@orionscanner/cli 0.1.0 → 0.5.1

package/src/orion/engine/dead_import/engine.py

@@ -1,293 +0,0 @@
-"""Dead import detection engine - finds unused imports using AST analysis."""
-import ast
-from typing import Dict, List, Set, Optional, Any
-from dataclasses import dataclass, field
-from collections import defaultdict
-from orion.engine.config import EngineConfig, ResourceLimits
-from orion.engine.ir import OrionIR
-from orion.engine.results import EngineResult, Finding
-
-
-@dataclass
-class ImportInfo:
-    name: str
-    alias: Optional[str]
-    module: str
-    lineno: int
-    is_from_import: bool
-    is_future: bool = False
-    is_side_effect: bool = False
-    used: bool = False
-    used_as: Set[str] = field(default_factory=set)
-
-
-class ImportVisitor(ast.NodeVisitor):
-    def __init__(self, filename: str, source_lines: List[str]):
-        self.filename = filename
-        self.source_lines = source_lines
-        self.findings: List[Finding] = []
-        self.imports: List[ImportInfo] = []
-        self.used_names: Set[str] = set()
-        self.used_attributes: Dict[str, Set[str]] = defaultdict(set)
-        self.scope_stack: List[Set[str]] = [set()]
-        self.future_imports: Set[str] = set()
-        self.current_class: Optional[str] = None
-
-    def get_snippet(self, node: ast.AST, context: int = 2) -> str:
-        start = max(0, node.lineno - 1 - context)
-        end = min(len(self.source_lines),
-                  getattr(node, 'end_lineno', node.lineno) + context if hasattr(node, 'end_lineno') else node.lineno + context)
-        return "\n".join(self.source_lines[start:end])
-
-    def current_scope(self) -> Set[str]:
-        return self.scope_stack[-1]
-
-    def enter_scope(self):
-        self.scope_stack.append(set())
-
-    def exit_scope(self):
-        if len(self.scope_stack) > 1:
-            self.scope_stack.pop()
-
-    def mark_used(self, name: str):
-        self.used_names.add(name)
-        for scope in self.scope_stack:
-            scope.add(name)
-
-    def visit_Import(self, node: ast.Import):
-        for alias in node.names:
-            name = alias.asname or alias.name
-            module = alias.name
-            
-            is_future = module == "__future__"
-            is_side_effect = is_future or module in (
-                "typing", "typing_extensions", "types", "dataclasses",
-                "contextlib", "warnings", "logging", "sys", "os", "builtins"
-            )
-            
-            info = ImportInfo(
-                name=name,
-                alias=alias.asname,
-                module=module,
-                lineno=node.lineno,
-                is_from_import=False,
-                is_future=is_future,
-                is_side_effect=is_side_effect,
-            )
-            self.imports.append(info)
-            
-            if not is_future:
-                self.current_scope().add(name)
-        
-        self.generic_visit(node)
-
-    def visit_ImportFrom(self, node: ast.ImportFrom):
-        if node.module:
-            is_future = node.module == "__future__"
-            is_init_side_effect = node.module.endswith(".__init__") or (
-                node.level > 0 and not node.module
-            )
-            
-            for alias in node.names:
-                name = alias.asname or alias.name
-                full_module = f"{node.module}.{alias.name}" if node.module else alias.name
-                
-                is_side_effect = is_future or is_init_side_effect or (
-                    node.module in ("typing", "typing_extensions", "types", "dataclasses")
-                )
-                
-                info = ImportInfo(
-                    name=name,
-                    alias=alias.asname,
-                    module=full_module,
-                    lineno=node.lineno,
-                    is_from_import=True,
-                    is_future=is_future,
-                    is_side_effect=is_side_effect,
-                )
-                self.imports.append(info)
-                
-                if not is_future:
-                    self.current_scope().add(name)
-        
-        self.generic_visit(node)
-
-    def visit_Name(self, node: ast.Name):
-        if isinstance(node.ctx, ast.Load):
-            self.mark_used(node.id)
-        self.generic_visit(node)
-
-    def visit_Attribute(self, node: ast.Attribute):
-        if isinstance(node.ctx, ast.Load):
-            if isinstance(node.value, ast.Name):
-                base = node.value.id
-                self.used_attributes[base].add(node.attr)
-                self.mark_used(base)
-        self.generic_visit(node)
-
-    def visit_FunctionDef(self, node: ast.FunctionDef):
-        self.enter_scope()
-        for arg in node.args.args:
-            self.current_scope().add(arg.arg)
-        if node.args.vararg:
-            self.current_scope().add(node.args.vararg.arg)
-        if node.args.kwarg:
-            self.current_scope().add(node.args.kwarg.arg)
-        self.generic_visit(node)
-        self.exit_scope()
-
-    def visit_AsyncFunctionDef(self, node: ast.AsyncFunctionDef):
-        self.visit_FunctionDef(node)
-
-    def visit_ClassDef(self, node: ast.ClassDef):
-        old_class = self.current_class
-        self.current_class = node.name
-        self.enter_scope()
-        self.generic_visit(node)
-        self.exit_scope()
-        self.current_class = old_class
-
-    def visit_Lambda(self, node: ast.Lambda):
-        self.enter_scope()
-        for arg in node.args.args:
-            self.current_scope().add(arg.arg)
-        self.generic_visit(node)
-        self.exit_scope()
-
-    def visit_Comprehension(self, node: ast.comprehension):
-        if isinstance(node.target, ast.Name):
-            self.current_scope().add(node.target.id)
-        elif isinstance(node.target, (ast.Tuple, ast.List)):
-            for elt in node.target.elts:
-                if isinstance(elt, ast.Name):
-                    self.current_scope().add(elt.id)
-        self.generic_visit(node)
-
-    def visit_Global(self, node: ast.Global):
-        for name in node.names:
-            self.mark_used(name)
-
-    def visit_Nonlocal(self, node: ast.Nonlocal):
-        for name in node.names:
-            self.mark_used(name)
-
-    def visit_ExceptHandler(self, node: ast.ExceptHandler):
-        if node.name:
-            self.current_scope().add(node.name)
-        self.generic_visit(node)
-
-    def visit_With(self, node: ast.With):
-        for item in node.items:
-            if item.optional_vars:
-                if isinstance(item.optional_vars, ast.Name):
-                    self.current_scope().add(item.optional_vars.id)
-                elif isinstance(item.optional_vars, (ast.Tuple, ast.List)):
-                    for elt in item.optional_vars.elts:
-                        if isinstance(elt, ast.Name):
-                            self.current_scope().add(elt.id)
-        self.generic_visit(node)
-
-    def visit_Match(self, node: ast.Match):
-        self.enter_scope()
-        self.generic_visit(node)
-        self.exit_scope()
-
-    def visit_match_case(self, node: ast.match_case):
-        self.enter_scope()
-        self.generic_visit(node.pattern)
-        self.generic_visit(node.guard)
-        for stmt in node.body:
-            self.generic_visit(stmt)
-        self.exit_scope()
-
-
-class Engine:
-    name = "dead_import"
-    version = "1.0.0"
-
-    async def check_availability(self) -> bool:
-        return True
-
-    def resource_limits(self) -> ResourceLimits:
-        return ResourceLimits(max_cpu_seconds=60, max_memory_mb=512, max_files=50000)
-
-    async def run(self, ctx, config: EngineConfig) -> EngineResult:
-        # Handle both single IR and list of IRs
-        if not isinstance(ctx, list):
-            ctx = [ctx]
-        all_findings = []
-        errors = []
-        files_processed = 0
-
-        exclude_patterns = config.toggles.get("exclude", []) if config.toggles else []
-
-        for ir in ctx:
-            try:
-                if not ir.metadata.get("language") == "python":
-                    continue
-
-                rel_path = ir.metadata.get("path", "unknown.py")
-                if any(pattern in rel_path for pattern in exclude_patterns):
-                    continue
-
-                content = ir.content.decode("utf-8", errors="replace")
-                source_lines = content.splitlines()
-                tree = ast.parse(content, filename=rel_path)
-
-                visitor = ImportVisitor(rel_path, source_lines)
-                visitor.visit(tree)
-
-                for imp in visitor.imports:
-                    if imp.is_future or imp.is_side_effect:
-                        continue
-                    
-                    used_name = imp.alias or imp.name
-                    
-                    is_used = (
-                        used_name in visitor.used_names or
-                        used_name in visitor.used_attributes or
-                        any(used_name in scope for scope in visitor.scope_stack)
-                    )
-                    
-                    if not is_used:
-                        for attr in visitor.used_attributes.get(used_name, []):
-                            is_used = True
-                            break
-                    
-                    if not is_used:
-                        all_findings.append(Finding(
-                            engine="dead_import",
-                            severity="low",
-                            title="Unused import",
-                            description=f"Import '{imp.name}' from '{imp.module}' is never used",
-                            location=f"{rel_path}:{imp.lineno}",
-                            metadata={
-                                "snippet": visitor.get_snippet_by_line(imp.lineno),
-                                "cwe": "CWE-1041",
-                                "confidence": 0.9,
-                                "imported": imp.name,
-                                "module": imp.module,
-                                "alias": imp.alias,
-                                "is_from_import": imp.is_from_import,
-                            }
-                        ))
-
-                files_processed += 1
-
-            except SyntaxError as e:
-                errors.append(f"Syntax error in {ir.metadata.get('path', 'unknown')}: {e}")
-            except Exception as e:
-                errors.append(f"Error processing {ir.metadata.get('path', 'unknown')}: {e}")
-
-        return EngineResult(
-            engine=self.name,
-            findings=all_findings,
-            errors=errors,
-            metrics={"files_processed": files_processed, "findings_count": len(all_findings)},
-            ok=len(errors) == 0
-        )
-
-    def get_snippet_by_line(self, lines: List[str], line: int, context: int = 2) -> str:
-        start = max(0, line - 1 - context)
-        end = min(len(lines), line + context)
-        return "\n".join(lines[start:end])

package/src/orion/engine/deps/engine.py

@@ -1,244 +0,0 @@
-"""Dependency vulnerability scanner engine."""
-import re
-import json
-import tomllib
-from pathlib import Path
-from orion.engine.config import EngineConfig
-from orion.engine.ir import OrionIR
-from orion.engine.results import EngineResult, Finding
-
-
-class Engine:
-    name = "deps"
-    version = "1.0.0"
-
-    VULN_DB = {
-        "requests": [("2.28.0", "CVE-2022-32891", "2.25.1")],
-        "urllib3": [("1.26.5", "CVE-2021-33503", "1.26.4")],
-        "django": [("4.1.7", "CVE-2022-34265", "4.1.6")],
-        "flask": [("2.2.2", "CVE-2022-29242", "2.2.1")],
-        "spring-boot": [("2.7.8", "CVE-2022-22965", "2.7.7")],
-        "log4j": [("2.17.1", "CVE-2021-44228", "2.17.0")],
-        "jackson-databind": [("2.13.2", "CVE-2020-36518", "2.13.1")],
-    }
-
-    GPL_LICENSES = {"GPL-2.0", "GPL-3.0", "AGPL-3.0", "LGPL-2.1", "LGPL-3.0"}
-
-    async def check_availability(self) -> bool:
-        return True
-
-    def resource_limits(self):
-        from orion.engine.config import ResourceLimits
-        return ResourceLimits(max_cpu_seconds=60, max_memory_mb=256)
-
-    async def run(self, ir: OrionIR, config: EngineConfig) -> EngineResult:
-        try:
-            text = ir.content.decode("utf-8", errors="replace")
-        except Exception:
-            text = str(ir.content)
-
-        path = ir.metadata.get("path", "unknown")
-        filename = Path(path).name.lower()
-        findings = []
-        deps = {}
-
-        if filename in ("requirements.txt",) or filename.startswith("requirements-") and filename.endswith(".txt"):
-            deps = self._parse_requirements(text)
-        elif filename == "pyproject.toml":
-            deps = self._parse_pyproject_toml(text)
-        elif filename == "package.json":
-            deps = self._parse_package_json(text)
-        elif filename == "pipfile":
-            deps = self._parse_pipfile(text)
-        elif filename in ("poetry.lock", "pnpm-lock.yaml", "yarn.lock"):
-            deps = self._parse_lock_file(text, filename)
-
-        if not deps:
-            return EngineResult(engine=self.name, findings=findings, ok=True)
-
-        for name, version in deps.items():
-            findings.extend(self._check_vulnerabilities(name, version, path))
-            findings.extend(self._check_license_conflicts(name, version, path))
-            findings.extend(self._check_outdated(name, version, path))
-
-        if filename in ("requirements.txt", "package.json", "pipfile", "pyproject.toml"):
-            if not self._has_lock_file(path):
-                findings.append(Finding(
-                    engine=self.name,
-                    severity="info",
-                    title="Missing lock file",
-                    description="No lock file found for dependency pinning",
-                    location=path,
-                    metadata={"confidence": 0.9, "file": filename, "cwe": "CWE-1104"},
-                ))
-
-        return EngineResult(engine=self.name, findings=findings, ok=True)
-
-    def _parse_requirements(self, text: str) -> dict:
-        deps = {}
-        for line in text.splitlines():
-            line = line.strip()
-            if not line or line.startswith("#") or line.startswith("-"):
-                continue
-            match = re.match(r"^([A-Za-z0-9_\-\.]+)(?:[=<>!~]+([A-Za-z0-9_\-\.]+))?", line)
-            if match:
-                name = match.group(1).lower()
-                version = match.group(2) or "unknown"
-                deps[name] = version
-        return deps
-
-    def _parse_pyproject_toml(self, text: str) -> dict:
-        deps = {}
-        try:
-            data = tomllib.loads(text)
-            for section in ("project", "tool.poetry"):
-                if section in data:
-                    dep_section = data[section].get("dependencies", {})
-                    for name, spec in dep_section.items():
-                        if name.lower() != "python":
-                            version = spec if isinstance(spec, str) else spec.get("version", "unknown")
-                            deps[name.lower()] = version
-        except Exception:
-            pass
-        return deps
-
-    def _parse_package_json(self, text: str) -> dict:
-        deps = {}
-        try:
-            data = json.loads(text)
-            for section in ("dependencies", "devDependencies"):
-                for name, version in data.get(section, {}).items():
-                    deps[name.lower()] = version.lstrip("^~>=")
-        except Exception:
-            pass
-        return deps
-
-    def _parse_pipfile(self, text: str) -> dict:
-        deps = {}
-        current_section = None
-        for line in text.splitlines():
-            line = line.strip()
-            if line.startswith("[") and line.endswith("]"):
-                current_section = line[1:-1].lower()
-                continue
-            if current_section in ("packages", "dev-packages") and "=" in line:
-                parts = line.split("=", 1)
-                name = parts[0].strip().lower()
-                version = parts[1].strip().strip('"\'')
-                deps[name] = version
-        return deps
-
-    def _parse_lock_file(self, text: str, filename: str) -> dict:
-        deps = {}
-        try:
-            if filename == "poetry.lock":
-                data = tomllib.loads(text)
-                for pkg in data.get("package", []):
-                    deps[pkg["name"].lower()] = pkg["version"]
-            elif filename == "pnpm-lock.yaml":
-                for line in text.splitlines():
-                    match = re.match(r"^\s+([^:]+):\s+\"([^\"]+)\"", line)
-                    if match and not match.group(1).startswith(" "):
-                        deps[match.group(1).lower()] = match.group(2)
-            elif filename == "yarn.lock":
-                for line in text.splitlines():
-                    match = re.match(r'^"([^@]+)@[^"]+":', line)
-                    if match:
-                        name = match.group(1).lower()
-                        version_match = re.search(r'version\s+"([^"]+)"', line)
-                        if version_match:
-                            deps[name] = version_match.group(1)
-        except Exception:
-            pass
-        return deps
-
-    def _check_vulnerabilities(self, name: str, version: str, path: str):
-        findings = []
-        name_lower = name.lower()
-        if name_lower in self.VULN_DB and version != "unknown":
-            for fixed_version, cve, affected_version in self.VULN_DB[name_lower]:
-                if self._version_less_than(version, fixed_version):
-                    findings.append(Finding(
-                        engine=self.name,
-                        severity="high",
-                        title=f"Vulnerable dependency: {name}",
-                        description=f"{name} {version} is vulnerable to {cve}",
-                        location=path,
-                        metadata={
-                            "confidence": 0.9,
-                            "package": name,
-                            "version": version,
-                            "vuln": cve,
-                            "fixed_in": fixed_version,
-                            "cwe": "CWE-1104",
-                            "cvss": 7.5,
-                        },
-                    ))
-        return findings
-
-    def _check_license_conflicts(self, name: str, version: str, path: str):
-        findings = []
-        if name_lower in {"python-gnupg", "pygpl", "gpl-package"}:
-            findings.append(Finding(
-                engine=self.name,
-                severity="medium",
-                title=f"GPL/AGPL dependency detected: {name}",
-                description=f"Dependency {name} uses GPL/AGPL license which may conflict with project license",
-                location=path,
-                metadata={
-                    "confidence": 0.75,
-                    "package": name,
-                    "license": "GPL-3.0",
-                    "cwe": "CWE-1104",
-                },
-            ))
-        return findings
-
-    def _check_outdated(self, name: str, version: str, path: str):
-        findings = []
-        major_match = re.match(r"^(\d+)\.", version)
-        if major_match:
-            major = int(major_match.group(1))
-            if major >= 2:
-                findings.append(Finding(
-                    engine=self.name,
-                    severity="low",
-                    title=f"Potentially outdated dependency: {name}",
-                    description=f"{name} {version} may be outdated (major version >= 2, consider checking for updates)",
-                    location=path,
-                    metadata={
-                        "confidence": 0.6,
-                        "package": name,
-                        "version": version,
-                        "note": "Offline heuristic - verify manually",
-                    },
-                ))
-        return findings
-
-    def _has_lock_file(self, path: str) -> bool:
-        p = Path(path)
-        parent = p.parent
-        lock_files = ["package-lock.json", "yarn.lock", "pnpm-lock.yaml", "poetry.lock", "Pipfile.lock"]
-        return any((parent / lf).exists() for lf in lock_files)
-
-    def _version_less_than(self, v1: str, v2: str) -> bool:
-        try:
-            parts1 = [int(x) for x in re.split(r"[.\-]", v1) if x.isdigit()]
-            parts2 = [int(x) for x in re.split(r"[.\-]", v2) if x.isdigit()]
-            for i in range(max(len(parts1), len(parts2))):
-                p1 = parts1[i] if i < len(parts1) else 0
-                p2 = parts2[i] if i < len(parts2) else 0
-                if p1 < p2:
-                    return True
-                elif p1 > p2:
-                    return False
-            return False
-        except Exception:
-            return False
-
-
-_name_lower = None  # placeholder to avoid unused warning in _check_vulnerabilities
-
-
-def _version_key(v):
-    return tuple(int(x) for x in re.split(r"[.\-]", v) if x.isdigit())