@orionscanner/cli 0.1.0

package/src/orion/engine/dispatcher.py

@@ -0,0 +1,350 @@
+"""Universal polyglot dispatcher - routes any file to the right language analyzer."""
+
+import asyncio
+import os
+import re
+from typing import Dict, List, Optional, Any
+from pathlib import Path
+
+from orion.engine.languages import (
+    Language, detect_language, get_capabilities, LANGUAGE_CAPABILITIES
+)
+from orion.engine.ir import OrionIR
+from orion.engine.config import EngineConfig
+from orion.engine.results import EngineResult, Finding
+
+
+class PolyglotDispatcher:
+    """Routes files to language-specific analyzers for any engine."""
+    
+    def __init__(self):
+        self._analyzers: Dict[str, Dict[Language, Any]] = {}  # engine_name -> {Language: analyzer}
+        self._fallback_analyzers: Dict[str, Any] = {}  # engine_name -> generic analyzer
+    
+    def register_analyzer(self, engine_name: str, language: Language, analyzer: Any):
+        """Register a language-specific analyzer for an engine."""
+        if engine_name not in self._analyzers:
+            self._analyzers[engine_name] = {}
+        self._analyzers[engine_name][language] = analyzer
+    
+    def register_fallback(self, engine_name: str, analyzer: Any):
+        """Register a generic fallback analyzer for unsupported languages."""
+        self._fallback_analyzers[engine_name] = analyzer
+    
+    async def analyze(self, engine_name: str, ir: OrionIR, config: EngineConfig) -> EngineResult:
+        """Analyze a single IR with the appropriate language analyzer."""
+        language = ir.metadata.get("language")
+        if isinstance(language, str):
+            try:
+                language = Language(language.lower())
+            except ValueError:
+                language = detect_language(ir.metadata.get("path", ""))
+        
+        # Get engine's analyzers
+        engine_analyzers = self._analyzers.get(engine_name, {})
+        
+        # Try exact language match
+        if language in engine_analyzers:
+            analyzer = engine_analyzers[language]
+            return await self._run_analyzer(analyzer, ir, config)
+        
+        # Try fallback
+        if engine_name in self._fallback_analyzers:
+            return await self._run_analyzer(self._fallback_analyzers[engine_name], ir, config)
+        
+        # No analyzer available
+        caps = get_capabilities(language)
+        return EngineResult(
+            engine=engine_name,
+            findings=[],
+            ok=True,
+            metrics={"skipped": True, "reason": f"No analyzer for {language.value}", "language": language.value}
+        )
+    
+    async def _run_analyzer(self, analyzer: Any, ir: OrionIR, config: EngineConfig) -> EngineResult:
+        """Run analyzer with error handling."""
+        try:
+            if asyncio.iscoroutinefunction(analyzer.run):
+                return await analyzer.run(ir, config)
+            else:
+                return analyzer.run(ir, config)
+        except Exception as e:
+            return EngineResult(
+                engine=analyzer.__class__.__name__,
+                findings=[],
+                errors=[str(e)],
+                ok=False
+            )
+    
+    async def analyze_batch(self, engine_name: str, irs: List[OrionIR], config: EngineConfig) -> EngineResult:
+        """Analyze multiple IRs with the appropriate language analyzers."""
+        all_findings = []
+        all_errors = []
+        engines_run = 0
+        languages_seen = set()
+        
+        for ir in irs:
+            language = ir.metadata.get("language")
+            if isinstance(language, str):
+                try:
+                    language = Language(language.lower())
+                except ValueError:
+                    language = detect_language(ir.metadata.get("path", ""))
+            languages_seen.add(language)
+        
+        # Group by language for efficiency
+        language_to_irs: Dict[Language, List[OrionIR]] = {}
+        for ir in irs:
+            lang = ir.metadata.get("language")
+            if isinstance(lang, str):
+                try:
+                    lang = Language(lang.lower())
+                except ValueError:
+                    lang = detect_language(ir.metadata.get("path", ""))
+            if lang not in language_to_irs:
+                language_to_irs[lang] = []
+            language_to_irs[lang].append(ir)
+        
+        # Run per language
+        for language, lang_irs in language_to_irs.items():
+            result = await self.analyze(engine_name, lang_irs[0], config)
+            # For batch, we'd need the analyzer to support batch
+            # For now, run individually
+            for ir in lang_irs:
+                r = await self.analyze(engine_name, ir, config)
+                if r.findings:
+                    all_findings.extend(r.findings)
+                if r.errors:
+                    all_errors.extend(r.errors)
+                engines_run += 1
+        
+        return EngineResult(
+            engine=engine_name,
+            findings=all_findings,
+            errors=all_errors,
+            ok=len(all_errors) == 0,
+            metrics={"engines_run": engines_run, "languages": [l.value for l in languages_seen]}
+        )
+
+
+# Language-specific regex patterns (fallback when no AST)
+UNIVERSAL_PATTERNS = {
+    # Secrets - universal regex
+    "secrets": [
+        (re.compile(r'AKIA[0-9A-Z]{16}'), "aws_access_key", "AWS Access Key", 0.95),
+        (re.compile(r'gh[pousr]_[A-Za-z0-9_]{36}'), "github_token", "GitHub Token", 0.95),
+        (re.compile(r'sk_live_[a-zA-Z0-9]{24}'), "stripe_secret", "Stripe Secret Key", 0.95),
+        (re.compile(r'eyJ[A-Za-z0-9_-]{10,}\.[A-Za-z0-9_-]{10,}\.[A-Za-z0-9_-]{10,}'), "jwt_token", "JWT Token", 0.85),
+        (re.compile(r'xox[baprs]-[0-9]{12}-[0-9]{12}-[0-9]{12}-[a-z0-9]{32}'), "slack_token", "Slack Token", 0.95),
+        (re.compile(r'(?i)(api[_-]?key|secret|token|password|passwd)\s*[:=]\s*[\'"][a-zA-Z0-9_\-]{20,}[\'"]'), "generic_secret", "Generic Secret", 0.75),
+        (re.compile(r'-----BEGIN (?:RSA|DSA|EC|OPENSSH) PRIVATE KEY-----'), "private_key", "Private Key", 0.99),
+    ],
+    
+    # SQL Injection patterns (universal)
+    "sql_injection": [
+        (re.compile(r'(SELECT|INSERT|UPDATE|DELETE|UNION|DROP|CREATE|ALTER)\s+.*[\+\%].*(input|req\.|request\.|params|query|body)'), "sql_injection", "Potential SQL Injection", 0.8),
+        (re.compile(r'execute\s*\(.*[\+\%].*(input|req\.|request\.|params|query|body)'), "sql_injection", "Potential SQL Injection", 0.85),
+        (re.compile(r'query\s*\(.*[\+\%].*(input|req\.|request\.|params|query|body)'), "sql_injection", "Potential SQL Injection", 0.85),
+    ],
+    
+    # Command Injection (universal)
+    "command_injection": [
+        (re.compile(r'(system|exec|popen|subprocess|ProcessBuilder|Runtime\.exec|os\.exec|child_process)\s*\(.*[\+\%].*(input|req\.|request\.|params|query|body|argv)'), "command_injection", "Potential Command Injection", 0.85),
+        (re.compile(r'(shell\s*=\s*True|shell_exec|passthru|proc_open|`.*\$\{).*input'), "command_injection", "Potential Command Injection", 0.9),
+    ],
+    
+    # XSS (universal)
+    "xss": [
+        (re.compile(r'innerHTML\s*=\s*.*(req\.|request\.|params|query|body)'), "xss", "Potential XSS via innerHTML", 0.85),
+        (re.compile(r'document\.write\s*\(.*(req\.|request\.|params|query|body)'), "xss", "Potential XSS via document.write", 0.85),
+        (re.compile(r'dangerouslySetInnerHTML\s*:\s*\{.*req\.'), "xss", "Potential XSS via dangerouslySetInnerHTML", 0.9),
+        (re.compile(r'v-html\s*=\s*.*req\.'), "xss", "Potential XSS via v-html", 0.9),
+    ],
+    
+    # Path Traversal (universal)
+    "path_traversal": [
+        (re.compile(r'(open|readFile|readFileSync|FileReader|File\.read|Files\.read|readAllBytes|slurp)\s*\(.*\.\./'), "path_traversal", "Potential Path Traversal", 0.85),
+        (re.compile(r'(include|require|require_once|import)\s*\(.*\.\./'), "path_traversal", "Potential Path Traversal", 0.8),
+    ],
+    
+    # Hardcoded credentials (universal)
+    "hardcoded_creds": [
+        (re.compile(r'(?i)(password|passwd|pwd|secret|api_?key|token|access_?key)\s*[:=]\s*[\'"][a-zA-Z0-9_\-]{8,}[\'"]'), "hardcoded_secret", "Hardcoded Credential", 0.75),
+        (re.compile(r'(?i)(aws_?secret|aws_?key|ssh_?key|private_?key)\s*[:=]\s*[\'"][A-Za-z0-9/\+=]{20,}[\'"]'), "cloud_credential", "Cloud Credential", 0.9),
+    ],
+    
+    # Weak crypto (universal)
+    "weak_crypto": [
+        (re.compile(r'(MD5|SHA1|DES|RC4|ECB)\s*\('), "weak_crypto", "Weak Cryptographic Algorithm", 0.85),
+        (re.compile(r'(md5|sha1)\s*\(.*password'), "weak_password_hash", "Weak Password Hash", 0.9),
+    ],
+}
+
+
+class UniversalRegexAnalyzer:
+    """Fallback analyzer using universal regex patterns for any language."""
+    
+    def __init__(self, pattern_categories: List[str] = None):
+        self.categories = pattern_categories or list(UNIVERSAL_PATTERNS.keys())
+        self._compile_patterns()
+    
+    def _compile_patterns(self):
+        self.compiled = {}
+        for cat in self.categories:
+            self.compiled[cat] = [(re.compile(p[0]), p[1], p[2], p[3]) for p in UNIVERSAL_PATTERNS[cat]]
+    
+    def run(self, ir: OrionIR, config: EngineConfig) -> EngineResult:
+        try:
+            content = ir.content.decode("utf-8", errors="replace")
+        except Exception:
+            content = str(ir.content)
+        
+        findings = []
+        filepath = ir.metadata.get("path", "unknown")
+        
+        for cat, patterns in self.compiled.items():
+            for regex, name, desc, conf in patterns:
+                for match in regex.finditer(content):
+                    line_num = content[:match.start()].count('\n') + 1
+                    lines = content.splitlines()
+                    start = max(0, line_num - 3)
+                    end = min(len(lines), line_num + 2)
+                    snippet = '\n'.join(lines[start:end])
+                    
+                    findings.append(Finding(
+                        engine="universal",
+                        severity=self._severity_from_conf(conf),
+                        title=f"{cat}: {name}",
+                        description=desc,
+                        location=f"{filepath}:{line_num}",
+                        metadata={
+                            "pattern": name,
+                            "confidence": conf,
+                            "match": match.group()[:100],
+                            "snippet": snippet,
+                            "file": filepath,
+                            "line": line_num,
+                            "category": cat,
+                        }
+                    ))
+        
+        return EngineResult(engine="universal", findings=findings, ok=True)
+    
+    def _severity_from_conf(self, conf: float) -> str:
+        if conf >= 0.9: return "critical"
+        if conf >= 0.8: return "high"
+        if conf >= 0.7: return "medium"
+        if conf >= 0.5: return "low"
+        return "info"
+
+
+# Polyglot engine base class
+class PolyglotEngine:
+    """Base class for engines that support multiple languages."""
+    
+    name = "polyglot_base"
+    version = "1.0.0"
+    
+    def __init__(self):
+        self.universal = UniversalRegexAnalyzer()
+        self.language_analyzers: Dict[Language, Any] = {}
+    
+    def register_language_analyzer(self, language: Language, analyzer: Any):
+        """Register a language-specific analyzer."""
+        self.language_analyzers[language] = analyzer
+    
+    async def check_availability(self) -> bool:
+        return True
+    
+    def resource_limits(self):
+        from orion.engine.config import ResourceLimits
+        return ResourceLimits(max_cpu_seconds=60, max_memory_mb=512)
+    
+    async def run(self, ir: OrionIR, config: EngineConfig) -> EngineResult:
+        """Route to language-specific analyzer or universal fallback."""
+        language = ir.metadata.get("language")
+        if isinstance(language, str):
+            try:
+                language = Language(language.lower())
+            except ValueError:
+                from orion.engine.languages import detect_language
+                language = detect_language(ir.metadata.get("path", ""))
+        
+        # Try language-specific analyzer
+        if language in self.language_analyzers:
+            analyzer = self.language_analyzers[language]
+            if asyncio.iscoroutinefunction(analyzer.run):
+                return await analyzer.run(ir, config)
+            else:
+                return analyzer.run(ir, config)
+        
+        # Fallback to universal regex
+        return self.universal.run(ir, config)
+
+
+# Example: Polyglot SAST Engine
+class PolyglotSASTEngine(PolyglotEngine):
+    name = "sast"
+    version = "2.0.0"
+    
+    def __init__(self):
+        super().__init__()
+        # Python AST analyzer (existing)
+        from orion.engine.sast.patterns import run_ast_patterns
+        self._python_ast = run_ast_patterns
+    
+    async def run(self, ir: OrionIR, config: EngineConfig) -> EngineResult:
+        language = ir.metadata.get("language")
+        if isinstance(language, str):
+            try:
+                language = Language(language.lower())
+            except ValueError:
+                from orion.engine.languages import detect_language
+                language = detect_language(ir.metadata.get("path", ""))
+        
+        if language == Language.PYTHON:
+            return await self._run_python_ast(ir, config)
+        
+        # For other languages, use universal regex
+        return self.universal.run(ir, config)
+    
+    async def _run_python_ast(self, ir: OrionIR, config: EngineConfig) -> EngineResult:
+        try:
+            content = ir.content.decode("utf-8", errors="replace")
+        except Exception:
+            content = str(ir.content)
+        
+        filepath = ir.metadata.get("path", "unknown")
+        ast_findings = self._python_ast(content, filepath)
+        
+        findings = []
+        for af in ast_findings:
+            findings.append(Finding(
+                engine=self.name,
+                severity=af.get('severity', 'medium').lower(),
+                title=f"{af['pattern']}: {af['description']}",
+                description=f"{af['description']} (CWE: {af['cwe']}, CVSS: {af['cvss']})",
+                location=f"{filepath}:{af['line']}",
+                metadata={
+                    "pattern": af['pattern'],
+                    "cwe": af['cwe'],
+                    "cvss": af['cvss'],
+                    "confidence": af['confidence'],
+                    "snippet": af['snippet'],
+                    "file": filepath,
+                    "line": af['line'],
+                }
+            ))
+        
+        return EngineResult(engine=self.name, findings=findings, ok=True)
+
+
+# Export key classes
+__all__ = [
+    "PolyglotDispatcher",
+    "PolyglotEngine",
+    "PolyglotSASTEngine",
+    "UniversalRegexAnalyzer",
+    "UNIVERSAL_PATTERNS",
+    "Language",
+]