@orionscanner/cli 0.1.0

package/src/orion/engine/sandbox_escape/engine.py

@@ -0,0 +1,284 @@
+"""Sandbox escape pattern detection engine."""
+import ast
+import re
+from typing import Dict, List, Set, Optional, Any, Tuple
+from dataclasses import dataclass, field
+from orion.engine.config import EngineConfig, ResourceLimits
+from orion.engine.ir import OrionIR
+from orion.engine.results import EngineResult, Finding
+
+
+ESCAPE_PATTERNS = {
+    "import_os": {
+        "patterns": [
+            r"__import__\s*\(\s*['\"]os['\"]",
+            r"__import__\s*\(\s*['\"]subprocess['\"]",
+            r"__import__\s*\(\s*['\"]sys['\"]",
+            r"importlib\.import_module\s*\(\s*['\"]os['\"]",
+            r"importlib\.import_module\s*\(\s*['\"]subprocess['\"]",
+            r"importlib\.import_module\s*\(\s*['\"]sys['\"]",
+            r"runpy\.run_module\s*\(\s*['\"]os['\"]",
+            r"runpy\.run_module\s*\(\s*['\"]subprocess['\"]",
+        ],
+        "cwe": "CWE-829",
+        "severity": "critical",
+        "description": "Dynamic import of dangerous module (os, subprocess, sys)",
+    },
+    "builtin_access": {
+        "patterns": [
+            r"getattr\s*\(\s*__builtins__\s*,\s*['\"]eval['\"]",
+            r"getattr\s*\(\s*__builtins__\s*,\s*['\"]exec['\"]",
+            r"getattr\s*\(\s*__builtins__\s*,\s*['\"]compile['\"]",
+            r"__builtins__\s*\[\s*['\"]eval['\"]",
+            r"__builtins__\s*\[\s*['\"]exec['\"]",
+            r"__builtins__\s*\[\s*['\"]compile['\"]",
+            r"vars\s*\(\s*\)\s*\[\s*['\"]eval['\"]",
+            r"vars\s*\(\s*\)\s*\[\s*['\"]exec['\"]",
+            r"globals\s*\(\s*\)\s*\[\s*['\"]eval['\"]",
+            r"globals\s*\(\s*\)\s*\[\s*['\"]exec['\"]",
+        ],
+        "cwe": "CWE-94",
+        "severity": "critical",
+        "description": "Access to builtin eval/exec/compile via getattr or dict access",
+    },
+    "eval_compile": {
+        "patterns": [
+            r"eval\s*\(\s*compile\s*\(",
+            r"exec\s*\(\s*compile\s*\(",
+            r"compile\s*\([^)]+,\s*['\"]eval['\"]",
+            r"compile\s*\([^)]+,\s*['\"]exec['\"]",
+            r"compile\s*\([^)]+,\s*['\"]single['\"]",
+        ],
+        "cwe": "CWE-94",
+        "severity": "critical",
+        "description": "Code execution via eval/exec with compile",
+    },
+    "code_type": {
+        "patterns": [
+            r"types\.CodeType\s*\(",
+            r"code\.replace\s*\(",
+            r"func_code\s*=",
+            r"__code__\s*=",
+            r"f\.f_code\s*=",
+            r"frame\.f_code\s*=",
+        ],
+        "cwe": "CWE-94",
+        "severity": "high",
+        "description": "Direct code object manipulation",
+    },
+    "ctypes": {
+        "patterns": [
+            r"ctypes\.CDLL\s*\(",
+            r"ctypes\.windll\s*\.",
+            r"ctypes\.WinDLL\s*\(",
+            r"ctypes\.cdll\s*\.",
+            r"ctypes\.pythonapi",
+            r"ctypes\.PyDLL\s*\(",
+            r"ctypes\.CFUNCTYPE\s*\(",
+            r"ctypes\.cast\s*\(",
+            r"ctypes\.addressof\s*\(",
+            r"ctypes\.string_at\s*\(",
+        ],
+        "cwe": "CWE-111",
+        "severity": "critical",
+        "description": "ctypes usage for direct memory/library access",
+    },
+    "introspection": {
+        "patterns": [
+            r"sys\._getframe\s*\(",
+            r"inspect\.getouterframes\s*\(",
+            r"inspect\.currentframe\s*\(",
+            r"inspect\.stack\s*\(",
+            r"inspect\.trace\s*\(",
+            r"sys\.modules\s*\[\s*['\"]os['\"]",
+            r"sys\.modules\s*\[\s*['\"]subprocess['\"]",
+        ],
+        "cwe": "CWE-470",
+        "severity": "high",
+        "description": "Frame/introspection access for escaping sandboxes",
+    },
+    "class_mro": {
+        "patterns": [
+            r"__class__\.__bases__",
+            r"__class__\.__mro__",
+            r"__mro__\s*\[",
+            r"__subclasses__\s*\(",
+            r"\.__subclasses__\s*\(",
+            r"type\(\)\.__subclasses__",
+            r"object\.__subclasses__\s*\(",
+        ],
+        "cwe": "CWE-470",
+        "severity": "critical",
+        "description": "Class hierarchy traversal for sandbox escape (Python 2/3)",
+    },
+    "pickle": {
+        "patterns": [
+            r"pickle\.loads\s*\(",
+            r"pickle\.load\s*\(",
+            r"_pickle\.loads\s*\(",
+            r"marshal\.loads\s*\(",
+            r"shelve\.open\s*\(",
+            r"dill\.loads\s*\(",
+        ],
+        "cwe": "CWE-502",
+        "severity": "high",
+        "description": "Deserialization of untrusted data",
+    },
+    "subprocess": {
+        "patterns": [
+            r"subprocess\.call\s*\(",
+            r"subprocess\.run\s*\(",
+            r"subprocess\.Popen\s*\(",
+            r"subprocess\.check_output\s*\(",
+            r"subprocess\.check_call\s*\(",
+            r"os\.system\s*\(",
+            r"os\.popen\s*\(",
+            r"commands\.getstatusoutput\s*\(",
+            r"commands\.getoutput\s*\(",
+        ],
+        "cwe": "CWE-78",
+        "severity": "critical",
+        "description": "Command execution via subprocess/os",
+    },
+    "template_injection": {
+        "patterns": [
+            r"render_template_string\s*\(",
+            r"Template\s*\([^)]*request",
+            r"Environment\s*\(\s*loader\s*=",
+            r"jinja2\.Environment\s*\(",
+            r"markupsafe\.Markup\s*\(",
+            r"Markup\s*\(",
+        ],
+        "cwe": "CWE-79",
+        "severity": "high",
+        "description": "Server-side template injection (SSTI)",
+    },
+    "breakpoint": {
+        "patterns": [
+            r"breakpoint\s*\(",
+            r"pdb\.set_trace\s*\(",
+            r"ipdb\.set_trace\s*\(",
+            r"debugpy\.breakpoint\s*\(",
+        ],
+        "cwe": "CWE-489",
+        "severity": "medium",
+        "description": "Debug breakpoint in production code",
+    },
+}
+
+
+class SandboxVisitor(ast.NodeVisitor):
+    def __init__(self, filename: str, source_lines: List[str]):
+        self.filename = filename
+        self.source_lines = source_lines
+        self.findings: List[Finding] = []
+        self.seen_findings: Set[Tuple[str, int]] = set()
+        self.compiled_patterns = {
+            name: [re.compile(p, re.IGNORECASE) for p in data["patterns"]]
+            for name, data in ESCAPE_PATTERNS.items()
+        }
+
+    def get_snippet(self, line_no: int, context: int = 2) -> str:
+        start = max(0, line_no - 1 - context)
+        end = min(len(self.source_lines), line_no + context)
+        return "\n".join(self.source_lines[start:end])
+
+    def check_node(self, node: ast.AST):
+        line_no = getattr(node, 'lineno', 0)
+        if not line_no or line_no > len(self.source_lines):
+            return
+        
+        line_text = self.source_lines[line_no - 1]
+        for category, patterns in self.compiled_patterns.items():
+            if (category, line_no) in self.seen_findings:
+                continue
+            for pattern in patterns:
+                if pattern.search(line_text):
+                    self.seen_findings.add((category, line_no))
+                    data = ESCAPE_PATTERNS[category]
+                    confidence = 0.9 if category in ("class_mro", "ctypes", "subprocess") else 0.85
+                    
+                    self.findings.append(Finding(
+                        engine="sandbox_escape",
+                        severity=data["severity"],
+                        title=f"Sandbox escape: {data['description']}",
+                        description=f"Detected {category}: {data['description']}",
+                        location=f"{self.filename}:{line_no}",
+                        metadata={
+                            "snippet": self.get_snippet(line_no),
+                            "cwe": data["cwe"],
+                            "confidence": confidence,
+                            "category": category,
+                            "pattern": pattern.pattern,
+                        }
+                    ))
+                    break
+
+    def visit_Call(self, node: ast.Call):
+        self.check_node(node)
+        self.generic_visit(node)
+
+    def visit_Attribute(self, node: ast.Attribute):
+        self.check_node(node)
+        self.generic_visit(node)
+
+    def visit_Import(self, node: ast.Import):
+        self.check_node(node)
+        self.generic_visit(node)
+
+    def visit_ImportFrom(self, node: ast.ImportFrom):
+        self.check_node(node)
+        self.generic_visit(node)
+
+
+class Engine:
+    name = "sandbox_escape"
+    version = "1.0.0"
+
+    async def check_availability(self) -> bool:
+        return True
+
+    def resource_limits(self) -> ResourceLimits:
+        return ResourceLimits(max_cpu_seconds=60, max_memory_mb=512, max_files=50000)
+
+    async def run(self, ctx, config: EngineConfig) -> EngineResult:
+        # Handle both single IR and list of IRs
+        if not isinstance(ctx, list):
+            ctx = [ctx]
+        all_findings = []
+        errors = []
+        files_processed = 0
+
+        exclude_patterns = config.toggles.get("exclude", []) if config.toggles else []
+
+        for ir in ctx:
+            try:
+                if not ir.metadata.get("language") == "python":
+                    continue
+
+                rel_path = ir.metadata.get("path", "unknown.py")
+                if any(pattern in rel_path for pattern in exclude_patterns):
+                    continue
+
+                content = ir.content.decode("utf-8", errors="replace")
+                source_lines = content.splitlines()
+                tree = ast.parse(content, filename=rel_path)
+
+                visitor = SandboxVisitor(rel_path, source_lines)
+                visitor.visit(tree)
+
+                all_findings.extend(visitor.findings)
+                files_processed += 1
+
+            except SyntaxError as e:
+                errors.append(f"Syntax error in {ir.metadata.get('path', 'unknown')}: {e}")
+            except Exception as e:
+                errors.append(f"Error processing {ir.metadata.get('path', 'unknown')}: {e}")
+
+        return EngineResult(
+            engine=self.name,
+            findings=all_findings,
+            errors=errors,
+            metrics={"files_processed": files_processed, "findings_count": len(all_findings)},
+            ok=len(errors) == 0
+        )

package/src/orion/engine/sast/engine.py

@@ -0,0 +1,217 @@
+"""Full SAST engine - primary security engine with comprehensive pattern detection."""
+import re
+import ast
+from pathlib import Path
+from typing import List, Optional
+from dataclasses import dataclass
+
+from orion.engine.config import EngineConfig
+from orion.engine.ir import OrionIR
+from orion.engine.results import EngineResult, Finding
+from orion.engine.sast.patterns import (
+    PATTERNS,
+    get_patterns_for_language,
+    run_ast_patterns,
+    Severity,
+    Pattern,
+)
+
+
+@dataclass
+class SASTFinding:
+    pattern: Pattern
+    line: int
+    snippet: str
+    match: str
+    filepath: str
+
+
+class SASTEngine:
+    name = "sast"
+    version = "2.0.0"
+
+    EXCLUDED_DIRS = {
+        "__pycache__", ".git", ".venv", "venv", "env", "node_modules",
+        "dist", "build", ".pytest_cache", ".mypy_cache", ".tox",
+        "migrations", "tests", "test", "scripts", "examples", "docs",
+    }
+
+    EXCLUDED_FILES = {
+        "conftest.py", "manage.py", "wsgi.py", "asgi.py", "celery.py",
+        "gunicorn.conf.py", "pytest.ini", "setup.py", "setup.cfg",
+    }
+
+    async def check_availability(self) -> bool:
+        return True
+
+    def resource_limits(self):
+        from orion.engine.config import ResourceLimits
+        return ResourceLimits(max_cpu_seconds=120, max_memory_mb=1024)
+
+    def _should_exclude(self, filepath: str, config: EngineConfig) -> bool:
+        path = Path(filepath)
+        # Check excluded directories
+        for part in path.parts:
+            if part in self.EXCLUDED_DIRS:
+                return True
+        # Check excluded files
+        if path.name in self.EXCLUDED_FILES:
+            return True
+        # Check config exclude patterns
+        if config.toggles.get("exclude"):
+            for pattern in config.toggles["exclude"]:
+                if path.match(pattern) or any(p.match(pattern) for p in path.parents):
+                    return True
+        return False
+
+    def _detect_language(self, filepath: str, content: str) -> str:
+        ext = Path(filepath).suffix.lower()
+        lang_map = {
+            ".py": "python",
+            ".js": "javascript",
+            ".ts": "typescript",
+            ".jsx": "javascript",
+            ".tsx": "typescript",
+            ".java": "java",
+            ".go": "go",
+            ".rs": "rust",
+            ".php": "php",
+            ".rb": "ruby",
+            ".cs": "csharp",
+            ".cpp": "cpp",
+            ".cc": "cpp",
+            ".c": "c",
+            ".h": "c",
+            ".hpp": "cpp",
+            ".sh": "bash",
+            ".yaml": "yaml",
+            ".yml": "yaml",
+            ".json": "json",
+            ".toml": "toml",
+            ".xml": "xml",
+            ".html": "html",
+            ".css": "css",
+            ".sql": "sql",
+        }
+        return lang_map.get(ext, "unknown")
+
+    def _find_matches(self, content: str, patterns: List[Pattern], filepath: str) -> List[SASTFinding]:
+        findings = []
+        lines = content.splitlines()
+        for pattern in patterns:
+            for match in pattern.pattern.finditer(content):
+                line_num = content[:match.start()].count('\n') + 1
+                start = max(0, line_num - 3)
+                end = min(len(lines), line_num + 2)
+                snippet = '\n'.join(lines[start:end])
+                findings.append(SASTFinding(
+                    pattern=pattern,
+                    line=line_num,
+                    snippet=snippet,
+                    match=match.group()[:100],
+                    filepath=filepath,
+                ))
+        return findings
+
+    def _run_ast_analysis(self, content: str, filepath: str, language: str) -> List[SASTFinding]:
+        if language != "python":
+            return []
+        ast_findings = run_ast_patterns(content, filepath)
+        results = []
+        for af in ast_findings:
+            # Convert to pattern-like object
+            class ASTPattern:
+                def __init__(self, finding):
+                    self.name = finding['pattern']
+                    self.severity = finding['severity']
+                    self.confidence = finding['confidence']
+                    self.cwe = finding['cwe']
+                    self.cvss = finding['cvss']
+                    self.description = finding['description']
+            pattern_obj = ASTPattern(af)
+            results.append(SASTFinding(
+                pattern=pattern_obj,
+                line=af['line'],
+                snippet=af['snippet'],
+                match=af['pattern'],
+                filepath=filepath,
+            ))
+        return results
+
+    def _aggregate_findings(self, findings: List[SASTFinding]) -> List[Finding]:
+        """Aggregate findings, deduplicate similar ones, and create EngineResult findings."""
+        aggregated = []
+        seen = set()
+
+        for f in findings:
+            key = (f.filepath, f.line, f.pattern.name)
+            if key in seen:
+                continue
+            seen.add(key)
+
+            if f.pattern.confidence < 0.75:
+                continue
+
+            severity = f.pattern.severity.value if hasattr(f.pattern.severity, 'value') else str(f.pattern.severity)
+
+            aggregated.append(Finding(
+                engine=self.name,
+                severity=severity,
+                title=f"{f.pattern.name}: {f.pattern.description}",
+                description=f"{f.pattern.description} (CWE: {f.pattern.cwe}, CVSS: {f.pattern.cvss})",
+                location=f"{f.filepath}:{f.line}",
+                metadata={
+                    "pattern": f.pattern.name,
+                    "cwe": f.pattern.cwe,
+                    "cvss": f.pattern.cvss,
+                    "confidence": f.pattern.confidence,
+                    "match": f.match,
+                    "snippet": f.snippet,
+                    "file": f.filepath,
+                    "line": f.line,
+                },
+            ))
+        return aggregated
+
+    async def run(self, ir: OrionIR, config: EngineConfig) -> EngineResult:
+        try:
+            content = ir.content.decode("utf-8", errors="replace")
+        except Exception:
+            content = str(ir.content)
+
+        filepath = ir.metadata.get("path", "unknown")
+        project_root = ir.metadata.get("project_root", ".")
+        language = ir.metadata.get("language") or self._detect_language(filepath, content)
+
+        if self._should_exclude(filepath, config):
+            return EngineResult(engine=self.name, ok=True, metrics={"skipped": True})
+
+        all_findings = []
+
+        # Run regex patterns
+        patterns = get_patterns_for_language(language)
+        regex_findings = self._find_matches(content, patterns, filepath)
+        all_findings.extend(regex_findings)
+
+        # Run AST patterns for Python
+        ast_findings = self._run_ast_analysis(content, filepath, language)
+        all_findings.extend(ast_findings)
+
+        # Aggregate and filter
+        findings = self._aggregate_findings(all_findings)
+
+        return EngineResult(
+            engine=self.name,
+            findings=findings,
+            ok=True,
+            metrics={
+                "files_scanned": 1,
+                "patterns_run": len(patterns),
+                "findings_count": len(findings),
+                "language": language,
+            },
+        )
+
+
+# Backward compatibility
+Engine = SASTEngine