apisec-code-bolt 0.1.0__py3-none-any.whl

apisec_code_bolt/analysis/request_patterns.py

@@ -0,0 +1,162 @@
+"""
+Request access pattern registry for read-site origin detection.
+
+Maps framework-specific request access patterns (request.path_params["id"],
+request.args.get("page"), etc.) to generic OriginType. Used to identify
+data origins when handlers read from the request object directly
+(Flask, Django) rather than via parameters (FastAPI).
+"""
+
+from __future__ import annotations
+
+from dataclasses import dataclass
+
+
+@dataclass
+class RequestAccessPattern:
+    """Maps framework-specific request access to origin type."""
+
+    framework: str  # "fastapi", "flask", "django", "starlette"
+    # Attribute chain: ("request", "path_params") or ("request", "args")
+    attr_chain: tuple[str, ...]
+    # Access method: "get", "__getitem__", None for direct/call
+    access_method: str | None = None
+    # For .get("key"), the param name is typically the first arg
+    # For ["key"], the param name is the subscript
+    origin_type: str = ""  # Will map to OriginType
+
+    # Optional: specific param name if inferrable from pattern
+    param_name_from_subscript: bool = True
+
+
+# =============================================================================
+# Pattern Registry
+# =============================================================================
+
+
+# Built-in patterns for each framework
+# Format: (attr_chain, access_method) -> OriginType name
+FASTAPI_STARLETTE_PATTERNS: list[tuple[tuple[str, ...], str | None, str]] = [
+    (("request", "path_params"), "__getitem__", "HTTP_PATH_PARAM"),
+    (("request", "path_params"), "get", "HTTP_PATH_PARAM"),
+    (("request", "query_params"), "__getitem__", "HTTP_QUERY_PARAM"),
+    (("request", "query_params"), "get", "HTTP_QUERY_PARAM"),
+    (("request", "headers"), "__getitem__", "HTTP_HEADER"),
+    (("request", "headers"), "get", "HTTP_HEADER"),
+    (("request", "cookies"), "__getitem__", "HTTP_COOKIE"),
+    (("request", "cookies"), "get", "HTTP_COOKIE"),
+    (("request", "body"), None, "HTTP_BODY"),
+    (("request", "json"), None, "HTTP_BODY"),  # .json() returns body
+]
+
+FLASK_PATTERNS: list[tuple[tuple[str, ...], str | None, str]] = [
+    (("request", "args"), "get", "HTTP_QUERY_PARAM"),
+    (("request", "args"), "__getitem__", "HTTP_QUERY_PARAM"),
+    (("request", "form"), "get", "HTTP_FORM"),
+    (("request", "form"), "__getitem__", "HTTP_FORM"),
+    (("request", "files"), "get", "HTTP_FILE"),
+    (("request", "headers"), "get", "HTTP_HEADER"),
+    (("request", "cookies"), "get", "HTTP_COOKIE"),
+    (("request", "get_json"), None, "HTTP_BODY"),  # request.get_json()
+    (("request", "json"), None, "HTTP_BODY"),  # request.json
+    (("request", "data"), None, "HTTP_BODY"),
+]
+
+DJANGO_PATTERNS: list[tuple[tuple[str, ...], str | None, str]] = [
+    (("request", "GET"), "get", "HTTP_QUERY_PARAM"),
+    (("request", "POST"), "get", "HTTP_FORM"),
+    (("request", "POST"), "__getitem__", "HTTP_FORM"),
+    (("request", "FILES"), "get", "HTTP_FILE"),
+    (("request", "COOKIES"), "get", "HTTP_COOKIE"),
+    (("request", "headers"), "get", "HTTP_HEADER"),
+    (("request", "body"), None, "HTTP_BODY"),
+    # Django Rest Framework
+    (("request", "data"), "__getitem__", "HTTP_BODY"),
+    (("request", "data"), "get", "HTTP_BODY"),
+    (("request", "query_params"), "get", "HTTP_QUERY_PARAM"),
+]
+
+
+class RequestPatternRegistry:
+    """Registry of request access patterns per framework."""
+
+    def __init__(self):
+        self._patterns: dict[str, list[RequestAccessPattern]] = {
+            "fastapi": [],
+            "starlette": [],
+            "flask": [],
+            "django": [],
+        }
+        self._init_builtin_patterns()
+
+    def _init_builtin_patterns(self) -> None:
+        """Initialize with built-in patterns."""
+        for attr_chain, method, origin_name in FASTAPI_STARLETTE_PATTERNS:
+            for fw in ("fastapi", "starlette"):
+                self._patterns[fw].append(
+                    RequestAccessPattern(
+                        framework=fw,
+                        attr_chain=attr_chain,
+                        access_method=method,
+                        origin_type=origin_name,
+                    )
+                )
+
+        for attr_chain, method, origin_name in FLASK_PATTERNS:
+            self._patterns["flask"].append(
+                RequestAccessPattern(
+                    framework="flask",
+                    attr_chain=attr_chain,
+                    access_method=method,
+                    origin_type=origin_name,
+                )
+            )
+
+        for attr_chain, method, origin_name in DJANGO_PATTERNS:
+            self._patterns["django"].append(
+                RequestAccessPattern(
+                    framework="django",
+                    attr_chain=attr_chain,
+                    access_method=method,
+                    origin_type=origin_name,
+                )
+            )
+
+    def get_origin_type(
+        self,
+        framework: str,
+        attr_chain: tuple[str, ...],
+        access_method: str | None = None,
+    ) -> str | None:
+        """
+        Get the OriginType name for a request access pattern.
+
+        Args:
+            framework: "fastapi", "flask", "django", "starlette"
+            attr_chain: e.g. ("request", "path_params") or ("request", "args")
+            access_method: "get", "__getitem__", or None
+
+        Returns:
+            OriginType name string or None if no match
+        """
+        patterns = self._patterns.get(framework.lower(), [])
+        for p in patterns:
+            if p.attr_chain == attr_chain and p.access_method == access_method:
+                return p.origin_type
+        return None
+
+    def get_all_patterns(self, framework: str) -> list[RequestAccessPattern]:
+        """Get all patterns for a framework."""
+        return self._patterns.get(framework.lower(), [])
+
+
+# Singleton registry
+_default_registry: RequestPatternRegistry | None = None
+
+
+def get_request_pattern_registry() -> RequestPatternRegistry:
+    """Get the default request pattern registry."""
+    global _default_registry
+    if _default_registry is None:
+        _default_registry = RequestPatternRegistry()
+    return _default_registry

apisec_code_bolt/analysis/sensitivity_classifier.py

@@ -0,0 +1,224 @@
+"""
+Sensitivity classification for integrations and data.
+
+Assigns sensitivity labels to detected integrations based on:
+1. **Integration type** — databases inherently store data, caches may hold
+   sessions, email services handle contact info.
+2. **SQL table/column heuristics** — SQL patterns referencing ``users``,
+   ``passwords``, ``payments`` suggest PII or financial data.
+3. **Variable / env-var naming** — ``DB_PASSWORD``, ``STRIPE_SECRET_KEY``
+   indicate auth credentials or financial integrations.
+
+Labels are purely factual tags (not severity scores) that the cloud uses
+to prioritise and contextualise findings.
+"""
+
+from __future__ import annotations
+
+import re
+from typing import TYPE_CHECKING, Any
+
+if TYPE_CHECKING:
+    from ..core.manifest import IntegrationModel, LiteralPatternModel
+
+
+# ============================================================================
+# Sensitivity label constants
+# ============================================================================
+
+
+class SensitivityLabel:
+    PII = "PII"
+    FINANCIAL = "FINANCIAL"
+    AUTH_CREDENTIAL = "AUTH_CREDENTIAL"
+    SECRETS = "SECRETS"
+    INTERNAL = "INTERNAL"
+    GENERAL = "GENERAL"
+
+
+# ============================================================================
+# Rules: integration-type → default sensitivity
+# ============================================================================
+
+_INTEGRATION_TYPE_SENSITIVITY: dict[str, list[str]] = {
+    "database": [SensitivityLabel.PII, SensitivityLabel.INTERNAL],
+    "cache": [SensitivityLabel.INTERNAL],
+    "message_queue": [SensitivityLabel.INTERNAL],
+    "http_client": [],
+    "cloud_service": [SensitivityLabel.INTERNAL],
+    "serialization": [SensitivityLabel.INTERNAL],
+    "xml_parser": [],
+    "template_engine": [],
+    "crypto": [SensitivityLabel.AUTH_CREDENTIAL],
+    "directory_service": [SensitivityLabel.AUTH_CREDENTIAL, SensitivityLabel.PII],
+    "email": [SensitivityLabel.PII],
+    "file_system": [],
+    "os_command": [],
+    "monitoring": [],
+    "logging": [],
+    "auth_provider": [SensitivityLabel.AUTH_CREDENTIAL],
+}
+
+# Integration names that indicate financial data
+_FINANCIAL_INTEGRATIONS: set[str] = {
+    "stripe",
+    "braintree",
+    "adyen",
+    "paypal",
+    "square",
+}
+
+# ============================================================================
+# Rules: SQL table/column patterns
+# ============================================================================
+
+_PII_TABLE_PATTERNS = re.compile(
+    r"\b(?:users?|customers?|patients?|employees?|persons?|contacts?|profiles?|"
+    r"accounts?|members?|subscribers?)\b",
+    re.IGNORECASE,
+)
+
+_FINANCIAL_TABLE_PATTERNS = re.compile(
+    r"\b(?:payments?|transactions?|invoices?|orders?|billing|subscriptions?|"
+    r"charges?|refunds?|credits?|wallets?|balances?)\b",
+    re.IGNORECASE,
+)
+
+_AUTH_TABLE_PATTERNS = re.compile(
+    r"\b(?:passwords?|credentials?|tokens?|sessions?|api_keys?|secrets?|"
+    r"auth|oauth|permissions?|roles?|grants?|logins?)\b",
+    re.IGNORECASE,
+)
+
+# ============================================================================
+# Rules: env-var / variable name patterns
+# ============================================================================
+
+_SECRET_VAR_PATTERNS = re.compile(
+    r"(?:PASSWORD|SECRET|PRIVATE_KEY|API_KEY|TOKEN|CREDENTIALS?|AUTH)",
+    re.IGNORECASE,
+)
+
+_FINANCIAL_VAR_PATTERNS = re.compile(
+    r"(?:STRIPE|PAYPAL|BRAINTREE|ADYEN|SQUARE|PAYMENT)",
+    re.IGNORECASE,
+)
+
+_PII_VAR_PATTERNS = re.compile(
+    r"(?:SSN|SOCIAL_SECURITY|EMAIL|PHONE|ADDRESS|DATE_OF_BIRTH|DOB|"
+    r"FIRST_NAME|LAST_NAME|FULL_NAME)",
+    re.IGNORECASE,
+)
+
+
+# ============================================================================
+# SensitivityClassifier
+# ============================================================================
+
+
+class SensitivityClassifier:
+    """
+    Assigns sensitivity labels to integrations, SQL patterns, and env vars.
+    """
+
+    def classify_integration(
+        self,
+        integration_type: str,
+        integration_name: str,
+        metadata: dict[str, Any] | None = None,
+    ) -> list[str]:
+        """Return sensitivity labels for an integration."""
+        labels: set[str] = set()
+
+        # Type-based defaults
+        for label in _INTEGRATION_TYPE_SENSITIVITY.get(integration_type, []):
+            labels.add(label)
+
+        # Financial integration names
+        name_lower = integration_name.lower()
+        for fin_name in _FINANCIAL_INTEGRATIONS:
+            if fin_name in name_lower:
+                labels.add(SensitivityLabel.FINANCIAL)
+                break
+
+        # Sub-services may indicate financial (e.g. "AWS SQS" vs "AWS S3")
+        if metadata:
+            for svc in metadata.get("services", []):
+                svc_lower = svc.lower()
+                if any(f in svc_lower for f in ("payment", "billing", "invoice")):
+                    labels.add(SensitivityLabel.FINANCIAL)
+
+        return sorted(labels) if labels else [SensitivityLabel.GENERAL]
+
+    def classify_sql_pattern(self, sql_value: str) -> list[str]:
+        """Return sensitivity labels based on SQL table/column names."""
+        labels: set[str] = set()
+
+        if _PII_TABLE_PATTERNS.search(sql_value):
+            labels.add(SensitivityLabel.PII)
+        if _FINANCIAL_TABLE_PATTERNS.search(sql_value):
+            labels.add(SensitivityLabel.FINANCIAL)
+        if _AUTH_TABLE_PATTERNS.search(sql_value):
+            labels.add(SensitivityLabel.AUTH_CREDENTIAL)
+
+        return sorted(labels)
+
+    def classify_env_var(self, var_name: str) -> list[str]:
+        """Return sensitivity labels based on env variable name."""
+        labels: set[str] = set()
+
+        if _SECRET_VAR_PATTERNS.search(var_name):
+            labels.add(SensitivityLabel.SECRETS)
+        if _FINANCIAL_VAR_PATTERNS.search(var_name):
+            labels.add(SensitivityLabel.FINANCIAL)
+        if _PII_VAR_PATTERNS.search(var_name):
+            labels.add(SensitivityLabel.PII)
+
+        return sorted(labels)
+
+    def classify_connection_string(self, scheme: str) -> list[str]:
+        """Return sensitivity labels based on a connection string scheme."""
+        labels: set[str] = set()
+        scheme_lower = scheme.lower()
+
+        labels.add(SensitivityLabel.AUTH_CREDENTIAL)
+
+        if any(db in scheme_lower for db in ("postgres", "mysql", "sqlite", "mongodb")):
+            labels.add(SensitivityLabel.PII)
+        if "redis" in scheme_lower:
+            labels.add(SensitivityLabel.INTERNAL)
+        if any(mq in scheme_lower for mq in ("amqp", "kafka", "nats")):
+            labels.add(SensitivityLabel.INTERNAL)
+
+        return sorted(labels)
+
+    # ------------------------------------------------------------------
+    # Batch operations
+    # ------------------------------------------------------------------
+
+    def enrich_integrations(
+        self,
+        integrations: list[IntegrationModel],
+    ) -> None:
+        """Mutate integration models in-place, adding sensitivity_labels."""
+        for integration in integrations:
+            labels = self.classify_integration(
+                integration.type,
+                integration.name,
+                integration.metadata,
+            )
+            integration.sensitivity_labels = labels
+
+    def enrich_sql_patterns(
+        self,
+        sql_patterns: list[LiteralPatternModel],
+    ) -> None:
+        """Annotate SQL literal patterns with sensitivity in notes."""
+        for pattern in sql_patterns:
+            if not pattern.value:
+                continue
+            labels = self.classify_sql_pattern(pattern.value)
+            if labels:
+                existing = pattern.notes or ""
+                sensitivity_str = f"sensitivity: {', '.join(labels)}"
+                pattern.notes = f"{existing}; {sensitivity_str}" if existing else sensitivity_str