Class TestCompileRules

tests/unit/test_false_positive_reductions.py:128–166

# ===========================================================================

class TestCompileRules:
    def test_re_compile_not_flagged_py515(self):
        """re.compile() is regex, not Python code execution — no PY515."""
        code = """
            import re
            tag_re = re.compile(r'({%.*?%}|{{.*?}}|{#.*?#})')
            hidden_settings = re.compile('API|AUTH|TOKEN|KEY|SECRET', flags=re.I)
        """
        assert findings_for_rule(code, "PY515") == [], \
            "PY515 should not fire for re.compile()"

    def test_re_compile_not_flagged_shell645(self):
        """re.compile() must not trigger SHELL645."""
        code = """
            import re
            pattern = re.compile(r'[a-z]+')
        """
        assert findings_for_rule(code, "SHELL645") == [], \
            "SHELL645 should not fire for re.compile()"

    def test_re_compile_not_flagged_shell670(self):
        """re.compile() must not trigger SHELL670."""
        code = """
            import re
            validator_re = re.compile(r'^[A-Z_]+$')
        """
        assert findings_for_rule(code, "SHELL670") == [], \
            "SHELL670 should not fire for re.compile()"

    # True positives
    def test_bare_compile_or_exec_flagged(self):
        """exec(compile(user_code, ...)) IS dangerous — PY305 (exec) or compile rules must fire."""
        code = "user_code = get_input()\nexec(compile(user_code, '<string>', 'exec'))\n"
        findings = run_pyspector(code, filename="runner.py")
        # PY305 (exec), PY515/SHELL645/SHELL670 (compile), SEC501 — any confirms danger
        danger_rules = {"PY515", "SHELL645", "SHELL670", "PY305", "SEC501"}
        triggered = {f["rule_id"] for f in findings} & danger_rules
        assert triggered, \
            f"At least one danger rule should fire for exec(compile(user_code)), got: {findings}"


# ===========================================================================