (essential for GenAI projects) - id: detect_secrets diff --git a/examples/dotnet-project.yaml b/examples/dotnet-project.yaml index 376575b..5e6c79e 100644 --- a/examples/dotnet-project.yaml +++ b/examples/dotnet-project.yaml @@ -2,8 +2,8 @@ # Setup for C#, VB.NET, and F# development with security focus repos: - - repo: https://github.com/TriaFed/pre-commit-library - rev: v1.1.5 # Use the latest version + - repo: https://github.com/david-parker-softrams/pre-commit-library + rev: v1.1.6 # Use the latest version hooks: # Security hooks (essential for GenAI projects) - id: detect_secrets diff --git a/examples/full-stack.yaml b/examples/full-stack.yaml index 35d7333..740a492 100644 --- a/examples/full-stack.yaml +++ b/examples/full-stack.yaml @@ -2,8 +2,8 @@ # Comprehensive setup for projects with multiple languages and technologies repos: - - repo: https://github.com/TriaFed/pre-commit-library - rev: v1.1.5 # Use the latest version + - repo: https://github.com/david-parker-softrams/pre-commit-library + rev: v1.1.6 # Use the latest version hooks: # Security hooks (essential for ALL GenAI projects) - id: detect_secrets diff --git a/examples/go-project.yaml b/examples/go-project.yaml index af68b23..457d8a1 100644 --- a/examples/go-project.yaml +++ b/examples/go-project.yaml @@ -2,8 +2,8 @@ # Setup for Go development with security focus repos: - - repo: https://github.com/TriaFed/pre-commit-library - rev: v1.1.5 # Use the latest version + - repo: https://github.com/david-parker-softrams/pre-commit-library + rev: v1.1.6 # Use the latest version hooks: # Security hooks (essential for GenAI projects) - id: detect_secrets diff --git a/examples/infrastructure.yaml b/examples/infrastructure.yaml index 697130a..02ce40d 100644 --- a/examples/infrastructure.yaml +++ b/examples/infrastructure.yaml @@ -2,8 +2,8 @@ # Setup for Terraform, CloudFormation, and Docker with security focus repos: - - repo: https://github.com/TriaFed/pre-commit-library - rev: v1.1.5 # Use the latest version + - repo: https://github.com/david-parker-softrams/pre-commit-library + rev: v1.1.6 # Use the latest version hooks: # Security hooks (essential for GenAI projects) - id: detect_secrets diff --git a/examples/java-project.yaml b/examples/java-project.yaml index b298ae4..a1af909 100644 --- a/examples/java-project.yaml +++ b/examples/java-project.yaml @@ -2,8 +2,8 @@ # Setup for Java development with security focus repos: - - repo: https://github.com/TriaFed/pre-commit-library - rev: v1.1.5 # Use the latest version + - repo: https://github.com/david-parker-softrams/pre-commit-library + rev: v1.1.6 # Use the latest version hooks: # Security hooks (essential for GenAI projects) - id: detect_secrets diff --git a/examples/minimal-security.yaml b/examples/minimal-security.yaml index 3636c49..03546c0 100644 --- a/examples/minimal-security.yaml +++ b/examples/minimal-security.yaml @@ -2,8 +2,8 @@ # Essential hooks for protecting against accidental credential/secret commits repos: - - repo: https://github.com/TriaFed/pre-commit-library - rev: v1.1.5 # Use the latest version + - repo: https://github.com/david-parker-softrams/pre-commit-library + rev: v1.1.6 # Use the latest version hooks: # Critical security hooks for GenAI-generated code - id: detect_secrets diff --git a/examples/nodejs-react.yaml b/examples/nodejs-react.yaml index 119343d..aafe660 100644 --- a/examples/nodejs-react.yaml +++ b/examples/nodejs-react.yaml @@ -2,8 +2,8 @@ # Setup for JavaScript/TypeScript development with security focus repos: - - repo: https://github.com/TriaFed/pre-commit-library - rev: v1.1.5 # Use the latest version + - repo: https://github.com/david-parker-softrams/pre-commit-library + rev: v1.1.6 # Use the latest version hooks: # Security hooks (essential for GenAI projects) - id: detect_secrets diff --git a/examples/python-project.yaml b/examples/python-project.yaml index 26bb7fc..df57a45 100644 --- a/examples/python-project.yaml +++ b/examples/python-project.yaml @@ -2,8 +2,8 @@ # Comprehensive setup for Python development with security focus repos: - - repo: https://github.com/TriaFed/pre-commit-library - rev: v1.1.5 # Use the latest version + - repo: https://github.com/david-parker-softrams/pre-commit-library + rev: v1.1.6 # Use the latest version hooks: # Security hooks (essential for GenAI projects) - id: detect_secrets diff --git a/hooks/__init__.py b/hooks/__init__.py index 1dfa7ea..44c3b1e 100644 --- a/hooks/__init__.py +++ b/hooks/__init__.py @@ -6,7 +6,7 @@ and other GenAI assistants. """ -__version__ = "1.1.5" +__version__ = "1.1.6" __author__ = "TriaFed" __email__ = "info@triafed.com" __description__ = "Pre-commit hooks library for GenAI code validation and security" diff --git a/hooks/detect_hardcoded_urls.py b/hooks/detect_hardcoded_urls.py index 071e6e7..8629d11 100755 --- a/hooks/detect_hardcoded_urls.py +++ b/hooks/detect_hardcoded_urls.py @@ -17,27 +17,30 @@ r'ftp://[^\s\'">\]]+', # Database connection strings with URLs r'(?:jdbc|mongodb|mysql|postgresql)://[^\s\'">\]]+', - # API endpoints patterns - r'(?:api\.|www\.)[a-zA-Z0-9.-]+\.[a-zA-Z]{2,}(?:/[^\s\'">\]]*)?', + # API endpoints patterns (more specific to avoid overlap with documentation URLs) + r'api\.[a-zA-Z0-9.-]+\.[a-zA-Z]{2,}(?:/[^\s\'">\]]*)?', + # Suspicious www domains (exclude common safe ones) + r'www\.(?!(?:w3\.org|github\.com|docs\.|example\.(?:com|org|net)|.*\.example\.(?:com|org|net)))[a-zA-Z0-9.-]+\.[a-zA-Z]{2,}(?:/[^\s\'">\]]*)?', ] # URLs that are typically safe to ignore SAFE_URL_PATTERNS = [ - r'https?://localhost', - r'https?://127\.0\.0\.1', - r'https?://0\.0\.0\.0', - r'https?://example\.com', - r'https?://example\.org', - r'https?://example\.net', - r'https?://.*\.example\.com', - r'https?://.*\.test', - r'https?://.*\.local', - r'https?://.*\.localhost', + r'https?://localhost(?:[:/].*)?', + r'https?://127\.0\.0\.1(?:[:/].*)?', + r'https?://0\.0\.0\.0(?:[:/].*)?', + r'https?://example\.com(?:[/?#].*)?', + r'https?://example\.org(?:[/?#].*)?', + r'https?://example\.net(?:[/?#].*)?', + r'https?://.*\.example\.com(?:[/?#].*)?', + r'https?://.*\.test(?:[/?#].*)?', + r'https?://.*\.local(?:[/?#].*)?', + r'https?://.*\.localhost(?:[/?#].*)?', + r'https?://mock-host/.*', # Common documentation URLs - r'https?://github\.com/.*', + r'https?://(?:www\.)?github\.com(?:[/?#].*)?', r'https?://docs\..*', - r'https?://www\.w3\.org/.*', - r'https?://tools\.ietf\.org/.*', + r'https?://www\.w3\.org(?:[/?#].*)?', + r'https?://tools\.ietf\.org(?:[/?#].*)?', r'https?://schemas\..*', # Package registries r'https?://registry\.npmjs\.org/.*', @@ -46,7 +49,7 @@ ] # File extensions to skip -SKIP_EXTENSIONS = {'.png', '.jpg', '.jpeg', '.gif', '.ico', '.svg', '.pdf', '.zip', '.tar', '.gz'} +SKIP_EXTENSIONS = {'.png', '.jpg', '.jpeg', '.gif', '.ico', '.svg', '.pdf', '.zip', '.tar', '.gz', '.md'} # Patterns that suggest this might be in a comment or documentation COMMENT_PATTERNS = [ @@ -65,7 +68,7 @@ def is_in_comment(line: str) -> bool: def is_safe_url(url: str) -> bool: """Check if URL matches safe patterns.""" - return any(re.match(pattern, url, re.IGNORECASE) for pattern in SAFE_URL_PATTERNS) + return any(re.match(pattern + r'$', url, re.IGNORECASE) for pattern in SAFE_URL_PATTERNS) def find_hardcoded_urls(file_path: str) -> List[Tuple[int, str, str]]: diff --git a/hooks/genai_security_check.py b/hooks/genai_security_check.py index fa93c13..ddaa7cc 100755 --- a/hooks/genai_security_check.py +++ b/hooks/genai_security_check.py @@ -59,10 +59,10 @@ }, 'weak_crypto': { 'patterns': [ - r'MD5', - r'SHA1\b', + r'\bMD5\b', + r'\bSHA1\b', r'\bDES\b', - r'RC4', + r'\bRC4\b', r'\.md5\(', r'\.sha1\(', r'createHash\(["\']md5["\']', @@ -216,8 +216,29 @@ def check_genai_patterns(file_path: str) -> List[Tuple[int, str, str, str]]: if not line.strip(): continue + # Check if line is an import statement + stripped_line = line.strip() + is_import_line = ( + # stripped_line.startswith('import ') or + # stripped_line.startswith('from ') or + re.match(r'^\s*import\s+', line) or + re.match(r'^\s*}?\s*from\s+', line) or + re.match(r'^\s*#include\s*<', line) or # C/C++ + re.match(r'^\s*#include\s*"', line) or # C/C++ + re.match(r'^\s*using\s+', line) or # C#/Java + re.match(r'^\s*require\s*\(', line) or # JavaScript/Node.js + re.match(r'^\s*const\s+.*\s*=\s*require\s*\(', line) or # JavaScript/Node.js + re.match(r'^\s*let\s+.*\s*=\s*require\s*\(', line) or # JavaScript/Node.js + re.match(r'^\s*var\s+.*\s*=\s*require\s*\(', line) or # JavaScript/Node.js + re.match(r'^\s*import\s+.*\s+from\s+', line) # ES6 imports + ) + # Check security patterns for pattern_name, pattern_info in GENAI_SECURITY_PATTERNS.items(): + # Skip path traversal checks for import lines + if pattern_name == 'path_traversal' and is_import_line: + continue + for pattern in pattern_info['patterns']: if re.search(pattern, line, re.IGNORECASE): issues.append(( diff --git a/pyproject.toml b/pyproject.toml index 72d9462..23501a2 100644 --- a/pyproject.toml +++ b/pyproject.toml @@ -4,7 +4,7 @@ build-backend = "setuptools.build_meta" [project] name = "pre-commit-hooks-genai" -version = "1.1.5" +version = "1.1.6" description = "Pre-commit hooks library for GenAI code validation and security" readme = "README.md" license = {text = "MIT"}