DataDog / guarddog

:snake: :mag: GuardDog is a CLI tool to Identify malicious PyPI and npm packages
https://securitylabs.datadoghq.com/articles/guarddog-identify-malicious-pypi-packages/
Apache License 2.0
585 stars 43 forks source link

Unused callback function argument in PackageScanner #411

Closed ikretz closed 1 month ago

ikretz commented 2 months ago

The PackageScanner.scan_local() method accepts a callback function argument that it does not use.

# guarddog/scanners/scanner.py:227

def scan_local(
        self, path, rules=None, callback: typing.Callable[[dict], None] = noop
) -> dict:
    if rules is not None:
        rules = set(rules)

    if not os.path.exists(path):
        raise Exception(f"Path {path} does not exist.")

    if any(path.endswith(ext) for ext in (".tar.gz", ".tgz", ".zip", ".whl")):
        with tempfile.TemporaryDirectory() as tmpdirname:
            safe_extract(path, tmpdirname)
            return self.analyzer.analyze_sourcecode(
                tmpdirname, rules=rules
            )

    if os.path.isdir(path):
        return self.analyzer.analyze_sourcecode(path, rules=rules)

    raise Exception(
        f"Path {path} is not a directory nor an archive type supported by GuardDog."
    )

It should be applied to the result of analyze_sourcecode() before returning it.