@orionscanner/cli 0.1.0 → 0.5.1

package/src/orion/engine/complexity/engine.py

@@ -1,144 +0,0 @@
-"""Cyclomatic complexity engine - analyze function/method complexity."""
-import ast
-from orion.engine.config import EngineConfig
-from orion.engine.ir import OrionIR
-from orion.engine.results import EngineResult, Finding
-
-
-class Engine:
-    name = "complexity"
-    version = "1.0.0"
-
-    async def check_availability(self) -> bool:
-        return True
-
-    def resource_limits(self):
-        from orion.engine.config import ResourceLimits
-        return ResourceLimits(max_cpu_seconds=30, max_memory_mb=128)
-
-    async def run(self, ir: OrionIR, config: EngineConfig) -> EngineResult:
-        try:
-            text = ir.content.decode("utf-8", errors="replace")
-        except Exception:
-            text = str(ir.content)
-
-        path = ir.metadata.get("path", "unknown")
-        findings = []
-        metrics = {"functions": []}
-
-        if not path.endswith(".py"):
-            return EngineResult(engine=self.name, findings=findings, metrics=metrics, ok=True)
-
-        try:
-            tree = ast.parse(text)
-        except SyntaxError as e:
-            return EngineResult(engine=self.name, findings=findings, metrics=metrics, ok=True, errors=[str(e)])
-
-        lines = text.splitlines()
-
-        for node in ast.walk(tree):
-            if isinstance(node, (ast.FunctionDef, ast.AsyncFunctionDef)):
-                cc = self._calculate_cyclomatic_complexity(node)
-                cognitive = self._calculate_cognitive_complexity(node)
-                func_metrics = {
-                    "name": node.name,
-                    "line": node.lineno,
-                    "cyclomatic_complexity": cc,
-                    "cognitive_complexity": cognitive,
-                }
-                metrics["functions"].append(func_metrics)
-
-                if cc > 20:
-                    severity = "critical" if cc > 50 else "high"
-                    findings.append(Finding(
-                        engine=self.name,
-                        severity=severity,
-                        title=f"High cyclomatic complexity: {node.name} (CC={cc})",
-                        description=f"Function '{node.name}' has cyclomatic complexity of {cc} (cognitive: {cognitive}) - consider refactoring",
-                        location=f"{path}:{node.lineno}",
-                        metadata={
-                            "confidence": 1.0,
-                            "snippet": self._get_snippet(lines, node.lineno),
-                            "function": node.name,
-                            "cyclomatic_complexity": cc,
-                            "cognitive_complexity": cognitive,
-                            "threshold": "critical" if cc > 50 else "high",
-                            "cwe": "CWE-1121",
-                            "cvss": 4.0,
-                        },
-                    ))
-                elif cc > 10:
-                    findings.append(Finding(
-                        engine=self.name,
-                        severity="medium",
-                        title=f"Elevated cyclomatic complexity: {node.name} (CC={cc})",
-                        description=f"Function '{node.name}' has cyclomatic complexity of {cc} - monitor for maintainability",
-                        location=f"{path}:{node.lineno}",
-                        metadata={
-                            "confidence": 1.0,
-                            "snippet": self._get_snippet(lines, node.lineno),
-                            "function": node.name,
-                            "cyclomatic_complexity": cc,
-                            "cognitive_complexity": cognitive,
-                            "threshold": "medium",
-                            "cwe": "CWE-1121",
-                        },
-                    ))
-
-        return EngineResult(engine=self.name, findings=findings, metrics=metrics, ok=True)
-
-    def _calculate_cyclomatic_complexity(self, node: ast.FunctionDef) -> int:
-        complexity = 1
-        for child in ast.walk(node):
-            if isinstance(child, (ast.If, ast.While, ast.For, ast.AsyncFor)):
-                complexity += 1
-            elif isinstance(child, ast.ExceptHandler):
-                complexity += 1
-            elif isinstance(child, ast.BoolOp):
-                complexity += len(child.values) - 1
-            elif isinstance(child, ast.With):
-                complexity += 1
-            elif isinstance(child, (ast.ListComp, ast.SetComp, ast.DictComp, ast.GeneratorExp)):
-                complexity += 1
-            elif isinstance(child, ast.IfExp):
-                complexity += 1
-            elif isinstance(child, ast.Match):
-                complexity += len(child.cases)
-        return complexity
-
-    def _calculate_cognitive_complexity(self, node: ast.FunctionDef) -> int:
-        complexity = 0
-        nesting = 0
-
-        def walk(n, nest_level):
-            nonlocal complexity
-            current_nest = nest_level
-            if isinstance(n, (ast.If, ast.While, ast.For, ast.AsyncFor, ast.With, ast.Try)):
-                current_nest = nest_level + 1
-                complexity += current_nest
-            elif isinstance(n, ast.ExceptHandler):
-                complexity += nest_level + 1
-            elif isinstance(n, ast.BoolOp):
-                complexity += len(n.values) - 1
-            elif isinstance(n, ast.IfExp):
-                complexity += nest_level + 1
-            elif isinstance(n, (ast.ListComp, ast.SetComp, ast.DictComp, ast.GeneratorExp)):
-                complexity += nest_level + 1
-            elif isinstance(n, ast.Match):
-                complexity += len(n.cases) * (nest_level + 1)
-                current_nest = nest_level + 1
-            elif isinstance(n, (ast.FunctionDef, ast.AsyncFunctionDef, ast.ClassDef, ast.Lambda)):
-                return
-
-            for child in ast.iter_child_nodes(n):
-                walk(child, current_nest)
-
-        walk(node, 0)
-        return complexity
-
-    def _get_snippet(self, lines: list, line_no: int, context: int = 3) -> str:
-        if line_no <= 0:
-            return ""
-        start = max(0, line_no - context - 1)
-        end = min(len(lines), line_no + context)
-        return "\n".join(lines[start:end])

package/src/orion/engine/compliance/engine.py

@@ -1,325 +0,0 @@
-"""Compliance mapping engine - maps findings to compliance frameworks."""
-from typing import List, Dict, Any, Optional
-from dataclasses import dataclass
-from collections import defaultdict
-
-from orion.engine.config import EngineConfig
-from orion.engine.ir import OrionIR
-from orion.engine.results import EngineResult, Finding
-
-
-@dataclass
-class ComplianceMapping:
-    framework: str
-    article: str
-    control: str
-    description: str
-
-
-class ComplianceEngine:
-    name = "compliance"
-    version = "1.0.0"
-
-    # Mapping from finding patterns to compliance frameworks
-    COMPLIANCE_MAP = {
-        # GDPR mappings
-        "sql_injection": [
-            ComplianceMapping("GDPR", "Art. 32", "security_of_processing", "SQL injection allows unauthorized access to personal data"),
-            ComplianceMapping("GDPR", "Art. 25", "privacy_by_design", "Lack of parameterized queries violates privacy by design"),
-        ],
-        "xss": [
-            ComplianceMapping("GDPR", "Art. 32", "security_of_processing", "XSS can lead to personal data theft"),
-            ComplianceMapping("GDPR", "Art. 25", "privacy_by_design", "Missing output encoding violates privacy by design"),
-        ],
-        "path_traversal": [
-            ComplianceMapping("GDPR", "Art. 32", "security_of_processing", "Path traversal can expose personal data files"),
-        ],
-        "hardcoded_secret": [
-            ComplianceMapping("GDPR", "Art. 32", "encryption_at_rest", "Hardcoded secrets violate encryption requirements"),
-            ComplianceMapping("GDPR", "Art. 33", "breach_notification", "Exposed secrets require breach notification"),
-        ],
-        "hardcoded_credential": [
-            ComplianceMapping("GDPR", "Art. 32", "encryption_at_rest", "Hardcoded credentials violate encryption requirements"),
-        ],
-        "weak_crypto": [
-            ComplianceMapping("GDPR", "Art. 32", "encryption_at_rest", "Weak cryptography fails to protect personal data"),
-            ComplianceMapping("GDPR", "Art. 25", "privacy_by_design", "Weak crypto violates privacy by design"),
-        ],
-        "md5": [
-            ComplianceMapping("GDPR", "Art. 32", "encryption_at_rest", "MD5 is cryptographically broken"),
-        ],
-        "sha1": [
-            ComplianceMapping("GDPR", "Art. 32", "encryption_at_rest", "SHA1 is cryptographically weak"),
-        ],
-        "insecure_deserialization": [
-            ComplianceMapping("GDPR", "Art. 32", "security_of_processing", "Deserialization vulnerabilities can lead to data breach"),
-        ],
-        "missing_auth": [
-            ComplianceMapping("GDPR", "Art. 32", "access_control", "Missing authentication violates access control requirements"),
-        ],
-        "authorization_bypass": [
-            ComplianceMapping("GDPR", "Art. 32", "access_control", "Authorization bypass allows unauthorized data access"),
-        ],
-        "pii_logging": [
-            ComplianceMapping("GDPR", "Art. 32", "security_of_processing", "Logging PII exposes personal data"),
-            ComplianceMapping("GDPR", "Art. 25", "data_minimization", "Logging PII violates data minimization"),
-        ],
-        "sensitive_data_logging": [
-            ComplianceMapping("GDPR", "Art. 32", "security_of_processing", "Logging sensitive data exposes it"),
-        ],
-        "missing_csp": [
-            ComplianceMapping("GDPR", "Art. 32", "security_of_processing", "Missing CSP increases XSS risk"),
-        ],
-
-        # PCI-DSS mappings
-        "sql_injection": [
-            ComplianceMapping("PCI-DSS", "Req 6.5.1", "injection_flaws", "SQL injection is a primary injection flaw"),
-        ],
-        "xss": [
-            ComplianceMapping("PCI-DSS", "Req 6.5.7", "cross_site_scripting", "XSS is explicitly mentioned in PCI-DSS"),
-        ],
-        "hardcoded_secret": [
-            ComplianceMapping("PCI-DSS", "Req 3", "protect_stored_data", "Hardcoded secrets violate stored data protection"),
-            ComplianceMapping("PCI-DSS", "Req 8", "identify_authenticate", "Hardcoded credentials violate authentication requirements"),
-        ],
-        "weak_crypto": [
-            ComplianceMapping("PCI-DSS", "Req 3.4", "encrypt_transmission", "Weak crypto fails to protect cardholder data"),
-            ComplianceMapping("PCI-DSS", "Req 4", "encrypt_transmission", "Weak crypto in transit violates encryption requirements"),
-        ],
-        "md5": [
-            ComplianceMapping("PCI-DSS", "Req 3.4", "encrypt_transmission", "MD5 not allowed for protecting cardholder data"),
-        ],
-        "sha1": [
-            ComplianceMapping("PCI-DSS", "Req 3.4", "encrypt_transmission", "SHA1 not allowed for protecting cardholder data"),
-        ],
-        "missing_auth": [
-            ComplianceMapping("PCI-DSS", "Req 8", "identify_authenticate", "Missing authentication violates Req 8"),
-        ],
-        "insecure_deserialization": [
-            ComplianceMapping("PCI-DSS", "Req 6.5.8", "insecure_deserialization", "Insecure deserialization is a software vulnerability"),
-        ],
-        "path_traversal": [
-            ComplianceMapping("PCI-DSS", "Req 6.5.5", "improper_access_control", "Path traversal is improper access control"),
-        ],
-
-        # SOC2 mappings
-        "sql_injection": [
-            ComplianceMapping("SOC2", "CC6.1", "logical_access", "SQL injection bypasses logical access controls"),
-        ],
-        "xss": [
-            ComplianceMapping("SOC2", "CC6.1", "logical_access", "XSS bypasses logical access controls"),
-        ],
-        "hardcoded_secret": [
-            ComplianceMapping("SOC2", "CC6.1", "logical_access", "Hardcoded secrets bypass logical access controls"),
-            ComplianceMapping("SOC2", "CC6.7", "data_transmission", "Secrets in code can be transmitted"),
-        ],
-        "weak_crypto": [
-            ComplianceMapping("SOC2", "CC6.7", "data_transmission", "Weak crypto fails to protect data in transmission"),
-        ],
-        "missing_auth": [
-            ComplianceMapping("SOC2", "CC6.1", "logical_access", "Missing authentication violates logical access"),
-        ],
-        "authorization_bypass": [
-            ComplianceMapping("SOC2", "CC6.1", "logical_access", "Authorization bypass violates logical access"),
-        ],
-        "pii_logging": [
-            ComplianceMapping("SOC2", "CC6.7", "data_transmission", "Logging PII exposes data in transmission"),
-        ],
-        "missing_csp": [
-            ComplianceMapping("SOC2", "CC7.2", "system_monitoring", "Missing CSP reduces monitoring effectiveness"),
-        ],
-        "insecure_deserialization": [
-            ComplianceMapping("SOC2", "CC6.1", "logical_access", "Deserialization bypasses logical access"),
-        ],
-
-        # HIPAA mappings
-        "sql_injection": [
-            ComplianceMapping("HIPAA", "164.312(a)(1)", "access_control", "SQL injection bypasses access control"),
-        ],
-        "xss": [
-            ComplianceMapping("HIPAA", "164.312(a)(1)", "access_control", "XSS bypasses access control"),
-        ],
-        "hardcoded_secret": [
-            ComplianceMapping("HIPAA", "164.312(a)(1)", "access_control", "Hardcoded secrets bypass access control"),
-            ComplianceMapping("HIPAA", "164.312(e)(1)", "transmission_security", "Secrets in code violate transmission security"),
-        ],
-        "weak_crypto": [
-            ComplianceMapping("HIPAA", "164.312(e)(1)", "transmission_security", "Weak crypto violates transmission security"),
-            ComplianceMapping("HIPAA", "164.312(a)(2)(iv)", "encryption", "Weak crypto fails encryption standard"),
-        ],
-        "md5": [
-            ComplianceMapping("HIPAA", "164.312(e)(1)", "transmission_security", "MD5 not approved for ePHI"),
-        ],
-        "sha1": [
-            ComplianceMapping("HIPAA", "164.312(e)(1)", "transmission_security", "SHA1 not approved for ePHI"),
-        ],
-        "insecure_deserialization": [
-            ComplianceMapping("HIPAA", "164.312(a)(1)", "access_control", "Deserialization bypasses access control"),
-        ],
-        "pii_logging": [
-            ComplianceMapping("HIPAA", "164.312(a)(1)", "access_control", "Logging ePHI violates access control"),
-            ComplianceMapping("HIPAA", "164.312(b)", "audit_controls", "Improper logging violates audit controls"),
-        ],
-        "missing_auth": [
-            ComplianceMapping("HIPAA", "164.312(a)(1)", "access_control", "Missing authentication violates access control"),
-        ],
-
-        # Additional mappings
-        "cmd_injection": [
-            ComplianceMapping("GDPR", "Art. 32", "security_of_processing", "Command injection allows system compromise"),
-            ComplianceMapping("PCI-DSS", "Req 6.5.1", "injection_flaws", "Command injection is an injection flaw"),
-            ComplianceMapping("SOC2", "CC6.1", "logical_access", "Command injection bypasses logical access"),
-            ComplianceMapping("HIPAA", "164.312(a)(1)", "access_control", "Command injection bypasses access control"),
-        ],
-        "ssrf": [
-            ComplianceMapping("GDPR", "Art. 32", "security_of_processing", "SSRF allows internal network access"),
-            ComplianceMapping("PCI-DSS", "Req 1.3", "network_segmentation", "SSRF bypasses network segmentation"),
-            ComplianceMapping("SOC2", "CC6.1", "logical_access", "SSRF bypasses logical access"),
-        ],
-        "missing_healthcheck": [
-            ComplianceMapping("SOC2", "CC7.2", "system_monitoring", "Missing health checks reduce monitoring"),
-        ],
-        "missing_resource_limits": [
-            ComplianceMapping("SOC2", "CC7.2", "system_monitoring", "Missing resource limits affect availability"),
-        ],
-        "privileged_container": [
-            ComplianceMapping("GDPR", "Art. 32", "security_of_processing", "Privileged containers increase attack surface"),
-            ComplianceMapping("PCI-DSS", "Req 2.2", "secure_configuration", "Privileged containers violate secure config"),
-            ComplianceMapping("SOC2", "CC6.1", "logical_access", "Privileged containers bypass logical access"),
-        ],
-        "run_as_root": [
-            ComplianceMapping("GDPR", "Art. 32", "security_of_processing", "Running as root increases risk"),
-            ComplianceMapping("PCI-DSS", "Req 2.2", "secure_configuration", "Running as root violates secure config"),
-        ],
-        "allow_privilege_escalation": [
-            ComplianceMapping("GDPR", "Art. 32", "security_of_processing", "Privilege escalation increases risk"),
-            ComplianceMapping("PCI-DSS", "Req 2.2", "secure_configuration", "Privilege escalation violates secure config"),
-        ],
-        "host_network": [
-            ComplianceMapping("PCI-DSS", "Req 1.3", "network_segmentation", "Host network bypasses segmentation"),
-        ],
-        "missing_egress_control": [
-            ComplianceMapping("PCI-DSS", "Req 1.3", "network_segmentation", "Missing egress control violates segmentation"),
-            ComplianceMapping("SOC2", "CC6.7", "data_transmission", "Missing egress control allows data exfiltration"),
-        ],
-    }
-
-    async def check_availability(self) -> bool:
-        return True
-
-    def resource_limits(self):
-        from orion.engine.config import ResourceLimits
-        return ResourceLimits(max_cpu_seconds=10, max_memory_mb=64)
-
-    def _extract_pattern_key(self, finding: Finding) -> str:
-        """Extract normalized pattern key from finding."""
-        # Try metadata first
-        pattern = finding.metadata.get("pattern", "")
-        if pattern:
-            return pattern.lower()
-
-        # Try title
-        title = finding.title.lower()
-        # Map common patterns
-        patterns = [
-            "sql_injection", "sqli", "xss", "cmd_injection", "ssrf",
-            "path_traversal", "hardcoded_secret", "hardcoded_credential",
-            "weak_crypto", "md5", "sha1", "insecure_deserialization",
-            "pickle", "yaml", "eval", "exec", "subprocess", "shell",
-            "missing_auth", "authorization", "csp", "logging",
-            "pii", "sensitive", "privileged", "run_as_root",
-            "allow_privilege_escalation", "host_network", "host_pid", "host_ipc",
-            "missing_healthcheck", "missing_resource_limits", "read_only",
-            "cap_add", "network_mode", "pid_mode", "ipc_mode",
-            "missing_egress_control", "allow_all_outbound",
-        ]
-        for p in patterns:
-            if p in title:
-                return p
-        return title[:50]
-
-    def _get_mappings(self, pattern_key: str) -> List[ComplianceMapping]:
-        """Get compliance mappings for a pattern key."""
-        mappings = []
-        for key, comp_mappings in self.COMPLIANCE_MAP.items():
-            if key in pattern_key or pattern_key in key:
-                mappings.extend(comp_mappings)
-        return mappings
-
-    async def run(self, ir: OrionIR, config: EngineConfig) -> EngineResult:
-        # Get all findings from context
-        all_findings = ir.metadata.get("all_findings", [])
-
-        # Also check project context
-        project_ctx = ir.metadata.get("project_context")
-        if project_ctx and hasattr(project_ctx, 'findings'):
-            all_findings.extend(project_ctx.findings)
-
-        if not all_findings:
-            return EngineResult(engine=self.name, ok=True, metrics={"findings_processed": 0})
-
-        # Process each finding and add compliance metadata
-        enriched_findings = []
-        compliance_stats = defaultdict(int)
-
-        for finding in all_findings:
-            pattern_key = self._extract_pattern_key(finding)
-            mappings = self._get_mappings(pattern_key)
-
-            if mappings:
-                # Add compliance metadata to finding
-                compliance_metadata = []
-                for m in mappings:
-                    compliance_metadata.append({
-                        "framework": m.framework,
-                        "article": m.article,
-                        "control": m.control,
-                        "description": m.description,
-                    })
-                    compliance_stats[m.framework] += 1
-
-                # Create enriched finding with compliance metadata
-                enriched = Finding(
-                    engine=finding.engine,
-                    severity=finding.severity,
-                    title=finding.title,
-                    description=finding.description,
-                    location=finding.location,
-                    metadata={
-                        **finding.metadata,
-                        "compliance": compliance_metadata,
-                    },
-                )
-                enriched_findings.append(enriched)
-            else:
-                enriched_findings.append(finding)
-
-        # Create summary finding
-        if compliance_stats:
-            summary = Finding(
-                engine=self.name,
-                severity="info",
-                title="Compliance mapping summary",
-                description=f"Mapped findings to compliance frameworks: {dict(compliance_stats)}",
-                location="",
-                metadata={
-                    "rule": "compliance_summary",
-                    "frameworks": dict(compliance_stats),
-                    "total_mappings": sum(compliance_stats.values()),
-                },
-            )
-            enriched_findings.append(summary)
-
-        return EngineResult(
-            engine=self.name,
-            findings=enriched_findings,
-            ok=True,
-            metrics={
-                "findings_processed": len(all_findings),
-                "findings_with_mappings": len([f for f in enriched_findings if "compliance" in f.metadata]),
-                "compliance_stats": dict(compliance_stats),
-            },
-        )
-
-
-Engine = ComplianceEngine

package/src/orion/engine/config.py

@@ -1,41 +0,0 @@
-import hashlib
-from dataclasses import dataclass, field
-from typing import Optional
-
-
-@dataclass
-class ResourceLimits:
-    max_memory_mb: int = 512
-    max_cpu_seconds: int = 60
-    max_file_size_mb: int = 10
-    max_files: int = 50000
-
-
-@dataclass
-class NetworkPolicy:
-    allow_outbound: bool = False
-    allowed_hosts: list = field(default_factory=list)
-
-
-@dataclass
-class EngineConfig:
-    toggles: dict = field(default_factory=dict)
-    resource_limits: dict = field(default_factory=dict)
-    network_policy: dict = field(default_factory=dict)
-
-    def get_limits(self) -> ResourceLimits:
-        defaults = ResourceLimits()
-        rl = self.resource_limits or {}
-        return ResourceLimits(
-            max_memory_mb=rl.get("max_memory_mb", defaults.max_memory_mb),
-            max_cpu_seconds=rl.get("max_cpu_seconds", defaults.max_cpu_seconds),
-            max_file_size_mb=rl.get("max_file_size_mb", defaults.max_file_size_mb),
-            max_files=rl.get("max_files", defaults.max_files),
-        )
-
-    def get_network_policy(self) -> NetworkPolicy:
-        np = self.network_policy or {}
-        return NetworkPolicy(
-            allow_outbound=np.get("allow_outbound", False),
-            allowed_hosts=np.get("allowed_hosts", []),
-        )