@orionscanner/cli 0.5.4-a2 → 0.8.0
This diff represents the content of publicly available package versions that have been released to one of the supported registries. The information contained in this diff is provided for informational purposes only and reflects changes between package versions as they appear in their respective public registries.
- package/LICENSE +16 -21
- package/README.md +217 -73
- package/bin/orion.js +66 -22
- package/dist/orion.exe +0 -0
- package/package.json +1 -1
package/LICENSE
CHANGED
|
@@ -1,21 +1,16 @@
|
|
|
1
|
-
|
|
2
|
-
|
|
3
|
-
|
|
4
|
-
|
|
5
|
-
|
|
6
|
-
|
|
7
|
-
|
|
8
|
-
|
|
9
|
-
|
|
10
|
-
|
|
11
|
-
|
|
12
|
-
|
|
13
|
-
|
|
14
|
-
|
|
15
|
-
|
|
16
|
-
|
|
17
|
-
FITNESS FOR A PARTICULAR PURPOSE AND NONINFRINGEMENT. IN NO EVENT SHALL THE
|
|
18
|
-
AUTHORS OR COPYRIGHT HOLDERS BE LIABLE FOR ANY CLAIM, DAMAGES OR OTHER
|
|
19
|
-
LIABILITY, WHETHER IN AN ACTION OF CONTRACT, TORT OR OTHERWISE, ARISING FROM,
|
|
20
|
-
OUT OF OR IN CONNECTION WITH THE SOFTWARE OR THE USE OR OTHER DEALINGS IN THE
|
|
21
|
-
SOFTWARE.
|
|
1
|
+
Copyright (c) 2024 Chandra Hotha. All rights reserved.
|
|
2
|
+
|
|
3
|
+
Orion Security Suite is proprietary, in-house developed software.
|
|
4
|
+
|
|
5
|
+
UNLICENSED: this software is NOT offered under any open-source license.
|
|
6
|
+
No permission is granted to copy, modify, merge, publish, distribute,
|
|
7
|
+
sublicense, or sell this software or derivative works, except as
|
|
8
|
+
explicitly authorized in writing by the copyright holder.
|
|
9
|
+
|
|
10
|
+
The npm package declares "license": "UNLICENSED" and the compiled
|
|
11
|
+
distribution ships binaries only (zero Python source code distributed).
|
|
12
|
+
|
|
13
|
+
ORN-P4-022: this file previously contained MIT license text that
|
|
14
|
+
contradicted the package.json "UNLICENSED" declaration and the README's
|
|
15
|
+
proprietary positioning. The MIT text was removed; the proprietary
|
|
16
|
+
posture is the single source of truth.
|
package/README.md
CHANGED
|
@@ -1,138 +1,282 @@
|
|
|
1
|
-
|
|
1
|
+
<div align="center">
|
|
2
2
|
|
|
3
|
-
<
|
|
4
|
-
<img src="assets/logo.png" alt="Orion Security Suite" width="460" />
|
|
5
|
-
</p>
|
|
3
|
+
<img src="assets/logo.png" alt="Orion Engine Suite" width="420" />
|
|
6
4
|
|
|
7
|
-
|
|
8
|
-
<strong>SEE. ANALYZE. IMPROVE.</strong><br>
|
|
9
|
-
<em>The Autonomous, In-House Code Intelligence & Enterprise Security Audit Platform</em>
|
|
10
|
-
</p>
|
|
5
|
+
# Orion Engine Suite
|
|
11
6
|
|
|
12
|
-
|
|
13
|
-
|
|
14
|
-
|
|
15
|
-
|
|
16
|
-
|
|
17
|
-
|
|
7
|
+
**SEE. ANALYZE. IMPROVE.**
|
|
8
|
+
|
|
9
|
+
The Autonomous, In-House **Code Intelligence & Bug Identifier** — with enterprise security analysis built in.
|
|
10
|
+
**76 specialized engines.** Zero cloud. Zero third-party runtime dependencies. 100% your infrastructure.
|
|
11
|
+
|
|
12
|
+
[](https://www.npmjs.com/package/@orionscanner/cli)
|
|
13
|
+
[](https://www.python.org)
|
|
14
|
+
[](#)
|
|
15
|
+
[](docs/reference/ENGINE_CATALOG.md)
|
|
16
|
+
[](#)
|
|
17
|
+
[](docs/engineering/fixtures/PHASE4-TESTS-CI-FIXES.MD)
|
|
18
|
+
[](#license--intellectual-property)
|
|
19
|
+
|
|
20
|
+
[Quick Start](#-instant-quick-start) · [CLI](#-supercharged-cli) · [Engines](#-the-76-engine-arsenal) · [Detection Science](#-detection-science) · [Reports](#-executive-ready-reports) · [Documentation](#-documentation) · [New in v0.7.0](#-new-in-v070)
|
|
21
|
+
|
|
22
|
+
</div>
|
|
18
23
|
|
|
19
24
|
---
|
|
20
25
|
|
|
21
|
-
## Why Choose Orion?
|
|
26
|
+
## <img src="https://img.shields.io/badge/-WHY%20ORION-0b1220" height="22" /> Why Choose Orion?
|
|
22
27
|
|
|
23
|
-
Modern development teams face fragmented security tools, high false-alarm noise, and code
|
|
28
|
+
Modern development teams face fragmented security tools, high false-alarm noise, and code-privacy risk from sending proprietary source to third-party clouds.
|
|
24
29
|
|
|
25
|
-
**Orion
|
|
30
|
+
**Orion Engine Suite** is the answer: a unified, zero-cloud code intelligence powerhouse that finds bugs and security issues entirely where your code lives — your workstation, your CI runner, your air-gapped lab.
|
|
26
31
|
|
|
27
32
|
```
|
|
28
|
-
|
|
29
|
-
|
|
30
|
-
|
|
31
|
-
|
|
33
|
+
┌──────────────────────────────────────────┐
|
|
34
|
+
│ ORION ENGINE SUITE │
|
|
35
|
+
│ SEE. ANALYZE. IMPROVE. │
|
|
36
|
+
└────────────────────┬─────────────────────┘
|
|
32
37
|
│
|
|
33
|
-
|
|
34
|
-
|
|
35
|
-
🛡️ Application Security
|
|
36
|
-
• Deep SAST &
|
|
37
|
-
•
|
|
38
|
-
•
|
|
38
|
+
┌─────────────────────────────┼─────────────────────────────┐
|
|
39
|
+
▼ ▼ ▼
|
|
40
|
+
🛡️ Application Security 🧠 AI & LLM Defense ⚡ Code Quality & Flow
|
|
41
|
+
• Deep SAST & sink analysis • Prompt-injection shields • Complexity & O(n²) guard
|
|
42
|
+
• Scoped taint + wrappers • Agent trust boundaries • Dead code elimination
|
|
43
|
+
• 32 injection/hardening • Automated STRIDE modeling • Architecture layer checks
|
|
44
|
+
• 76 specialized engines • Optional BYOK verification • 7 quality engines
|
|
39
45
|
```
|
|
40
46
|
|
|
47
|
+
### 💎 The Orion Advantage
|
|
48
|
+
|
|
49
|
+
| | |
|
|
50
|
+
|---|---|
|
|
51
|
+
| 🔒 **100% In-House, Zero-Cloud** | Your source never leaves your infrastructure. Every parser, AST visitor, heuristic rule and taint engine is original IP, executes locally, and the runtime has **zero third-party dependencies** — not even a YAML parser is imported; Orion ships its own. Ideal for defense, finance and air-gapped environments. |
|
|
52
|
+
| 🎯 **Evidence-Driven Detection** | Taint-proven findings carry `source → sink` evidence metadata instead of bare pattern matches. Cross-engine correlation merges duplicate findings into one stronger, corroborated finding — every suppression is disclosed, never silent. |
|
|
53
|
+
| 🧪 **Benchmarked & Gated** | A ground-truth benchmark harness gates every release: **recall 1.00** across vulnerability classes in 3 languages. Adversarial-repo suites, parser fuzzing, a scan-time performance budget and a dogfood self-scan ratchet ship in CI. |
|
|
54
|
+
| 🤖 **Optional AI Verification (BYOK)** | Opt-in second opinion on top findings using **your own API key** — one combined call verifies, re-ranks, and drafts the executive summary. Secrets are masked before transmission; fully offline by default. |
|
|
55
|
+
| ⚡ **Hardened by Design** | 190+ tracked engineering fixes across 6 phases: fail-open suppression safety, engine timeout isolation, deterministic output ordering, hostile-input regression suites, function-scoped taint, alias-aware sink resolution. See the [Fix Registry](docs/engineering/FIX-REGISTRY.MD). |
|
|
56
|
+
|
|
41
57
|
---
|
|
42
58
|
|
|
43
|
-
## Instant Quick Start
|
|
59
|
+
## 🚀 Instant Quick Start
|
|
44
60
|
|
|
45
|
-
###
|
|
61
|
+
### Via npm (one line)
|
|
46
62
|
|
|
47
63
|
```bash
|
|
48
64
|
npm install -g @orionscanner/cli
|
|
49
65
|
```
|
|
50
66
|
|
|
51
|
-
*Or run instantly with
|
|
67
|
+
*Or run instantly with zero installation:*
|
|
68
|
+
|
|
52
69
|
```bash
|
|
53
70
|
npx @orionscanner/cli .
|
|
54
71
|
```
|
|
55
72
|
|
|
56
|
-
|
|
73
|
+
The npm package ships **compiled standalone binaries** for Windows, macOS and Linux — no Python source, no Python runtime required.
|
|
57
74
|
|
|
58
|
-
###
|
|
75
|
+
### Via Python (from source)
|
|
59
76
|
|
|
60
77
|
```bash
|
|
61
|
-
# Clone the repository
|
|
62
78
|
git clone https://github.com/chandrahotha/OrionEngine.git
|
|
63
79
|
cd OrionEngine
|
|
64
|
-
|
|
65
|
-
# Install locally in editable mode
|
|
66
80
|
pip install -e .
|
|
67
81
|
```
|
|
68
82
|
|
|
83
|
+
Requires **Python 3.11+**. No other runtime dependencies — the standard library is the only dependency.
|
|
84
|
+
|
|
69
85
|
---
|
|
70
86
|
|
|
71
|
-
## ⚡ Supercharged CLI
|
|
87
|
+
## ⚡ Supercharged CLI
|
|
72
88
|
|
|
73
|
-
Audit
|
|
89
|
+
Audit an entire codebase in seconds:
|
|
74
90
|
|
|
75
91
|
```bash
|
|
76
|
-
#
|
|
77
|
-
orion .
|
|
92
|
+
orion . # Full workspace audit — all 76 engines
|
|
93
|
+
orion . --security # Deep SAST, taint flow, secrets, injection sinks
|
|
94
|
+
orion . --threat # Automated STRIDE threat modeling + PII privacy sweep
|
|
95
|
+
orion . --ai # AI/LLM defense: prompt injection, agent trust boundaries
|
|
96
|
+
orion . --iac # Dockerfile, Kubernetes, Terraform, config hygiene
|
|
97
|
+
orion . --crypto # Broken algorithms, weak modes, hardcoded key material
|
|
98
|
+
orion . --quality # Complexity, perf anti-patterns, dead code, duplication
|
|
99
|
+
orion . --arch # Layer violations, import cycles, god modules
|
|
100
|
+
orion . --supply-chain # SBOM, provenance, deps, license, typosquatting
|
|
101
|
+
orion . --incremental # Incremental scan (git diff since HEAD)
|
|
102
|
+
orion . --diff # Alias for --incremental
|
|
103
|
+
orion . --baseline main # Diff against main branch
|
|
104
|
+
orion fix . --apply --yes # Auto-fix all issues (CI mode)
|
|
105
|
+
orion # Launch the interactive terminal console
|
|
106
|
+
```
|
|
78
107
|
|
|
79
|
-
|
|
80
|
-
orion . --security
|
|
108
|
+
Every scan ends in a styled audit dashboard with a weighted **security score and letter grade**:
|
|
81
109
|
|
|
82
|
-
|
|
83
|
-
|
|
110
|
+
```
|
|
111
|
+
┌───────────────────────────────────────────────────────────────────────────────────┐
|
|
112
|
+
│ AUDIT SUMMARY • ORION SECURITY SUITE │
|
|
113
|
+
├─────────────────────┬─────────────────────┬───────────────────┬───────────────────┤
|
|
114
|
+
│ Files Scanned │ Engines Run │ Findings │ Security Score │
|
|
115
|
+
│ 308 │ 11,704 │ 142 │ 87 / 100 (B+) │
|
|
116
|
+
└─────────────────────┴─────────────────────┴───────────────────┴───────────────────┘
|
|
117
|
+
```
|
|
84
118
|
|
|
85
|
-
|
|
86
|
-
orion . --ai
|
|
119
|
+
---
|
|
87
120
|
|
|
88
|
-
|
|
89
|
-
orion . --iac
|
|
121
|
+
## 🧬 The 76-Engine Arsenal
|
|
90
122
|
|
|
91
|
-
|
|
92
|
-
orion . --quality
|
|
123
|
+
Every engine is independently authored, contract-validated at registration, resource-limited, and timeout-isolated — a runaway engine can never stall your scan. Full catalog: [`docs/reference/ENGINE_CATALOG.md`](docs/reference/ENGINE_CATALOG.md)
|
|
93
124
|
|
|
94
|
-
|
|
95
|
-
|
|
96
|
-
|
|
125
|
+
| Domain | Engines | What they catch |
|
|
126
|
+
|---|---|---|
|
|
127
|
+
| 🛡️ **Core SAST & Taint** | `sast` · `taint` · `secrets` · `sandbox_escape` · `api_security` · `authorization` · `crypto_guard` · `wiring_trace` · `reachability` | Injection sinks, interprocedural taint flows, leaked keys, BOLA/IDOR endpoints, missing auth, broken crypto, secret wiring from config to code, entrypoint-to-sink REACHABLE/UNREACHABLE call-path evidence |
|
|
128
|
+
| 💉 **Injection Guards** | `ssrf_guard` · `xxe_guard` · `deserialization_guard` · `open_redirect_guard` · `header_injection_guard` · `ssti_guard` · `log_injection_guard` · `ldap_xpath_injection` · `mass_assignment_guard` · `prototype_pollution` · `csrf_guard` | Taint-proven SSRF, XML entity resolution, unsafe deserializers, redirect/header/CRLF/template/log/LDAP/XPath injection — with alias-aware sink resolution |
|
|
129
|
+
| 🌐 **Web Hardening** | `jwt_guard` · `csrf_guard` · `cors_misconfig_guard` · `session_cookie_flags` · `error_disclosure_guard` · `mass_assignment_guard` · `graphql_guard` · `websocket_guard` · `idor_guard` | alg=none & verify-off JWTs, missing CSRF, wildcard CORS with credentials, insecure cookie flags, debug/stack-trace disclosure, mass assignment, GraphQL/WebSocket hardening, IDOR ownership gaps |
|
|
130
|
+
| 🧨 **Runtime & Exploit Patterns** | `redos_scanner` · `zip_slip_guard` · `toctou_guard` · `prototype_pollution` · `memory_safety_c` · `obfuscation_detector` | Catastrophic regex backtracking (in-house regex parser), archive-extraction path escape, file race windows, JS prototype pollution, C/C++ buffer idioms, packed/encoded payloads |
|
|
131
|
+
| 🧠 **AI & LLM Defense** | `llm_security` · `prompt_security` · `ai_verify` | Executed LLM output, prompt injection, hardcoded provider keys, autonomy flags; optional BYOK verification |
|
|
132
|
+
| ☁️ **Cloud & IaC** | `container` · `iac_security` · `k8s_rbac_analyzer` · `hardcoded_infra_leak` · `config_engine` · `config_validation` · `chaos_config` | Root containers, open security groups, cluster-admin & wildcard RBAC, private IPs/internal hostnames in code, dangerous config values |
|
|
133
|
+
| 📦 **Supply Chain** | `deps` · `supply_chain_sbom` · `provenance` · `typosquat_guard` · `manifest_script_audit` · `lockfile_drift` · `git_history_secrets` · `binary_blob_detector` · `license` | Vulnerable/unpinned deps, **OSV.dev CVE feed**, SBOM, build provenance, dependency typosquatting, install-script droppers, manifest/lockfile drift, secrets recoverable from git history, committed binaries, GPL contamination |
|
|
134
|
+
| 🔐 **Privacy & Compliance** | `pii_scan` · `sensitive_data` · `logging_c` · `entropy_secrets_v2` · `threat_model` · `compliance` | Hardcoded PII, GDPR/CCPA exposure, sensitive data in logs, context-scored entropy secrets, STRIDE threats, PCI-DSS/SOC2/GDPR/HIPAA mapping |
|
|
135
|
+
| ⚡ **Code Quality & Flow** | `lint` · `complexity` · `perf_guard` · `cfg` · `dataflow` · `dead_import` · `symbol` · `duplication` · `state` · `callgraph` · `regression` · `contract_probe` · `error_handling` | Complexity hotspots, N+1 queries, loop anti-patterns, infinite loops, use-before-def, dead code, monkey-patching, unguarded HTTP calls |
|
|
136
|
+
| 🏛️ **Architecture & Contracts** | `architecture` · `orphan` · `test_coverage` · `api_contract_drift` | Import cycles, layer violations, god modules, orphan files, untested public APIs, OpenAPI spec-vs-implementation drift |
|
|
137
|
+
| 🎛️ **Signal Control** | `fp_suppression` · `chaos` | Transparent dedup, learned FP suppression, cross-engine correlation with corroborated evidence, resilience gaps |
|
|
97
138
|
|
|
98
139
|
---
|
|
99
140
|
|
|
100
|
-
##
|
|
141
|
+
## 🔬 Detection Science
|
|
101
142
|
|
|
102
|
-
|
|
103
|
-
Your proprietary source code never leaves your workstation or CI/CD runner. Every parser, AST visitor, heuristic rule, and taint-flow engine is 100% custom-built and executes locally with zero external subprocess dependencies.
|
|
143
|
+
Orion favors **proof over pattern matching**:
|
|
104
144
|
|
|
105
|
-
|
|
106
|
-
|
|
107
|
-
- **
|
|
108
|
-
- **
|
|
109
|
-
- **
|
|
145
|
+
- **Function-scoped taint** — module globals flow into functions; a local in one function never leaks into a sibling. Bounded fixpoint propagation keeps scans fast and deterministic.
|
|
146
|
+
- **Alias-aware resolution** — `import requests as r`, `from requests import get`, `from flask import request as req` all resolve to canonical names for both sources and sinks.
|
|
147
|
+
- **Bounded wrapper tracking** — a local function proven to return attacker-controlled data becomes a taint source at its call sites (1 hop; deep flows belong to the `taint` engine).
|
|
148
|
+
- **Contextual sinks** — `session.get()` is only an HTTP sink when HTTP-client context is established; ORM/database calls with the same name stay clean.
|
|
149
|
+
- **Cross-engine correlation** — generic SAST + specialized guard + taint agreeing on one line collapse into a single stronger finding with `corroborated_by` evidence and preserved compliance mapping.
|
|
150
|
+
- **Calibrated severity** — hardening recommendations (stdlib XML parsers) report medium; proven-exploitable shapes (lxml entity resolution, tainted pickle) report high/critical.
|
|
110
151
|
|
|
111
|
-
|
|
112
|
-
|
|
152
|
+
---
|
|
153
|
+
|
|
154
|
+
## 🌐 Multi-Language Coverage
|
|
113
155
|
|
|
114
|
-
|
|
115
|
-
|
|
156
|
+
- **Languages**: Python, JavaScript, TypeScript, Go, Java, Rust, Ruby, PHP, C/C++, C#, Shell, SQL
|
|
157
|
+
- **Cloud & DevOps**: Dockerfile, `docker-compose.yml`, Kubernetes manifests, Terraform, GitHub Actions
|
|
158
|
+
- **Manifests**: `package.json`, `requirements.txt`, `pyproject.toml`, `go.mod`, `Cargo.toml`, `pom.xml`, lockfiles
|
|
116
159
|
|
|
117
160
|
---
|
|
118
161
|
|
|
119
|
-
##
|
|
162
|
+
## 📊 Executive-Ready Reports
|
|
120
163
|
|
|
121
|
-
|
|
164
|
+
Every scan generates self-contained reports in `ORION SCANNER REPORTS/`:
|
|
122
165
|
|
|
123
|
-
- **
|
|
124
|
-
- **
|
|
125
|
-
- **
|
|
166
|
+
- **Interactive HTML dashboard** — filter by category (Security / Quality / Architecture / Supply Chain) and severity; one-click PDF export for stakeholders. No CDN, no web fonts, no phone-home — the report is fully offline.
|
|
167
|
+
- **Machine-readable JSON** — complete finding metadata with CWE mappings, confidence scores, evidence, snippets.
|
|
168
|
+
- **SARIF** — pipe findings into your existing code-review tooling.
|
|
169
|
+
- **Transparent suppression log** — everything hidden by dedup/FP-suppression/correlation is listed with reasons.
|
|
126
170
|
|
|
127
171
|
---
|
|
128
172
|
|
|
129
|
-
##
|
|
173
|
+
## 🧪 Development
|
|
174
|
+
|
|
175
|
+
```bash
|
|
176
|
+
pip install -e ".[dev]" # pytest, pytest-cov, coverage, ruff, mypy — dev-only, never shipped
|
|
177
|
+
|
|
178
|
+
pytest # full suite (smoke, regressions, per-engine detection, adversarial)
|
|
179
|
+
pytest -m slow # benchmark, fuzz, dogfood self-scan and perf-budget gates
|
|
180
|
+
python -m ruff check src tests # defect gate
|
|
181
|
+
python -m mypy # core contract layer type check
|
|
182
|
+
```
|
|
130
183
|
|
|
131
|
-
- **
|
|
132
|
-
|
|
184
|
+
CI runs a **3-OS × 3-Python matrix** with lint, type, coverage, benchmark and PyInstaller build-smoke gates, plus the continuous-hardening gates: an adversarial-repo suite, a parser fuzz harness, a scan-time performance budget, and a dogfood self-scan that fails on any new critical/high finding in Orion's own source. Releases build signed binaries for Windows/macOS/Linux and publish to npm with provenance.
|
|
185
|
+
|
|
186
|
+
---
|
|
187
|
+
|
|
188
|
+
## 📚 Documentation
|
|
189
|
+
|
|
190
|
+
| Category | Guide | Description |
|
|
191
|
+
|---|---|---|
|
|
192
|
+
| **Getting Started** | [Quick Start](docs/guides/GETTING_STARTED.md) | Installation, first scan, configuration |
|
|
193
|
+
| **Scanning** | [Incremental Scanning](docs/guides/INCREMENTAL_SCANNING.md) | Git diff-based incremental scans |
|
|
194
|
+
| | [GitHub Action](docs/guides/GITHUB_ACTION.md) | CI/CD integration with SARIF upload |
|
|
195
|
+
| | [Pre-commit Hook](docs/guides/PRE_COMMIT_HOOK.md) | Local security gate |
|
|
196
|
+
| | [OSV CVE Feed](docs/guides/OSV_CVE_FEED.md) | Live vulnerability enrichment |
|
|
197
|
+
| | [Tree-sitter](docs/guides/TREE_SITTER.md) | Optional robust AST parsing |
|
|
198
|
+
| | [Auto-Fix](docs/guides/AUTO_FIX.md) | Safe in-place remediation |
|
|
199
|
+
| | [Real-World Validation](docs/guides/REAL_WORLD_VALIDATION.md) | CVE pattern benchmarking |
|
|
200
|
+
| **Rules & Detection** | [Declarative Rules](docs/guides/DECLARATIVE_RULES.md) | YAML-based rule engine |
|
|
201
|
+
| | [Engine Catalog](docs/reference/ENGINE_CATALOG.md) | All 76 engines, scopes and limits |
|
|
202
|
+
| | [Real-World Validation](docs/guides/REAL_WORLD_VALIDATION.md) | CVE pattern benchmarking |
|
|
203
|
+
| **Architecture & API** | [Architecture](docs/reference/ARCHITECTURE.md) | IR pipeline, orchestrator, engine contract |
|
|
204
|
+
| | [API Reference](docs/reference/API_REFERENCE.md) | Library usage: `OrionEngine`, `EngineConfig`, results |
|
|
205
|
+
| **Contributing** | [Contributing Guide](docs/contributing/CONTRIBUTING.md) | Engineering standards and workflow |
|
|
206
|
+
| | [Fix Registry](docs/engineering/FIX-REGISTRY.MD) | Live fix registry across all phases |
|
|
207
|
+
| | [Changelog](docs/CHANGELOG.md) | Release history |
|
|
208
|
+
|
|
209
|
+
---
|
|
210
|
+
|
|
211
|
+
## 🔗 Links
|
|
212
|
+
|
|
213
|
+
- **npm**: [`@orionscanner/cli`](https://www.npmjs.com/package/@orionscanner/cli)
|
|
214
|
+
- **GitHub**: [`chandrahotha/OrionEngine`](https://github.com/chandrahotha/OrionEngine)
|
|
215
|
+
- **OSV.dev**: [`osv.dev`](https://osv.dev)
|
|
216
|
+
- **Tree-sitter**: [`tree-sitter.github.io`](https://tree-sitter.github.io/tree-sitter/)
|
|
217
|
+
|
|
218
|
+
---
|
|
219
|
+
|
|
220
|
+
## 🆕 New in v0.7.0
|
|
221
|
+
|
|
222
|
+
### Major Features
|
|
223
|
+
|
|
224
|
+
| Feature | Description |
|
|
225
|
+
|---------|-------------|
|
|
226
|
+
| **Incremental / Diff Scanning** | `orion . --incremental` — only scan files changed since baseline (default: HEAD) |
|
|
227
|
+
| **GitHub Action** | Reusable composite action with SARIF upload, PR comments, artifact retention |
|
|
228
|
+
| **Pre-commit Hook** | Local security gate with `orion-scan-security`, `orion-scan-incremental` |
|
|
229
|
+
| **Declarative Rules Engine** | YAML-based rule definitions (20 SAST rules) replacing hardcoded Python patterns |
|
|
230
|
+
| **OSV.dev CVE Feed** | Opt-in live vulnerability enrichment for dependencies via Google's OSV.dev |
|
|
231
|
+
| **Tree-sitter Foundation** | Optional robust AST parsing for 20+ languages with graceful fallback |
|
|
232
|
+
| **Auto-Fix Expansion** | 9+ patterns: hashlib upgrade, empty except, requests timeout, eval→JSON.parse, SSTI/XSS warnings, cookie hardening, CORS warnings |
|
|
233
|
+
| **Real-World Validation** | 14 CVE-based fixtures, 58.3% match rate — identifies detection gaps |
|
|
234
|
+
| **Declarative Rules** | YAML-based rule engine with regex/ast/entropy/semantic match types |
|
|
235
|
+
| **SARIF + PR Comments** | GitHub Code Scanning integration + automated PR summaries |
|
|
236
|
+
|
|
237
|
+
### Engine Additions (32 new in v0.7.0)
|
|
238
|
+
|
|
239
|
+
- **Injection Guards**: SSRF, XXE, Deserialization, Open Redirect, Header Injection, SSTI, Log Injection, LDAP/XPath Injection
|
|
240
|
+
- **Web Hardening**: JWT, CSRF, CORS, Cookie Flags, Error Disclosure, Mass Assignment, GraphQL, WebSocket, IDOR
|
|
241
|
+
- **Runtime Patterns**: ReDoS, Zip Slip, TOCTOU, Prototype Pollution, Memory Safety (C/C++)
|
|
242
|
+
- **AI/LLM**: Prompt Injection, Agent Security, Hardcoded Provider Keys
|
|
243
|
+
- **Supply Chain**: SBOM, Provenance, Typosquatting, Lockfile Drift, Git History Secrets, Binary Blobs, License, Entropy Secrets v2
|
|
244
|
+
- **Compliance**: PCI-DSS, SOC2, GDPR, HIPAA mapping via `compliance` engine
|
|
245
|
+
|
|
246
|
+
---
|
|
247
|
+
|
|
248
|
+
## 🏗️ Architecture Highlights
|
|
249
|
+
|
|
250
|
+
```
|
|
251
|
+
┌─────────────────────────────────────────────────────────────────┐
|
|
252
|
+
│ ORION ENGINE SUITE │
|
|
253
|
+
├─────────────────────────────────────────────────────────────────┤
|
|
254
|
+
│ Polyglot Dispatcher → Engine Registry (76 engines) │
|
|
255
|
+
├─────────────────────────────────────────────────────────────────┤
|
|
256
|
+
│ IR Pipeline: Source → OrionIR → Engine Pool → Correlation │
|
|
257
|
+
│ • Function-scoped taint (no cross-function leakage) │
|
|
258
|
+
│ • Alias-aware resolution (import ... as, from ... import) │
|
|
259
|
+
│ • Bounded wrapper tracking (1-hop source promotion) │
|
|
260
|
+
│ • Cross-engine correlation (file+line+CWE) │
|
|
261
|
+
│ • Declarative rule engine (YAML + regex/AST/entropy/semantic) │
|
|
262
|
+
├─────────────────────────────────────────────────────────────────┤
|
|
263
|
+
│ Auto-Fix Engine: hashlib, except:, requests timeout, eval→JSON│
|
|
264
|
+
│ OSV.dev CVE Feed (opt-in, cached 24h, fails open) │
|
|
265
|
+
│ Tree-sitter (optional): 20+ languages, graceful fallback │
|
|
266
|
+
│ Incremental Scan: git diff → filtered file set │
|
|
267
|
+
└─────────────────────────────────────────────────────────────────┘
|
|
268
|
+
```
|
|
133
269
|
|
|
134
270
|
---
|
|
135
271
|
|
|
136
272
|
## License & Intellectual Property
|
|
137
273
|
|
|
138
|
-
Orion
|
|
274
|
+
Orion Engine Suite is **proprietary, in-house developed** software. All engines, algorithms, and AST analyzers are original intellectual property built for high-performance code intelligence and security auditing. All rights reserved — see [`LICENSE`](LICENSE).
|
|
275
|
+
|
|
276
|
+
<div align="center">
|
|
277
|
+
|
|
278
|
+
**SEE. ANALYZE. IMPROVE.**
|
|
279
|
+
|
|
280
|
+
Built with zero shortcuts. Shipped with zero dependencies.
|
|
281
|
+
|
|
282
|
+
</div>
|
package/bin/orion.js
CHANGED
|
@@ -1,8 +1,18 @@
|
|
|
1
1
|
#!/usr/bin/env node
|
|
2
2
|
/**
|
|
3
|
-
* Orion Security Suite - Protected Standalone Binary Wrapper
|
|
3
|
+
* Orion Security Suite - Protected Standalone Binary Wrapper
|
|
4
4
|
* 100% In-House Code Intelligence & SAST Platform
|
|
5
5
|
* (Zero Python Source Code Distributed)
|
|
6
|
+
*
|
|
7
|
+
* ORN-P4-016: version string removed from this header -- it went stale
|
|
8
|
+
* (said v0.5.2 while the product was at 0.5.4). The canonical version
|
|
9
|
+
* lives in pyproject.toml; `orion --version` prints the real one.
|
|
10
|
+
*
|
|
11
|
+
* ORN-P4-027: spawn 'error' events (ENOENT when the interpreter/binary is
|
|
12
|
+
* missing, EACCES, ...) used to crash with an unhandled-exception stack
|
|
13
|
+
* trace. Every child now has an error handler with a clean message, and the
|
|
14
|
+
* source fallback resolves the Python interpreter from a candidate list
|
|
15
|
+
* (py -3 / python / python3) instead of assuming one fixed name.
|
|
6
16
|
*/
|
|
7
17
|
|
|
8
18
|
const { spawn } = require('child_process');
|
|
@@ -12,38 +22,72 @@ const fs = require('fs');
|
|
|
12
22
|
const projectRoot = path.resolve(__dirname, '..');
|
|
13
23
|
const args = process.argv.slice(2);
|
|
14
24
|
|
|
15
|
-
|
|
16
|
-
|
|
17
|
-
|
|
25
|
+
function fail(message) {
|
|
26
|
+
console.error(`\x1b[31m\u2716 ${message}\x1b[0m`);
|
|
27
|
+
process.exit(1);
|
|
28
|
+
}
|
|
18
29
|
|
|
19
|
-
|
|
20
|
-
const child = spawn(
|
|
30
|
+
function launch(cmd, cmdArgs, env) {
|
|
31
|
+
const child = spawn(cmd, cmdArgs, {
|
|
21
32
|
stdio: 'inherit',
|
|
33
|
+
env: env || process.env,
|
|
22
34
|
cwd: process.cwd()
|
|
23
35
|
});
|
|
24
|
-
|
|
25
|
-
|
|
26
|
-
|
|
27
|
-
|
|
28
|
-
cwd: process.cwd()
|
|
36
|
+
// ORN-P4-027: without this handler a missing/broken executable threw an
|
|
37
|
+
// unhandled 'error' event instead of printing a usable diagnostic.
|
|
38
|
+
child.on('error', (err) => {
|
|
39
|
+
fail(`Failed to launch '${cmd}': ${err.message}`);
|
|
29
40
|
});
|
|
30
41
|
child.on('close', (code) => process.exit(code || 0));
|
|
42
|
+
}
|
|
43
|
+
|
|
44
|
+
// Check for standalone compiled binary first (zero source code).
|
|
45
|
+
// ORN-P4-017: the release ships one binary per OS; resolve the
|
|
46
|
+
// platform-specific name first, then fall back to the legacy generic name.
|
|
47
|
+
const exePath = path.join(projectRoot, 'dist', 'orion.exe');
|
|
48
|
+
const unixCandidates =
|
|
49
|
+
process.platform === 'darwin'
|
|
50
|
+
? [path.join(projectRoot, 'dist', 'orion-darwin'), path.join(projectRoot, 'dist', 'orion')]
|
|
51
|
+
: [path.join(projectRoot, 'dist', 'orion-linux'), path.join(projectRoot, 'dist', 'orion')];
|
|
52
|
+
const binPath = unixCandidates.find((p) => fs.existsSync(p));
|
|
53
|
+
|
|
54
|
+
if (process.platform === 'win32' && fs.existsSync(exePath)) {
|
|
55
|
+
launch(exePath, args);
|
|
56
|
+
} else if (binPath) {
|
|
57
|
+
launch(binPath, args);
|
|
31
58
|
} else {
|
|
32
59
|
// Fallback if running from development workspace with source
|
|
33
|
-
const scriptPath = path.join(projectRoot, 'src', 'orion', 'engine', '
|
|
34
|
-
if (fs.existsSync(scriptPath)) {
|
|
35
|
-
|
|
36
|
-
|
|
37
|
-
|
|
38
|
-
|
|
39
|
-
|
|
60
|
+
const scriptPath = path.join(projectRoot, 'src', 'orion', 'engine', 'cli.py');
|
|
61
|
+
if (!fs.existsSync(scriptPath)) {
|
|
62
|
+
fail('Orion executable not found: no dist binary and no source tree present.');
|
|
63
|
+
}
|
|
64
|
+
const pythonEnv = Object.assign({}, process.env, {
|
|
65
|
+
PYTHONPATH: path.join(projectRoot, 'src') + (process.env.PYTHONPATH ? path.delimiter + process.env.PYTHONPATH : '')
|
|
66
|
+
});
|
|
67
|
+
// ORN-P4-027: robust interpreter resolution -- try candidates in order;
|
|
68
|
+
// ENOENT on one candidate advances to the next instead of crashing.
|
|
69
|
+
const candidates = process.platform === 'win32'
|
|
70
|
+
? [['py', ['-3']], ['python', []], ['python3', []]]
|
|
71
|
+
: [['python3', []], ['python', []]];
|
|
72
|
+
|
|
73
|
+
const tryCandidate = (index) => {
|
|
74
|
+
if (index >= candidates.length) {
|
|
75
|
+
fail(`No Python interpreter found (tried: ${candidates.map((c) => c[0]).join(', ')}). Orion requires Python 3.11+.`);
|
|
76
|
+
}
|
|
77
|
+
const [cmd, prefix] = candidates[index];
|
|
78
|
+
const child = spawn(cmd, [...prefix, scriptPath, ...args], {
|
|
40
79
|
stdio: 'inherit',
|
|
41
80
|
env: pythonEnv,
|
|
42
81
|
cwd: process.cwd()
|
|
43
82
|
});
|
|
83
|
+
child.on('error', (err) => {
|
|
84
|
+
if (err.code === 'ENOENT') {
|
|
85
|
+
tryCandidate(index + 1);
|
|
86
|
+
} else {
|
|
87
|
+
fail(`Failed to launch '${cmd}': ${err.message}`);
|
|
88
|
+
}
|
|
89
|
+
});
|
|
44
90
|
child.on('close', (code) => process.exit(code || 0));
|
|
45
|
-
}
|
|
46
|
-
|
|
47
|
-
process.exit(1);
|
|
48
|
-
}
|
|
91
|
+
};
|
|
92
|
+
tryCandidate(0);
|
|
49
93
|
}
|
package/dist/orion.exe
CHANGED
|
Binary file
|