@orionscanner/cli 0.1.0

package/src/orion/engine/chaos/engine.py

@@ -0,0 +1,268 @@
+"""Chaos injection analysis engine - AST mutation analysis for resilience patterns."""
+import ast
+from orion.engine.config import EngineConfig
+from orion.engine.ir import OrionIR
+from orion.engine.results import EngineResult, Finding
+
+
+class Engine:
+    name = "chaos"
+    version = "1.0.0"
+
+    EXTERNAL_CALL_PATTERNS = {
+        "requests.get", "requests.post", "requests.put", "requests.delete", "requests.request",
+        "httpx.get", "httpx.post", "httpx.put", "httpx.delete", "httpx.request",
+        "aiohttp.ClientSession.get", "aiohttp.ClientSession.post",
+        "urllib.request.urlopen", "urllib3.request",
+        "boto3.client", "boto3.resource",
+        "redis.Redis", "redis.StrictRedis",
+        "psycopg2.connect", "mysql.connector.connect", "pymongo.MongoClient",
+        "sqlalchemy.create_engine", "asyncpg.connect",
+        "kafka.KafkaProducer", "kafka.KafkaConsumer",
+        "pika.BlockingConnection", "pika.SelectConnection",
+    }
+
+    RETRY_PATTERNS = {"retry", "backoff", "tenacity", "retrying"}
+    CIRCUIT_BREAKER_PATTERNS = {"circuitbreaker", "circuit_breaker", "pybreaker", "hystrix"}
+    TIMEOUT_PATTERNS = {"timeout", "connect_timeout", "read_timeout", "request_timeout"}
+
+    async def check_availability(self) -> bool:
+        return True
+
+    def resource_limits(self):
+        from orion.engine.config import ResourceLimits
+        return ResourceLimits(max_cpu_seconds=120, max_memory_mb=512)
+
+    async def run(self, ir: OrionIR, config: EngineConfig) -> EngineResult:
+        try:
+            text = ir.content.decode("utf-8", errors="replace")
+        except Exception:
+            return EngineResult(engine=self.name, findings=[], ok=True)
+
+        path = ir.metadata.get("path", "unknown")
+        is_test = self._is_test_file(path)
+
+        try:
+            tree = ast.parse(text, filename=path)
+        except SyntaxError:
+            return EngineResult(engine=self.name, findings=[], ok=True)
+
+        findings = []
+        visitor = ChaosVisitor(path, is_test, text.splitlines())
+        visitor.visit(tree)
+        findings.extend(visitor.findings)
+
+        return EngineResult(engine=self.name, findings=findings, ok=True)
+
+    def _is_test_file(self, path: str) -> bool:
+        return any(p in path for p in ["test_", "_test.py", "/tests/", "/test/", "conftest.py"])
+
+
+class ChaosVisitor(ast.NodeVisitor):
+    EXTERNAL_CALL_PATTERNS = {
+        "requests.get", "requests.post", "requests.put", "requests.delete", "requests.request",
+        "httpx.get", "httpx.post", "httpx.put", "httpx.delete", "httpx.request",
+        "aiohttp.ClientSession.get", "aiohttp.ClientSession.post",
+        "urllib.request.urlopen", "urllib3.request",
+        "boto3.client", "boto3.resource",
+        "redis.Redis", "redis.StrictRedis",
+        "psycopg2.connect", "mysql.connector.connect", "pymongo.MongoClient",
+        "sqlalchemy.create_engine", "asyncpg.connect",
+        "kafka.KafkaProducer", "kafka.KafkaConsumer",
+        "pika.BlockingConnection", "pika.SelectConnection",
+    }
+
+    RETRY_PATTERNS = {"retry", "backoff", "tenacity", "retrying"}
+    CIRCUIT_BREAKER_PATTERNS = {"circuitbreaker", "circuit_breaker", "pybreaker", "hystrix"}
+    TIMEOUT_PATTERNS = {"timeout", "connect_timeout", "read_timeout", "request_timeout"}
+
+    def __init__(self, filepath: str, is_test: bool, lines: list[str]):
+        self.filepath = filepath
+        self.is_test = is_test
+        self.lines = lines
+        self.findings = []
+        self.external_calls = []
+        self.has_retry = False
+        self.has_circuit_breaker = False
+        self.has_timeout = False
+        self.has_idempotency = False
+        self.global_state = set()
+        self.global_locks = set()
+        self.direct_instantiations = []
+        self.health_check_endpoints = []
+        self.module_level_threads = []
+        self.in_function = False
+        self.current_function = None
+
+    def visit_FunctionDef(self, node: ast.FunctionDef):
+        old_func = self.current_function
+        self.current_function = node.name
+        old_in_func = self.in_function
+        self.in_function = True
+
+        # First visit body to collect external calls
+        for stmt in node.body:
+            self.visit(stmt)
+
+        # Then check for chaos patterns
+        self._check_function_for_chaos_patterns(node)
+
+        self.in_function = old_in_func
+        self.current_function = old_func
+
+    def visit_AsyncFunctionDef(self, node: ast.AsyncFunctionDef):
+        self.visit_FunctionDef(node)
+
+    def visit_Call(self, node: ast.Call):
+        self._analyze_call(node)
+        self.generic_visit(node)
+
+    def visit_Assign(self, node: ast.Assign):
+        if not self.in_function:
+            for target in node.targets:
+                if isinstance(target, ast.Name):
+                    self.global_state.add(target.id)
+                    if self._is_lock_creation(node.value):
+                        self.global_locks.add(target.id)
+        self.generic_visit(node)
+
+    def visit_ClassDef(self, node: ast.ClassDef):
+        self.generic_visit(node)
+
+    def _analyze_call(self, node: ast.Call):
+        func_name = self._get_call_name(node)
+        if not func_name:
+            return
+
+        if any(pattern in func_name for pattern in self.EXTERNAL_CALL_PATTERNS):
+            self.external_calls.append((node, func_name))
+
+        if any(pattern in func_name.lower() for pattern in self.RETRY_PATTERNS):
+            self.has_retry = True
+
+        if any(pattern in func_name.lower() for pattern in self.CIRCUIT_BREAKER_PATTERNS):
+            self.has_circuit_breaker = True
+
+        if "timeout" in func_name.lower():
+            self.has_timeout = True
+
+        for kw in node.keywords:
+            if kw.arg in ("timeout", "connect_timeout", "read_timeout", "request_timeout"):
+                self.has_timeout = True
+            if kw.arg in ("idempotency_key", "idempotent"):
+                self.has_idempotency = True
+
+        if self._is_direct_instantiation(node):
+            self.direct_instantiations.append((node, func_name))
+
+    def _get_call_name(self, node: ast.Call) -> str | None:
+        if isinstance(node.func, ast.Name):
+            return node.func.id
+        elif isinstance(node.func, ast.Attribute):
+            parts = []
+            current = node.func
+            while isinstance(current, ast.Attribute):
+                parts.append(current.attr)
+                current = current.value
+            if isinstance(current, ast.Name):
+                parts.append(current.id)
+            return ".".join(reversed(parts))
+        return None
+
+    def _is_lock_creation(self, node: ast.AST) -> bool:
+        if isinstance(node, ast.Call):
+            name = self._get_call_name(node)
+            return name and ("Lock" in name or "RLock" in name or "Semaphore" in name)
+        return False
+
+    def _is_direct_instantiation(self, node: ast.Call) -> bool:
+        if isinstance(node.func, ast.Name):
+            return node.func.id[0].isupper() if node.func.id else False
+        elif isinstance(node.func, ast.Attribute):
+            return node.func.attr[0].isupper() if node.func.attr else False
+        return False
+
+    def _check_function_for_chaos_patterns(self, node: ast.FunctionDef):
+        if self.external_calls and not self.has_retry:
+            for call_node, call_name in self.external_calls:
+                self._add_finding(call_node, "no_retry",
+                    f"External call '{call_name}' without retry logic",
+                    f"Add retry with exponential backoff for resilience",
+                    confidence=0.8)
+
+        if self.external_calls and not self.has_circuit_breaker:
+            for call_node, call_name in self.external_calls:
+                self._add_finding(call_node, "no_circuit_breaker",
+                    f"External call '{call_name}' without circuit breaker",
+                    f"Add circuit breaker pattern to prevent cascade failures",
+                    confidence=0.75)
+
+        if self.external_calls and not self.has_timeout:
+            for call_node, call_name in self.external_calls:
+                self._add_finding(call_node, "no_timeout",
+                    f"External call '{call_name}' without timeout",
+                    f"Add timeout parameter (e.g., timeout=5)",
+                    confidence=0.85)
+
+        if self.external_calls and not self.has_idempotency:
+            for call_node, call_name in self.external_calls:
+                if "post" in call_name.lower() or "put" in call_name.lower() or "patch" in call_name.lower():
+                    self._add_finding(call_node, "no_idempotency_key",
+                        f"Mutating external call '{call_name}' without idempotency key",
+                        f"Add idempotency_key parameter for safe retries",
+                        confidence=0.7)
+
+    def visit_Module(self, node: ast.Module):
+        for stmt in node.body:
+            if isinstance(stmt, (ast.Import, ast.ImportFrom)):
+                for alias in stmt.names:
+                    if alias.name in ("threading", "multiprocessing", "concurrent.futures"):
+                        pass
+            elif isinstance(stmt, (ast.FunctionDef, ast.AsyncFunctionDef)):
+                pass
+            elif isinstance(stmt, ast.Assign):
+                self.visit(stmt)
+            elif isinstance(stmt, ast.Expr) and isinstance(stmt.value, ast.Call):
+                call_name = self._get_call_name(stmt.value)
+                if call_name and "Thread" in call_name:
+                    self.module_level_threads.append((stmt, call_name))
+
+        self._check_module_level_patterns()
+        self.generic_visit(node)
+
+    def _check_module_level_patterns(self):
+        for thread_node, thread_name in self.module_level_threads:
+            self._add_finding(thread_node, "module_level_threading",
+                f"Thread/process started at module level: {thread_name}",
+                "Move thread initialization to function or use lazy initialization",
+                confidence=0.8)
+
+        if len(self.global_locks) > 0:
+            for lock in self.global_locks:
+                self._add_finding(None, "global_lock_bottleneck",
+                    f"Global lock '{lock}' may create single-threaded bottleneck",
+                    "Consider fine-grained locking or lock-free data structures",
+                    confidence=0.75, line_no=1)
+
+    def _add_finding(self, node: ast.AST | None, pattern: str, title: str, fix: str, confidence: float, line_no: int | None = None):
+        if node:
+            line_no = getattr(node, "lineno", 1)
+        elif line_no is None:
+            line_no = 1
+
+        snippet = self.lines[line_no - 1].strip() if 0 < line_no <= len(self.lines) else ""
+
+        self.findings.append(Finding(
+            engine="chaos",
+            severity="high" if confidence >= 0.8 else "medium",
+            title=title,
+            description=fix,
+            location=f"{self.filepath}:{line_no}",
+            metadata={
+                "confidence": confidence,
+                "pattern": pattern,
+                "location": f"{self.filepath}:{line_no}",
+                "fix": fix,
+                "snippet": snippet[:200],
+            },
+        ))

package/src/orion/engine/chaos_config/engine.py

@@ -0,0 +1,322 @@
+"""Config chaos analysis engine - edge case testing for configuration files."""
+import json
+import re
+import tomllib
+from pathlib import Path
+from orion.engine.config import EngineConfig
+from orion.engine.ir import OrionIR
+from orion.engine.results import EngineResult, Finding
+
+
+class Engine:
+    name = "chaos_config"
+    version = "1.0.0"
+
+    POSITIVE_ONLY_KEYS = {
+        "port", "PORT", "timeout", "TIMEOUT", "retries", "RETRIES", "max_retries",
+        "workers", "WORKERS", "pool_size", "POOL_SIZE", "max_connections",
+        "MAX_CONNECTIONS", "buffer_size", "BUFFER_SIZE", "batch_size", "BATCH_SIZE",
+        "limit", "LIMIT", "page_size", "PAGE_SIZE", "ttl", "TTL", "expire", "EXPIRE",
+        "interval", "INTERVAL", "rate_limit", "RATE_LIMIT", "max_size", "MAX_SIZE",
+    }
+
+    ENUM_KEYS = {
+        "log_level": {"DEBUG", "INFO", "WARNING", "ERROR", "CRITICAL"},
+        "LOG_LEVEL": {"DEBUG", "INFO", "WARNING", "ERROR", "CRITICAL"},
+        "environment": {"development", "staging", "production", "test"},
+        "ENVIRONMENT": {"development", "staging", "production", "test"},
+        "mode": {"sync", "async", "threaded", "multiprocess"},
+        "protocol": {"http", "https", "grpc", "tcp", "udp"},
+    }
+
+    REQUIRED_SECTIONS = {
+        "database", "redis", "kafka", "rabbitmq", "email", "storage", "auth",
+        "logging", "monitoring", "security", "cache", "queue",
+    }
+
+    async def check_availability(self) -> bool:
+        return True
+
+    def resource_limits(self):
+        from orion.engine.config import ResourceLimits
+        return ResourceLimits(max_cpu_seconds=60, max_memory_mb=256)
+
+    async def run(self, ir: OrionIR, config: EngineConfig) -> EngineResult:
+        try:
+            text = ir.content.decode("utf-8", errors="replace")
+        except Exception:
+            return EngineResult(engine=self.name, findings=[], ok=True)
+
+        path = ir.metadata.get("path", "unknown")
+        filename = Path(path).name.lower()
+        ext = Path(path).suffix.lower()
+
+        findings = []
+        parsed = self._parse_config(text, filename, ext)
+
+        if parsed is not None:
+            flat = self._flatten_config(parsed)
+            findings.extend(self._check_edge_cases(flat, path, filename, ext))
+            findings.extend(self._check_circular_refs(flat, path))
+            findings.extend(self._check_overly_long(flat, path))
+            findings.extend(self._check_special_chars(flat, path))
+
+        return EngineResult(engine=self.name, findings=findings, ok=True)
+
+    def _parse_config(self, text: str, filename: str, ext: str) -> dict | None:
+        try:
+            if ext in (".yaml", ".yml"):
+                import yaml
+                return yaml.safe_load(text) or {}
+            elif ext == ".json":
+                return json.loads(text) or {}
+            elif ext == ".toml":
+                return tomllib.loads(text) or {}
+            elif ext in (".env",):
+                return self._parse_env(text)
+            elif ext in (".ini", ".cfg", ".conf"):
+                return self._parse_ini(text)
+            elif ext == ".properties":
+                return self._parse_properties(text)
+        except Exception:
+            pass
+        return None
+
+    def _parse_env(self, text: str) -> dict:
+        result = {}
+        for line in text.splitlines():
+            line = line.strip()
+            if not line or line.startswith("#"):
+                continue
+            if "=" in line:
+                key, value = line.split("=", 1)
+                result[key.strip()] = value.strip().strip('"\'')
+        return result
+
+    def _parse_ini(self, text: str) -> dict:
+        import configparser
+        parser = configparser.ConfigParser()
+        parser.read_string(text)
+        result = {}
+        for section in parser.sections():
+            for key, value in parser[section].items():
+                result[f"{section}.{key}"] = value
+        return result
+
+    def _parse_properties(self, text: str) -> dict:
+        result = {}
+        for line in text.splitlines():
+            line = line.strip()
+            if not line or line.startswith("#") or line.startswith("!"):
+                continue
+            if "=" in line:
+                key, value = line.split("=", 1)
+                result[key.strip()] = value.strip()
+            elif ":" in line:
+                key, value = line.split(":", 1)
+                result[key.strip()] = value.strip()
+        return result
+
+    def _flatten_config(self, config: dict, prefix: str = "") -> dict:
+        result = {}
+        for key, value in config.items():
+            full_key = f"{prefix}.{key}" if prefix else key
+            if isinstance(value, dict):
+                result.update(self._flatten_config(value, full_key))
+            else:
+                result[full_key] = value
+        return result
+
+    def _check_edge_cases(self, flat: dict, path: str, filename: str, ext: str) -> list[Finding]:
+        findings = []
+        for key, value in flat.items():
+            key_lower = key.lower()
+
+            if value is None or (isinstance(value, str) and value.strip() == ""):
+                findings.append(Finding(
+                    engine=self.name,
+                    severity="high",
+                    title=f"Empty/null config value: {key}",
+                    description=f"Config key '{key}' has empty or null value which may cause failures",
+                    location=path,
+                    metadata={
+                        "confidence": 0.9,
+                        "key": key,
+                        "value": "null" if value is None else '""',
+                        "risk": "null_or_empty_value",
+                    },
+                ))
+
+            if isinstance(value, (int, float)):
+                if key_lower in self.POSITIVE_ONLY_KEYS and value <= 0:
+                    findings.append(Finding(
+                        engine=self.name,
+                        severity="high",
+                        title=f"Negative/zero value for positive-only key: {key}",
+                        description=f"Key '{key}' = {value} but must be positive",
+                        location=path,
+                        metadata={
+                            "confidence": 0.95,
+                            "key": key,
+                            "value": str(value),
+                            "risk": "negative_where_positive_expected",
+                        },
+                    ))
+                if isinstance(value, (int, float)) and abs(value) > 1e9:
+                    findings.append(Finding(
+                        engine=self.name,
+                        severity="medium",
+                        title=f"Extremely large numeric value: {key}",
+                        description=f"Key '{key}' = {value} may cause overflow or performance issues",
+                        location=path,
+                        metadata={
+                            "confidence": 0.75,
+                            "key": key,
+                            "value": str(value),
+                            "risk": "very_large_number",
+                        },
+                    ))
+
+            if isinstance(value, str):
+                if key_lower in self.ENUM_KEYS:
+                    allowed = self.ENUM_KEYS[key_lower]
+                    if value.upper() not in {v.upper() for v in allowed}:
+                        findings.append(Finding(
+                            engine=self.name,
+                            severity="high",
+                            title=f"Invalid enum value: {key}",
+                            description=f"Key '{key}' = '{value}' not in allowed values: {allowed}",
+                            location=path,
+                            metadata={
+                                "confidence": 0.95,
+                                "key": key,
+                                "value": value,
+                                "risk": "invalid_enum",
+                                "allowed": list(allowed),
+                            },
+                        ))
+
+        return findings
+
+    def _check_circular_refs(self, flat: dict, path: str) -> list[Finding]:
+        findings = []
+        visited = set()
+        path_stack = []
+
+        def check_refs(obj, current_path=""):
+            if id(obj) in visited:
+                return
+            visited.add(id(obj))
+
+            if isinstance(obj, dict):
+                for k, v in obj.items():
+                    new_path = f"{current_path}.{k}" if current_path else k
+                    if isinstance(v, str) and v.startswith("${") and v.endswith("}"):
+                        ref_key = v[2:-1]
+                        if ref_key in path_stack:
+                            findings.append(Finding(
+                                engine=self.name,
+                                severity="high",
+                                title=f"Circular reference detected: {new_path}",
+                                description=f"Config reference '{v}' creates circular dependency",
+                                location=path,
+                                metadata={
+                                    "confidence": 0.9,
+                                    "key": new_path,
+                                    "value": v,
+                                    "risk": "circular_reference",
+                                    "cycle": " -> ".join(path_stack + [ref_key]),
+                                },
+                            ))
+                    path_stack.append(k)
+                    check_refs(v, new_path)
+                    path_stack.pop()
+            elif isinstance(obj, list):
+                for i, item in enumerate(obj):
+                    check_refs(item, f"{current_path}[{i}]")
+
+        check_refs(flat)
+        return findings
+
+    def _check_overly_long(self, flat: dict, path: str) -> list[Finding]:
+        findings = []
+        for key, value in flat.items():
+            if isinstance(value, str) and len(value) > 10000:
+                findings.append(Finding(
+                    engine=self.name,
+                    severity="medium",
+                    title=f"Overly long config value: {key}",
+                    description=f"Config value for '{key}' exceeds 10000 characters ({len(value)} chars)",
+                    location=path,
+                    metadata={
+                        "confidence": 0.8,
+                        "key": key,
+                        "value_length": len(value),
+                        "risk": "overly_long_string",
+                    },
+                ))
+        return findings
+
+    def _check_special_chars(self, flat: dict, path: str) -> list[Finding]:
+        findings = []
+        dangerous_chars = ["\0", "\r", "\x1b", "\x00", "\x01", "\x02", "\x03", "\x04"]
+        for key, value in flat.items():
+            if isinstance(value, str):
+                for char in dangerous_chars:
+                    if char in value:
+                        findings.append(Finding(
+                            engine=self.name,
+                            severity="high",
+                            title=f"Dangerous character in config: {key}",
+                            description=f"Config value contains control character (0x{ord(char):02x})",
+                            location=path,
+                            metadata={
+                                "confidence": 0.9,
+                                "key": key,
+                                "risk": "control_character",
+                                "char_code": f"0x{ord(char):02x}",
+                            },
+                        ))
+                        break
+
+                if key.lower().endswith(("path", "dir", "directory", "file", "cert", "key")):
+                    if any(c in value for c in ["|", "&", ";", "$", "`", ">", "<", "\n", "\r"]):
+                        findings.append(Finding(
+                            engine=self.name,
+                            severity="high",
+                            title=f"Shell metacharacters in path config: {key}",
+                            description=f"Path value contains shell metacharacters - potential injection",
+                            location=path,
+                            metadata={
+                                "confidence": 0.85,
+                                "key": key,
+                                "risk": "shell_metacharacters_in_path",
+                            },
+                        ))
+        return findings
+
+    def _check_missing_sections(self, parsed: dict, path: str, filename: str) -> list[Finding]:
+        findings = []
+        if not parsed:
+            return findings
+
+        top_keys = {k.lower() for k in parsed.keys() if not isinstance(parsed[k], dict)}
+        section_keys = {k.lower() for k in parsed.keys() if isinstance(parsed[k], dict)}
+
+        for req in self.REQUIRED_SECTIONS:
+            if req not in section_keys and req not in top_keys:
+                if any(req in k for k in section_keys) or any(req in k for k in top_keys):
+                    continue
+                findings.append(Finding(
+                    engine=self.name,
+                    severity="medium",
+                    title=f"Missing required config section: {req}",
+                    description=f"Expected configuration section '{req}' not found",
+                    location=path,
+                    metadata={
+                        "confidence": 0.7,
+                        "key": req,
+                        "issue": "missing_section",
+                    },
+                ))
+        return findings