@orionscanner/cli 0.1.0

package/src/orion/engine/contract_probe/engine.py

@@ -0,0 +1,316 @@
+"""External contract analysis engine - HTTP call security scanning."""
+import ast
+import re
+from orion.engine.config import EngineConfig
+from orion.engine.ir import OrionIR
+from orion.engine.results import EngineResult, Finding
+
+
+class Engine:
+    name = "contract_probe"
+    version = "1.0.0"
+
+    HTTP_CALL_PATTERNS = [
+        ("requests", "get"),
+        ("requests", "post"),
+        ("requests", "put"),
+        ("requests", "delete"),
+        ("requests", "patch"),
+        ("requests", "request"),
+        ("httpx", "get"),
+        ("httpx", "post"),
+        ("httpx", "put"),
+        ("httpx", "delete"),
+        ("httpx", "patch"),
+        ("httpx", "request"),
+        ("httpx.AsyncClient", "get"),
+        ("httpx.AsyncClient", "post"),
+        ("httpx.AsyncClient", "put"),
+        ("httpx.AsyncClient", "delete"),
+        ("httpx.AsyncClient", "patch"),
+        ("httpx.AsyncClient", "request"),
+        ("urllib.request", "urlopen"),
+        ("urllib.request", "Request"),
+        ("aiohttp.ClientSession", "get"),
+        ("aiohttp.ClientSession", "post"),
+        ("aiohttp.ClientSession", "put"),
+        ("aiohttp.ClientSession", "delete"),
+        ("aiohttp.ClientSession", "patch"),
+        ("aiohttp.ClientSession", "request"),
+    ]
+
+    async def check_availability(self) -> bool:
+        return True
+
+    def resource_limits(self):
+        from orion.engine.config import ResourceLimits
+        return ResourceLimits(max_cpu_seconds=60, max_memory_mb=256)
+
+    async def run(self, ir: OrionIR, config: EngineConfig) -> EngineResult:
+        try:
+            text = ir.content.decode("utf-8", errors="replace")
+        except Exception:
+            text = str(ir.content)
+
+        path = ir.metadata.get("path", "unknown")
+        findings = []
+
+        code_extensions = {".py", ".js", ".jsx", ".ts", ".tsx", ".go", ".java", ".rs", ".rb", ".php", ".cs"}
+        if not any(path.endswith(ext) for ext in code_extensions):
+            return EngineResult(engine=self.name, findings=[], ok=True)
+
+        if path.endswith(".py"):
+            findings.extend(self._analyze_python(text, path))
+        else:
+            findings.extend(self._analyze_generic(text, path))
+
+        return EngineResult(engine=self.name, findings=findings, ok=True)
+
+    def _analyze_python(self, text: str, path: str):
+        findings = []
+        try:
+            tree = ast.parse(text)
+        except SyntaxError:
+            return self._analyze_generic(text, path)
+
+        lines = text.splitlines()
+
+        for node in ast.walk(tree):
+            if isinstance(node, ast.Call):
+                findings.extend(self._check_call(node, lines, path))
+
+        return findings
+
+    def _check_call(self, node: ast.Call, lines: list, path: str):
+        findings = []
+
+        func_name = self._get_call_name(node)
+        if not func_name:
+            return findings
+
+        # Match genuine HTTP clients and libraries
+        http_clients = ("requests", "httpx", "urllib.request", "aiohttp", "client", "session", "http_client", "api_client")
+        is_http_call = False
+        for mod, method in self.HTTP_CALL_PATTERNS:
+            if func_name == f"{mod}.{method}":
+                is_http_call = True
+                break
+        if not is_http_call:
+            parts = func_name.split(".")
+            if len(parts) >= 2 and parts[-1] in ("get", "post", "put", "delete", "patch", "request"):
+                caller = ".".join(parts[:-1]).lower()
+                if any(caller == c or caller.endswith(f".{c}") for c in http_clients):
+                    is_http_call = True
+
+        if not is_http_call:
+            return findings
+
+        line_no = getattr(node, "lineno", 0)
+        snippet = self._get_snippet(lines, line_no)
+
+        missing = []
+        confidence_factors = []
+
+        if not self._has_timeout(node):
+            missing.append("timeout")
+            confidence_factors.append(0.8)
+
+        if not self._has_retry(node):
+            missing.append("retry/backoff")
+            confidence_factors.append(0.7)
+
+        if not self._has_max_size(node):
+            missing.append("max response size")
+            confidence_factors.append(0.7)
+
+        if not self._has_circuit_breaker(node):
+            missing.append("circuit breaker")
+            confidence_factors.append(0.6)
+
+        if self._has_verify_false(node):
+            findings.append(Finding(
+                engine=self.name,
+                severity="high",
+                title="SSL verification disabled",
+                description=f"HTTP call {func_name} has verify=False, disabling certificate validation",
+                location=f"{path}:{line_no}",
+                metadata={
+                    "confidence": 0.95,
+                    "snippet": snippet,
+                    "call": func_name,
+                    "issue": "verify=False",
+                    "cwe": "CWE-295",
+                    "cvss": 7.4,
+                },
+            ))
+
+        if self._has_hardcoded_secret_url(node):
+            findings.append(Finding(
+                engine=self.name,
+                severity="high",
+                title="Hardcoded URL with potential secrets",
+                description=f"HTTP call {func_name} contains hardcoded URL with embedded credentials",
+                location=f"{path}:{line_no}",
+                metadata={
+                    "confidence": 0.85,
+                    "snippet": snippet,
+                    "call": func_name,
+                    "issue": "hardcoded_secret_in_url",
+                    "cwe": "CWE-798",
+                    "cvss": 7.5,
+                },
+            ))
+
+        if not self._has_auth_header(node) and self._is_external_call(node):
+            missing.append("authentication header")
+            confidence_factors.append(0.75)
+
+        if missing:
+            confidence = max(confidence_factors) if confidence_factors else 0.75
+            findings.append(Finding(
+                engine=self.name,
+                severity="medium",
+                title=f"Missing HTTP protections in {func_name}",
+                description=f"External call missing: {', '.join(missing)}",
+                location=f"{path}:{line_no}",
+                metadata={
+                    "confidence": round(confidence, 2),
+                    "snippet": snippet,
+                    "call": func_name,
+                    "missing": missing,
+                    "cwe": "CWE-1188",
+                    "cvss": 5.3,
+                },
+            ))
+
+        return findings
+
+    def _get_call_name(self, node) -> str:
+        if isinstance(node, ast.Call):
+            return self._get_call_name(node.func)
+        if isinstance(node, ast.Attribute):
+            if isinstance(node.value, ast.Attribute):
+                return f"{self._get_call_name(node.value)}.{node.attr}"
+            elif isinstance(node.value, ast.Name):
+                return f"{node.value.id}.{node.attr}"
+            elif isinstance(node.value, ast.Call):
+                return f"{self._get_call_name(node.value)}.{node.attr}"
+        elif isinstance(node, ast.Name):
+            return node.id
+        return ""
+
+    def _has_timeout(self, node: ast.Call) -> bool:
+        for kw in node.keywords:
+            if kw.arg in ("timeout", "timeout_seconds", "read_timeout", "connect_timeout"):
+                return True
+        return False
+
+    def _has_retry(self, node: ast.Call) -> bool:
+        for kw in node.keywords:
+            if kw.arg in ("retries", "max_retries", "retry", "backoff_factor", "backoff"):
+                return True
+        return False
+
+    def _has_max_size(self, node: ast.Call) -> bool:
+        for kw in node.keywords:
+            if kw.arg in ("max_size", "max_content_size", "stream"):
+                return True
+        return False
+
+    def _has_circuit_breaker(self, node: ast.Call) -> bool:
+        for kw in node.keywords:
+            if kw.arg in ("circuit_breaker", "breaker", "failure_threshold"):
+                return True
+        return False
+
+    def _has_verify_false(self, node: ast.Call) -> bool:
+        for kw in node.keywords:
+            if kw.arg == "verify":
+                if isinstance(kw.value, ast.Constant) and kw.value.value is False:
+                    return True
+        return False
+
+    def _has_hardcoded_secret_url(self, node: ast.Call) -> bool:
+        for arg in node.args:
+            if isinstance(arg, ast.Constant) and isinstance(arg.value, str):
+                url = arg.value
+                if re.search(r"https?://[^:]+:[^@]+@", url):
+                    return True
+                if re.search(r"(api[_-]?key|token|secret|password)=[^&]+", url):
+                    return True
+        for kw in node.keywords:
+            if kw.arg in ("url", "uri") and isinstance(kw.value, ast.Constant):
+                url = kw.value.value
+                if re.search(r"https?://[^:]+:[^@]+@", url):
+                    return True
+        return False
+
+    def _has_auth_header(self, node: ast.Call) -> bool:
+        for kw in node.keywords:
+            if kw.arg in ("headers", "auth"):
+                if isinstance(kw.value, ast.Dict):
+                    for key in kw.value.keys:
+                        if isinstance(key, ast.Constant) and isinstance(key.value, str):
+                            if key.value.lower() in ("authorization", "x-api-key", "api-key", "bearer"):
+                                return True
+                elif isinstance(kw.value, ast.Call):
+                    if isinstance(kw.value.func, ast.Name) and kw.value.func.id in ("HTTPBasicAuth", "HTTPDigestAuth", "BearerToken"):
+                        return True
+        return False
+
+    def _is_external_call(self, node: ast.Call) -> bool:
+        for arg in node.args:
+            if isinstance(arg, ast.Constant) and isinstance(arg.value, str):
+                url = arg.value
+                if url.startswith("http://") or url.startswith("https://"):
+                    if not any(x in url for x in ["localhost", "127.0.0.1", "0.0.0.0", "[::1]"]):
+                        return True
+        for kw in node.keywords:
+            if kw.arg in ("url", "uri") and isinstance(kw.value, ast.Constant):
+                url = kw.value.value
+                if url.startswith("http://") or url.startswith("https://"):
+                    if not any(x in url for x in ["localhost", "127.0.0.1", "0.0.0.0", "[::1]"]):
+                        return True
+        return False
+
+    def _analyze_generic(self, text: str, path: str):
+        findings = []
+        lines = text.splitlines()
+
+        http_patterns = [
+            r"requests\.(?:get|post|put|delete|patch|request)\s*\(",
+            r"httpx\.(?:get|post|put|delete|patch|request)\s*\(",
+            r"fetch\s*\(",
+            r"axios\.(?:get|post|put|delete|patch|request)\s*\(",
+            r"curl\s+",
+            r"urllib\.request\.urlopen\s*\(",
+        ]
+
+        for i, line in enumerate(lines):
+            for pattern in http_patterns:
+                if re.search(pattern, line):
+                    if "timeout" not in line and "retry" not in line:
+                        findings.append(Finding(
+                            engine=self.name,
+                            severity="medium",
+                            title="Potential HTTP call missing protections",
+                            description=f"HTTP call pattern detected without visible timeout/retry",
+                            location=f"{path}:{i+1}",
+                            metadata={
+                                "confidence": 0.6,
+                                "snippet": line.strip()[:200],
+                                "pattern": pattern,
+                                "cwe": "CWE-1188",
+                                "cvss": 5.3,
+                            },
+                        ))
+                    break
+
+        return findings
+
+    def _get_snippet(self, lines: list, line_no: int, context: int = 2) -> str:
+        if line_no <= 0:
+            return ""
+        start = max(0, line_no - context - 1)
+        end = min(len(lines), line_no + context)
+        return "\n".join(lines[start:end])

package/src/orion/engine/core.py

@@ -0,0 +1,75 @@
+import asyncio
+import logging
+import time
+from typing import Dict, List, Callable, Optional
+
+from orion.engine.config import EngineConfig
+from orion.engine.ir import OrionIR
+from orion.engine.results import EngineResult, Finding
+from orion.engine.registry import EngineRegistry
+
+logger = logging.getLogger(__name__)
+
+
+class OrionEngine:
+    def __init__(self, registry: EngineRegistry | None = None):
+        self._registry = registry or EngineRegistry()
+        self._engines: Dict[str, type] = {}
+        self._engines.update(self._registry.all())
+
+    def register_engine(self, name: str, engine_cls: type) -> None:
+        self._engines[name] = engine_cls
+
+    @property
+    def registered_count(self) -> int:
+        return len(self._engines)
+
+    async def run(
+        self,
+        irs: List[OrionIR],
+        config: EngineConfig,
+        on_progress: Optional[Callable[[int, int, str, str], None]] = None
+    ) -> EngineResult:
+        start = time.monotonic()
+        all_findings: List[Finding] = []
+        all_errors: List[str] = []
+        engines_run = 0
+
+        # Initialize engines once
+        instantiated_engines = {}
+        for name, cls in self._engines.items():
+            try:
+                instantiated_engines[name] = cls()
+            except Exception as e:
+                all_errors.append(f"Init {name}: {e}")
+
+        total_files = len(irs)
+        # Process IRs with live progress reporting
+        for idx, ir in enumerate(irs, 1):
+            path = ir.metadata.get("path", "")
+            if on_progress:
+                on_progress(idx, total_files, path, "Scanning 42 Engines")
+
+            for name, engine in instantiated_engines.items():
+                try:
+                    res = await engine.run(ir, config)
+                    engines_run += 1
+                    if res and res.findings:
+                        all_findings.extend(res.findings)
+                    if res and res.errors:
+                        all_errors.extend([f"{name}: {e}" for e in res.errors])
+                except Exception as exc:
+                    all_errors.append(f"{name}: {exc}")
+
+        if on_progress:
+            on_progress(total_files, total_files, "Finalizing", "Aggregating Findings & Metrics")
+
+        elapsed = time.monotonic() - start
+
+        return EngineResult(
+            engine="orion",
+            findings=all_findings,
+            errors=all_errors,
+            metrics={"elapsed_s": round(elapsed, 3), "engines_run": engines_run, "files_scanned": len(irs)},
+            ok=not all_errors,
+        )

package/src/orion/engine/crypto_guard/engine.py

@@ -0,0 +1,134 @@
+"""Cryptographic Flaws, Weak Ciphers, and Key Hygiene Auditor.
+
+100% Custom In-House Developed Engine for Orion Engine Platform.
+Detects broken hashes (MD5, SHA1), weak ciphers (DES, RC4, ECB), insecure PRNGs, and short key lengths.
+"""
+import re
+from pathlib import Path
+from typing import List, Dict, Any
+
+from orion.engine.config import EngineConfig, ResourceLimits
+from orion.engine.ir import OrionIR
+from orion.engine.results import EngineResult, Finding
+
+
+CRYPTO_RULES = [
+    {
+        "id": "CRYPTO-001",
+        "pattern": r"(?i)\b(hashlib\.(md5|sha1)|MD5\.new|SHA1\.new|MessageDigest\.getInstance\s*\(\s*[\"'](MD5|SHA-1)[\"']|createHash\s*\(\s*[\"'](md5|sha1)[\"'])\b",
+        "title": "Use of cryptographically broken hash algorithm (MD5/SHA-1)",
+        "description": "MD5 and SHA-1 have known collision vulnerabilities. Use SHA-256, SHA-3, or BLAKE2 instead",
+        "severity": "high",
+        "cwe": "CWE-328",
+        "confidence": 0.95,
+    },
+    {
+        "id": "CRYPTO-002",
+        "pattern": r"(?i)\b(AES\.MODE_ECB|Cipher\.getInstance\s*\(\s*[\"']AES/ECB/|mode\s*=\s*AES\.MODE_ECB)\b",
+        "title": "Insecure ECB cipher mode used",
+        "description": "Electronic Codebook (ECB) mode does not provide pattern confidentiality. Use GCM or CBC with random IV",
+        "severity": "critical",
+        "cwe": "CWE-327",
+        "confidence": 0.95,
+    },
+    {
+        "id": "CRYPTO-003",
+        "pattern": r"(?i)\b(DES|Blowfish|RC4|ARC4|TripleDES)\.(new|getInstance|createCipher)\b",
+        "title": "Use of deprecated weak symmetric cipher (DES/RC4/Blowfish)",
+        "description": "Legacy ciphers with short block sizes or known biases are susceptible to plaintext recovery attacks",
+        "severity": "critical",
+        "cwe": "CWE-327",
+        "confidence": 0.95,
+    },
+    {
+        "id": "CRYPTO-004",
+        "pattern": r"(?i)\b(random\.(randint|random|choice|choices|sample|getrandbits)|Math\.random\s*\(\s*\)|rand\s*\(\s*\)|srand\s*\()\b.*(?i)(token|key|secret|password|auth|salt|nonce|session)",
+        "title": "Insecure Pseudo-Random Number Generator used for security context",
+        "description": "Standard pseudo-random generators are predictable. Use secrets module, crypto.getRandomValues, or CSPRNG",
+        "severity": "high",
+        "cwe": "CWE-338",
+        "confidence": 0.85,
+    },
+    {
+        "id": "CRYPTO-005",
+        "pattern": r"(?i)(iv|nonce|salt)\s*=\s*(b?[\"'][a-zA-Z0-9_\-]{8,}[\"']|b?\\x[0-9a-fA-F]{2})",
+        "title": "Static or hardcoded IV / Salt detected",
+        "description": "Initialization vectors (IVs) and salts must be uniquely and randomly generated for each encryption operation",
+        "severity": "high",
+        "cwe": "CWE-329",
+        "confidence": 0.85,
+    },
+    {
+        "id": "CRYPTO-006",
+        "pattern": r"(?i)(RSA\.generate|generate_private_key|KeyPairGenerator\.getInstance)\s*\(\s*(512|1024)\b",
+        "title": "Insufficient RSA key length (< 2048 bits)",
+        "description": "RSA keys smaller than 2048 bits are vulnerable to factorization. Minimum recommended key size is 2048 or 4096 bits",
+        "severity": "high",
+        "cwe": "CWE-326",
+        "confidence": 0.95,
+    },
+]
+
+
+class CryptoGuardEngine:
+    """100% custom, in-house developed Cryptographic Flaw & Key Auditor."""
+
+    name = "crypto_guard"
+    version = "1.0.0"
+
+    def __init__(self):
+        self._compiled_rules = []
+        for r in CRYPTO_RULES:
+            self._compiled_rules.append({
+                **r,
+                "regex": re.compile(r["pattern"])
+            })
+
+    async def check_availability(self) -> bool:
+        return True
+
+    def resource_limits(self) -> ResourceLimits:
+        return ResourceLimits(max_cpu_seconds=30, max_memory_mb=256)
+
+    async def run(self, ir: OrionIR, config: EngineConfig) -> EngineResult:
+        path = ir.metadata.get("path", "unknown")
+        try:
+            content = ir.content.decode("utf-8", errors="replace")
+        except Exception:
+            return EngineResult(engine=self.name, findings=[], ok=True)
+
+        lines = content.splitlines()
+        findings = []
+
+        for rule in self._compiled_rules:
+            for match in rule["regex"].finditer(content):
+                line_no = content[:match.start()].count('\n') + 1
+                start_line = max(0, line_no - 2)
+                end_line = min(len(lines), line_no + 2)
+                snippet = '\n'.join(lines[start_line:end_line])
+
+                findings.append(Finding(
+                    engine=self.name,
+                    severity=rule["severity"],
+                    title=f"{rule['id']}: {rule['title']}",
+                    description=rule["description"],
+                    location=f"{path}:{line_no}",
+                    metadata={
+                        "rule_id": rule["id"],
+                        "cwe": rule["cwe"],
+                        "confidence": rule["confidence"],
+                        "snippet": snippet,
+                        "file": path,
+                        "line": line_no,
+                    }
+                ))
+
+        return EngineResult(
+            engine=self.name,
+            findings=findings,
+            ok=True,
+            metrics={"findings_count": len(findings)}
+        )
+
+
+Engine = CryptoGuardEngine