Function analyze_code_security

plugins/security-guidance/hooks/llm.py:710–979

Use Haiku to perform a security review of code. files: list of (file_path, content_or_diff) tuples is_diff: if True, the content is a unified diff rather than full file contents previous_findings: list of category strings from earlier stop hook firings this turn, used to pro

(files: List[Tuple[str, str]], is_diff: bool = False, previous_findings: Optional[List[str]] = None)

def analyze_code_security(files: List[Tuple[str, str]], is_diff: bool = False, previous_findings: Optional[List[str]] = None) -> Tuple[Optional[str], List[Dict[str, Any]]]:
    """
    Use Haiku to perform a security review of code.
    files: list of (file_path, content_or_diff) tuples
    is_diff: if True, the content is a unified diff rather than full file contents
    previous_findings: list of category strings from earlier stop hook firings this turn,
        used to prompt the reviewer to verify those issues were actually fixed.
    Returns (formatted guidance string or None, list of vuln dicts with severity/category).
    """
    if not HAS_API_CREDENTIALS or not files:
        return None, []

    # Build language context from file extensions
    lang_hints = {
        ".go": "Go", ".java": "Java/Spring Boot", ".py": "Python",
        ".rb": "Ruby", ".php": "PHP", ".rs": "Rust",
        ".ts": "TypeScript", ".js": "JavaScript", ".jsx": "JavaScript/React",
        ".tsx": "TypeScript/React", ".ejs": "EJS templates",
        ".html": "HTML/templates", ".properties": "Java properties",
        ".yaml": "YAML config", ".yml": "YAML config",
    }
    languages = set()
    for fp, _ in files:
        ext = os.path.splitext(fp)[1].lower()
        if ext in lang_hints:
            languages.add(lang_hints[ext])
    language = ", ".join(sorted(languages)) if languages else "server-side"

    files = _cap_files_for_prompt(files)

    # Build the files section
    files_section = []
    for fp, content in files:
        ext = os.path.splitext(fp)[1].lower()
        label = "DIFF" if is_diff else "FILE"
        files_section.append(f"=== {label}: {fp} ===\n```{ext.lstrip('.')}\n{content}\n```")
    files_text = "\n\n".join(files_section)

    content_desc = "diff" if is_diff else "code"

    if is_diff:
        diff_instruction = """Note: You are reviewing a unified diff. Unmarked lines (starting with a space) are UNCHANGED context — they were already in the file before this session. Lines starting with + are ADDITIONS made in this session. Lines starting with - are REMOVALS.

CRITICAL: ONLY flag vulnerabilities that are NEWLY INTRODUCED in + lines. Do NOT flag:
- Issues in unmarked context lines (space-prefixed = pre-existing code). Even if a context line contains SECRET_KEY = 'hardcoded', DEBUG=True, hardcoded passwords, SQL injection, or any other vulnerability — it is PRE-EXISTING and must be ignored.
- Issues where the SAME pattern existed in the removed (-) lines and was re-added in + lines (this means the code was rewritten/reformatted but the pattern is pre-existing)
- Pre-existing patterns that Claude simply preserved when rewriting a file
- Any vulnerability whose vulnerable code snippet appears in context (space-prefixed) lines
- Vulnerabilities in the ORIGINAL/STARTER code that the developer was given to work with. If a file was fully rewritten (all lines show as - then +), compare the + content against the - content. Only flag NEWLY INTRODUCED patterns that did NOT exist in the - lines.
- Issues OUTSIDE THE SCOPE of what the developer was asked to do. If the task was "add logging middleware" and the starter code has a hardcoded SECRET_KEY, that is pre-existing and out of scope — do NOT flag it.

A vulnerability is ONLY new if the + lines introduce a pattern that did NOT exist anywhere in the - lines or context lines of the same file.

EXCEPTION — data flow to pre-existing sinks: If + lines route user-controlled data to a PRE-EXISTING dangerous sink (like `new Function()`, `eval()`, `exec()`, or shell string interpolation in context lines), this IS a new vulnerability. The sink was already there, but the new code created a new attack path to it. Flag this as a new vulnerability in the + lines."""
    else:
        diff_instruction = ""

    structured_prev = [f for f in (previous_findings or []) if isinstance(f, dict)]