@orionscanner/cli 0.1.0 → 0.5.1

package/src/orion/engine/chaos/engine.py

@@ -1,268 +0,0 @@
-"""Chaos injection analysis engine - AST mutation analysis for resilience patterns."""
-import ast
-from orion.engine.config import EngineConfig
-from orion.engine.ir import OrionIR
-from orion.engine.results import EngineResult, Finding
-
-
-class Engine:
-    name = "chaos"
-    version = "1.0.0"
-
-    EXTERNAL_CALL_PATTERNS = {
-        "requests.get", "requests.post", "requests.put", "requests.delete", "requests.request",
-        "httpx.get", "httpx.post", "httpx.put", "httpx.delete", "httpx.request",
-        "aiohttp.ClientSession.get", "aiohttp.ClientSession.post",
-        "urllib.request.urlopen", "urllib3.request",
-        "boto3.client", "boto3.resource",
-        "redis.Redis", "redis.StrictRedis",
-        "psycopg2.connect", "mysql.connector.connect", "pymongo.MongoClient",
-        "sqlalchemy.create_engine", "asyncpg.connect",
-        "kafka.KafkaProducer", "kafka.KafkaConsumer",
-        "pika.BlockingConnection", "pika.SelectConnection",
-    }
-
-    RETRY_PATTERNS = {"retry", "backoff", "tenacity", "retrying"}
-    CIRCUIT_BREAKER_PATTERNS = {"circuitbreaker", "circuit_breaker", "pybreaker", "hystrix"}
-    TIMEOUT_PATTERNS = {"timeout", "connect_timeout", "read_timeout", "request_timeout"}
-
-    async def check_availability(self) -> bool:
-        return True
-
-    def resource_limits(self):
-        from orion.engine.config import ResourceLimits
-        return ResourceLimits(max_cpu_seconds=120, max_memory_mb=512)
-
-    async def run(self, ir: OrionIR, config: EngineConfig) -> EngineResult:
-        try:
-            text = ir.content.decode("utf-8", errors="replace")
-        except Exception:
-            return EngineResult(engine=self.name, findings=[], ok=True)
-
-        path = ir.metadata.get("path", "unknown")
-        is_test = self._is_test_file(path)
-
-        try:
-            tree = ast.parse(text, filename=path)
-        except SyntaxError:
-            return EngineResult(engine=self.name, findings=[], ok=True)
-
-        findings = []
-        visitor = ChaosVisitor(path, is_test, text.splitlines())
-        visitor.visit(tree)
-        findings.extend(visitor.findings)
-
-        return EngineResult(engine=self.name, findings=findings, ok=True)
-
-    def _is_test_file(self, path: str) -> bool:
-        return any(p in path for p in ["test_", "_test.py", "/tests/", "/test/", "conftest.py"])
-
-
-class ChaosVisitor(ast.NodeVisitor):
-    EXTERNAL_CALL_PATTERNS = {
-        "requests.get", "requests.post", "requests.put", "requests.delete", "requests.request",
-        "httpx.get", "httpx.post", "httpx.put", "httpx.delete", "httpx.request",
-        "aiohttp.ClientSession.get", "aiohttp.ClientSession.post",
-        "urllib.request.urlopen", "urllib3.request",
-        "boto3.client", "boto3.resource",
-        "redis.Redis", "redis.StrictRedis",
-        "psycopg2.connect", "mysql.connector.connect", "pymongo.MongoClient",
-        "sqlalchemy.create_engine", "asyncpg.connect",
-        "kafka.KafkaProducer", "kafka.KafkaConsumer",
-        "pika.BlockingConnection", "pika.SelectConnection",
-    }
-
-    RETRY_PATTERNS = {"retry", "backoff", "tenacity", "retrying"}
-    CIRCUIT_BREAKER_PATTERNS = {"circuitbreaker", "circuit_breaker", "pybreaker", "hystrix"}
-    TIMEOUT_PATTERNS = {"timeout", "connect_timeout", "read_timeout", "request_timeout"}
-
-    def __init__(self, filepath: str, is_test: bool, lines: list[str]):
-        self.filepath = filepath
-        self.is_test = is_test
-        self.lines = lines
-        self.findings = []
-        self.external_calls = []
-        self.has_retry = False
-        self.has_circuit_breaker = False
-        self.has_timeout = False
-        self.has_idempotency = False
-        self.global_state = set()
-        self.global_locks = set()
-        self.direct_instantiations = []
-        self.health_check_endpoints = []
-        self.module_level_threads = []
-        self.in_function = False
-        self.current_function = None
-
-    def visit_FunctionDef(self, node: ast.FunctionDef):
-        old_func = self.current_function
-        self.current_function = node.name
-        old_in_func = self.in_function
-        self.in_function = True
-
-        # First visit body to collect external calls
-        for stmt in node.body:
-            self.visit(stmt)
-
-        # Then check for chaos patterns
-        self._check_function_for_chaos_patterns(node)
-
-        self.in_function = old_in_func
-        self.current_function = old_func
-
-    def visit_AsyncFunctionDef(self, node: ast.AsyncFunctionDef):
-        self.visit_FunctionDef(node)
-
-    def visit_Call(self, node: ast.Call):
-        self._analyze_call(node)
-        self.generic_visit(node)
-
-    def visit_Assign(self, node: ast.Assign):
-        if not self.in_function:
-            for target in node.targets:
-                if isinstance(target, ast.Name):
-                    self.global_state.add(target.id)
-                    if self._is_lock_creation(node.value):
-                        self.global_locks.add(target.id)
-        self.generic_visit(node)
-
-    def visit_ClassDef(self, node: ast.ClassDef):
-        self.generic_visit(node)
-
-    def _analyze_call(self, node: ast.Call):
-        func_name = self._get_call_name(node)
-        if not func_name:
-            return
-
-        if any(pattern in func_name for pattern in self.EXTERNAL_CALL_PATTERNS):
-            self.external_calls.append((node, func_name))
-
-        if any(pattern in func_name.lower() for pattern in self.RETRY_PATTERNS):
-            self.has_retry = True
-
-        if any(pattern in func_name.lower() for pattern in self.CIRCUIT_BREAKER_PATTERNS):
-            self.has_circuit_breaker = True
-
-        if "timeout" in func_name.lower():
-            self.has_timeout = True
-
-        for kw in node.keywords:
-            if kw.arg in ("timeout", "connect_timeout", "read_timeout", "request_timeout"):
-                self.has_timeout = True
-            if kw.arg in ("idempotency_key", "idempotent"):
-                self.has_idempotency = True
-
-        if self._is_direct_instantiation(node):
-            self.direct_instantiations.append((node, func_name))
-
-    def _get_call_name(self, node: ast.Call) -> str | None:
-        if isinstance(node.func, ast.Name):
-            return node.func.id
-        elif isinstance(node.func, ast.Attribute):
-            parts = []
-            current = node.func
-            while isinstance(current, ast.Attribute):
-                parts.append(current.attr)
-                current = current.value
-            if isinstance(current, ast.Name):
-                parts.append(current.id)
-            return ".".join(reversed(parts))
-        return None
-
-    def _is_lock_creation(self, node: ast.AST) -> bool:
-        if isinstance(node, ast.Call):
-            name = self._get_call_name(node)
-            return name and ("Lock" in name or "RLock" in name or "Semaphore" in name)
-        return False
-
-    def _is_direct_instantiation(self, node: ast.Call) -> bool:
-        if isinstance(node.func, ast.Name):
-            return node.func.id[0].isupper() if node.func.id else False
-        elif isinstance(node.func, ast.Attribute):
-            return node.func.attr[0].isupper() if node.func.attr else False
-        return False
-
-    def _check_function_for_chaos_patterns(self, node: ast.FunctionDef):
-        if self.external_calls and not self.has_retry:
-            for call_node, call_name in self.external_calls:
-                self._add_finding(call_node, "no_retry",
-                    f"External call '{call_name}' without retry logic",
-                    f"Add retry with exponential backoff for resilience",
-                    confidence=0.8)
-
-        if self.external_calls and not self.has_circuit_breaker:
-            for call_node, call_name in self.external_calls:
-                self._add_finding(call_node, "no_circuit_breaker",
-                    f"External call '{call_name}' without circuit breaker",
-                    f"Add circuit breaker pattern to prevent cascade failures",
-                    confidence=0.75)
-
-        if self.external_calls and not self.has_timeout:
-            for call_node, call_name in self.external_calls:
-                self._add_finding(call_node, "no_timeout",
-                    f"External call '{call_name}' without timeout",
-                    f"Add timeout parameter (e.g., timeout=5)",
-                    confidence=0.85)
-
-        if self.external_calls and not self.has_idempotency:
-            for call_node, call_name in self.external_calls:
-                if "post" in call_name.lower() or "put" in call_name.lower() or "patch" in call_name.lower():
-                    self._add_finding(call_node, "no_idempotency_key",
-                        f"Mutating external call '{call_name}' without idempotency key",
-                        f"Add idempotency_key parameter for safe retries",
-                        confidence=0.7)
-
-    def visit_Module(self, node: ast.Module):
-        for stmt in node.body:
-            if isinstance(stmt, (ast.Import, ast.ImportFrom)):
-                for alias in stmt.names:
-                    if alias.name in ("threading", "multiprocessing", "concurrent.futures"):
-                        pass
-            elif isinstance(stmt, (ast.FunctionDef, ast.AsyncFunctionDef)):
-                pass
-            elif isinstance(stmt, ast.Assign):
-                self.visit(stmt)
-            elif isinstance(stmt, ast.Expr) and isinstance(stmt.value, ast.Call):
-                call_name = self._get_call_name(stmt.value)
-                if call_name and "Thread" in call_name:
-                    self.module_level_threads.append((stmt, call_name))
-
-        self._check_module_level_patterns()
-        self.generic_visit(node)
-
-    def _check_module_level_patterns(self):
-        for thread_node, thread_name in self.module_level_threads:
-            self._add_finding(thread_node, "module_level_threading",
-                f"Thread/process started at module level: {thread_name}",
-                "Move thread initialization to function or use lazy initialization",
-                confidence=0.8)
-
-        if len(self.global_locks) > 0:
-            for lock in self.global_locks:
-                self._add_finding(None, "global_lock_bottleneck",
-                    f"Global lock '{lock}' may create single-threaded bottleneck",
-                    "Consider fine-grained locking or lock-free data structures",
-                    confidence=0.75, line_no=1)
-
-    def _add_finding(self, node: ast.AST | None, pattern: str, title: str, fix: str, confidence: float, line_no: int | None = None):
-        if node:
-            line_no = getattr(node, "lineno", 1)
-        elif line_no is None:
-            line_no = 1
-
-        snippet = self.lines[line_no - 1].strip() if 0 < line_no <= len(self.lines) else ""
-
-        self.findings.append(Finding(
-            engine="chaos",
-            severity="high" if confidence >= 0.8 else "medium",
-            title=title,
-            description=fix,
-            location=f"{self.filepath}:{line_no}",
-            metadata={
-                "confidence": confidence,
-                "pattern": pattern,
-                "location": f"{self.filepath}:{line_no}",
-                "fix": fix,
-                "snippet": snippet[:200],
-            },
-        ))

package/src/orion/engine/chaos_config/engine.py

@@ -1,322 +0,0 @@
-"""Config chaos analysis engine - edge case testing for configuration files."""
-import json
-import re
-import tomllib
-from pathlib import Path
-from orion.engine.config import EngineConfig
-from orion.engine.ir import OrionIR
-from orion.engine.results import EngineResult, Finding
-
-
-class Engine:
-    name = "chaos_config"
-    version = "1.0.0"
-
-    POSITIVE_ONLY_KEYS = {
-        "port", "PORT", "timeout", "TIMEOUT", "retries", "RETRIES", "max_retries",
-        "workers", "WORKERS", "pool_size", "POOL_SIZE", "max_connections",
-        "MAX_CONNECTIONS", "buffer_size", "BUFFER_SIZE", "batch_size", "BATCH_SIZE",
-        "limit", "LIMIT", "page_size", "PAGE_SIZE", "ttl", "TTL", "expire", "EXPIRE",
-        "interval", "INTERVAL", "rate_limit", "RATE_LIMIT", "max_size", "MAX_SIZE",
-    }
-
-    ENUM_KEYS = {
-        "log_level": {"DEBUG", "INFO", "WARNING", "ERROR", "CRITICAL"},
-        "LOG_LEVEL": {"DEBUG", "INFO", "WARNING", "ERROR", "CRITICAL"},
-        "environment": {"development", "staging", "production", "test"},
-        "ENVIRONMENT": {"development", "staging", "production", "test"},
-        "mode": {"sync", "async", "threaded", "multiprocess"},
-        "protocol": {"http", "https", "grpc", "tcp", "udp"},
-    }
-
-    REQUIRED_SECTIONS = {
-        "database", "redis", "kafka", "rabbitmq", "email", "storage", "auth",
-        "logging", "monitoring", "security", "cache", "queue",
-    }
-
-    async def check_availability(self) -> bool:
-        return True
-
-    def resource_limits(self):
-        from orion.engine.config import ResourceLimits
-        return ResourceLimits(max_cpu_seconds=60, max_memory_mb=256)
-
-    async def run(self, ir: OrionIR, config: EngineConfig) -> EngineResult:
-        try:
-            text = ir.content.decode("utf-8", errors="replace")
-        except Exception:
-            return EngineResult(engine=self.name, findings=[], ok=True)
-
-        path = ir.metadata.get("path", "unknown")
-        filename = Path(path).name.lower()
-        ext = Path(path).suffix.lower()
-
-        findings = []
-        parsed = self._parse_config(text, filename, ext)
-
-        if parsed is not None:
-            flat = self._flatten_config(parsed)
-            findings.extend(self._check_edge_cases(flat, path, filename, ext))
-            findings.extend(self._check_circular_refs(flat, path))
-            findings.extend(self._check_overly_long(flat, path))
-            findings.extend(self._check_special_chars(flat, path))
-
-        return EngineResult(engine=self.name, findings=findings, ok=True)
-
-    def _parse_config(self, text: str, filename: str, ext: str) -> dict | None:
-        try:
-            if ext in (".yaml", ".yml"):
-                import yaml
-                return yaml.safe_load(text) or {}
-            elif ext == ".json":
-                return json.loads(text) or {}
-            elif ext == ".toml":
-                return tomllib.loads(text) or {}
-            elif ext in (".env",):
-                return self._parse_env(text)
-            elif ext in (".ini", ".cfg", ".conf"):
-                return self._parse_ini(text)
-            elif ext == ".properties":
-                return self._parse_properties(text)
-        except Exception:
-            pass
-        return None
-
-    def _parse_env(self, text: str) -> dict:
-        result = {}
-        for line in text.splitlines():
-            line = line.strip()
-            if not line or line.startswith("#"):
-                continue
-            if "=" in line:
-                key, value = line.split("=", 1)
-                result[key.strip()] = value.strip().strip('"\'')
-        return result
-
-    def _parse_ini(self, text: str) -> dict:
-        import configparser
-        parser = configparser.ConfigParser()
-        parser.read_string(text)
-        result = {}
-        for section in parser.sections():
-            for key, value in parser[section].items():
-                result[f"{section}.{key}"] = value
-        return result
-
-    def _parse_properties(self, text: str) -> dict:
-        result = {}
-        for line in text.splitlines():
-            line = line.strip()
-            if not line or line.startswith("#") or line.startswith("!"):
-                continue
-            if "=" in line:
-                key, value = line.split("=", 1)
-                result[key.strip()] = value.strip()
-            elif ":" in line:
-                key, value = line.split(":", 1)
-                result[key.strip()] = value.strip()
-        return result
-
-    def _flatten_config(self, config: dict, prefix: str = "") -> dict:
-        result = {}
-        for key, value in config.items():
-            full_key = f"{prefix}.{key}" if prefix else key
-            if isinstance(value, dict):
-                result.update(self._flatten_config(value, full_key))
-            else:
-                result[full_key] = value
-        return result
-
-    def _check_edge_cases(self, flat: dict, path: str, filename: str, ext: str) -> list[Finding]:
-        findings = []
-        for key, value in flat.items():
-            key_lower = key.lower()
-
-            if value is None or (isinstance(value, str) and value.strip() == ""):
-                findings.append(Finding(
-                    engine=self.name,
-                    severity="high",
-                    title=f"Empty/null config value: {key}",
-                    description=f"Config key '{key}' has empty or null value which may cause failures",
-                    location=path,
-                    metadata={
-                        "confidence": 0.9,
-                        "key": key,
-                        "value": "null" if value is None else '""',
-                        "risk": "null_or_empty_value",
-                    },
-                ))
-
-            if isinstance(value, (int, float)):
-                if key_lower in self.POSITIVE_ONLY_KEYS and value <= 0:
-                    findings.append(Finding(
-                        engine=self.name,
-                        severity="high",
-                        title=f"Negative/zero value for positive-only key: {key}",
-                        description=f"Key '{key}' = {value} but must be positive",
-                        location=path,
-                        metadata={
-                            "confidence": 0.95,
-                            "key": key,
-                            "value": str(value),
-                            "risk": "negative_where_positive_expected",
-                        },
-                    ))
-                if isinstance(value, (int, float)) and abs(value) > 1e9:
-                    findings.append(Finding(
-                        engine=self.name,
-                        severity="medium",
-                        title=f"Extremely large numeric value: {key}",
-                        description=f"Key '{key}' = {value} may cause overflow or performance issues",
-                        location=path,
-                        metadata={
-                            "confidence": 0.75,
-                            "key": key,
-                            "value": str(value),
-                            "risk": "very_large_number",
-                        },
-                    ))
-
-            if isinstance(value, str):
-                if key_lower in self.ENUM_KEYS:
-                    allowed = self.ENUM_KEYS[key_lower]
-                    if value.upper() not in {v.upper() for v in allowed}:
-                        findings.append(Finding(
-                            engine=self.name,
-                            severity="high",
-                            title=f"Invalid enum value: {key}",
-                            description=f"Key '{key}' = '{value}' not in allowed values: {allowed}",
-                            location=path,
-                            metadata={
-                                "confidence": 0.95,
-                                "key": key,
-                                "value": value,
-                                "risk": "invalid_enum",
-                                "allowed": list(allowed),
-                            },
-                        ))
-
-        return findings
-
-    def _check_circular_refs(self, flat: dict, path: str) -> list[Finding]:
-        findings = []
-        visited = set()
-        path_stack = []
-
-        def check_refs(obj, current_path=""):
-            if id(obj) in visited:
-                return
-            visited.add(id(obj))
-
-            if isinstance(obj, dict):
-                for k, v in obj.items():
-                    new_path = f"{current_path}.{k}" if current_path else k
-                    if isinstance(v, str) and v.startswith("${") and v.endswith("}"):
-                        ref_key = v[2:-1]
-                        if ref_key in path_stack:
-                            findings.append(Finding(
-                                engine=self.name,
-                                severity="high",
-                                title=f"Circular reference detected: {new_path}",
-                                description=f"Config reference '{v}' creates circular dependency",
-                                location=path,
-                                metadata={
-                                    "confidence": 0.9,
-                                    "key": new_path,
-                                    "value": v,
-                                    "risk": "circular_reference",
-                                    "cycle": " -> ".join(path_stack + [ref_key]),
-                                },
-                            ))
-                    path_stack.append(k)
-                    check_refs(v, new_path)
-                    path_stack.pop()
-            elif isinstance(obj, list):
-                for i, item in enumerate(obj):
-                    check_refs(item, f"{current_path}[{i}]")
-
-        check_refs(flat)
-        return findings
-
-    def _check_overly_long(self, flat: dict, path: str) -> list[Finding]:
-        findings = []
-        for key, value in flat.items():
-            if isinstance(value, str) and len(value) > 10000:
-                findings.append(Finding(
-                    engine=self.name,
-                    severity="medium",
-                    title=f"Overly long config value: {key}",
-                    description=f"Config value for '{key}' exceeds 10000 characters ({len(value)} chars)",
-                    location=path,
-                    metadata={
-                        "confidence": 0.8,
-                        "key": key,
-                        "value_length": len(value),
-                        "risk": "overly_long_string",
-                    },
-                ))
-        return findings
-
-    def _check_special_chars(self, flat: dict, path: str) -> list[Finding]:
-        findings = []
-        dangerous_chars = ["\0", "\r", "\x1b", "\x00", "\x01", "\x02", "\x03", "\x04"]
-        for key, value in flat.items():
-            if isinstance(value, str):
-                for char in dangerous_chars:
-                    if char in value:
-                        findings.append(Finding(
-                            engine=self.name,
-                            severity="high",
-                            title=f"Dangerous character in config: {key}",
-                            description=f"Config value contains control character (0x{ord(char):02x})",
-                            location=path,
-                            metadata={
-                                "confidence": 0.9,
-                                "key": key,
-                                "risk": "control_character",
-                                "char_code": f"0x{ord(char):02x}",
-                            },
-                        ))
-                        break
-
-                if key.lower().endswith(("path", "dir", "directory", "file", "cert", "key")):
-                    if any(c in value for c in ["|", "&", ";", "$", "`", ">", "<", "\n", "\r"]):
-                        findings.append(Finding(
-                            engine=self.name,
-                            severity="high",
-                            title=f"Shell metacharacters in path config: {key}",
-                            description=f"Path value contains shell metacharacters - potential injection",
-                            location=path,
-                            metadata={
-                                "confidence": 0.85,
-                                "key": key,
-                                "risk": "shell_metacharacters_in_path",
-                            },
-                        ))
-        return findings
-
-    def _check_missing_sections(self, parsed: dict, path: str, filename: str) -> list[Finding]:
-        findings = []
-        if not parsed:
-            return findings
-
-        top_keys = {k.lower() for k in parsed.keys() if not isinstance(parsed[k], dict)}
-        section_keys = {k.lower() for k in parsed.keys() if isinstance(parsed[k], dict)}
-
-        for req in self.REQUIRED_SECTIONS:
-            if req not in section_keys and req not in top_keys:
-                if any(req in k for k in section_keys) or any(req in k for k in top_keys):
-                    continue
-                findings.append(Finding(
-                    engine=self.name,
-                    severity="medium",
-                    title=f"Missing required config section: {req}",
-                    description=f"Expected configuration section '{req}' not found",
-                    location=path,
-                    metadata={
-                        "confidence": 0.7,
-                        "key": req,
-                        "issue": "missing_section",
-                    },
-                ))
-        return findings