@orionscanner/cli 0.1.0 → 0.5.1

package/src/orion/engine/data_residency/engine.py

@@ -1,238 +0,0 @@
-"""PII detection engine - regex-based detection of hardcoded PII in code."""
-import re
-import hashlib
-from orion.engine.config import EngineConfig
-from orion.engine.ir import OrionIR
-from orion.engine.results import EngineResult, Finding
-
-
-class Engine:
-    name = "data_residency"
-    version = "1.0.0"
-
-    PII_PATTERNS = {
-        "email": re.compile(r"[a-zA-Z0-9._%+-]+@[a-zA-Z0-9.-]+\.[a-zA-Z]{2,}"),
-        "phone": re.compile(r"\+?\d{1,3}[-.\s]?\(?\d{3}\)?[-.\s]?\d{3}[-.\s]?\d{4}"),
-        "ssn": re.compile(r"\b\d{3}-\d{2}-\d{4}\b"),
-        "credit_card": re.compile(r"\b(?:\d{4}[-\s]?){3}\d{4}\b"),
-        "ipv4": re.compile(r"\b(?:(?:25[0-5]|2[0-4][0-9]|[01]?[0-9][0-9]?)\.){3}(?:25[0-5]|2[0-4][0-9]|[01]?[0-9][0-9]?)\b"),
-        "uuid": re.compile(r"\b[0-9a-f]{8}-[0-9a-f]{4}-[0-9a-f]{4}-[0-9a-f]{4}-[0-9a-f]{12}\b", re.IGNORECASE),
-        "api_key": re.compile(r"(?i)(?:api[_-]?key|access[_-]?token|secret[_-]?key)['\"]?\s*[:=]\s*['\"]?([a-zA-Z0-9_\-]{20,})"),
-        "jwt": re.compile(r"eyJ[A-Za-z0-9_-]+\.[A-Za-z0-9_-]+\.[A-Za-z0-9_-]+"),
-    }
-
-    EXCLUDE_PATTERNS = [
-        r"test_", r"_test\.py$", r"/tests/", r"/test/", r"conftest\.py",
-        r"\.example", r"\.sample", r"\.template", r"fixture", r"mock",
-        r"example\.com", r"test@.*", r"user@.*", r"admin@.*",
-        r"127\.0\.0\.1", r"localhost", r"0\.0\.0\.0", r"::1",
-        r"555[-.\s]?\d{3}[-.\s]?\d{4}",  # fake phone prefix
-        r"123-45-6789",  # fake SSN
-        r"4111[-.\s]?1111[-.\s]?1111[-.\s]?1111",  # test CC
-    ]
-
-    def __init__(self):
-        self._exclude_regex = [re.compile(p, re.IGNORECASE) for p in self.EXCLUDE_PATTERNS]
-
-    async def check_availability(self) -> bool:
-        return True
-
-    def resource_limits(self):
-        from orion.engine.config import ResourceLimits
-        return ResourceLimits(max_cpu_seconds=60, max_memory_mb=256)
-
-    async def run(self, ir: OrionIR, config: EngineConfig) -> EngineResult:
-        try:
-            text = ir.content.decode("utf-8", errors="replace")
-        except Exception:
-            return EngineResult(engine=self.name, findings=[], ok=True)
-
-        path = ir.metadata.get("path", "unknown")
-
-        if self._should_exclude(path, text):
-            return EngineResult(engine=self.name, findings=[], ok=True)
-
-        findings = []
-        lines = text.splitlines()
-
-        findings.extend(self._scan_regex_patterns(text, lines, path))
-        findings.extend(self._scan_luhn_valid_cards(text, lines, path))
-
-        return EngineResult(engine=self.name, findings=findings, ok=True)
-
-    def _should_exclude(self, path: str, text: str) -> bool:
-        for pattern in self._exclude_regex:
-            if pattern.search(path):
-                return True
-        return False
-
-    def _scan_regex_patterns(self, text: str, lines: list[str], path: str) -> list[Finding]:
-        findings = []
-        for pii_type, pattern in self.PII_PATTERNS.items():
-            for match in pattern.finditer(text):
-                if pii_type == "credit_card" and not self._luhn_check(match.group()):
-                    continue
-
-                line_no = text[:match.start()].count("\n") + 1
-                context_start = max(0, match.start() - 50)
-                context_end = min(len(text), match.end() + 50)
-                context = text[context_start:context_end]
-
-                if self._is_in_comment_or_string(text, match.start(), lines, line_no):
-                    continue
-
-                if self._is_false_positive(pii_type, match.group(), context):
-                    continue
-
-                confidence = self._calculate_confidence(pii_type, match.group(), context)
-                if confidence >= 0.7:
-                    findings.append(Finding(
-                        engine=self.name,
-                        severity="high" if pii_type in ("ssn", "credit_card", "api_key", "jwt") else "medium",
-                        title=f"PII detected: {pii_type}",
-                        description=f"Hardcoded {pii_type} found in source code",
-                        location=f"{path}:{line_no}",
-                        metadata={
-                            "confidence": confidence,
-                            "pii_type": pii_type,
-                            "snippet": self._mask_pii(match.group(), pii_type),
-                            "context": context[:200],
-                            "cwe": "CWE-532",
-                        },
-                    ))
-
-        return findings
-
-    def _scan_luhn_valid_cards(self, text: str, lines: list[str], path: str) -> list[Finding]:
-        findings = []
-        cc_pattern = re.compile(r"\b(?:\d{4}[-\s]?){3}\d{4}\b|\b\d{13,19}\b")
-        for match in cc_pattern.finditer(text):
-            card_num = match.group().replace(" ", "").replace("-", "")
-            if len(card_num) >= 13 and len(card_num) <= 19 and card_num.isdigit():
-                if self._luhn_check(card_num):
-                    line_no = text[:match.start()].count("\n") + 1
-                    if not self._is_in_comment_or_string(text, match.start(), lines, line_no):
-                        findings.append(Finding(
-                            engine=self.name,
-                            severity="high",
-                            title="PII detected: credit_card (Luhn valid)",
-                            description="Hardcoded credit card number (passes Luhn check) found in source code",
-                            location=f"{path}:{line_no}",
-                            metadata={
-                                "confidence": 0.9,
-                                "pii_type": "credit_card",
-                                "snippet": self._mask_pii(match.group(), "credit_card"),
-                                "cwe": "CWE-532",
-                            },
-                        ))
-        return findings
-
-    def _is_in_comment_or_string(self, text: str, pos: int, lines: list[str], line_no: int) -> bool:
-        line_idx = line_no - 1
-        if 0 <= line_idx < len(lines):
-            line = lines[line_idx]
-            col = pos - (len(text) - len("\n".join(lines[line_idx:])))
-            if col < 0:
-                col = 0
-
-            in_string = False
-            string_char = None
-            escaped = False
-            for i, ch in enumerate(line[:col]):
-                if escaped:
-                    escaped = False
-                    continue
-                if ch == "\\":
-                    escaped = True
-                    continue
-                if not in_string and ch in ('"', "'", "`"):
-                    in_string = True
-                    string_char = ch
-                elif in_string and ch == string_char:
-                    in_string = False
-                    string_char = None
-            if in_string:
-                return True
-
-            comment_pos = line.find("#")
-            if comment_pos >= 0 and col > comment_pos:
-                return True
-
-        return False
-
-    def _is_false_positive(self, pii_type: str, value: str, context: str) -> bool:
-        context_lower = context.lower()
-
-        if pii_type == "email":
-            if any(fake in value.lower() for fake in ["example", "test", "dummy", "fake", "placeholder", "user@", "admin@", "noreply@", "no-reply@"]):
-                return True
-            if any(fake in context_lower for fake in ["example.com", "test.com", "localhost", "invalid", "placeholder"]):
-                return True
-
-        if pii_type == "phone":
-            if value.startswith(("555", "123", "000")):
-                return True
-
-        if pii_type == "ssn":
-            if value in ("123-45-6789", "000-00-0000", "999-99-9999"):
-                return True
-
-        if pii_type == "ipv4":
-            if value.startswith(("127.", "10.", "192.168.", "172.16.", "172.17.", "172.18.", "172.19.", "172.20.", "172.21.", "172.22.", "172.23.", "172.24.", "172.25.", "172.26.", "172.27.", "172.28.", "172.29.", "172.30.", "172.31.", "0.0.0.0", "255.255.255.255")):
-                return True
-
-        if pii_type == "uuid":
-            if value in ("00000000-0000-0000-0000-000000000000", "ffffffff-ffff-ffff-ffff-ffffffffffff"):
-                return True
-
-        return False
-
-    def _calculate_confidence(self, pii_type: str, value: str, context: str) -> float:
-        base_confidence = {
-            "email": 0.75,
-            "phone": 0.7,
-            "ssn": 0.9,
-            "credit_card": 0.85,
-            "ipv4": 0.65,
-            "uuid": 0.8,
-            "api_key": 0.85,
-            "jwt": 0.95,
-        }.get(pii_type, 0.7)
-
-        context_lower = context.lower()
-        if any(kw in context_lower for kw in ["config", "secret", "password", "token", "key", "credential", "auth"]):
-            base_confidence += 0.1
-        if any(kw in context_lower for kw in ["example", "test", "demo", "sample", "placeholder", "fake"]):
-            base_confidence -= 0.2
-
-        return max(0.5, min(1.0, base_confidence))
-
-    def _luhn_check(self, card_num: str) -> bool:
-        digits = [int(d) for d in card_num if d.isdigit()]
-        if len(digits) < 13:
-            return False
-        checksum = 0
-        for i, d in enumerate(reversed(digits)):
-            if i % 2 == 1:
-                d *= 2
-                if d > 9:
-                    d -= 9
-            checksum += d
-        return checksum % 10 == 0
-
-    def _mask_pii(self, value: str, pii_type: str) -> str:
-        if pii_type == "email":
-            parts = value.split("@")
-            if len(parts) == 2:
-                return parts[0][:2] + "***" + "@" + parts[1]
-        elif pii_type in ("credit_card", "ssn"):
-            return value[:4] + "*" * (len(value) - 8) + value[-4:] if len(value) > 8 else "*" * len(value)
-        elif pii_type == "phone":
-            return value[:3] + "***" + value[-2:] if len(value) > 5 else "*" * len(value)
-        elif pii_type == "api_key":
-            return value[:8] + "*" * (len(value) - 12) + value[-4:] if len(value) > 12 else "*" * len(value)
-        elif pii_type == "jwt":
-            parts = value.split(".")
-            if len(parts) == 3:
-                return parts[0][:10] + "..." + parts[2][-10:]
-        return value[:4] + "*" * max(0, len(value) - 8) + value[-4:] if len(value) > 8 else "*" * len(value)

package/src/orion/engine/dataflow/engine.py

@@ -1,398 +0,0 @@
-"""Variable data flow analyzer for detecting use-before-def, dead stores, mutable defaults, and global mutations."""
-import ast
-from typing import Dict, List, Set, Optional, Any, Tuple
-from dataclasses import dataclass, field
-from collections import defaultdict
-from orion.engine.config import EngineConfig, ResourceLimits
-from orion.engine.ir import OrionIR
-from orion.engine.results import EngineResult, Finding
-
-
-@dataclass
-class VarInfo:
-    name: str
-    defined_at: List[int] = field(default_factory=list)
-    used_at: List[int] = field(default_factory=list)
-    assigned_at: List[int] = field(default_factory=list)
-    is_parameter: bool = False
-    is_global: bool = False
-    is_nonlocal: bool = False
-    is_mutable_default: bool = False
-    default_node: Optional[ast.AST] = None
-    scope_level: int = 0
-
-
-class DataFlowVisitor(ast.NodeVisitor):
-    def __init__(self, filename: str, source_lines: List[str]):
-        self.filename = filename
-        self.source_lines = source_lines
-        self.findings: List[Finding] = []
-        self.variables: Dict[str, VarInfo] = {}
-        self.scope_stack: List[Dict[str, VarInfo]] = [{}]
-        self.current_function: Optional[str] = None
-        self.global_names: Set[str] = set()
-        self.nonlocal_names: Set[str] = set()
-        self.loop_stack: List[int] = []
-        self.assignment_targets: Dict[int, List[str]] = defaultdict(list)
-
-    def get_snippet(self, node: ast.AST, context: int = 2) -> str:
-        start = max(0, node.lineno - 1 - context)
-        end = min(len(self.source_lines),
-                  getattr(node, 'end_lineno', node.lineno) + context if hasattr(node, 'end_lineno') else node.lineno + context)
-        return "\n".join(self.source_lines[start:end])
-
-    def current_scope(self) -> Dict[str, VarInfo]:
-        return self.scope_stack[-1]
-
-    def define_var(self, name: str, node: ast.AST, is_parameter: bool = False):
-        scope = self.current_scope()
-        if name not in scope:
-            scope[name] = VarInfo(name=name, scope_level=len(self.scope_stack))
-        var = scope[name]
-        var.defined_at.append(node.lineno)
-        var.assigned_at.append(node.lineno)
-        if is_parameter:
-            var.is_parameter = True
-        if name in self.global_names:
-            var.is_global = True
-        if name in self.nonlocal_names:
-            var.is_nonlocal = True
-
-    def use_var(self, name: str, node: ast.AST):
-        scope = self.current_scope()
-        found = False
-        for s in reversed(self.scope_stack):
-            if name in s:
-                s[name].used_at.append(node.lineno)
-                found = True
-                break
-        if not found and name not in self.global_names:
-            pass
-
-    def visit_Module(self, node: ast.Module):
-        self.generic_visit(node)
-        self._check_dead_stores()
-        self._check_mutable_defaults()
-        self._check_global_mutations()
-
-    def visit_FunctionDef(self, node: ast.FunctionDef):
-        old_function = self.current_function
-        self.current_function = node.name
-        
-        self.global_names.clear()
-        self.nonlocal_names.clear()
-        
-        self.scope_stack.append({})
-        
-        for arg in node.args.args:
-            self.define_var(arg.arg, arg, is_parameter=True)
-        
-        if node.args.vararg:
-            self.define_var(node.args.vararg.arg, node.args.vararg, is_parameter=True)
-        if node.args.kwarg:
-            self.define_var(node.args.kwarg.arg, node.args.kwarg, is_parameter=True)
-        
-        for i, default in enumerate(node.args.defaults):
-            arg_index = len(node.args.args) - len(node.args.defaults) + i
-            if arg_index < len(node.args.args):
-                arg_name = node.args.args[arg_index].arg
-                if arg_name in self.current_scope():
-                    self.current_scope()[arg_name].is_mutable_default = self._is_mutable(default)
-                    self.current_scope()[arg_name].default_node = default
-        
-        self.generic_visit(node)
-        
-        self._check_function_scope(self.current_scope(), node.name)
-        self.scope_stack.pop()
-        self.current_function = old_function
-
-    def visit_AsyncFunctionDef(self, node: ast.AsyncFunctionDef):
-        self.visit_FunctionDef(node)
-
-    def visit_ClassDef(self, node: ast.ClassDef):
-        self.scope_stack.append({})
-        self.generic_visit(node)
-        self.scope_stack.pop()
-
-    def visit_Global(self, node: ast.Global):
-        for name in node.names:
-            self.global_names.add(name)
-            for scope in reversed(self.scope_stack):
-                if name in scope:
-                    scope[name].is_global = True
-                    break
-
-    def visit_Nonlocal(self, node: ast.Nonlocal):
-        for name in node.names:
-            self.nonlocal_names.add(name)
-            for scope in reversed(self.scope_stack[:-1]):
-                if name in scope:
-                    scope[name].is_nonlocal = True
-                    break
-
-    def visit_Assign(self, node: ast.Assign):
-        for target in node.targets:
-            names = self._get_assignment_names(target)
-            for name in names:
-                self.define_var(name, node)
-                self.assignment_targets[node.lineno].append(name)
-        self.generic_visit(node.value)
-
-    def visit_AnnAssign(self, node: ast.AnnAssign):
-        if node.target:
-            names = self._get_assignment_names(node.target)
-            for name in names:
-                self.define_var(name, node)
-                self.assignment_targets[node.lineno].append(name)
-        if node.value:
-            self.generic_visit(node.value)
-
-    def visit_AugAssign(self, node: ast.AugAssign):
-        names = self._get_assignment_names(node.target)
-        for name in names:
-            self.define_var(name, node)
-            self.use_var(name, node)
-            self.assignment_targets[node.lineno].append(name)
-        self.generic_visit(node.value)
-
-    def _get_assignment_names(self, target: ast.AST) -> List[str]:
-        names = []
-        if isinstance(target, ast.Name):
-            names.append(target.id)
-        elif isinstance(target, (ast.Tuple, ast.List)):
-            for elt in target.elts:
-                names.extend(self._get_assignment_names(elt))
-        elif isinstance(target, ast.Attribute):
-            pass
-        elif isinstance(target, ast.Subscript):
-            pass
-        return names
-
-    def visit_Name(self, node: ast.Name):
-        if isinstance(node.ctx, ast.Load):
-            self.use_var(node.id, node)
-        elif isinstance(node.ctx, ast.Store):
-            self.define_var(node.id, node)
-        elif isinstance(node.ctx, ast.Del):
-            pass
-        self.generic_visit(node)
-
-    def visit_For(self, node: ast.For):
-        self.loop_stack.append(node.lineno)
-        names = self._get_assignment_names(node.target)
-        for name in names:
-            self.define_var(name, node)
-        self.generic_visit(node.iter)
-        for stmt in node.body:
-            self.generic_visit(stmt)
-        for stmt in node.orelse:
-            self.generic_visit(stmt)
-        self.loop_stack.pop()
-
-    def visit_While(self, node: ast.While):
-        self.loop_stack.append(node.lineno)
-        self.generic_visit(node.test)
-        for stmt in node.body:
-            self.generic_visit(stmt)
-        for stmt in node.orelse:
-            self.generic_visit(stmt)
-        self.loop_stack.pop()
-
-    def visit_With(self, node: ast.With):
-        for item in node.items:
-            if item.optional_vars:
-                names = self._get_assignment_names(item.optional_vars)
-                for name in names:
-                    self.define_var(name, node)
-        for stmt in node.body:
-            self.generic_visit(stmt)
-
-    def visit_Try(self, node: ast.Try):
-        for handler in node.handlers:
-            if handler.name:
-                self.define_var(handler.name, handler)
-        for stmt in node.body:
-            self.generic_visit(stmt)
-        for handler in node.handlers:
-            for stmt in handler.body:
-                self.generic_visit(stmt)
-        for stmt in node.orelse:
-            self.generic_visit(stmt)
-        for stmt in node.finalbody:
-            self.generic_visit(stmt)
-
-    def visit_Comprehension(self, node: ast.comprehension):
-        names = self._get_assignment_names(node.target)
-        for name in names:
-            self.define_var(name, node)
-        self.generic_visit(node.iter)
-        for if_clause in node.ifs:
-            self.generic_visit(if_clause)
-
-    def visit_Lambda(self, node: ast.Lambda):
-        old_function = self.current_function
-        self.current_function = "<lambda>"
-        self.scope_stack.append({})
-        for arg in node.args.args:
-            self.define_var(arg.arg, arg, is_parameter=True)
-        self.generic_visit(node.body)
-        self._check_function_scope(self.current_scope(), "<lambda>")
-        self.scope_stack.pop()
-        self.current_function = old_function
-
-    def _is_mutable(self, node: ast.AST) -> bool:
-        if isinstance(node, (ast.List, ast.Dict, ast.Set)):
-            return True
-        if isinstance(node, ast.Call):
-            if isinstance(node.func, ast.Name):
-                return node.func.id in ("list", "dict", "set", "bytearray", "deque", "defaultdict")
-            if isinstance(node.func, ast.Attribute):
-                return node.func.attr in ("list", "dict", "set", "copy", "deepcopy")
-        return False
-
-    def _check_use_before_def(self, var: VarInfo, func_name: str):
-        for use_line in var.used_at:
-            has_def_before = any(def_line < use_line for def_line in var.defined_at)
-            if not has_def_before and not var.is_parameter:
-                self.findings.append(Finding(
-                    engine="dataflow",
-                    severity="medium",
-                    title="Use before definition",
-                    description=f"Variable '{var.name}' used before assignment in function '{func_name}'",
-                    location=f"{self.filename}:{use_line}",
-                    metadata={
-                        "snippet": self.get_snippet_by_line(use_line),
-                        "cwe": "CWE-457",
-                        "confidence": 0.85,
-                        "check": "use_before_def",
-                        "variable": var.name,
-                        "function": func_name,
-                    }
-                ))
-
-    def _check_function_scope(self, scope: Dict[str, VarInfo], func_name: str):
-        for var in scope.values():
-            self._check_use_before_def(var, func_name)
-            if var.is_mutable_default and var.default_node:
-                self.findings.append(Finding(
-                    engine="dataflow",
-                    severity="medium",
-                    title="Mutable default argument",
-                    description=f"Function '{func_name}' has mutable default argument '{var.name}' "
-                               f"which is shared across all calls",
-                    location=f"{self.filename}:{var.default_node.lineno}",
-                    metadata={
-                        "snippet": self.get_snippet(var.default_node),
-                        "cwe": "CWE-477",
-                        "confidence": 0.95,
-                        "check": "mutable_default",
-                        "variable": var.name,
-                        "function": func_name,
-                    }
-                ))
-
-    def _check_dead_stores(self):
-        for scope in self.scope_stack:
-            for var in scope.values():
-                # Only check local function variables, not module level or global exports
-                if var.scope_level > 1 and var.assigned_at and not var.used_at and not var.is_parameter:
-                    if var.name.startswith("_") or var.name in ("self", "cls"):
-                        continue
-                    for line in var.assigned_at:
-                        self.findings.append(Finding(
-                            engine="dataflow",
-                            severity="low",
-                            title="Dead store",
-                            description=f"Local variable '{var.name}' is assigned but never used",
-                            location=f"{self.filename}:{line}",
-                            metadata={
-                                "snippet": self.get_snippet_by_line(line),
-                                "cwe": "CWE-563",
-                                "confidence": 0.8,
-                                "check": "dead_store",
-                                "variable": var.name,
-                            }
-                        ))
-
-    def _check_mutable_defaults(self):
-        pass
-
-    def _check_global_mutations(self):
-        for scope in self.scope_stack:
-            for var in scope.values():
-                if var.is_global and var.assigned_at and self.current_function:
-                    if var.name not in ("__all__", "__version__", "__author__", "__name__"):
-                        for line in var.assigned_at:
-                            self.findings.append(Finding(
-                                engine="dataflow",
-                                severity="low",
-                                title="Global variable mutation",
-                                description=f"Global variable '{var.name}' is modified in function '{self.current_function}'",
-                                location=f"{self.filename}:{line}",
-                                metadata={
-                                    "snippet": self.get_snippet_by_line(line),
-                                    "cwe": "CWE-473",
-                                    "confidence": 0.75,
-                                    "check": "global_mutation",
-                                    "variable": var.name,
-                                    "function": self.current_function,
-                                }
-                            ))
-
-    def get_snippet_by_line(self, line: int, context: int = 2) -> str:
-        start = max(0, line - 1 - context)
-        end = min(len(self.source_lines), line + context)
-        return "\n".join(self.source_lines[start:end])
-
-
-class Engine:
-    name = "dataflow"
-    version = "1.0.0"
-
-    async def check_availability(self) -> bool:
-        return True
-
-    def resource_limits(self) -> ResourceLimits:
-        return ResourceLimits(max_cpu_seconds=60, max_memory_mb=512, max_files=50000)
-
-    async def run(self, ctx, config: EngineConfig) -> EngineResult:
-        # Handle both single IR and list of IRs
-        if not isinstance(ctx, list):
-            ctx = [ctx]
-        all_findings = []
-        errors = []
-        files_processed = 0
-
-        exclude_patterns = config.toggles.get("exclude", []) if config.toggles else []
-
-        for ir in ctx:
-            try:
-                if not ir.metadata.get("language") == "python":
-                    continue
-
-                rel_path = ir.metadata.get("path", "unknown.py")
-                if any(pattern in rel_path for pattern in exclude_patterns):
-                    continue
-
-                content = ir.content.decode("utf-8", errors="replace")
-                source_lines = content.splitlines()
-                tree = ast.parse(content, filename=rel_path)
-
-                visitor = DataFlowVisitor(rel_path, source_lines)
-                visitor.visit(tree)
-
-                all_findings.extend(visitor.findings)
-                files_processed += 1
-
-            except SyntaxError as e:
-                errors.append(f"Syntax error in {ir.metadata.get('path', 'unknown')}: {e}")
-            except Exception as e:
-                errors.append(f"Error processing {ir.metadata.get('path', 'unknown')}: {e}")
-
-        return EngineResult(
-            engine=self.name,
-            findings=all_findings,
-            errors=errors,
-            metrics={"files_processed": files_processed, "findings_count": len(all_findings)},
-            ok=len(errors) == 0
-        )