mirror of
https://github.com/kuhyx/steam-backlog-enforcer.git
synced 2026-11-11 13:47:31 +01:00
Krzysztof kuhy Rudnicki
7323c896f6
hltb, _cmd_done, _whitelist and _actions each kept a module __getattr__ that served names moved out in the 250-line split, via importlib to dodge the resulting import cycle. pylint cannot see through that, and graded every such import as no-name-in-module (26 of them). The 32 import statements now name the real module; with nothing left going through the facades, they are gone. Also the pylint hook on 4.0.8 with the source-only scope config, the three implicit-booleaness disables the reference repos carry, the http.server do_GET admission, and the third-party pins the hook was missing (aiohttp, websockets, howlongtobeatpy). Gate still 8.0. Co-Authored-By: Claude Opus 5 (1M context) <noreply@anthropic.com> Claude-Session: https://claude.ai/code/session_01HHCbkJWXHjtTUaqvnHRAqA
114 lines
4.4 KiB
Python
114 lines
4.4 KiB
Python
"""Whitelist hardening: time-locked exceptions, reason validation, immutability."""
|
|
|
|
from __future__ import annotations
|
|
|
|
from collections import Counter
|
|
import logging
|
|
import math
|
|
import re
|
|
from typing import TYPE_CHECKING
|
|
|
|
from steam_backlog_enforcer.config import CONFIG_DIR
|
|
|
|
if TYPE_CHECKING:
|
|
from pathlib import Path
|
|
|
|
logger = logging.getLogger(__name__)
|
|
|
|
# ──────────────────────────────────────────────────────────────
|
|
# File paths (patched in tests via conftest)
|
|
# ──────────────────────────────────────────────────────────────
|
|
|
|
APPROVED_EXCEPTIONS_FILE: Path = CONFIG_DIR / "approved_exceptions.json"
|
|
EXCEPTION_AUDIT_LOG: Path = CONFIG_DIR / "exception_audit.log"
|
|
|
|
# ──────────────────────────────────────────────────────────────
|
|
# Constants
|
|
# ──────────────────────────────────────────────────────────────
|
|
|
|
_MIN_REASON_WORDS: int = 5
|
|
_MIN_REASON_LENGTH: int = 25
|
|
_MIN_ENTROPY: float = 3.0
|
|
# Reject runs of the same character longer than this (e.g. "aaaa").
|
|
_MAX_CHAR_RUN: int = 3
|
|
|
|
|
|
# ──────────────────────────────────────────────────────────────
|
|
# Reason validation
|
|
# ──────────────────────────────────────────────────────────────
|
|
|
|
|
|
def _shannon_entropy(text: str) -> float:
|
|
"""Return Shannon entropy (bits per character) for *text*.
|
|
|
|
Whitespace is excluded before counting so spaces don't inflate entropy.
|
|
|
|
Args:
|
|
text: Input string to measure.
|
|
|
|
Returns:
|
|
Entropy in bits per character, or 0.0 for empty input.
|
|
"""
|
|
chars = [c.lower() for c in text if not c.isspace()]
|
|
if not chars:
|
|
return 0.0
|
|
total = len(chars)
|
|
counts = Counter(chars)
|
|
return -sum((c / total) * math.log2(c / total) for c in counts.values())
|
|
|
|
|
|
def validate_reason(reason: str) -> str | None:
|
|
"""Validate that a whitelist exception reason is genuine.
|
|
|
|
Returns None when the reason is acceptable, or a human-readable error
|
|
string that explains why it was rejected.
|
|
|
|
Args:
|
|
reason: User-supplied justification text.
|
|
|
|
Returns:
|
|
None if valid, or an error message string if invalid.
|
|
"""
|
|
stripped = reason.strip()
|
|
|
|
if len(stripped) < _MIN_REASON_LENGTH:
|
|
return (
|
|
f"Reason is too short ({len(stripped)} chars; "
|
|
f"need at least {_MIN_REASON_LENGTH})."
|
|
)
|
|
|
|
words = stripped.split()
|
|
if len(words) < _MIN_REASON_WORDS:
|
|
return (
|
|
f"Reason must contain at least {_MIN_REASON_WORDS} words "
|
|
f"(got {len(words)})."
|
|
)
|
|
|
|
entropy = _shannon_entropy(stripped)
|
|
if entropy < _MIN_ENTROPY:
|
|
return (
|
|
f"Reason appears to be random characters "
|
|
f"(entropy {entropy:.2f} < {_MIN_ENTROPY}). "
|
|
"Write a genuine justification."
|
|
)
|
|
|
|
# Reject runs of the same character: aaaa, bbbbbb, etc.
|
|
if re.search(r"(.)\1{3,}", stripped, re.IGNORECASE):
|
|
return "Reason contains repeated characters. Write a genuine justification."
|
|
|
|
# Reject simple two-character alternating patterns: ababab, asasas, etc.
|
|
if re.search(r"(..)(\1){3,}", stripped, re.IGNORECASE):
|
|
return "Reason contains repetitive patterns. Write a genuine justification."
|
|
|
|
return None
|
|
|
|
|
|
# ──────────────────────────────────────────────────────────────
|
|
# Immutability helpers
|
|
# ──────────────────────────────────────────────────────────────
|
|
|
|
# From <linux/fs.h>. FS_IOC_GETFLAGS is the 64-bit encoding of _IOR('f', 1,
|
|
# long); FS_IMMUTABLE_FL is the "immutable" bit that `chattr +i` sets.
|
|
_FS_IOC_GETFLAGS = 0x80086601
|
|
_FS_IMMUTABLE_FL = 0x00000010
|