[akhilp117]

Part 2 of 2 for ENG-8951 (https://linear.app/getsentry/issue/ENG-8951/fix-s026-to-catch-raw-reads-being-passed-into-helpers). The S025-S028 input rules only looked inside a public endpoint method, so a raw read or a serializer inside a helper it calls was never reported. This follows those helpers and reports what they read, checked against the public method's @extend_schema.

• After the module walk, _report_public_inputs builds each public method's report with _merged_http_method_inputs, which starts a new ctx and fills it with _merge_ctx_into. For every call the method makes, _helper_call_ctx_lookup finds the same-file function that actually runs:
  • a plain helper() call is a module-level function
  • self.helper() goes through the public class's bases in the order _handle_inheritance_method_lookup and _walk_class_bases return, so subclass overrides win
  • super().helper() starts after the class that made the call
• _merge_ctx_into copies the helper's reads, serializers and hand-offs, then does the same for the helper's own calls, so helpers of helpers are followed too
• A helper often reads through its own parameter (for example def helper(self, params): params.get("id")), which only means something once we know what the caller passed. We handle this through _bind_call, which matches the call's arguments with the helper's parameters

What we report now:

• A read or hand-off inside a helper (S026-S028) is reported once, at the helper's line with the helper as its scope, even when several public methods reach it. ApiInputViolation.caller records the first public method that reaches it, so a module-level helper can still be given an owner
• S025 stays on each calling method, since each one is checked against its own @extend_schema
• A call into a followed helper no longer reports an S028 for handing it the payload, because the helper's reads are reported instead

When a helper isn't followed the S028 stays

• The payload can leave the helper without being recorded: returned, yielded, stored, put in a container, iterated, or the parameter being reassigned. Harmless checks (i.e, isinstance, in, is None, truthiness, len) don't count as leaving
• The call could mean more than one function:
  • the name is bound in the calling function (a parameter, local, import or nested def)
  • it's bound more than once in the module or class body
  • the class tree has more than one base from this file, where the depth-first order may not be Python's
• A payload can't be tied to a parameter (*args, **kwargs, or a keyword the helper doesn't have)

Other changes

• request.GET if xyz else {abc} counts as an input source
• A data= call to a name ending in _cls, serializer or validator (serializer_cls(data=xyz), settings.validator(data=xyz)) counts as a serializer and not an S028 hand-off
• isinstance(request.data) is no longer an S028, which was a bug that existed when the rules were first implemented
• A variable reassigned to something that isn't request input (data = serializer.validated_data) stops counting as request input for the reads after it in the same block, so data.get("name") is no longer a wrong S026. After an if, loop, try or nested def the name may still be the request, so it's tracked again. This also changes main's checks for local variables in public methods andd not just helper parameters

Total results (mains plugin vs this PR's plugin on the same commit 493f22a)

• 229 findings before, 294 after
• +65 S026: raw reads inside helpers
• +1 S025: a serializer built inside a helper
• +3 S028: hand-offs to imported code that were hidden inside helpers
• -4 S028: hand-offs to same-file helpers that are now followed and read through
• Every added and removed finding was checked by hand, with no false positives. The other S-rules' output is unchanged

[linear-code]

ENG-8951

[cursor]

Stale Bugbot comment from a previous run.

[cursor]

Cursor Bugbot has reviewed your changes and found 1 potential issue.

There are 2 total unresolved issues (including 1 from previous review).

^{❌ Bugbot Autofix is OFF. To automatically fix reported issues with cloud agents, enable autofix in the Cursor dashboard.}

^{Reviewed by Cursor Bugbot for commit 9e1f791. Configure here.}

[DominikB2014]

We went over this pr in person, this flow is getting quite complex, but i'm okay with running with this and giving it a try. This isn't actually being ran in CI yet

[cursor]

This PR is too large for Bugbot to review. It changes 58,255 lines and 3,798,062 characters. Split the change into smaller pull requests to get a review.