apisec-code-bolt 0.1.2__tar.gz → 0.1.3__tar.gz

{apisec_code_bolt-0.1.2 → apisec_code_bolt-0.1.3}/PKG-INFO

@@ -1,6 +1,6 @@
 Metadata-Version: 2.4
 Name: apisec-code-bolt
-Version: 0.1.2
+Version: 0.1.3
 Summary: Static analysis probe for extracting architectural metadata from codebases
 Project-URL: Homepage, https://apisec.ai
 Project-URL: Documentation, https://docs.apisec.ai/code-bolt
@@ -31,6 +31,7 @@ Requires-Dist: pyyaml>=6.0
 Requires-Dist: rich>=13.7.0
 Requires-Dist: tree-sitter-c-sharp>=0.23
 Requires-Dist: tree-sitter-javascript>=0.23
+Requires-Dist: tree-sitter-ruby>=0.23
 Requires-Dist: tree-sitter-typescript>=0.23
 Requires-Dist: tree-sitter>=0.23
 Requires-Dist: typing-extensions>=4.9.0

{apisec_code_bolt-0.1.2 → apisec_code_bolt-0.1.3}/pyproject.toml

@@ -4,7 +4,7 @@ build-backend = "hatchling.build"
 
 [project]
 name = "apisec-code-bolt"
-version = "0.1.2"
+version = "0.1.3"
 description = "Static analysis probe for extracting architectural metadata from codebases"
 readme = "README.md"
 license = {text = "Proprietary"}
@@ -41,6 +41,9 @@ dependencies = [
     "tree-sitter-javascript>=0.23",      # JS grammar for tree-sitter
     "tree-sitter-typescript>=0.23",      # TypeScript grammar for tree-sitter
 
+    # Ruby parsing
+    "tree-sitter-ruby>=0.23",            # Ruby grammar for tree-sitter
+
     # Graph operations
     "networkx>=3.2",                    # Call graph, data flow graphs
     

{apisec_code_bolt-0.1.2 → apisec_code_bolt-0.1.3}/src/apisec_code_bolt/__init__.py

@@ -8,6 +8,7 @@ raw source code outside the customer's environment.
 
 try:
     from importlib.metadata import version as _pkg_version
+
     __version__ = _pkg_version("apisec-code-bolt")
 except Exception:
     __version__ = "0.0.0"

{apisec_code_bolt-0.1.2 → apisec_code_bolt-0.1.3}/src/apisec_code_bolt/analysis/analyzer.py

@@ -61,6 +61,7 @@ from ..frameworks.base import FrameworkPluginRegistry
 from ..parsing import csharp as _csharp_pkg  # noqa: F401 — registers CSharpParser
 from ..parsing import js as _js_pkg  # noqa: F401 — registers JavaScriptParser
 from ..parsing import jvm as _jvm_pkg  # noqa: F401 — registers JavaParser
+from ..parsing import ruby as _ruby_pkg  # noqa: F401 — registers RubyParser
 from ..parsing.base import ParsedFile, ParserRegistry
 from ..parsing.csharp.language_services import CSharpLanguageServices
 from ..parsing.js.language_services import JavaScriptLanguageServices
@@ -69,6 +70,7 @@ from ..parsing.jvm.language_services import JavaLanguageServices
 from ..parsing.python.language_services import PythonLanguageServices
 from ..parsing.python.parser import PythonProjectParser
 from ..parsing.python.type_resolver import SchemaBuilder, TypeResolver
+from ..parsing.ruby.language_services import RubyLanguageServices
 from ..parsing.services import AnalysisContext, LanguageServices
 from .call_graph import CallGraph, build_call_graph_with_context
 from .data_flow import DataFlowAnalyzer
@@ -201,11 +203,17 @@ class ProjectAnalyzer:
             Language.JAVA: JavaLanguageServices(),
             Language.CSHARP: CSharpLanguageServices(),
             Language.JAVASCRIPT: JavaScriptLanguageServices(),
+            Language.RUBY: RubyLanguageServices(),
         }
 
         # Analysis contexts per language (built during analysis)
         self._analysis_contexts: dict[Language, AnalysisContext] = {}
 
+        # Express parent-router auth middleware map, built during context setup.
+        # Maps resolved file path str → list of auth middleware variable names
+        # that apply to routes in that file (inherited from parent router mounts).
+        self._express_parent_auth_map: dict[str, list[str]] = {}
+
         # Parsed data
         self._parsed_files: dict[Path, ParsedFile] = {}
         self._discovery_result: DiscoveryResult | None = None
@@ -369,7 +377,11 @@ class ProjectAnalyzer:
         self._populate_route_auth_mapping(ctx["auth"], ctx["routes"], ctx["middleware"])
         self._link_routes_to_auth_schemes(ctx["routes"], ctx["auth"])
         self._propagate_file_auth_to_routes(ctx["routes"], ctx["auth"])
+        self._propagate_express_parent_auth_to_routes(ctx["routes"])
+        self._propagate_django_class_auth_to_routes(ctx["routes"], ctx["auth"])
+        self._propagate_rails_auth_to_routes(ctx["routes"], ctx["auth"])
         self._apply_spring_filter_chain_policy(ctx["routes"])
+        self._infer_pydantic_route_bodies(ctx["routes"])
         ctx["calls"] = self._extract_all_calls()
 
     def _stage_analyze_flows(self, ctx: dict[str, Any]) -> None:
@@ -485,13 +497,20 @@ class ProjectAnalyzer:
                     logger.debug("Django prefix map failed: %s", e)
             elif language == Language.JAVASCRIPT:
                 try:
-                    from .url_prefix_resolver import build_express_prefix_map
+                    from .url_prefix_resolver import (
+                        build_express_auth_middleware_map,
+                        build_express_prefix_map,
+                    )
 
                     pm = build_express_prefix_map(files, project_root=self.config.project_root)
                     context.language_services["_url_prefix_map"] = pm
                     logger.debug("Express prefix map built: %d entries", len(pm))
+
+                    am = build_express_auth_middleware_map(files)
+                    self._express_parent_auth_map = am
+                    logger.debug("Express auth middleware map built: %d entries", len(am))
                 except Exception as e:
-                    logger.debug("Express prefix map failed: %s", e)
+                    logger.debug("Express prefix/auth map failed: %s", e)
 
             self._analysis_contexts[language] = context
 
@@ -1286,6 +1305,138 @@ class ProjectAnalyzer:
         # matches the suffix of any qualified name.
         return any(qn.endswith("." + type_name) for qn in known_models)
 
+    # -------------------------------------------------------------------------
+    # Pydantic body inference
+    # -------------------------------------------------------------------------
+
+    # Frameworks whose plugins don't natively parse Pydantic request bodies.
+    # FastAPI and Django Ninja are excluded because their plugins already set
+    # route.body from route signature annotations.
+    _PYDANTIC_INFER_FRAMEWORKS: frozenset[str] = frozenset(
+        {"flask", "django", "generic", "webhook", ""}
+    )
+
+    # Pydantic instantiation patterns we recognise in call sites.
+    # A call site contributes a candidate model name when:
+    #   (a) its callee_name exactly matches a known Pydantic model class name, OR
+    #   (b) its callee_name is "ModelName.parse_obj", "ModelName.model_validate",
+    #       or "ModelName.from_orm".
+    _PYDANTIC_CLASS_METHODS: frozenset[str] = frozenset(
+        {"parse_obj", "model_validate", "from_orm", "model_validate_json"}
+    )
+
+    # Receiver expressions that indicate the argument came from the HTTP request.
+    _REQUEST_RECEIVERS: frozenset[str] = frozenset({"request", "req"})
+
+    def _infer_pydantic_route_bodies(self, routes: list[RouteModel]) -> None:
+        """Set body.model_name for Python routes that instantiate a Pydantic model.
+
+        Flask, Django, and similar frameworks don't emit Pydantic body metadata
+        from their plugins — the handler just calls ``Model(**request.get_json())``
+        directly.  This pass scans call sites to recover those model references,
+        so _collect_schemas can assign usage="request_body" instead of "domain".
+        """
+        py_ctx = self._analysis_contexts.get(Language.PYTHON)
+        if not py_ctx or not py_ctx.type_resolver:
+            return
+
+        all_models = py_ctx.type_resolver.get_all_models()
+        if not all_models:
+            return
+
+        # simple class name → first matching qualified name
+        simple_to_qname: dict[str, str] = {}
+        for qname in all_models:
+            simple = qname.rsplit(".", 1)[-1]
+            if simple not in simple_to_qname:
+                simple_to_qname[simple] = qname
+        model_simple_names: frozenset[str] = frozenset(simple_to_qname)
+
+        # caller qualified name → list of ParsedCallSite
+        caller_calls: dict[str, list] = {}
+        for parsed in self._parsed_files.values():
+            if not parsed.success or parsed.language != Language.PYTHON:
+                continue
+            for cs in parsed.call_sites or []:
+                if cs.caller_function:
+                    key = cs.caller_function.full
+                    caller_calls.setdefault(key, []).append(cs)
+
+        for i, route in enumerate(routes):
+            if route.body is not None:
+                continue
+            if route.method not in ("POST", "PUT", "PATCH"):
+                continue
+            if route.framework not in self._PYDANTIC_INFER_FRAMEWORKS:
+                continue
+
+            call_sites = caller_calls.get(route.handler_function, [])
+            if not call_sites:
+                continue
+
+            model_name = self._pick_pydantic_body_model(call_sites, model_simple_names)
+            if model_name:
+                routes[i] = route.model_copy(
+                    update={
+                        "body": HttpBodyModel(
+                            content_type="application/json",
+                            model_name=model_name,
+                            body_fields=[],
+                            required=True,
+                        )
+                    }
+                )
+
+    def _pick_pydantic_body_model(
+        self,
+        call_sites: list,
+        model_simple_names: frozenset[str],
+    ) -> str | None:
+        """Return the first Pydantic model instantiated with what looks like request data.
+
+        Prefers calls that directly spread request data (**request.json, **data where
+        data came from get_json).  Falls back to any Pydantic model instantiation found
+        in the handler — these are almost always the request schema for POST handlers.
+        """
+        # Check if this handler reads from an HTTP request object at all
+        has_request_read = any(
+            cs.receiver_expression in self._REQUEST_RECEIVERS
+            or "get_json" in cs.callee_name
+            or "request.json" in cs.callee_name
+            or "request.data" in cs.callee_name
+            or "request.body" in cs.callee_name
+            for cs in call_sites
+        )
+
+        candidates: list[tuple[int, str]] = []  # (priority, model_name)
+
+        for cs in call_sites:
+            callee = cs.callee_name
+
+            # Direct instantiation: UserCreate(**data)
+            if callee in model_simple_names:
+                has_spread = any(getattr(arg, "is_keyword_spread", False) for arg in cs.arguments)
+                priority = 0 if has_spread else 1
+                candidates.append((priority, callee))
+
+            # Class-method call: UserCreate.parse_obj(data) / UserCreate.model_validate(data)
+            elif "." in callee:
+                obj, _, method = callee.rpartition(".")
+                if obj in model_simple_names and method in self._PYDANTIC_CLASS_METHODS:
+                    candidates.append((0, obj))
+
+        if not candidates:
+            return None
+
+        # If no request read was found, be conservative: only infer if there's a spread call
+        if not has_request_read:
+            candidates = [(p, m) for p, m in candidates if p == 0]
+            if not candidates:
+                return None
+
+        candidates.sort(key=lambda x: x[0])
+        return candidates[0][1]
+
     def _get_type_resolver(self):
         """Get the type resolver from whichever analysis context is available."""
         ctx = (
@@ -1426,6 +1577,11 @@ class ProjectAnalyzer:
                                     extracts=dep.extracts_fields,
                                     validates=dep.validates,
                                     jwt_operations=dep.jwt_operations,
+                                    controller_module=dep.qualified_name.module
+                                    if dep.qualified_name
+                                    else "",
+                                    only_actions=list(dep.only_actions),
+                                    except_actions=list(dep.except_actions),
                                 )
                             )
                         except ValidationError as exc:
@@ -1550,6 +1706,148 @@ class ProjectAnalyzer:
             if dep_name:
                 route.router_name = dep_name
 
+    def _propagate_express_parent_auth_to_routes(self, routes: list[RouteModel]) -> None:
+        """Propagate auth middleware from parent Express router files to child routes.
+
+        A parent router file may call router.use(apikey) before mounting sub-routers
+        via router.use('/path', subRouter).  Routes in those sub-router files inherit
+        the middleware even though it doesn't appear in their own file.
+
+        The parent auth map is built by build_express_auth_middleware_map() and stored
+        on self._express_parent_auth_map during context setup.  Each entry maps a
+        resolved file path to the list of auth middleware variable names accumulated
+        from all ancestor router.use() calls that precede the mount of that file.
+        """
+        if not self._express_parent_auth_map:
+            return
+        for route in routes:
+            if route.router_name is not None:
+                continue
+            if not route.handler_location or not route.handler_location.file:
+                continue
+            auth_middlewares = self._express_parent_auth_map.get(route.handler_location.file, [])
+            if auth_middlewares:
+                route.router_name = "+".join(auth_middlewares)
+
+    def _propagate_django_class_auth_to_routes(
+        self,
+        routes: list[RouteModel],
+        auth_model: AuthModel,
+    ) -> None:
+        """Link Django CBV CLASS-type auth dependencies to their routes.
+
+        DRF APIView subclasses that inherit from an auth mixin (e.g. ApiAuthMixin)
+        are emitted as CLASS-type auth dependencies by the Django plugin.  The
+        generic _propagate_file_auth_to_routes only handles MIDDLEWARE-type deps,
+        so this pass closes the gap for class-based auth.
+
+        Matching logic: route handler_function strings look like
+        "urls.FileStandardUploadApi.post" (module.ClassName.method).  We split on "."
+        and check every component against a global class-name → dep-name map so
+        the lookup works regardless of module prefix.
+
+        File-key matching is intentionally skipped — Django view classes are defined
+        in apis.py but routes are extracted from urls.py, so the handler_location
+        file and the dep location file differ.
+        """
+        class_to_dep: dict[str, str] = {}
+        for dep in auth_model.auth_dependencies:
+            if dep.type != "CLASS":
+                continue
+            class_to_dep[dep.name] = dep.name
+
+        if not class_to_dep:
+            return
+
+        for route in routes:
+            if route.router_name is not None:
+                continue
+            handler = str(route.handler_function or "")
+            for part in handler.split("."):
+                dep_name = class_to_dep.get(part)
+                if dep_name:
+                    route.router_name = dep_name
+                    break
+
+    def _propagate_rails_auth_to_routes(
+        self,
+        routes: list[RouteModel],
+        auth_model: AuthModel,
+    ) -> None:
+        """Link Rails before_action guards to routes using controller + action matching.
+
+        Deps extracted by the Rails plugin carry qualified_name.module = controller
+        resource name (e.g. 'articles') and only_actions/except_actions filters.
+        Routes carry handler_function.module = same controller name and
+        handler_function.name = action name.
+
+        A route is covered by a dep when:
+          - dep.qualified_name.module == route.handler_function.module  (same controller)
+          - action is in dep.only_actions (if only_actions is set), OR
+            action is NOT in dep.except_actions (if except_actions is set), OR
+            no filter is set (applies to all actions)
+
+        Special case — Ruby GraphQL routes (path starts with /graphql:):
+          graphql-ruby routes are served by a single GraphqlController whose
+          controller_module is "graphql".  Their handler_function.module is the
+          type-file stem ("query_type", "mutation_type"), NOT "graphql", so the
+          regular controller matching never fires.  We match them unconditionally
+          against any dep whose controller_module is "graphql" — action-level
+          only:/except: filters on that dep target controller actions ("execute"),
+          not individual GraphQL field names, so coverage is treated as global.
+        """
+        rails_deps = [
+            dep
+            for dep in auth_model.auth_dependencies
+            if dep.type == "FUNCTION" and dep.controller_module
+        ]
+        if not rails_deps:
+            return
+
+        graphql_ctrl_deps = [d for d in rails_deps if d.controller_module == "graphql"]
+
+        for route in routes:
+            if route.router_name is not None:
+                continue
+            hf = route.handler_function
+            if not hf:
+                continue
+
+            # Ruby GraphQL routes: match against GraphqlController deps only.
+            if route.path.startswith("/graphql:") and graphql_ctrl_deps:
+                route.router_name = graphql_ctrl_deps[0].name
+                continue
+
+            # handler_function stored as "controller.action" string in RouteModel
+            hf_str = str(hf)
+            parts = hf_str.split(".")
+            ctrl_module = parts[0] if len(parts) > 1 else ""
+            action = parts[-1]
+
+            for dep in rails_deps:
+                # Rails singular `resource :user` stores module "user" but
+                # the controller class is UsersController → dep module "users".
+                # Try exact match first, then simple +s pluralization as fallback.
+                # Namespaced controllers (Api::V1::AnnouncementsController →
+                # "api/v1/announcements") only store the resource name in the
+                # routes file ("announcements"), so also match on the last segment.
+                dep_mod = dep.controller_module
+                dep_suffix = dep_mod.rsplit("/", 1)[-1]
+                candidates = {ctrl_module, ctrl_module + "s"}
+                if dep_mod not in candidates and dep_suffix not in candidates:
+                    continue
+                only = dep.only_actions
+                excl = dep.except_actions
+                if only:
+                    covered = action in only
+                elif excl:
+                    covered = action not in excl
+                else:
+                    covered = True
+                if covered:
+                    route.router_name = dep.name
+                    break
+
     def _apply_spring_filter_chain_policy(self, routes: list[RouteModel]) -> None:
         """Apply a Spring SecurityFilterChain policy to Spring/GraphQL routes.
 
@@ -1844,6 +2142,20 @@ class ProjectAnalyzer:
             "truncated_flows": 0,
         }
 
+        # ── Ruby intra-method taint (runs without a call graph) ──────────────
+        ruby_files = [
+            pf for pf in self._parsed_files.values() if pf.success and pf.language == Language.RUBY
+        ]
+        if ruby_files:
+            from ..frameworks.ruby.taint_scanner import RubyTaintScanner
+
+            for flow_dict in RubyTaintScanner(ruby_files).scan():
+                try:
+                    flows.append(DataFlowModel(**flow_dict))
+                    self._data_flow_stats["flows_discovered"] += 1
+                except (KeyError, ValueError, TypeError) as exc:
+                    logger.warning("Ruby taint flow model error: %s", exc)
+
         if not self._call_graph:
             return flows, self._data_flow_stats
 

{apisec_code_bolt-0.1.2 → apisec_code_bolt-0.1.3}/src/apisec_code_bolt/analysis/call_graph.py

@@ -400,6 +400,30 @@ class CallGraphBuilder:
                 if len(parts) > 1:
                     scope_function = ".".join(parts[:-1])
 
+            # Statically-typed languages (Java, C#) record a local variable's
+            # DECLARED type, which is authoritative for method-receiver
+            # resolution regardless of the initializer -- e.g. for
+            # ``LoaderOptions options = new LoaderOptions()`` the initializer is
+            # an object-creation expression (not a "call"), but the declared
+            # type tells us ``options`` is a ``LoaderOptions``. Binding it lets
+            # ``options.method()`` resolve to the library FQCN (needed for
+            # class-level reachability). Resolve the declared type through the
+            # import map; skip ``var``/``val`` inference keywords and primitives
+            # (lower-cased type names like ``int``/``boolean`` are never call
+            # receivers).
+            decl_type = assign.type_annotation
+            if decl_type and decl_type not in ("var", "val", "dynamic"):
+                base = decl_type.split("<", 1)[0].replace("[]", "").strip()
+                if base and base[0].isupper():
+                    resolved = self._imports.get((file_path, base), base)
+                    self._bindings.add_assignment(
+                        assign.target,
+                        resolved,
+                        file_path,
+                        assign.location.line,
+                        scope_function=scope_function,
+                    )
+
             if assign.source_type == "call" and assign.source_call:
                 # x = SomeClass() -> x is bound to SomeClass
                 called = assign.source_call

{apisec_code_bolt-0.1.2 → apisec_code_bolt-0.1.3}/src/apisec_code_bolt/analysis/data_flow.py

@@ -47,6 +47,21 @@ if TYPE_CHECKING:
 logger = logging.getLogger(__name__)
 
 
+# Maps an OriginType member name to its wire placement (the OpenAPI-style
+# ``in`` taxonomy: query/path/header/cookie/body). Only HTTP request inputs
+# have a wire identity; non-request origins (env vars, DB reads, etc.) are
+# absent here and produce no WireIdentityModel.
+_ORIGIN_TYPE_TO_WIRE_IN: dict[str, str] = {
+    "HTTP_PATH_PARAM": "path",
+    "HTTP_QUERY_PARAM": "query",
+    "HTTP_HEADER": "header",
+    "HTTP_COOKIE": "cookie",
+    "HTTP_BODY": "body",
+    "HTTP_FORM": "body",
+    "HTTP_FILE": "body",
+}
+
+
 # =============================================================================
 # Core Data Structures
 # =============================================================================
@@ -1720,6 +1735,7 @@ class DataFlowAnalyzer:
             FlowStepModel,
             LocationModel,
             TransformationModel,
+            WireIdentityModel,
         )
 
         result = []
@@ -1763,16 +1779,25 @@ class DataFlowAnalyzer:
 
             sink_evidence_model = self._evidence_to_model(flow.sink_evidence)
 
+            origin_type_name = flow.origin_type.name
+            wire_in = _ORIGIN_TYPE_TO_WIRE_IN.get(origin_type_name)
+            wire_identity = (
+                WireIdentityModel(name=flow.origin_name, location=wire_in)
+                if wire_in and flow.origin_name
+                else None
+            )
+
             flow_model = DataFlowModel(
                 id=flow.id,
                 origin=DataOriginModel(
-                    type=flow.origin_type.name,
+                    type=origin_type_name,
                     name=flow.origin_name,
                     location=LocationModel(
                         file=str(flow.origin_location[0]),
                         line=flow.origin_location[1],
                     ),
                     entry_point_ref=flow.entry_point_id,
+                    wire=wire_identity,
                 ),
                 sink=DataSinkModel(
                     function=flow.sink_function,

{apisec_code_bolt-0.1.2 → apisec_code_bolt-0.1.3}/src/apisec_code_bolt/analysis/dependency_extractor.py

@@ -37,6 +37,7 @@ class DependencyExtractor:
         "package.json": "_parse_package_json",
         "go.mod": "_parse_go_mod",
         "Cargo.toml": "_parse_cargo_toml",
+        "Gemfile.lock": "_parse_gemfile_lock",
     }
 
     # Each parser handles exactly one ecosystem; tag packages authoritatively at
@@ -54,6 +55,7 @@ class DependencyExtractor:
         "_parse_csproj": "NuGet",
         "_parse_pom": "Maven",
         "_parse_gradle": "Maven",
+        "_parse_gemfile_lock": "RubyGems",
     }
 
     _SKIP_DIRS = frozenset(
@@ -354,6 +356,48 @@ class DependencyExtractor:
 
         return packages
 
+    # -- Gemfile.lock (Ruby) ---------------------------------------------------
+
+    def _parse_gemfile_lock(self, path: Path) -> list[PackageDependencyModel]:
+        """Parse Gemfile.lock — resolved gems under each GEM/GIT/PATH ``specs:``.
+
+        A lockfile pins exact versions, so every gem yields a confident version.
+        Resolved gems sit at a 4-space indent as ``name (version)``; deeper
+        (6-space) lines are sub-dependency constraints and are skipped, as is the
+        2-space DEPENDENCIES section (ranges, not resolved). Platform suffixes
+        (``1.13.9-x86_64-linux``) are stripped — Ruby prereleases use dots
+        (``1.2.3.rc1``), so a hyphen in a lockfile version is always the platform.
+        """
+        packages: list[PackageDependencyModel] = []
+        spec_re = re.compile(r"^    ([A-Za-z0-9._-]+) \(([^)]+)\)$")
+        try:
+            in_specs = False
+            for raw in path.read_text(errors="replace").splitlines():
+                if raw and not raw[0].isspace():
+                    in_specs = False  # top-level section (GEM, PLATFORMS, DEPENDENCIES, …)
+                    continue
+                if raw.strip() == "specs:":
+                    in_specs = True
+                    continue
+                if not in_specs:
+                    continue
+                m = spec_re.match(raw)
+                if not m:
+                    continue  # 6-space sub-dependency constraints, etc.
+                packages.append(
+                    PackageDependencyModel(
+                        name=m.group(1),
+                        version=m.group(2).split("-", 1)[0].strip(),
+                        version_constraint=None,
+                        is_dev=False,
+                        source_file=path.name,
+                    )
+                )
+        except Exception as e:
+            logger.warning("Failed to parse %s: %s", path.name, e)
+
+        return packages
+
     # -- Pipfile ---------------------------------------------------------------
 
     def _parse_pipfile(self, path: Path) -> list[PackageDependencyModel]: