refactor: split detection rules into modular rule engine

Author: Saharsh1123

detectors/ast_analyzer.py

@@ -0,0 +1,90 @@
+import ast
+import textwrap
+
+def parse_ast(file):
+    """
+    Parse source code into an AST.
+
+    Args:
+        file (str): Raw Python source code.
+
+    Returns:
+        ast.AST | None: Parsed AST object, or None if parsing fails.
+    """
+    file = textwrap.dedent(file)
+
+    try:
+        tree = ast.parse(file)
+    except SyntaxError:
+        return None
+
+    return tree
+
+
+def get_assignments(tree):
+    """
+    Yield all assignment nodes from an AST.
+
+    Args:
+        tree (ast.AST): Parsed syntax tree.
+
+    Yields:
+        ast.Assign: Assignment nodes found during traversal.
+    """
+    for node in ast.walk(tree):
+        if isinstance(node, ast.Assign):
+            yield node
+
+
+def extract_node_value(node):
+    """
+    Extract a string literal value from an assignment node.
+
+    Args:
+        node (ast.Assign): Assignment node.
+
+    Returns:
+        str | None: String value if valid, otherwise None.
+    """
+    val = node.value
+    if not (isinstance(val, ast.Constant) and isinstance(val.value, str)):
+        return None
+    return val.value
+
+
+def extract_variable_path(node):
+    """
+    Extract variable name paths from assignment targets.
+
+    Supports simple variables and nested attributes (e.g., self.config.key).
+
+    Args:
+        node (ast.Assign): Assignment node.
+
+    Yields:
+        list[str]: Normalized variable path (lowercased components).
+    """
+    for var in node.targets:
+        full_path = []
+        temp_node = var
+
+        # Traverse nested attribute chain (e.g., self.config.key)
+        if isinstance(temp_node, ast.Attribute):
+            while isinstance(temp_node, ast.Attribute):
+                full_path.append(temp_node.attr.lower())
+                temp_node = temp_node.value
+
+            # Ensure root is a valid variable name
+            if not isinstance(temp_node, ast.Name):
+                continue
+
+            full_path.append(temp_node.id.lower())
+            full_path.reverse()
+
+        # Handle simple variable assignment
+        elif isinstance(var, ast.Name):
+            full_path.append(var.id.lower())
+
+        # Yield only valid, non-empty paths
+        if len(full_path) != 0:
+            yield full_path

detectors/find_secrets.py

@@ -1,169 +1,5 @@
-import re
-import ast
-import textwrap
-
-# Rule definitions for secret detection.
-# Rules can match either:
-# - a secret-like value pattern, regardless of variable name
-# - a suspicious variable name combined with a minimum value length
-REGEX_INFO = {
-    "AWS Access Key": {
-        "value_pattern": re.compile(r"(AKIA[0-9A-Z]{16})"),
-        "severity": "HIGH",
-    },
-    "Password": {
-        "var_patterns": [
-            re.compile(r"password", re.IGNORECASE),
-            re.compile(r"pwd", re.IGNORECASE),
-            re.compile(r"passwd", re.IGNORECASE),
-        ],
-        "min_length": 4,
-        "severity": "HIGH",
-    },
-    "API Key": {
-        "var_patterns": [
-            re.compile(r"api_key", re.IGNORECASE),
-            re.compile(r"apikey", re.IGNORECASE),
-        ],
-        "min_length": 4,
-        "severity": "HIGH",
-    },
-    "Token": {
-        "var_patterns": [re.compile(r"token", re.IGNORECASE)],
-        "min_length": 4,
-        "severity": "MEDIUM",
-    },
-    "Secret": {
-        "var_patterns": [
-            re.compile(r"secret", re.IGNORECASE),
-        ],
-        "min_length": 4,
-        "severity": "MEDIUM",
-    },
-}
-
-
-def parse_ast(file):
-    """
-    Parse source code into an AST.
-
-    Args:
-        file (str): Raw Python source code.
-
-    Returns:
-        ast.AST | None: Parsed AST object, or None if parsing fails.
-    """
-    file = textwrap.dedent(file)
-
-    try:
-        tree = ast.parse(file)
-    except SyntaxError:
-        return None
-
-    return tree
-
-
-def get_assignments(tree):
-    """
-    Yield all assignment nodes from an AST.
-
-    Args:
-        tree (ast.AST): Parsed syntax tree.
-
-    Yields:
-        ast.Assign: Assignment nodes found during traversal.
-    """
-    for node in ast.walk(tree):
-        if isinstance(node, ast.Assign):
-            yield node
-
-
-def extract_node_value(node):
-    """
-    Extract a string literal value from an assignment node.
-
-    Args:
-        node (ast.Assign): Assignment node.
-
-    Returns:
-        str | None: String value if valid, otherwise None.
-    """
-    val = node.value
-    if not (isinstance(val, ast.Constant) and isinstance(val.value, str)):
-        return None
-    return val.value
-
-
-def extract_variable_path(node):
-    """
-    Extract variable name paths from assignment targets.
-
-    Supports simple variables and nested attributes (e.g., self.config.key).
-
-    Args:
-        node (ast.Assign): Assignment node.
-
-    Yields:
-        list[str]: Normalized variable path (lowercased components).
-    """
-    for var in node.targets:
-        full_path = []
-        temp_node = var
-
-        # Traverse nested attribute chain (e.g., self.config.key)
-        if isinstance(temp_node, ast.Attribute):
-            while isinstance(temp_node, ast.Attribute):
-                full_path.append(temp_node.attr.lower())
-                temp_node = temp_node.value
-
-            # Ensure root is a valid variable name
-            if not isinstance(temp_node, ast.Name):
-                continue
-
-            full_path.append(temp_node.id.lower())
-            full_path.reverse()
-
-        # Handle simple variable assignment
-        elif isinstance(var, ast.Name):
-            full_path.append(var.id.lower())
-
-        # Yield only valid, non-empty paths
-        if len(full_path) != 0:
-            yield full_path
-
-
-def detect_from_parts(var_name, val):
-    """
-    Classify an extracted variable/value pair against secret detection rules.
-
-    Args:
-        var_name (str): Normalized variable name or final attribute name.
-        val (str): Extracted string literal value.
-
-    Returns:
-        list[tuple[str, str, str]] | None:
-            A list of findings where each finding is:
-                (rule_name, severity, extracted_value)
-
-            Returns None if no rule matches.
-    """
-    findings = []
-
-    for rule, data in REGEX_INFO.items():
-        # Match structured secret values, such as AWS access keys
-        if "value_pattern" in data:
-            if data["value_pattern"].fullmatch(val):
-                findings.append((rule, data["severity"], val))
-
-        # Match suspicious variable names and enforce minimum value length
-        if "var_patterns" in data:
-            for pattern in data["var_patterns"]:
-                match = pattern.search(var_name)
-                if match and len(val) >= data["min_length"]:
-                    findings.append((rule, data["severity"], val))
-
-    return findings or None
-
+from detectors.ast_analyzer import parse_ast, get_assignments, extract_node_value, extract_variable_path
+from detectors.rule_engine import apply_rules
 
 def detect_ast_secrets(code):
     """
@@ -196,7 +32,7 @@ def detect_ast_secrets(code):
         for full_path in extract_variable_path(node):
             var_name = full_path[-1]
 
-            vulnerabilities = detect_from_parts(var_name, val)
+            vulnerabilities = apply_rules(var_name, val)
 
             if vulnerabilities:
                 for pattern_name, severity, value in vulnerabilities:

detectors/rule_engine.py

@@ -0,0 +1,34 @@
+from detectors.rules import RULES
+
+
+def apply_rules(var_name, val):
+    """
+    Classify an extracted variable/value pair against secret detection rules.
+
+    Args:
+        var_name (str): Normalized variable name or final attribute name.
+        val (str): Extracted string literal value.
+
+    Returns:
+        list[tuple[str, str, str]] | None:
+            A list of findings where each finding is:
+                (rule_name, severity, extracted_value)
+
+            Returns None if no rule matches.
+    """
+    findings = []
+
+    for rule, data in RULES.items():
+        # Match structured secret values, such as AWS access keys
+        if "value_pattern" in data:
+            if data["value_pattern"].fullmatch(val):
+                findings.append((rule, data["severity"], val))
+
+        # Match suspicious variable names and enforce minimum value length
+        if "var_patterns" in data:
+            for pattern in data["var_patterns"]:
+                match = pattern.search(var_name)
+                if match and len(val) >= data["min_length"]:
+                    findings.append((rule, data["severity"], val))
+
+    return findings or None

detectors/rules.py

@@ -0,0 +1,42 @@
+import re
+
+
+# Rule definitions for secret detection.
+# Rules can match either:
+# - a secret-like value pattern, regardless of variable name
+# - a suspicious variable name combined with a minimum value length
+RULES = {
+    "AWS Access Key": {
+        "value_pattern": re.compile(r"(AKIA[0-9A-Z]{16})"),
+        "severity": "HIGH",
+    },
+    "Password": {
+        "var_patterns": [
+            re.compile(r"password", re.IGNORECASE),
+            re.compile(r"pwd", re.IGNORECASE),
+            re.compile(r"passwd", re.IGNORECASE),
+        ],
+        "min_length": 4,
+        "severity": "HIGH",
+    },
+    "API Key": {
+        "var_patterns": [
+            re.compile(r"api_key", re.IGNORECASE),
+            re.compile(r"apikey", re.IGNORECASE),
+        ],
+        "min_length": 4,
+        "severity": "HIGH",
+    },
+    "Token": {
+        "var_patterns": [re.compile(r"token", re.IGNORECASE)],
+        "min_length": 4,
+        "severity": "MEDIUM",
+    },
+    "Secret": {
+        "var_patterns": [
+            re.compile(r"secret", re.IGNORECASE),
+        ],
+        "min_length": 4,
+        "severity": "MEDIUM",
+    },
+}

main.py

@@ -13,7 +13,8 @@
 """
 
 from cli import input_path, chosen_severity, use_json
-from scanner import check_path, scan, list_python_files, output, filter_results
+from scanner import check_path, scan, list_python_files
+from output import filter_results, output
 
 
 if __name__ == "__main__":