@orionscanner/cli 0.1.0

package/docs/GETTING_STARTED.md

@@ -0,0 +1,226 @@
+# Getting Started
+
+## Installation
+
+```bash
+# From source
+git clone https://github.com/chandrahotha/OrionEngine
+cd OrionEngine
+pip install -e .
+
+# Or from PyPI (when published)
+pip install orion-engine
+```
+
+Requires Python 3.10+
+
+## Quick Start
+
+### 1. Interactive Menu
+```bash
+orion
+```
+Opens interactive menu with 9 options:
+1. **Quick Scan** — Fast security check of current project
+2. **Full Security Audit** — Complete analysis with all 38 engines
+3. **Vulnerability Scan** — SAST, Secrets, Dependencies, Injection
+4. **Code Quality Review** — Complexity, Duplication, Standards, Tests
+5. **Architecture Analysis** — Dependencies, Layers, Coupling, Design
+6. **Supply Chain Security** — SBOM, Provenance, Compliance, Containers
+7. **View Reports** — Browse previous scan reports
+8. **Settings** — Configure limits, exclusions, network
+9. **System Status** — Engine health and availability
+
+### 2. Direct Command Line
+```bash
+# Scan current directory
+orion .
+
+# Scan specific path
+orion ./my_project
+orion path/to/file.py
+
+# Security-focused scan (SAST, Secrets, Deps, Taint, Auth)
+orion . --security
+
+# Quality-focused scan (Complexity, Lint, Duplication, Tests)
+orion . --quality
+
+# Architecture scan (Callgraph, CFG, Symbols, Layers)
+orion . --arch
+
+# Custom config
+orion . --config-json '{"resource_limits":{"max_cpu_seconds":30}}'
+```
+
+## Configuration
+
+### EngineConfig
+```python
+from orion.engine import EngineConfig, ResourceLimits, NetworkPolicy
+
+config = EngineConfig(
+    toggles={
+        "exclude": ["tests/", "vendor/", "migrations/", "*.min.js"],
+        "only_engines": ["sast", "secrets", "deps"],
+        "severity_threshold": "medium",
+    },
+    resource_limits=ResourceLimits(
+        max_cpu_seconds=120,
+        max_memory_mb=1024,
+        max_file_size_mb=10,
+        max_files=50000
+    ),
+    network_policy=NetworkPolicy(
+        allow_outbound=False,
+        allowed_hosts=[]
+    )
+)
+```
+
+### ResourceLimits
+| Parameter | Default | Description |
+|-----------|---------|-------------|
+| `max_cpu_seconds` | 60 | Timeout per engine |
+| `max_memory_mb` | 512 | Memory limit per engine |
+| `max_file_size_mb` | 10 | Skip files larger than this |
+| `max_files` | 50000 | Max files to scan |
+
+### NetworkPolicy
+```python
+NetworkPolicy(
+    allow_outbound=False,    # Block all external calls (default)
+    allowed_hosts=[]         # Allowlist if outbound enabled
+)
+```
+
+## Reports
+
+Reports generated in `ORION SCANNER REPORTS/`:
+- **HTML** — Dark theme, sidebar navigation, expandable findings, score/grade (A-F)
+- **JSON** — Machine-readable for CI/CD integration
+- **TXT** — Human-readable summary
+
+```bash
+# Open latest HTML report (Windows)
+start "ORION SCANNER REPORTS\*.html"
+
+# Open latest HTML report (Linux/macOS)
+xdg-open "ORION SCANNER REPORTS"/*.html
+```
+
+## Programmatic Usage
+
+```python
+import asyncio
+from orion.engine import OrionEngine, EngineConfig, ResourceLimits
+from orion.engine.ir import OrionIR
+from pathlib import Path
+
+async def scan_project(project_path: str):
+    engine = OrionEngine()
+    
+    # Collect files
+    files = list(Path(project_path).rglob("*.py"))
+    irs = []
+    for f in files:
+        content = f.read_bytes()
+        irs.append(OrionIR(
+            content=content,
+            metadata={"path": str(f.relative_to(project_path)), "language": "python"}
+        ))
+    
+    config = EngineConfig(
+        resource_limits=ResourceLimits(max_cpu_seconds=120, max_memory_mb=1024)
+    )
+    
+    result = await engine.run(irs, config)
+    
+    print(f"Scanned {len(files)} files")
+    print(f"Found {len(result.findings)} issues")
+    print(f"Grade: {calculate_grade(result.findings)}")
+    
+    for f in result.findings:
+        if f.severity in ("critical", "high"):
+            print(f"  [{f.severity.upper()}] {f.title} @ {f.location}")
+
+asyncio.run(scan_project("."))
+```
+
+## Exit Codes
+- `0` — No critical/high findings
+- `1` — Critical or high severity findings found
+
+## Multi-Language Support
+
+Orion automatically detects language from file extension:
+
+| Extension | Language | SAST Support |
+|-----------|----------|--------------|
+| `.py` | Python | AST + Regex |
+| `.js`, `.jsx`, `.ts`, `.tsx` | JavaScript/TypeScript | Regex |
+| `.java` | Java | Regex |
+| `.go` | Go | Regex |
+| `.rs` | Rust | Regex |
+| `.php` | PHP | Regex |
+| `.rb` | Ruby | Regex |
+| `.cs` | C# | Regex |
+| `.cpp`, `.cc`, `.c`, `.h` | C/C++ | Regex |
+| `.html`, `.htm` | HTML | Regex |
+| `.yml`, `.yaml`, `.json`, `.toml` | Config | Regex |
+| `Dockerfile` | Dockerfile | Regex |
+
+## Excluding Files/Directories
+
+```python
+config = EngineConfig(
+    toggles={
+        "exclude": [
+            "tests/", "test/", "tests/**",
+            "vendor/", "node_modules/",
+            "migrations/", "dist/", "build/",
+            "*.min.js", "*.min.css",
+            "generated/", "*.pb.go"
+        ]
+    }
+)
+```
+
+## CI/CD Integration
+
+```yaml
+# GitHub Actions example
+- name: Orion Security Scan
+  run: |
+    pip install orion-engine
+    orion . --security
+```
+
+## False Positive Feedback
+
+Create `.orion-feedback.json` in project root:
+```json
+{
+  "findings": [
+    {
+      "engine": "sast",
+      "location": "app.py:42",
+      "title": "SQL Injection",
+      "feedback": "false_positive",
+      "reason": "Parameterized query used"
+    }
+  ]
+}
+```
+
+Orion learns from feedback and reduces confidence on similar patterns.
+
+## Troubleshooting
+
+| Issue | Solution |
+|-------|----------|
+| `ModuleNotFoundError: orion` | Run `pip install -e .` from project root |
+| Scan hangs | Reduce `max_cpu_seconds` in ResourceLimits |
+| Too many findings | Increase `severity_threshold` or add exclude patterns |
+| No findings | Check language detection, add file extensions |
+| Memory error | Reduce `max_memory_mb` or `max_files` |

package/package.json

@@ -0,0 +1,48 @@
+{
+  "name": "@orionscanner/cli",
+  "version": "0.1.0",
+  "description": "Orion Security Suite - Proprietary In-House Code Intelligence, SAST & Architecture Auditing Platform",
+  "main": "bin/orion.js",
+  "bin": {
+    "orion": "./bin/orion.js",
+    "orion-engine": "./bin/orion.js",
+    "orion-cli": "./bin/orion.js"
+  },
+  "scripts": {
+    "start": "node ./bin/orion.js",
+    "orion": "node ./bin/orion.js"
+  },
+  "keywords": [
+    "orion",
+    "security",
+    "sast",
+    "code-audit",
+    "static-analysis",
+    "taint-analysis",
+    "code-quality",
+    "threat-modeling",
+    "privacy-shield",
+    "architecture"
+  ],
+  "author": "Chandra Hotha",
+  "license": "UNLICENSED",
+  "engines": {
+    "node": ">=16.0.0"
+  },
+  "repository": {
+    "type": "git",
+    "url": "git+https://github.com/chandrahotha/OrionEngine.git"
+  },
+  "bugs": {
+    "url": "https://github.com/chandrahotha/OrionEngine/issues"
+  },
+  "homepage": "https://github.com/chandrahotha/OrionEngine#readme",
+  "files": [
+    "bin/",
+    "src/",
+    "assets/",
+    "docs/",
+    "README.md",
+    "pyproject.toml"
+  ]
+}

package/pyproject.toml

@@ -0,0 +1,16 @@
+[build-system]
+requires = ["setuptools>=68", "wheel"]
+build-backend = "setuptools.build_meta"
+
+[project]
+name = "orion-engine"
+version = "0.1.0"
+description = "Orion Security Suite - Proprietary In-House Code Intelligence & Security Audit Platform"
+requires-python = ">=3.10"
+dependencies = []
+
+[project.scripts]
+orion = "orion.engine.runner:main"
+
+[tool.setuptools.packages.find]
+where = ["src"]

package/src/orion/engine/__init__.py

@@ -0,0 +1,17 @@
+from orion.engine.config import EngineConfig, NetworkPolicy, ResourceLimits
+from orion.engine.results import EngineResult, Finding
+from orion.engine.ir import OrionIR
+from orion.engine.registry import EngineRegistry
+from orion.engine.core import OrionEngine
+
+__version__ = "1.0.0"
+__all__ = [
+    "OrionEngine",
+    "EngineConfig",
+    "NetworkPolicy",
+    "ResourceLimits",
+    "EngineResult",
+    "Finding",
+    "OrionIR",
+    "EngineRegistry",
+]

package/src/orion/engine/api_security/engine.py

@@ -0,0 +1,125 @@
+"""REST & Microservice API Security Engine.
+
+100% Custom In-House Developed Engine for Orion Engine Platform (OWASP API Security Top 10).
+Detects BOLA/IDOR patterns, mass assignment risks, unvalidated redirects, and exposed debug endpoints.
+"""
+import re
+from pathlib import Path
+from typing import List, Dict, Any
+
+from orion.engine.config import EngineConfig, ResourceLimits
+from orion.engine.ir import OrionIR
+from orion.engine.results import EngineResult, Finding
+
+
+API_RULES = [
+    {
+        "id": "API-001",
+        "pattern": r"(?i)@(app|router|api)\.(get|post|put|delete|patch)\s*\([^)]*[\"']/api/[^\"']*\{?(user_id|account_id|org_id|id)\}?[^\"']*[\"']\)\s*\n\s*(?:async\s+)?def\s+[a-zA-Z0-9_]+\s*\([^)]*\):\s*\n(?!\s*.*(?:verify_owner|check_permission|current_user|authorize))",
+        "title": "Missing object-level authorization check on ID-parameterized endpoint (API1: BOLA / IDOR)",
+        "description": "Endpoint operates directly on user-provided resource identifier without verifying caller ownership",
+        "severity": "high",
+        "cwe": "CWE-639",
+        "confidence": 0.8,
+    },
+    {
+        "id": "API-002",
+        "pattern": r"(?i)\b(Model\.objects\.create\s*\(\s*\*\*req\.(body|data|POST)|db\.session\.add\s*\(\s*User\s*\(\s*\*\*data\)|update\s*\(\s*\*\*request\.json)\b",
+        "title": "Mass assignment vulnerability on user input model mapping (API6: Mass Assignment)",
+        "description": "Directly unpacking untrusted request payload into ORM model allows attackers to overwrite administrative fields (e.g. is_admin, role)",
+        "severity": "high",
+        "cwe": "CWE-915",
+        "confidence": 0.9,
+    },
+    {
+        "id": "API-003",
+        "pattern": r"(?i)\b(redirect|HttpResponseRedirect)\s*\(\s*(request\.(GET|POST|args|query|params)\[?['\"]?(url|next|redirect|target|return_to)['\"]?\]?)\b",
+        "title": "Unvalidated open redirect via request query parameter (API8: SSRF / Open Redirect)",
+        "description": "Directly passing user-supplied URL to redirect without whitelist validation enables phishing and auth token leakage",
+        "severity": "medium",
+        "cwe": "CWE-601",
+        "confidence": 0.85,
+    },
+    {
+        "id": "API-004",
+        "pattern": r'(?i)@(app|router|api)\.(get|post)\s*\([^)]*["\']/(debug|metrics|actuator|healthcheck/full|_profiler|env|configdump)["\']\)',
+        "title": "Potentially exposed internal debug or diagnostic API endpoint",
+        "description": "Sensitive diagnostic endpoints exposed without strict network ACL or authentication guard",
+        "severity": "medium",
+        "cwe": "CWE-200",
+        "confidence": 0.85,
+    },
+    {
+        "id": "API-005",
+        "pattern": r'(?i)(jwt\.decode\s*\([^)]*options\s*=\s*\{.*verify_signature.*False.*\}|jwt\.decode\s*\([^)]*algorithms\s*=\s*\[\s*["\']none["\']\s*\]|verify\s*=\s*False)',
+        "title": "JWT signature verification explicitly disabled or 'none' algorithm accepted",
+        "description": "Accepting unsigned tokens or disabling cryptographic validation bypasses authentication completely",
+        "severity": "critical",
+        "cwe": "CWE-347",
+        "confidence": 0.95,
+    },
+]
+
+
+class ApiSecurityEngine:
+    """100% custom, in-house developed REST API & Microservice Security Engine."""
+
+    name = "api_security"
+    version = "1.0.0"
+
+    def __init__(self):
+        self._compiled_rules = []
+        for r in API_RULES:
+            self._compiled_rules.append({
+                **r,
+                "regex": re.compile(r["pattern"])
+            })
+
+    async def check_availability(self) -> bool:
+        return True
+
+    def resource_limits(self) -> ResourceLimits:
+        return ResourceLimits(max_cpu_seconds=30, max_memory_mb=256)
+
+    async def run(self, ir: OrionIR, config: EngineConfig) -> EngineResult:
+        path = ir.metadata.get("path", "unknown")
+        try:
+            content = ir.content.decode("utf-8", errors="replace")
+        except Exception:
+            return EngineResult(engine=self.name, findings=[], ok=True)
+
+        lines = content.splitlines()
+        findings = []
+
+        for rule in self._compiled_rules:
+            for match in rule["regex"].finditer(content):
+                line_no = content[:match.start()].count('\n') + 1
+                start_line = max(0, line_no - 2)
+                end_line = min(len(lines), line_no + 2)
+                snippet = '\n'.join(lines[start_line:end_line])
+
+                findings.append(Finding(
+                    engine=self.name,
+                    severity=rule["severity"],
+                    title=f"{rule['id']}: {rule['title']}",
+                    description=rule["description"],
+                    location=f"{path}:{line_no}",
+                    metadata={
+                        "rule_id": rule["id"],
+                        "cwe": rule["cwe"],
+                        "confidence": rule["confidence"],
+                        "snippet": snippet,
+                        "file": path,
+                        "line": line_no,
+                    }
+                ))
+
+        return EngineResult(
+            engine=self.name,
+            findings=findings,
+            ok=True,
+            metrics={"findings_count": len(findings)}
+        )
+
+
+Engine = ApiSecurityEngine