@orionscanner/cli 0.1.0

package/src/orion/engine/wiring_trace/engine.py

@@ -0,0 +1,200 @@
+"""Config wiring trace engine - trace config from source to usage."""
+import re
+import os
+import json
+import ast
+from pathlib import Path
+from orion.engine.config import EngineConfig
+from orion.engine.ir import OrionIR
+from orion.engine.results import EngineResult, Finding
+
+
+class Engine:
+    name = "wiring_trace"
+    version = "1.0.0"
+
+    CONFIG_FILES = {
+        ".env", "config.yaml", "config.yml", "settings.py", "settings.json",
+        "appsettings.json", "application.properties", "application.yml",
+        "config.toml", "config.ini", "secrets.yaml", "secrets.yml"
+    }
+
+    ENV_ACCESS_PATTERNS = [
+        (r"os\.getenv\s*\(\s*['\"]([^'\"]+)['\"]", "os.getenv"),
+        (r"os\.environ\.get\s*\(\s*['\"]([^'\"]+)['\"]", "os.environ.get"),
+        (r"os\.environ\s*\[\s*['\"]([^'\"]+)['\"]\s*\]", "os.environ[]"),
+        (r"config\s*\(\s*['\"]([^'\"]+)['\"]", "config()"),
+        (r"settings\.\w+", "settings."),
+        (r"environ\s*\[\s*['\"]([^'\"]+)['\"]", "environ[]"),
+        (r"getenv\s*\(\s*['\"]([^'\"]+)['\"]", "getenv()"),
+    ]
+
+    SECRET_KEY_PATTERNS = [
+        r"(?i)(password|secret|key|token|api.?key|access.?key|private.?key)",
+        r"(?i)(db.?password|database.?password|db.?secret)",
+        r"(?i)(jwt.?secret|session.?secret|cookie.?secret)",
+        r"(?i)(aws.?secret|aws.?access.?key)",
+        r"(?i)(github.?token|gitlab.?token|slack.?token)",
+    ]
+
+    async def check_availability(self) -> bool:
+        return True
+
+    def resource_limits(self):
+        from orion.engine.config import ResourceLimits
+        return ResourceLimits(max_cpu_seconds=60, max_memory_mb=256)
+
+    async def run(self, ir: OrionIR, config: EngineConfig) -> EngineResult:
+        try:
+            text = ir.content.decode("utf-8", errors="replace")
+        except Exception:
+            text = str(ir.content)
+
+        path = ir.metadata.get("path", "unknown")
+        filename = Path(path).name
+        findings = []
+
+        if filename in self.CONFIG_FILES:
+            config_keys = self._parse_config_file(text, filename)
+            if config_keys:
+                findings.append(Finding(
+                    engine=self.name,
+                    severity="info",
+                    title=f"Config source detected: {filename}",
+                    description=f"Found {len(config_keys)} configuration keys in {filename}",
+                    location=path,
+                    metadata={
+                        "confidence": 1.0,
+                        "config_keys": list(config_keys.keys()),
+                        "source_type": filename,
+                    },
+                ))
+
+        env_keys = self._find_env_access(text)
+        for key, pattern in env_keys:
+            line_no = text[:text.find(key)].count("\n") + 1 if key in text else 1
+            findings.append(Finding(
+                engine=self.name,
+                severity="info",
+                title=f"Environment variable access: {key}",
+                description=f"Code accesses environment variable '{key}' via {pattern}",
+                location=f"{path}:{line_no}",
+                metadata={
+                    "confidence": 0.9,
+                    "config_key": key,
+                    "access_method": pattern,
+                    "source": "code",
+                },
+            ))
+
+        if filename.endswith(".py"):
+            hardcoded = self._find_hardcoded_secrets(text, path)
+            findings.extend(hardcoded)
+
+        return EngineResult(engine=self.name, findings=findings, ok=True)
+
+    def _parse_config_file(self, text: str, filename: str) -> dict:
+        keys = {}
+        if filename == ".env":
+            for line in text.splitlines():
+                line = line.strip()
+                if line and not line.startswith("#") and "=" in line:
+                    key, val = line.split("=", 1)
+                    keys[key.strip()] = val.strip().strip('"\'')
+        elif filename.endswith(".json"):
+            try:
+                data = json.loads(text)
+                keys = self._flatten_dict(data)
+            except Exception:
+                pass
+        elif filename.endswith((".yaml", ".yml")):
+            keys = self._parse_yaml_simple(text)
+        elif filename.endswith(".toml"):
+            try:
+                import tomllib
+                data = tomllib.loads(text)
+                keys = self._flatten_dict(data)
+            except Exception:
+                pass
+        elif filename.endswith(".properties"):
+            for line in text.splitlines():
+                line = line.strip()
+                if line and not line.startswith("#") and "=" in line:
+                    key, val = line.split("=", 1)
+                    keys[key.strip()] = val.strip()
+        elif filename.endswith(".py"):
+            try:
+                tree = ast.parse(text)
+                for node in ast.walk(tree):
+                    if isinstance(node, ast.Assign):
+                        for target in node.targets:
+                            if isinstance(target, ast.Name) and target.id.isupper():
+                                if isinstance(node.value, ast.Constant):
+                                    keys[target.id] = str(node.value.value)
+            except Exception:
+                pass
+        return keys
+
+    def _parse_yaml_simple(self, text: str) -> dict:
+        keys = {}
+        indent_stack = []
+        for line in text.splitlines():
+            if not line.strip() or line.strip().startswith("#"):
+                continue
+            indent = len(line) - len(line.lstrip())
+            while indent_stack and indent_stack[-1][0] >= indent:
+                indent_stack.pop()
+            match = re.match(r"^(\s*)([^:]+):\s*(.*)$", line)
+            if match:
+                key = match.group(2).strip()
+                value = match.group(3).strip().strip('"\'')
+                prefix = ".".join([x[1] for x in indent_stack]) if indent_stack else ""
+                full_key = f"{prefix}.{key}" if prefix else key
+                keys[full_key] = value
+                indent_stack.append((indent, key))
+        return keys
+
+    def _flatten_dict(self, d: dict, prefix: str = "") -> dict:
+        result = {}
+        for k, v in d.items():
+            new_key = f"{prefix}.{k}" if prefix else k
+            if isinstance(v, dict):
+                result.update(self._flatten_dict(v, new_key))
+            else:
+                result[new_key] = v
+        return result
+
+    def _find_env_access(self, text: str) -> list:
+        results = []
+        for pattern, method in self.ENV_ACCESS_PATTERNS:
+            for match in re.finditer(pattern, text):
+                key = match.group(1)
+                results.append((key, method))
+        return results
+
+    def _find_hardcoded_secrets(self, text: str, path: str):
+        findings = []
+        lines = text.splitlines()
+
+        for i, line in enumerate(lines):
+            for pattern in self.SECRET_KEY_PATTERNS:
+                match = re.search(pattern, line)
+                if match:
+                    if re.search(r"=\s*['\"][^'\"]{8,}['\"]", line):
+                        if not re.search(r"os\.(getenv|environ)|config\(|settings\.", line):
+                            findings.append(Finding(
+                                engine=self.name,
+                                severity="high",
+                                title=f"Hardcoded secret value detected",
+                                description=f"Possible hardcoded secret matching pattern '{match.group(1)}' without config reference",
+                                location=f"{path}:{i+1}",
+                                metadata={
+                                    "confidence": 0.8,
+                                    "snippet": line.strip()[:200],
+                                    "pattern": match.group(1),
+                                    "issue": "hardcoded_secret",
+                                    "cwe": "CWE-798",
+                                    "cvss": 7.5,
+                                },
+                            ))
+        return findings

package/src/orion_engine.egg-info/PKG-INFO

@@ -0,0 +1,7 @@
+Metadata-Version: 2.4
+Name: orion-engine
+Version: 0.1.0
+Summary: Orion Security Suite - Proprietary In-House Code Intelligence & Security Audit Platform
+Requires-Python: >=3.10
+License-File: LICENSE
+Dynamic: license-file

package/src/orion_engine.egg-info/SOURCES.txt

@@ -0,0 +1,65 @@
+LICENSE
+README.md
+pyproject.toml
+src/orion/__init__.py
+src/orion/engine/__init__.py
+src/orion/engine/config.py
+src/orion/engine/core.py
+src/orion/engine/dispatcher.py
+src/orion/engine/ir.py
+src/orion/engine/languages.py
+src/orion/engine/registry.py
+src/orion/engine/results.py
+src/orion/engine/runner.py
+src/orion/engine/api_security/engine.py
+src/orion/engine/architecture/engine.py
+src/orion/engine/authorization/engine.py
+src/orion/engine/callgraph/engine.py
+src/orion/engine/cfg/engine.py
+src/orion/engine/chaos/engine.py
+src/orion/engine/chaos_config/engine.py
+src/orion/engine/complexity/engine.py
+src/orion/engine/compliance/engine.py
+src/orion/engine/config_engine/engine.py
+src/orion/engine/config_validation/engine.py
+src/orion/engine/container/engine.py
+src/orion/engine/contract_probe/engine.py
+src/orion/engine/crypto_guard/engine.py
+src/orion/engine/data_residency/engine.py
+src/orion/engine/dataflow/engine.py
+src/orion/engine/dead_import/engine.py
+src/orion/engine/deps/engine.py
+src/orion/engine/duplication/engine.py
+src/orion/engine/error_handling/engine.py
+src/orion/engine/fp_learn/engine.py
+src/orion/engine/hunter/engine.py
+src/orion/engine/iac_security/engine.py
+src/orion/engine/license/engine.py
+src/orion/engine/lint/engine.py
+src/orion/engine/llm_security/engine.py
+src/orion/engine/logging_c/engine.py
+src/orion/engine/noise/engine.py
+src/orion/engine/orphan/engine.py
+src/orion/engine/perf_guard/engine.py
+src/orion/engine/prompt_security/engine.py
+src/orion/engine/prompt_security/detectors/__init__.py
+src/orion/engine/provenance/engine.py
+src/orion/engine/regression/engine.py
+src/orion/engine/sandbox_escape/engine.py
+src/orion/engine/sast/engine.py
+src/orion/engine/sast/patterns/__init__.py
+src/orion/engine/secrets/engine.py
+src/orion/engine/secrets/patterns/__init__.py
+src/orion/engine/sensitive_data/engine.py
+src/orion/engine/state/engine.py
+src/orion/engine/supply_chain_sbom/engine.py
+src/orion/engine/symbol/engine.py
+src/orion/engine/taint/engine.py
+src/orion/engine/test_coverage/engine.py
+src/orion/engine/threat_model/engine.py
+src/orion/engine/wiring_trace/engine.py
+src/orion_engine.egg-info/PKG-INFO
+src/orion_engine.egg-info/SOURCES.txt
+src/orion_engine.egg-info/dependency_links.txt
+src/orion_engine.egg-info/entry_points.txt
+src/orion_engine.egg-info/top_level.txt

package/src/orion_engine.egg-info/dependency_links.txt

@@ -0,0 +1 @@
+

package/src/orion_engine.egg-info/entry_points.txt

@@ -0,0 +1,2 @@
+[console_scripts]
+orion = orion.engine.runner:main

package/src/orion_engine.egg-info/top_level.txt

@@ -0,0 +1 @@
+orion