@orionscanner/cli 0.1.0 → 0.5.1

package/src/orion/engine/container/engine.py

@@ -1,546 +0,0 @@
-"""Container/security config analysis engine - analyzes Dockerfiles, docker-compose, Kubernetes, Helm."""
-import re
-import yaml
-import json
-from pathlib import Path
-from typing import Dict, List, Optional, Any, Set
-from dataclasses import dataclass
-
-from orion.engine.config import EngineConfig
-from orion.engine.ir import OrionIR
-from orion.engine.results import EngineResult, Finding
-
-
-@dataclass
-class ContainerFinding:
-    severity: str
-    title: str
-    description: str
-    location: str
-    metadata: dict
-
-
-class ContainerEngine:
-    name = "container"
-    version = "1.0.0"
-
-    CONTAINER_FILES = {
-        "dockerfile": ["Dockerfile", "Dockerfile.*", "*.dockerfile"],
-        "docker_compose": ["docker-compose.yml", "docker-compose.yaml", "docker-compose.*.yml", "docker-compose.*.yaml"],
-        "dockerignore": [".dockerignore"],
-        "kubernetes": ["kubernetes/*.yaml", "kubernetes/*.yml", "k8s/*.yaml", "k8s/*.yml", "manifests/*.yaml", "manifests/*.yml"],
-        "helm": ["helm/**/values.yaml", "helm/**/values.yml", "charts/**/values.yaml", "charts/**/values.yml"],
-    }
-
-    SECRET_PATTERNS = [
-        (re.compile(r'(password|passwd|pwd)\s*[:=]\s*["\']?[^"\'\s]{8,}'), "password"),
-        (re.compile(r'(api[_-]?key|apikey|secret[_-]?key|access[_-]?token)\s*[:=]\s*["\']?[^"\'\s]{16,}'), "api_key"),
-        (re.compile(r'AKIA[0-9A-Z]{16}'), "aws_access_key"),
-        (re.compile(r'-----BEGIN (RSA |EC |DSA |OPENSSH )?PRIVATE KEY-----'), "private_key"),
-        (re.compile(r'(jdbc|mongodb|redis|mysql|postgres)://[^:\s]+:[^@\s]+@'), "connection_string"),
-    ]
-
-    async def check_availability(self) -> bool:
-        return True
-
-    def resource_limits(self):
-        from orion.engine.config import ResourceLimits
-        return ResourceLimits(max_cpu_seconds=30, max_memory_mb=128)
-
-    def _should_exclude(self, filepath: str, config: EngineConfig) -> bool:
-        path = Path(filepath)
-        if config.toggles.get("exclude"):
-            for pattern in config.toggles["exclude"]:
-                if path.match(pattern) or any(p.match(pattern) for p in path.parents):
-                    return True
-        return False
-
-    def _detect_file_type(self, filepath: str) -> Optional[str]:
-        path = Path(filepath)
-        name = path.name.lower()
-
-        if name == "dockerfile" or name.startswith("dockerfile.") or name.endswith(".dockerfile"):
-            return "dockerfile"
-        if name.startswith("docker-compose") and (name.endswith(".yml") or name.endswith(".yaml")):
-            return "docker_compose"
-        if name == ".dockerignore":
-            return "dockerignore"
-        if "kubernetes" in path.parts or "k8s" in path.parts or "manifests" in path.parts:
-            if name.endswith((".yaml", ".yml")):
-                return "kubernetes"
-        if "helm" in path.parts or "charts" in path.parts:
-            if name in ("values.yaml", "values.yml"):
-                return "helm"
-        return None
-
-    def _scan_secrets(self, content: str, filepath: str) -> List[ContainerFinding]:
-        findings = []
-        lines = content.splitlines()
-        for i, line in enumerate(lines, 1):
-            for pattern, secret_type in self.SECRET_PATTERNS:
-                if pattern.search(line):
-                    findings.append(ContainerFinding(
-                        severity="critical",
-                        title=f"Hardcoded {secret_type} in {Path(filepath).name}",
-                        description=f"Potential {secret_type} found in container config",
-                        location=f"{filepath}:{i}",
-                        metadata={"rule": f"secret_{secret_type}", "file": filepath, "line": i, "type": secret_type},
-                    ))
-        return findings
-
-    def _analyze_dockerfile(self, content: str, filepath: str) -> List[ContainerFinding]:
-        findings = []
-        lines = content.splitlines()
-        has_user = False
-        has_healthcheck = False
-        from_latest = False
-        copy_dot = False
-        has_add_url = False
-
-        for i, line in enumerate(lines, 1):
-            stripped = line.strip()
-            upper = stripped.upper()
-
-            # Check for USER instruction
-            if upper.startswith("USER "):
-                user = stripped[5:].strip()
-                if user == "root" or user == "0":
-                    findings.append(ContainerFinding(
-                        severity="high",
-                        title="Container runs as root",
-                        description="Dockerfile specifies USER root - containers should run as non-root user",
-                        location=f"{filepath}:{i}",
-                        metadata={"rule": "user_root", "file": filepath, "line": i},
-                    ))
-                has_user = True
-
-            # Check for FROM latest or no tag
-            if upper.startswith("FROM "):
-                from_part = stripped[5:].strip()
-                if ":latest" in from_part or (":" not in from_part and "@" not in from_part and not from_part.startswith("--")):
-                    findings.append(ContainerFinding(
-                        severity="medium",
-                        title="Base image uses 'latest' tag or no tag",
-                        description="Using 'latest' or no tag makes builds non-reproducible",
-                        location=f"{filepath}:{i}",
-                        metadata={"rule": "from_latest", "file": filepath, "line": i, "image": from_part},
-                    ))
-                    from_latest = True
-
-            # Check for COPY . .
-            if upper.startswith("COPY ") and ". ." in stripped:
-                findings.append(ContainerFinding(
-                    severity="medium",
-                    title="COPY . . copies entire build context",
-                    description="COPY . . copies all files including secrets, tests, etc. - use explicit paths",
-                    location=f"{filepath}:{i}",
-                    metadata={"rule": "copy_dot_dot", "file": filepath, "line": i},
-                ))
-                copy_dot = True
-
-            # Check for ADD from URL
-            if upper.startswith("ADD ") and ("http://" in stripped or "https://" in stripped):
-                findings.append(ContainerFinding(
-                    severity="high",
-                    title="ADD with remote URL",
-                    description="ADD with URL can introduce supply chain risks - use COPY or RUN with explicit download",
-                    location=f"{filepath}:{i}",
-                    metadata={"rule": "add_remote_url", "file": filepath, "line": i},
-                ))
-                has_add_url = True
-
-            # Check for secrets in ENV/ARG
-            if upper.startswith("ENV ") or upper.startswith("ARG "):
-                for pattern, secret_type in self.SECRET_PATTERNS:
-                    if pattern.search(stripped):
-                        findings.append(ContainerFinding(
-                            severity="critical",
-                            title=f"Secret in {upper.split()[0]} instruction",
-                            description=f"Potential {secret_type} in {upper.split()[0]} - use build secrets or runtime env",
-                            location=f"{filepath}:{i}",
-                            metadata={"rule": f"secret_in_{upper.split()[0].lower()}", "file": filepath, "line": i, "type": secret_type},
-                        ))
-
-            # Check for HEALTHCHECK
-            if upper.startswith("HEALTHCHECK"):
-                has_healthcheck = True
-
-        # Missing USER
-        if not has_user:
-            findings.append(ContainerFinding(
-                severity="high",
-                title="Missing USER instruction",
-                description="Container will run as root by default - add USER instruction",
-                location=filepath,
-                metadata={"rule": "missing_user", "file": filepath},
-            ))
-
-        # Missing HEALTHCHECK
-        if not has_healthcheck:
-            findings.append(ContainerFinding(
-                severity="medium",
-                title="Missing HEALTHCHECK",
-                description="No health check defined - container orchestration cannot verify health",
-                location=filepath,
-                metadata={"rule": "missing_healthcheck", "file": filepath},
-            ))
-
-        return findings
-
-    def _analyze_docker_compose(self, content: str, filepath: str) -> List[ContainerFinding]:
-        findings = []
-        try:
-            compose = yaml.safe_load(content)
-            if not compose or "services" not in compose:
-                return findings
-
-            for service_name, service_config in compose.get("services", {}).items():
-                if not isinstance(service_config, dict):
-                    continue
-
-                # privileged
-                if service_config.get("privileged"):
-                    findings.append(ContainerFinding(
-                        severity="critical",
-                        title=f"Service '{service_name}' runs in privileged mode",
-                        description="Privileged containers have full access to host - major security risk",
-                        location=f"{filepath}:services.{service_name}.privileged",
-                        metadata={"rule": "privileged", "file": filepath, "service": service_name},
-                    ))
-
-                # cap_add: ALL
-                cap_add = service_config.get("cap_add", [])
-                if isinstance(cap_add, list) and "ALL" in cap_add:
-                    findings.append(ContainerFinding(
-                        severity="high",
-                        title=f"Service '{service_name}' adds ALL capabilities",
-                        description="Adding ALL capabilities defeats container isolation",
-                        location=f"{filepath}:services.{service_name}.cap_add",
-                        metadata={"rule": "cap_add_all", "file": filepath, "service": service_name},
-                    ))
-
-                # network_mode: host
-                if service_config.get("network_mode") == "host":
-                    findings.append(ContainerFinding(
-                        severity="high",
-                        title=f"Service '{service_name}' uses host network",
-                        description="Host network mode gives container full access to host network stack",
-                        location=f"{filepath}:services.{service_name}.network_mode",
-                        metadata={"rule": "network_mode_host", "file": filepath, "service": service_name},
-                    ))
-
-                # pid_mode: host
-                if service_config.get("pid_mode") == "host":
-                    findings.append(ContainerFinding(
-                        severity="high",
-                        title=f"Service '{service_name}' uses host PID namespace",
-                        description="Host PID mode allows container to see all host processes",
-                        location=f"{filepath}:services.{service_name}.pid_mode",
-                        metadata={"rule": "pid_mode_host", "file": filepath, "service": service_name},
-                    ))
-
-                # ipc_mode: host
-                if service_config.get("ipc_mode") == "host":
-                    findings.append(ContainerFinding(
-                        severity="high",
-                        title=f"Service '{service_name}' uses host IPC namespace",
-                        description="Host IPC mode allows container to share IPC with host",
-                        location=f"{filepath}:services.{service_name}.ipc_mode",
-                        metadata={"rule": "ipc_mode_host", "file": filepath, "service": service_name},
-                    ))
-
-                # read_only
-                if not service_config.get("read_only"):
-                    findings.append(ContainerFinding(
-                        severity="medium",
-                        title=f"Service '{service_name}' missing read_only: true",
-                        description="Container filesystem should be read-only for security",
-                        location=f"{filepath}:services.{service_name}.read_only",
-                        metadata={"rule": "missing_read_only", "file": filepath, "service": service_name},
-                    ))
-
-                # resource limits
-                deploy = service_config.get("deploy", {})
-                resources = deploy.get("resources", {})
-                limits = resources.get("limits", {})
-                if not limits:
-                    findings.append(ContainerFinding(
-                        severity="medium",
-                        title=f"Service '{service_name}' missing resource limits",
-                        description="Containers should have CPU/memory limits to prevent DoS",
-                        location=f"{filepath}:services.{service_name}.deploy.resources.limits",
-                        metadata={"rule": "missing_resource_limits", "file": filepath, "service": service_name},
-                    ))
-
-                # secrets in environment
-                env = service_config.get("environment", {})
-                if isinstance(env, dict):
-                    for key, value in env.items():
-                        for pattern, secret_type in self.SECRET_PATTERNS:
-                            if isinstance(value, str) and pattern.search(value):
-                                findings.append(ContainerFinding(
-                                    severity="critical",
-                                    title=f"Secret in environment variable for service '{service_name}'",
-                                    description=f"Potential {secret_type} in environment variable '{key}'",
-                                    location=f"{filepath}:services.{service_name}.environment.{key}",
-                                    metadata={"rule": f"secret_in_env", "file": filepath, "service": service_name, "env_var": key, "type": secret_type},
-                                ))
-
-        except yaml.YAMLError:
-            pass
-        return findings
-
-    def _analyze_kubernetes(self, content: str, filepath: str) -> List[ContainerFinding]:
-        findings = []
-        try:
-            docs = list(yaml.safe_load_all(content))
-            for doc in docs:
-                if not doc or not isinstance(doc, dict):
-                    continue
-
-                kind = doc.get("kind", "")
-                metadata = doc.get("metadata", {})
-                name = metadata.get("name", "unknown")
-                namespace = metadata.get("namespace", "default")
-
-                # Check Pod security context
-                spec = doc.get("spec", {})
-                template_spec = spec.get("template", {}).get("spec", spec)
-
-                # allowPrivilegeEscalation
-                containers = template_spec.get("containers", [])
-                for container in containers:
-                    if not isinstance(container, dict):
-                        continue
-                    container_name = container.get("name", "unknown")
-                    security_context = container.get("securityContext", {})
-
-                    if security_context.get("allowPrivilegeEscalation") is True:
-                        findings.append(ContainerFinding(
-                            severity="high",
-                            title=f"Container '{container_name}' allows privilege escalation",
-                            description="allowPrivilegeEscalation: true allows processes to gain more privileges",
-                            location=f"{filepath}:{kind}/{name}.spec.containers[{container_name}].securityContext.allowPrivilegeEscalation",
-                            metadata={"rule": "allow_privilege_escalation", "file": filepath, "kind": kind, "name": name, "container": container_name},
-                        ))
-
-                    if security_context.get("runAsRoot") is True:
-                        findings.append(ContainerFinding(
-                            severity="high",
-                            title=f"Container '{container_name}' runs as root",
-                            description="runAsRoot: true allows container to run as root user",
-                            location=f"{filepath}:{kind}/{name}.spec.containers[{container_name}].securityContext.runAsRoot",
-                            metadata={"rule": "run_as_root", "file": filepath, "kind": kind, "name": name, "container": container_name},
-                        ))
-
-                    if security_context.get("privileged") is True:
-                        findings.append(ContainerFinding(
-                            severity="critical",
-                            title=f"Container '{container_name}' is privileged",
-                            description="Privileged containers have full access to host",
-                            location=f"{filepath}:{kind}/{name}.spec.containers[{container_name}].securityContext.privileged",
-                            metadata={"rule": "privileged_container", "file": filepath, "kind": kind, "name": name, "container": container_name},
-                        ))
-
-                    # capabilities
-                    caps = security_context.get("capabilities", {})
-                    if isinstance(caps, dict):
-                        add_caps = caps.get("add", [])
-                        if "ALL" in add_caps:
-                            findings.append(ContainerFinding(
-                                severity="high",
-                                title=f"Container '{container_name}' adds ALL capabilities",
-                                description="Adding ALL capabilities defeats container isolation",
-                                location=f"{filepath}:{kind}/{name}.spec.containers[{container_name}].securityContext.capabilities.add",
-                                metadata={"rule": "cap_add_all_k8s", "file": filepath, "kind": kind, "name": name, "container": container_name},
-                            ))
-
-                # Host network/PID/IPC
-                if template_spec.get("hostNetwork"):
-                    findings.append(ContainerFinding(
-                        severity="high",
-                        title=f"{kind} '{name}' uses hostNetwork",
-                        description="hostNetwork: true gives pod access to host network stack",
-                        location=f"{filepath}:{kind}/{name}.spec.hostNetwork",
-                        metadata={"rule": "host_network", "file": filepath, "kind": kind, "name": name},
-                    ))
-
-                if template_spec.get("hostPID"):
-                    findings.append(ContainerFinding(
-                        severity="high",
-                        title=f"{kind} '{name}' uses hostPID",
-                        description="hostPID: true gives pod access to host process namespace",
-                        location=f"{filepath}:{kind}/{name}.spec.hostPID",
-                        metadata={"rule": "host_pid", "file": filepath, "kind": kind, "name": name},
-                    ))
-
-                if template_spec.get("hostIPC"):
-                    findings.append(ContainerFinding(
-                        severity="high",
-                        title=f"{kind} '{name}' uses hostIPC",
-                        description="hostIPC: true gives pod access to host IPC namespace",
-                        location=f"{filepath}:{kind}/{name}.spec.hostIPC",
-                        metadata={"rule": "host_ipc", "file": filepath, "kind": kind, "name": name},
-                    ))
-
-                # Resource limits
-                for container in containers:
-                    resources = container.get("resources", {})
-                    limits = resources.get("limits", {})
-                    if not limits:
-                        findings.append(ContainerFinding(
-                            severity="medium",
-                            title=f"Container '{container.get('name', 'unknown')}' missing resource limits",
-                            description="Containers should have CPU/memory limits",
-                            location=f"{filepath}:{kind}/{name}.spec.containers[{container.get('name', 'unknown')}].resources.limits",
-                            metadata={"rule": "missing_resource_limits_k8s", "file": filepath, "kind": kind, "name": name, "container": container.get("name")},
-                        ))
-
-                # Secrets in configmaps/secrets (check for hardcoded values)
-                if kind in ("ConfigMap", "Secret"):
-                    data = doc.get("data", {})
-                    string_data = doc.get("stringData", {})
-                    all_data = {**data, **string_data}
-                    for key, value in all_data.items():
-                        if isinstance(value, str):
-                            for pattern, secret_type in self.SECRET_PATTERNS:
-                                if pattern.search(value):
-                                    findings.append(ContainerFinding(
-                                        severity="critical" if kind == "Secret" else "high",
-                                        title=f"Hardcoded {secret_type} in {kind} '{name}'",
-                                        description=f"Potential {secret_type} in {kind} data key '{key}'",
-                                        location=f"{filepath}:{kind}/{name}.data.{key}",
-                                        metadata={"rule": f"secret_in_{kind.lower()}", "file": filepath, "kind": kind, "name": name, "key": key, "type": secret_type},
-                                    ))
-
-        except yaml.YAMLError:
-            pass
-        return findings
-
-    def _analyze_helm_values(self, content: str, filepath: str) -> List[ContainerFinding]:
-        findings = []
-        try:
-            values = yaml.safe_load(content)
-            if not values or not isinstance(values, dict):
-                return findings
-
-            # Check for hardcoded secrets in values
-            def check_dict(d: dict, prefix: str = ""):
-                for key, value in d.items():
-                    full_key = f"{prefix}.{key}" if prefix else key
-                    if isinstance(value, str):
-                        for pattern, secret_type in self.SECRET_PATTERNS:
-                            if pattern.search(value):
-                                findings.append(ContainerFinding(
-                                    severity="critical",
-                                    title=f"Hardcoded {secret_type} in Helm values",
-                                    description=f"Potential {secret_type} in values.{full_key}",
-                                    location=f"{filepath}:{full_key}",
-                                    metadata={"rule": "secret_in_helm_values", "file": filepath, "key": full_key, "type": secret_type},
-                                ))
-                    elif isinstance(value, dict):
-                        check_dict(value, full_key)
-
-            check_dict(values)
-
-        except yaml.YAMLError:
-            pass
-        return findings
-
-    def _analyze_dockerignore(self, content: str, filepath: str) -> List[ContainerFinding]:
-        findings = []
-        lines = content.splitlines()
-        has_git = False
-        has_env = False
-        has_secrets = False
-
-        for line in lines:
-            stripped = line.strip()
-            if not stripped or stripped.startswith("#"):
-                continue
-            if ".git" in stripped:
-                has_git = True
-            if ".env" in stripped or "*.env" in stripped:
-                has_env = True
-            if any(s in stripped.lower() for s in ["secret", "key", "password", "token", "credential"]):
-                has_secrets = True
-
-        if not has_git:
-            findings.append(ContainerFinding(
-                severity="low",
-                title=".dockerignore missing .git exclusion",
-                description="Should exclude .git directory from build context",
-                location=filepath,
-                metadata={"rule": "dockerignore_missing_git", "file": filepath},
-            ))
-
-        if not has_env:
-            findings.append(ContainerFinding(
-                severity="medium",
-                title=".dockerignore missing .env exclusion",
-                description="Should exclude .env files from build context to prevent secret leakage",
-                location=filepath,
-                metadata={"rule": "dockerignore_missing_env", "file": filepath},
-            ))
-
-        return findings
-
-    async def run(self, ir: OrionIR, config: EngineConfig) -> EngineResult:
-        filepath = ir.metadata.get("path", "unknown")
-
-        if self._should_exclude(filepath, config):
-            return EngineResult(engine=self.name, ok=True, metrics={"skipped": "excluded"})
-
-        file_type = self._detect_file_type(filepath)
-        if not file_type:
-            return EngineResult(engine=self.name, ok=True, metrics={"skipped": "not_container_file"})
-
-        try:
-            content = ir.content.decode("utf-8", errors="replace")
-        except Exception:
-            content = str(ir.content)
-
-        all_findings = []
-
-        # Scan for secrets in all file types
-        all_findings.extend(self._scan_secrets(content, filepath))
-
-        # Type-specific analysis
-        if file_type == "dockerfile":
-            all_findings.extend(self._analyze_dockerfile(content, filepath))
-        elif file_type == "docker_compose":
-            all_findings.extend(self._analyze_docker_compose(content, filepath))
-        elif file_type == "kubernetes":
-            all_findings.extend(self._analyze_kubernetes(content, filepath))
-        elif file_type == "helm":
-            all_findings.extend(self._analyze_helm_values(content, filepath))
-        elif file_type == "dockerignore":
-            all_findings.extend(self._analyze_dockerignore(content, filepath))
-
-        # Convert to Finding objects
-        findings = []
-        for f in all_findings:
-            # Only keep findings with confidence >= 0.85 (as per requirements)
-            # All our rules have high confidence
-            findings.append(Finding(
-                engine=self.name,
-                severity=f.severity,
-                title=f.title,
-                description=f.description,
-                location=f.location,
-                metadata=f.metadata,
-            ))
-
-        return EngineResult(
-            engine=self.name,
-            findings=findings,
-            ok=True,
-            metrics={
-                "file_type": file_type,
-                "file": filepath,
-                "findings_count": len(findings),
-            },
-        )
-
-
-Engine = ContainerEngine