DataDog / guarddog

:snake: :mag: GuardDog is a CLI tool to Identify malicious PyPI and npm packages
https://securitylabs.datadoghq.com/articles/guarddog-identify-malicious-pypi-packages/
Apache License 2.0
585 stars 43 forks source link

Eliminate Package class #422

Closed ikretz closed 1 month ago

ikretz commented 1 month ago

This PR proposes to eliminate the Package class, which superclasses PackageScanner and ProjectScanner.

Reasons to do this:

  1. There is no context in which a PackageScanner and a ProjectScanner can be used interchangeably without a great deal of difficulty. These classes have only one common method, scan_local(), that expect different kinds (as opposed to types) of arguments: a path to a local package directory or archive for PackageScanner versus a path to a requirements.txt file for ProjectScanner

  2. It seems the only purpose of Package is to give scanner.get_scanner() a definite, non-union return type. However, we end up paying elsewhere for this simplicity, namely via the explicit cast in cli._scan() needed only to satisfy the type checker, so it's not clear we gain anything from it. This PR splits get_scanner() into two functions to eliminate the cast