adl-toolkit 0.0.0-stage → 0.1.3

package/adl_drift/lang/java/detectors/security.py

@@ -0,0 +1,386 @@
+"""High-signal, single-file Java security checks (taint stays in P4.6)."""
+
+from __future__ import annotations
+
+import re
+from pathlib import Path
+from typing import Dict, List, Optional, Set
+
+from tree_sitter import Node, Tree
+
+from adl_drift.lang.java.detectors.base import DeclaredTypes, JavaDetector
+from adl_drift.lang.java.scopes import TypeScopes
+from adl_drift.utils.types import Pattern, PatternCategory
+
+SQL_METHODS = {"execute", "executeQuery", "executeUpdate", "prepareStatement", "createNativeQuery"}
+JDBC_STATEMENT_TYPES = {"Statement", "PreparedStatement", "CallableStatement"}
+SQL_WORDS = re.compile(r"(?i)\b(select|insert|update|delete|merge|drop|alter)\b")
+SECRET_NAME = re.compile(r"(?i)(?:^|_)(password|passwd|secret|token|api_?key)(?:_|$)")
+WEAK_DIGESTS = {"MD2", "MD5", "SHA-1", "SHA1"}
+# JDBC PreparedStatement/CallableStatement parameter-binding setters + JPA's
+# setParameter/registerOutParameter. Deliberately excludes the same-prefixed
+# Statement/Query *configuration* setters (setQueryTimeout, setMaxRows,
+# setFetchSize, setMaxResults, setFirstResult, setHint, setFlushMode,
+# setEscapeProcessing, setCursorName, setPoolable, setFetchDirection,
+# setLargeMaxRows, ...) which bind nothing and must not suppress a real flag.
+BIND_PARAMETER_METHODS = {
+    "setArray", "setAsciiStream", "setBigDecimal", "setBinaryStream", "setBlob",
+    "setBoolean", "setByte", "setBytes", "setCharacterStream", "setClob",
+    "setDate", "setDouble", "setFloat", "setInt", "setLong",
+    "setNCharacterStream", "setNClob", "setNString", "setNull", "setObject",
+    "setRef", "setRowId", "setSQLXML", "setShort", "setString", "setTime",
+    "setTimestamp", "setUnicodeStream", "setURL", "setParameter",
+    "registerOutParameter",
+}
+# Scopes _has_subsequent_bind should search up to — method/constructor/lambda
+# bodies, NOT `_tp._declaration_scope`'s notion of scope (which stops at the
+# nearest enclosing `block`, e.g. an `if`/`else` arm — too narrow when the
+# statement variable is assigned inside a branch but bound/executed after it).
+METHOD_SCOPE_TYPES = ("method_declaration", "constructor_declaration", "lambda_expression")
+# `switch_rule` = arrow form (`case 1 -> ...;`, Java 14+, never falls
+# through); `switch_block_statement_group` = classic colon form (`case 1:
+# ...`, falls through to the next group without an explicit terminator).
+SWITCH_GROUP_TYPES = ("switch_rule", "switch_block_statement_group")
+SWITCH_TERMINATOR_TYPES = (
+    "break_statement", "return_statement", "throw_statement",
+    "continue_statement", "yield_statement",
+)
+
+
+class JavaSecurityDetector(JavaDetector):
+    @property
+    def category(self) -> PatternCategory:
+        return PatternCategory.SECURITY
+
+    def detect(self, tree: Tree, source_bytes: bytes, file_path: Path) -> List[Pattern]:
+        root = tree.root_node
+        imports = self._imports(root, source_bytes)
+        types = self._declared_types(root, source_bytes)
+        local_types = self._declared_type_names(root, source_bytes)
+        patterns: List[Pattern] = []
+        for node in self._walk(root):
+            if node.type == "method_invocation":
+                patterns.extend(self._check_invocation(
+                    node, source_bytes, file_path, types, imports, local_types
+                ))
+            elif node.type == "object_creation_expression":
+                pattern = self._check_constructor(
+                    node, source_bytes, file_path, imports, local_types
+                )
+                if pattern:
+                    patterns.append(pattern)
+            elif node.type == "variable_declarator":
+                pattern = self._check_secret(node, source_bytes, file_path)
+                if pattern:
+                    patterns.append(pattern)
+        return patterns
+
+    def _check_invocation(
+        self, node: Node, source: bytes, path: Path,
+        types: DeclaredTypes, imports: Set[str], local_types: TypeScopes,
+    ) -> List[Pattern]:
+        method = self._text(node.child_by_field_name("name"), source)
+        receiver = self._text(node.child_by_field_name("object"), source)
+        first_arg = self._first_argument(node)
+        out: List[Pattern] = []
+
+        runtime_type = receiver.removesuffix(".getRuntime()")
+        declared_type = self._declared_type(receiver, types, node)
+        if method == "exec" and (
+            self._type_has_provenance(
+                runtime_type, imports, local_types, "java.lang.Runtime", node
+            )
+            or self._type_has_provenance(
+                declared_type, imports, local_types, "java.lang.Runtime", node
+            )
+        ):
+            out.append(self._finding(
+                "runtime_exec", "Runtime.exec executes an operating-system command",
+                node, path, 0.95, "HIGH", "Runtime receiver invokes exec",
+            ))
+        elif method == "readObject" and self._type_has_provenance(
+            self._declared_type(receiver, types, node), imports, local_types,
+            "java.io.ObjectInputStream", node,
+        ):
+            out.append(self._finding(
+                "unsafe_deserialization", "ObjectInputStream.readObject may instantiate unsafe objects",
+                node, path, 0.95, "HIGH", "Java native deserialization call",
+            ))
+
+        raw_sql_type = self._declared_type(receiver, types, node)
+        sql_type = self._simple_type(raw_sql_type)
+        sql_types = {
+            "Statement": ("java.sql.Statement",),
+            "PreparedStatement": ("java.sql.PreparedStatement",),
+            "CallableStatement": ("java.sql.CallableStatement",),
+            "Connection": ("java.sql.Connection",),
+            "EntityManager": (
+                "jakarta.persistence.EntityManager", "javax.persistence.EntityManager",
+            ),
+        }
+        sql_receiver = any(
+            self._type_has_provenance(raw_sql_type, imports, local_types, qualified, node)
+            for qualified in sql_types.get(sql_type, ())
+        )
+        sql_method = method in SQL_METHODS or (
+            sql_type in JDBC_STATEMENT_TYPES and method.startswith("execute")
+        )
+        if sql_method and sql_receiver and first_arg is not None \
+                and first_arg.type == "binary_expression" \
+                and SQL_WORDS.search(self._text(first_arg, source)):
+            confidence = 0.92
+            reason = "SQL keyword and concatenation occur in the SQL argument"
+            is_bound = method in ("prepareStatement", "createNativeQuery") and (
+                self._is_immediately_chained_bind(node, source)
+                or self._has_subsequent_bind(self._bound_variable_name(node, source), node, source)
+            )
+            if is_bound:
+                # The statement produced here is bound via setXxx(...)/setParameter(...) before
+                # execute — the classic dynamic-IN-clause pattern, where the concatenated text is
+                # typically a placeholder list, not attacker data. Can't prove it's safe from
+                # syntax alone (a table/column name could still be concatenated in), so this stays
+                # a low-confidence lead (CONFIDENCE.md's "Guess" band) rather than a hard flag.
+                confidence = 0.35
+                reason = (
+                    "SQL keyword and concatenation occur in the SQL argument, but the statement "
+                    "is bound via setXxx/setParameter before execute — likely a safe "
+                    "dynamic-placeholder pattern rather than unparameterized concatenation"
+                )
+            out.append(self._finding(
+                "sql_string_concatenation", "SQL statement is assembled with string concatenation",
+                node, path, confidence, "HIGH", reason,
+                {"method": method},
+            ))
+
+        if method == "getInstance" and first_arg is not None:
+            algorithm = self._string(first_arg, source)
+            if self._type_has_provenance(
+                    receiver, imports, local_types, "java.security.MessageDigest", node) \
+                    and algorithm.upper() in WEAK_DIGESTS:
+                out.append(self._finding(
+                    "weak_message_digest", f"Weak message digest: {algorithm}",
+                    node, path, 0.98, "HIGH", "MessageDigest requests a collision-prone algorithm",
+                ))
+            elif self._type_has_provenance(
+                    receiver, imports, local_types, "javax.crypto.Cipher", node) \
+                    and self._weak_cipher(algorithm):
+                out.append(self._finding(
+                    "weak_cipher", f"Weak cipher transformation: {algorithm}",
+                    node, path, 0.9, "HIGH", "Cipher transformation is obsolete or uses ECB mode",
+                ))
+
+        reflection_types = {
+            "AccessibleObject": "java.lang.reflect.AccessibleObject",
+            "Field": "java.lang.reflect.Field",
+            "Method": "java.lang.reflect.Method",
+            "Constructor": "java.lang.reflect.Constructor",
+        }
+        raw_reflection_type = self._declared_type(receiver, types, node)
+        reflection_receiver = any(
+            self._type_has_provenance(
+                raw_reflection_type, imports, local_types, qualified, node
+            )
+            for qualified in reflection_types.values()
+        ) or any(marker in receiver for marker in ("getDeclaredField(", "getDeclaredMethod("))
+        if method == "setAccessible" and reflection_receiver \
+                and self._text(first_arg, source) == "true":
+            out.append(self._finding(
+                "unsafe_reflection_access", "Reflection bypasses Java access checks",
+                node, path, 0.9, "MEDIUM", "setAccessible(true) disables member access checks",
+            ))
+        return out
+
+    def _bound_variable_name(self, node: Node, source: bytes) -> str:
+        parent = node.parent
+        if parent is not None and parent.type == "variable_declarator" \
+                and parent.child_by_field_name("value") == node:
+            return self._text(parent.child_by_field_name("name"), source)
+        if parent is not None and parent.type == "assignment_expression" \
+                and parent.child_by_field_name("right") == node:
+            return self._text(parent.child_by_field_name("left"), source)
+        return ""
+
+    def _is_immediately_chained_bind(self, node: Node, source: bytes) -> bool:
+        current = node
+        parent = current.parent
+        while parent is not None and parent.type == "method_invocation" \
+                and parent.child_by_field_name("object") == current:
+            if self._text(parent.child_by_field_name("name"), source) in BIND_PARAMETER_METHODS:
+                return True
+            current = parent
+            parent = current.parent
+        return False
+
+    def _enclosing_method_scope(self, node: Node) -> Node:
+        parent = node.parent
+        while parent is not None and parent.type not in METHOD_SCOPE_TYPES:
+            parent = parent.parent
+        return parent or node
+
+    @staticmethod
+    def _direct_child_toward(ancestor: Node, descendant: Node) -> Optional[Node]:
+        current = descendant
+        while current.parent is not None and current.parent != ancestor:
+            current = current.parent
+        return current if current.parent == ancestor else None
+
+    def _is_exclusive_branch(self, node: Node, candidate: Node) -> bool:
+        """True when `node` and `candidate` sit in different, mutually
+        exclusive arms of the same `if`/`else` or `switch` — a reassignment
+        or bind call on `candidate`'s side must not affect `node`'s side."""
+        node_ancestor_ids = set()
+        walker = node
+        while walker is not None:
+            node_ancestor_ids.add(walker.id)
+            walker = walker.parent
+        walker = candidate
+        while walker is not None and walker.id not in node_ancestor_ids:
+            walker = walker.parent
+        if walker is None:
+            return False
+        if walker.type == "if_statement":
+            consequence = walker.child_by_field_name("consequence")
+            alternative = walker.child_by_field_name("alternative")
+            node_branch = self._direct_child_toward(walker, node)
+            candidate_branch = self._direct_child_toward(walker, candidate)
+            node_side = "consequence" if node_branch == consequence \
+                else "alternative" if node_branch == alternative else None
+            candidate_side = "consequence" if candidate_branch == consequence \
+                else "alternative" if candidate_branch == alternative else None
+            return bool(node_side and candidate_side and node_side != candidate_side)
+        if walker.type == "switch_block":
+            return self._is_exclusive_switch_branch(walker, node, candidate)
+        return False
+
+    def _is_exclusive_switch_branch(self, block: Node, node: Node, candidate: Node) -> bool:
+        """True when `node` and `candidate` sit in different `case`/`default`
+        arms of the same `switch` that cannot both run for one evaluation of
+        the switch subject — arrow-form (`switch_rule`) arms never fall
+        through, so any two distinct arms qualify; classic colon-form arms
+        (`switch_block_statement_group`) fall through to the next arm unless
+        terminated, so every arm from `node`'s through the one just before
+        `candidate`'s must end in break/return/throw/continue/yield for the
+        two to be considered exclusive — otherwise `candidate`'s reassignment
+        can still run on `node`'s own execution path. `block` (the LCA when
+        node/candidate sit in different arms) is the `switch_block` itself —
+        the groups' direct parent — not the enclosing `switch_expression`,
+        which sits one level further up via its `body` field."""
+        groups = [c for c in block.children if c.type in SWITCH_GROUP_TYPES]
+        node_group = self._direct_child_toward(block, node)
+        candidate_group = self._direct_child_toward(block, candidate)
+        if node_group not in groups or candidate_group not in groups:
+            return False
+        if node_group is candidate_group:
+            return False
+        node_index = groups.index(node_group)
+        candidate_index = groups.index(candidate_group)
+        if candidate_index <= node_index:
+            return False
+        if node_group.type == "switch_rule":
+            return True
+        # Colon-form groups fall through into the *next* physical group when
+        # they lack a terminator, so control reaches `candidate_group` unless
+        # some group at or after `node_group` (and before `candidate_group`)
+        # terminates first — it doesn't matter whether the groups between
+        # that point and `candidate_group` fall through, they're never
+        # reached from `node_group`'s side either way.
+        return any(
+            self._switch_group_terminates(group)
+            for group in groups[node_index:candidate_index]
+        )
+
+    @staticmethod
+    def _switch_group_terminates(group: Node) -> bool:
+        return any(child.type in SWITCH_TERMINATOR_TYPES for child in group.children)
+
+    def _has_subsequent_bind(self, var_name: str, node: Node, source: bytes) -> bool:
+        if not var_name:
+            return False
+        scope = self._enclosing_method_scope(node)
+        for candidate in self._walk(scope):
+            if candidate.start_byte <= node.end_byte:
+                continue
+            if self._is_exclusive_branch(node, candidate):
+                continue
+            if candidate.type == "assignment_expression" \
+                    and self._text(candidate.child_by_field_name("left"), source) == var_name:
+                # var_name is reassigned before any bind call was found for
+                # *this* statement — a later statement's bind call belongs to
+                # the new value, not the one `node` produced.
+                return False
+            if candidate.type == "variable_declarator" \
+                    and self._text(candidate.child_by_field_name("name"), source) == var_name:
+                return False
+            if candidate.type != "method_invocation":
+                continue
+            if self._text(candidate.child_by_field_name("object"), source) != var_name:
+                continue
+            candidate_method = self._text(candidate.child_by_field_name("name"), source)
+            if candidate_method in BIND_PARAMETER_METHODS:
+                return True
+            if candidate_method.startswith("execute"):
+                # The statement already ran unbound at this call — a bind call
+                # appearing later (dead code, variable reuse, ...) does not
+                # retroactively parameterize the query that already executed.
+                return False
+        return False
+
+    def _check_constructor(
+        self, node: Node, source: bytes, path: Path,
+        imports: Set[str], local_types: TypeScopes,
+    ) -> Optional[Pattern]:
+        type_name = self._text(node.child_by_field_name("type"), source)
+        if not self._type_has_provenance(
+            type_name, imports, local_types, "java.lang.ProcessBuilder", node
+        ):
+            return None
+        return self._finding(
+            "process_builder", "ProcessBuilder creates an operating-system process",
+            node, path, 0.9, "HIGH", "ProcessBuilder constructor receives a command",
+        )
+
+    def _check_secret(self, node: Node, source: bytes, path: Path) -> Optional[Pattern]:
+        name = self._text(node.child_by_field_name("name"), source)
+        normalized_name = re.sub(r"([a-z0-9])([A-Z])", r"\1_\2", name).replace("$", "_")
+        value = node.child_by_field_name("value")
+        if not SECRET_NAME.search(normalized_name) or value is None \
+                or value.type != "string_literal":
+            return None
+        secret = self._string(value, source)
+        if len(secret) < 8:
+            return None
+        return self._finding(
+            "hardcoded_secret", f"Possible hardcoded secret: {name}",
+            # CONFIDENCE.md's "Pattern confidence" table bands a bare
+            # name+length regex guess (no entropy/context check) at 0.3 —
+            # this rule is that exact class of FP-prone match (e.g. `String
+            # passwordPrompt = "Please enter your password!!";`), so it
+            # can't carry a higher score than Python's own regex-only
+            # hardcoded-secret detector (0.6). Severity stays HIGH: severity
+            # answers "how bad if real", confidence answers "how likely" —
+            # the two axes are independent per CONFIDENCE.md.
+            node, path, 0.3, "HIGH", "Secret-like variable is assigned a non-trivial string literal",
+            {"key_name": name},
+        )
+
+    def _finding(
+        self, name: str, description: str, node: Node, path: Path,
+        confidence: float, severity: str, reason: str,
+        extra: Optional[Dict[str, str]] = None,
+    ) -> Pattern:
+        return self._make_pattern(
+            name=name, description=description, node=node, file_path=path,
+            confidence=confidence,
+            metadata={"severity": severity, "reason": reason, **(extra or {})},
+        )
+
+    def _string(self, node: Node, source: bytes) -> str:
+        if node.type != "string_literal":
+            return ""
+        raw = self._text(node, source)
+        return raw[1:-1] if len(raw) >= 2 else ""
+
+    @staticmethod
+    def _weak_cipher(algorithm: str) -> bool:
+        upper = algorithm.upper()
+        return upper in {"DES", "DESEDE", "RC2", "RC4", "BLOWFISH"} or "/ECB/" in upper

package/adl_drift/lang/java/detectors/tests.py

@@ -0,0 +1,74 @@
+"""JUnit and TestNG detector."""
+
+from __future__ import annotations
+
+from pathlib import Path
+from typing import List, Set
+
+from tree_sitter import Node, Tree
+
+from adl_drift.lang.java.detectors.base import JavaDetector
+from adl_drift.utils.types import Pattern, PatternCategory
+
+JUNIT_PACKAGES = ("org.junit", "org.junit.jupiter.api", "org.junit.jupiter.params")
+TESTNG_PACKAGE = "org.testng.annotations"
+TEST_ANNOTATIONS = {"Test", "ParameterizedTest", "RepeatedTest", "TestFactory", "TestTemplate"}
+LIFECYCLE_ANNOTATIONS = {
+    "Before", "After", "BeforeClass", "AfterClass", "BeforeEach", "AfterEach",
+    "BeforeAll", "AfterAll", "BeforeMethod", "AfterMethod", "BeforeSuite", "AfterSuite",
+}
+
+
+class JavaTestDetector(JavaDetector):
+    @property
+    def category(self) -> PatternCategory:
+        return PatternCategory.TESTS
+
+    def detect(self, tree: Tree, source_bytes: bytes, file_path: Path) -> List[Pattern]:
+        imports = self._imports(tree.root_node, source_bytes)
+        patterns: List[Pattern] = []
+        for node in self._walk(tree.root_node):
+            if node.type == "method_declaration":
+                for annotation in self._annotations(node):
+                    name = self._annotation_name(annotation, source_bytes).rsplit(".", 1)[-1]
+                    framework = self._framework(annotation, source_bytes, imports)
+                    if framework and name in TEST_ANNOTATIONS:
+                        patterns.append(self._finding(
+                            "java_test", framework, name, node, file_path, 0.99,
+                            f"Method uses {framework} @{name}",
+                        ))
+                    elif framework and name in LIFECYCLE_ANNOTATIONS:
+                        patterns.append(self._finding(
+                            "test_lifecycle", framework, name, node, file_path, 0.98,
+                            f"Method uses {framework} lifecycle annotation @{name}",
+                        ))
+            elif node.type == "class_declaration" and "extends TestCase" in self._text(node, source_bytes):
+                if any(i.startswith("junit.framework.TestCase") for i in imports):
+                    patterns.append(self._finding(
+                        "junit3_testcase", "junit", "TestCase", node, file_path, 0.98,
+                        "Class extends imported junit.framework.TestCase",
+                    ))
+        return patterns
+
+    def _framework(self, annotation: Node, source: bytes, imports: Set[str]) -> str:
+        name = self._annotation_name(annotation, source)
+        simple = name.rsplit(".", 1)[-1]
+        if any(self._annotation_is(annotation, source, imports, f"{p}.{simple}")
+               for p in JUNIT_PACKAGES):
+            return "junit"
+        if self._annotation_is(annotation, source, imports, f"{TESTNG_PACKAGE}.{simple}"):
+            return "testng"
+        return ""
+
+    def _finding(
+        self, name: str, framework: str, annotation: str, node: Node,
+        path: Path, confidence: float, reason: str,
+    ) -> Pattern:
+        return self._make_pattern(
+            name=name,
+            description=f"{framework} test annotation: @{annotation}",
+            node=node,
+            file_path=path,
+            confidence=confidence,
+            metadata={"framework": framework, "annotation": annotation, "reason": reason},
+        )