@orionscanner/cli 0.1.0

package/src/orion/engine/symbol/engine.py

@@ -0,0 +1,463 @@
+"""Symbol table analyzer for detecting shadowed builtins, undefined names, unused imports, and late binding closures."""
+import ast
+from typing import Dict, List, Set, Optional, Any, Tuple
+from dataclasses import dataclass, field
+from collections import defaultdict
+from orion.engine.config import EngineConfig, ResourceLimits
+from orion.engine.ir import OrionIR
+from orion.engine.results import EngineResult, Finding
+
+
+import builtins
+
+BUILTINS = set(dir(builtins)) | {
+    "__file__", "__name__", "__doc__", "__package__", "__loader__",
+    "__spec__", "__annotations__", "__builtins__", "__all__", "__path__",
+    "__class__", "self", "cls", "True", "False", "None", "Ellipsis", "NotImplemented"
+}
+
+
+@dataclass
+class Scope:
+    name: str
+    parent: Optional['Scope'] = None
+    variables: Dict[str, 'Symbol'] = field(default_factory=dict)
+    imports: Dict[str, str] = field(default_factory=dict)
+    used_names: Set[str] = field(default_factory=set)
+    defined_names: Set[str] = field(default_factory=set)
+    is_function: bool = False
+    is_class: bool = False
+    is_module: bool = False
+
+
+@dataclass
+class Symbol:
+    name: str
+    scope: Scope
+    node: ast.AST
+    is_import: bool = False
+    is_parameter: bool = False
+    is_function: bool = False
+    is_class: bool = False
+    is_global: bool = False
+    is_nonlocal: bool = False
+    is_used: bool = False
+    is_assigned: bool = False
+    line: int = 0
+
+
+class SymbolVisitor(ast.NodeVisitor):
+    def __init__(self, filename: str, source_lines: List[str]):
+        self.filename = filename
+        self.source_lines = source_lines
+        self.findings: List[Finding] = []
+        self.current_scope: Optional[Scope] = None
+        self.module_scope: Optional[Scope] = None
+        self.symbols: Dict[int, Symbol] = {}
+        self.closure_vars: Dict[str, List[Tuple[str, int]]] = defaultdict(list)
+        self.late_binding_vars: List[Tuple[str, int]] = []
+
+    def get_snippet(self, node: ast.AST, context: int = 2) -> str:
+        start = max(0, node.lineno - 1 - context)
+        end = min(len(self.source_lines),
+                  getattr(node, 'end_lineno', node.lineno) + context if hasattr(node, 'end_lineno') else node.lineno + context)
+        return "\n".join(self.source_lines[start:end])
+
+    def enter_scope(self, name: str, is_function: bool = False, is_class: bool = False, is_module: bool = False):
+        new_scope = Scope(
+            name=name,
+            parent=self.current_scope,
+            is_function=is_function,
+            is_class=is_class,
+            is_module=is_module
+        )
+        if self.current_scope is None:
+            self.module_scope = new_scope
+        self.current_scope = new_scope
+
+    def exit_scope(self):
+        if self.current_scope and self.current_scope.parent:
+            self.current_scope = self.current_scope.parent
+        else:
+            self.current_scope = None
+
+    def define(self, name: str, node: ast.AST, is_import: bool = False, is_parameter: bool = False,
+               is_function: bool = False, is_class: bool = False, is_global: bool = False,
+               is_nonlocal: bool = False):
+        if not self.current_scope:
+            return
+        
+        symbol = Symbol(
+            name=name,
+            scope=self.current_scope,
+            node=node,
+            is_import=is_import,
+            is_parameter=is_parameter,
+            is_function=is_function,
+            is_class=is_class,
+            is_global=is_global,
+            is_nonlocal=is_nonlocal,
+            line=node.lineno
+        )
+        self.current_scope.variables[name] = symbol
+        self.current_scope.defined_names.add(name)
+        self.symbols[id(node)] = symbol
+
+    def use(self, name: str, node: ast.AST):
+        if not self.current_scope:
+            return
+        
+        scope = self.current_scope
+        while scope:
+            if name in scope.variables:
+                scope.variables[name].is_used = True
+                scope.used_names.add(name)
+                return
+            scope = scope.parent
+        
+        if name not in BUILTINS and not self._is_future_import(name):
+            self.findings.append(Finding(
+                engine="symbol",
+                severity="medium",
+                title="Undefined name",
+                description=f"Name '{name}' is used but not defined",
+                location=f"{self.filename}:{node.lineno}",
+                metadata={
+                    "snippet": self.get_snippet(node),
+                    "cwe": "CWE-476",
+                    "confidence": 0.85,
+                    "check": "undefined_name",
+                    "name": name,
+                }
+            ))
+
+    def _is_future_import(self, name: str) -> bool:
+        if self.module_scope:
+            return name in self.module_scope.imports
+        return False
+
+    def visit_Module(self, node: ast.Module):
+        self.enter_scope("<module>", is_module=True)
+        self.generic_visit(node)
+        self._check_unused_imports()
+        self._check_shadowed_builtins()
+        self.exit_scope()
+
+    def visit_Import(self, node: ast.Import):
+        for alias in node.names:
+            name = alias.asname or alias.name
+            self.define(name, node, is_import=True)
+            if self.current_scope:
+                self.current_scope.imports[name] = alias.name
+        self.generic_visit(node)
+
+    def visit_ImportFrom(self, node: ast.ImportFrom):
+        if node.module:
+            for alias in node.names:
+                name = alias.asname or alias.name
+                self.define(name, node, is_import=True)
+                if self.current_scope:
+                    self.current_scope.imports[name] = f"{node.module}.{alias.name}"
+        self.generic_visit(node)
+
+    def visit_FunctionDef(self, node: ast.FunctionDef):
+        name = node.name
+        if self.current_scope and self.current_scope.is_class:
+            qual_name = f"{self.current_scope.name}.{name}"
+        else:
+            qual_name = name
+        
+        self.define(name, node, is_function=True)
+        
+        self.enter_scope(qual_name, is_function=True)
+        
+        for arg in node.args.args:
+            self.define(arg.arg, arg, is_parameter=True)
+        
+        if node.args.vararg:
+            self.define(node.args.vararg.arg, node.args.vararg, is_parameter=True)
+        if node.args.kwarg:
+            self.define(node.args.kwarg.arg, node.args.kwarg, is_parameter=True)
+        
+        for default in node.args.defaults:
+            self._check_late_binding(default, node)
+        
+        self.generic_visit(node)
+        
+        self._check_unused_params()
+        self.exit_scope()
+
+    def visit_AsyncFunctionDef(self, node: ast.AsyncFunctionDef):
+        self.visit_FunctionDef(node)
+
+    def _check_late_binding(self, default: ast.AST, func_node: ast.FunctionDef):
+        if isinstance(default, (ast.List, ast.Dict, ast.Set, ast.Call)):
+            for name_node in ast.walk(default):
+                if isinstance(name_node, ast.Name) and isinstance(name_node.ctx, ast.Load):
+                    self.late_binding_vars.append((name_node.id, default.lineno))
+
+    def visit_ClassDef(self, node: ast.ClassDef):
+        name = node.name
+        self.define(name, node, is_class=True)
+        
+        self.enter_scope(name, is_class=True)
+        self.generic_visit(node)
+        self.exit_scope()
+
+    def visit_Assign(self, node: ast.Assign):
+        for target in node.targets:
+            self._handle_assignment_target(target, node)
+        self.generic_visit(node)
+
+    def visit_AnnAssign(self, node: ast.AnnAssign):
+        if node.target:
+            self._handle_assignment_target(node.target, node)
+        if node.value:
+            self.generic_visit(node.value)
+
+    def visit_AugAssign(self, node: ast.AugAssign):
+        self._handle_assignment_target(node.target, node)
+        self.generic_visit(node)
+
+    def _handle_assignment_target(self, target: ast.AST, value_node: ast.AST):
+        if isinstance(target, ast.Name):
+            name = target.id
+            scope = self.current_scope
+            while scope:
+                if name in scope.variables:
+                    sym = scope.variables[name]
+                    sym.is_assigned = True
+                    if sym.is_parameter and not scope.is_function:
+                        self.findings.append(Finding(
+                            engine="symbol",
+                            severity="low",
+                            title="Parameter reassignment",
+                            description=f"Function parameter '{name}' is reassigned",
+                            location=f"{self.filename}:{target.lineno}",
+                            metadata={
+                                "snippet": self.get_snippet(target),
+                                "cwe": "CWE-563",
+                                "confidence": 0.75,
+                                "check": "param_reassignment",
+                                "name": name,
+                            }
+                        ))
+                    break
+                scope = scope.parent
+            else:
+                self.define(name, target)
+        elif isinstance(target, ast.Attribute):
+            pass
+        elif isinstance(target, ast.Subscript):
+            pass
+        elif isinstance(target, (ast.Tuple, ast.List)):
+            for elt in target.elts:
+                self._handle_assignment_target(elt, value_node)
+
+    def visit_Global(self, node: ast.Global):
+        for name in node.names:
+            if self.module_scope and name in self.module_scope.variables:
+                self.module_scope.variables[name].is_global = True
+            if self.current_scope:
+                self.current_scope.variables[name] = Symbol(
+                    name=name, scope=self.module_scope or self.current_scope,
+                    node=node, is_global=True, line=node.lineno
+                )
+
+    def visit_Nonlocal(self, node: ast.Nonlocal):
+        for name in node.names:
+            scope = self.current_scope.parent if self.current_scope else None
+            while scope and not scope.is_function:
+                scope = scope.parent
+            if scope and name in scope.variables:
+                scope.variables[name].is_nonlocal = True
+
+    def visit_Name(self, node: ast.Name):
+        if isinstance(node.ctx, ast.Load):
+            self.use(node.id, node)
+        elif isinstance(node.ctx, ast.Store):
+            pass
+        elif isinstance(node.ctx, ast.Del):
+            pass
+        self.generic_visit(node)
+
+    def visit_Lambda(self, node: ast.Lambda):
+        self.enter_scope("<lambda>", is_function=True)
+        for arg in node.args.args:
+            self.define(arg.arg, arg, is_parameter=True)
+        self.generic_visit(node)
+        self.exit_scope()
+
+    def visit_Comprehension(self, node: ast.comprehension):
+        self.define(node.target.id if isinstance(node.target, ast.Name) else "_", node, is_parameter=True)
+        for if_clause in node.ifs:
+            self.generic_visit(if_clause)
+        self.generic_visit(node.iter)
+
+    def visit_GeneratorExp(self, node: ast.GeneratorExp):
+        self.enter_scope("<genexpr>", is_function=True)
+        for gen in node.generators:
+            self.visit_Comprehension(gen)
+        self.generic_visit(node.elt)
+        self.exit_scope()
+
+    def visit_ListComp(self, node: ast.ListComp):
+        self.visit_GeneratorExp(node)
+
+    def visit_SetComp(self, node: ast.SetComp):
+        self.visit_GeneratorExp(node)
+
+    def visit_DictComp(self, node: ast.DictComp):
+        self.enter_scope("<dictexpr>", is_function=True)
+        for gen in node.generators:
+            self.visit_Comprehension(gen)
+        self.generic_visit(node.key)
+        self.generic_visit(node.value)
+        self.exit_scope()
+
+    def _check_unused_params(self):
+        if not self.current_scope or not self.current_scope.is_function:
+            return
+        for name, sym in self.current_scope.variables.items():
+            if sym.is_parameter and not sym.is_used and name != "_":
+                self.findings.append(Finding(
+                    engine="symbol",
+                    severity="low",
+                    title="Unused function parameter",
+                    description=f"Parameter '{name}' is defined but never used",
+                    location=f"{self.filename}:{sym.line}",
+                    metadata={
+                        "snippet": self.get_snippet(sym.node),
+                        "cwe": "CWE-563",
+                        "confidence": 0.8,
+                        "check": "unused_parameter",
+                        "name": name,
+                    }
+                ))
+
+    def _check_unused_imports(self):
+        if not self.module_scope:
+            return
+        for name, sym in self.module_scope.variables.items():
+            if sym.is_import and not sym.is_used:
+                if name.startswith("_"):
+                    continue
+                if self.module_scope.imports.get(name, "").startswith("__future__"):
+                    continue
+                self.findings.append(Finding(
+                    engine="symbol",
+                    severity="low",
+                    title="Unused import",
+                    description=f"Import '{name}' is never used",
+                    location=f"{self.filename}:{sym.line}",
+                    metadata={
+                        "snippet": self.get_snippet(sym.node),
+                        "cwe": "CWE-1041",
+                        "confidence": 0.85,
+                        "check": "unused_import",
+                        "imported": name,
+                        "module": self.module_scope.imports.get(name, ""),
+                    }
+                ))
+
+    def _check_shadowed_builtins(self):
+        if not self.module_scope:
+            return
+        for name in self.module_scope.variables:
+            if name in BUILTINS and not name.startswith("_"):
+                sym = self.module_scope.variables[name]
+                if sym.is_import or sym.is_function or sym.is_class:
+                    self.findings.append(Finding(
+                        engine="symbol",
+                        severity="medium",
+                        title="Shadowed builtin",
+                        description=f"Builtin '{name}' is shadowed by local definition",
+                        location=f"{self.filename}:{sym.line}",
+                        metadata={
+                            "snippet": self.get_snippet(sym.node),
+                            "cwe": "CWE-1228",
+                            "confidence": 0.9,
+                            "check": "shadowed_builtin",
+                            "name": name,
+                        }
+                    ))
+
+        for scope_name, scope in self._collect_scopes(self.module_scope):
+            for name, sym in scope.variables.items():
+                if name in BUILTINS and not name.startswith("_"):
+                    if sym.is_parameter:
+                        self.findings.append(Finding(
+                            engine="symbol",
+                            severity="medium",
+                            title="Shadowed builtin parameter",
+                            description=f"Function parameter '{name}' shadows builtin",
+                            location=f"{self.filename}:{sym.line}",
+                            metadata={
+                                "snippet": self.get_snippet(sym.node),
+                                "cwe": "CWE-1228",
+                                "confidence": 0.85,
+                                "check": "shadowed_builtin_param",
+                                "name": name,
+                                "function": scope.name,
+                            }
+                        ))
+
+    def _collect_scopes(self, scope: Scope) -> List[Tuple[str, Scope]]:
+        result = [(scope.name, scope)]
+        for var in scope.variables.values():
+            if var.is_function or var.is_class:
+                pass
+        return result
+
+
+class Engine:
+    name = "symbol"
+    version = "1.0.0"
+
+    async def check_availability(self) -> bool:
+        return True
+
+    def resource_limits(self) -> ResourceLimits:
+        return ResourceLimits(max_cpu_seconds=60, max_memory_mb=512, max_files=50000)
+
+    async def run(self, ctx, config: EngineConfig) -> EngineResult:
+        # Handle both single IR and list of IRs
+        if not isinstance(ctx, list):
+            ctx = [ctx]
+        all_findings = []
+        errors = []
+        files_processed = 0
+
+        exclude_patterns = config.toggles.get("exclude", []) if config.toggles else []
+
+        for ir in ctx:
+            try:
+                if not ir.metadata.get("language") == "python":
+                    continue
+
+                rel_path = ir.metadata.get("path", "unknown.py")
+                if any(pattern in rel_path for pattern in exclude_patterns):
+                    continue
+
+                content = ir.content.decode("utf-8", errors="replace")
+                source_lines = content.splitlines()
+                tree = ast.parse(content, filename=rel_path)
+
+                visitor = SymbolVisitor(rel_path, source_lines)
+                visitor.visit(tree)
+
+                all_findings.extend(visitor.findings)
+                files_processed += 1
+
+            except SyntaxError as e:
+                errors.append(f"Syntax error in {ir.metadata.get('path', 'unknown')}: {e}")
+            except Exception as e:
+                errors.append(f"Error processing {ir.metadata.get('path', 'unknown')}: {e}")
+
+        return EngineResult(
+            engine=self.name,
+            findings=all_findings,
+            errors=errors,
+            metrics={"files_processed": files_processed, "findings_count": len(all_findings)},
+            ok=len(errors) == 0
+        )