clckernel 1.2.6

package/tools/docker_guard.py

@@ -0,0 +1,210 @@
+#!/usr/bin/env python3
+"""
+Docker Guard
+Checks for Docker security issues in changed Dockerfile and docker-compose files.
+Self-contained: uses only Python stdlib (pathlib, subprocess, json, sys, re).
+"""
+from __future__ import annotations
+
+import json
+import os
+import re
+import subprocess
+import sys
+from pathlib import Path
+
+
+def _get_changed_dockerfiles(target_dir: str) -> list[str] | None:
+    """Return list of changed Docker-related files from git diff, or None on failure."""
+    for ref in ("HEAD~1", "--cached"):
+        try:
+            args = ["git", "diff", "--name-only"]
+            if ref == "--cached":
+                args.append("--cached")
+            else:
+                args.append(ref)
+            out = subprocess.check_output(
+                args, cwd=target_dir,
+                stderr=subprocess.DEVNULL, text=True,
+            )
+            files = [
+                f.strip() for f in out.splitlines()
+                if f.strip().endswith(('Dockerfile', 'docker-compose.yml', 'docker-compose.yaml'))
+                or 'Dockerfile' in f
+                or 'docker-compose' in f
+            ]
+            if files:
+                return files
+        except (subprocess.CalledProcessError, FileNotFoundError):
+            continue
+    return None
+
+
+def _read_file_content(full_path: Path) -> str | None:
+    """Read file content safely, return None on failure."""
+    try:
+        return full_path.read_text(encoding="utf-8", errors="replace")
+    except (OSError, PermissionError):
+        return None
+
+
+def _check_dockerfile(content: str, filepath: str) -> list[dict]:
+    """Check a Dockerfile for security issues."""
+    violations: list[dict] = []
+    lines = content.splitlines()
+
+    has_user = False
+    user_is_root = False
+    has_healthcheck = False
+    env_secrets: list[tuple[int, str]] = []
+
+    secret_patterns = [
+        re.compile(r'^\s*ENV\s+(AWS_SECRET_ACCESS_KEY|DB_PASSWORD|SECRET_KEY|PASSWORD|TOKEN|API_KEY)\s*=', re.IGNORECASE),
+        re.compile(r'^\s*ENV\s+\w*SECRET\w*\s*=', re.IGNORECASE),
+        re.compile(r'^\s*ENV\s+\w*PASSWORD\w*\s*=', re.IGNORECASE),
+    ]
+
+    for lineno, line in enumerate(lines, start=1):
+        stripped = line.strip()
+
+        # Check USER directive
+        if stripped.startswith('USER '):
+            has_user = True
+            user_val = stripped[5:].split()[0] if len(stripped) > 5 else ''
+            if user_val.lower() in ('root', '0', 'root:x:0:0'):
+                user_is_root = True
+
+        # Check for HEALTHCHECK
+        if stripped.startswith('HEALTHCHECK '):
+            has_healthcheck = True
+
+        # Check for ENV secrets
+        for pattern in secret_patterns:
+            if pattern.match(stripped):
+                env_secrets.append((lineno, stripped))
+
+    if not has_user:
+        violations.append({
+            "file": filepath,
+            "lineNo": 0,
+            "issue": "missing_user",
+            "snippet": "No USER directive found - container runs as root",
+        })
+    elif user_is_root:
+        violations.append({
+            "file": filepath,
+            "lineNo": 0,
+            "issue": "user_is_root",
+            "snippet": "USER directive runs as root - use non-root user",
+        })
+
+    for lineno, snippet in env_secrets:
+        violations.append({
+            "file": filepath,
+            "lineNo": lineno,
+            "issue": "env_secret",
+            "snippet": snippet[:120],
+        })
+
+    if not has_healthcheck:
+        violations.append({
+            "file": filepath,
+            "lineNo": 0,
+            "issue": "missing_healthcheck",
+            "snippet": "No HEALTHCHECK directive found",
+        })
+
+    return violations
+
+
+def _check_docker_compose(content: str, filepath: str) -> list[dict]:
+    """Check a docker-compose file for security issues."""
+    violations: list[dict] = []
+
+    # Look for hardcoded secrets in environment variables
+    secret_patterns = [
+        re.compile(r'^\s*-\s+(AWS_SECRET_ACCESS_KEY|DB_PASSWORD|SECRET_KEY|PASSWORD|TOKEN|API_KEY)\s*=\s*["\']', re.IGNORECASE),
+        re.compile(r'^\s*-\s+\w*SECRET\w*\s*=\s*["\']', re.IGNORECASE),
+        re.compile(r'^\s*-\s+\w*PASSWORD\w*\s*=\s*["\']', re.IGNORECASE),
+    ]
+
+    privilege_pattern = re.compile(r'^\s*privileged:\s*true', re.IGNORECASE)
+
+    lines = content.splitlines()
+    for lineno, line in enumerate(lines, start=1):
+        for pattern in secret_patterns:
+            if pattern.match(line):
+                violations.append({
+                    "file": filepath,
+                    "lineNo": lineno,
+                    "issue": "compose_env_secret",
+                    "snippet": line.strip()[:120],
+                })
+
+        if privilege_pattern.match(line.strip()):
+            violations.append({
+                "file": filepath,
+                "lineNo": lineno,
+                "issue": "privileged_container",
+                "snippet": line.strip(),
+            })
+
+    return violations
+
+
+def check(target_dir: str | None = None) -> dict:
+    """
+    Scan changed Docker files for security issues.
+
+    Returns:
+        dict with keys: exit_code, skipped, name, data
+    """
+    dir_path = target_dir or os.getcwd()
+
+    files = _get_changed_dockerfiles(dir_path)
+    if files is None:
+        return {
+            "exit_code": 0, "skipped": True, "name": "docker_guard",
+            "data": {"findings": [], "message": "No git diff available"},
+        }
+
+    if not files:
+        return {
+            "exit_code": 0, "skipped": False, "name": "docker_guard",
+            "data": {"findings": [], "message": "No changed Docker files to scan"},
+        }
+
+    all_violations: list[dict] = []
+
+    for filepath in files:
+        full_path = Path(dir_path) / filepath
+        if not full_path.exists():
+            continue
+
+        content = _read_file_content(full_path)
+        if content is None:
+            continue
+
+        if 'docker-compose' in filepath:
+            all_violations.extend(_check_docker_compose(content, filepath))
+        else:
+            all_violations.extend(_check_dockerfile(content, filepath))
+
+    total = len(all_violations)
+    if total:
+        msg = f"{total} Docker violation(s) found"
+    else:
+        msg = "No Docker violations found"
+
+    return {
+        "exit_code": 1 if total else 0,
+        "skipped": False,
+        "name": "docker_guard",
+        "data": {"findings": all_violations, "message": msg},
+    }
+
+
+if __name__ == "__main__":
+    result = check(sys.argv[1] if len(sys.argv) > 1 else None)
+    print(json.dumps(result, indent=2))
+    sys.exit(result["exit_code"])

package/tools/postgres_guard.py

@@ -0,0 +1,192 @@
+#!/usr/bin/env python3
+"""
+PostgreSQL Guard
+Checks for PostgreSQL security issues (SQL injection, hstore misuse) in changed Python files.
+Self-contained: uses only Python stdlib (ast, pathlib, subprocess, json, sys).
+"""
+from __future__ import annotations
+
+import ast
+import json
+import os
+import subprocess
+import sys
+from pathlib import Path
+
+
+def _get_changed_files(target_dir: str) -> list[str] | None:
+    """Return list of changed Python files from git diff, or None on failure."""
+    for ref in ("HEAD~1", "--cached"):
+        try:
+            args = ["git", "diff", "--name-only"]
+            if ref == "--cached":
+                args.append("--cached")
+            else:
+                args.append(ref)
+            out = subprocess.check_output(
+                args, cwd=target_dir,
+                stderr=subprocess.DEVNULL, text=True,
+            )
+            files = [
+                f.strip() for f in out.splitlines()
+                if f.strip().endswith('.py')
+            ]
+            if files:
+                return files
+        except (subprocess.CalledProcessError, FileNotFoundError):
+            continue
+    return None
+
+
+class PostgresVisitor(ast.NodeVisitor):
+    """AST visitor that detects PostgreSQL security issues."""
+
+    def __init__(self, filepath: str):
+        self.filepath = filepath
+        self.violations: list[dict] = []
+
+    def _add_violation(self, lineno: int, issue: str, snippet: str):
+        self.violations.append({
+            "file": self.filepath,
+            "lineNo": lineno,
+            "issue": issue,
+            "snippet": snippet[:120],
+        })
+
+    def _is_sql_method(self, node: ast.expr) -> bool:
+        """Check if expression is a SQL-related method call."""
+        if isinstance(node, ast.Attribute):
+            return node.attr in ('execute', 'executemany', 'callproc', 'cursor')
+        return False
+
+    def _has_formatted_sql(self, node: ast.Call) -> bool:
+        """Check if a SQL call has formatted (injected) string arguments."""
+        for arg in node.args:
+            # f-string SQL
+            if isinstance(arg, ast.JoinedStr):
+                return True
+            # % formatted string
+            if isinstance(arg, ast.BinOp) and isinstance(arg.op, ast.Mod):
+                return True
+            # str.format() call
+            if isinstance(arg, ast.Call):
+                if isinstance(arg.func, ast.Attribute) and arg.func.attr == 'format':
+                    return True
+        return False
+
+    def _check_hstore_raw(self, node: ast.Call) -> bool:
+        """Check for raw hstore usage that bypasses parameterized queries."""
+        # Look for cursor.execute("...::hstore...") patterns
+        for arg in node.args:
+            if isinstance(arg, ast.Constant) and isinstance(arg.value, str):
+                if '::hstore' in arg.value or "hstore('" in arg.value:
+                    return True
+        return False
+
+    def visit_Call(self, node: ast.Call):
+        # Check for cursor.execute(), connection.execute(), etc.
+        if self._is_sql_method(node):
+            # Check for raw SQL with string formatting (f-string, %, .format())
+            if self._has_formatted_sql(node):
+                self._add_violation(
+                    node.lineno or 0,
+                    "sql_string_formatting",
+                    "SQL query uses string formatting (f-string, %, .format()) - SQL injection risk"
+                )
+
+            # Check for raw hstore usage
+            if self._check_hstore_raw(node):
+                self._add_violation(
+                    node.lineno or 0,
+                    "hstore_raw_usage",
+                    "Raw hstore expression bypasses parameterized queries"
+                )
+
+            # Check for string concatenation in SQL
+            for arg in node.args:
+                if isinstance(arg, ast.BinOp) and isinstance(arg.op, ast.Add):
+                    # String concatenation like "SELECT * FROM " + table
+                    if isinstance(arg.left, ast.Constant) or isinstance(arg.right, ast.Constant):
+                        self._add_violation(
+                            node.lineno or 0,
+                            "sql_string_concatenation",
+                            "SQL query uses string concatenation - SQL injection risk"
+                        )
+                        break
+
+        # Check for psycopg2 sql.SQL() with .format() or .compose()
+        if isinstance(node.func, ast.Attribute):
+            if node.func.attr in ('sql', 'SQL'):
+                # Check if composed with format
+                for keyword in node.keywords:
+                    if keyword.arg in ('format', 'compose'):
+                        self._add_violation(
+                            node.lineno or 0,
+                            "sql_composition_risk",
+                            "psycopg2 sql.SQL composition may bypass escaping"
+                        )
+
+        self.generic_visit(node)
+
+
+def check(target_dir: str | None = None) -> dict:
+    """
+    Scan changed Python files for PostgreSQL security issues.
+
+    Returns:
+        dict with keys: exit_code, skipped, name, data
+    """
+    dir_path = target_dir or os.getcwd()
+
+    files = _get_changed_files(dir_path)
+    if files is None:
+        return {
+            "exit_code": 0, "skipped": True, "name": "postgres_guard",
+            "data": {"findings": [], "message": "No git diff available"},
+        }
+
+    if not files:
+        return {
+            "exit_code": 0, "skipped": False, "name": "postgres_guard",
+            "data": {"findings": [], "message": "No changed Python files to scan"},
+        }
+
+    all_violations: list[dict] = []
+
+    for filepath in files:
+        full_path = Path(dir_path) / filepath
+        if not full_path.exists():
+            continue
+
+        try:
+            content = full_path.read_text(encoding="utf-8", errors="replace")
+        except (OSError, PermissionError):
+            continue
+
+        try:
+            tree = ast.parse(content, filename=str(full_path))
+        except SyntaxError:
+            continue
+
+        visitor = PostgresVisitor(filepath)
+        visitor.visit(tree)
+        all_violations.extend(visitor.violations)
+
+    total = len(all_violations)
+    if total:
+        msg = f"{total} PostgreSQL violation(s) found"
+    else:
+        msg = "No PostgreSQL violations found"
+
+    return {
+        "exit_code": 1 if total else 0,
+        "skipped": False,
+        "name": "postgres_guard",
+        "data": {"findings": all_violations, "message": msg},
+    }
+
+
+if __name__ == "__main__":
+    result = check(sys.argv[1] if len(sys.argv) > 1 else None)
+    print(json.dumps(result, indent=2))
+    sys.exit(result["exit_code"])

package/tools/redis_guard.py

@@ -0,0 +1,197 @@
+#!/usr/bin/env python3
+"""
+Redis Guard
+Checks for Redis configuration security issues in changed Python files.
+Self-contained: uses only Python stdlib (ast, pathlib, subprocess, json, sys).
+"""
+from __future__ import annotations
+
+import ast
+import json
+import os
+import subprocess
+import sys
+from pathlib import Path
+
+
+def _get_changed_files(target_dir: str) -> list[str] | None:
+    """Return list of changed Python files from git diff, or None on failure."""
+    for ref in ("HEAD~1", "--cached"):
+        try:
+            args = ["git", "diff", "--name-only"]
+            if ref == "--cached":
+                args.append("--cached")
+            else:
+                args.append(ref)
+            out = subprocess.check_output(
+                args, cwd=target_dir,
+                stderr=subprocess.DEVNULL, text=True,
+            )
+            files = [
+                f.strip() for f in out.splitlines()
+                if f.strip().endswith('.py')
+            ]
+            if files:
+                return files
+        except (subprocess.CalledProcessError, FileNotFoundError):
+            continue
+    return None
+
+
+class RedisVisitor(ast.NodeVisitor):
+    """AST visitor that detects Redis configuration security issues."""
+
+    def __init__(self, filepath: str):
+        self.filepath = filepath
+        self.violations: list[dict] = []
+
+    def _add_violation(self, lineno: int, issue: str, snippet: str):
+        self.violations.append({
+            "file": self.filepath,
+            "lineNo": lineno,
+            "issue": issue,
+            "snippet": snippet[:120],
+        })
+
+    def _is_redis_url(self, node: ast.expr) -> bool:
+        """Check if expression looks like a redis:// URL."""
+        if isinstance(node, ast.Constant) and isinstance(node.value, str):
+            val = node.value.lower()
+            return 'redis://' in val or 'rediss://' in val
+        return False
+
+    def _has_password_check(self, keywords: list[ast.keyword]) -> bool:
+        """Check if password or auth is provided in Redis connection keywords."""
+        for kw in keywords:
+            if kw.arg in ('password', 'secret', 'ssl_password'):
+                if isinstance(kw.value, ast.Constant) and kw.value.value:
+                    return True
+                # Check for str() wrapper which might hide empty password
+                if isinstance(kw.value, ast.Call):
+                    return False  # Treat wrapped values as potentially missing
+        return False
+
+    def visit_Call(self, node: ast.Call):
+        # Check for Redis() or redis.Redis() instantiation
+        is_redis_call = False
+        if isinstance(node.func, ast.Name) and node.func.id == 'Redis':
+            is_redis_call = True
+        elif isinstance(node.func, ast.Attribute) and node.func.attr == 'Redis':
+            is_redis_call = True
+
+        if is_redis_call:
+            has_decode = False
+            has_timeout = False
+            has_password = self._has_password_check(node.keywords)
+            has_hardcoded_url = False
+
+            for keyword in node.keywords:
+                if keyword.arg == 'decode_responses':
+                    if isinstance(keyword.value, ast.Constant) and keyword.value.value is True:
+                        has_decode = True
+                elif keyword.arg == 'socket_connect_timeout':
+                    has_timeout = True
+                elif keyword.arg == 'host' and not has_password:
+                    # Host without password on decode_responses is risky
+                    pass
+                elif keyword.arg in ('url', 'connection_pool'):
+                    # url or connection_pool might contain credentials
+                    pass
+
+            # Check positional args for decode_responses
+            if node.args:
+                # First positional arg could be host or url
+                if len(node.args) >= 1:
+                    arg = node.args[0]
+                    if isinstance(arg, ast.Constant) and isinstance(arg.value, str):
+                        if self._is_redis_url(arg):
+                            has_hardcoded_url = True
+
+            # decode_responses=True without password is a security risk
+            if has_decode and not has_password:
+                self._add_violation(
+                    node.lineno or 0,
+                    "decode_responses_without_password",
+                    "Redis decode_responses=True without password authentication"
+                )
+
+            # Missing socket_connect_timeout
+            if not has_timeout:
+                self._add_violation(
+                    node.lineno or 0,
+                    "missing_socket_connect_timeout",
+                    "Redis connection missing socket_connect_timeout"
+                )
+
+            # Hardcoded Redis URL
+            if has_hardcoded_url:
+                self._add_violation(
+                    node.lineno or 0,
+                    "hardcoded_redis_url",
+                    "Hardcoded redis:// URL in Redis() call"
+                )
+
+        self.generic_visit(node)
+
+
+def check(target_dir: str | None = None) -> dict:
+    """
+    Scan changed Python files for Redis security issues.
+
+    Returns:
+        dict with keys: exit_code, skipped, name, data
+    """
+    dir_path = target_dir or os.getcwd()
+
+    files = _get_changed_files(dir_path)
+    if files is None:
+        return {
+            "exit_code": 0, "skipped": True, "name": "redis_guard",
+            "data": {"findings": [], "message": "No git diff available"},
+        }
+
+    if not files:
+        return {
+            "exit_code": 0, "skipped": False, "name": "redis_guard",
+            "data": {"findings": [], "message": "No changed Python files to scan"},
+        }
+
+    all_violations: list[dict] = []
+
+    for filepath in files:
+        full_path = Path(dir_path) / filepath
+        if not full_path.exists():
+            continue
+
+        try:
+            content = full_path.read_text(encoding="utf-8", errors="replace")
+        except (OSError, PermissionError):
+            continue
+
+        try:
+            tree = ast.parse(content, filename=str(full_path))
+        except SyntaxError:
+            continue
+
+        visitor = RedisVisitor(filepath)
+        visitor.visit(tree)
+        all_violations.extend(visitor.violations)
+
+    total = len(all_violations)
+    if total:
+        msg = f"{total} Redis violation(s) found"
+    else:
+        msg = "No Redis violations found"
+
+    return {
+        "exit_code": 1 if total else 0,
+        "skipped": False,
+        "name": "redis_guard",
+        "data": {"findings": all_violations, "message": msg},
+    }
+
+
+if __name__ == "__main__":
+    result = check(sys.argv[1] if len(sys.argv) > 1 else None)
+    print(json.dumps(result, indent=2))
+    sys.exit(result["exit_code"])