@orionscanner/cli 0.1.0

package/src/orion/engine/sensitive_data/engine.py

@@ -0,0 +1,143 @@
+"""PrivacyShield™ - In-House PII, GDPR, HIPAA & PCI-DSS Data Leak Engine.
+
+100% Proprietary In-House IP for Commercial Privacy, Data Protection & Regulatory Compliance.
+"""
+
+import re
+from pathlib import Path
+from typing import List, Dict, Any
+
+from orion.engine.config import EngineConfig, ResourceLimits
+from orion.engine.ir import OrionIR
+from orion.engine.results import EngineResult, Finding
+
+
+def luhn_checksum_valid(card_num: str) -> bool:
+    """Proprietary in-house Luhn checksum validator for payment cards."""
+    digits = [int(c) for c in card_num if c.isdigit()]
+    if len(digits) < 13 or len(digits) > 19:
+        return False
+    checksum = 0
+    reverse_digits = digits[::-1]
+    for i, digit in enumerate(reverse_digits):
+        if i % 2 == 1:
+            doubled = digit * 2
+            checksum += doubled - 9 if doubled > 9 else doubled
+        else:
+            checksum += digit
+    return checksum % 10 == 0
+
+
+class SensitiveDataEngine:
+    name = "sensitive_data"
+    version = "1.0.0"
+
+    # US Social Security Numbers (SSN)
+    SSN_PATTERN = re.compile(r"\b(?!000|666|9\d{2})\d{3}[-\s](?!00)\d{2}[-\s](?!0000)\d{4}\b")
+
+    # Payment Card Numbers (Visa, Mastercard, Amex, Discover)
+    CC_PATTERN = re.compile(r"\b(?:4[0-9]{12}(?:[0-9]{3})?|5[1-5][0-9]{14}|3[47][0-9]{13}|6(?:011|5[0-9]{2})[0-9]{12})\b")
+
+    # Health & Medical Identifiers (US NPI, DEA, MRN)
+    NPI_PATTERN = re.compile(r"\b(?:npi|medical_record_number|mrn|patient_id)\s*[:=]\s*['\"]?([0-9]{10})['\"]?\b", re.IGNORECASE)
+
+    # Cleartext Passwords / PII in Logging statements
+    LOGGED_PII_PATTERN = re.compile(r"(?:logger|logging|console)\.(?:info|debug|warn|error|log)\s*\([^)]*(?:ssn|credit_card|card_number|password|secret|dob|birth_date|salary)[^)]*\)", re.IGNORECASE)
+
+    async def check_availability(self) -> bool:
+        return True
+
+    def resource_limits(self) -> ResourceLimits:
+        return ResourceLimits(max_cpu_seconds=45, max_memory_mb=128)
+
+    async def run(self, ir: OrionIR, config: EngineConfig) -> EngineResult:
+        filepath = ir.metadata.get("path", "unknown")
+        findings: List[Finding] = []
+
+        try:
+            content = ir.content.decode("utf-8", errors="replace")
+        except Exception:
+            content = str(ir.content)
+
+        lines = content.splitlines()
+
+        for i, line in enumerate(lines, 1):
+            line_str = line.strip()
+
+            # Skip comments or mock test files if configured
+            if line_str.startswith("#") and "mock" in line_str.lower():
+                continue
+
+            # 1. PCI-DSS: Credit Card Numbers
+            for match in self.CC_PATTERN.finditer(line):
+                candidate = match.group(0)
+                if luhn_checksum_valid(candidate):
+                    findings.append(Finding(
+                        engine=self.name,
+                        severity="high",
+                        title="PCI-DSS Violation: Hardcoded Payment Card Primary Account Number (PAN)",
+                        description=f"Luhn-validated payment card number detected in cleartext source, violating PCI-DSS Req 3.4",
+                        location=f"{filepath}:{i}",
+                        metadata={
+                            "regulation": "PCI-DSS-Req-3.4",
+                            "cwe": "CWE-312",
+                            "masked_value": candidate[:4] + "********" + candidate[-4:],
+                            "confidence": 0.95,
+                        },
+                    ))
+
+            # 2. GDPR/CCPA: US Social Security Numbers
+            for match in self.SSN_PATTERN.finditer(line):
+                ssn = match.group(0)
+                findings.append(Finding(
+                    engine=self.name,
+                    severity="high",
+                    title="GDPR/CCPA Sensitive PII: Hardcoded Social Security Number (SSN)",
+                    description=f"Direct Social Security Number format detected in cleartext",
+                    location=f"{filepath}:{i}",
+                    metadata={
+                        "regulation": "GDPR-Article-9 / CCPA-1798.140",
+                        "cwe": "CWE-359",
+                        "confidence": 0.90,
+                    },
+                ))
+
+            # 3. HIPAA: Medical / Patient Identifiers
+            for match in self.NPI_PATTERN.finditer(line):
+                findings.append(Finding(
+                    engine=self.name,
+                    severity="medium",
+                    title="HIPAA Security Rule: Unprotected Protected Health Information (PHI/NPI)",
+                    description="Medical Record / National Provider Identifier (NPI) referenced directly in application source",
+                    location=f"{filepath}:{i}",
+                    metadata={
+                        "regulation": "HIPAA-164.312",
+                        "cwe": "CWE-359",
+                        "confidence": 0.85,
+                    },
+                ))
+
+            # 4. Privacy Logging Violation: Sensitive PII in Loggers
+            if self.LOGGED_PII_PATTERN.search(line):
+                findings.append(Finding(
+                    engine=self.name,
+                    severity="medium",
+                    title="Privacy & Compliance Violation: Sensitive PII Sent to Application Logger",
+                    description="Sensitive data fields (passwords, SSNs, credit cards, dates of birth) detected inside logging arguments",
+                    location=f"{filepath}:{i}",
+                    metadata={
+                        "regulation": "SOC2-Privacy / GDPR-Article-32",
+                        "cwe": "CWE-532",
+                        "confidence": 0.90,
+                    },
+                ))
+
+        return EngineResult(
+            engine=self.name,
+            findings=findings,
+            ok=True,
+            metrics={"file": filepath, "checks_run": 4, "findings_count": len(findings)},
+        )
+
+
+Engine = SensitiveDataEngine

package/src/orion/engine/state/engine.py

@@ -0,0 +1,218 @@
+"""Mutable state detection engine - find global/class/function mutable state."""
+import ast
+from orion.engine.config import EngineConfig
+from orion.engine.ir import OrionIR
+from orion.engine.results import EngineResult, Finding
+
+
+class Engine:
+    name = "state"
+    version = "1.0.0"
+
+    async def check_availability(self) -> bool:
+        return True
+
+    def resource_limits(self):
+        from orion.engine.config import ResourceLimits
+        return ResourceLimits(max_cpu_seconds=30, max_memory_mb=128)
+
+    async def run(self, ir: OrionIR, config: EngineConfig) -> EngineResult:
+        try:
+            text = ir.content.decode("utf-8", errors="replace")
+        except Exception:
+            text = str(ir.content)
+
+        path = ir.metadata.get("path", "unknown")
+        findings = []
+
+        if not path.endswith(".py"):
+            return EngineResult(engine=self.name, findings=findings, ok=True)
+
+        try:
+            tree = ast.parse(text)
+        except SyntaxError:
+            return EngineResult(engine=self.name, findings=findings, ok=True, errors=["Syntax error in source"])
+
+        lines = text.splitlines()
+
+        for node in ast.walk(tree):
+            if isinstance(node, ast.Assign) and self._is_module_level(node, tree):
+                findings.extend(self._check_module_assignment(node, lines, path))
+            elif isinstance(node, ast.FunctionDef):
+                findings.extend(self._check_function_defaults(node, lines, path))
+            elif isinstance(node, ast.ClassDef):
+                findings.extend(self._check_class_attributes(node, lines, path))
+            elif isinstance(node, ast.Global):
+                findings.extend(self._check_global_usage(node, lines, path))
+            elif isinstance(node, ast.Nonlocal):
+                findings.extend(self._check_nonlocal_usage(node, lines, path))
+
+        return EngineResult(engine=self.name, findings=findings, ok=True)
+
+    def _is_module_level(self, node: ast.AST, tree: ast.AST) -> bool:
+        for n in ast.walk(tree):
+            if isinstance(n, (ast.FunctionDef, ast.AsyncFunctionDef, ast.ClassDef)):
+                for child in ast.walk(n):
+                    if child is node:
+                        return False
+        return True
+
+    def _check_module_assignment(self, node: ast.Assign, lines: list, path: str):
+        findings = []
+        for target in node.targets:
+            if isinstance(target, ast.Name):
+                # Standard Python uppercase constants, lookup maps and registry dicts are not race conditions
+                if target.id.isupper() or target.id.startswith("_") or any(target.id.endswith(s) for s in ["_MAP", "_DICT", "_LIST", "_PATTERNS", "_EXTENSIONS", "_TYPES"]):
+                    continue
+
+                if self._is_mutable_value(node.value):
+                    line_no = node.lineno
+                    snippet = self._get_snippet(lines, line_no)
+                    findings.append(Finding(
+                        engine=self.name,
+                        severity="low",
+                        title=f"Module-level mutable variable: {target.id}",
+                        description=f"Global variable '{target.id}' assigned a mutable value ({self._get_type_name(node.value)})",
+                        location=f"{path}:{line_no}",
+                        metadata={
+                            "confidence": 0.65,
+                            "snippet": snippet,
+                            "variable": target.id,
+                            "type": self._get_type_name(node.value),
+                            "issue": "global_mutable",
+                            "cwe": "CWE-488",
+                        },
+                    ))
+        return findings
+
+    def _is_mutable_value(self, node: ast.AST) -> bool:
+        if isinstance(node, (ast.Dict, ast.List, ast.Set)):
+            return True
+        if isinstance(node, ast.Call):
+            if isinstance(node.func, ast.Name):
+                if node.func.id in ("dict", "list", "set", "defaultdict", "OrderedDict", "Counter"):
+                    return True
+            if isinstance(node.func, ast.Attribute):
+                if node.func.attr in ("dict", "list", "set"):
+                    return True
+        return False
+
+    def _get_type_name(self, node: ast.AST) -> str:
+        if isinstance(node, ast.Dict):
+            return "dict"
+        elif isinstance(node, ast.List):
+            return "list"
+        elif isinstance(node, ast.Set):
+            return "set"
+        elif isinstance(node, ast.Call):
+            if isinstance(node.func, ast.Name):
+                return node.func.id
+            elif isinstance(node.func, ast.Attribute):
+                return node.func.attr
+        return "unknown"
+
+    def _check_function_defaults(self, node: ast.FunctionDef, lines: list, path: str):
+        findings = []
+        for default in node.args.defaults:
+            if self._is_mutable_value(default):
+                line_no = node.lineno
+                snippet = self._get_snippet(lines, line_no)
+                arg_index = len(node.args.posonlyargs) + len(node.args.args) - len(node.args.defaults)
+                arg_name = node.args.args[arg_index].arg if arg_index < len(node.args.args) else "unknown"
+                findings.append(Finding(
+                    engine=self.name,
+                    severity="high",
+                    title=f"Mutable default argument: {node.name}.{arg_name}",
+                    description=f"Function '{node.name}' has mutable default argument '{arg_name}' ({self._get_type_name(default)})",
+                    location=f"{path}:{line_no}",
+                    metadata={
+                        "confidence": 0.95,
+                        "snippet": snippet,
+                        "function": node.name,
+                        "argument": arg_name,
+                        "type": self._get_type_name(default),
+                        "issue": "mutable_default",
+                        "cwe": "CWE-488",
+                        "cvss": 5.0,
+                    },
+                ))
+        return findings
+
+    def _check_class_attributes(self, node: ast.ClassDef, lines: list, path: str):
+        findings = []
+        for item in node.body:
+            if isinstance(item, ast.Assign):
+                for target in item.targets:
+                    if isinstance(target, ast.Name):
+                        if self._is_mutable_value(item.value):
+                            line_no = item.lineno
+                            snippet = self._get_snippet(lines, line_no)
+                            findings.append(Finding(
+                                engine=self.name,
+                                severity="medium",
+                                title=f"Class-level mutable attribute: {node.name}.{target.id}",
+                                description=f"Class '{node.name}' has mutable class attribute '{target.id}' ({self._get_type_name(item.value)}) - shared across all instances",
+                                location=f"{path}:{line_no}",
+                                metadata={
+                                    "confidence": 0.9,
+                                    "snippet": snippet,
+                                    "class": node.name,
+                                    "attribute": target.id,
+                                    "type": self._get_type_name(item.value),
+                                    "issue": "class_mutable_attribute",
+                                    "cwe": "CWE-488",
+                                    "cvss": 4.0,
+                                },
+                            ))
+        return findings
+
+    def _check_global_usage(self, node: ast.Global, lines: list, path: str):
+        findings = []
+        for name in node.names:
+            line_no = node.lineno
+            snippet = self._get_snippet(lines, line_no)
+            findings.append(Finding(
+                engine=self.name,
+                severity="low",
+                title=f"Global variable declaration: {name}",
+                description=f"Explicit 'global {name}' declaration - check for mutable state",
+                location=f"{path}:{line_no}",
+                metadata={
+                    "confidence": 0.7,
+                    "snippet": snippet,
+                    "variable": name,
+                    "issue": "global_declaration",
+                    "cwe": "CWE-488",
+                    "cvss": 3.0,
+                },
+            ))
+        return findings
+
+    def _check_nonlocal_usage(self, node: ast.Nonlocal, lines: list, path: str):
+        findings = []
+        for name in node.names:
+            line_no = node.lineno
+            snippet = self._get_snippet(lines, line_no)
+            findings.append(Finding(
+                engine=self.name,
+                severity="low",
+                title=f"Nonlocal variable declaration: {name}",
+                description=f"Explicit 'nonlocal {name}' declaration - check for mutable state in closure",
+                location=f"{path}:{line_no}",
+                metadata={
+                    "confidence": 0.7,
+                    "snippet": snippet,
+                    "variable": name,
+                    "issue": "nonlocal_declaration",
+                    "cwe": "CWE-488",
+                    "cvss": 3.0,
+                },
+            ))
+        return findings
+
+    def _get_snippet(self, lines: list, line_no: int, context: int = 2) -> str:
+        if line_no <= 0:
+            return ""
+        start = max(0, line_no - context - 1)
+        end = min(len(lines), line_no + context)
+        return "\n".join(lines[start:end])

package/src/orion/engine/supply_chain_sbom/engine.py

@@ -0,0 +1,290 @@
+"""SBOM generation engine - creates CycloneDX-like SBOM from dependencies."""
+import json
+import hashlib
+import re
+import subprocess
+import tomllib
+from pathlib import Path
+from orion.engine.config import EngineConfig
+from orion.engine.ir import OrionIR
+from orion.engine.results import EngineResult, Finding
+
+
+class Engine:
+    name = "supply_chain_sbom"
+    version = "1.0.0"
+
+    DEP_FILES = {
+        "requirements.txt", "requirements-dev.txt", "requirements-test.txt",
+        "pyproject.toml", "setup.py", "setup.cfg",
+        "Pipfile", "Pipfile.lock",
+        "poetry.lock", "pnpm-lock.yaml", "yarn.lock", "package-lock.json",
+        "package.json", "go.mod", "go.sum",
+        "Cargo.toml", "Cargo.lock",
+        "pom.xml", "build.gradle", "build.gradle.kts",
+        "composer.json", "composer.lock",
+    }
+
+    async def check_availability(self) -> bool:
+        return True
+
+    def resource_limits(self):
+        from orion.engine.config import ResourceLimits
+        return ResourceLimits(max_cpu_seconds=120, max_memory_mb=512)
+
+    async def run(self, ir: OrionIR, config: EngineConfig) -> EngineResult:
+        path = ir.metadata.get("path", "unknown")
+        project_root = ir.metadata.get("project_root", ".")
+
+        deps = self._get_dependencies(ir, project_root)
+        if not deps:
+            return EngineResult(engine=self.name, findings=[], ok=True, metrics={"sbom": {"components": []}})
+
+        sbom = self._generate_sbom(deps, project_root)
+
+        return EngineResult(
+            engine=self.name,
+            findings=[],
+            ok=True,
+            metrics={"sbom": sbom},
+        )
+
+    def _get_dependencies(self, ir: OrionIR, project_root: str) -> dict[str, str]:
+        deps = {}
+
+        if ir.metadata.get("metrics", {}).get("dependencies"):
+            deps.update(ir.metadata["metrics"]["dependencies"])
+
+        if not deps:
+            deps = self._parse_dep_files(project_root)
+
+        return deps
+
+    def _parse_dep_files(self, project_root: str) -> dict[str, str]:
+        deps = {}
+        root_path = Path(project_root)
+
+        for dep_file in self.DEP_FILES:
+            for found in root_path.rglob(dep_file):
+                try:
+                    text = found.read_text(encoding="utf-8", errors="replace")
+                    parsed = self._parse_dep_file(text, found.name)
+                    deps.update(parsed)
+                except Exception:
+                    pass
+
+        return deps
+
+    def _parse_dep_file(self, text: str, filename: str) -> dict[str, str]:
+        deps = {}
+        filename_lower = filename.lower()
+
+        if filename_lower in ("requirements.txt",) or filename_lower.startswith("requirements-") and filename_lower.endswith(".txt"):
+            deps = self._parse_requirements(text)
+        elif filename_lower == "pyproject.toml":
+            deps = self._parse_pyproject_toml(text)
+        elif filename_lower == "pipfile":
+            deps = self._parse_pipfile(text)
+        elif filename_lower == "poetry.lock":
+            deps = self._parse_poetry_lock(text)
+        elif filename_lower == "package.json":
+            deps = self._parse_package_json(text)
+        elif filename_lower in ("pnpm-lock.yaml", "yarn.lock", "package-lock.json"):
+            deps = self._parse_lock_file(text, filename_lower)
+        elif filename_lower == "go.mod":
+            deps = self._parse_go_mod(text)
+        elif filename_lower == "cargo.toml":
+            deps = self._parse_cargo_toml(text)
+
+        return deps
+
+    def _parse_requirements(self, text: str) -> dict[str, str]:
+        deps = {}
+        for line in text.splitlines():
+            line = line.strip()
+            if not line or line.startswith("#") or line.startswith("-"):
+                continue
+            match = re.match(r"^([A-Za-z0-9_\-\.]+)(?:[=<>!~]+([A-Za-z0-9_\-\.]+))?", line)
+            if match:
+                name = match.group(1).lower()
+                version = match.group(2) or "unknown"
+                deps[name] = version
+        return deps
+
+    def _parse_pyproject_toml(self, text: str) -> dict[str, str]:
+        deps = {}
+        try:
+            data = tomllib.loads(text)
+            for section in ("project", "tool.poetry"):
+                if section in data:
+                    dep_section = data[section].get("dependencies", {})
+                    for name, spec in dep_section.items():
+                        if name.lower() != "python":
+                            version = spec if isinstance(spec, str) else spec.get("version", "unknown")
+                            deps[name.lower()] = version
+        except Exception:
+            pass
+        return deps
+
+    def _parse_pipfile(self, text: str) -> dict[str, str]:
+        deps = {}
+        current_section = None
+        for line in text.splitlines():
+            line = line.strip()
+            if line.startswith("[") and line.endswith("]"):
+                current_section = line[1:-1].lower()
+                continue
+            if current_section in ("packages", "dev-packages") and "=" in line:
+                parts = line.split("=", 1)
+                name = parts[0].strip().lower()
+                version = parts[1].strip().strip('"\'')
+                deps[name] = version
+        return deps
+
+    def _parse_poetry_lock(self, text: str) -> dict[str, str]:
+        deps = {}
+        try:
+            data = tomllib.loads(text)
+            for pkg in data.get("package", []):
+                deps[pkg["name"].lower()] = pkg["version"]
+        except Exception:
+            pass
+        return deps
+
+    def _parse_package_json(self, text: str) -> dict[str, str]:
+        deps = {}
+        try:
+            data = json.loads(text)
+            for section in ("dependencies", "devDependencies", "peerDependencies", "optionalDependencies"):
+                for name, version in data.get(section, {}).items():
+                    deps[name.lower()] = version.lstrip("^~>=")
+        except Exception:
+            pass
+        return deps
+
+    def _parse_lock_file(self, text: str, filename: str) -> dict[str, str]:
+        deps = {}
+        try:
+            if filename == "package-lock.json":
+                data = json.loads(text)
+                for name, info in data.get("packages", {}).items():
+                    if name and name != "":
+                        clean_name = name.split("node_modules/")[-1].lower()
+                        deps[clean_name] = info.get("version", "unknown")
+            elif filename == "pnpm-lock.yaml":
+                for line in text.splitlines():
+                    match = re.match(r"^\s+([^:]+):\s+\"([^\"]+)\"", line)
+                    if match and not match.group(1).startswith(" "):
+                        deps[match.group(1).lower()] = match.group(2)
+            elif filename == "yarn.lock":
+                current_name = None
+                for line in text.splitlines():
+                    match = re.match(r'^"([^@]+)@[^"]+":', line)
+                    if match:
+                        current_name = match.group(1).lower()
+                    elif current_name and "version" in line:
+                        version_match = re.search(r'version\s+"([^"]+)"', line)
+                        if version_match:
+                            deps[current_name] = version_match.group(1)
+                            current_name = None
+        except Exception:
+            pass
+        return deps
+
+    def _parse_go_mod(self, text: str) -> dict[str, str]:
+        deps = {}
+        for line in text.splitlines():
+            line = line.strip()
+            if line.startswith("require "):
+                parts = line.split()
+                if len(parts) >= 3:
+                    deps[parts[1].lower()] = parts[2]
+        return deps
+
+    def _parse_cargo_toml(self, text: str) -> dict[str, str]:
+        deps = {}
+        try:
+            data = tomllib.loads(text)
+            for section in ("dependencies", "dev-dependencies"):
+                for name, spec in data.get(section, {}).items():
+                    version = spec if isinstance(spec, str) else spec.get("version", "unknown")
+                    deps[name.lower()] = version
+        except Exception:
+            pass
+        return deps
+
+    def _generate_sbom(self, deps: dict[str, str], project_root: str) -> dict:
+        components = []
+
+        for name, version in sorted(deps.items()):
+            comp = {
+                "name": name,
+                "version": version,
+                "purl": self._generate_purl(name, version),
+                "hashes": self._fetch_hashes(name, version),
+                "licenses": self._fetch_license(name, version),
+                "externalReferences": self._fetch_references(name),
+            }
+            components.append(comp)
+
+        return {
+            "bomFormat": "CycloneDX",
+            "specVersion": "1.5",
+            "serialNumber": f"urn:uuid:{hashlib.sha256(str(sorted(deps.items())).encode()).hexdigest()[:32]}",
+            "version": 1,
+            "components": components,
+        }
+
+    def _generate_purl(self, name: str, version: str) -> str:
+        if re.match(r"^[a-z0-9_\-]+$", name.lower()):
+            return f"pkg:pypi/{name.lower()}@{version}"
+        elif "/" in name:
+            return f"pkg:npm/{name}@{version}"
+        else:
+            return f"pkg:generic/{name}@{version}"
+
+    def _fetch_hashes(self, name: str, version: str) -> dict[str, str]:
+        try:
+            result = subprocess.run(
+                ["pip", "download", "--no-deps", "-d", "/tmp", f"{name}=={version}"],
+                capture_output=True, text=True, timeout=30
+            )
+            if result.returncode == 0:
+                for line in result.stdout.splitlines():
+                    if ".whl" in line or ".tar.gz" in line:
+                        filepath = line.strip()
+                        sha256 = self._file_sha256(filepath)
+                        if sha256:
+                            return {"sha256": sha256}
+        except Exception:
+            pass
+        return {}
+
+    def _file_sha256(self, filepath: str) -> str | None:
+        try:
+            with open(filepath, "rb") as f:
+                return hashlib.sha256(f.read()).hexdigest()
+        except Exception:
+            return None
+
+    def _fetch_license(self, name: str, version: str) -> list[dict]:
+        try:
+            result = subprocess.run(
+                ["pip", "show", f"{name}=={version}"],
+                capture_output=True, text=True, timeout=10
+            )
+            if result.returncode == 0:
+                for line in result.stdout.splitlines():
+                    if line.startswith("License:"):
+                        license_str = line.split(":", 1)[1].strip()
+                        return [{"license": {"id": license_str}}]
+        except Exception:
+            pass
+        return [{"license": {"id": "UNKNOWN"}}]
+
+    def _fetch_references(self, name: str) -> list[dict]:
+        refs = []
+        if re.match(r"^[a-z0-9_\-]+$", name.lower()):
+            refs.append({"type": "website", "url": f"https://pypi.org/project/{name}"})
+            refs.append({"type": "repository", "url": f"https://github.com/pypi/{name}"})
+        return refs