Kjell Tore Guttormsen 76f190cf78 fix(llm-security): AST-taint clears taint on reassignment (#29) + sink test coverage (#28) ... py-ast-taint.py Assign handler never removed a name from the tainted set on reassignment, so a source-then-constant/sanitizer rebind (g=os.getenv(); g='safe'; os.system(g), or x=shlex.quote(x)) kept stale taint and fired false AST-CMD-EXEC findings. Assign now clears taint for target names when the RHS is not a source. No cross-expression propagation added — the f-string/concat/alias recall gap (#27) stays deferred to v8. #28: added fixtures+assertions locking the tainted subprocess/os.system AST-CMD-EXEC sink and the open(...,'w') AST-FILE-WRITE sink. Suite 1931/0. Co-Authored-By: Claude Opus 4.8 (1M context) <noreply@anthropic.com> Claude-Session: https://claude.ai/code/session_01TcQyMTQfyrsAapaCMPxTtQ		2026-07-18 10:14:51 +02:00
..
creds-net.py	feat(llm-security): add AST Python-taint scanner with python3 fallback	2026-06-20 09:38:36 +02:00
reassign.py	fix(llm-security): AST-taint clears taint on reassignment (#29) + sink test coverage (#28)	2026-07-18 10:14:51 +02:00
scope.py	feat(llm-security): add AST Python-taint scanner with python3 fallback	2026-06-20 09:38:36 +02:00
sentinel.py	feat(llm-security): add AST Python-taint scanner with python3 fallback	2026-06-20 09:38:36 +02:00
sinks.py	fix(llm-security): AST-taint clears taint on reassignment (#29) + sink test coverage (#28)	2026-07-18 10:14:51 +02:00