@orionscanner/cli 0.1.0

package/src/orion/engine/perf_guard/engine.py

@@ -0,0 +1,345 @@
+"""Performance anti-patterns detection engine - AST analysis."""
+import ast
+import re
+from orion.engine.config import EngineConfig
+from orion.engine.ir import OrionIR
+from orion.engine.results import EngineResult, Finding
+
+
+class Engine:
+    name = "perf_guard"
+    version = "1.0.0"
+
+    DB_QUERY_METHODS = {
+        "execute", "executemany", "query", "find", "find_one", "get", "filter",
+        "filter_by", "all", "first", "one", "scalar", "scalars", "fetchone",
+        "fetchall", "fetchmany", "select", "insert", "update", "delete",
+        "aggregate", "count", "exists", "bulk_insert", "bulk_update",
+    }
+
+    HOT_LOOP_METHODS = {"append", "extend", "insert", "add", "update"}
+    STRING_CONCAT_PATTERNS = {"__iadd__", "__add__"}
+    SYNC_IO_IN_ASYNC = {"open", "read", "write", "readline", "readlines", "requests.get", "requests.post", "requests.put", "requests.delete", "requests.request", "urllib.request.urlopen", "httpx.get", "httpx.post", "httpx.put", "httpx.delete"}
+
+    COMPILE_PATTERN = re.compile(r"re\.compile|re\.search|re\.match|re\.findall|re\.sub|re\.split")
+
+    async def check_availability(self) -> bool:
+        return True
+
+    def resource_limits(self):
+        from orion.engine.config import ResourceLimits
+        return ResourceLimits(max_cpu_seconds=60, max_memory_mb=256)
+
+    async def run(self, ir: OrionIR, config: EngineConfig) -> EngineResult:
+        try:
+            text = ir.content.decode("utf-8", errors="replace")
+        except Exception:
+            return EngineResult(engine=self.name, findings=[], ok=True)
+
+        path = ir.metadata.get("path", "unknown")
+        is_test = self._is_test_file(path)
+
+        try:
+            tree = ast.parse(text, filename=path)
+        except SyntaxError:
+            return EngineResult(engine=self.name, findings=[], ok=True)
+
+        findings = []
+        visitor = PerfVisitor(path, is_test, text.splitlines())
+        visitor.visit(tree)
+        findings.extend(visitor.findings)
+
+        findings.extend(self._check_regex_compile_in_loop(text, path))
+        findings.extend(self._check_json_in_hot_path(text, path))
+
+        return EngineResult(engine=self.name, findings=findings, ok=True)
+
+    def _is_test_file(self, path: str) -> bool:
+        return any(p in path for p in ["test_", "_test.py", "/tests/", "/test/", "conftest.py"])
+
+    def _check_regex_compile_in_loop(self, text: str, path: str) -> list[Finding]:
+        findings = []
+        lines = text.splitlines()
+        in_loop = False
+        loop_depth = 0
+
+        for i, line in enumerate(lines):
+            stripped = line.strip()
+            if re.match(r"^\s*(for|while)\s+", stripped):
+                loop_depth += 1
+                in_loop = True
+            elif stripped and not stripped.startswith("#"):
+                if loop_depth > 0:
+                    if self.COMPILE_PATTERN.search(line):
+                        findings.append(Finding(
+                            engine=self.name,
+                            severity="medium",
+                            title="re.compile in loop",
+                            description="Regex compilation inside loop - compile once outside loop",
+                            location=f"{path}:{i + 1}",
+                            metadata={
+                                "confidence": 0.85,
+                                "snippet": line.strip()[:200],
+                                "pattern": "re_compile_in_loop",
+                                "cwe": "CWE-1054",
+                            },
+                        ))
+
+            if loop_depth > 0 and stripped and not re.match(r"^\s*(for|while|if|elif|else|try|except|finally|with|def|class|async)\s", stripped):
+                pass
+            if "dedent" in stripped.lower() or (stripped == "" and loop_depth > 0):
+                pass
+
+            indent = len(line) - len(line.lstrip())
+            if i + 1 < len(lines):
+                next_indent = len(lines[i + 1]) - len(lines[i + 1].lstrip())
+                if next_indent < indent and loop_depth > 0:
+                    loop_depth = max(0, loop_depth - 1)
+
+        return findings
+
+    def _check_json_in_hot_path(self, text: str, path: str) -> list[Finding]:
+        findings = []
+        lines = text.splitlines()
+        in_loop = False
+        loop_depth = 0
+
+        for i, line in enumerate(lines):
+            stripped = line.strip()
+            if re.match(r"^\s*(for|while)\s+", stripped):
+                loop_depth += 1
+                in_loop = True
+            elif in_loop and ("json.loads" in line or "json.dumps" in line or "json.load" in line or "json.dump" in line):
+                findings.append(Finding(
+                    engine=self.name,
+                    severity="medium",
+                    title="json.loads/dumps in loop",
+                    description="JSON serialization in hot loop - consider batching or caching",
+                    location=f"{path}:{i + 1}",
+                    metadata={
+                        "confidence": 0.8,
+                        "snippet": line.strip()[:200],
+                        "pattern": "json_in_loop",
+                        "cwe": "CWE-1054",
+                    },
+                ))
+
+            indent = len(line) - len(line.lstrip())
+            if i + 1 < len(lines):
+                next_indent = len(lines[i + 1]) - len(lines[i + 1].lstrip())
+                if next_indent < indent and loop_depth > 0:
+                    loop_depth = max(0, loop_depth - 1)
+
+        return findings
+
+
+class PerfVisitor(ast.NodeVisitor):
+    def __init__(self, filepath: str, is_test: bool, lines: list[str]):
+        self.filepath = filepath
+        self.is_test = is_test
+        self.lines = lines
+        self.findings = []
+        self.loop_vars = []
+        self.in_async_function = False
+        self.current_loop_depth = 0
+
+    def visit_For(self, node: ast.For):
+        old_depth = self.current_loop_depth
+        self.current_loop_depth += 1
+
+        if self.current_loop_depth >= 2:
+            self._check_nested_loops(node)
+
+        self._check_db_query_in_loop(node)
+        self._check_list_append_in_loop(node)
+        self._check_string_concat_in_loop(node)
+        self._check_large_in_memory_load(node)
+        self._check_missing_pagination(node)
+
+        old_vars = self.loop_vars[:]
+        if isinstance(node.target, ast.Name):
+            self.loop_vars.append(node.target.id)
+        elif isinstance(node.target, ast.Tuple):
+            for elt in node.target.elts:
+                if isinstance(elt, ast.Name):
+                    self.loop_vars.append(elt.id)
+
+        self.generic_visit(node)
+
+        self.loop_vars = old_vars
+        self.current_loop_depth = old_depth
+
+    def visit_While(self, node: ast.While):
+        old_depth = self.current_loop_depth
+        self.current_loop_depth += 1
+
+        if self.current_loop_depth >= 2:
+            self._check_nested_loops(node)
+
+        self._check_db_query_in_loop(node)
+        self._check_list_append_in_loop(node)
+        self._check_string_concat_in_loop(node)
+        self._check_large_in_memory_load(node)
+        self._check_missing_pagination(node)
+
+        # While nodes don't have a target like For nodes
+        old_vars = self.loop_vars[:]
+        self.generic_visit(node)
+        self.loop_vars = old_vars
+        self.current_loop_depth = old_depth
+
+    def visit_AsyncFunctionDef(self, node: ast.AsyncFunctionDef):
+        old_async = self.in_async_function
+        self.in_async_function = True
+        self.generic_visit(node)
+        self.in_async_function = old_async
+
+    def visit_Call(self, node: ast.Call):
+        if self.in_async_function:
+            self._check_sync_io_in_async(node)
+
+        self._check_repeated_compile(node)
+
+        self.generic_visit(node)
+
+    def _check_nested_loops(self, node: ast.For):
+        outer_var = self.loop_vars[-1] if self.loop_vars else None
+        inner_var = None
+        if isinstance(node.target, ast.Name):
+            inner_var = node.target.id
+        elif isinstance(node.target, ast.Tuple):
+            for elt in node.target.elts:
+                if isinstance(elt, ast.Name):
+                    inner_var = elt.id
+                    break
+
+        if outer_var and inner_var and outer_var == inner_var:
+            self._add_finding(node, "nested_loop_same_var",
+                f"Nested loops using same variable '{outer_var}' - likely O(n²)",
+                "Use different variable names or consider algorithm optimization",
+                confidence=0.8)
+
+    def _check_db_query_in_loop(self, node: ast.For):
+        db_callers = {"db", "session", "cursor", "conn", "connection", "repo", "repository", "query", "orm"}
+        strict_db_methods = {"execute", "executemany", "raw", "raw_sql", "fetchmany", "fetchall"}
+
+        for stmt in ast.walk(node):
+            if isinstance(stmt, ast.Call) and isinstance(stmt.func, ast.Attribute):
+                caller_name = ""
+                if isinstance(stmt.func.value, ast.Name):
+                    caller_name = stmt.func.value.id.lower()
+
+                method_name = stmt.func.attr.lower()
+
+                # Flag only if explicit DB caller or strictly SQL execution method on a database object
+                if (caller_name in db_callers and method_name in {"execute", "query", "find", "select", "insert", "update", "delete"}) or \
+                   (method_name in strict_db_methods and caller_name not in {"dict", "json", "re", "os", "sys"}):
+                    self._add_finding(stmt, "n_plus_one_query",
+                        f"Database query '{stmt.func.attr}' in loop - potential N+1",
+                        "Use batch loading, joins, or prefetch to avoid N+1 queries",
+                        confidence=0.85)
+                    break
+
+    def _check_list_append_in_loop(self, node: ast.For):
+        # Do not flag standard list accumulation as an error
+        pass
+
+    def _is_list_comprehension_possible(self, loop_node: ast.For, list_var: str) -> bool:
+        append_count = 0
+        other_stmts = 0
+        for stmt in ast.walk(loop_node):
+            if stmt is loop_node:
+                continue
+            if isinstance(stmt, ast.Call) and isinstance(stmt.func, ast.Attribute):
+                if stmt.func.attr == "append" and isinstance(stmt.func.value, ast.Name) and stmt.func.value.id == list_var:
+                    append_count += 1
+            elif isinstance(stmt, (ast.Assign, ast.AugAssign, ast.If, ast.For, ast.While, ast.Try, ast.With)):
+                other_stmts += 1
+        return append_count > 0 and other_stmts == 0
+
+    def _check_string_concat_in_loop(self, node: ast.For):
+        for stmt in ast.walk(node):
+            if isinstance(stmt, ast.AugAssign) and isinstance(stmt.op, ast.Add):
+                if isinstance(stmt.target, ast.Name):
+                    self._add_finding(stmt, "string_concat_in_loop",
+                        f"String concatenation (+=) in loop for '{stmt.target.id}'",
+                        "Use list append + ''.join() or StringIO for better performance",
+                        confidence=0.85)
+                    break
+
+    def _check_large_in_memory_load(self, node: ast.For):
+        for stmt in ast.walk(node):
+            if isinstance(stmt, ast.Call) and isinstance(stmt.func, ast.Attribute):
+                if stmt.func.attr in ("fetchall", "read", "readlines", "read_all"):
+                    if isinstance(stmt.func.value, ast.Name):
+                        self._add_finding(stmt, "large_in_memory_load",
+                            f"Large in-memory load '{stmt.func.attr}()' in loop",
+                            "Use pagination, streaming, or chunked processing",
+                            confidence=0.8)
+                        break
+
+    def _check_missing_pagination(self, node: ast.For):
+        for stmt in ast.walk(node):
+            if isinstance(stmt, ast.Call) and isinstance(stmt.func, ast.Attribute):
+                if stmt.func.attr in ("query", "filter", "filter_by", "find", "select", "all"):
+                    has_limit = False
+                    has_offset = False
+                    for kw in stmt.keywords:
+                        if kw.arg in ("limit", "offset", "page", "per_page", "skip", "take"):
+                            if kw.arg in ("limit", "per_page", "take", "page_size"):
+                                has_limit = True
+                            if kw.arg in ("offset", "skip", "page"):
+                                has_offset = True
+                    if not has_limit and not has_offset:
+                        self._add_finding(stmt, "missing_pagination",
+                            f"Query '{stmt.func.attr}' without pagination (limit/offset)",
+                            "Add limit/offset or pagination to prevent large result sets",
+                            confidence=0.75)
+                        break
+
+    def _check_sync_io_in_async(self, node: ast.Call):
+        func_name = self._get_call_name(node)
+        if func_name and any(pattern in func_name for pattern in self.SYNC_IO_IN_ASYNC):
+            self._add_finding(node, "sync_io_in_async",
+                f"Synchronous I/O '{func_name}' in async function",
+                "Use async alternatives (aiofiles, aiohttp, asyncpg, etc.)",
+                confidence=0.85)
+
+    def _check_repeated_compile(self, node: ast.Call):
+        func_name = self._get_call_name(node)
+        if func_name and "re.compile" in func_name:
+            pass
+
+    def _get_call_name(self, node: ast.Call) -> str | None:
+        if isinstance(node.func, ast.Name):
+            return node.func.id
+        elif isinstance(node.func, ast.Attribute):
+            parts = []
+            current = node.func
+            while isinstance(current, ast.Attribute):
+                parts.append(current.attr)
+                current = current.value
+            if isinstance(current, ast.Name):
+                parts.append(current.id)
+            return ".".join(reversed(parts))
+        return None
+
+    def _add_finding(self, node: ast.AST, pattern: str, title: str, description: str, confidence: float):
+        line_no = getattr(node, "lineno", 0)
+        snippet = self.lines[line_no - 1].strip() if 0 < line_no <= len(self.lines) else ""
+        self.findings.append(Finding(
+            engine="perf_guard",
+            severity="high" if confidence >= 0.85 else "medium",
+            title=title,
+            description=description,
+            location=f"{self.filepath}:{line_no}",
+            metadata={
+                "confidence": confidence,
+                "pattern": pattern,
+                "snippet": snippet[:200],
+                "cwe": "CWE-1054",
+            },
+        ))
+
+    SYNC_IO_IN_ASYNC = {"open", "read", "write", "readline", "readlines", "requests.get", "requests.post", "requests.put", "requests.delete", "requests.request", "urllib.request.urlopen", "httpx.get", "httpx.post", "httpx.put", "httpx.delete"}
+    DB_QUERY_METHODS = {"execute", "executemany", "query", "find", "find_one", "get", "filter", "filter_by", "all", "first", "one", "scalar", "scalars", "fetchone", "fetchall", "fetchmany", "select", "insert", "update", "delete", "aggregate", "count", "exists", "bulk_insert", "bulk_update"}

package/src/orion/engine/prompt_security/detectors/__init__.py

@@ -0,0 +1,4 @@
+"""Prompt security detector modules."""
+from orion.engine.prompt_security.engine import PromptSecurityEngine
+
+__all__ = ["PromptSecurityEngine"]

package/src/orion/engine/prompt_security/engine.py

@@ -0,0 +1,170 @@
+"""Prompt security engine - detect injection patterns in prompts and LLM inputs."""
+import re
+import base64
+from orion.engine.config import EngineConfig
+from orion.engine.ir import OrionIR
+from orion.engine.results import EngineResult, Finding
+
+
+class Engine:
+    name = "prompt_security"
+    version = "1.0.0"
+
+    EXPLICIT_PATTERNS = [
+        (r"ignore previous instructions", "ignore_previous"),
+        (r"disregard (?:all |the )?(?:previous|above) (?:instructions|prompts?)", "disregard_previous"),
+        (r"system prompt", "system_prompt_ref"),
+        (r"you are now (?:a |an |the )?(?:different|new|unrestricted)", "role_change"),
+        (r"forget everything (?:above|before|prior)", "forget_context"),
+        (r"new instructions?:", "new_instructions"),
+        (r"override (?:your |the )?(?:system |)(?:prompt|instructions)", "override_prompt"),
+        (r"jailbreak", "jailbreak"),
+        (r"\bDAN\b", "dan_mode"),
+        (r"do anything now", "do_anything_now"),
+        (r"act as (?:a |an |)(?:unrestricted|uncensored|no restrictions?)", "act_as_unrestricted"),
+        (r"pretend to be (?:a |an |)(?:unrestricted|uncensored|no restrictions?)", "pretend_unrestricted"),
+        (r"reveal your (?:system |)(?:prompt|instructions?)", "reveal_prompt"),
+        (r"show me your (?:system |)(?:prompt|instructions?)", "show_prompt"),
+        (r"what is your system prompt", "ask_system_prompt"),
+        (r"ignore (?:all |)safety", "ignore_safety"),
+        (r"bypass (?:safety|security|filter)", "bypass_safety"),
+        (r"disable (?:safety|filter|moderation)", "disable_safety"),
+        (r"you have no (?:restrictions|limitations|rules)", "no_restrictions"),
+        (r"unrestricted mode", "unrestricted_mode"),
+        (r"developer mode", "developer_mode"),
+        (r"sudo mode", "sudo_mode"),
+    ]
+
+    HEURISTIC_PATTERNS = [
+        (r"<\|endoftext\|>", "special_token_endoftext"),
+        (r"<\|im_start\|>", "special_token_im_start"),
+        (r"<\|im_end\|>", "special_token_im_end"),
+        (r"<\|", "special_token_generic"),
+        (r"###\s*(?:instruction|system|user|assistant)", "markdown_role"),
+        (r"<<SYS>>", "sys_token"),
+        (r"<</SYS>>", "sys_token_end"),
+        (r"\[INST\]", "inst_token"),
+        (r"\[/INST\]", "inst_token_end"),
+        (r"<\|user\|>", "user_token"),
+        (r"<\|assistant\|>", "assistant_token"),
+        (r"<\|system\|>", "system_token"),
+    ]
+
+    BASE64_PATTERN = re.compile(r"[A-Za-z0-9+/]{50,}={0,2}")
+    REPEATING_PATTERN = re.compile(r"(.{10,}?)\1{3,}")
+
+    async def check_availability(self) -> bool:
+        return True
+
+    def resource_limits(self):
+        from orion.engine.config import ResourceLimits
+        return ResourceLimits(max_cpu_seconds=30, max_memory_mb=128)
+
+    async def run(self, ir: OrionIR, config: EngineConfig) -> EngineResult:
+        try:
+            text = ir.content.decode("utf-8", errors="replace")
+        except Exception:
+            text = str(ir.content)
+
+        path = ir.metadata.get("path", "unknown")
+        filename = Path(path).name.lower()
+        ext = Path(path).suffix.lower()
+
+        # Skip documentation files
+        if ext in (".md", ".markdown", ".rst", ".txt") or "docs" in path.lower() or "license" in filename:
+            return EngineResult(engine=self.name, findings=[], ok=True)
+
+        lines = text.splitlines()
+        findings = []
+
+        text_lower = text.lower()
+
+        for pattern, name in self.EXPLICIT_PATTERNS:
+            for match in re.finditer(pattern, text_lower, re.IGNORECASE):
+                line_no = text[:match.start()].count("\n") + 1
+                snippet = self._get_snippet(lines, line_no)
+                findings.append(Finding(
+                    engine=self.name,
+                    severity="critical",
+                    title=f"Prompt injection: {name}",
+                    description=f"Explicit prompt injection pattern detected: {name}",
+                    location=f"{path}:{line_no}",
+                    metadata={
+                        "confidence": 0.85,
+                        "snippet": snippet,
+                        "pattern": name,
+                        "match": match.group(0)[:100],
+                        "cwe": "CWE-74",
+                        "cvss": 9.0,
+                    },
+                ))
+
+        for pattern, name in self.HEURISTIC_PATTERNS:
+            for match in re.finditer(pattern, text):
+                line_no = text[:match.start()].count("\n") + 1
+                snippet = self._get_snippet(lines, line_no)
+                findings.append(Finding(
+                    engine=self.name,
+                    severity="medium",
+                    title=f"Prompt injection indicator: {name}",
+                    description=f"Heuristic prompt injection indicator detected: {name}",
+                    location=f"{path}:{line_no}",
+                    metadata={
+                        "confidence": 0.65,
+                        "snippet": snippet,
+                        "pattern": name,
+                        "match": match.group(0)[:100],
+                        "cwe": "CWE-74",
+                        "cvss": 6.5,
+                    },
+                ))
+
+        for match in self.BASE64_PATTERN.finditer(text):
+            try:
+                decoded = base64.b64decode(match.group(0)).decode("utf-8", errors="ignore")
+                if any(p in decoded.lower() for p in ["ignore", "disregard", "system prompt", "jailbreak", "dan"]):
+                    line_no = text[:match.start()].count("\n") + 1
+                    snippet = self._get_snippet(lines, line_no)
+                    findings.append(Finding(
+                        engine=self.name,
+                        severity="high",
+                        title="Base64-encoded prompt injection payload",
+                        description="Base64 string decodes to text containing prompt injection patterns",
+                        location=f"{path}:{line_no}",
+                        metadata={
+                            "confidence": 0.8,
+                            "snippet": snippet,
+                            "decoded_preview": decoded[:200],
+                            "cwe": "CWE-74",
+                            "cvss": 8.0,
+                        },
+                    ))
+            except Exception:
+                pass
+
+        for match in self.REPEATING_PATTERN.finditer(text):
+            if len(match.group(1)) > 10:
+                line_no = text[:match.start()].count("\n") + 1
+                snippet = self._get_snippet(lines, line_no)
+                findings.append(Finding(
+                    engine=self.name,
+                    severity="low",
+                    title="Repeating sequence detected",
+                    description="Long repeating sequence may indicate prompt stuffing attack",
+                    location=f"{path}:{line_no}",
+                    metadata={
+                        "confidence": 0.55,
+                        "snippet": snippet,
+                        "repeat_unit": match.group(1)[:50],
+                        "count": len(match.group(0)) // len(match.group(1)),
+                        "cwe": "CWE-74",
+                        "cvss": 4.0,
+                    },
+                ))
+
+        return EngineResult(engine=self.name, findings=findings, ok=True)
+
+    def _get_snippet(self, lines: list, line_no: int, context: int = 2) -> str:
+        start = max(0, line_no - context - 1)
+        end = min(len(lines), line_no + context)
+        return "\n".join(lines[start:end])