Repository navigation
feat: let an entry point name a project function by its own symbol - #180
Merged
Merged
Conversation
A template file the engine cannot read proves nothing about escaping: the flow through render_to_string stays xss, and a template extending or including it is not established to escape either.
escaped_templates read a template file it could not open as empty text, and an empty template escapes everything it renders. Such a file now yields no escaping verdict, like a template the engine cannot find, so the flow stays xss and the templates needing it are not established either.
An EntryPoint naming a project function or class by its symbol makes it an entry point, whatever its parameters are called, and inputs limits the parameters that are input to the given positions: a handler's event, not its context. A function named handler is nothing without a declaration.
function_entry_point now matches the project symbol of a function, or of its class, against the EntryPoint models, after the decorators, the bases and the registrations, so an integration reading a deployment declaration can make a bare Lambda handler an entry point. EntryPoint.inputs limits the parameters that are input to the given positions after self.
…-entry-points Both branches open the Unreleased section of the changelog; it now holds the Precision and the Plugins entries.
Merged
This file contains hidden or bidirectional Unicode text that may be interpreted or compiled differently than what appears below. To review, open the file in an editor that reveals hidden Unicode characters.
Learn more about bidirectional Unicode characters
Sign up for free
to join this conversation on GitHub.
Already have an account?
Sign in to comment
Add this suggestion to a batch that can be applied as a single commit.This suggestion is invalid because no changes were made to the code.Suggestions cannot be applied while the pull request is closed.Suggestions cannot be applied while viewing a subset of changes.Only one suggestion per line can be applied in a batch.Add this suggestion to a batch that can be applied as a single commit.Applying suggestions on deleted lines is not supported.You must change the existing code in this line in order to create a valid suggestion.Outdated suggestions cannot be applied.This suggestion has been applied or marked resolved.Suggestions cannot be applied from pending reviews.Suggestions cannot be applied on multi-line comments.Suggestions cannot be applied while the pull request is queued to merge.Suggestion cannot be applied right now. Please check back later.
The engine side of the bare Lambda handler item (CoreTrace-Entreprise/coretrace-python-analyzer-plugins#3): a generic entry point by explicit symbol. Reading SAM templates and
serverless.ymlbelongs to the Enterpriseserverlesstable, which follows.Summary
EntryPointmay name a project function or class by its own symbol,python.app.handlers.mainorpython.app.handlers.Worker.function_entry_pointmatches it after the decorators, the class bases and the registrations, so the function, or every method of the class, receives input as a decorated one does, whatever its parameters are called. The engine infers nothing from a function's name:handler(event, context)without a declaration is nothing, and a test locks that.EntryPoint.inputslimits the parameters that are input to the given positions, afterselffor a method: a handler's event (inputs=(0,)), not its context. It applies to decorated entry points too, andNonekeeps every parameter, so existing models are unchanged.Verification
EntryPointhad noinputs), then two on my own line numbers, fixed in the test.tests/test_declared_entry_points.py: 7 passed. Full suite under Python 3.12.10, regression snapshots included: 1440 passed.ruff checkandmypypass.