secure-scan 1.2.2

package/src/analyzers/php/phpAnalyzer.ts

@@ -0,0 +1,280 @@
+/**
+ * PHP Analyzer
+ * Specialized analyzer for PHP code
+ */
+
+import { BaseAnalyzer } from '../base';
+import { ScannedFile, Finding, Rule, SupportedLanguage, Severity, ThreatType, FindingCategory } from '../../types';
+import { generateId, extractCodeContext } from '../../utils';
+import { getStandardsForThreat } from '../../rules/standards';
+
+/**
+ * PHP Analyzer Class
+ */
+export class PHPAnalyzer extends BaseAnalyzer {
+  name = 'PHP Analyzer';
+  languages: SupportedLanguage[] = ['php'];
+  version = '1.0.0';
+
+  /**
+   * Analyze PHP file
+   */
+  async analyze(file: ScannedFile, rules: Rule[]): Promise<Finding[]> {
+    const findings: Finding[] = [];
+
+    // Filter rules for PHP
+    const phpRules = rules.filter(r => r.languages.includes('php'));
+
+    // Run rule engine
+    const ruleFindings = await this.ruleEngine.analyzeFile(file, phpRules);
+    findings.push(...ruleFindings);
+
+    // Additional PHP-specific analysis
+    const customFindings = await this.customAnalysis(file);
+    findings.push(...customFindings);
+
+    return findings;
+  }
+
+  /**
+   * Custom PHP-specific analysis
+   */
+  private async customAnalysis(file: ScannedFile): Promise<Finding[]> {
+    const findings: Finding[] = [];
+    const lines = file.content.split('\n');
+
+    for (let i = 0; i < lines.length; i++) {
+      const line = lines[i];
+      const lineNum = i + 1;
+
+      // Check for dangerous functions
+      if (this.checkDangerousFunctions(line)) {
+        findings.push(this.createFinding(
+          file,
+          lineNum,
+          'Dangerous PHP Function',
+          'Use of a function that can execute arbitrary code or commands.',
+          Severity.CRITICAL,
+          ThreatType.DANGEROUS_FUNCTION
+        ));
+      }
+
+      // Check for file inclusion vulnerabilities
+      if (this.checkFileInclusion(line)) {
+        findings.push(this.createFinding(
+          file,
+          lineNum,
+          'Potential File Inclusion Vulnerability',
+          'File include with user-controlled input can lead to LFI/RFI.',
+          Severity.CRITICAL,
+          ThreatType.PATH_TRAVERSAL
+        ));
+      }
+
+      // Check for SQL injection patterns
+      if (this.checkSqlInjection(line)) {
+        findings.push(this.createFinding(
+          file,
+          lineNum,
+          'Potential SQL Injection',
+          'Direct variable interpolation in SQL query detected.',
+          Severity.CRITICAL,
+          ThreatType.SQL_INJECTION
+        ));
+      }
+
+      // Check for XSS vulnerabilities
+      if (this.checkXss(line)) {
+        findings.push(this.createFinding(
+          file,
+          lineNum,
+          'Potential Cross-Site Scripting (XSS)',
+          'User input echoed without proper escaping.',
+          Severity.HIGH,
+          ThreatType.XSS
+        ));
+      }
+
+      // Check for insecure session configuration
+      if (this.checkInsecureSession(line)) {
+        findings.push(this.createFinding(
+          file,
+          lineNum,
+          'Insecure Session Configuration',
+          'Session configuration may be insecure.',
+          Severity.MEDIUM,
+          ThreatType.SECURITY_MISCONFIGURATION
+        ));
+      }
+
+      // Check for disable_functions bypass attempts
+      if (this.checkBypassAttempts(line)) {
+        findings.push(this.createFinding(
+          file,
+          lineNum,
+          'Security Bypass Attempt',
+          'Code attempts to bypass PHP security restrictions.',
+          Severity.CRITICAL,
+          ThreatType.BACKDOOR
+        ));
+      }
+
+      // Check for web shell patterns
+      if (this.checkWebShell(line)) {
+        findings.push(this.createFinding(
+          file,
+          lineNum,
+          'Web Shell Pattern Detected',
+          'Code pattern consistent with a PHP web shell.',
+          Severity.CRITICAL,
+          ThreatType.BACKDOOR
+        ));
+      }
+    }
+
+    return findings;
+  }
+
+  /**
+   * Check for dangerous functions
+   */
+  private checkDangerousFunctions(line: string): boolean {
+    const dangerous = [
+      /\bassert\s*\(\s*\$/,
+      /\bpreg_replace\s*\([^)]*\/[^)]*e['"]/i,
+      /\bcreate_function\s*\(/,
+      /\barray_map\s*\(\s*['"]\w+['"],\s*\$/,
+      /\barray_filter\s*\(\s*\$[^,]*,\s*['"]\w+['"]\)/,
+      /\busort\s*\(\s*\$[^,]*,\s*['"]\w+['"]\)/,
+      /\bregister_shutdown_function\s*\(\s*\$/,
+      /\bregister_tick_function\s*\(\s*\$/
+    ];
+    return dangerous.some(p => p.test(line));
+  }
+
+  /**
+   * Check for file inclusion vulnerabilities
+   */
+  private checkFileInclusion(line: string): boolean {
+    const patterns = [
+      /\b(?:include|require|include_once|require_once)\s*\(\s*\$_(?:GET|POST|REQUEST|COOKIE)/i,
+      /\b(?:include|require|include_once|require_once)\s*\(\s*\$(?!_)[a-zA-Z_]/i,
+      /\bfile_get_contents\s*\(\s*\$_/i,
+      /\bfopen\s*\(\s*\$_/i,
+      /\breadf(?:ile)?\s*\(\s*\$_/i
+    ];
+    return patterns.some(p => p.test(line));
+  }
+
+  /**
+   * Check for SQL injection
+   */
+  private checkSqlInjection(line: string): boolean {
+    const patterns = [
+      /\$(?:query|sql)\s*=\s*["'].*\.\s*\$_(?:GET|POST|REQUEST)/i,
+      /mysql_query\s*\([^)]*\.\s*\$_/i,
+      /mysqli_query\s*\([^)]*\.\s*\$_/i,
+      /\$(?:pdo|db|conn)->query\s*\([^)]*\.\s*\$_/i,
+      /["']SELECT[^'"]*\.\s*\$_/i,
+      /["']INSERT[^'"]*\.\s*\$_/i,
+      /["']UPDATE[^'"]*\.\s*\$_/i,
+      /["']DELETE[^'"]*\.\s*\$_/i
+    ];
+    return patterns.some(p => p.test(line));
+  }
+
+  /**
+   * Check for XSS
+   */
+  private checkXss(line: string): boolean {
+    const patterns = [
+      /echo\s+\$_(?:GET|POST|REQUEST|COOKIE)/i,
+      /print\s+\$_(?:GET|POST|REQUEST|COOKIE)/i,
+      /<?=\s*\$_(?:GET|POST|REQUEST|COOKIE)/i,
+      /echo\s+\$[a-zA-Z_]+[^;]*;\s*(?!.*htmlspecialchars|.*htmlentities|.*strip_tags)/
+    ];
+    return patterns.some(p => p.test(line));
+  }
+
+  /**
+   * Check for insecure session configuration
+   */
+  private checkInsecureSession(line: string): boolean {
+    const patterns = [
+      /session\.cookie_httponly\s*=\s*(?:0|false|off)/i,
+      /session\.cookie_secure\s*=\s*(?:0|false|off)/i,
+      /session\.use_strict_mode\s*=\s*(?:0|false|off)/i,
+      /ini_set\s*\(\s*['"]session\.cookie_httponly['"]\s*,\s*(?:0|false|'0'|'false')/i
+    ];
+    return patterns.some(p => p.test(line));
+  }
+
+  /**
+   * Check for security bypass attempts
+   */
+  private checkBypassAttempts(line: string): boolean {
+    const patterns = [
+      /\bini_set\s*\(\s*['"]disable_functions['"]/i,
+      /\bini_restore\s*\(/i,
+      /\bputenv\s*\(\s*['"]LD_PRELOAD/i,
+      /\bmail\s*\([^)]*-X\s/i,
+      /\bimap_open\s*\([^)]*\\x00/i
+    ];
+    return patterns.some(p => p.test(line));
+  }
+
+  /**
+   * Check for web shell patterns
+   */
+  private checkWebShell(line: string): boolean {
+    const patterns = [
+      /\$_(?:GET|POST|REQUEST)\s*\[[^\]]+\]\s*\(\s*\$_(?:GET|POST|REQUEST)/i,
+      /eval\s*\(\s*(?:base64_decode|gzinflate|gzuncompress|str_rot13)\s*\(/i,
+      /\$\w+\s*=\s*str_replace\s*\([^)]+\)\s*;\s*\$\w+\s*\(/,
+      /\$\{\s*\$_(?:GET|POST|REQUEST)/i,
+      /\$\w+\s*=\s*\$_(?:GET|POST|REQUEST)[^;]+;\s*@?\$\w+\s*\(/
+    ];
+    return patterns.some(p => p.test(line));
+  }
+
+  /**
+   * Create generic finding
+   */
+  private createFinding(
+    file: ScannedFile,
+    lineNum: number,
+    title: string,
+    description: string,
+    severity: Severity,
+    threatType: ThreatType
+  ): Finding {
+    const context = extractCodeContext(file.content, lineNum, 2);
+
+    return {
+      id: generateId(),
+      title,
+      description,
+      severity,
+      threatType,
+      category: FindingCategory.VULNERABILITY,
+      location: {
+        file: file.relativePath,
+        startLine: lineNum,
+        endLine: lineNum
+      },
+      snippet: {
+        code: context.code,
+        contextBefore: context.contextBefore,
+        contextAfter: context.contextAfter
+      },
+      standards: getStandardsForThreat(threatType),
+      remediation: 'Review and fix the identified issue.',
+      confidence: 80,
+      analyzer: this.name,
+      timestamp: new Date(),
+      tags: ['php']
+    };
+  }
+}
+
+export default PHPAnalyzer;

package/src/analyzers/python/index.ts

@@ -0,0 +1,5 @@
+/**
+ * Python Analyzer Exports
+ */
+
+export * from './pythonAnalyzer';

package/src/analyzers/python/pythonAnalyzer.ts

@@ -0,0 +1,319 @@
+/**
+ * Python Analyzer
+ * Specialized analyzer for Python code
+ */
+
+import { BaseAnalyzer } from '../base';
+import { ScannedFile, Finding, Rule, SupportedLanguage, Severity, ThreatType, FindingCategory } from '../../types';
+import { generateId, extractCodeContext, looksObfuscated } from '../../utils';
+import { getStandardsForThreat } from '../../rules/standards';
+import { logger } from '../../utils/logger';
+
+/**
+ * Python Analyzer Class
+ */
+export class PythonAnalyzer extends BaseAnalyzer {
+  name = 'Python Analyzer';
+  languages: SupportedLanguage[] = ['python'];
+  version = '1.0.0';
+
+  /**
+   * Analyze Python file
+   */
+  async analyze(file: ScannedFile, rules: Rule[]): Promise<Finding[]> {
+    const findings: Finding[] = [];
+
+    // Filter rules for Python
+    const pyRules = rules.filter(r => r.languages.includes('python'));
+
+    // Run rule engine
+    const ruleFindings = await this.ruleEngine.analyzeFile(file, pyRules);
+    findings.push(...ruleFindings);
+
+    // Additional Python-specific analysis
+    const customFindings = await this.customAnalysis(file);
+    findings.push(...customFindings);
+
+    return findings;
+  }
+
+  /**
+   * Custom Python-specific analysis
+   */
+  private async customAnalysis(file: ScannedFile): Promise<Finding[]> {
+    const findings: Finding[] = [];
+    const lines = file.content.split('\n');
+
+    for (let i = 0; i < lines.length; i++) {
+      const line = lines[i];
+      const lineNum = i + 1;
+
+      // Check for dangerous imports
+      if (this.checkDangerousImports(line)) {
+        findings.push(this.createFinding(
+          file,
+          lineNum,
+          'Potentially Dangerous Import',
+          'Import of a module commonly used in malware or exploits.',
+          Severity.MEDIUM,
+          ThreatType.DANGEROUS_FUNCTION
+        ));
+      }
+
+      // Check for pickle usage
+      if (this.checkPickleUsage(line)) {
+        findings.push(this.createFinding(
+          file,
+          lineNum,
+          'Insecure Pickle Deserialization',
+          'Pickle can execute arbitrary code during deserialization.',
+          Severity.HIGH,
+          ThreatType.INSECURE_DESERIALIZATION
+        ));
+      }
+
+      // Check for YAML unsafe load
+      if (this.checkUnsafeYamlLoad(line)) {
+        findings.push(this.createFinding(
+          file,
+          lineNum,
+          'Insecure YAML Load',
+          'yaml.load() without Loader can execute arbitrary Python code.',
+          Severity.HIGH,
+          ThreatType.INSECURE_DESERIALIZATION
+        ));
+      }
+
+      // Check for subprocess shell=True
+      if (this.checkSubprocessShell(line)) {
+        findings.push(this.createFinding(
+          file,
+          lineNum,
+          'Subprocess with shell=True',
+          'Using shell=True with subprocess can lead to command injection.',
+          Severity.HIGH,
+          ThreatType.COMMAND_INJECTION
+        ));
+      }
+
+      // Check for tarfile path traversal
+      if (this.checkTarfileTraversal(line)) {
+        findings.push(this.createFinding(
+          file,
+          lineNum,
+          'Tarfile Path Traversal Risk',
+          'Extracting tar files without validation can lead to path traversal.',
+          Severity.MEDIUM,
+          ThreatType.PATH_TRAVERSAL
+        ));
+      }
+
+      // Check for Flask debug mode
+      if (this.checkFlaskDebug(line)) {
+        findings.push(this.createFinding(
+          file,
+          lineNum,
+          'Flask Debug Mode Enabled',
+          'Debug mode in production exposes the Werkzeug debugger.',
+          Severity.HIGH,
+          ThreatType.SECURITY_MISCONFIGURATION
+        ));
+      }
+
+      // Check for Django settings vulnerabilities
+      if (this.checkDjangoSettings(line)) {
+        findings.push(this.createFinding(
+          file,
+          lineNum,
+          'Insecure Django Configuration',
+          'Insecure Django setting detected.',
+          Severity.MEDIUM,
+          ThreatType.SECURITY_MISCONFIGURATION
+        ));
+      }
+
+      // Check for compile/exec with input
+      if (this.checkCompileExec(line)) {
+        findings.push(this.createFinding(
+          file,
+          lineNum,
+          'Dynamic Code Compilation/Execution',
+          'compile() or exec() may execute arbitrary code.',
+          Severity.HIGH,
+          ThreatType.DANGEROUS_FUNCTION
+        ));
+      }
+    }
+
+    // Check for requirements.txt if exists
+    if (file.relativePath.endsWith('requirements.txt')) {
+      const reqFindings = this.analyzeRequirements(file);
+      findings.push(...reqFindings);
+    }
+
+    return findings;
+  }
+
+  /**
+   * Check for dangerous imports
+   */
+  private checkDangerousImports(line: string): boolean {
+    const dangerousModules = [
+      /^import\s+ctypes/,
+      /^from\s+ctypes\s+import/,
+      /^import\s+mmap/,
+      /^import\s+pyHook/,
+      /^import\s+pythoncom/,
+      /^import\s+pynput/
+    ];
+    return dangerousModules.some(p => p.test(line.trim()));
+  }
+
+  /**
+   * Check for pickle usage
+   */
+  private checkPickleUsage(line: string): boolean {
+    return /pickle\.loads?\s*\(/.test(line) || /cPickle\.loads?\s*\(/.test(line);
+  }
+
+  /**
+   * Check for unsafe YAML load
+   */
+  private checkUnsafeYamlLoad(line: string): boolean {
+    if (/yaml\.load\s*\(/.test(line)) {
+      // Check if Loader is specified
+      if (!/Loader\s*=/.test(line) && !/yaml\.safe_load/.test(line)) {
+        return true;
+      }
+    }
+    return false;
+  }
+
+  /**
+   * Check for subprocess with shell=True
+   */
+  private checkSubprocessShell(line: string): boolean {
+    return /subprocess\.(?:Popen|call|run|check_output|check_call)\s*\([^)]*shell\s*=\s*True/.test(line);
+  }
+
+  /**
+   * Check for tarfile extraction without validation
+   */
+  private checkTarfileTraversal(line: string): boolean {
+    return /\.extractall\s*\(/.test(line) || /\.extract\s*\(/.test(line);
+  }
+
+  /**
+   * Check for Flask debug mode
+   */
+  private checkFlaskDebug(line: string): boolean {
+    return /app\.run\s*\([^)]*debug\s*=\s*True/.test(line) ||
+           /DEBUG\s*=\s*True/.test(line);
+  }
+
+  /**
+   * Check for Django settings issues
+   */
+  private checkDjangoSettings(line: string): boolean {
+    const issues = [
+      /DEBUG\s*=\s*True/,
+      /SECRET_KEY\s*=\s*['"]/,
+      /ALLOWED_HOSTS\s*=\s*\[\s*['"]?\*['"]?\s*\]/
+    ];
+    return issues.some(p => p.test(line));
+  }
+
+  /**
+   * Check for compile/exec usage
+   */
+  private checkCompileExec(line: string): boolean {
+    return /\bexec\s*\(/.test(line) || /\bcompile\s*\([^)]*['"]\bexec\b['"]\)/.test(line);
+  }
+
+  /**
+   * Analyze requirements.txt
+   */
+  private analyzeRequirements(file: ScannedFile): Finding[] {
+    const findings: Finding[] = [];
+    const lines = file.content.split('\n');
+
+    // Known vulnerable packages (simplified list)
+    const vulnerablePackages: Record<string, { version: string; severity: Severity; description: string }> = {
+      'pyyaml': { version: '<5.4', severity: Severity.HIGH, description: 'Arbitrary code execution via yaml.load()' },
+      'django': { version: '<3.2.4', severity: Severity.HIGH, description: 'Multiple security vulnerabilities' },
+      'flask': { version: '<2.0', severity: Severity.MEDIUM, description: 'Security improvements in newer versions' },
+      'requests': { version: '<2.20.0', severity: Severity.MEDIUM, description: 'CVE-2018-18074 - HTTPS verification bypass' }
+    };
+
+    for (let i = 0; i < lines.length; i++) {
+      const line = lines[i].trim().toLowerCase();
+      for (const [pkg, info] of Object.entries(vulnerablePackages)) {
+        if (line.startsWith(pkg + '==') || line.startsWith(pkg + '<') || line === pkg) {
+          findings.push({
+            id: generateId(),
+            title: `Potentially Vulnerable Package: ${pkg}`,
+            description: `${info.description}. Consider upgrading.`,
+            severity: info.severity,
+            threatType: ThreatType.VULNERABLE_DEPENDENCY,
+            category: FindingCategory.VULNERABILITY,
+            location: {
+              file: file.relativePath,
+              startLine: i + 1,
+              endLine: i + 1
+            },
+            snippet: { code: lines[i] },
+            standards: getStandardsForThreat(ThreatType.VULNERABLE_DEPENDENCY),
+            remediation: `Upgrade ${pkg} to the latest secure version.`,
+            confidence: 60,
+            analyzer: this.name,
+            timestamp: new Date(),
+            tags: ['dependency', 'vulnerable', 'python']
+          });
+        }
+      }
+    }
+
+    return findings;
+  }
+
+  /**
+   * Create generic finding
+   */
+  private createFinding(
+    file: ScannedFile,
+    lineNum: number,
+    title: string,
+    description: string,
+    severity: Severity,
+    threatType: ThreatType
+  ): Finding {
+    const context = extractCodeContext(file.content, lineNum, 2);
+
+    return {
+      id: generateId(),
+      title,
+      description,
+      severity,
+      threatType,
+      category: FindingCategory.VULNERABILITY,
+      location: {
+        file: file.relativePath,
+        startLine: lineNum,
+        endLine: lineNum
+      },
+      snippet: {
+        code: context.code,
+        contextBefore: context.contextBefore,
+        contextAfter: context.contextAfter
+      },
+      standards: getStandardsForThreat(threatType),
+      remediation: 'Review and fix the identified issue.',
+      confidence: 75,
+      analyzer: this.name,
+      timestamp: new Date(),
+      tags: ['python']
+    };
+  }
+}
+
+export default PythonAnalyzer;