@orionscanner/cli 0.1.0 → 0.5.1

package/src/orion/engine/authorization/engine.py

@@ -1,337 +0,0 @@
-"""Authorization engine for detecting missing authentication on routes."""
-import ast
-import re
-from typing import Dict, List, Set, Optional, Any, Tuple
-from dataclasses import dataclass, field
-from orion.engine.config import EngineConfig, ResourceLimits
-from orion.engine.ir import OrionIR
-from orion.engine.results import EngineResult, Finding
-
-
-AUTH_DECORATORS = {
-    "flask": [
-        "login_required", "permission_required", "roles_required",
-        "auth_required", "token_required", "jwt_required",
-        "fresh_login_required", "current_user",
-    ],
-    "fastapi": [
-        "Depends", "Security", "get_current_user", "get_current_active_user",
-        "oauth2_scheme", "http_bearer", "api_key_header",
-    ],
-    "django": [
-        "login_required", "permission_required", "user_passes_test",
-        "staff_member_required", "superuser_required",
-        "LoginRequiredMixin", "PermissionRequiredMixin", "UserPassesTestMixin",
-    ],
-    "bottle": ["auth_required", "require_auth"],
-    "tornado": ["authenticated", "auth_required"],
-    "starlette": ["Depends", "Security"],
-    "generic": ["requires_auth", "requires_login", "requires_permission",
-                "check_auth", "verify_token", "validate_user"],
-}
-
-ROUTE_DECORATORS = {
-    "flask": ["route", "get", "post", "put", "delete", "patch", "head", "options"],
-    "fastapi": ["get", "post", "put", "delete", "patch", "head", "options", "api_route"],
-    "django": ["path", "re_path", "url"],
-    "bottle": ["route", "get", "post", "put", "delete", "patch"],
-    "tornado": ["route"],
-    "starlette": ["route", "get", "post", "put", "delete", "patch"],
-    "aiohttp": ["get", "post", "put", "delete", "patch"],
-}
-
-EXEMPT_PATTERNS = [
-    r"/health", r"/ready", r"/live", r"/metrics", r"/status",
-    r"/ping", r"/version", r"/favicon", r"/robots\.txt",
-    r"/static/", r"/media/", r"/assets/",
-    r"\.well-known/", r"/docs", r"/redoc", r"/openapi",
-]
-
-
-@dataclass
-class RouteInfo:
-    path: str
-    methods: List[str]
-    decorators: List[str]
-    lineno: int
-    filename: str
-    has_auth: bool = False
-    auth_decorators: List[str] = field(default_factory=list)
-    is_exempt: bool = False
-
-
-class AuthVisitor(ast.NodeVisitor):
-    def __init__(self, filename: str, source_lines: List[str]):
-        self.filename = filename
-        self.source_lines = source_lines
-        self.findings: List[Finding] = []
-        self.routes: List[RouteInfo] = []
-        self.imports: Dict[str, str] = {}
-        self.current_class: Optional[str] = None
-        self.blueprint_routes: List[RouteInfo] = []
-
-    def get_snippet(self, node: ast.AST, context: int = 3) -> str:
-        start = max(0, node.lineno - 1 - context)
-        end = min(len(self.source_lines),
-                  getattr(node, 'end_lineno', node.lineno) + context if hasattr(node, 'end_lineno') else node.lineno + context)
-        return "\n".join(self.source_lines[start:end])
-
-    def visit_Import(self, node: ast.Import):
-        for alias in node.names:
-            self.imports[alias.asname or alias.name] = alias.name
-        self.generic_visit(node)
-
-    def visit_ImportFrom(self, node: ast.ImportFrom):
-        if node.module:
-            for alias in node.names:
-                self.imports[alias.asname or alias.name] = f"{node.module}.{alias.name}"
-        self.generic_visit(node)
-
-    def visit_ClassDef(self, node: ast.ClassDef):
-        old_class = self.current_class
-        self.current_class = node.name
-        self.generic_visit(node)
-        self.current_class = old_class
-
-    def visit_FunctionDef(self, node: ast.FunctionDef):
-        self._check_function(node)
-        self.generic_visit(node)
-
-    def visit_AsyncFunctionDef(self, node: ast.AsyncFunctionDef):
-        self._check_function(node)
-        self.generic_visit(node)
-
-    def _check_function(self, node: ast.FunctionDef):
-        route_info = self._extract_route(node)
-        if route_info:
-            self._analyze_route(route_info)
-            if not route_info.is_exempt:
-                self.routes.append(route_info)
-
-    def _extract_route(self, node: ast.FunctionDef) -> Optional[RouteInfo]:
-        decorators = []
-        for dec in node.decorator_list:
-            dec_str = self._decorator_to_string(dec)
-            decorators.append(dec_str)
-
-        for dec in decorators:
-            if self._is_route_decorator(dec):
-                path, methods = self._extract_path_and_methods(dec, node)
-                if path:
-                    return RouteInfo(
-                        path=path,
-                        methods=methods,
-                        decorators=decorators,
-                        lineno=node.lineno,
-                        filename=self.filename,
-                    )
-        return None
-
-    def _decorator_to_string(self, node: ast.AST) -> str:
-        if isinstance(node, ast.Name):
-            return node.id
-        elif isinstance(node, ast.Attribute):
-            return self._decorator_to_string(node.value) + "." + node.attr
-        elif isinstance(node, ast.Call):
-            return self._decorator_to_string(node.func)
-        return ""
-
-    def _is_route_decorator(self, dec: str) -> bool:
-        dec_lower = dec.lower()
-        for framework, patterns in ROUTE_DECORATORS.items():
-            for pattern in patterns:
-                if pattern in dec_lower:
-                    return True
-        return False
-
-    def _extract_path_and_methods(self, dec: str, node: ast.FunctionDef) -> Tuple[str, List[str]]:
-        path = ""
-        methods = ["GET"]
-        
-        dec_lower = dec.lower()
-        
-        if any(m in dec_lower for m in [".get", "@get", "@app.get", "@router.get"]):
-            methods = ["GET"]
-        elif any(m in dec_lower for m in [".post", "@post", "@app.post", "@router.post"]):
-            methods = ["POST"]
-        elif any(m in dec_lower for m in [".put", "@put", "@app.put", "@router.put"]):
-            methods = ["PUT"]
-        elif any(m in dec_lower for m in [".delete", "@delete", "@app.delete", "@router.delete"]):
-            methods = ["DELETE"]
-        elif any(m in dec_lower for m in [".patch", "@patch", "@app.patch", "@router.patch"]):
-            methods = ["PATCH"]
-        
-        if "(" in dec:
-            try:
-                call_part = dec[dec.index("(")+1:dec.rindex(")")]
-                parts = [p.strip().strip('"\'') for p in call_part.split(",")]
-                if parts:
-                    path = parts[0]
-                    if len(parts) > 1 and "method" in parts[1].lower():
-                        pass
-            except:
-                pass
-        
-        if not path:
-            path = f"/{node.name}"
-        
-        return path, methods
-
-    def _analyze_route(self, route: RouteInfo):
-        route.has_auth = False
-        route.auth_decorators = []
-        
-        for dec in route.decorators:
-            if self._is_auth_decorator(dec):
-                route.has_auth = True
-                route.auth_decorators.append(dec)
-        
-        if not route.has_auth:
-            if self.current_class:
-                for base in getattr(self, 'class_bases', []):
-                    if self._is_auth_mixin(base):
-                        route.has_auth = True
-                        route.auth_decorators.append(f"Mixin:{base}")
-        
-        route.is_exempt = self._is_exempt_path(route.path)
-
-    def _is_auth_decorator(self, dec: str) -> bool:
-        dec_lower = dec.lower()
-        for framework, patterns in AUTH_DECORATORS.items():
-            for pattern in patterns:
-                if pattern.lower() in dec_lower:
-                    return True
-        return False
-
-    def _is_auth_mixin(self, base: str) -> bool:
-        base_lower = base.lower()
-        auth_mixins = ["loginrequiredmixin", "permissionrequiredmixin", "userpassestestmixin",
-                       "staffmemberrequiredmixin", "superuserrequiredmixin",
-                       "accesscontrolmixin", "authorizationmixin"]
-        return any(m in base_lower for m in auth_mixins)
-
-    def _is_exempt_path(self, path: str) -> bool:
-        for pattern in EXEMPT_PATTERNS:
-            if re.search(pattern, path, re.IGNORECASE):
-                return True
-        return False
-
-    def visit_Call(self, node: ast.Call):
-        if isinstance(node.func, ast.Attribute):
-            if node.func.attr in ("add_url_rule", "route"):
-                if node.args:
-                    path = self._get_string_value(node.args[0])
-                    if path:
-                        methods = ["GET"]
-                        if len(node.args) > 1:
-                            methods_arg = node.args[1]
-                            if isinstance(methods_arg, ast.List):
-                                methods = [self._get_string_value(e) or "GET" for e in methods_arg.elts]
-                        
-                        route = RouteInfo(
-                            path=path,
-                            methods=methods,
-                            decorators=[f"add_url_rule({path})"],
-                            lineno=node.lineno,
-                            filename=self.filename,
-                        )
-                        self._analyze_route(route)
-                        if not route.is_exempt:
-                            self.routes.append(route)
-        self.generic_visit(node)
-
-    def _get_string_value(self, node: ast.AST) -> Optional[str]:
-        if isinstance(node, ast.Constant) and isinstance(node.value, str):
-            return node.value
-        if isinstance(node, ast.Str):
-            return node.s
-        return None
-
-
-class Engine:
-    name = "authorization"
-    version = "1.0.0"
-
-    async def check_availability(self) -> bool:
-        return True
-
-    def resource_limits(self) -> ResourceLimits:
-        return ResourceLimits(max_cpu_seconds=60, max_memory_mb=512, max_files=50000)
-
-    async def run(self, ctx, config: EngineConfig) -> EngineResult:
-        # Handle both single IR and list of IRs
-        if not isinstance(ctx, list):
-            ctx = [ctx]
-        all_findings = []
-        errors = []
-        files_processed = 0
-        total_routes = 0
-        unprotected_routes = 0
-
-        exclude_patterns = config.toggles.get("exclude", []) if config.toggles else []
-
-        for ir in ctx:
-            try:
-                if not ir.metadata.get("language") == "python":
-                    continue
-
-                rel_path = ir.metadata.get("path", "unknown.py")
-                if any(pattern in rel_path for pattern in exclude_patterns):
-                    continue
-
-                content = ir.content.decode("utf-8", errors="replace")
-                source_lines = content.splitlines()
-                tree = ast.parse(content, filename=rel_path)
-
-                visitor = AuthVisitor(rel_path, source_lines)
-                visitor.visit(tree)
-
-                for route in visitor.routes:
-                    total_routes += 1
-                    if not route.has_auth:
-                        unprotected_routes += 1
-                        severity = "high" if any(m in route.methods for m in ["POST", "PUT", "DELETE", "PATCH"]) else "medium"
-                        
-                        all_findings.append(Finding(
-                            engine="authorization",
-                            severity=severity,
-                            title="Missing authentication on route",
-                            description=f"Route '{route.path}' [{', '.join(route.methods)}] has no authentication decorator. "
-                                       f"Consider adding @login_required, @auth_required, or Depends(get_current_user).",
-                            location=f"{route.filename}:{route.lineno}",
-                            metadata={
-                                "snippet": self.get_snippet_by_line(source_lines, route.lineno),
-                                "cwe": "CWE-306",
-                                "confidence": 0.85,
-                                "route_path": route.path,
-                                "route_methods": route.methods,
-                                "decorators": route.decorators,
-                                "is_exempt": route.is_exempt,
-                            }
-                        ))
-
-                files_processed += 1
-
-            except SyntaxError as e:
-                errors.append(f"Syntax error in {ir.metadata.get('path', 'unknown')}: {e}")
-            except Exception as e:
-                errors.append(f"Error processing {ir.metadata.get('path', 'unknown')}: {e}")
-
-        return EngineResult(
-            engine=self.name,
-            findings=all_findings,
-            errors=errors,
-            metrics={
-                "files_processed": files_processed,
-                "total_routes": total_routes,
-                "unprotected_routes": unprotected_routes,
-                "protected_routes": total_routes - unprotected_routes,
-                "findings_count": len(all_findings),
-            },
-            ok=len(errors) == 0
-        )
-
-    def get_snippet_by_line(self, lines: List[str], line: int, context: int = 3) -> str:
-        start = max(0, line - 1 - context)
-        end = min(len(lines), line + context)
-        return "\n".join(lines[start:end])

package/src/orion/engine/callgraph/engine.py

@@ -1,236 +0,0 @@
-"""Function call graph builder engine."""
-import ast
-import asyncio
-from collections import defaultdict
-from typing import Dict, List, Set, Optional, Any
-from orion.engine.config import EngineConfig, ResourceLimits
-from orion.engine.ir import OrionIR
-from orion.engine.results import EngineResult, Finding
-
-
-class CallGraphVisitor(ast.NodeVisitor):
-    def __init__(self, filename: str, source_lines: List[str]):
-        self.filename = filename
-        self.source_lines = source_lines
-        self.calls: Dict[str, Set[str]] = defaultdict(set)
-        self.function_defs: Set[str] = set()
-        self.class_defs: Set[str] = set()
-        self.imports: Dict[str, str] = {}
-        self.current_class: Optional[str] = None
-        self.current_function: Optional[str] = None
-        self.call_depth = 0
-        self.max_call_depth = 100
-        self.undefined_calls: List[tuple] = []
-        self.recursive_calls: List[tuple] = []
-        self.deep_chains: List[tuple] = []
-
-    def get_qualified_name(self, name: str) -> str:
-        parts = []
-        if self.current_class:
-            parts.append(self.current_class)
-        if self.current_function:
-            parts.append(self.current_function)
-        parts.append(name)
-        return ".".join(parts)
-
-    def visit_Import(self, node: ast.Import):
-        for alias in node.names:
-            self.imports[alias.asname or alias.name] = alias.name
-        self.generic_visit(node)
-
-    def visit_ImportFrom(self, node: ast.ImportFrom):
-        if node.module:
-            for alias in node.names:
-                self.imports[alias.asname or alias.name] = f"{node.module}.{alias.name}"
-        self.generic_visit(node)
-
-    def visit_ClassDef(self, node: ast.ClassDef):
-        old_class = self.current_class
-        self.current_class = node.name
-        self.class_defs.add(self.get_qualified_name(node.name))
-        self.generic_visit(node)
-        self.current_class = old_class
-
-    def visit_FunctionDef(self, node: ast.FunctionDef):
-        old_function = self.current_function
-        self.current_function = node.name
-        qual_name = self.get_qualified_name(node.name)
-        self.function_defs.add(qual_name)
-        self.generic_visit(node)
-        self.current_function = old_function
-
-    def visit_AsyncFunctionDef(self, node: ast.AsyncFunctionDef):
-        self.visit_FunctionDef(node)
-
-    def visit_Call(self, node: ast.Call):
-        if self.call_depth > self.max_call_depth:
-            return
-        self.call_depth += 1
-        try:
-            caller = self.current_function or "<module>"
-            if self.current_class:
-                caller = f"{self.current_class}.{caller}"
-            
-            callee = self._resolve_callee(node.func)
-            if callee:
-                self.calls[caller].add(callee)
-                
-                if callee == caller:
-                    self.recursive_calls.append((caller, node.lineno))
-                
-                if callee not in self.function_defs and not self._is_builtin(callee):
-                    self.undefined_calls.append((caller, callee, node.lineno))
-            
-            self.generic_visit(node)
-        finally:
-            self.call_depth -= 1
-
-    def _resolve_callee(self, node: ast.AST) -> Optional[str]:
-        if isinstance(node, ast.Name):
-            return node.id
-        elif isinstance(node, ast.Attribute):
-            parts = []
-            current = node
-            while isinstance(current, ast.Attribute):
-                parts.append(current.attr)
-                current = current.value
-            if isinstance(current, ast.Name):
-                parts.append(current.id)
-                return ".".join(reversed(parts))
-            elif isinstance(current, ast.Call):
-                return "<dynamic>"
-            return ".".join(reversed(parts))
-        elif isinstance(node, ast.Call):
-            return "<dynamic>"
-        elif isinstance(node, ast.Subscript):
-            return "<subscript>"
-        elif isinstance(node, ast.Lambda):
-            return "<lambda>"
-        return None
-
-    def _is_builtin(self, name: str) -> bool:
-        builtins = {
-            "print", "len", "str", "int", "float", "list", "dict", "set", "tuple",
-            "range", "enumerate", "zip", "map", "filter", "sorted", "reversed",
-            "sum", "min", "max", "abs", "round", "pow", "divmod", "isinstance",
-            "issubclass", "hasattr", "getattr", "setattr", "delattr", "callable",
-            "type", "object", "super", "property", "staticmethod", "classmethod",
-            "open", "input", "eval", "exec", "compile", "hash", "id", "hex", "oct",
-            "bin", "chr", "ord", "ascii", "repr", "format", "vars", "locals", "globals",
-            "dir", "help", "breakpoint", "__import__", "iter", "next", "slice",
-            "property", "complex", "bool", "bytes", "bytearray", "memoryview",
-            "frozenset", "classmethod", "staticmethod", "property",
-            "Exception", "BaseException", "ValueError", "TypeError", "KeyError",
-            "IndexError", "AttributeError", "ImportError", "ModuleNotFoundError",
-            "OSError", "IOError", "RuntimeError", "StopIteration", "GeneratorExit",
-            "KeyboardInterrupt", "SystemExit", "NameError", "SyntaxError",
-        }
-        return name in builtins or name.startswith("__") and name.endswith("__")
-
-
-class Engine:
-    name = "callgraph"
-    version = "1.0.0"
-
-    async def check_availability(self) -> bool:
-        return True
-
-    def resource_limits(self) -> ResourceLimits:
-        return ResourceLimits(max_cpu_seconds=60, max_memory_mb=512, max_files=50000)
-
-    async def run(self, ctx, config: EngineConfig) -> EngineResult:
-        # Handle both single IR and list of IRs
-        if not isinstance(ctx, list):
-            ctx = [ctx]
-        all_calls: Dict[str, Set[str]] = defaultdict(set)
-        all_functions: Set[str] = set()
-        all_classes: Set[str] = set()
-        all_undefined: List[tuple] = []
-        all_recursive: List[tuple] = []
-        errors = []
-        files_processed = 0
-
-        exclude_patterns = config.toggles.get("exclude", []) if config.toggles else []
-
-        for ir in ctx:
-            try:
-                if not ir.metadata.get("language") == "python":
-                    continue
-
-                rel_path = ir.metadata.get("path", "unknown.py")
-                if any(pattern in rel_path for pattern in exclude_patterns):
-                    continue
-
-                content = ir.content.decode("utf-8", errors="replace")
-                source_lines = content.splitlines()
-                tree = ast.parse(content, filename=rel_path)
-
-                visitor = CallGraphVisitor(rel_path, source_lines)
-                visitor.visit(tree)
-
-                for caller, callees in visitor.calls.items():
-                    all_calls[caller].update(callees)
-                all_functions.update(visitor.function_defs)
-                all_classes.update(visitor.class_defs)
-                all_undefined.extend(visitor.undefined_calls)
-                all_recursive.extend(visitor.recursive_calls)
-                files_processed += 1
-
-            except SyntaxError as e:
-                errors.append(f"Syntax error in {ir.metadata.get('path', 'unknown')}: {e}")
-            except Exception as e:
-                errors.append(f"Error processing {ir.metadata.get('path', 'unknown')}: {e}")
-
-        deep_chains = self._find_deep_chains(all_calls)
-
-        call_graph = {k: list(v) for k, v in all_calls.items()}
-
-        metrics = {
-            "files_processed": files_processed,
-            "functions_defined": len(all_functions),
-            "classes_defined": len(all_classes),
-            "total_edges": sum(len(v) for v in all_calls.values()),
-            "unique_callers": len(all_calls),
-            "undefined_calls_count": len(all_undefined),
-            "recursive_calls_count": len(all_recursive),
-            "deep_chains_count": len(deep_chains),
-            "call_graph": call_graph,
-            "undefined_calls": all_undefined[:50],
-            "recursive_calls": all_recursive[:50],
-            "deep_chains": deep_chains[:20],
-        }
-
-        return EngineResult(
-            engine=self.name,
-            findings=[],
-            errors=errors,
-            metrics=metrics,
-            ok=len(errors) == 0
-        )
-
-    def _find_deep_chains(self, calls: Dict[str, Set[str]], max_depth: int = 10) -> List[tuple]:
-        chains = []
-        visited = set()
-
-        def dfs(node: str, path: List[str], depth: int):
-            if depth > max_depth:
-                chains.append((path[0], path[-1], depth, path.copy()))
-                return
-            if node in visited:
-                return
-            if node in path:
-                return
-            
-            visited.add(node)
-            path.append(node)
-            
-            for callee in calls.get(node, []):
-                dfs(callee, path, depth + 1)
-            
-            path.pop()
-            visited.discard(node)
-
-        for caller in calls:
-            dfs(caller, [], 0)
-
-        return chains