@orionscanner/cli 0.1.0 → 0.5.1

package/src/orion/engine/languages.py

@@ -1,454 +0,0 @@
-"""Universal language support for Orion Engine."""
-
-from enum import Enum
-from dataclasses import dataclass
-from typing import Dict, List, Set, Optional
-import os
-
-
-class Language(Enum):
-    """Supported programming languages."""
-    PYTHON = "python"
-    JAVASCRIPT = "javascript"
-    TYPESCRIPT = "typescript"
-    JAVA = "java"
-    GO = "go"
-    RUST = "rust"
-    CPP = "cpp"
-    C = "c"
-    CSHARP = "csharp"
-    PHP = "php"
-    RUBY = "ruby"
-    SWIFT = "swift"
-    KOTLIN = "kotlin"
-    SCALA = "scala"
-    HTML = "html"
-    CSS = "css"
-    SQL = "sql"
-    YAML = "yaml"
-    JSON = "json"
-    TOML = "toml"
-    XML = "xml"
-    DOCKERFILE = "dockerfile"
-    MARKDOWN = "markdown"
-    SHELL = "shell"
-    POWERSHELL = "powershell"
-    UNKNOWN = "unknown"
-
-
-# File extension to language mapping
-EXTENSION_MAP: Dict[str, Language] = {
-    # Python
-    ".py": Language.PYTHON,
-    ".pyw": Language.PYTHON,
-    ".pyi": Language.PYTHON,
-    
-    # JavaScript/TypeScript
-    ".js": Language.JAVASCRIPT,
-    ".jsx": Language.JAVASCRIPT,
-    ".mjs": Language.JAVASCRIPT,
-    ".cjs": Language.JAVASCRIPT,
-    ".ts": Language.TYPESCRIPT,
-    ".tsx": Language.TYPESCRIPT,
-    ".mts": Language.TYPESCRIPT,
-    ".cts": Language.TYPESCRIPT,
-    
-    # Java
-    ".java": Language.JAVA,
-    
-    # Go
-    ".go": Language.GO,
-    
-    # Rust
-    ".rs": Language.RUST,
-    
-    # C/C++
-    ".c": Language.C,
-    ".h": Language.C,
-    ".cpp": Language.CPP,
-    ".cc": Language.CPP,
-    ".cxx": Language.CPP,
-    ".hpp": Language.CPP,
-    ".hxx": Language.CPP,
-    
-    # C#
-    ".cs": Language.CSHARP,
-    
-    # PHP
-    ".php": Language.PHP,
-    ".phtml": Language.PHP,
-    
-    # Ruby
-    ".rb": Language.RUBY,
-    ".erb": Language.RUBY,
-    
-    # Swift
-    ".swift": Language.SWIFT,
-    
-    # Kotlin
-    ".kt": Language.KOTLIN,
-    ".kts": Language.KOTLIN,
-    
-    # Scala
-    ".scala": Language.SCALA,
-    
-    # Web
-    ".html": Language.HTML,
-    ".htm": Language.HTML,
-    ".xhtml": Language.HTML,
-    ".css": Language.CSS,
-    ".scss": Language.CSS,
-    ".sass": Language.CSS,
-    ".less": Language.CSS,
-    
-    # SQL
-    ".sql": Language.SQL,
-    
-    # Config
-    ".yaml": Language.YAML,
-    ".yml": Language.YAML,
-    ".json": Language.JSON,
-    ".toml": Language.TOML,
-    ".xml": Language.XML,
-    ".ini": Language.YAML,
-    ".cfg": Language.YAML,
-    ".conf": Language.YAML,
-    ".properties": Language.YAML,
-    
-    # Docker/Container
-    "Dockerfile": Language.DOCKERFILE,
-    "dockerfile": Language.DOCKERFILE,
-    ".dockerfile": Language.DOCKERFILE,
-    "docker-compose.yml": Language.DOCKERFILE,
-    "docker-compose.yaml": Language.DOCKERFILE,
-    
-    # Shell
-    ".sh": Language.SHELL,
-    ".bash": Language.SHELL,
-    ".zsh": Language.SHELL,
-    ".fish": Language.SHELL,
-    
-    # PowerShell
-    ".ps1": Language.POWERSHELL,
-    ".psm1": Language.POWERSHELL,
-    ".psd1": Language.POWERSHELL,
-    
-    # Documentation
-    ".md": Language.MARKDOWN,
-    ".markdown": Language.MARKDOWN,
-    ".rst": Language.MARKDOWN,
-    
-    # Config files without extensions
-    "Makefile": Language.SHELL,
-    "makefile": Language.SHELL,
-    "CMakeLists.txt": Language.SHELL,
-    ".gitignore": Language.YAML,
-    ".gitattributes": Language.YAML,
-    ".editorconfig": Language.YAML,
-    ".env": Language.YAML,
-    ".env.example": Language.YAML,
-    ".env.local": Language.YAML,
-    "package.json": Language.JSON,
-    "package-lock.json": Language.JSON,
-    "yarn.lock": Language.YAML,
-    "pnpm-lock.yaml": Language.YAML,
-    "requirements.txt": Language.YAML,
-    "requirements-dev.txt": Language.YAML,
-    "Pipfile": Language.TOML,
-    "Pipfile.lock": Language.JSON,
-    "pyproject.toml": Language.TOML,
-    "poetry.lock": Language.JSON,
-    "Cargo.toml": Language.TOML,
-    "Cargo.lock": Language.JSON,
-    "go.mod": Language.YAML,
-    "go.sum": Language.YAML,
-    "pom.xml": Language.XML,
-    "build.gradle": Language.SHELL,
-    "build.gradle.kts": Language.SHELL,
-    "settings.gradle": Language.SHELL,
-    "composer.json": Language.JSON,
-    "composer.lock": Language.JSON,
-    "Gemfile": Language.YAML,
-    "Gemfile.lock": Language.YAML,
-    "mix.exs": Language.SHELL,
-    "mix.lock": Language.YAML,
-    "pubspec.yaml": Language.YAML,
-    "pubspec.lock": Language.YAML,
-}
-
-
-# Filename patterns for special files
-FILENAME_PATTERNS: Dict[str, Language] = {
-    "Dockerfile": Language.DOCKERFILE,
-    "dockerfile": Language.DOCKERFILE,
-    "docker-compose.yml": Language.DOCKERFILE,
-    "docker-compose.yaml": Language.DOCKERFILE,
-    "docker-compose.override.yml": Language.DOCKERFILE,
-    "docker-compose.override.yaml": Language.DOCKERFILE,
-    "Makefile": Language.SHELL,
-    "makefile": Language.SHELL,
-    "CMakeLists.txt": Language.SHELL,
-    "CMakeLists.txt": Language.SHELL,
-}
-
-
-def detect_language(filepath: str) -> Language:
-    """Detect language from file path."""
-    filename = os.path.basename(filepath)
-    
-    # Check exact filename matches first
-    if filename in FILENAME_PATTERNS:
-        return FILENAME_PATTERNS[filename]
-    
-    # Check extension
-    _, ext = os.path.splitext(filename)
-    ext = ext.lower()
-    if ext in EXTENSION_MAP:
-        return EXTENSION_MAP[ext]
-    
-    # Check for double extensions (e.g., .dockerfile, .min.js)
-    if '.' in filename:
-        parts = filename.split('.')
-        if len(parts) > 2:
-            double_ext = '.' + '.'.join(parts[-2:]).lower()
-            if double_ext in EXTENSION_MAP:
-                return EXTENSION_MAP[double_ext]
-    
-    return Language.UNKNOWN
-
-
-def is_binary_file(filepath: str) -> bool:
-    """Quick check if file is likely binary."""
-    try:
-        with open(filepath, 'rb') as f:
-            chunk = f.read(8192)
-            return b'\x00' in chunk
-    except Exception:
-        return True
-
-
-# Language groups for engine targeting
-LANGUAGE_GROUPS: Dict[str, Set[Language]] = {
-    "pythonic": {Language.PYTHON},
-    "javascript": {Language.JAVASCRIPT, Language.TYPESCRIPT},
-    "jvm": {Language.JAVA, Language.KOTLIN, Language.SCALA},
-    "native": {Language.C, Language.CPP, Language.RUST, Language.GO, Language.CSHARP},
-    "web": {Language.HTML, Language.CSS, Language.JAVASCRIPT, Language.TYPESCRIPT},
-    "scripting": {Language.PYTHON, Language.JAVASCRIPT, Language.TYPESCRIPT, Language.PHP, Language.RUBY, Language.SHELL, Language.POWERSHELL},
-    "compiled": {Language.C, Language.CPP, Language.RUST, Language.GO, Language.JAVA, Language.CSHARP, Language.SWIFT, Language.KOTLIN, Language.SCALA},
-    "interpreted": {Language.PYTHON, Language.JAVASCRIPT, Language.TYPESCRIPT, Language.PHP, Language.RUBY, Language.SHELL},
-    "config": {Language.YAML, Language.JSON, Language.TOML, Language.XML},
-    "container": {Language.DOCKERFILE},
-    "data": {Language.SQL, Language.JSON, Language.YAML, Language.XML},
-    "web_static": {Language.HTML, Language.CSS},
-    "documentation": {Language.MARKDOWN},
-}
-
-
-def get_language_group(language: Language) -> List[str]:
-    """Get groups a language belongs to."""
-    groups = []
-    for group_name, langs in LANGUAGE_GROUPS.items():
-        if language in langs:
-            groups.append(group_name)
-    return groups
-
-
-@dataclass
-class LanguageCapabilities:
-    """What analysis capabilities are available for a language."""
-    language: Language
-    has_ast_parser: bool = False
-    has_tree_sitter: bool = False
-    sast_patterns: int = 0
-    secret_patterns: int = 0
-    dep_parsers: List[str] = None
-    taint_sources: List[str] = None
-    taint_sinks: List[str] = None
-    
-    def __post_init__(self):
-        if self.dep_parsers is None:
-            self.dep_parsers = []
-        if self.taint_sources is None:
-            self.taint_sources = []
-        if self.taint_sinks is None:
-            self.taint_sinks = []
-
-
-# Language capability registry
-LANGUAGE_CAPABILITIES: Dict[Language, LanguageCapabilities] = {
-    Language.PYTHON: LanguageCapabilities(
-        language=Language.PYTHON,
-        has_ast_parser=True,
-        has_tree_sitter=True,
-        sast_patterns=28,
-        secret_patterns=12,
-        dep_parsers=["requirements.txt", "pyproject.toml", "Pipfile", "poetry.lock", "setup.py"],
-        taint_sources=["request.", "input(", "sys.argv", "os.environ", "request.GET", "request.POST"],
-        taint_sinks=["execute", "eval", "exec", "system", "popen", "subprocess", "render_template_string"],
-    ),
-    Language.JAVASCRIPT: LanguageCapabilities(
-        language=Language.JAVASCRIPT,
-        has_ast_parser=True,
-        has_tree_sitter=True,
-        sast_patterns=6,
-        secret_patterns=8,
-        dep_parsers=["package.json", "package-lock.json", "yarn.lock", "pnpm-lock.yaml"],
-        taint_sources=["req.body", "req.query", "req.params", "req.headers", "process.env"],
-        taint_sinks=["eval", "exec", "Function", "innerHTML", "outerHTML", "document.write"],
-    ),
-    Language.TYPESCRIPT: LanguageCapabilities(
-        language=Language.TYPESCRIPT,
-        has_ast_parser=True,
-        has_tree_sitter=True,
-        sast_patterns=6,
-        secret_patterns=8,
-        dep_parsers=["package.json", "package-lock.json", "yarn.lock", "pnpm-lock.yaml"],
-        taint_sources=["req.body", "req.query", "req.params", "req.headers", "process.env"],
-        taint_sinks=["eval", "exec", "Function", "innerHTML", "outerHTML", "document.write"],
-    ),
-    Language.JAVA: LanguageCapabilities(
-        language=Language.JAVA,
-        has_ast_parser=True,
-        has_tree_sitter=True,
-        sast_patterns=0,
-        secret_patterns=8,
-        dep_parsers=["pom.xml", "build.gradle", "build.gradle.kts"],
-        taint_sources=["request.getParameter", "request.getHeader", "System.getenv"],
-        taint_sinks=["executeQuery", "executeUpdate", "Runtime.exec", "ProcessBuilder"],
-    ),
-    Language.GO: LanguageCapabilities(
-        language=Language.GO,
-        has_ast_parser=True,
-        has_tree_sitter=True,
-        sast_patterns=0,
-        secret_patterns=8,
-        dep_parsers=["go.mod", "go.sum"],
-        taint_sources=["r.FormValue", "r.URL.Query", "os.Getenv"],
-        taint_sinks=["Exec", "Query", "ExecContext", "os/exec.Command"],
-    ),
-    Language.RUST: LanguageCapabilities(
-        language=Language.RUST,
-        has_ast_parser=True,
-        has_tree_sitter=True,
-        sast_patterns=0,
-        secret_patterns=8,
-        dep_parsers=["Cargo.toml", "Cargo.lock"],
-        taint_sources=["std::env::var", "req.body", "req.query"],
-        taint_sinks=["std::process::Command", "sqlx::query", "diesel::RunQueryDsl"],
-    ),
-    Language.CSHARP: LanguageCapabilities(
-        language=Language.CSHARP,
-        has_ast_parser=True,
-        has_tree_sitter=True,
-        sast_patterns=0,
-        secret_patterns=8,
-        dep_parsers=["*.csproj", "packages.config", "paket.dependencies"],
-        taint_sources=["Request.QueryString", "Request.Form", "Environment.GetEnvironmentVariable"],
-        taint_sinks=["SqlCommand.ExecuteReader", "Process.Start", "SqlCommand.ExecuteNonQuery"],
-    ),
-    Language.PHP: LanguageCapabilities(
-        language=Language.PHP,
-        has_ast_parser=True,
-        has_tree_sitter=True,
-        sast_patterns=0,
-        secret_patterns=8,
-        dep_parsers=["composer.json", "composer.lock"],
-        taint_sources=["$_GET", "$_POST", "$_REQUEST", "$_COOKIE", "$_SERVER", "$_ENV"],
-        taint_sinks=["exec", "system", "shell_exec", "passthru", "proc_open", "eval", "mysqli_query"],
-    ),
-    Language.RUBY: LanguageCapabilities(
-        language=Language.RUBY,
-        has_ast_parser=True,
-        has_tree_sitter=True,
-        sast_patterns=0,
-        secret_patterns=8,
-        dep_parsers=["Gemfile", "Gemfile.lock"],
-        taint_sources=["params", "request.env", "ENV"],
-        taint_sinks=["system", "exec", "`", "eval", "ActiveRecord::Base.connection.execute"],
-    ),
-    Language.HTML: LanguageCapabilities(
-        language=Language.HTML,
-        has_ast_parser=False,
-        has_tree_sitter=True,
-        sast_patterns=0,
-        secret_patterns=4,
-        dep_parsers=[],
-        taint_sources=[],
-        taint_sinks=["innerHTML", "outerHTML", "document.write", "eval"],
-    ),
-    Language.CSS: LanguageCapabilities(
-        language=Language.CSS,
-        has_ast_parser=False,
-        has_tree_sitter=True,
-        sast_patterns=0,
-        secret_patterns=0,
-        dep_parsers=[],
-        taint_sources=[],
-        taint_sinks=[],
-    ),
-    Language.YAML: LanguageCapabilities(
-        language=Language.YAML,
-        has_ast_parser=False,
-        has_tree_sitter=False,
-        sast_patterns=0,
-        secret_patterns=8,
-        dep_parsers=[],
-        taint_sources=[],
-        taint_sinks=[],
-    ),
-    Language.JSON: LanguageCapabilities(
-        language=Language.JSON,
-        has_ast_parser=False,
-        has_tree_sitter=False,
-        sast_patterns=0,
-        secret_patterns=4,
-        dep_parsers=["package.json", "composer.json", "composer.lock", "poetry.lock"],
-        taint_sources=[],
-        taint_sinks=[],
-    ),
-    Language.TOML: LanguageCapabilities(
-        language=Language.TOML,
-        has_ast_parser=False,
-        has_tree_sitter=False,
-        sast_patterns=0,
-        secret_patterns=4,
-        dep_parsers=["pyproject.toml", "Cargo.toml"],
-        taint_sources=[],
-        taint_sinks=[],
-    ),
-    Language.DOCKERFILE: LanguageCapabilities(
-        language=Language.DOCKERFILE,
-        has_ast_parser=False,
-        has_tree_sitter=False,
-        sast_patterns=0,
-        secret_patterns=8,
-        dep_parsers=["Dockerfile", "docker-compose.yml"],
-        taint_sources=[],
-        taint_sinks=["ADD http", "ADD https", "RUN curl", "RUN wget"],
-    ),
-}
-
-
-def get_capabilities(language: Language) -> LanguageCapabilities:
-    """Get capabilities for a language."""
-    return LANGUAGE_CAPABILITIES.get(language, LanguageCapabilities(language=language))
-
-
-def get_supported_languages() -> List[Language]:
-    """Get all supported languages."""
-    return list(Language)[:-1]  # Exclude UNKNOWN
-
-
-__all__ = [
-    "Language",
-    "detect_language",
-    "is_binary_file",
-    "LanguageCapabilities",
-    "get_capabilities",
-    "get_supported_languages",
-    "LANGUAGE_GROUPS",
-    "get_language_group",
-    "EXTENSION_MAP",
-    "FILENAME_PATTERNS",
-]

package/src/orion/engine/license/engine.py

@@ -1,172 +0,0 @@
-"""License header + GPL contamination detection engine."""
-import re
-import os
-from pathlib import Path
-from orion.engine.config import EngineConfig
-from orion.engine.ir import OrionIR
-from orion.engine.results import EngineResult, Finding
-
-
-class Engine:
-    name = "license"
-    version = "1.0.0"
-
-    SPDX_PATTERN = re.compile(r"SPDX-License-Identifier:\s*([A-Za-z0-9\.\-\+]+)")
-    LICENSE_HEADER_PATTERNS = [
-        re.compile(r"Copyright\s+\(c\)\s+\d{4}"),
-        re.compile(r"Licensed under the\s+([A-Za-z0-9\.\-\+]+)"),
-        re.compile(r"License:\s*([A-Za-z0-9\.\-\+]+)"),
-    ]
-
-    GPL_LICENSES = {
-        "GPL-2.0", "GPL-3.0", "AGPL-3.0", "LGPL-2.1", "LGPL-3.0",
-        "GPL-2.0-only", "GPL-2.0-or-later", "GPL-3.0-only", "GPL-3.0-or-later",
-        "AGPL-3.0-only", "AGPL-3.0-or-later", "LGPL-2.1-only", "LGPL-2.1-or-later",
-        "LGPL-3.0-only", "LGPL-3.0-or-later",
-    }
-
-    PERMISSIVE_LICENSES = {
-        "MIT", "Apache-2.0", "BSD-2-Clause", "BSD-3-Clause", "ISC", "MPL-2.0",
-        "Unlicense", "0BSD", "Zlib", "Python-2.0",
-    }
-
-    TEST_PATHS = {"test", "tests", "testing", "spec", "specs", "__pycache__", "vendor", "third_party", "generated"}
-    GENERATED_MARKERS = ["generated", "auto-generated", "do not edit", "codegen"]
-
-    async def check_availability(self) -> bool:
-        return True
-
-    def resource_limits(self):
-        from orion.engine.config import ResourceLimits
-        return ResourceLimits(max_cpu_seconds=30, max_memory_mb=128)
-
-    async def run(self, ir: OrionIR, config: EngineConfig) -> EngineResult:
-        try:
-            text = ir.content.decode("utf-8", errors="replace")
-        except Exception:
-            text = str(ir.content)
-
-        path = ir.metadata.get("path", "unknown")
-        findings = []
-
-        if self._is_test_or_generated(path, text):
-            return EngineResult(engine=self.name, findings=findings, ok=True)
-
-        has_spdx, spdx_license = self._check_spdx_header(text)
-        has_license_hdr, hdr_license = self._check_license_header(text)
-        detected_license = spdx_license or hdr_license
-
-        # Focus on GPL/Copyleft contamination in proprietary projects
-        if detected_license and self._is_gpl_contaminated(detected_license):
-            findings.append(Finding(
-                engine=self.name,
-                severity="high",
-                title=f"GPL/Copyleft Contamination Risk: {detected_license}",
-                description=f"Strong copyleft license '{detected_license}' detected, which may impose open-source distribution requirements",
-                location=path,
-                metadata={
-                    "license": detected_license,
-                    "risk": "gpl_copyleft",
-                    "cwe": "CWE-1104",
-                    "confidence": 0.95,
-                },
-            ))
-
-        return EngineResult(engine=self.name, findings=findings, ok=True)
-
-    def _is_test_or_generated(self, path: str, text: str) -> bool:
-        path_lower = path.lower()
-        for test_dir in self.TEST_PATHS:
-            if f"/{test_dir}/" in path_lower or path_lower.startswith(f"{test_dir}/"):
-                return True
-        for marker in self.GENERATED_MARKERS:
-            if marker.lower() in text[:500].lower():
-                return True
-        return False
-
-    def _check_spdx_header(self, text: str):
-        lines = text.splitlines()[:30]
-        header_text = "\n".join(lines)
-        match = self.SPDX_PATTERN.search(header_text)
-        if match:
-            return True, match.group(1).strip()
-        for pattern in self.LICENSE_HEADER_PATTERNS:
-            match = pattern.search(header_text)
-            if match:
-                return True, match.group(1).strip() if match.groups() else "Unknown"
-        return False, None
-
-    def _check_root_license_files(self, path: str):
-        findings = []
-        p = Path(path)
-        project_root = None
-        for parent in p.parents:
-            if (parent / ".git").exists() or (parent / "pyproject.toml").exists() or (parent / "package.json").exists():
-                project_root = parent
-                break
-
-        if project_root:
-            license_files = list(project_root.glob("LICENSE*")) + list(project_root.glob("COPYING*"))
-            if not license_files:
-                findings.append(Finding(
-                    engine=self.name,
-                    severity="low",
-                    title="Missing license file at project root",
-                    description="No LICENSE or COPYING file found in project root",
-                    location=str(project_root),
-                    metadata={
-                        "confidence": 0.8,
-                        "missing_license_file": True,
-                        "project_root": str(project_root),
-                    },
-                ))
-            else:
-                for lf in license_files:
-                    try:
-                        content = lf.read_text(encoding="utf-8", errors="replace")
-                        for gpl in self.GPL_LICENSES:
-                            if gpl in content:
-                                findings.append(Finding(
-                                    engine=self.name,
-                                    severity="high",
-                                    title=f"GPL/AGPL license file detected: {gpl}",
-                                    description=f"Project root license file contains {gpl}",
-                                    location=str(lf),
-                                    metadata={
-                                        "confidence": 0.95,
-                                        "license": gpl,
-                                        "file": str(lf),
-                                        "cwe": "CWE-1104",
-                                    },
-                                ))
-                    except Exception:
-                        pass
-        return findings
-
-    def _check_dep_gpl_conflicts(self, ir: OrionIR, file_license: str):
-        findings = []
-        if file_license not in self.PERMISSIVE_LICENSES:
-            return findings
-
-        metrics = ir.metadata.get("metrics", {})
-        deps = metrics.get("deps", {})
-        if isinstance(deps, dict):
-            for dep_name, dep_info in deps.items():
-                dep_license = dep_info.get("license") if isinstance(dep_info, dict) else None
-                if dep_license and dep_license in self.GPL_LICENSES:
-                    findings.append(Finding(
-                        engine=self.name,
-                        severity="high",
-                        title=f"GPL/AGPL dependency in permissive project: {dep_name}",
-                        description=f"Dependency '{dep_name}' uses {dep_license} but project uses {file_license or 'permissive'} license",
-                        location=ir.metadata.get("path", "unknown"),
-                        metadata={
-                            "confidence": 0.85,
-                            "gpl_dep": dep_name,
-                            "license": dep_license,
-                            "project_license": file_license,
-                            "cwe": "CWE-1104",
-                            "cvss": 7.0,
-                        },
-                    ))
-        return findings