@orionscanner/cli 0.1.0

package/src/orion/engine/duplication/engine.py

@@ -0,0 +1,120 @@
+"""Code duplication detection engine using sliding window over normalized tokens."""
+import hashlib
+import re
+from collections import defaultdict
+from orion.engine.config import EngineConfig
+from orion.engine.ir import OrionIR
+from orion.engine.results import EngineResult, Finding
+
+
+class Engine:
+    name = "duplication"
+    version = "1.0.0"
+
+    WINDOW_LINES = 8
+    MIN_OCCURRENCES = 3
+    MIN_TOKENS = 40
+
+    async def check_availability(self) -> bool:
+        return True
+
+    def resource_limits(self):
+        from orion.engine.config import ResourceLimits
+        return ResourceLimits(max_cpu_seconds=120, max_memory_mb=512)
+
+    async def run(self, ir: OrionIR, config: EngineConfig) -> EngineResult:
+        try:
+            text = ir.content.decode("utf-8", errors="replace")
+        except Exception:
+            text = str(ir.content)
+
+        path = ir.metadata.get("path", "unknown")
+        language = ir.metadata.get("language", "unknown")
+
+        if language not in ("python", "javascript", "typescript", "java", "go", "c", "cpp", "rust"):
+            return EngineResult(engine=self.name, findings=[], ok=True)
+
+        tokens = self._normalize_and_tokenize(text, language)
+        if len(tokens) < self.MIN_TOKENS:
+            return EngineResult(engine=self.name, findings=[], ok=True)
+
+        window_hashes = self._sliding_window_hashes(tokens, path)
+        clusters = self._find_clusters(window_hashes)
+
+        findings = []
+        reported_lines = set()
+        for cluster in clusters:
+            start_line = cluster[0][1]
+            if start_line in reported_lines or any(abs(start_line - r) < self.WINDOW_LINES for r in reported_lines):
+                continue
+
+            if len(cluster) >= self.MIN_OCCURRENCES:
+                reported_lines.add(start_line)
+                locations = [{"file": loc[0], "line": loc[1]} for loc in cluster]
+                unique_files = set(loc[0] for loc in cluster)
+                token_count = self.WINDOW_LINES * 10
+                findings.append(Finding(
+                    engine=self.name,
+                    severity="low",
+                    title=f"Code duplication block ({len(cluster)} occurrences)",
+                    description=f"Found {len(cluster)} similar code sequences of {self.WINDOW_LINES}+ lines",
+                    location=f"{path}:{start_line}",
+                    metadata={
+                        "confidence": 0.8,
+                        "locations": locations,
+                        "token_count": token_count,
+                        "occurrences": len(cluster),
+                        "cwe": "CWE-1041",
+                    },
+                ))
+
+        return EngineResult(engine=self.name, findings=findings, ok=True)
+
+    def _normalize_and_tokenize(self, text: str, language: str) -> list[tuple[int, str]]:
+        lines = text.splitlines()
+        normalized = []
+
+        for line_no, line in enumerate(lines, 1):
+            stripped = line.strip()
+            if not stripped:
+                continue
+
+            if language == "python":
+                stripped = re.sub(r"#.*$", "", stripped)
+            elif language in ("javascript", "typescript", "java", "c", "cpp", "go", "rust"):
+                stripped = re.sub(r"//.*$", "", stripped)
+                stripped = re.sub(r"/\*.*?\*/", "", stripped)
+
+            stripped = re.sub(r"\s+", " ", stripped)
+
+            stripped = re.sub(r"\b\d+\b", "<LIT>", stripped)
+            stripped = re.sub(r"\b0x[0-9a-fA-F]+\b", "<LIT>", stripped)
+            stripped = re.sub(r'"[^"]*"', "<LIT>", stripped)
+            stripped = re.sub(r"'[^']*'", "<LIT>", stripped)
+            stripped = re.sub(r"`[^`]*`", "<LIT>", stripped)
+
+            stripped = re.sub(r"\b[a-zA-Z_][a-zA-Z0-9_]*\b", "<ID>", stripped)
+
+            normalized.append((line_no, stripped))
+
+        return normalized
+
+    def _sliding_window_hashes(self, tokens: list[tuple[int, str]], filepath: str) -> dict[str, list[tuple[str, int]]]:
+        window_hashes = defaultdict(list)
+
+        for i in range(len(tokens) - self.WINDOW_LINES + 1):
+            window = [t[1] for t in tokens[i:i + self.WINDOW_LINES]]
+            window_str = "\n".join(window)
+            h = hashlib.sha256(window_str.encode()).hexdigest()[:16]
+
+            start_line = tokens[i][0]
+            window_hashes[h].append((filepath, start_line))
+
+        return window_hashes
+
+    def _find_clusters(self, window_hashes: dict[str, list[tuple[str, int]]]) -> list[list[tuple[str, int]]]:
+        clusters = []
+        for h, locations in window_hashes.items():
+            if len(locations) >= self.MIN_OCCURRENCES:
+                clusters.append(locations)
+        return clusters

package/src/orion/engine/error_handling/engine.py

@@ -0,0 +1,256 @@
+"""Error handling anti-patterns detection engine using AST analysis."""
+import ast
+import sys
+from orion.engine.config import EngineConfig
+from orion.engine.ir import OrionIR
+from orion.engine.results import EngineResult, Finding
+
+
+class Engine:
+    name = "error_handling"
+    version = "1.0.0"
+
+    CRITICAL_EXCEPTIONS = {
+        "KeyboardInterrupt", "SystemExit", "GeneratorExit",
+        "MemoryError", "BaseException"
+    }
+
+    async def check_availability(self) -> bool:
+        return True
+
+    def resource_limits(self):
+        from orion.engine.config import ResourceLimits
+        return ResourceLimits(max_cpu_seconds=60, max_memory_mb=256)
+
+    async def run(self, ir: OrionIR, config: EngineConfig) -> EngineResult:
+        try:
+            text = ir.content.decode("utf-8", errors="replace")
+        except Exception:
+            return EngineResult(engine=self.name, findings=[], ok=True)
+
+        path = ir.metadata.get("path", "unknown")
+        is_test = self._is_test_file(path)
+
+        try:
+            tree = ast.parse(text, filename=path)
+        except SyntaxError:
+            return EngineResult(engine=self.name, findings=[], ok=True)
+
+        findings = []
+        visitor = ErrorHandlingVisitor(path, is_test, text.splitlines())
+        visitor.visit(tree)
+        findings.extend(visitor.findings)
+
+        return EngineResult(engine=self.name, findings=findings, ok=True)
+
+    def _is_test_file(self, path: str) -> bool:
+        test_patterns = ["test_", "_test.py", "/tests/", "/test/", "conftest.py"]
+        return any(p in path for p in test_patterns)
+
+
+class ErrorHandlingVisitor(ast.NodeVisitor):
+    CRITICAL_EXCEPTIONS = {
+        "KeyboardInterrupt", "SystemExit", "GeneratorExit",
+        "MemoryError", "BaseException"
+    }
+
+    def __init__(self, filepath: str, is_test: bool, lines: list[str]):
+        self.filepath = filepath
+        self.is_test = is_test
+        self.lines = lines
+        self.findings = []
+        self.in_test_context = is_test
+        self.except_counts = {}
+        self.in_finally = False
+
+    def visit_Try(self, node: ast.Try):
+        self._check_bare_except(node)
+        self._check_except_pass(node)
+        self._check_except_logging_only(node)
+        self._check_raise_without_from(node)
+        self._check_multiple_same_except(node)
+        self._check_critical_exception_caught(node)
+        self._check_try_with_pass_finally(node)
+
+        old_finally = self.in_finally
+        self.in_finally = True
+        for handler in node.handlers:
+            self.visit(handler)
+        for stmt in node.body:
+            self.visit(stmt)
+        for stmt in node.finalbody:
+            self.visit(stmt)
+        self.in_finally = old_finally
+
+        if node.orelse:
+            for stmt in node.orelse:
+                self.visit(stmt)
+
+    def _check_bare_except(self, node: ast.Try):
+        for handler in node.handlers:
+            if handler.type is None:
+                self._add_finding(
+                    handler,
+                    "Bare except clause",
+                    "Bare 'except:' catches all exceptions including SystemExit and KeyboardInterrupt",
+                    confidence=0.9,
+                    cwe="CWE-396",
+                )
+            elif isinstance(handler.type, ast.Name):
+                if handler.type.id in self.CRITICAL_EXCEPTIONS and handler.name is None:
+                    self._add_finding(
+                        handler,
+                        f"Catching {handler.type.id} without 'as'",
+                        f"Catching {handler.type.id} without binding prevents proper handling",
+                        confidence=0.85,
+                        cwe="CWE-396",
+                    )
+
+    def _check_except_pass(self, node: ast.Try):
+        for handler in node.handlers:
+            if len(handler.body) == 1:
+                stmt = handler.body[0]
+                if isinstance(stmt, ast.Pass):
+                    self._add_finding(
+                        handler,
+                        "Empty except block (pass)",
+                        "Exception caught and silently ignored",
+                        confidence=0.85,
+                        cwe="CWE-391",
+                    )
+                elif isinstance(stmt, ast.Expr) and isinstance(stmt.value, ast.Constant) and stmt.value.value is Ellipsis:
+                    self._add_finding(
+                        handler,
+                        "Empty except block (Ellipsis)",
+                        "Exception caught and ignored with '...'",
+                        confidence=0.85,
+                        cwe="CWE-391",
+                    )
+                elif isinstance(stmt, ast.Return):
+                    self._add_finding(
+                        handler,
+                        "Except block only returns",
+                        "Exception caught and function returns without handling",
+                        confidence=0.8,
+                        cwe="CWE-391",
+                    )
+
+    def _check_except_logging_only(self, node: ast.Try):
+        for handler in node.handlers:
+            if len(handler.body) == 1:
+                stmt = handler.body[0]
+                if isinstance(stmt, ast.Expr) and isinstance(stmt.value, ast.Call):
+                    func = stmt.value.func
+                    if isinstance(func, ast.Attribute):
+                        if func.attr in ("error", "exception", "warning", "info", "debug", "critical"):
+                            if isinstance(func.value, ast.Name) and func.value.id in ("logging", "logger", "log"):
+                                self._add_finding(
+                                    handler,
+                                    "Except only logs",
+                                    "Exception caught but only logged without recovery or re-raise",
+                                    confidence=0.75,
+                                    cwe="CWE-391",
+                                )
+
+    def _check_raise_without_from(self, node: ast.Try):
+        for handler in node.handlers:
+            for stmt in ast.walk(handler):
+                if isinstance(stmt, ast.Raise) and stmt.exc and not stmt.cause:
+                    if not (isinstance(stmt.exc, ast.Name) and stmt.exc.id in self.CRITICAL_EXCEPTIONS):
+                        self._add_finding(
+                            stmt,
+                            "Raise without 'from' (lost exception cause)",
+                            "Re-raising exception without 'from' loses original traceback",
+                            confidence=0.8,
+                            cwe="CWE-390",
+                        )
+
+    def _check_multiple_same_except(self, node: ast.Try):
+        exc_types = []
+        for handler in node.handlers:
+            if handler.type:
+                if isinstance(handler.type, ast.Name):
+                    exc_types.append(handler.type.id)
+                elif isinstance(handler.type, ast.Tuple):
+                    for elt in handler.type.elts:
+                        if isinstance(elt, ast.Name):
+                            exc_types.append(elt.id)
+
+        for exc in set(exc_types):
+            if exc_types.count(exc) > 1:
+                self._add_finding(
+                    node,
+                    f"Multiple except blocks for same exception: {exc}",
+                    f"Exception '{exc}' caught in multiple except blocks - consolidate",
+                    confidence=0.8,
+                    cwe="CWE-397",
+                )
+
+    def _check_critical_exception_caught(self, node: ast.Try):
+        for handler in node.handlers:
+            if handler.type:
+                if isinstance(handler.type, ast.Name):
+                    if handler.type.id in self.CRITICAL_EXCEPTIONS:
+                        has_reraise = any(
+                            isinstance(stmt, ast.Raise) and (stmt.exc is None or
+                             (isinstance(stmt.exc, ast.Name) and stmt.exc.id == handler.type.id))
+                            for stmt in ast.walk(handler) if isinstance(stmt, ast.Raise)
+                        )
+                        if not has_reraise:
+                            self._add_finding(
+                                handler,
+                                f"Catching {handler.type.id} without re-raise",
+                                f"Critical exception {handler.type.id} caught but not re-raised",
+                                confidence=0.9,
+                                cwe="CWE-396",
+                            )
+
+    def _check_try_with_pass_finally(self, node: ast.Try):
+        if node.finalbody and len(node.finalbody) == 1:
+            if isinstance(node.finalbody[0], ast.Pass):
+                self._add_finding(
+                    node,
+                    "Try block with only 'pass' in finally",
+                    "Finally block contains only 'pass' - consider removing",
+                    confidence=0.75,
+                    cwe="CWE-1054",
+                )
+
+    def visit_Assert(self, node: ast.Assert):
+        if not self.in_test_context:
+            self._add_finding(
+                node,
+                "Assert in production code",
+                "Assert statements are optimized out with -O flag",
+                confidence=0.8,
+                cwe="CWE-617",
+            )
+
+    def visit_Call(self, node: ast.Call):
+        if isinstance(node.func, ast.Attribute):
+            if node.func.attr == "exit" and isinstance(node.func.value, ast.Name) and node.func.value.id == "sys":
+                if not self.in_test_context:
+                    self._add_finding(
+                        node,
+                        "sys.exit() in library code",
+                        "sys.exit() should not be used in library/module code",
+                        confidence=0.85,
+                        cwe="CWE-617",
+                    )
+        self.generic_visit(node)
+
+    def _add_finding(self, node: ast.AST, title: str, description: str, confidence: float, cwe: str):
+        line_no = getattr(node, "lineno", 0)
+        snippet = self.lines[line_no - 1].strip() if 0 < line_no <= len(self.lines) else ""
+        self.findings.append(Finding(
+            engine="error_handling",
+            severity="high" if confidence >= 0.85 else "medium",
+            title=title,
+            description=description,
+            location=f"{self.filepath}:{line_no}",
+            metadata={
+                "confidence": confidence,
+                "snippet": snippet[:200],
+                "cwe": cwe,
+            },
+        ))

package/src/orion/engine/fp_learn/engine.py

@@ -0,0 +1,248 @@
+"""False positive learning engine - learns from user feedback to reduce false positives."""
+import json
+import hashlib
+import ast
+from pathlib import Path
+from typing import Dict, List, Optional, Any, Set
+from dataclasses import dataclass, asdict
+from collections import defaultdict
+
+from orion.engine.config import EngineConfig
+from orion.engine.ir import OrionIR
+from orion.engine.results import EngineResult, Finding
+
+
+@dataclass
+class FPFeature:
+    engine: str
+    pattern: str
+    file_type: str
+    ast_context: str
+    confidence_reduction: float = 0.3
+
+
+@dataclass
+class FeedbackEntry:
+    engine: str
+    location: str
+    title: str
+    feedback: str
+    reason: str
+    timestamp: str
+
+
+class FPLearnEngine:
+    name = "fp_learn"
+    version = "1.0.0"
+
+    FEEDBACK_FILE = ".orion-feedback.json"
+
+    async def check_availability(self) -> bool:
+        return True
+
+    def resource_limits(self):
+        from orion.engine.config import ResourceLimits
+        return ResourceLimits(max_cpu_seconds=10, max_memory_mb=64)
+
+    def _load_feedback(self, project_root: str) -> List[FeedbackEntry]:
+        """Load feedback from .orion-feedback.json."""
+        feedback_path = Path(project_root) / self.FEEDBACK_FILE
+        if not feedback_path.exists():
+            return []
+
+        try:
+            with open(feedback_path, "r") as f:
+                data = json.load(f)
+            entries = []
+            for item in data.get("findings", []):
+                entries.append(FeedbackEntry(
+                    engine=item.get("engine", ""),
+                    location=item.get("location", ""),
+                    title=item.get("title", ""),
+                    feedback=item.get("feedback", ""),
+                    reason=item.get("reason", ""),
+                    timestamp=item.get("timestamp", ""),
+                ))
+            return entries
+        except Exception:
+            return []
+
+    def _extract_features(self, finding: Finding, content: str) -> FPFeature:
+        """Extract features from a finding for FP matching."""
+        engine = finding.engine
+        # Normalize pattern key - use metadata.pattern if available, else derive from title
+        pattern = finding.metadata.get("pattern", "")
+        if not pattern:
+            pattern = finding.title.lower().replace(" ", "_")
+        # Normalize: replace spaces with underscores, lowercase
+        pattern = pattern.lower().replace(" ", "_")
+        file_type = Path(finding.metadata.get("file", "")).suffix
+
+        # Extract AST context around the finding
+        ast_context = ""
+        if file_type == ".py":
+            try:
+                tree = ast.parse(content)
+                line = finding.metadata.get("line", 0)
+                for node in ast.walk(tree):
+                    if hasattr(node, 'lineno') and node.lineno == line:
+                        ast_context = type(node).__name__
+                        break
+            except Exception:
+                pass
+
+        return FPFeature(
+            engine=engine,
+            pattern=pattern,
+            file_type=file_type,
+            ast_context=ast_context,
+        )
+
+    def _feature_hash(self, feature: FPFeature) -> str:
+        """Generate a hash for a feature set."""
+        data = f"{feature.engine}:{feature.pattern}:{feature.file_type}:{feature.ast_context}"
+        return hashlib.sha256(data.encode()).hexdigest()[:16]
+
+    def _learn_fp_patterns(self, feedback_entries: List[FeedbackEntry], all_files: Dict[str, OrionIR]) -> Set[str]:
+        """Learn FP patterns from feedback."""
+        fp_hashes = set()
+
+        for entry in feedback_entries:
+            if entry.feedback != "false_positive":
+                continue
+
+            # Find the file content
+            file_path = entry.location.split(":")[0] if ":" in entry.location else ""
+            line_str = entry.location.split(":")[1] if ":" in entry.location else "0"
+            try:
+                line_num = int(line_str)
+            except ValueError:
+                line_num = 0
+                
+            file_ir = all_files.get(file_path)
+            if not file_ir:
+                continue
+
+            try:
+                content = file_ir.content.decode("utf-8", errors="replace")
+            except Exception:
+                content = ""
+
+            # Create a pseudo-finding to extract features
+            pseudo_finding = Finding(
+                engine=entry.engine,
+                severity="",
+                title=entry.title,
+                description="",
+                location=entry.location,
+                metadata={"pattern": entry.title.lower().replace(" ", "_"), "line": line_num, "file": file_path},
+            )
+
+            feature = self._extract_features(pseudo_finding, content)
+            fp_hashes.add(self._feature_hash(feature))
+
+        return fp_hashes
+
+    def _apply_fp_reduction(self, findings: List[Finding], fp_hashes: Set[str], all_files: Dict[str, OrionIR]) -> List[Finding]:
+        """Apply FP reduction to findings."""
+        adjusted = []
+        fp_stats = {"learned": len(fp_hashes), "applied": 0, "suppressed": 0}
+
+        for finding in findings:
+            file_path = finding.metadata.get("file", finding.location.split(":")[0] if ":" in finding.location else "")
+            file_ir = all_files.get(file_path)
+            if not file_ir:
+                adjusted.append(finding)
+                continue
+
+            try:
+                content = file_ir.content.decode("utf-8", errors="replace")
+            except Exception:
+                content = ""
+
+            feature = self._extract_features(finding, content)
+            feature_hash = self._feature_hash(feature)
+
+            if feature_hash in fp_hashes:
+                # Reduce confidence by 0.3
+                original_confidence = finding.metadata.get("confidence", 0.8)
+                new_confidence = max(0.0, original_confidence - 0.3)
+
+                if new_confidence < 0.7:
+                    # Suppress finding (below threshold)
+                    fp_stats["suppressed"] += 1
+                    # Don't add to adjusted findings
+                    continue
+                else:
+                    fp_stats["applied"] += 1
+                    adjusted.append(Finding(
+                        engine=finding.engine,
+                        severity=finding.severity,
+                        title=finding.title,
+                        description=finding.description,
+                        location=finding.location,
+                        metadata={
+                            **finding.metadata,
+                            "confidence": new_confidence,
+                            "fp_adjusted": True,
+                            "original_confidence": original_confidence,
+                        },
+                    ))
+            else:
+                adjusted.append(finding)
+
+        # Store stats in the last finding's metadata or return via metrics
+        return adjusted, fp_stats
+
+    async def run(self, ir: OrionIR, config: EngineConfig) -> EngineResult:
+        project_root = ir.metadata.get("project_root", ".")
+        all_files = ir.metadata.get("all_files", {})
+
+        if not all_files:
+            all_files = {ir.metadata.get("path", "unknown"): ir}
+
+        # Get all findings from context
+        all_findings = ir.metadata.get("all_findings", [])
+
+        # Also check project context
+        project_ctx = ir.metadata.get("project_context")
+        if project_ctx and hasattr(project_ctx, 'findings'):
+            all_findings.extend(project_ctx.findings)
+
+        # Load feedback
+        feedback_entries = self._load_feedback(project_root)
+
+        if not feedback_entries:
+            return EngineResult(
+                engine=self.name,
+                findings=[],
+                ok=True,
+                metrics={
+                    "feedback_entries": 0,
+                    "fp_stats": {"learned": 0, "applied": 0, "suppressed": 0},
+                },
+            )
+
+        # Learn FP patterns
+        fp_hashes = self._learn_fp_patterns(feedback_entries, all_files)
+
+        # Apply FP reduction to all findings
+        adjusted_findings, fp_stats = self._apply_fp_reduction(all_findings, fp_hashes, all_files)
+
+        # This engine doesn't produce its own findings - it adjusts others
+        # But we return metrics with the stats
+        return EngineResult(
+            engine=self.name,
+            findings=[],
+            ok=True,
+            metrics={
+                "feedback_entries": len(feedback_entries),
+                "fp_patterns_learned": len(fp_hashes),
+                "fp_stats": fp_stats,
+                "findings_adjusted": fp_stats["applied"],
+                "findings_suppressed": fp_stats["suppressed"],
+            },
+        )
+
+
+Engine = FPLearnEngine