@orionscanner/cli 0.1.0

package/src/orion/engine/sast/patterns/__init__.py

@@ -0,0 +1,513 @@
+"""SAST pattern detectors for security vulnerabilities."""
+import re
+import ast
+from dataclasses import dataclass
+from typing import List, Optional, Pattern
+from enum import Enum
+
+
+class Severity(Enum):
+    CRITICAL = "critical"
+    HIGH = "high"
+    MEDIUM = "medium"
+    LOW = "low"
+
+
+@dataclass
+class Pattern:
+    name: str
+    pattern: Pattern
+    severity: Severity
+    confidence: float
+    cwe: str
+    cvss: float
+    description: str
+    languages: List[str]
+
+
+def _compile_patterns() -> List[Pattern]:
+    return [
+        # SQL Injection
+        Pattern(
+            name="sql_injection_concat",
+            pattern=re.compile(
+                r'(execute|executemany|query|raw)\s*\(\s*["\'].*[%+].*["\']',
+                re.IGNORECASE,
+            ),
+            severity=Severity.CRITICAL,
+            confidence=0.85,
+            cwe="CWE-89",
+            cvss=9.8,
+            description="SQL query built via string concatenation - potential SQL injection",
+            languages=["python"],
+        ),
+        Pattern(
+            name="sql_injection_format",
+            pattern=re.compile(
+                r'(execute|executemany|query|raw)\s*\(\s*f["\'].*\{.*\}.*["\']',
+                re.IGNORECASE,
+            ),
+            severity=Severity.CRITICAL,
+            confidence=0.9,
+            cwe="CWE-89",
+            cvss=9.8,
+            description="SQL query built via f-string - potential SQL injection",
+            languages=["python"],
+        ),
+        Pattern(
+            name="sql_injection_percent",
+            pattern=re.compile(
+                r'(execute|executemany|query|raw)\s*\(\s*["\'].*%.*["\']\s*%',
+                re.IGNORECASE,
+            ),
+            severity=Severity.CRITICAL,
+            confidence=0.8,
+            cwe="CWE-89",
+            cvss=9.8,
+            description="SQL query built via % formatting - potential SQL injection",
+            languages=["python"],
+        ),
+        # XSS
+        Pattern(
+            name="xss_direct_output",
+            pattern=re.compile(
+                r'(render_template_string|mark_safe|safe_filter|escape\(false\))',
+                re.IGNORECASE,
+            ),
+            severity=Severity.HIGH,
+            confidence=0.8,
+            cwe="CWE-79",
+            cvss=7.1,
+            description="Direct output of user-controlled data without escaping",
+            languages=["python", "javascript", "typescript"],
+        ),
+        Pattern(
+            name="xss_inner_html",
+            pattern=re.compile(
+                r'innerHTML\s*=\s*.*request\.(GET|POST|body|params|query)',
+                re.IGNORECASE,
+            ),
+            severity=Severity.HIGH,
+            confidence=0.85,
+            cwe="CWE-79",
+            cvss=7.1,
+            description="User input directly assigned to innerHTML",
+            languages=["javascript", "typescript"],
+        ),
+        # Command Injection
+        Pattern(
+            name="cmd_injection_os_system",
+            pattern=re.compile(
+                r'os\.system\s*\(.*[\+\%]',
+                re.IGNORECASE,
+            ),
+            severity=Severity.CRITICAL,
+            confidence=0.9,
+            cwe="CWE-78",
+            cvss=9.8,
+            description="Command injection via os.system with string concatenation",
+            languages=["python"],
+        ),
+        Pattern(
+            name="cmd_injection_subprocess",
+            pattern=re.compile(
+                r'subprocess\.(call|run|Popen|check_output)\s*\(.*shell\s*=\s*True.*[\+\%]',
+                re.IGNORECASE,
+            ),
+            severity=Severity.CRITICAL,
+            confidence=0.85,
+            cwe="CWE-78",
+            cvss=9.8,
+            description="Command injection via subprocess with shell=True and concatenation",
+            languages=["python"],
+        ),
+        Pattern(
+            name="cmd_injection_popen",
+            pattern=re.compile(
+                r'popen\s*\(.*[\+\%]',
+                re.IGNORECASE,
+            ),
+            severity=Severity.CRITICAL,
+            confidence=0.8,
+            cwe="CWE-78",
+            cvss=9.8,
+            description="Command injection via popen with concatenation",
+            languages=["python"],
+        ),
+        # SSRF
+        Pattern(
+            name="ssrf_requests",
+            pattern=re.compile(
+                r'(requests|httpx|aiohttp|urllib)\.(get|post|put|delete|request)\s*\(.*(input|request\.(GET|POST|body|params|query)|argv)',
+                re.IGNORECASE,
+            ),
+            severity=Severity.HIGH,
+            confidence=0.75,
+            cwe="CWE-918",
+            cvss=7.5,
+            description="Server-side request forgery - user-controlled URL",
+            languages=["python"],
+        ),
+        Pattern(
+            name="ssrf_urlopen",
+            pattern=re.compile(
+                r'urllib\.request\.urlopen\s*\(.*(input|request\.(GET|POST|body|params|query)|argv)',
+                re.IGNORECASE,
+            ),
+            severity=Severity.HIGH,
+            confidence=0.75,
+            cwe="CWE-918",
+            cvss=7.5,
+            description="SSRF via urllib.urlopen with user input",
+            languages=["python"],
+        ),
+        # Path Traversal
+        Pattern(
+            name="path_traversal_open",
+            pattern=re.compile(
+                r'open\s*\(.*[\+\%].*\.\./',
+                re.IGNORECASE,
+            ),
+            severity=Severity.HIGH,
+            confidence=0.8,
+            cwe="CWE-22",
+            cvss=7.5,
+            description="Path traversal via open() with user-controlled path",
+            languages=["python"],
+        ),
+        Pattern(
+            name="path_traversal_pathlib",
+            pattern=re.compile(
+                r'Path\s*\(.*[\+\%].*\.\./',
+                re.IGNORECASE,
+            ),
+            severity=Severity.HIGH,
+            confidence=0.75,
+            cwe="CWE-22",
+            cvss=7.5,
+            description="Path traversal via pathlib.Path with user-controlled path",
+            languages=["python"],
+        ),
+        Pattern(
+            name="path_traversal_join",
+            pattern=re.compile(
+                r'os\.path\.join\s*\(.*\.\..*\)',
+                re.IGNORECASE,
+            ),
+            severity=Severity.MEDIUM,
+            confidence=0.7,
+            cwe="CWE-22",
+            cvss=5.9,
+            description="Potential path traversal via os.path.join with ../",
+            languages=["python"],
+        ),
+        # Hardcoded Credentials
+        Pattern(
+            name="hardcoded_password",
+            pattern=re.compile(
+                r'(password|passwd|pwd)\s*=\s*["\'][^"\']{8,}["\']',
+                re.IGNORECASE,
+            ),
+            severity=Severity.HIGH,
+            confidence=0.75,
+            cwe="CWE-798",
+            cvss=7.5,
+            description="Hardcoded password in source code",
+            languages=["python", "javascript", "typescript", "yaml", "json"],
+        ),
+        Pattern(
+            name="hardcoded_api_key",
+            pattern=re.compile(
+                r'(api[_-]?key|apikey|secret[_-]?key|access[_-]?token)\s*=\s*["\'][^"\']{16,}["\']',
+                re.IGNORECASE,
+            ),
+            severity=Severity.CRITICAL,
+            confidence=0.85,
+            cwe="CWE-798",
+            cvss=9.1,
+            description="Hardcoded API key or secret token",
+            languages=["python", "javascript", "typescript", "yaml", "json"],
+        ),
+        Pattern(
+            name="hardcoded_aws_key",
+            pattern=re.compile(
+                r'(AKIA[0-9A-Z]{16}|aws[_-]?access[_-]?key[_-]?id)\s*=\s*["\'][^"\']+["\']',
+                re.IGNORECASE,
+            ),
+            severity=Severity.CRITICAL,
+            confidence=0.95,
+            cwe="CWE-798",
+            cvss=9.8,
+            description="Hardcoded AWS access key",
+            languages=["python", "javascript", "typescript", "yaml", "json"],
+        ),
+        Pattern(
+            name="hardcoded_private_key",
+            pattern=re.compile(
+                r'-----BEGIN (RSA |EC |DSA |OPENSSH )?PRIVATE KEY-----',
+                re.IGNORECASE,
+            ),
+            severity=Severity.CRITICAL,
+            confidence=0.99,
+            cwe="CWE-798",
+            cvss=9.8,
+            description="Hardcoded private key",
+            languages=["python", "javascript", "typescript", "yaml", "json"],
+        ),
+        # Weak Crypto
+        Pattern(
+            name="weak_crypto_md5",
+            pattern=re.compile(
+                r'hashlib\.md5\s*\(',
+                re.IGNORECASE,
+            ),
+            severity=Severity.MEDIUM,
+            confidence=0.9,
+            cwe="CWE-327",
+            cvss=5.3,
+            description="Use of cryptographically weak MD5 hash",
+            languages=["python"],
+        ),
+        Pattern(
+            name="weak_crypto_sha1",
+            pattern=re.compile(
+                r'hashlib\.sha1\s*\(',
+                re.IGNORECASE,
+            ),
+            severity=Severity.MEDIUM,
+            confidence=0.9,
+            cwe="CWE-327",
+            cvss=5.3,
+            description="Use of cryptographically weak SHA1 hash",
+            languages=["python"],
+        ),
+        Pattern(
+            name="weak_crypto_des",
+            pattern=re.compile(
+                r'(DES|3DES|TripleDES)\.new\s*\(',
+                re.IGNORECASE,
+            ),
+            severity=Severity.HIGH,
+            confidence=0.85,
+            cwe="CWE-327",
+            cvss=7.5,
+            description="Use of weak DES/3DES encryption",
+            languages=["python"],
+        ),
+        Pattern(
+            name="weak_crypto_ecb",
+            pattern=re.compile(
+                r'\.MODE_ECB\s*\)',
+                re.IGNORECASE,
+            ),
+            severity=Severity.HIGH,
+            confidence=0.85,
+            cwe="CWE-327",
+            cvss=7.5,
+            description="Use of ECB mode (insecure)",
+            languages=["python"],
+        ),
+        Pattern(
+            name="weak_crypto_random",
+            pattern=re.compile(
+                r'random\.(random|randint|choice|choices)\s*\(',
+                re.IGNORECASE,
+            ),
+            severity=Severity.MEDIUM,
+            confidence=0.7,
+            cwe="CWE-338",
+            cvss=5.3,
+            description="Use of non-cryptographic random for security purposes",
+            languages=["python"],
+        ),
+        # Insecure Deserialization
+        Pattern(
+            name="deserialization_pickle",
+            pattern=re.compile(
+                r'pickle\.(loads|load)\s*\(',
+                re.IGNORECASE,
+            ),
+            severity=Severity.CRITICAL,
+            confidence=0.9,
+            cwe="CWE-502",
+            cvss=9.8,
+            description="Insecure deserialization via pickle",
+            languages=["python"],
+        ),
+        Pattern(
+            name="deserialization_yaml",
+            pattern=re.compile(
+                r'yaml\.(load|load_all)\s*\(.*Loader\s*=\s*(yaml\.)?CLoader',
+                re.IGNORECASE,
+            ),
+            severity=Severity.CRITICAL,
+            confidence=0.85,
+            cwe="CWE-502",
+            cvss=9.8,
+            description="Insecure YAML deserialization with unsafe loader",
+            languages=["python"],
+        ),
+        Pattern(
+            name="deserialization_json",
+            pattern=re.compile(
+                r'jsonpickle\.decode\s*\(',
+                re.IGNORECASE,
+            ),
+            severity=Severity.HIGH,
+            confidence=0.8,
+            cwe="CWE-502",
+            cvss=7.5,
+            description="Insecure deserialization via jsonpickle",
+            languages=["python"],
+        ),
+        Pattern(
+            name="deserialization_marshal",
+            pattern=re.compile(
+                r'marshal\.loads\s*\(',
+                re.IGNORECASE,
+            ),
+            severity=Severity.HIGH,
+            confidence=0.8,
+            cwe="CWE-502",
+            cvss=7.5,
+            description="Insecure deserialization via marshal",
+            languages=["python"],
+        ),
+        # Additional dangerous patterns
+        Pattern(
+            name="eval_usage",
+            pattern=re.compile(
+                r'\beval\s*\(',
+                re.IGNORECASE,
+            ),
+            severity=Severity.CRITICAL,
+            confidence=0.9,
+            cwe="CWE-94",
+            cvss=9.8,
+            description="Use of eval() - code injection risk",
+            languages=["python"],
+        ),
+        Pattern(
+            name="exec_usage",
+            pattern=re.compile(
+                r'\bexec\s*\(',
+                re.IGNORECASE,
+            ),
+            severity=Severity.CRITICAL,
+            confidence=0.9,
+            cwe="CWE-94",
+            cvss=9.8,
+            description="Use of exec() - code injection risk",
+            languages=["python"],
+        ),
+        Pattern(
+            name="subprocess_shell_true",
+            pattern=re.compile(
+                r'subprocess\.(call|run|Popen|check_output)\s*\([^)]*shell\s*=\s*True',
+                re.IGNORECASE,
+            ),
+            severity=Severity.HIGH,
+            confidence=0.8,
+            cwe="CWE-78",
+            cvss=7.5,
+            description="subprocess with shell=True - command injection risk",
+            languages=["python"],
+        ),
+    ]
+
+
+PATTERNS = _compile_patterns()
+
+
+def get_patterns_for_language(language: str) -> List[Pattern]:
+    """Get patterns applicable to a specific language."""
+    return [p for p in PATTERNS if language.lower() in [l.lower() for l in p.languages]]
+
+
+def get_all_patterns() -> List[Pattern]:
+    """Get all patterns."""
+    return PATTERNS
+
+
+class ASTPatternVisitor(ast.NodeVisitor):
+    """AST-based pattern detection for more complex patterns."""
+
+    def __init__(self, content: str, filepath: str):
+        self.content = content
+        self.filepath = filepath
+        self.findings = []
+        self.lines = content.splitlines()
+
+    def _get_line(self, node: ast.AST) -> int:
+        return getattr(node, 'lineno', 0)
+
+    def _get_snippet(self, line_num: int, context: int = 2) -> str:
+        start = max(0, line_num - context - 1)
+        end = min(len(self.lines), line_num + context)
+        return '\n'.join(self.lines[start:end])
+
+    def visit_Call(self, node: ast.Call):
+        # Detect hardcoded secrets in function calls
+        if isinstance(node.func, ast.Attribute):
+            attr_name = node.func.attr.lower()
+            if attr_name in ('password', 'secret', 'token', 'api_key', 'apikey'):
+                for keyword in node.keywords:
+                    if isinstance(keyword.value, ast.Constant) and isinstance(keyword.value.value, str):
+                        if len(keyword.value.value) >= 8:
+                            self.findings.append({
+                                'pattern': 'hardcoded_secret_call',
+                                'line': self._get_line(node),
+                                'snippet': self._get_snippet(self._get_line(node)),
+                                'severity': Severity.HIGH,
+                                'confidence': 0.75,
+                                'cwe': 'CWE-798',
+                                'cvss': 7.5,
+                                'description': f'Hardcoded secret in {attr_name} parameter',
+                            })
+        # Detect subprocess with user input
+        if isinstance(node.func, ast.Attribute):
+            if node.func.attr in ('call', 'run', 'Popen', 'check_output'):
+                for keyword in node.keywords:
+                    if keyword.arg == 'shell' and isinstance(keyword.value, ast.Constant) and keyword.value.value is True:
+                        self.findings.append({
+                            'pattern': 'subprocess_shell_true_ast',
+                            'line': self._get_line(node),
+                            'snippet': self._get_snippet(self._get_line(node)),
+                            'severity': Severity.HIGH,
+                            'confidence': 0.8,
+                            'cwe': 'CWE-78',
+                            'cvss': 7.5,
+                            'description': 'subprocess with shell=True detected via AST',
+                        })
+        self.generic_visit(node)
+
+    def visit_Assign(self, node: ast.Assign):
+        # Detect hardcoded credentials in assignments
+        for target in node.targets:
+            if isinstance(target, ast.Name):
+                var_name = target.id.lower()
+                if any(kw in var_name for kw in ('password', 'passwd', 'pwd', 'secret', 'token', 'api_key', 'apikey', 'access_key')):
+                    if isinstance(node.value, ast.Constant) and isinstance(node.value.value, str):
+                        if len(node.value.value) >= 8:
+                            self.findings.append({
+                                'pattern': 'hardcoded_credential_ast',
+                                'line': self._get_line(node),
+                                'snippet': self._get_snippet(self._get_line(node)),
+                                'severity': Severity.HIGH if 'api' in var_name or 'key' in var_name else Severity.MEDIUM,
+                                'confidence': 0.8,
+                                'cwe': 'CWE-798',
+                                'cvss': 7.5 if 'api' in var_name or 'key' in var_name else 5.9,
+                                'description': f'Hardcoded credential in variable {target.id}',
+                            })
+        self.generic_visit(node)
+
+
+def run_ast_patterns(content: str, filepath: str) -> List[dict]:
+    """Run AST-based pattern detection."""
+    try:
+        tree = ast.parse(content)
+        visitor = ASTPatternVisitor(content, filepath)
+        visitor.visit(tree)
+        return visitor.findings
+    except SyntaxError:
+        return []

package/src/orion/engine/secrets/engine.py

@@ -0,0 +1,77 @@
+"""Secret detection engine - regex + entropy scanning."""
+import re
+from orion.engine.config import EngineConfig
+from orion.engine.ir import OrionIR
+from orion.engine.results import EngineResult, Finding
+from orion.engine.secrets.patterns import scan_patterns, shannon_entropy, find_high_entropy_strings
+
+
+class Engine:
+    name = "secrets"
+    version = "1.0.0"
+
+    async def check_availability(self) -> bool:
+        return True
+
+    def resource_limits(self):
+        from orion.engine.config import ResourceLimits
+        return ResourceLimits(max_cpu_seconds=60, max_memory_mb=256)
+
+    async def run(self, ir: OrionIR, config: EngineConfig) -> EngineResult:
+        try:
+            text = ir.content.decode("utf-8", errors="replace")
+        except Exception:
+            text = str(ir.content)
+
+        findings = []
+        path = ir.metadata.get("path", "unknown")
+        lines = text.splitlines()
+
+        for p in scan_patterns(text):
+            line_no = text[:p["start"]].count("\n") + 1
+            snippet = self._mask_secret(p["match"])
+            entropy = shannon_entropy(p["match"])
+            findings.append(Finding(
+                engine=self.name,
+                severity="high" if entropy > 4.0 else "medium",
+                title=f"Secret detected: {p['pattern_id']}",
+                description=f"Potential secret matching pattern '{p['pattern_id']}' found with entropy {entropy:.2f}",
+                location=f"{path}:{line_no}",
+                metadata={
+                    "confidence": 0.85 if entropy > 4.0 else 0.7,
+                    "snippet": snippet,
+                    "pattern": p["pattern_id"],
+                    "entropy": round(entropy, 2),
+                    "cwe": "CWE-798",
+                    "cvss": 7.5,
+                },
+            ))
+
+        for hp in find_high_entropy_strings(text):
+            line_no = text.find(hp["string"])
+            if line_no >= 0:
+                line_no = text[:line_no].count("\n") + 1
+            else:
+                line_no = 0
+            findings.append(Finding(
+                engine=self.name,
+                severity="medium",
+                title="High entropy string detected",
+                description=f"String with Shannon entropy {hp['entropy']:.2f} may be a secret",
+                location=f"{path}:{line_no}",
+                metadata={
+                    "confidence": 0.7,
+                    "snippet": self._mask_secret(hp["string"]),
+                    "entropy": round(hp["entropy"], 2),
+                    "pattern": "high_entropy",
+                    "cwe": "CWE-798",
+                    "cvss": 5.3,
+                },
+            ))
+
+        return EngineResult(engine=self.name, findings=findings, ok=True)
+
+    def _mask_secret(self, secret: str) -> str:
+        if len(secret) <= 8:
+            return "*" * len(secret)
+        return secret[:4] + "*" * (len(secret) - 8) + secret[-4:]

package/src/orion/engine/secrets/patterns/__init__.py

@@ -0,0 +1,74 @@
+"""Regex + entropy-based secret detection patterns."""
+import re
+import math
+from collections import Counter
+
+_SECRET_PATTERNS = [
+    ("aws_access_key", re.compile(r"\bAKIA[0-9A-Z]{16}\b")),
+    ("github_token", re.compile(r"\bgh[pousr]_[A-Za-z0-9_]{36}\b")),
+    ("stripe_live_key", re.compile(r"\bsk_live_[a-zA-Z0-9]{24}\b")),
+    ("jwt_token", re.compile(r"\beyJ[A-Za-z0-9_-]{10,}\.[A-Za-z0-9_-]{10,}\.[A-Za-z0-9_-]{10,}\b")),
+    ("slack_token", re.compile(r"\bxox[baprs]-[0-9]{12}-[0-9]{12}-[0-9]{12}-[a-z0-9]{32}\b")),
+    ("generic_api_key", re.compile(r"[a-zA-Z_]*[_-]?key[_-]?[=:]\s*['\"][a-zA-Z0-9_\-]{20,}['\"]")),
+    ("private_key", re.compile(r"-----BEGIN (?:RSA|DSA|EC|OPENSSH) PRIVATE KEY-----")),
+    ("generic_secret", re.compile(r"(?i)(?:api[_-]?key|apikey|secret|token|password|passwd)\s*[:=]\s*['\"]([a-zA-Z0-9_\-+/=]{20,})['\"]")),
+    ("aws_secret_key", re.compile(r"(?i)aws.{0,20}?(?:secret.?access.?key)\s*[:=]\s*['\"]([A-Za-z0-9/+=]{40})['\"]")),
+]
+
+_TEST_PATTERNS = [
+    "sk_test_",
+    "AKIAIOSFODNN7EXAMPLE",
+    "example",
+    "test",
+    "dummy",
+    "placeholder",
+    "your_key_here",
+    "your_api_key",
+    "your_secret",
+    "xxxxxxxx",
+    "aaaaaaaa",
+    "12345678",
+    "fake",
+    "mock",
+]
+
+
+def is_test_pattern(match: str) -> bool:
+    match_lower = match.lower()
+    return any(tp.lower() in match_lower for tp in _TEST_PATTERNS)
+
+
+def scan_patterns(text: str):
+    findings = []
+    for pattern_id, pattern in _SECRET_PATTERNS:
+        for match in pattern.finditer(text):
+            matched_text = match.group(0)
+            if is_test_pattern(matched_text):
+                continue
+            findings.append({
+                "pattern_id": pattern_id,
+                "match": matched_text,
+                "start": match.start(),
+                "end": match.end(),
+            })
+    return findings
+
+
+def shannon_entropy(data: str) -> float:
+    if not data or len(data) < 20:
+        return 0.0
+    counts = Counter(data)
+    length = len(data)
+    return -sum((c / length) * math.log2(c / length) for c in counts.values())
+
+
+def find_high_entropy_strings(text: str, min_length: int = 20, threshold: float = 4.5):
+    results = []
+    words = re.findall(r"[A-Za-z0-9_\-+/=]{20,}", text)
+    for word in words:
+        if is_test_pattern(word):
+            continue
+        entropy = shannon_entropy(word)
+        if entropy > threshold:
+            results.append({"string": word, "entropy": entropy})
+    return results