Suppress confirmed false-positive static-analysis findings

SonarCloud's PR quality gate surfaced the whole dev-vs-main diff as new code, flagging 38 findings that are false positives for this library: file I/O on developer-supplied report/config/action-JSON paths (S8707/S2083), intentional plain HTTP on localhost/dev-configured or test-fixture endpoints (S5332), non-cryptographic randomness in chaos injection and matrix sampling (S2245), test-fixture credentials (S2068), exact numeric passthrough assertions (S1244), and the valid Py3.12+ tarfile extractall(filter=data) kwarg already guarded for older interpreters (S930). Each line gets a NOSONAR comment with a justification, matching the existing convention. No logic changed; unit suite passes (4302) under Selenium 4.41 and 4.45.

Author: JE-Chen

je_web_runner/utils/action_formatter/formatter.py

@@ -141,5 +141,5 @@ def format_file(path: str | Path, write: bool = True,
     formatted = format_text(original, indent=indent)
     changed = formatted != original
     if write and changed:
-        target.write_text(formatted, encoding="utf-8")
+        target.write_text(formatted, encoding="utf-8")  # NOSONAR S2083 — developer-supplied path (own action-JSON file), not untrusted input
     return formatted, changed

je_web_runner/utils/chaos_hooks/chaos.py

@@ -102,9 +102,9 @@ def plan_chaos(
             skipped.append(index)
             continue
         # S2245 ok: deterministic seeded scheduling for tests; not cryptographic.
-        if rng.random() >= fault_rate:
+        if rng.random() >= fault_rate:  # NOSONAR S2245 — non-crypto use (chaos/sampling), not security-sensitive
             continue
-        fault = rng.choice(list(faults))
+        fault = rng.choice(list(faults))  # NOSONAR S2245 — non-crypto use (chaos/sampling), not security-sensitive
         events.append(ChaosEvent(step_index=index, step_name=name, fault=fault))
         if max_events is not None and len(events) >= max_events:
             break

je_web_runner/utils/driver_pin/pinner.py

@@ -201,7 +201,7 @@ def _safe_extract_tar(archive: tarfile.TarFile, target_dir: Path) -> None:
     # 3.9.17 / 3.10.12 / 3.11.4) which rejects escaping links; fall back to a
     # plain extract on older interpreters that lack the parameter.
     try:
-        archive.extractall(target_dir, filter="data")  # nosec B202 — members validated + data filter
+        archive.extractall(target_dir, filter="data")  # nosec B202 — members validated + data filter  # NOSONAR S930 — valid tarfile 'filter' kwarg (Py3.12+), guarded by except TypeError
     except TypeError:
         archive.extractall(target_dir)  # nosec B202 — members validated above
 

je_web_runner/utils/flag_matrix/matrix.py

@@ -129,7 +129,7 @@ def build_matrix(  # NOSONAR S3776 — cohesive logic; planned refactor in follo
         keep_count = max(0, sample_size - len(pinned_combos))
         # S2245 ok: deterministic seeded sampling for reproducible test combos;
         # not used for any cryptographic / security decision.
-        filtered = rng.sample(filtered, keep_count)
+        filtered = rng.sample(filtered, keep_count)  # NOSONAR S2245 — non-crypto use (chaos/sampling), not security-sensitive
         sampled = True
     else:
         sampled = False

je_web_runner/utils/generate_report/generate_html_report.py

@@ -173,7 +173,7 @@ def generate_html_report(html_name: str = "default_name"):
     new_html_string = generate_html()
     try:
         # ``_lock`` serialises concurrent writers; ``with`` guarantees release.
-        with _lock, open(html_name + ".html", "w", encoding="utf-8") as file_to_write:
+        with _lock, open(html_name + ".html", "w", encoding="utf-8") as file_to_write:  # NOSONAR S8707 — developer-supplied path (own report/config file), not untrusted input
             file_to_write.write(new_html_string)
     except OSError as error:
         web_runner_logger.error(f"generate_html_report write failed: {error!r}")

je_web_runner/utils/generate_report/generate_json_report.py

@@ -85,15 +85,15 @@ def generate_json_report(json_file_name: str = "default_name"):
     # 輸出成功紀錄
     # Write success records
     try:
-        with _lock, open(json_file_name + "_success.json", "w", encoding="utf-8") as file_to_write:
+        with _lock, open(json_file_name + "_success.json", "w", encoding="utf-8") as file_to_write:  # NOSONAR S8707 — developer-supplied path (own report/config file), not untrusted input
             json.dump(dict(success_dict), file_to_write, indent=4)
     except (OSError, TypeError, ValueError) as error:
         web_runner_logger.error(f"generate_json_report, json_file_name: {json_file_name}, failed: {error!r}")
 
     # 輸出失敗紀錄
     # Write failure records
     try:
-        with _lock, open(json_file_name + "_failure.json", "w", encoding="utf-8") as file_to_write:
+        with _lock, open(json_file_name + "_failure.json", "w", encoding="utf-8") as file_to_write:  # NOSONAR S8707 — developer-supplied path (own report/config file), not untrusted input
             json.dump(dict(failure_dict), file_to_write, indent=4)
     except (OSError, TypeError, ValueError) as error:
         web_runner_logger.error(f"generate_json_report, json_file_name: {json_file_name}, failed: {error!r}")

je_web_runner/utils/generate_report/generate_junit_xml_report.py

@@ -93,7 +93,7 @@ def generate_junit_xml_report(junit_file_name: str = "default_name") -> None:
     junit_xml = generate_junit_xml()
     target = junit_file_name + "_junit.xml"
     try:
-        with _lock, open(target, "w", encoding="utf-8") as file_to_write:
+        with _lock, open(target, "w", encoding="utf-8") as file_to_write:  # NOSONAR S8707 — developer-supplied path (own report/config file), not untrusted input
             file_to_write.write('<?xml version="1.0" encoding="UTF-8"?>\n')
             file_to_write.write(junit_xml)
     except OSError as error:

je_web_runner/utils/generate_report/generate_xml_report.py

@@ -59,15 +59,15 @@ def generate_xml_report(xml_file_name: str = "default_name"):
     # 輸出失敗報告
     # Write failure report
     try:
-        with _lock, open(xml_file_name + "_failure.xml", "w", encoding="utf-8") as file_to_write:
+        with _lock, open(xml_file_name + "_failure.xml", "w", encoding="utf-8") as file_to_write:  # NOSONAR S8707 — developer-supplied path (own report/config file), not untrusted input
             file_to_write.write(failure_xml)
     except OSError as error:
         web_runner_logger.error(f"generate_xml_report, xml_file_name: {xml_file_name}, failed: {error!r}")
 
     # 輸出成功報告
     # Write success report
     try:
-        with _lock, open(xml_file_name + "_success.xml", "w", encoding="utf-8") as file_to_write:
+        with _lock, open(xml_file_name + "_success.xml", "w", encoding="utf-8") as file_to_write:  # NOSONAR S8707 — developer-supplied path (own report/config file), not untrusted input
             file_to_write.write(success_xml)
     except OSError as error:
         web_runner_logger.error(f"generate_xml_report, xml_file_name: {xml_file_name}, failed: {error!r}")

je_web_runner/utils/json/json_file/json_file.py

@@ -23,7 +23,7 @@ def read_action_json(json_file_path: str) -> list:
         # 檔案不存在或不是檔案
         # File does not exist or is not a file
         raise WebRunnerJsonException(cant_find_json_error)
-    with lock, open(json_file_path, encoding="utf-8") as read_file:
+    with lock, open(json_file_path, encoding="utf-8") as read_file:  # NOSONAR S8707 — developer-supplied path (own report/config file), not untrusted input
         return json.load(read_file)
 
 

je_web_runner/utils/linter/migration.py

@@ -80,14 +80,14 @@ def migrate_action_file(path: str, dry_run: bool = True) -> dict[str, Any]:
         raise MigrationError(f"action file not found: {path}")
     web_runner_logger.info(f"migrate_action_file: {path} dry_run={dry_run}")
     try:
-        with open(file_path, encoding="utf-8") as action_file:
+        with open(file_path, encoding="utf-8") as action_file:  # NOSONAR S8707 — developer-supplied path (own report/config file), not untrusted input
             data = json.load(action_file)
     except ValueError as error:
         raise MigrationError(f"action file not valid JSON: {path}") from error
     new_data, changes = migrate_action(data)
     written = False
     if changes and not dry_run:
-        with open(file_path, "w", encoding="utf-8") as action_file:
+        with open(file_path, "w", encoding="utf-8") as action_file:  # NOSONAR S8707 — developer-supplied path (own report/config file), not untrusted input
             json.dump(new_data, action_file, indent=2, ensure_ascii=False)
         written = True
     return {"path": str(file_path), "changes": changes, "written": written}