@orionscanner/cli 0.1.0

package/src/orion/engine/hunter/engine.py

@@ -0,0 +1,324 @@
+"""Cross-engine correlation hunter - correlates findings across engines to find attack chains."""
+from typing import List, Dict, Set, Any
+from dataclasses import dataclass
+from collections import defaultdict
+
+from orion.engine.config import EngineConfig
+from orion.engine.ir import OrionIR
+from orion.engine.results import EngineResult, Finding
+
+
+@dataclass
+class CorrelationRule:
+    name: str
+    required_engines: List[str]
+    required_patterns: List[str]
+    boosted_severity: str
+    description: str
+    chain_id: str
+
+
+class HunterEngine:
+    name = "hunter"
+    version = "1.0.0"
+
+    # Correlation rules defining attack chains
+    CORRELATION_RULES = [
+        CorrelationRule(
+            name="sqli_missing_auth",
+            required_engines=["sast"],
+            required_patterns=["sql_injection", "missing_auth", "authorization_bypass"],
+            boosted_severity="critical",
+            description="SQL injection combined with missing authentication = critical data breach risk",
+            chain_id="CHAIN-001",
+        ),
+        CorrelationRule(
+            name="xss_missing_csp",
+            required_engines=["sast", "config_engine"],
+            required_patterns=["xss", "missing_csp", "csp_not_enabled"],
+            boosted_severity="high",
+            description="XSS vulnerability with no Content Security Policy = high exploitability",
+            chain_id="CHAIN-002",
+        ),
+        CorrelationRule(
+            name="secret_public_repo",
+            required_engines=["secrets", "deps"],
+            required_patterns=["hardcoded_secret", "public_repository", "git_public"],
+            boosted_severity="critical",
+            description="Hardcoded secret in public repository = immediate credential compromise",
+            chain_id="CHAIN-003",
+        ),
+        CorrelationRule(
+            name="pii_logging",
+            required_engines=["sast", "logging_c"],
+            required_patterns=["hardcoded_pii", "pii_logged", "sensitive_data_logging"],
+            boosted_severity="high",
+            description="PII in code combined with logging = data exposure risk",
+            chain_id="CHAIN-004",
+        ),
+        CorrelationRule(
+            name="monkey_patch_no_tests",
+            required_engines=["symbol", "test_coverage"],
+            required_patterns=["monkey_patch", "runtime_patch", "untested_code", "low_coverage"],
+            boosted_severity="medium",
+            description="Monkey patching without tests = high regression risk",
+            chain_id="CHAIN-005",
+        ),
+        CorrelationRule(
+            name="n1_query_no_pagination",
+            required_engines=["dataflow", "sast"],
+            required_patterns=["n_plus_one_query", "missing_pagination", "unbounded_query"],
+            boosted_severity="high",
+            description="N+1 query pattern without pagination = DoS risk",
+            chain_id="CHAIN-006",
+        ),
+        CorrelationRule(
+            name="ssrf_no_egress_control",
+            required_engines=["sast", "container", "config_engine"],
+            required_patterns=["ssrf", "missing_egress_control", "allow_all_outbound"],
+            boosted_severity="critical",
+            description="SSRF vulnerability with no egress filtering = internal network access",
+            chain_id="CHAIN-007",
+        ),
+        CorrelationRule(
+            name="weak_crypto_sensitive_data",
+            required_engines=["sast", "data_residency"],
+            required_patterns=["weak_crypto", "md5", "sha1", "sensitive_data_storage"],
+            boosted_severity="high",
+            description="Weak cryptography protecting sensitive data = compliance violation",
+            chain_id="CHAIN-008",
+        ),
+        CorrelationRule(
+            name="deserialization_rce_chain",
+            required_engines=["sast", "sandbox_escape"],
+            required_patterns=["insecure_deserialization", "pickle", "yaml_unsafe", "sandbox_escape"],
+            boosted_severity="critical",
+            description="Insecure deserialization with sandbox escape = RCE chain",
+            chain_id="CHAIN-009",
+        ),
+        CorrelationRule(
+            name="path_traversal_file_read",
+            required_engines=["sast", "authorization"],
+            required_patterns=["path_traversal", "missing_path_validation", "authorization_bypass"],
+            boosted_severity="high",
+            description="Path traversal with missing authorization = arbitrary file read",
+            chain_id="CHAIN-010",
+        ),
+    ]
+
+    SEVERITY_ORDER = {"low": 0, "medium": 1, "high": 2, "critical": 3}
+
+    async def check_availability(self) -> bool:
+        return True
+
+    def resource_limits(self):
+        from orion.engine.config import ResourceLimits
+        return ResourceLimits(max_cpu_seconds=30, max_memory_mb=128)
+
+    def _get_all_findings(self, ir: OrionIR) -> List[Finding]:
+        """Get all findings from context - check metrics and project context."""
+        # First check if findings are in metrics
+        all_findings = ir.metadata.get("all_findings", [])
+
+        # Also check if there's a project context with findings from all engines
+        project_ctx = ir.metadata.get("project_context")
+        if project_ctx and hasattr(project_ctx, 'findings'):
+            all_findings.extend(project_ctx.findings)
+
+        return all_findings
+
+    def _extract_pattern_key(self, finding: Finding) -> str:
+        """Extract a normalized pattern key from a finding."""
+        # Try metadata first
+        pattern = finding.metadata.get("pattern", "")
+        if pattern:
+            return pattern.lower()
+
+        # Fallback to title
+        title = finding.title.lower()
+        # Extract key terms
+        keywords = [
+            "sql_injection", "sqli", "xss", "cmd_injection", "ssrf",
+            "path_traversal", "hardcoded", "secret", "credential",
+            "weak_crypto", "md5", "sha1", "deserialization", "pickle",
+            "yaml", "eval", "exec", "subprocess", "shell",
+            "missing_auth", "authorization", "csp", "logging",
+            "monkey_patch", "n_plus_one", "n1", "pagination",
+            "egress", "sandbox", "pii", "sensitive",
+        ]
+        for kw in keywords:
+            if kw in title:
+                return kw
+        return title[:50]
+
+    def _match_rule(self, rule: CorrelationRule, findings_by_engine: Dict[str, List[Finding]]) -> List[Finding]:
+        """Check if a correlation rule matches and return boosted findings."""
+        matched_findings = []
+
+        # Check if all required engines have findings
+        for engine in rule.required_engines:
+            if engine not in findings_by_engine or not findings_by_engine[engine]:
+                return []
+
+        # Check if required patterns are present
+        all_patterns = set()
+        for engine_findings in findings_by_engine.values():
+            for f in engine_findings:
+                all_patterns.add(self._extract_pattern_key(f))
+
+        # Flexible matching - check if any required pattern is present
+        pattern_matched = False
+        for required in rule.required_patterns:
+            for pattern in all_patterns:
+                if required.lower() in pattern or pattern in required.lower():
+                    pattern_matched = True
+                    break
+            if pattern_matched:
+                break
+
+        if not pattern_matched:
+            return []
+
+        # Rule matched - boost severity of related findings
+        for engine in rule.required_engines:
+            for finding in findings_by_engine[engine]:
+                pattern_key = self._extract_pattern_key(finding)
+                # Check if this finding is part of the chain
+                for required in rule.required_patterns:
+                    if required.lower() in pattern_key or pattern_key in required.lower():
+                        original_severity = finding.severity
+                        if self.SEVERITY_ORDER.get(rule.boosted_severity, 0) > self.SEVERITY_ORDER.get(original_severity, 0):
+                            boosted = Finding(
+                                engine=finding.engine,
+                                severity=rule.boosted_severity,
+                                title=f"[CORRELATED] {finding.title}",
+                                description=f"{finding.description}\n\nCorrelation: {rule.description} (Chain: {rule.chain_id})",
+                                location=finding.location,
+                                metadata={
+                                    **finding.metadata,
+                                    "chain": rule.chain_id,
+                                    "chain_name": rule.name,
+                                    "boosted_from": original_severity,
+                                    "boosted_to": rule.boosted_severity,
+                                    "correlation_rule": rule.name,
+                                    "original_finding": True,
+                                },
+                            )
+                            matched_findings.append(boosted)
+
+        return matched_findings
+
+    def _find_cross_file_chains(self, all_findings: List[Finding]) -> List[Finding]:
+        """Find correlation chains across different files."""
+        # Group findings by file
+        findings_by_file = defaultdict(list)
+        for f in all_findings:
+            file_path = f.metadata.get("file", f.location.split(":")[0] if ":" in f.location else "unknown")
+            findings_by_file[file_path].append(f)
+
+        chain_findings = []
+
+        # Look for chains within same file
+        for file_path, findings in findings_by_file.items():
+            if len(findings) < 2:
+                continue
+
+            # Check for specific combinations in same file
+            has_sqli = any("sql_injection" in self._extract_pattern_key(f).lower() for f in findings)
+            has_auth_issue = any("auth" in self._extract_pattern_key(f).lower() for f in findings)
+            has_xss = any("xss" in self._extract_pattern_key(f).lower() for f in findings)
+            has_secret = any("secret" in self._extract_pattern_key(f).lower() or "credential" in self._extract_pattern_key(f).lower() for f in findings)
+            has_logging = any("log" in self._extract_pattern_key(f).lower() for f in findings)
+            has_pii = any("pii" in self._extract_pattern_key(f).lower() for f in findings)
+
+            if has_sqli and has_auth_issue:
+                chain_findings.append(Finding(
+                    engine=self.name,
+                    severity="critical",
+                    title="SQLi + Auth Bypass in same file",
+                    description="SQL injection vulnerability combined with authentication bypass in same file",
+                    location=file_path,
+                    metadata={
+                        "chain": "CHAIN-011",
+                        "chain_name": "sqli_auth_same_file",
+                        "components": ["sql_injection", "auth_bypass"],
+                        "file": file_path,
+                    },
+                ))
+
+            if has_xss and has_secret:
+                chain_findings.append(Finding(
+                    engine=self.name,
+                    severity="high",
+                    title="XSS + Secret Exposure in same file",
+                    description="XSS vulnerability could leak hardcoded secrets",
+                    location=file_path,
+                    metadata={
+                        "chain": "CHAIN-012",
+                        "chain_name": "xss_secret_same_file",
+                        "components": ["xss", "secret_exposure"],
+                        "file": file_path,
+                    },
+                ))
+
+            if has_pii and has_logging:
+                chain_findings.append(Finding(
+                    engine=self.name,
+                    severity="high",
+                    title="PII + Logging in same file",
+                    description="PII data being logged - potential data exposure",
+                    location=file_path,
+                    metadata={
+                        "chain": "CHAIN-013",
+                        "chain_name": "pii_logging_same_file",
+                        "components": ["pii", "logging"],
+                        "file": file_path,
+                    },
+                ))
+
+        return chain_findings
+
+    async def run(self, ir: OrionIR, config: EngineConfig) -> EngineResult:
+        all_findings = self._get_all_findings(ir)
+
+        if not all_findings:
+            return EngineResult(engine=self.name, ok=True, metrics={"correlations_found": 0})
+
+        # Group findings by engine
+        findings_by_engine = defaultdict(list)
+        for f in all_findings:
+            findings_by_engine[f.engine].append(f)
+
+        # Apply correlation rules
+        correlated_findings = []
+        for rule in self.CORRELATION_RULES:
+            matched = self._match_rule(rule, findings_by_engine)
+            correlated_findings.extend(matched)
+
+        # Find cross-file chains
+        cross_file_chains = self._find_cross_file_chains(all_findings)
+        correlated_findings.extend(cross_file_chains)
+
+        # Deduplicate by chain_id and location
+        seen = set()
+        deduped = []
+        for f in correlated_findings:
+            key = (f.metadata.get("chain", ""), f.location)
+            if key not in seen:
+                seen.add(key)
+                deduped.append(f)
+
+        return EngineResult(
+            engine=self.name,
+            findings=deduped,
+            ok=True,
+            metrics={
+                "total_findings_analyzed": len(all_findings),
+                "engines_analyzed": len(findings_by_engine),
+                "correlations_found": len(deduped),
+                "rules_evaluated": len(self.CORRELATION_RULES),
+            },
+        )
+
+
+Engine = HunterEngine

package/src/orion/engine/iac_security/engine.py

@@ -0,0 +1,218 @@
+"""Infrastructure as Code (IaC) & Cloud Security Engine.
+
+100% Custom In-House Developed Engine for Orion Engine Platform.
+Scans Terraform, Kubernetes, Dockerfile, CloudFormation, and GitHub Actions CI/CD workflows.
+"""
+import re
+from pathlib import Path
+from typing import List, Dict, Any
+
+from orion.engine.config import EngineConfig, ResourceLimits
+from orion.engine.ir import OrionIR
+from orion.engine.results import EngineResult, Finding
+
+
+IAC_RULES = [
+    # Dockerfile Rules
+    {
+        "id": "IAC-DOCKER-001",
+        "file_types": [".dockerfile", "dockerfile"],
+        "pattern": r"(?i)^\s*USER\s+root\b|(?i)^\s*FROM\s+.*(?!\n\s*USER)",
+        "title": "Container running as root user",
+        "description": "Container should specify a non-root USER to prevent privilege escalation attacks",
+        "severity": "high",
+        "cwe": "CWE-250",
+        "confidence": 0.85,
+    },
+    {
+        "id": "IAC-DOCKER-002",
+        "file_types": [".dockerfile", "dockerfile"],
+        "pattern": r"(?i)^\s*ADD\s+https?://",
+        "title": "Insecure ADD instruction with remote URL",
+        "description": "Use curl/wget with checksum verification or COPY instead of remote ADD",
+        "severity": "medium",
+        "cwe": "CWE-829",
+        "confidence": 0.9,
+    },
+    {
+        "id": "IAC-DOCKER-003",
+        "file_types": [".dockerfile", "dockerfile"],
+        "pattern": r"(?i)^\s*FROM\s+[^:\n]+(?::latest)?\s*$",
+        "title": "Unpinned base image tag",
+        "description": "Base image uses 'latest' or unpinned tag; pin image to specific SHA256 digest or version",
+        "severity": "low",
+        "cwe": "CWE-1104",
+        "confidence": 0.8,
+    },
+
+    # Terraform Rules
+    {
+        "id": "IAC-TF-001",
+        "file_types": [".tf", ".hcl"],
+        "pattern": r'cidr_blocks\s*=\s*\[\s*["\']0\.0\.0\.0/0["\']\s*\]',
+        "title": "Security group open to the world (0.0.0.0/0)",
+        "description": "Security group ingress allows unrestricted inbound traffic from all IP addresses",
+        "severity": "critical",
+        "cwe": "CWE-284",
+        "confidence": 0.95,
+    },
+    {
+        "id": "IAC-TF-002",
+        "file_types": [".tf", ".hcl"],
+        "pattern": r'acl\s*=\s*["\']public-read["\']|acl\s*=\s*["\']public-read-write["\']',
+        "title": "S3 bucket with public read/write ACL",
+        "description": "Cloud storage bucket configured with public access, risk of data exposure",
+        "severity": "critical",
+        "cwe": "CWE-732",
+        "confidence": 0.95,
+    },
+    {
+        "id": "IAC-TF-003",
+        "file_types": [".tf", ".hcl"],
+        "pattern": r'encrypted\s*=\s*false',
+        "title": "Unencrypted storage volume",
+        "description": "Cloud volume or database is configured without server-side encryption enabled",
+        "severity": "high",
+        "cwe": "CWE-311",
+        "confidence": 0.9,
+    },
+
+    # Kubernetes Rules
+    {
+        "id": "IAC-K8S-001",
+        "file_types": [".yaml", ".yml"],
+        "pattern": r'privileged:\s*true',
+        "title": "Kubernetes container running in privileged mode",
+        "description": "Privileged container allows root escalation and container breakout on the host node",
+        "severity": "critical",
+        "cwe": "CWE-250",
+        "confidence": 0.95,
+    },
+    {
+        "id": "IAC-K8S-002",
+        "file_types": [".yaml", ".yml"],
+        "pattern": r'hostNetwork:\s*true|hostPID:\s*true|hostIPC:\s*true',
+        "title": "Kubernetes pod sharing host namespace",
+        "description": "Sharing host network, PID, or IPC allows pod to snoop and interact with host system",
+        "severity": "high",
+        "cwe": "CWE-668",
+        "confidence": 0.9,
+    },
+    {
+        "id": "IAC-K8S-003",
+        "file_types": [".yaml", ".yml"],
+        "pattern": r'allowPrivilegeEscalation:\s*true',
+        "title": "Allow Privilege Escalation enabled in pod",
+        "description": "Container process can gain more privileges than its parent process",
+        "severity": "high",
+        "cwe": "CWE-250",
+        "confidence": 0.9,
+    },
+
+    # CI/CD Workflow Rules (GitHub Actions, GitLab CI)
+    {
+        "id": "IAC-CICD-001",
+        "file_types": [".yaml", ".yml"],
+        "pattern": r'pull_request_target:',
+        "title": "Dangerous pull_request_target trigger in CI workflow",
+        "description": "pull_request_target runs with write permissions and secrets access on untrusted PR fork code",
+        "severity": "critical",
+        "cwe": "CWE-829",
+        "confidence": 0.9,
+    },
+    {
+        "id": "IAC-CICD-002",
+        "file_types": [".yaml", ".yml"],
+        "pattern": r'uses:\s*[a-zA-Z0-9_-]+/[a-zA-Z0-9_.-]+@(main|master|latest)\b',
+        "title": "Unpinned GitHub Actions step reference",
+        "description": "Third-party action pinned to branch instead of full commit SHA hash, supply chain risk",
+        "severity": "medium",
+        "cwe": "CWE-1104",
+        "confidence": 0.85,
+    },
+]
+
+
+class IacSecurityEngine:
+    """100% custom, in-house developed Infrastructure-as-Code & Cloud configuration scanner."""
+
+    name = "iac_security"
+    version = "1.0.0"
+
+    def __init__(self):
+        self._compiled_rules = []
+        for r in IAC_RULES:
+            self._compiled_rules.append({
+                **r,
+                "regex": re.compile(r["pattern"], re.MULTILINE)
+            })
+
+    async def check_availability(self) -> bool:
+        return True
+
+    def resource_limits(self) -> ResourceLimits:
+        return ResourceLimits(max_cpu_seconds=30, max_memory_mb=256)
+
+    async def run(self, ir: OrionIR, config: EngineConfig) -> EngineResult:
+        path_str = ir.metadata.get("path", "").lower()
+        ext = Path(path_str).suffix.lower()
+        filename = Path(path_str).name.lower()
+
+        # Check if file is relevant for IaC
+        is_relevant = (
+            ext in (".tf", ".hcl", ".dockerfile", ".yaml", ".yml", ".json") or
+            filename in ("dockerfile", "docker-compose.yml", "docker-compose.yaml") or
+            ".github" in path_str or "k8s" in path_str or "terraform" in path_str
+        )
+
+        if not is_relevant:
+            return EngineResult(engine=self.name, findings=[], ok=True)
+
+        try:
+            content = ir.content.decode("utf-8", errors="replace")
+        except Exception:
+            return EngineResult(engine=self.name, findings=[], ok=True)
+
+        lines = content.splitlines()
+        findings = []
+
+        for rule in self._compiled_rules:
+            # Match file type
+            matches_file = any(
+                ft == ext or ft == filename or (ft.startswith(".") and path_str.endswith(ft))
+                for ft in rule["file_types"]
+            )
+            if not matches_file:
+                continue
+
+            for match in rule["regex"].finditer(content):
+                line_no = content[:match.start()].count('\n') + 1
+                start_line = max(0, line_no - 2)
+                end_line = min(len(lines), line_no + 2)
+                snippet = '\n'.join(lines[start_line:end_line])
+
+                findings.append(Finding(
+                    engine=self.name,
+                    severity=rule["severity"],
+                    title=f"{rule['id']}: {rule['title']}",
+                    description=rule["description"],
+                    location=f"{ir.metadata.get('path', 'unknown')}:{line_no}",
+                    metadata={
+                        "rule_id": rule["id"],
+                        "cwe": rule["cwe"],
+                        "confidence": rule["confidence"],
+                        "snippet": snippet,
+                        "file": ir.metadata.get("path", "unknown"),
+                        "line": line_no,
+                    }
+                ))
+
+        return EngineResult(
+            engine=self.name,
+            findings=findings,
+            ok=True,
+            metrics={"findings_count": len(findings)}
+        )
+
+
+Engine = IacSecurityEngine

package/src/orion/engine/ir.py

@@ -0,0 +1,22 @@
+import hashlib
+from dataclasses import dataclass, field
+from typing import Any, Dict
+
+
+@dataclass
+class OrionIR:
+    content: bytes
+    metadata: Dict[str, Any] = field(default_factory=dict)
+    _hash: str = field(default="", repr=False)
+
+    def __post_init__(self):
+        if not self._hash:
+            self._hash = hashlib.sha256(self.content).hexdigest()[:16]
+
+    @property
+    def address(self) -> str:
+        return self._hash
+
+    def with_meta(self, **kwargs) -> "OrionIR":
+        meta = {**self.metadata, **kwargs}
+        return OrionIR(content=self.content, metadata=meta, _hash=self._hash)