@orionscanner/cli 0.1.0

package/src/orion/engine/languages.py

@@ -0,0 +1,454 @@
+"""Universal language support for Orion Engine."""
+
+from enum import Enum
+from dataclasses import dataclass
+from typing import Dict, List, Set, Optional
+import os
+
+
+class Language(Enum):
+    """Supported programming languages."""
+    PYTHON = "python"
+    JAVASCRIPT = "javascript"
+    TYPESCRIPT = "typescript"
+    JAVA = "java"
+    GO = "go"
+    RUST = "rust"
+    CPP = "cpp"
+    C = "c"
+    CSHARP = "csharp"
+    PHP = "php"
+    RUBY = "ruby"
+    SWIFT = "swift"
+    KOTLIN = "kotlin"
+    SCALA = "scala"
+    HTML = "html"
+    CSS = "css"
+    SQL = "sql"
+    YAML = "yaml"
+    JSON = "json"
+    TOML = "toml"
+    XML = "xml"
+    DOCKERFILE = "dockerfile"
+    MARKDOWN = "markdown"
+    SHELL = "shell"
+    POWERSHELL = "powershell"
+    UNKNOWN = "unknown"
+
+
+# File extension to language mapping
+EXTENSION_MAP: Dict[str, Language] = {
+    # Python
+    ".py": Language.PYTHON,
+    ".pyw": Language.PYTHON,
+    ".pyi": Language.PYTHON,
+    
+    # JavaScript/TypeScript
+    ".js": Language.JAVASCRIPT,
+    ".jsx": Language.JAVASCRIPT,
+    ".mjs": Language.JAVASCRIPT,
+    ".cjs": Language.JAVASCRIPT,
+    ".ts": Language.TYPESCRIPT,
+    ".tsx": Language.TYPESCRIPT,
+    ".mts": Language.TYPESCRIPT,
+    ".cts": Language.TYPESCRIPT,
+    
+    # Java
+    ".java": Language.JAVA,
+    
+    # Go
+    ".go": Language.GO,
+    
+    # Rust
+    ".rs": Language.RUST,
+    
+    # C/C++
+    ".c": Language.C,
+    ".h": Language.C,
+    ".cpp": Language.CPP,
+    ".cc": Language.CPP,
+    ".cxx": Language.CPP,
+    ".hpp": Language.CPP,
+    ".hxx": Language.CPP,
+    
+    # C#
+    ".cs": Language.CSHARP,
+    
+    # PHP
+    ".php": Language.PHP,
+    ".phtml": Language.PHP,
+    
+    # Ruby
+    ".rb": Language.RUBY,
+    ".erb": Language.RUBY,
+    
+    # Swift
+    ".swift": Language.SWIFT,
+    
+    # Kotlin
+    ".kt": Language.KOTLIN,
+    ".kts": Language.KOTLIN,
+    
+    # Scala
+    ".scala": Language.SCALA,
+    
+    # Web
+    ".html": Language.HTML,
+    ".htm": Language.HTML,
+    ".xhtml": Language.HTML,
+    ".css": Language.CSS,
+    ".scss": Language.CSS,
+    ".sass": Language.CSS,
+    ".less": Language.CSS,
+    
+    # SQL
+    ".sql": Language.SQL,
+    
+    # Config
+    ".yaml": Language.YAML,
+    ".yml": Language.YAML,
+    ".json": Language.JSON,
+    ".toml": Language.TOML,
+    ".xml": Language.XML,
+    ".ini": Language.YAML,
+    ".cfg": Language.YAML,
+    ".conf": Language.YAML,
+    ".properties": Language.YAML,
+    
+    # Docker/Container
+    "Dockerfile": Language.DOCKERFILE,
+    "dockerfile": Language.DOCKERFILE,
+    ".dockerfile": Language.DOCKERFILE,
+    "docker-compose.yml": Language.DOCKERFILE,
+    "docker-compose.yaml": Language.DOCKERFILE,
+    
+    # Shell
+    ".sh": Language.SHELL,
+    ".bash": Language.SHELL,
+    ".zsh": Language.SHELL,
+    ".fish": Language.SHELL,
+    
+    # PowerShell
+    ".ps1": Language.POWERSHELL,
+    ".psm1": Language.POWERSHELL,
+    ".psd1": Language.POWERSHELL,
+    
+    # Documentation
+    ".md": Language.MARKDOWN,
+    ".markdown": Language.MARKDOWN,
+    ".rst": Language.MARKDOWN,
+    
+    # Config files without extensions
+    "Makefile": Language.SHELL,
+    "makefile": Language.SHELL,
+    "CMakeLists.txt": Language.SHELL,
+    ".gitignore": Language.YAML,
+    ".gitattributes": Language.YAML,
+    ".editorconfig": Language.YAML,
+    ".env": Language.YAML,
+    ".env.example": Language.YAML,
+    ".env.local": Language.YAML,
+    "package.json": Language.JSON,
+    "package-lock.json": Language.JSON,
+    "yarn.lock": Language.YAML,
+    "pnpm-lock.yaml": Language.YAML,
+    "requirements.txt": Language.YAML,
+    "requirements-dev.txt": Language.YAML,
+    "Pipfile": Language.TOML,
+    "Pipfile.lock": Language.JSON,
+    "pyproject.toml": Language.TOML,
+    "poetry.lock": Language.JSON,
+    "Cargo.toml": Language.TOML,
+    "Cargo.lock": Language.JSON,
+    "go.mod": Language.YAML,
+    "go.sum": Language.YAML,
+    "pom.xml": Language.XML,
+    "build.gradle": Language.SHELL,
+    "build.gradle.kts": Language.SHELL,
+    "settings.gradle": Language.SHELL,
+    "composer.json": Language.JSON,
+    "composer.lock": Language.JSON,
+    "Gemfile": Language.YAML,
+    "Gemfile.lock": Language.YAML,
+    "mix.exs": Language.SHELL,
+    "mix.lock": Language.YAML,
+    "pubspec.yaml": Language.YAML,
+    "pubspec.lock": Language.YAML,
+}
+
+
+# Filename patterns for special files
+FILENAME_PATTERNS: Dict[str, Language] = {
+    "Dockerfile": Language.DOCKERFILE,
+    "dockerfile": Language.DOCKERFILE,
+    "docker-compose.yml": Language.DOCKERFILE,
+    "docker-compose.yaml": Language.DOCKERFILE,
+    "docker-compose.override.yml": Language.DOCKERFILE,
+    "docker-compose.override.yaml": Language.DOCKERFILE,
+    "Makefile": Language.SHELL,
+    "makefile": Language.SHELL,
+    "CMakeLists.txt": Language.SHELL,
+    "CMakeLists.txt": Language.SHELL,
+}
+
+
+def detect_language(filepath: str) -> Language:
+    """Detect language from file path."""
+    filename = os.path.basename(filepath)
+    
+    # Check exact filename matches first
+    if filename in FILENAME_PATTERNS:
+        return FILENAME_PATTERNS[filename]
+    
+    # Check extension
+    _, ext = os.path.splitext(filename)
+    ext = ext.lower()
+    if ext in EXTENSION_MAP:
+        return EXTENSION_MAP[ext]
+    
+    # Check for double extensions (e.g., .dockerfile, .min.js)
+    if '.' in filename:
+        parts = filename.split('.')
+        if len(parts) > 2:
+            double_ext = '.' + '.'.join(parts[-2:]).lower()
+            if double_ext in EXTENSION_MAP:
+                return EXTENSION_MAP[double_ext]
+    
+    return Language.UNKNOWN
+
+
+def is_binary_file(filepath: str) -> bool:
+    """Quick check if file is likely binary."""
+    try:
+        with open(filepath, 'rb') as f:
+            chunk = f.read(8192)
+            return b'\x00' in chunk
+    except Exception:
+        return True
+
+
+# Language groups for engine targeting
+LANGUAGE_GROUPS: Dict[str, Set[Language]] = {
+    "pythonic": {Language.PYTHON},
+    "javascript": {Language.JAVASCRIPT, Language.TYPESCRIPT},
+    "jvm": {Language.JAVA, Language.KOTLIN, Language.SCALA},
+    "native": {Language.C, Language.CPP, Language.RUST, Language.GO, Language.CSHARP},
+    "web": {Language.HTML, Language.CSS, Language.JAVASCRIPT, Language.TYPESCRIPT},
+    "scripting": {Language.PYTHON, Language.JAVASCRIPT, Language.TYPESCRIPT, Language.PHP, Language.RUBY, Language.SHELL, Language.POWERSHELL},
+    "compiled": {Language.C, Language.CPP, Language.RUST, Language.GO, Language.JAVA, Language.CSHARP, Language.SWIFT, Language.KOTLIN, Language.SCALA},
+    "interpreted": {Language.PYTHON, Language.JAVASCRIPT, Language.TYPESCRIPT, Language.PHP, Language.RUBY, Language.SHELL},
+    "config": {Language.YAML, Language.JSON, Language.TOML, Language.XML},
+    "container": {Language.DOCKERFILE},
+    "data": {Language.SQL, Language.JSON, Language.YAML, Language.XML},
+    "web_static": {Language.HTML, Language.CSS},
+    "documentation": {Language.MARKDOWN},
+}
+
+
+def get_language_group(language: Language) -> List[str]:
+    """Get groups a language belongs to."""
+    groups = []
+    for group_name, langs in LANGUAGE_GROUPS.items():
+        if language in langs:
+            groups.append(group_name)
+    return groups
+
+
+@dataclass
+class LanguageCapabilities:
+    """What analysis capabilities are available for a language."""
+    language: Language
+    has_ast_parser: bool = False
+    has_tree_sitter: bool = False
+    sast_patterns: int = 0
+    secret_patterns: int = 0
+    dep_parsers: List[str] = None
+    taint_sources: List[str] = None
+    taint_sinks: List[str] = None
+    
+    def __post_init__(self):
+        if self.dep_parsers is None:
+            self.dep_parsers = []
+        if self.taint_sources is None:
+            self.taint_sources = []
+        if self.taint_sinks is None:
+            self.taint_sinks = []
+
+
+# Language capability registry
+LANGUAGE_CAPABILITIES: Dict[Language, LanguageCapabilities] = {
+    Language.PYTHON: LanguageCapabilities(
+        language=Language.PYTHON,
+        has_ast_parser=True,
+        has_tree_sitter=True,
+        sast_patterns=28,
+        secret_patterns=12,
+        dep_parsers=["requirements.txt", "pyproject.toml", "Pipfile", "poetry.lock", "setup.py"],
+        taint_sources=["request.", "input(", "sys.argv", "os.environ", "request.GET", "request.POST"],
+        taint_sinks=["execute", "eval", "exec", "system", "popen", "subprocess", "render_template_string"],
+    ),
+    Language.JAVASCRIPT: LanguageCapabilities(
+        language=Language.JAVASCRIPT,
+        has_ast_parser=True,
+        has_tree_sitter=True,
+        sast_patterns=6,
+        secret_patterns=8,
+        dep_parsers=["package.json", "package-lock.json", "yarn.lock", "pnpm-lock.yaml"],
+        taint_sources=["req.body", "req.query", "req.params", "req.headers", "process.env"],
+        taint_sinks=["eval", "exec", "Function", "innerHTML", "outerHTML", "document.write"],
+    ),
+    Language.TYPESCRIPT: LanguageCapabilities(
+        language=Language.TYPESCRIPT,
+        has_ast_parser=True,
+        has_tree_sitter=True,
+        sast_patterns=6,
+        secret_patterns=8,
+        dep_parsers=["package.json", "package-lock.json", "yarn.lock", "pnpm-lock.yaml"],
+        taint_sources=["req.body", "req.query", "req.params", "req.headers", "process.env"],
+        taint_sinks=["eval", "exec", "Function", "innerHTML", "outerHTML", "document.write"],
+    ),
+    Language.JAVA: LanguageCapabilities(
+        language=Language.JAVA,
+        has_ast_parser=True,
+        has_tree_sitter=True,
+        sast_patterns=0,
+        secret_patterns=8,
+        dep_parsers=["pom.xml", "build.gradle", "build.gradle.kts"],
+        taint_sources=["request.getParameter", "request.getHeader", "System.getenv"],
+        taint_sinks=["executeQuery", "executeUpdate", "Runtime.exec", "ProcessBuilder"],
+    ),
+    Language.GO: LanguageCapabilities(
+        language=Language.GO,
+        has_ast_parser=True,
+        has_tree_sitter=True,
+        sast_patterns=0,
+        secret_patterns=8,
+        dep_parsers=["go.mod", "go.sum"],
+        taint_sources=["r.FormValue", "r.URL.Query", "os.Getenv"],
+        taint_sinks=["Exec", "Query", "ExecContext", "os/exec.Command"],
+    ),
+    Language.RUST: LanguageCapabilities(
+        language=Language.RUST,
+        has_ast_parser=True,
+        has_tree_sitter=True,
+        sast_patterns=0,
+        secret_patterns=8,
+        dep_parsers=["Cargo.toml", "Cargo.lock"],
+        taint_sources=["std::env::var", "req.body", "req.query"],
+        taint_sinks=["std::process::Command", "sqlx::query", "diesel::RunQueryDsl"],
+    ),
+    Language.CSHARP: LanguageCapabilities(
+        language=Language.CSHARP,
+        has_ast_parser=True,
+        has_tree_sitter=True,
+        sast_patterns=0,
+        secret_patterns=8,
+        dep_parsers=["*.csproj", "packages.config", "paket.dependencies"],
+        taint_sources=["Request.QueryString", "Request.Form", "Environment.GetEnvironmentVariable"],
+        taint_sinks=["SqlCommand.ExecuteReader", "Process.Start", "SqlCommand.ExecuteNonQuery"],
+    ),
+    Language.PHP: LanguageCapabilities(
+        language=Language.PHP,
+        has_ast_parser=True,
+        has_tree_sitter=True,
+        sast_patterns=0,
+        secret_patterns=8,
+        dep_parsers=["composer.json", "composer.lock"],
+        taint_sources=["$_GET", "$_POST", "$_REQUEST", "$_COOKIE", "$_SERVER", "$_ENV"],
+        taint_sinks=["exec", "system", "shell_exec", "passthru", "proc_open", "eval", "mysqli_query"],
+    ),
+    Language.RUBY: LanguageCapabilities(
+        language=Language.RUBY,
+        has_ast_parser=True,
+        has_tree_sitter=True,
+        sast_patterns=0,
+        secret_patterns=8,
+        dep_parsers=["Gemfile", "Gemfile.lock"],
+        taint_sources=["params", "request.env", "ENV"],
+        taint_sinks=["system", "exec", "`", "eval", "ActiveRecord::Base.connection.execute"],
+    ),
+    Language.HTML: LanguageCapabilities(
+        language=Language.HTML,
+        has_ast_parser=False,
+        has_tree_sitter=True,
+        sast_patterns=0,
+        secret_patterns=4,
+        dep_parsers=[],
+        taint_sources=[],
+        taint_sinks=["innerHTML", "outerHTML", "document.write", "eval"],
+    ),
+    Language.CSS: LanguageCapabilities(
+        language=Language.CSS,
+        has_ast_parser=False,
+        has_tree_sitter=True,
+        sast_patterns=0,
+        secret_patterns=0,
+        dep_parsers=[],
+        taint_sources=[],
+        taint_sinks=[],
+    ),
+    Language.YAML: LanguageCapabilities(
+        language=Language.YAML,
+        has_ast_parser=False,
+        has_tree_sitter=False,
+        sast_patterns=0,
+        secret_patterns=8,
+        dep_parsers=[],
+        taint_sources=[],
+        taint_sinks=[],
+    ),
+    Language.JSON: LanguageCapabilities(
+        language=Language.JSON,
+        has_ast_parser=False,
+        has_tree_sitter=False,
+        sast_patterns=0,
+        secret_patterns=4,
+        dep_parsers=["package.json", "composer.json", "composer.lock", "poetry.lock"],
+        taint_sources=[],
+        taint_sinks=[],
+    ),
+    Language.TOML: LanguageCapabilities(
+        language=Language.TOML,
+        has_ast_parser=False,
+        has_tree_sitter=False,
+        sast_patterns=0,
+        secret_patterns=4,
+        dep_parsers=["pyproject.toml", "Cargo.toml"],
+        taint_sources=[],
+        taint_sinks=[],
+    ),
+    Language.DOCKERFILE: LanguageCapabilities(
+        language=Language.DOCKERFILE,
+        has_ast_parser=False,
+        has_tree_sitter=False,
+        sast_patterns=0,
+        secret_patterns=8,
+        dep_parsers=["Dockerfile", "docker-compose.yml"],
+        taint_sources=[],
+        taint_sinks=["ADD http", "ADD https", "RUN curl", "RUN wget"],
+    ),
+}
+
+
+def get_capabilities(language: Language) -> LanguageCapabilities:
+    """Get capabilities for a language."""
+    return LANGUAGE_CAPABILITIES.get(language, LanguageCapabilities(language=language))
+
+
+def get_supported_languages() -> List[Language]:
+    """Get all supported languages."""
+    return list(Language)[:-1]  # Exclude UNKNOWN
+
+
+__all__ = [
+    "Language",
+    "detect_language",
+    "is_binary_file",
+    "LanguageCapabilities",
+    "get_capabilities",
+    "get_supported_languages",
+    "LANGUAGE_GROUPS",
+    "get_language_group",
+    "EXTENSION_MAP",
+    "FILENAME_PATTERNS",
+]

package/src/orion/engine/license/engine.py

@@ -0,0 +1,172 @@
+"""License header + GPL contamination detection engine."""
+import re
+import os
+from pathlib import Path
+from orion.engine.config import EngineConfig
+from orion.engine.ir import OrionIR
+from orion.engine.results import EngineResult, Finding
+
+
+class Engine:
+    name = "license"
+    version = "1.0.0"
+
+    SPDX_PATTERN = re.compile(r"SPDX-License-Identifier:\s*([A-Za-z0-9\.\-\+]+)")
+    LICENSE_HEADER_PATTERNS = [
+        re.compile(r"Copyright\s+\(c\)\s+\d{4}"),
+        re.compile(r"Licensed under the\s+([A-Za-z0-9\.\-\+]+)"),
+        re.compile(r"License:\s*([A-Za-z0-9\.\-\+]+)"),
+    ]
+
+    GPL_LICENSES = {
+        "GPL-2.0", "GPL-3.0", "AGPL-3.0", "LGPL-2.1", "LGPL-3.0",
+        "GPL-2.0-only", "GPL-2.0-or-later", "GPL-3.0-only", "GPL-3.0-or-later",
+        "AGPL-3.0-only", "AGPL-3.0-or-later", "LGPL-2.1-only", "LGPL-2.1-or-later",
+        "LGPL-3.0-only", "LGPL-3.0-or-later",
+    }
+
+    PERMISSIVE_LICENSES = {
+        "MIT", "Apache-2.0", "BSD-2-Clause", "BSD-3-Clause", "ISC", "MPL-2.0",
+        "Unlicense", "0BSD", "Zlib", "Python-2.0",
+    }
+
+    TEST_PATHS = {"test", "tests", "testing", "spec", "specs", "__pycache__", "vendor", "third_party", "generated"}
+    GENERATED_MARKERS = ["generated", "auto-generated", "do not edit", "codegen"]
+
+    async def check_availability(self) -> bool:
+        return True
+
+    def resource_limits(self):
+        from orion.engine.config import ResourceLimits
+        return ResourceLimits(max_cpu_seconds=30, max_memory_mb=128)
+
+    async def run(self, ir: OrionIR, config: EngineConfig) -> EngineResult:
+        try:
+            text = ir.content.decode("utf-8", errors="replace")
+        except Exception:
+            text = str(ir.content)
+
+        path = ir.metadata.get("path", "unknown")
+        findings = []
+
+        if self._is_test_or_generated(path, text):
+            return EngineResult(engine=self.name, findings=findings, ok=True)
+
+        has_spdx, spdx_license = self._check_spdx_header(text)
+        has_license_hdr, hdr_license = self._check_license_header(text)
+        detected_license = spdx_license or hdr_license
+
+        # Focus on GPL/Copyleft contamination in proprietary projects
+        if detected_license and self._is_gpl_contaminated(detected_license):
+            findings.append(Finding(
+                engine=self.name,
+                severity="high",
+                title=f"GPL/Copyleft Contamination Risk: {detected_license}",
+                description=f"Strong copyleft license '{detected_license}' detected, which may impose open-source distribution requirements",
+                location=path,
+                metadata={
+                    "license": detected_license,
+                    "risk": "gpl_copyleft",
+                    "cwe": "CWE-1104",
+                    "confidence": 0.95,
+                },
+            ))
+
+        return EngineResult(engine=self.name, findings=findings, ok=True)
+
+    def _is_test_or_generated(self, path: str, text: str) -> bool:
+        path_lower = path.lower()
+        for test_dir in self.TEST_PATHS:
+            if f"/{test_dir}/" in path_lower or path_lower.startswith(f"{test_dir}/"):
+                return True
+        for marker in self.GENERATED_MARKERS:
+            if marker.lower() in text[:500].lower():
+                return True
+        return False
+
+    def _check_spdx_header(self, text: str):
+        lines = text.splitlines()[:30]
+        header_text = "\n".join(lines)
+        match = self.SPDX_PATTERN.search(header_text)
+        if match:
+            return True, match.group(1).strip()
+        for pattern in self.LICENSE_HEADER_PATTERNS:
+            match = pattern.search(header_text)
+            if match:
+                return True, match.group(1).strip() if match.groups() else "Unknown"
+        return False, None
+
+    def _check_root_license_files(self, path: str):
+        findings = []
+        p = Path(path)
+        project_root = None
+        for parent in p.parents:
+            if (parent / ".git").exists() or (parent / "pyproject.toml").exists() or (parent / "package.json").exists():
+                project_root = parent
+                break
+
+        if project_root:
+            license_files = list(project_root.glob("LICENSE*")) + list(project_root.glob("COPYING*"))
+            if not license_files:
+                findings.append(Finding(
+                    engine=self.name,
+                    severity="low",
+                    title="Missing license file at project root",
+                    description="No LICENSE or COPYING file found in project root",
+                    location=str(project_root),
+                    metadata={
+                        "confidence": 0.8,
+                        "missing_license_file": True,
+                        "project_root": str(project_root),
+                    },
+                ))
+            else:
+                for lf in license_files:
+                    try:
+                        content = lf.read_text(encoding="utf-8", errors="replace")
+                        for gpl in self.GPL_LICENSES:
+                            if gpl in content:
+                                findings.append(Finding(
+                                    engine=self.name,
+                                    severity="high",
+                                    title=f"GPL/AGPL license file detected: {gpl}",
+                                    description=f"Project root license file contains {gpl}",
+                                    location=str(lf),
+                                    metadata={
+                                        "confidence": 0.95,
+                                        "license": gpl,
+                                        "file": str(lf),
+                                        "cwe": "CWE-1104",
+                                    },
+                                ))
+                    except Exception:
+                        pass
+        return findings
+
+    def _check_dep_gpl_conflicts(self, ir: OrionIR, file_license: str):
+        findings = []
+        if file_license not in self.PERMISSIVE_LICENSES:
+            return findings
+
+        metrics = ir.metadata.get("metrics", {})
+        deps = metrics.get("deps", {})
+        if isinstance(deps, dict):
+            for dep_name, dep_info in deps.items():
+                dep_license = dep_info.get("license") if isinstance(dep_info, dict) else None
+                if dep_license and dep_license in self.GPL_LICENSES:
+                    findings.append(Finding(
+                        engine=self.name,
+                        severity="high",
+                        title=f"GPL/AGPL dependency in permissive project: {dep_name}",
+                        description=f"Dependency '{dep_name}' uses {dep_license} but project uses {file_license or 'permissive'} license",
+                        location=ir.metadata.get("path", "unknown"),
+                        metadata={
+                            "confidence": 0.85,
+                            "gpl_dep": dep_name,
+                            "license": dep_license,
+                            "project_license": file_license,
+                            "cwe": "CWE-1104",
+                            "cvss": 7.0,
+                        },
+                    ))
+        return findings