From f894b32d263ac0e60389406a0b931c82a1b7360e Mon Sep 17 00:00:00 2001
From: M9nx <elhussieny@users.noreply.github.com>
Date: Mon, 7 Sep 2026 08:39:27 +0300
Subject: [PATCH] fix(safety): exclude PDO method calls from exec() detection

Resolves #19

The exec() danger pattern used a simple word-boundary regex that
matched any call whose name ended in 'exec', including PHP PDO
method calls such as $pdo->exec() and PDO::exec().

Apply negative look-behinds for '->' and '::' so that only standalone
function invocations (the global PHP exec() / Python exec()) are flagged.
Method-call forms are safe SQL-execution APIs and must not generate
false-positive safety warnings.

Changes:
- semantic_code_intelligence/llm/safety.py: update exec() pattern from
  \bexec\s*\( to (?<!->)(?<!::)\bexec\s*\(
- semantic_code_intelligence/tests/test_phase12.py: add 6 regression
  tests verifying global exec() is still caught while $pdo->exec(),
  $connection->exec(), and PDO::exec() are not flagged
---
 semantic_code_intelligence/llm/safety.py      |  2 +-
 .../tests/test_phase12.py                     | 31 +++++++++++++++++++
 2 files changed, 32 insertions(+), 1 deletion(-)

diff --git a/semantic_code_intelligence/llm/safety.py b/semantic_code_intelligence/llm/safety.py
index 3b4e900..b6b9b79 100644
--- a/semantic_code_intelligence/llm/safety.py
+++ b/semantic_code_intelligence/llm/safety.py
@@ -23,7 +23,7 @@
     (r"\brm\s+-rf\s+/", "Destructive rm -rf / command"),
     # Dynamic code execution
     (r"\beval\s*\(", "eval() call — avoid dynamic code execution"),
-    (r"\bexec\s*\(", "exec() call — avoid dynamic code execution"),
+    (r"(?<!->)(?<!::)\bexec\s*\(", "exec() call — avoid dynamic code execution"),
     (r"\b__import__\s*\(", "Dynamic __import__() — use explicit imports"),
     # SQL injection risk
     (r"DROP\s+TABLE|DROP\s+DATABASE", "SQL DROP statement — potential data loss"),
diff --git a/semantic_code_intelligence/tests/test_phase12.py b/semantic_code_intelligence/tests/test_phase12.py
index bead1b2..a5136fc 100644
--- a/semantic_code_intelligence/tests/test_phase12.py
+++ b/semantic_code_intelligence/tests/test_phase12.py
@@ -265,6 +265,37 @@ def test_validate_report_details(self):
         assert any("XSS" in d for d in descs)
         assert any("MD5" in d for d in descs)
 
+    # --- Issue #19: PDO::exec() false-positive regression tests ---
+
+    def test_exec_global_still_flagged(self):
+        """Standalone exec() (global PHP / Python function) must still be caught."""
+        assert not self.validator.is_safe("exec('ls -la')")
+
+    def test_exec_global_python_still_flagged(self):
+        """Python exec() with dynamic code must still be caught."""
+        assert not self.validator.is_safe("exec(user_code)")
+
+    def test_pdo_arrow_exec_not_flagged(self):
+        """PHP $pdo->exec() is a PDO method call and must NOT be flagged."""
+        assert self.validator.is_safe("$pdo->exec('CREATE TABLE foo (id INT)')")
+
+    def test_connection_arrow_exec_not_flagged(self):
+        """PHP $connection->exec() is a PDO method call and must NOT be flagged."""
+        assert self.validator.is_safe("$connection->exec($sql)")
+
+    def test_pdo_static_exec_not_flagged(self):
+        """PHP PDO::exec() static call must NOT be flagged."""
+        assert self.validator.is_safe("PDO::exec($statement)")
+
+    def test_pdo_exec_multiline_not_flagged(self):
+        """Multi-line PHP code using PDO method calls should pass the safety check."""
+        php_code = (
+            "$pdo = new PDO($dsn, $user, $pass);\n"
+            "$pdo->exec('SET NAMES utf8mb4');\n"
+            "$connection->exec($migrationSql);\n"
+        )
+        assert self.validator.is_safe(php_code)
+
 
 # =========================================================================
 # VSCode streaming context tests