Skip to content

fix(sc8): inspect bytecode in virtual environments - #571

Merged
rng1995 merged 1 commit into
NVIDIA:mainfrom
deepujain:fix/367-block-skipped-executables
Sep 18, 2026
Merged

rng1995 merged 1 commit into
NVIDIA:mainfrom
deepujain:fix/367-block-skipped-executables

Conversation

@deepujain

Copy link
Copy Markdown
Contributor

Summary

  • inspect shipped Python virtual-environment directories for bytecode, which remains importable by bundled runtimes
  • retain bounded traversal and vendor-directory exclusions
  • add a regression for .venv bytecode

Fixes #367

Validation

  • ruff check
  • ruff format
  • py_compile
  • git diff --check

@deepujain
deepujain force-pushed the fix/367-block-skipped-executables branch from 426797b to 73c68a2 Compare September 17, 2026 03:55
@deepujain
deepujain force-pushed the fix/367-block-skipped-executables branch from 73c68a2 to d0cda0e Compare September 17, 2026 22:40

@rng1995 rng1995 left a comment

Copy link
Copy Markdown
Collaborator

Choose a reason for hiding this comment

The reason will be displayed to describe this comment to others. Learn more.

[SkillSpector Review]

Reviewed exact head d0cda0e418b69d298c85eaa4a4f9bf90fae6975c.

The SC8 traversal now inspects shipped virtual-environment trees instead of treating .venv, venv, and .tox as non-runtime metadata. The existing traversal safeguards remain intact: symlinks are not followed, .git/node_modules/pytest cache remain excluded, and aggregate entry, depth, runtime, finding, and limitation bounds still fail closed. The focused regression covers the previously skipped .venv bytecode path, and all six hosted checks pass.

Approved.

@rng1995
rng1995 merged commit a2100fe into NVIDIA:main Sep 18, 2026
6 checks passed
Sign up for free to join this conversation on GitHub. Already have an account? Sign in to comment

Labels

None yet

Projects

None yet

Development

Successfully merging this pull request may close these issues.

[SECURITY] SC8 presence check does not fix incomplete skip denylist (CWE-184 / CWE-693) (same class as __pycache__ still applies elsewhere)

2 participants