@orionscanner/cli 0.1.0 → 0.5.1

package/src/orion/engine/sandbox_escape/engine.py

@@ -1,284 +0,0 @@
-"""Sandbox escape pattern detection engine."""
-import ast
-import re
-from typing import Dict, List, Set, Optional, Any, Tuple
-from dataclasses import dataclass, field
-from orion.engine.config import EngineConfig, ResourceLimits
-from orion.engine.ir import OrionIR
-from orion.engine.results import EngineResult, Finding
-
-
-ESCAPE_PATTERNS = {
-    "import_os": {
-        "patterns": [
-            r"__import__\s*\(\s*['\"]os['\"]",
-            r"__import__\s*\(\s*['\"]subprocess['\"]",
-            r"__import__\s*\(\s*['\"]sys['\"]",
-            r"importlib\.import_module\s*\(\s*['\"]os['\"]",
-            r"importlib\.import_module\s*\(\s*['\"]subprocess['\"]",
-            r"importlib\.import_module\s*\(\s*['\"]sys['\"]",
-            r"runpy\.run_module\s*\(\s*['\"]os['\"]",
-            r"runpy\.run_module\s*\(\s*['\"]subprocess['\"]",
-        ],
-        "cwe": "CWE-829",
-        "severity": "critical",
-        "description": "Dynamic import of dangerous module (os, subprocess, sys)",
-    },
-    "builtin_access": {
-        "patterns": [
-            r"getattr\s*\(\s*__builtins__\s*,\s*['\"]eval['\"]",
-            r"getattr\s*\(\s*__builtins__\s*,\s*['\"]exec['\"]",
-            r"getattr\s*\(\s*__builtins__\s*,\s*['\"]compile['\"]",
-            r"__builtins__\s*\[\s*['\"]eval['\"]",
-            r"__builtins__\s*\[\s*['\"]exec['\"]",
-            r"__builtins__\s*\[\s*['\"]compile['\"]",
-            r"vars\s*\(\s*\)\s*\[\s*['\"]eval['\"]",
-            r"vars\s*\(\s*\)\s*\[\s*['\"]exec['\"]",
-            r"globals\s*\(\s*\)\s*\[\s*['\"]eval['\"]",
-            r"globals\s*\(\s*\)\s*\[\s*['\"]exec['\"]",
-        ],
-        "cwe": "CWE-94",
-        "severity": "critical",
-        "description": "Access to builtin eval/exec/compile via getattr or dict access",
-    },
-    "eval_compile": {
-        "patterns": [
-            r"eval\s*\(\s*compile\s*\(",
-            r"exec\s*\(\s*compile\s*\(",
-            r"compile\s*\([^)]+,\s*['\"]eval['\"]",
-            r"compile\s*\([^)]+,\s*['\"]exec['\"]",
-            r"compile\s*\([^)]+,\s*['\"]single['\"]",
-        ],
-        "cwe": "CWE-94",
-        "severity": "critical",
-        "description": "Code execution via eval/exec with compile",
-    },
-    "code_type": {
-        "patterns": [
-            r"types\.CodeType\s*\(",
-            r"code\.replace\s*\(",
-            r"func_code\s*=",
-            r"__code__\s*=",
-            r"f\.f_code\s*=",
-            r"frame\.f_code\s*=",
-        ],
-        "cwe": "CWE-94",
-        "severity": "high",
-        "description": "Direct code object manipulation",
-    },
-    "ctypes": {
-        "patterns": [
-            r"ctypes\.CDLL\s*\(",
-            r"ctypes\.windll\s*\.",
-            r"ctypes\.WinDLL\s*\(",
-            r"ctypes\.cdll\s*\.",
-            r"ctypes\.pythonapi",
-            r"ctypes\.PyDLL\s*\(",
-            r"ctypes\.CFUNCTYPE\s*\(",
-            r"ctypes\.cast\s*\(",
-            r"ctypes\.addressof\s*\(",
-            r"ctypes\.string_at\s*\(",
-        ],
-        "cwe": "CWE-111",
-        "severity": "critical",
-        "description": "ctypes usage for direct memory/library access",
-    },
-    "introspection": {
-        "patterns": [
-            r"sys\._getframe\s*\(",
-            r"inspect\.getouterframes\s*\(",
-            r"inspect\.currentframe\s*\(",
-            r"inspect\.stack\s*\(",
-            r"inspect\.trace\s*\(",
-            r"sys\.modules\s*\[\s*['\"]os['\"]",
-            r"sys\.modules\s*\[\s*['\"]subprocess['\"]",
-        ],
-        "cwe": "CWE-470",
-        "severity": "high",
-        "description": "Frame/introspection access for escaping sandboxes",
-    },
-    "class_mro": {
-        "patterns": [
-            r"__class__\.__bases__",
-            r"__class__\.__mro__",
-            r"__mro__\s*\[",
-            r"__subclasses__\s*\(",
-            r"\.__subclasses__\s*\(",
-            r"type\(\)\.__subclasses__",
-            r"object\.__subclasses__\s*\(",
-        ],
-        "cwe": "CWE-470",
-        "severity": "critical",
-        "description": "Class hierarchy traversal for sandbox escape (Python 2/3)",
-    },
-    "pickle": {
-        "patterns": [
-            r"pickle\.loads\s*\(",
-            r"pickle\.load\s*\(",
-            r"_pickle\.loads\s*\(",
-            r"marshal\.loads\s*\(",
-            r"shelve\.open\s*\(",
-            r"dill\.loads\s*\(",
-        ],
-        "cwe": "CWE-502",
-        "severity": "high",
-        "description": "Deserialization of untrusted data",
-    },
-    "subprocess": {
-        "patterns": [
-            r"subprocess\.call\s*\(",
-            r"subprocess\.run\s*\(",
-            r"subprocess\.Popen\s*\(",
-            r"subprocess\.check_output\s*\(",
-            r"subprocess\.check_call\s*\(",
-            r"os\.system\s*\(",
-            r"os\.popen\s*\(",
-            r"commands\.getstatusoutput\s*\(",
-            r"commands\.getoutput\s*\(",
-        ],
-        "cwe": "CWE-78",
-        "severity": "critical",
-        "description": "Command execution via subprocess/os",
-    },
-    "template_injection": {
-        "patterns": [
-            r"render_template_string\s*\(",
-            r"Template\s*\([^)]*request",
-            r"Environment\s*\(\s*loader\s*=",
-            r"jinja2\.Environment\s*\(",
-            r"markupsafe\.Markup\s*\(",
-            r"Markup\s*\(",
-        ],
-        "cwe": "CWE-79",
-        "severity": "high",
-        "description": "Server-side template injection (SSTI)",
-    },
-    "breakpoint": {
-        "patterns": [
-            r"breakpoint\s*\(",
-            r"pdb\.set_trace\s*\(",
-            r"ipdb\.set_trace\s*\(",
-            r"debugpy\.breakpoint\s*\(",
-        ],
-        "cwe": "CWE-489",
-        "severity": "medium",
-        "description": "Debug breakpoint in production code",
-    },
-}
-
-
-class SandboxVisitor(ast.NodeVisitor):
-    def __init__(self, filename: str, source_lines: List[str]):
-        self.filename = filename
-        self.source_lines = source_lines
-        self.findings: List[Finding] = []
-        self.seen_findings: Set[Tuple[str, int]] = set()
-        self.compiled_patterns = {
-            name: [re.compile(p, re.IGNORECASE) for p in data["patterns"]]
-            for name, data in ESCAPE_PATTERNS.items()
-        }
-
-    def get_snippet(self, line_no: int, context: int = 2) -> str:
-        start = max(0, line_no - 1 - context)
-        end = min(len(self.source_lines), line_no + context)
-        return "\n".join(self.source_lines[start:end])
-
-    def check_node(self, node: ast.AST):
-        line_no = getattr(node, 'lineno', 0)
-        if not line_no or line_no > len(self.source_lines):
-            return
-        
-        line_text = self.source_lines[line_no - 1]
-        for category, patterns in self.compiled_patterns.items():
-            if (category, line_no) in self.seen_findings:
-                continue
-            for pattern in patterns:
-                if pattern.search(line_text):
-                    self.seen_findings.add((category, line_no))
-                    data = ESCAPE_PATTERNS[category]
-                    confidence = 0.9 if category in ("class_mro", "ctypes", "subprocess") else 0.85
-                    
-                    self.findings.append(Finding(
-                        engine="sandbox_escape",
-                        severity=data["severity"],
-                        title=f"Sandbox escape: {data['description']}",
-                        description=f"Detected {category}: {data['description']}",
-                        location=f"{self.filename}:{line_no}",
-                        metadata={
-                            "snippet": self.get_snippet(line_no),
-                            "cwe": data["cwe"],
-                            "confidence": confidence,
-                            "category": category,
-                            "pattern": pattern.pattern,
-                        }
-                    ))
-                    break
-
-    def visit_Call(self, node: ast.Call):
-        self.check_node(node)
-        self.generic_visit(node)
-
-    def visit_Attribute(self, node: ast.Attribute):
-        self.check_node(node)
-        self.generic_visit(node)
-
-    def visit_Import(self, node: ast.Import):
-        self.check_node(node)
-        self.generic_visit(node)
-
-    def visit_ImportFrom(self, node: ast.ImportFrom):
-        self.check_node(node)
-        self.generic_visit(node)
-
-
-class Engine:
-    name = "sandbox_escape"
-    version = "1.0.0"
-
-    async def check_availability(self) -> bool:
-        return True
-
-    def resource_limits(self) -> ResourceLimits:
-        return ResourceLimits(max_cpu_seconds=60, max_memory_mb=512, max_files=50000)
-
-    async def run(self, ctx, config: EngineConfig) -> EngineResult:
-        # Handle both single IR and list of IRs
-        if not isinstance(ctx, list):
-            ctx = [ctx]
-        all_findings = []
-        errors = []
-        files_processed = 0
-
-        exclude_patterns = config.toggles.get("exclude", []) if config.toggles else []
-
-        for ir in ctx:
-            try:
-                if not ir.metadata.get("language") == "python":
-                    continue
-
-                rel_path = ir.metadata.get("path", "unknown.py")
-                if any(pattern in rel_path for pattern in exclude_patterns):
-                    continue
-
-                content = ir.content.decode("utf-8", errors="replace")
-                source_lines = content.splitlines()
-                tree = ast.parse(content, filename=rel_path)
-
-                visitor = SandboxVisitor(rel_path, source_lines)
-                visitor.visit(tree)
-
-                all_findings.extend(visitor.findings)
-                files_processed += 1
-
-            except SyntaxError as e:
-                errors.append(f"Syntax error in {ir.metadata.get('path', 'unknown')}: {e}")
-            except Exception as e:
-                errors.append(f"Error processing {ir.metadata.get('path', 'unknown')}: {e}")
-
-        return EngineResult(
-            engine=self.name,
-            findings=all_findings,
-            errors=errors,
-            metrics={"files_processed": files_processed, "findings_count": len(all_findings)},
-            ok=len(errors) == 0
-        )

package/src/orion/engine/sast/engine.py

@@ -1,217 +0,0 @@
-"""Full SAST engine - primary security engine with comprehensive pattern detection."""
-import re
-import ast
-from pathlib import Path
-from typing import List, Optional
-from dataclasses import dataclass
-
-from orion.engine.config import EngineConfig
-from orion.engine.ir import OrionIR
-from orion.engine.results import EngineResult, Finding
-from orion.engine.sast.patterns import (
-    PATTERNS,
-    get_patterns_for_language,
-    run_ast_patterns,
-    Severity,
-    Pattern,
-)
-
-
-@dataclass
-class SASTFinding:
-    pattern: Pattern
-    line: int
-    snippet: str
-    match: str
-    filepath: str
-
-
-class SASTEngine:
-    name = "sast"
-    version = "2.0.0"
-
-    EXCLUDED_DIRS = {
-        "__pycache__", ".git", ".venv", "venv", "env", "node_modules",
-        "dist", "build", ".pytest_cache", ".mypy_cache", ".tox",
-        "migrations", "tests", "test", "scripts", "examples", "docs",
-    }
-
-    EXCLUDED_FILES = {
-        "conftest.py", "manage.py", "wsgi.py", "asgi.py", "celery.py",
-        "gunicorn.conf.py", "pytest.ini", "setup.py", "setup.cfg",
-    }
-
-    async def check_availability(self) -> bool:
-        return True
-
-    def resource_limits(self):
-        from orion.engine.config import ResourceLimits
-        return ResourceLimits(max_cpu_seconds=120, max_memory_mb=1024)
-
-    def _should_exclude(self, filepath: str, config: EngineConfig) -> bool:
-        path = Path(filepath)
-        # Check excluded directories
-        for part in path.parts:
-            if part in self.EXCLUDED_DIRS:
-                return True
-        # Check excluded files
-        if path.name in self.EXCLUDED_FILES:
-            return True
-        # Check config exclude patterns
-        if config.toggles.get("exclude"):
-            for pattern in config.toggles["exclude"]:
-                if path.match(pattern) or any(p.match(pattern) for p in path.parents):
-                    return True
-        return False
-
-    def _detect_language(self, filepath: str, content: str) -> str:
-        ext = Path(filepath).suffix.lower()
-        lang_map = {
-            ".py": "python",
-            ".js": "javascript",
-            ".ts": "typescript",
-            ".jsx": "javascript",
-            ".tsx": "typescript",
-            ".java": "java",
-            ".go": "go",
-            ".rs": "rust",
-            ".php": "php",
-            ".rb": "ruby",
-            ".cs": "csharp",
-            ".cpp": "cpp",
-            ".cc": "cpp",
-            ".c": "c",
-            ".h": "c",
-            ".hpp": "cpp",
-            ".sh": "bash",
-            ".yaml": "yaml",
-            ".yml": "yaml",
-            ".json": "json",
-            ".toml": "toml",
-            ".xml": "xml",
-            ".html": "html",
-            ".css": "css",
-            ".sql": "sql",
-        }
-        return lang_map.get(ext, "unknown")
-
-    def _find_matches(self, content: str, patterns: List[Pattern], filepath: str) -> List[SASTFinding]:
-        findings = []
-        lines = content.splitlines()
-        for pattern in patterns:
-            for match in pattern.pattern.finditer(content):
-                line_num = content[:match.start()].count('\n') + 1
-                start = max(0, line_num - 3)
-                end = min(len(lines), line_num + 2)
-                snippet = '\n'.join(lines[start:end])
-                findings.append(SASTFinding(
-                    pattern=pattern,
-                    line=line_num,
-                    snippet=snippet,
-                    match=match.group()[:100],
-                    filepath=filepath,
-                ))
-        return findings
-
-    def _run_ast_analysis(self, content: str, filepath: str, language: str) -> List[SASTFinding]:
-        if language != "python":
-            return []
-        ast_findings = run_ast_patterns(content, filepath)
-        results = []
-        for af in ast_findings:
-            # Convert to pattern-like object
-            class ASTPattern:
-                def __init__(self, finding):
-                    self.name = finding['pattern']
-                    self.severity = finding['severity']
-                    self.confidence = finding['confidence']
-                    self.cwe = finding['cwe']
-                    self.cvss = finding['cvss']
-                    self.description = finding['description']
-            pattern_obj = ASTPattern(af)
-            results.append(SASTFinding(
-                pattern=pattern_obj,
-                line=af['line'],
-                snippet=af['snippet'],
-                match=af['pattern'],
-                filepath=filepath,
-            ))
-        return results
-
-    def _aggregate_findings(self, findings: List[SASTFinding]) -> List[Finding]:
-        """Aggregate findings, deduplicate similar ones, and create EngineResult findings."""
-        aggregated = []
-        seen = set()
-
-        for f in findings:
-            key = (f.filepath, f.line, f.pattern.name)
-            if key in seen:
-                continue
-            seen.add(key)
-
-            if f.pattern.confidence < 0.75:
-                continue
-
-            severity = f.pattern.severity.value if hasattr(f.pattern.severity, 'value') else str(f.pattern.severity)
-
-            aggregated.append(Finding(
-                engine=self.name,
-                severity=severity,
-                title=f"{f.pattern.name}: {f.pattern.description}",
-                description=f"{f.pattern.description} (CWE: {f.pattern.cwe}, CVSS: {f.pattern.cvss})",
-                location=f"{f.filepath}:{f.line}",
-                metadata={
-                    "pattern": f.pattern.name,
-                    "cwe": f.pattern.cwe,
-                    "cvss": f.pattern.cvss,
-                    "confidence": f.pattern.confidence,
-                    "match": f.match,
-                    "snippet": f.snippet,
-                    "file": f.filepath,
-                    "line": f.line,
-                },
-            ))
-        return aggregated
-
-    async def run(self, ir: OrionIR, config: EngineConfig) -> EngineResult:
-        try:
-            content = ir.content.decode("utf-8", errors="replace")
-        except Exception:
-            content = str(ir.content)
-
-        filepath = ir.metadata.get("path", "unknown")
-        project_root = ir.metadata.get("project_root", ".")
-        language = ir.metadata.get("language") or self._detect_language(filepath, content)
-
-        if self._should_exclude(filepath, config):
-            return EngineResult(engine=self.name, ok=True, metrics={"skipped": True})
-
-        all_findings = []
-
-        # Run regex patterns
-        patterns = get_patterns_for_language(language)
-        regex_findings = self._find_matches(content, patterns, filepath)
-        all_findings.extend(regex_findings)
-
-        # Run AST patterns for Python
-        ast_findings = self._run_ast_analysis(content, filepath, language)
-        all_findings.extend(ast_findings)
-
-        # Aggregate and filter
-        findings = self._aggregate_findings(all_findings)
-
-        return EngineResult(
-            engine=self.name,
-            findings=findings,
-            ok=True,
-            metrics={
-                "files_scanned": 1,
-                "patterns_run": len(patterns),
-                "findings_count": len(findings),
-                "language": language,
-            },
-        )
-
-
-# Backward compatibility
-Engine = SASTEngine