@orionscanner/cli 0.1.0

package/src/orion/engine/authorization/engine.py

@@ -0,0 +1,337 @@
+"""Authorization engine for detecting missing authentication on routes."""
+import ast
+import re
+from typing import Dict, List, Set, Optional, Any, Tuple
+from dataclasses import dataclass, field
+from orion.engine.config import EngineConfig, ResourceLimits
+from orion.engine.ir import OrionIR
+from orion.engine.results import EngineResult, Finding
+
+
+AUTH_DECORATORS = {
+    "flask": [
+        "login_required", "permission_required", "roles_required",
+        "auth_required", "token_required", "jwt_required",
+        "fresh_login_required", "current_user",
+    ],
+    "fastapi": [
+        "Depends", "Security", "get_current_user", "get_current_active_user",
+        "oauth2_scheme", "http_bearer", "api_key_header",
+    ],
+    "django": [
+        "login_required", "permission_required", "user_passes_test",
+        "staff_member_required", "superuser_required",
+        "LoginRequiredMixin", "PermissionRequiredMixin", "UserPassesTestMixin",
+    ],
+    "bottle": ["auth_required", "require_auth"],
+    "tornado": ["authenticated", "auth_required"],
+    "starlette": ["Depends", "Security"],
+    "generic": ["requires_auth", "requires_login", "requires_permission",
+                "check_auth", "verify_token", "validate_user"],
+}
+
+ROUTE_DECORATORS = {
+    "flask": ["route", "get", "post", "put", "delete", "patch", "head", "options"],
+    "fastapi": ["get", "post", "put", "delete", "patch", "head", "options", "api_route"],
+    "django": ["path", "re_path", "url"],
+    "bottle": ["route", "get", "post", "put", "delete", "patch"],
+    "tornado": ["route"],
+    "starlette": ["route", "get", "post", "put", "delete", "patch"],
+    "aiohttp": ["get", "post", "put", "delete", "patch"],
+}
+
+EXEMPT_PATTERNS = [
+    r"/health", r"/ready", r"/live", r"/metrics", r"/status",
+    r"/ping", r"/version", r"/favicon", r"/robots\.txt",
+    r"/static/", r"/media/", r"/assets/",
+    r"\.well-known/", r"/docs", r"/redoc", r"/openapi",
+]
+
+
+@dataclass
+class RouteInfo:
+    path: str
+    methods: List[str]
+    decorators: List[str]
+    lineno: int
+    filename: str
+    has_auth: bool = False
+    auth_decorators: List[str] = field(default_factory=list)
+    is_exempt: bool = False
+
+
+class AuthVisitor(ast.NodeVisitor):
+    def __init__(self, filename: str, source_lines: List[str]):
+        self.filename = filename
+        self.source_lines = source_lines
+        self.findings: List[Finding] = []
+        self.routes: List[RouteInfo] = []
+        self.imports: Dict[str, str] = {}
+        self.current_class: Optional[str] = None
+        self.blueprint_routes: List[RouteInfo] = []
+
+    def get_snippet(self, node: ast.AST, context: int = 3) -> str:
+        start = max(0, node.lineno - 1 - context)
+        end = min(len(self.source_lines),
+                  getattr(node, 'end_lineno', node.lineno) + context if hasattr(node, 'end_lineno') else node.lineno + context)
+        return "\n".join(self.source_lines[start:end])
+
+    def visit_Import(self, node: ast.Import):
+        for alias in node.names:
+            self.imports[alias.asname or alias.name] = alias.name
+        self.generic_visit(node)
+
+    def visit_ImportFrom(self, node: ast.ImportFrom):
+        if node.module:
+            for alias in node.names:
+                self.imports[alias.asname or alias.name] = f"{node.module}.{alias.name}"
+        self.generic_visit(node)
+
+    def visit_ClassDef(self, node: ast.ClassDef):
+        old_class = self.current_class
+        self.current_class = node.name
+        self.generic_visit(node)
+        self.current_class = old_class
+
+    def visit_FunctionDef(self, node: ast.FunctionDef):
+        self._check_function(node)
+        self.generic_visit(node)
+
+    def visit_AsyncFunctionDef(self, node: ast.AsyncFunctionDef):
+        self._check_function(node)
+        self.generic_visit(node)
+
+    def _check_function(self, node: ast.FunctionDef):
+        route_info = self._extract_route(node)
+        if route_info:
+            self._analyze_route(route_info)
+            if not route_info.is_exempt:
+                self.routes.append(route_info)
+
+    def _extract_route(self, node: ast.FunctionDef) -> Optional[RouteInfo]:
+        decorators = []
+        for dec in node.decorator_list:
+            dec_str = self._decorator_to_string(dec)
+            decorators.append(dec_str)
+
+        for dec in decorators:
+            if self._is_route_decorator(dec):
+                path, methods = self._extract_path_and_methods(dec, node)
+                if path:
+                    return RouteInfo(
+                        path=path,
+                        methods=methods,
+                        decorators=decorators,
+                        lineno=node.lineno,
+                        filename=self.filename,
+                    )
+        return None
+
+    def _decorator_to_string(self, node: ast.AST) -> str:
+        if isinstance(node, ast.Name):
+            return node.id
+        elif isinstance(node, ast.Attribute):
+            return self._decorator_to_string(node.value) + "." + node.attr
+        elif isinstance(node, ast.Call):
+            return self._decorator_to_string(node.func)
+        return ""
+
+    def _is_route_decorator(self, dec: str) -> bool:
+        dec_lower = dec.lower()
+        for framework, patterns in ROUTE_DECORATORS.items():
+            for pattern in patterns:
+                if pattern in dec_lower:
+                    return True
+        return False
+
+    def _extract_path_and_methods(self, dec: str, node: ast.FunctionDef) -> Tuple[str, List[str]]:
+        path = ""
+        methods = ["GET"]
+        
+        dec_lower = dec.lower()
+        
+        if any(m in dec_lower for m in [".get", "@get", "@app.get", "@router.get"]):
+            methods = ["GET"]
+        elif any(m in dec_lower for m in [".post", "@post", "@app.post", "@router.post"]):
+            methods = ["POST"]
+        elif any(m in dec_lower for m in [".put", "@put", "@app.put", "@router.put"]):
+            methods = ["PUT"]
+        elif any(m in dec_lower for m in [".delete", "@delete", "@app.delete", "@router.delete"]):
+            methods = ["DELETE"]
+        elif any(m in dec_lower for m in [".patch", "@patch", "@app.patch", "@router.patch"]):
+            methods = ["PATCH"]
+        
+        if "(" in dec:
+            try:
+                call_part = dec[dec.index("(")+1:dec.rindex(")")]
+                parts = [p.strip().strip('"\'') for p in call_part.split(",")]
+                if parts:
+                    path = parts[0]
+                    if len(parts) > 1 and "method" in parts[1].lower():
+                        pass
+            except:
+                pass
+        
+        if not path:
+            path = f"/{node.name}"
+        
+        return path, methods
+
+    def _analyze_route(self, route: RouteInfo):
+        route.has_auth = False
+        route.auth_decorators = []
+        
+        for dec in route.decorators:
+            if self._is_auth_decorator(dec):
+                route.has_auth = True
+                route.auth_decorators.append(dec)
+        
+        if not route.has_auth:
+            if self.current_class:
+                for base in getattr(self, 'class_bases', []):
+                    if self._is_auth_mixin(base):
+                        route.has_auth = True
+                        route.auth_decorators.append(f"Mixin:{base}")
+        
+        route.is_exempt = self._is_exempt_path(route.path)
+
+    def _is_auth_decorator(self, dec: str) -> bool:
+        dec_lower = dec.lower()
+        for framework, patterns in AUTH_DECORATORS.items():
+            for pattern in patterns:
+                if pattern.lower() in dec_lower:
+                    return True
+        return False
+
+    def _is_auth_mixin(self, base: str) -> bool:
+        base_lower = base.lower()
+        auth_mixins = ["loginrequiredmixin", "permissionrequiredmixin", "userpassestestmixin",
+                       "staffmemberrequiredmixin", "superuserrequiredmixin",
+                       "accesscontrolmixin", "authorizationmixin"]
+        return any(m in base_lower for m in auth_mixins)
+
+    def _is_exempt_path(self, path: str) -> bool:
+        for pattern in EXEMPT_PATTERNS:
+            if re.search(pattern, path, re.IGNORECASE):
+                return True
+        return False
+
+    def visit_Call(self, node: ast.Call):
+        if isinstance(node.func, ast.Attribute):
+            if node.func.attr in ("add_url_rule", "route"):
+                if node.args:
+                    path = self._get_string_value(node.args[0])
+                    if path:
+                        methods = ["GET"]
+                        if len(node.args) > 1:
+                            methods_arg = node.args[1]
+                            if isinstance(methods_arg, ast.List):
+                                methods = [self._get_string_value(e) or "GET" for e in methods_arg.elts]
+                        
+                        route = RouteInfo(
+                            path=path,
+                            methods=methods,
+                            decorators=[f"add_url_rule({path})"],
+                            lineno=node.lineno,
+                            filename=self.filename,
+                        )
+                        self._analyze_route(route)
+                        if not route.is_exempt:
+                            self.routes.append(route)
+        self.generic_visit(node)
+
+    def _get_string_value(self, node: ast.AST) -> Optional[str]:
+        if isinstance(node, ast.Constant) and isinstance(node.value, str):
+            return node.value
+        if isinstance(node, ast.Str):
+            return node.s
+        return None
+
+
+class Engine:
+    name = "authorization"
+    version = "1.0.0"
+
+    async def check_availability(self) -> bool:
+        return True
+
+    def resource_limits(self) -> ResourceLimits:
+        return ResourceLimits(max_cpu_seconds=60, max_memory_mb=512, max_files=50000)
+
+    async def run(self, ctx, config: EngineConfig) -> EngineResult:
+        # Handle both single IR and list of IRs
+        if not isinstance(ctx, list):
+            ctx = [ctx]
+        all_findings = []
+        errors = []
+        files_processed = 0
+        total_routes = 0
+        unprotected_routes = 0
+
+        exclude_patterns = config.toggles.get("exclude", []) if config.toggles else []
+
+        for ir in ctx:
+            try:
+                if not ir.metadata.get("language") == "python":
+                    continue
+
+                rel_path = ir.metadata.get("path", "unknown.py")
+                if any(pattern in rel_path for pattern in exclude_patterns):
+                    continue
+
+                content = ir.content.decode("utf-8", errors="replace")
+                source_lines = content.splitlines()
+                tree = ast.parse(content, filename=rel_path)
+
+                visitor = AuthVisitor(rel_path, source_lines)
+                visitor.visit(tree)
+
+                for route in visitor.routes:
+                    total_routes += 1
+                    if not route.has_auth:
+                        unprotected_routes += 1
+                        severity = "high" if any(m in route.methods for m in ["POST", "PUT", "DELETE", "PATCH"]) else "medium"
+                        
+                        all_findings.append(Finding(
+                            engine="authorization",
+                            severity=severity,
+                            title="Missing authentication on route",
+                            description=f"Route '{route.path}' [{', '.join(route.methods)}] has no authentication decorator. "
+                                       f"Consider adding @login_required, @auth_required, or Depends(get_current_user).",
+                            location=f"{route.filename}:{route.lineno}",
+                            metadata={
+                                "snippet": self.get_snippet_by_line(source_lines, route.lineno),
+                                "cwe": "CWE-306",
+                                "confidence": 0.85,
+                                "route_path": route.path,
+                                "route_methods": route.methods,
+                                "decorators": route.decorators,
+                                "is_exempt": route.is_exempt,
+                            }
+                        ))
+
+                files_processed += 1
+
+            except SyntaxError as e:
+                errors.append(f"Syntax error in {ir.metadata.get('path', 'unknown')}: {e}")
+            except Exception as e:
+                errors.append(f"Error processing {ir.metadata.get('path', 'unknown')}: {e}")
+
+        return EngineResult(
+            engine=self.name,
+            findings=all_findings,
+            errors=errors,
+            metrics={
+                "files_processed": files_processed,
+                "total_routes": total_routes,
+                "unprotected_routes": unprotected_routes,
+                "protected_routes": total_routes - unprotected_routes,
+                "findings_count": len(all_findings),
+            },
+            ok=len(errors) == 0
+        )
+
+    def get_snippet_by_line(self, lines: List[str], line: int, context: int = 3) -> str:
+        start = max(0, line - 1 - context)
+        end = min(len(lines), line + context)
+        return "\n".join(lines[start:end])

package/src/orion/engine/callgraph/engine.py

@@ -0,0 +1,236 @@
+"""Function call graph builder engine."""
+import ast
+import asyncio
+from collections import defaultdict
+from typing import Dict, List, Set, Optional, Any
+from orion.engine.config import EngineConfig, ResourceLimits
+from orion.engine.ir import OrionIR
+from orion.engine.results import EngineResult, Finding
+
+
+class CallGraphVisitor(ast.NodeVisitor):
+    def __init__(self, filename: str, source_lines: List[str]):
+        self.filename = filename
+        self.source_lines = source_lines
+        self.calls: Dict[str, Set[str]] = defaultdict(set)
+        self.function_defs: Set[str] = set()
+        self.class_defs: Set[str] = set()
+        self.imports: Dict[str, str] = {}
+        self.current_class: Optional[str] = None
+        self.current_function: Optional[str] = None
+        self.call_depth = 0
+        self.max_call_depth = 100
+        self.undefined_calls: List[tuple] = []
+        self.recursive_calls: List[tuple] = []
+        self.deep_chains: List[tuple] = []
+
+    def get_qualified_name(self, name: str) -> str:
+        parts = []
+        if self.current_class:
+            parts.append(self.current_class)
+        if self.current_function:
+            parts.append(self.current_function)
+        parts.append(name)
+        return ".".join(parts)
+
+    def visit_Import(self, node: ast.Import):
+        for alias in node.names:
+            self.imports[alias.asname or alias.name] = alias.name
+        self.generic_visit(node)
+
+    def visit_ImportFrom(self, node: ast.ImportFrom):
+        if node.module:
+            for alias in node.names:
+                self.imports[alias.asname or alias.name] = f"{node.module}.{alias.name}"
+        self.generic_visit(node)
+
+    def visit_ClassDef(self, node: ast.ClassDef):
+        old_class = self.current_class
+        self.current_class = node.name
+        self.class_defs.add(self.get_qualified_name(node.name))
+        self.generic_visit(node)
+        self.current_class = old_class
+
+    def visit_FunctionDef(self, node: ast.FunctionDef):
+        old_function = self.current_function
+        self.current_function = node.name
+        qual_name = self.get_qualified_name(node.name)
+        self.function_defs.add(qual_name)
+        self.generic_visit(node)
+        self.current_function = old_function
+
+    def visit_AsyncFunctionDef(self, node: ast.AsyncFunctionDef):
+        self.visit_FunctionDef(node)
+
+    def visit_Call(self, node: ast.Call):
+        if self.call_depth > self.max_call_depth:
+            return
+        self.call_depth += 1
+        try:
+            caller = self.current_function or "<module>"
+            if self.current_class:
+                caller = f"{self.current_class}.{caller}"
+            
+            callee = self._resolve_callee(node.func)
+            if callee:
+                self.calls[caller].add(callee)
+                
+                if callee == caller:
+                    self.recursive_calls.append((caller, node.lineno))
+                
+                if callee not in self.function_defs and not self._is_builtin(callee):
+                    self.undefined_calls.append((caller, callee, node.lineno))
+            
+            self.generic_visit(node)
+        finally:
+            self.call_depth -= 1
+
+    def _resolve_callee(self, node: ast.AST) -> Optional[str]:
+        if isinstance(node, ast.Name):
+            return node.id
+        elif isinstance(node, ast.Attribute):
+            parts = []
+            current = node
+            while isinstance(current, ast.Attribute):
+                parts.append(current.attr)
+                current = current.value
+            if isinstance(current, ast.Name):
+                parts.append(current.id)
+                return ".".join(reversed(parts))
+            elif isinstance(current, ast.Call):
+                return "<dynamic>"
+            return ".".join(reversed(parts))
+        elif isinstance(node, ast.Call):
+            return "<dynamic>"
+        elif isinstance(node, ast.Subscript):
+            return "<subscript>"
+        elif isinstance(node, ast.Lambda):
+            return "<lambda>"
+        return None
+
+    def _is_builtin(self, name: str) -> bool:
+        builtins = {
+            "print", "len", "str", "int", "float", "list", "dict", "set", "tuple",
+            "range", "enumerate", "zip", "map", "filter", "sorted", "reversed",
+            "sum", "min", "max", "abs", "round", "pow", "divmod", "isinstance",
+            "issubclass", "hasattr", "getattr", "setattr", "delattr", "callable",
+            "type", "object", "super", "property", "staticmethod", "classmethod",
+            "open", "input", "eval", "exec", "compile", "hash", "id", "hex", "oct",
+            "bin", "chr", "ord", "ascii", "repr", "format", "vars", "locals", "globals",
+            "dir", "help", "breakpoint", "__import__", "iter", "next", "slice",
+            "property", "complex", "bool", "bytes", "bytearray", "memoryview",
+            "frozenset", "classmethod", "staticmethod", "property",
+            "Exception", "BaseException", "ValueError", "TypeError", "KeyError",
+            "IndexError", "AttributeError", "ImportError", "ModuleNotFoundError",
+            "OSError", "IOError", "RuntimeError", "StopIteration", "GeneratorExit",
+            "KeyboardInterrupt", "SystemExit", "NameError", "SyntaxError",
+        }
+        return name in builtins or name.startswith("__") and name.endswith("__")
+
+
+class Engine:
+    name = "callgraph"
+    version = "1.0.0"
+
+    async def check_availability(self) -> bool:
+        return True
+
+    def resource_limits(self) -> ResourceLimits:
+        return ResourceLimits(max_cpu_seconds=60, max_memory_mb=512, max_files=50000)
+
+    async def run(self, ctx, config: EngineConfig) -> EngineResult:
+        # Handle both single IR and list of IRs
+        if not isinstance(ctx, list):
+            ctx = [ctx]
+        all_calls: Dict[str, Set[str]] = defaultdict(set)
+        all_functions: Set[str] = set()
+        all_classes: Set[str] = set()
+        all_undefined: List[tuple] = []
+        all_recursive: List[tuple] = []
+        errors = []
+        files_processed = 0
+
+        exclude_patterns = config.toggles.get("exclude", []) if config.toggles else []
+
+        for ir in ctx:
+            try:
+                if not ir.metadata.get("language") == "python":
+                    continue
+
+                rel_path = ir.metadata.get("path", "unknown.py")
+                if any(pattern in rel_path for pattern in exclude_patterns):
+                    continue
+
+                content = ir.content.decode("utf-8", errors="replace")
+                source_lines = content.splitlines()
+                tree = ast.parse(content, filename=rel_path)
+
+                visitor = CallGraphVisitor(rel_path, source_lines)
+                visitor.visit(tree)
+
+                for caller, callees in visitor.calls.items():
+                    all_calls[caller].update(callees)
+                all_functions.update(visitor.function_defs)
+                all_classes.update(visitor.class_defs)
+                all_undefined.extend(visitor.undefined_calls)
+                all_recursive.extend(visitor.recursive_calls)
+                files_processed += 1
+
+            except SyntaxError as e:
+                errors.append(f"Syntax error in {ir.metadata.get('path', 'unknown')}: {e}")
+            except Exception as e:
+                errors.append(f"Error processing {ir.metadata.get('path', 'unknown')}: {e}")
+
+        deep_chains = self._find_deep_chains(all_calls)
+
+        call_graph = {k: list(v) for k, v in all_calls.items()}
+
+        metrics = {
+            "files_processed": files_processed,
+            "functions_defined": len(all_functions),
+            "classes_defined": len(all_classes),
+            "total_edges": sum(len(v) for v in all_calls.values()),
+            "unique_callers": len(all_calls),
+            "undefined_calls_count": len(all_undefined),
+            "recursive_calls_count": len(all_recursive),
+            "deep_chains_count": len(deep_chains),
+            "call_graph": call_graph,
+            "undefined_calls": all_undefined[:50],
+            "recursive_calls": all_recursive[:50],
+            "deep_chains": deep_chains[:20],
+        }
+
+        return EngineResult(
+            engine=self.name,
+            findings=[],
+            errors=errors,
+            metrics=metrics,
+            ok=len(errors) == 0
+        )
+
+    def _find_deep_chains(self, calls: Dict[str, Set[str]], max_depth: int = 10) -> List[tuple]:
+        chains = []
+        visited = set()
+
+        def dfs(node: str, path: List[str], depth: int):
+            if depth > max_depth:
+                chains.append((path[0], path[-1], depth, path.copy()))
+                return
+            if node in visited:
+                return
+            if node in path:
+                return
+            
+            visited.add(node)
+            path.append(node)
+            
+            for callee in calls.get(node, []):
+                dfs(callee, path, depth + 1)
+            
+            path.pop()
+            visited.discard(node)
+
+        for caller in calls:
+            dfs(caller, [], 0)
+
+        return chains