@orionscanner/cli 0.1.0 → 0.5.1

package/docs/ENGINE_CATALOG.md

@@ -1,87 +0,0 @@
-# Engine Catalog — 38 Native Engines
-
-All engines are **native, MIT-licensed, zero external dependencies**. Each engine routes to the appropriate language analyzer automatically via the Polyglot Dispatcher.
-
-## Security Engines (7)
-
-| Engine | Description | Primary Languages | Detection Method |
-|--------|-------------|-------------------|------------------|
-| **sast** | Static Application Security Testing — SQLi, XSS, CMDi, SSRF, path traversal, hardcoded creds, weak crypto, deserialization | Python (AST), JS/TS (regex), Universal regex fallback | AST + Regex |
-| **secrets** | API keys, tokens, passwords, private keys — regex + Shannon entropy, test pattern filtering | All text files | Regex + Entropy |
-| **deps** | Vulnerable dependencies — requirements.txt, package.json, Cargo.toml, go.mod, pom.xml, composer.json, Gemfile, Pipfile, poetry.lock, yarn.lock, pnpm-lock.yaml | Python, JS/TS, Go, Rust, Java, PHP, Ruby, .NET | Manifest parsing + CVE DB |
-| **taint** | Taint tracking: user input → dangerous sinks (SQL, shell, code exec, template, deserialization) | Python (AST), JS/TS (planned), Universal fallback | AST + Regex |
-| **authorization** | Missing auth on routes — Flask, FastAPI, Django, Express, Fastify, Spring, Gin, Laravel, Rails, ASP.NET | Python, JS/TS, Java, Go, PHP, Ruby, C# | AST + Regex |
-| **sandbox_escape** | `__import__('os')`, `eval(compile())`, `ctypes`, `__subclasses__()`, `Function` constructor, `Runtime.exec`, `Process.Start` | Python, JS/TS, Java, PHP, Ruby, C# | Regex |
-| **prompt_security** | Prompt injection, jailbreak patterns, base64 payloads, special tokens | All text files | Regex + Heuristics |
-
-## AST/IR Analysis Engines (8)
-
-| Engine | Description | Languages |
-|--------|-------------|-----------|
-| **callgraph** | Function call graph, recursive calls, undefined functions, deep chains | Python (AST), JS/TS, Java, Go, Rust, PHP, Ruby, C# (regex) |
-| **cfg** | Control flow graph per function — unreachable code, infinite loops, missing returns, cyclomatic complexity | Python (AST), Universal fallback |
-| **symbol** | Symbol table — shadowed builtins, undefined names, unused imports, late-binding closures | Python (AST), Universal fallback |
-| **dataflow** | Variable def/use — use-before-def, dead stores, mutable defaults, global mutations | Python (AST), Universal fallback |
-| **orphan** | Files with zero incoming imports — excludes `__init__.py`, tests, scripts, entry points | Python (AST), JS/TS, Java, Go, Rust, PHP, Ruby (regex) |
-| **dead_import** | Unused imports — tracks Name/Attribute usage across scopes | Python (AST), JS/TS, Java, Go, Rust, PHP, Ruby (regex) |
-| **wiring_trace** | Config wiring — traces from .env/config.yaml/settings.py to usage sites | Python, JS/TS, Java, Go, Rust, PHP, Ruby (config files) |
-| **state** | Mutable state — globals, class attrs, function defaults, `global`/`nonlocal` | Python (AST), Universal fallback |
-
-## Quality Engines (7)
-
-| Engine | Description | Languages |
-|--------|-------------|-----------|
-| **complexity** | Cyclomatic & cognitive complexity — functions >10/20/50 | Python (AST), Universal regex fallback |
-| **duplication** | Code duplication — sliding window (5 lines), token normalization, SHA256 clustering | Python, JS/TS, Java, Go, Rust, C/C++, C# |
-| **error_handling** | Bare `except:`, `except Exception: pass`, lost causes, `assert` in prod, `sys.exit()` in libs | Python (AST), Universal fallback |
-| **logging_c** | `print()` in prod, PII in logs, missing `getLogger(__name__)`, DEBUG in prod, missing structured logging | Python (AST), Universal fallback |
-| **license** | SPDX headers, GPL/AGPL detection, root LICENSE file, dep license conflicts | All source files |
-| **lint** | Unused vars, undefined names, import order, line length >100, missing docstrings, wildcard imports, `== None`, bare except | Python (AST), Universal fallback |
-| **test_coverage** | Untested public functions, test-only-mocks, no-assertions, long tests, missing conftest.py | Python (AST), Universal fallback |
-
-## Config/Infra Engines (7)
-
-| Engine | Description | Languages |
-|--------|-------------|-----------|
-| **config_engine** | Config validation — required keys, types, placeholders, secrets in non-.env, duplicates, URLs, emails | YAML, JSON, TOML, .env, .ini, .properties, Python |
-| **chaos** | Chaos resilience — no retry/circuit-breaker/timeout/idempotency, global locks, direct instantiation | Python (AST), Universal fallback |
-| **chaos_config** | Config edge cases — empty/null/negative/huge values, invalid enums, circular refs, long strings | YAML, JSON, TOML, .env, .ini, .properties, Python |
-| **regression** | Monkey patching, dynamic imports, `sys.modules` mutation, `builtins`/`os.environ` mutation, signal/atexit handlers | Python (AST), Universal fallback |
-| **perf_guard** | N+1 queries, O(n²) loops, `list.append` in hot loops, string `+=`, large in-memory loads, missing pagination, sync I/O in async | Python (AST), Universal fallback |
-| **data_residency** | Hardcoded PII — emails, phones, SSN, credit cards (Luhn), IPs, UUIDs, API keys | All text files (regex) |
-| **container** | Dockerfile, docker-compose, K8s YAML, Helm — root user, latest tag, secrets in ENV, privileged, host namespaces, missing healthcheck/read-only/limits | Dockerfile, docker-compose, K8s YAML, Helm values |
-
-## Meta/Supply Chain Engines (9)
-
-| Engine | Description | Languages |
-|--------|-------------|-----------|
-| **noise** | Suppresses low-confidence + recent changes + high churn, duplicates, generated files | All findings |
-| **hunter** | Cross-engine correlation — SQLi + missing auth = CRITICAL, XSS + missing CSP = HIGH, secret + public repo = CRITICAL | All findings |
-| **supply_chain_sbom** | CycloneDX SBOM — components with purl, hashes, licenses, external references | All dep files |
-| **compliance** | Maps findings to GDPR (Art 25/32/33), PCI-DSS (Req 3/4/6/8), SOC2 (CC6.1/6.7/7.2), HIPAA (164.312) | All findings |
-| **provenance** | SLSA-like — git commit/tag/branch, SHA256 file hashes, builder identity (CI env), dep hashes | Git, all source files |
-| **fp_learn** | Reads `.orion-feedback.json`, extracts features, reduces confidence by 0.3 on match | All findings |
-| **config_validation** | Validates OrionEngine config — paths, globs, limits, network policy, parallelism, timeout | Config object |
-| **architecture** | Cyclic imports, layer violations (domain→app→infra→pres), god classes/modules, feature envy, data classes with behavior | Python (AST), JS/TS, Java, Go, Rust, PHP, Ruby (regex) |
-| **config_validation** | Validates EngineConfig — paths exist, globs valid, limits positive, network policy consistent | Config object |
-
-## Language Support Matrix
-
-| Language | SAST | Secrets | Deps | Taint | Callgraph | Config | Container |
-|----------|------|---------|------|-------|-----------|--------|-----------|
-| Python | ���� AST | ���� | ���� | ���� AST | ���� AST | ���� | ���� |
-| JavaScript | ���� Regex | ���� | ���� | ���� Regex | ���� Regex | ���� | ���� |
-| TypeScript | ���� Regex | ���� | ���� | ���� Regex | ���� Regex | ���� | ���� |
-| Java | ���� Regex | ���� | ���� | ���� Regex | ���� Regex | ���� | ���� |
-| Go | ���� Regex | ���� | ���� | ���� Regex | ���� Regex | ���� | ���� |
-| Rust | ���� Regex | ���� | ���� | ���� Regex | ���� Regex | ���� | ���� |
-| PHP | ���� Regex | ���� | ���� | ���� Regex | ���� Regex | ���� | ���� |
-| Ruby | ���� Regex | ���� | ���� | ���� Regex | ���� Regex | ���� | ���� |
-| C/C++ | ���� Regex | ���� | ���� | ���� Regex | ���� Regex | ���� | ���� |
-| C# | ���� Regex | ���� | ���� | ���� Regex | ���� Regex | ���� | ���� |
-| HTML | ���� Regex | ���� | ���� | ���� Regex | ���� Regex | ���� | ���� |
-| CSS | ���� | ���� | ���� | ���� | ���� | ���� | ���� |
-| YAML/JSON/TOML | ���� | ���� | ���� | ���� | ���� | ���� | ���� |
-| Dockerfile | ���� Regex | ���� | ���� | ���� Regex | ���� Regex | ���� | ���� |
-
-�� = Full AST support | ���� = Regex/Universal fallback | ���� = Not applicable

package/docs/GETTING_STARTED.md

@@ -1,226 +0,0 @@
-# Getting Started
-
-## Installation
-
-```bash
-# From source
-git clone https://github.com/chandrahotha/OrionEngine
-cd OrionEngine
-pip install -e .
-
-# Or from PyPI (when published)
-pip install orion-engine
-```
-
-Requires Python 3.10+
-
-## Quick Start
-
-### 1. Interactive Menu
-```bash
-orion
-```
-Opens interactive menu with 9 options:
-1. **Quick Scan** — Fast security check of current project
-2. **Full Security Audit** — Complete analysis with all 38 engines
-3. **Vulnerability Scan** — SAST, Secrets, Dependencies, Injection
-4. **Code Quality Review** — Complexity, Duplication, Standards, Tests
-5. **Architecture Analysis** — Dependencies, Layers, Coupling, Design
-6. **Supply Chain Security** — SBOM, Provenance, Compliance, Containers
-7. **View Reports** — Browse previous scan reports
-8. **Settings** — Configure limits, exclusions, network
-9. **System Status** — Engine health and availability
-
-### 2. Direct Command Line
-```bash
-# Scan current directory
-orion .
-
-# Scan specific path
-orion ./my_project
-orion path/to/file.py
-
-# Security-focused scan (SAST, Secrets, Deps, Taint, Auth)
-orion . --security
-
-# Quality-focused scan (Complexity, Lint, Duplication, Tests)
-orion . --quality
-
-# Architecture scan (Callgraph, CFG, Symbols, Layers)
-orion . --arch
-
-# Custom config
-orion . --config-json '{"resource_limits":{"max_cpu_seconds":30}}'
-```
-
-## Configuration
-
-### EngineConfig
-```python
-from orion.engine import EngineConfig, ResourceLimits, NetworkPolicy
-
-config = EngineConfig(
-    toggles={
-        "exclude": ["tests/", "vendor/", "migrations/", "*.min.js"],
-        "only_engines": ["sast", "secrets", "deps"],
-        "severity_threshold": "medium",
-    },
-    resource_limits=ResourceLimits(
-        max_cpu_seconds=120,
-        max_memory_mb=1024,
-        max_file_size_mb=10,
-        max_files=50000
-    ),
-    network_policy=NetworkPolicy(
-        allow_outbound=False,
-        allowed_hosts=[]
-    )
-)
-```
-
-### ResourceLimits
-| Parameter | Default | Description |
-|-----------|---------|-------------|
-| `max_cpu_seconds` | 60 | Timeout per engine |
-| `max_memory_mb` | 512 | Memory limit per engine |
-| `max_file_size_mb` | 10 | Skip files larger than this |
-| `max_files` | 50000 | Max files to scan |
-
-### NetworkPolicy
-```python
-NetworkPolicy(
-    allow_outbound=False,    # Block all external calls (default)
-    allowed_hosts=[]         # Allowlist if outbound enabled
-)
-```
-
-## Reports
-
-Reports generated in `ORION SCANNER REPORTS/`:
-- **HTML** — Dark theme, sidebar navigation, expandable findings, score/grade (A-F)
-- **JSON** — Machine-readable for CI/CD integration
-- **TXT** — Human-readable summary
-
-```bash
-# Open latest HTML report (Windows)
-start "ORION SCANNER REPORTS\*.html"
-
-# Open latest HTML report (Linux/macOS)
-xdg-open "ORION SCANNER REPORTS"/*.html
-```
-
-## Programmatic Usage
-
-```python
-import asyncio
-from orion.engine import OrionEngine, EngineConfig, ResourceLimits
-from orion.engine.ir import OrionIR
-from pathlib import Path
-
-async def scan_project(project_path: str):
-    engine = OrionEngine()
-    
-    # Collect files
-    files = list(Path(project_path).rglob("*.py"))
-    irs = []
-    for f in files:
-        content = f.read_bytes()
-        irs.append(OrionIR(
-            content=content,
-            metadata={"path": str(f.relative_to(project_path)), "language": "python"}
-        ))
-    
-    config = EngineConfig(
-        resource_limits=ResourceLimits(max_cpu_seconds=120, max_memory_mb=1024)
-    )
-    
-    result = await engine.run(irs, config)
-    
-    print(f"Scanned {len(files)} files")
-    print(f"Found {len(result.findings)} issues")
-    print(f"Grade: {calculate_grade(result.findings)}")
-    
-    for f in result.findings:
-        if f.severity in ("critical", "high"):
-            print(f"  [{f.severity.upper()}] {f.title} @ {f.location}")
-
-asyncio.run(scan_project("."))
-```
-
-## Exit Codes
-- `0` — No critical/high findings
-- `1` — Critical or high severity findings found
-
-## Multi-Language Support
-
-Orion automatically detects language from file extension:
-
-| Extension | Language | SAST Support |
-|-----------|----------|--------------|
-| `.py` | Python | AST + Regex |
-| `.js`, `.jsx`, `.ts`, `.tsx` | JavaScript/TypeScript | Regex |
-| `.java` | Java | Regex |
-| `.go` | Go | Regex |
-| `.rs` | Rust | Regex |
-| `.php` | PHP | Regex |
-| `.rb` | Ruby | Regex |
-| `.cs` | C# | Regex |
-| `.cpp`, `.cc`, `.c`, `.h` | C/C++ | Regex |
-| `.html`, `.htm` | HTML | Regex |
-| `.yml`, `.yaml`, `.json`, `.toml` | Config | Regex |
-| `Dockerfile` | Dockerfile | Regex |
-
-## Excluding Files/Directories
-
-```python
-config = EngineConfig(
-    toggles={
-        "exclude": [
-            "tests/", "test/", "tests/**",
-            "vendor/", "node_modules/",
-            "migrations/", "dist/", "build/",
-            "*.min.js", "*.min.css",
-            "generated/", "*.pb.go"
-        ]
-    }
-)
-```
-
-## CI/CD Integration
-
-```yaml
-# GitHub Actions example
-- name: Orion Security Scan
-  run: |
-    pip install orion-engine
-    orion . --security
-```
-
-## False Positive Feedback
-
-Create `.orion-feedback.json` in project root:
-```json
-{
-  "findings": [
-    {
-      "engine": "sast",
-      "location": "app.py:42",
-      "title": "SQL Injection",
-      "feedback": "false_positive",
-      "reason": "Parameterized query used"
-    }
-  ]
-}
-```
-
-Orion learns from feedback and reduces confidence on similar patterns.
-
-## Troubleshooting
-
-| Issue | Solution |
-|-------|----------|
-| `ModuleNotFoundError: orion` | Run `pip install -e .` from project root |
-| Scan hangs | Reduce `max_cpu_seconds` in ResourceLimits |
-| Too many findings | Increase `severity_threshold` or add exclude patterns |
-| No findings | Check language detection, add file extensions |
-| Memory error | Reduce `max_memory_mb` or `max_files` |

package/pyproject.toml

@@ -1,16 +0,0 @@
-[build-system]
-requires = ["setuptools>=68", "wheel"]
-build-backend = "setuptools.build_meta"
-
-[project]
-name = "orion-engine"
-version = "0.1.0"
-description = "Orion Security Suite - Proprietary In-House Code Intelligence & Security Audit Platform"
-requires-python = ">=3.10"
-dependencies = []
-
-[project.scripts]
-orion = "orion.engine.runner:main"
-
-[tool.setuptools.packages.find]
-where = ["src"]

package/src/orion/engine/__init__.py

@@ -1,17 +0,0 @@
-from orion.engine.config import EngineConfig, NetworkPolicy, ResourceLimits
-from orion.engine.results import EngineResult, Finding
-from orion.engine.ir import OrionIR
-from orion.engine.registry import EngineRegistry
-from orion.engine.core import OrionEngine
-
-__version__ = "1.0.0"
-__all__ = [
-    "OrionEngine",
-    "EngineConfig",
-    "NetworkPolicy",
-    "ResourceLimits",
-    "EngineResult",
-    "Finding",
-    "OrionIR",
-    "EngineRegistry",
-]

package/src/orion/engine/api_security/engine.py

@@ -1,125 +0,0 @@
-"""REST & Microservice API Security Engine.
-
-100% Custom In-House Developed Engine for Orion Engine Platform (OWASP API Security Top 10).
-Detects BOLA/IDOR patterns, mass assignment risks, unvalidated redirects, and exposed debug endpoints.
-"""
-import re
-from pathlib import Path
-from typing import List, Dict, Any
-
-from orion.engine.config import EngineConfig, ResourceLimits
-from orion.engine.ir import OrionIR
-from orion.engine.results import EngineResult, Finding
-
-
-API_RULES = [
-    {
-        "id": "API-001",
-        "pattern": r"(?i)@(app|router|api)\.(get|post|put|delete|patch)\s*\([^)]*[\"']/api/[^\"']*\{?(user_id|account_id|org_id|id)\}?[^\"']*[\"']\)\s*\n\s*(?:async\s+)?def\s+[a-zA-Z0-9_]+\s*\([^)]*\):\s*\n(?!\s*.*(?:verify_owner|check_permission|current_user|authorize))",
-        "title": "Missing object-level authorization check on ID-parameterized endpoint (API1: BOLA / IDOR)",
-        "description": "Endpoint operates directly on user-provided resource identifier without verifying caller ownership",
-        "severity": "high",
-        "cwe": "CWE-639",
-        "confidence": 0.8,
-    },
-    {
-        "id": "API-002",
-        "pattern": r"(?i)\b(Model\.objects\.create\s*\(\s*\*\*req\.(body|data|POST)|db\.session\.add\s*\(\s*User\s*\(\s*\*\*data\)|update\s*\(\s*\*\*request\.json)\b",
-        "title": "Mass assignment vulnerability on user input model mapping (API6: Mass Assignment)",
-        "description": "Directly unpacking untrusted request payload into ORM model allows attackers to overwrite administrative fields (e.g. is_admin, role)",
-        "severity": "high",
-        "cwe": "CWE-915",
-        "confidence": 0.9,
-    },
-    {
-        "id": "API-003",
-        "pattern": r"(?i)\b(redirect|HttpResponseRedirect)\s*\(\s*(request\.(GET|POST|args|query|params)\[?['\"]?(url|next|redirect|target|return_to)['\"]?\]?)\b",
-        "title": "Unvalidated open redirect via request query parameter (API8: SSRF / Open Redirect)",
-        "description": "Directly passing user-supplied URL to redirect without whitelist validation enables phishing and auth token leakage",
-        "severity": "medium",
-        "cwe": "CWE-601",
-        "confidence": 0.85,
-    },
-    {
-        "id": "API-004",
-        "pattern": r'(?i)@(app|router|api)\.(get|post)\s*\([^)]*["\']/(debug|metrics|actuator|healthcheck/full|_profiler|env|configdump)["\']\)',
-        "title": "Potentially exposed internal debug or diagnostic API endpoint",
-        "description": "Sensitive diagnostic endpoints exposed without strict network ACL or authentication guard",
-        "severity": "medium",
-        "cwe": "CWE-200",
-        "confidence": 0.85,
-    },
-    {
-        "id": "API-005",
-        "pattern": r'(?i)(jwt\.decode\s*\([^)]*options\s*=\s*\{.*verify_signature.*False.*\}|jwt\.decode\s*\([^)]*algorithms\s*=\s*\[\s*["\']none["\']\s*\]|verify\s*=\s*False)',
-        "title": "JWT signature verification explicitly disabled or 'none' algorithm accepted",
-        "description": "Accepting unsigned tokens or disabling cryptographic validation bypasses authentication completely",
-        "severity": "critical",
-        "cwe": "CWE-347",
-        "confidence": 0.95,
-    },
-]
-
-
-class ApiSecurityEngine:
-    """100% custom, in-house developed REST API & Microservice Security Engine."""
-
-    name = "api_security"
-    version = "1.0.0"
-
-    def __init__(self):
-        self._compiled_rules = []
-        for r in API_RULES:
-            self._compiled_rules.append({
-                **r,
-                "regex": re.compile(r["pattern"])
-            })
-
-    async def check_availability(self) -> bool:
-        return True
-
-    def resource_limits(self) -> ResourceLimits:
-        return ResourceLimits(max_cpu_seconds=30, max_memory_mb=256)
-
-    async def run(self, ir: OrionIR, config: EngineConfig) -> EngineResult:
-        path = ir.metadata.get("path", "unknown")
-        try:
-            content = ir.content.decode("utf-8", errors="replace")
-        except Exception:
-            return EngineResult(engine=self.name, findings=[], ok=True)
-
-        lines = content.splitlines()
-        findings = []
-
-        for rule in self._compiled_rules:
-            for match in rule["regex"].finditer(content):
-                line_no = content[:match.start()].count('\n') + 1
-                start_line = max(0, line_no - 2)
-                end_line = min(len(lines), line_no + 2)
-                snippet = '\n'.join(lines[start_line:end_line])
-
-                findings.append(Finding(
-                    engine=self.name,
-                    severity=rule["severity"],
-                    title=f"{rule['id']}: {rule['title']}",
-                    description=rule["description"],
-                    location=f"{path}:{line_no}",
-                    metadata={
-                        "rule_id": rule["id"],
-                        "cwe": rule["cwe"],
-                        "confidence": rule["confidence"],
-                        "snippet": snippet,
-                        "file": path,
-                        "line": line_no,
-                    }
-                ))
-
-        return EngineResult(
-            engine=self.name,
-            findings=findings,
-            ok=True,
-            metrics={"findings_count": len(findings)}
-        )
-
-
-Engine = ApiSecurityEngine