Skip to content

fix: resolve Python false positives by enforcing type qualification#396

Open
Ndugu2 wants to merge 1 commit intocbomkit:mainfrom
Ndugu2:fix-python-false-positives
Open

fix: resolve Python false positives by enforcing type qualification#396
Ndugu2 wants to merge 1 commit intocbomkit:mainfrom
Ndugu2:fix-python-false-positives

Conversation

@Ndugu2
Copy link
Copy Markdown

@Ndugu2 Ndugu2 commented May 5, 2026

Problem
This PR resolves Issue #300: Python Scanner generates False Positives**. The Python detection engine was previously triggering cryptographic findings based on broad method-name matching (e.g., flagging any .generate() call regardless of the object type).

Solution
This PR stabilizes the Python detection engine by enforcing strict object-type qualification for cryptographic detections:

  • PythonLanguageTranslation**: Updated getInvokedObjectTypeString to correctly resolve and verify the qualifier type of method calls.
  • PythonDetectionEngine**: Improved parameter resolution to ensure detections only fire when the trace symbol and object type match cryptographic library expectations.
  • PythonSemantic**: Refined semantic analysis for more accurate type tracking in dynamically typed contexts.

Cleanup & Hygiene
To satisfy review requirements, this PR has been isolated from other architectural work:

  • Removed unrelated C++ (cxx/) and C# scaffolding.
  • Removed vendored Maven binaries (maven_fast/).
  • Hardened .gitignore to prevent ANTLR artifacts (*.tokens, *.interp) and generated sources from being committed.

Verification
Added a new test suite:

  • PycaFalsePositiveTest.java**: Verifies the fix against a sample Python file.
  • Confirmed that generic .generate() calls are now correctly ignored, while legitimate X448PrivateKey.generate() calls continue to be detected.

Fixes #300

@Ndugu2 Ndugu2 requested a review from a team as a code owner May 5, 2026 16:40
Sign up for free to join this conversation on GitHub. Already have an account? Sign in to comment

Labels

None yet

Projects

None yet

Development

Successfully merging this pull request may close these issues.

Python Scanner generates False Positives

1 participant