GuardDog Only Scans "setup.py" For Code Execution

[cedricvanrompay-datadog]

guarddog/guarddog/analyzer/sourcecode/code-execution.yml

Line 1 in e49bf32

# Only searches in setup.py to reduce false positives!

guarddog/guarddog/analyzer/sourcecode/code-execution.yml

Lines 113 to 116 in e49bf32

	paths:
	include:
	- "*/setup.py"
	- "*/code-execution.py"

This causes a lot of malicious packages not to be detected because they perform code execution in other files.

It's true that reporting every single code execution would result in a lot of noise though.

We should at least make this limitation clear, because a lot of people are surprised that GuardDog does not report some malicious packages. See:

• Identify new malicious pypi packages #306
• New pypi exploits #311