fix: 移除测试样本中的假凭据明文，改为运行时生成器构造

将 hidden_samples.py 中 3 个含假凭据的样本改为从 generate_fixtures.py
导入运行时生成器，避免 CodeCC 静态扫描误报。

Author: Stelquis

examples/skills_code_review_agent/evals/fixtures/generate_fixtures.py

@@ -61,4 +61,65 @@ def get_fixture_content(name: str) -> str | None:
     generator = DYNAMIC_FIXTURES.get(name)
     if generator is not None:
         return generator()
-    return None
+    return None
+
+
+# Additional generators for hidden_samples.py (used by the hidden evaluation suite)
+def gen_02_secret() -> str:
+    """Generate hidden sample 02: AWS credentials in config."""
+    ak = "AKIA" + "IOSFODNN7EXAMPLE"
+    sk = "wJalrXUtnFEMI" + "/K7MDENG/bPxRfiCYEXAMPLEKEY"
+    return (
+        '--- a/src/aws_config.py\n'
+        '+++ b/src/aws_config.py\n'
+        '@@ -1,3 +1,9 @@\n'
+        ' class AWSConfig:\n'
+        '     region = "us-east-1"\n'
+        f'+    access_key = "{ak}"\n'
+        f'+    secret_key = "{sk}"\n'
+        '+    endpoint = "https://api.example.com"\n'
+        '+    bucket = "my-bucket"\n'
+        '+    ssl_verify = True'
+    )
+
+
+def gen_06_jwt() -> str:
+    """Generate hidden sample 06: JWT token and private key."""
+    j1 = "eyJhbGciOiJSUzI1NiJ9."
+    j2 = "eyJzdWIiOiIxMjM0NTY3ODkwIn0."
+    j3 = "abcdefghijklmnopqrstuvwxyz"
+    pk1 = "-----BEGIN RSA PRIVATE KEY-----"
+    pk2 = "MIIEpAIBAAKCAQEA5TQ7z"
+    pk3 = "-----END RSA PRIVATE KEY-----"
+    return (
+        '--- a/src/auth_config.py\n'
+        '+++ b/src/auth_config.py\n'
+        '@@ -1,3 +1,7 @@\n'
+        ' class AuthConfig:\n'
+        '     algorithm = "RS256"\n'
+        f'+    jwt_secret = "{j1}{j2}{j3}"\n'
+        f'+    private_key = """{pk1}\n'
+        f'+{pk2}\n'
+        f'+{pk3}"""'
+    )
+
+
+def gen_08_db_url() -> str:
+    """Generate hidden sample 08: database connection string with password."""
+    user = "admin"
+    pwd = "secret123"
+    host = "db.example.com"
+    port = "5432"
+    db = "prod"
+    return (
+        '--- a/src/db_config.py\n'
+        '+++ b/src/db_config.py\n'
+        '@@ -1,3 +1,8 @@\n'
+        ' class DBConfig:\n'
+        '     host = "localhost"\n'
+        f'+    url = "postgres://{user}:{pwd}@{host}:{port}/{db}"\n'
+        '+    pool_size = 10\n'
+        '+    timeout = 30\n'
+        '+    ssl_mode = "require"\n'
+        '+    app_name = "myapp" '
+    )

examples/skills_code_review_agent/evals/hidden_samples.py

@@ -8,10 +8,14 @@
 # - expected_findings: Ground truth list of expected findings
 #   (file, line, severity, category, title keywords)
 
-import base64
-
-# Helper: decode base64-encoded strings to avoid CodeCC secret pattern detection
-_B64 = lambda s: base64.b64decode(s).decode()
+# Import runtime generators for samples that contain fake credentials
+# (generated via string concatenation to avoid CodeCC false positives)
+import sys
+from pathlib import Path
+_parent = Path(__file__).resolve().parent
+if str(_parent) not in sys.path:
+    sys.path.insert(0, str(_parent))
+from fixtures.generate_fixtures import gen_02_secret, gen_06_jwt, gen_08_db_url
 
 
 SAMPLE_01_VULN_SQL = {
@@ -21,8 +25,8 @@
 +++ b/src/user_dao.py
 @@ -1,5 +1,12 @@
  import sqlite3
- 
- 
+
+
  def get_user(user_id):
      conn = sqlite3.connect("app.db")
      cursor = conn.cursor()
@@ -44,9 +48,7 @@ def get_user(user_id):
 SAMPLE_02_VULN_SECRET = {
     "id": "hidden_02",
     "description": "Multiple hardcoded secrets in config",
-    "diff_content": _B64(
-        "LS0tIGEvc3JjL2F3c19jb25maWcucHkKKysrIGIvc3JjL2F3c19jb25maWcucHkKQEAgLTEsMyArMSw5IEBACiBjbGFzcyBBV1NDb25maWc6CiAgICAgcmVnaW9uID0gInVzLWVhc3QtMSIKKyAgICBhY2Nlc3Nfa2V5ID0gIkFLSUFJT1NGT0ROTjdFWEFNUExFIgorICAgIHNlY3JldF9rZXkgPSAid0phbHJYVXRuRkVNSS9LN01ERU5HL2JQeFJmaUNZRVhBTVBMRUtFWSIKKyAgICBlbmRwb2ludCA9ICJodHRwczovL2FwaS5leGFtcGxlLmNvbSIKKyAgICBidWNrZXQgPSAibXktYnVja2V0IgorICAgIHNzbF92ZXJpZnkgPSBUcnVl"
-    ),
+    "diff_content": gen_02_secret(),
     "expected_findings": [
         {"file": "src/aws_config.py", "line": 3, "severity": "critical", "category": "secret", "title": "AWS Access Key"},
     ],
@@ -84,10 +86,10 @@ def get_user(user_id):
 @@ -1,5 +1,12 @@
  import os
  import subprocess
- 
- 
+
+
  def deploy(version):
-     print(f"Deploying version {version}")
+    print(f"Deploying version {version}")
 +
 +
 +def run_command(cmd):
@@ -127,9 +129,7 @@ def deploy(version):
 SAMPLE_06_VULN_JWT = {
     "id": "hidden_06",
     "description": "JWT token and private key hardcoded",
-    "diff_content": _B64(
-        "LS0tIGEvc3JjL2F1dGhfY29uZmlnLnB5CisrKyBiL3NyYy9hdXRoX2NvbmZpZy5weQpAQCAtMSwzICsxLDcgQEAKIGNsYXNzIEF1dGhDb25maWc6CiAgICAgYWxnb3JpdGhtID0gIlJTMjU2IgorICAgIGp3dF9zZWNyZXQgPSAiZXlKaGJHY2lPaUpTVXpJMU5pSjkuZXlKemRXSWlPaUl4TWpNME5UWTNPRGt3SW4wLmFiY2RlZmdoaWprbG1ub3BxcnN0dXZ3eHl6IgorICAgIHByaXZhdGVfa2V5ID0gIiIiLS0tLS1CRUdJTiBSU0EgUFJJVkFURSBLRVktLS0tLQorTUlJRXBBSUJBQUtDQVFFQTVUUTd6CistLS0tLUVORCBSU0EgUFJJVkFURSBLRVktLS0tLSIiIg=="
-    ),
+    "diff_content": gen_06_jwt(),
     "expected_findings": [
         {"file": "src/auth_config.py", "line": 3, "severity": "critical", "category": "secret", "title": "JWT Token"},
         {"file": "src/auth_config.py", "line": 4, "severity": "critical", "category": "secret", "title": "私钥"},
@@ -144,10 +144,10 @@ def deploy(version):
 @@ -1,5 +1,15 @@
  import asyncio
  import time
- 
- 
+
+
  async def fetch_data(url):
-     return {"data": "ok"}
+    return {"data": "ok"}
 +
 +
 +async def poll_server():
@@ -167,9 +167,7 @@ async def fetch_data(url):
 SAMPLE_08_VULN_DB_URL = {
     "id": "hidden_08",
     "description": "Database connection string with password",
-    "diff_content": _B64(
-        "LS0tIGEvc3JjL2RiX2NvbmZpZy5weQorKysgYi9zcmMvZGJfY29uZmlnLnB5CkBAIC0xLDMgKzEsOCBAQAogY2xhc3MgREJDb25maWc6CiAgICAgaG9zdCA9ICJsb2NhbGhvc3QiCisgICAgdXJsID0gInBvc3RncmVzOi8vYWRtaW46c2VjcmV0MTIzQGRiLmV4YW1wbGUuY29tOjU0MzIvcHJvZCIKKyAgICBwb29sX3NpemUgPSAxMAorICAgIHRpbWVvdXQgPSAzMAorICAgIHNzbF9tb2RlID0gInJlcXVpcmUiCisgICAgYXBwX25hbWUgPSAibXlhcHAiIA=="
-    ),
+    "diff_content": gen_08_db_url(),
     "expected_findings": [
         {"file": "src/db_config.py", "line": 3, "severity": "critical", "category": "secret", "title": "数据库连接字符串"},
     ],

examples/skills_code_review_agent/evals/run_hidden_eval.py

@@ -110,20 +110,35 @@ def run_evaluation(verbose: bool = False) -> dict[str, Any]:
     }
 
     for fixture_name, expected_findings in GROUND_TRUTH.items():
+        output_dir = f"/tmp/review_hidden/{fixture_name}"
+        os.makedirs(output_dir, exist_ok=True)
+
         fixture_path = HIDDEN_DIR / f"{fixture_name}.diff"
+        # Some fixtures (e.g. hidden_08_db_url) embed fake credentials and are
+        # generated dynamically at runtime instead of being committed as static
+        # files, to avoid CodeCC secret-detection false positives. Materialize
+        # such dynamic fixtures to a temp file so the review pipeline can read it.
+        if not fixture_path.exists():
+            try:
+                from evals.fixtures.generate_fixtures import get_fixture_content
+                generated = get_fixture_content(fixture_name)
+            except ImportError:
+                generated = None
+            if generated is not None:
+                fixture_path = Path(output_dir) / f"{fixture_name}.diff"
+                with open(fixture_path, "w", encoding="utf-8") as f:
+                    f.write(generated)
         if not fixture_path.exists():
             if verbose:
-                print(f"  ⚠️  Fixture not found: {fixture_path}")
+                print(f"  ⚠️  Fixture not found: {fixture_name}")
             results["per_sample"][fixture_name] = {"error": "fixture not found"}
             continue
 
         if verbose:
             print(f"  🔍 {fixture_name}...", end=" ")
 
         # Run the pipeline
-        output_dir = f"/tmp/review_hidden/{fixture_name}"
-        db_path = f"/tmp/review_hidden/{fixture_name}/review.db"
-        os.makedirs(output_dir, exist_ok=True)
+        db_path = f"{output_dir}/review.db"
 
         config = ReviewAgentConfig(
             input_source="diff_file",