argus-languages 0.1.1__py3-none-any.whl

argus_languages/__init__.py

@@ -0,0 +1,15 @@
+"""Built-in multi-language security pattern scanner."""
+
+from argus_languages.models import Finding, ScanResult, Severity
+from argus_languages.scanner import SUPPORTED_LANGUAGES, scan_directory, scan_path
+
+__all__ = [
+    "Finding",
+    "ScanResult",
+    "Severity",
+    "SUPPORTED_LANGUAGES",
+    "scan_directory",
+    "scan_path",
+]
+
+__version__ = "0.1.1"

argus_languages/bundled_rules/__init__.py

@@ -0,0 +1 @@
+"""Bundled YAML security rules."""

argus_languages/bundled_rules/ansible.yaml

@@ -0,0 +1,42 @@
+- id: ansible-shell-command
+  title: Ansible shell/command module — prefer ansible.builtin.command
+  severity: moderate
+  pattern: 'ansible\.builtin\.(shell|raw):|^\s*(shell|raw):\s'
+  flags: [m]
+  languages: [ansible]
+
+- id: ansible-no-become-password
+  title: Hardcoded become/sudo password
+  severity: high
+  pattern: '(ansible_become_pass|ansible_sudo_pass|become_pass):\s*["''][^"'']+["'']'
+  languages: [ansible]
+
+- id: ansible-ssl-verify-off
+  title: SSL certificate verification disabled
+  severity: high
+  pattern: '(validate_certs:\s*false|verify:\s*false|insecure:\s*true)'
+  languages: [ansible]
+
+- id: ansible-world-perms
+  title: File permissions too open (777 or 666)
+  severity: moderate
+  pattern: 'mode:\s*[''"]?(0777|666|0o777)'
+  languages: [ansible]
+
+- id: ansible-hardcoded-secret
+  title: Hardcoded password or token in playbook
+  severity: high
+  pattern: '(password|api_key|token|secret):\s*["''][^"'']{4,}["'']'
+  languages: [ansible]
+
+- id: ansible-unquoted-var-shell
+  title: Unquoted Jinja variable in shell context
+  severity: moderate
+  pattern: '(shell|command):\s*[^\n]*\{\{[^}]+\}\}'
+  languages: [ansible]
+
+- id: ansible-git-insecure
+  title: Git clone with accept_hostkey or force
+  severity: moderate
+  pattern: '(accept_hostkey:\s*true|force:\s*true)'
+  languages: [ansible]

argus_languages/bundled_rules/common.yaml

@@ -0,0 +1,65 @@
+- id: injection-eval
+  title: Dynamic code execution (eval/exec) — injection risk
+  severity: high
+  pattern: '\beval\s*\(|\bexec\s*\(|\bFunction\s*\(|Runtime\.getRuntime\(\)\.exec'
+  languages: [javascript, typescript, python, java, php, ruby, perl, lua, vue]
+
+- id: sql-concat
+  title: Possible SQL injection — string concatenation in query
+  severity: high
+  pattern: '(SELECT|INSERT|UPDATE|DELETE|query\s*\+|f["''].*SELECT|Statement\.execute\s*\([^)]*\+)'
+  flags: [i]
+  languages: [javascript, typescript, python, java, php, ruby, csharp, go, kotlin, scala]
+
+- id: command-injection
+  title: Possible command injection — shell execution
+  severity: high
+  pattern: '(os\.system|subprocess\.(call|Popen|run)|shell_exec|exec\s*\(|passthru|system\s*\(|ProcessBuilder|child_process\.exec|Runtime\.getRuntime|os/exec\.Command)'
+  languages: [javascript, typescript, python, java, php, ruby, go, csharp, kotlin, scala, perl, shell]
+
+- id: weak-crypto
+  title: Weak cryptography (MD5/SHA1/DES/ECB)
+  severity: moderate
+  pattern: '(MD5|SHA1|DES|ECB|createHash\s*\(\s*["'']md5|MessageDigest\.getInstance\s*\(\s*["'']MD5|hash\.md5)'
+  flags: [i]
+
+- id: hardcoded-password
+  title: Hardcoded password or secret assignment
+  severity: high
+  pattern: '(password\s*=\s*["''][^"'']{4,}["'']|passwd\s*=\s*["'']|api_key\s*=\s*["''][^"'']+["'']|secret_key\s*=\s*["''][^"'']+["''])'
+  flags: [i]
+
+- id: deserialization
+  title: Unsafe deserialization
+  severity: high
+  pattern: '(pickle\.loads|yaml\.load\s*\(|unserialize\s*\(|ObjectInputStream|readObject\s*\()'
+  languages: [python, java, php, ruby, csharp, kotlin, scala, rust]
+
+- id: ssrf-fetch
+  title: Possible SSRF — URL fetch may use user-controlled input
+  severity: moderate
+  pattern: '(fetch\s*\([^)]*\+|requests\.(get|post)\s*\([^)]*\+|HttpClient.*\+|file_get_contents\s*\(\s*\$|urllib\.request\.urlopen\s*\([^)]*\+)'
+  languages: [javascript, typescript, python, php, ruby, java, go]
+
+- id: xss-innerhtml
+  title: Possible XSS — unsafe HTML insertion
+  severity: high
+  pattern: '(innerHTML\s*=|dangerouslySetInnerHTML|document\.write\s*\()'
+  languages: [javascript, typescript, vue, php]
+
+- id: nosql-injection
+  title: Possible NoSQL injection
+  severity: high
+  pattern: '(\$where|\$regex.*\+|find\s*\(\s*\{[^}]*\$)'
+  languages: [javascript, typescript, python]
+
+- id: cors-wildcard
+  title: CORS allows all origins (*)
+  severity: moderate
+  pattern: '(Access-Control-Allow-Origin[''"]\s*,\s*[''"]\*|cors\s*\(\s*\{[^}]*origin\s*:\s*[''"]\*)'
+  languages: [javascript, typescript]
+
+- id: path-traversal
+  title: Possible path traversal — user input in file path
+  severity: moderate
+  pattern: '(open\s*\([^)]*\+|readFile\s*\([^)]*\+|include\s*\(\s*\$|require\s*\(\s*\$|new File\s*\([^)]*\+)'

argus_languages/bundled_rules/dart.yaml

@@ -0,0 +1,57 @@
+- id: dart-cleartext-http
+  title: Cleartext HTTP URL — use HTTPS
+  severity: high
+  pattern: 'http://[^\s"'']+'
+  languages: [dart]
+
+- id: dart-hardcoded-secret
+  title: Hardcoded API key or secret in Dart source
+  severity: high
+  pattern: '(apiKey|api_key|secretKey|secret_key|accessToken|password)\s*=\s*[''"][^''"]{8,}[''"]'
+  flags: [i]
+  languages: [dart]
+
+- id: dart-weak-hash
+  title: Weak hashing (MD5/SHA-1) in Dart crypto
+  severity: moderate
+  pattern: '(Digest\s*\(\s*[''"]SHA-1|Digest\s*\(\s*[''"]MD5|MD5Digest|SHA1Digest|md5\.convert|sha1\.convert)'
+  flags: [i]
+  languages: [dart]
+
+- id: dart-bad-cert-callback
+  title: TLS certificate validation disabled (badCertificateCallback)
+  severity: high
+  pattern: 'badCertificateCallback\s*=>|badCertificateCallback\s*\('
+  languages: [dart]
+
+- id: dart-insecure-storage
+  title: Sensitive data in SharedPreferences — prefer flutter_secure_storage
+  severity: moderate
+  pattern: '(SharedPreferences.*\.(setString|setBool).*(password|token|secret|pin|apiKey))'
+  flags: [i]
+  languages: [dart]
+
+- id: dart-webview-js
+  title: WebView JavaScript enabled — XSS risk if loading untrusted content
+  severity: moderate
+  pattern: 'javascriptMode:\s*JavascriptMode\.unrestricted'
+  languages: [dart]
+
+- id: dart-print-sensitive
+  title: Possible sensitive data logged via print/debugPrint
+  severity: low
+  pattern: '(print|debugPrint)\s*\([^)]*(password|token|secret|apiKey|credential)'
+  flags: [i]
+  languages: [dart]
+
+- id: dart-sql-concat
+  title: Possible SQL injection — string concatenation in query
+  severity: high
+  pattern: '(rawQuery|execute)\s*\(\s*[''"][^''"]*[''"]\s*\+'
+  languages: [dart]
+
+- id: dart-eval
+  title: Dynamic evaluation — code injection risk
+  severity: high
+  pattern: '(Isolate\.spawnUri|Function\.apply\s*\([^)]*user|dart:mirrors)'
+  languages: [dart]

argus_languages/bundled_rules/flutter.yaml

@@ -0,0 +1,58 @@
+- id: flutter-debug-dependency
+  title: Debug-only package in production dependencies
+  severity: moderate
+  pattern: '^\s*(flutter_test|integration_test|mockito|build_runner):'
+  flags: [m]
+  languages: [flutter]
+
+- id: flutter-http-dependency
+  title: Plain http package — prefer https and certificate pinning for production
+  severity: low
+  pattern: '^\s*http:\s'
+  flags: [m]
+  languages: [flutter]
+
+- id: flutter-android-debuggable
+  title: Android app debuggable in release — set android:debuggable=false for production
+  severity: high
+  pattern: 'android:debuggable\s*=\s*["'']true["'']'
+  languages: [flutter]
+
+- id: flutter-android-backup
+  title: Android allowBackup enabled — may expose app data
+  severity: moderate
+  pattern: 'android:allowBackup\s*=\s*["'']true["'']'
+  languages: [flutter]
+
+- id: flutter-android-cleartext
+  title: Android cleartext traffic allowed
+  severity: high
+  pattern: 'usesCleartextTraffic\s*=\s*["'']true["'']'
+  languages: [flutter]
+
+- id: flutter-android-exported
+  title: Android component exported without permission — review attack surface
+  severity: moderate
+  pattern: 'android:exported\s*=\s*["'']true["'']'
+  languages: [flutter]
+
+- id: flutter-ios-arbitrary-loads
+  title: iOS App Transport Security disabled (allows arbitrary loads)
+  severity: high
+  pattern: '<key>NSAllowsArbitraryLoads</key>\s*<true\s*/>'
+  flags: [i]
+  languages: [flutter]
+
+- id: flutter-ios-file-sharing
+  title: iOS UIFileSharingEnabled — app documents exposed via iTunes
+  severity: moderate
+  pattern: '<key>UIFileSharingEnabled</key>\s*<true\s*/>'
+  flags: [i]
+  languages: [flutter]
+
+- id: flutter-hardcoded-secret-pubspec
+  title: Possible secret in pubspec or config file
+  severity: high
+  pattern: '(api[_-]?key|secret|password|token)\s*:\s*[''"][^''"]{8,}[''"]'
+  flags: [i]
+  languages: [flutter]

argus_languages/bundled_rules/java.yaml

@@ -0,0 +1,35 @@
+- id: java-sql-statement-concat
+  title: Java SQL Statement built via string concatenation
+  severity: high
+  pattern: '(Statement\.execute\s*\(|createStatement\s*\(\).*\+|PreparedStatement.*\+.*\+)'
+  languages: [java, kotlin, scala]
+
+- id: java-xxe
+  title: Possible XXE — XML parser without secure features
+  severity: high
+  pattern: '(DocumentBuilderFactory\.newInstance|SAXParserFactory\.newInstance|XMLInputFactory\.newInstance)'
+  languages: [java, kotlin, scala]
+
+- id: java-ldap-injection
+  title: Possible LDAP injection — concatenated filter
+  severity: high
+  pattern: '(search\s*\([^)]*\+|DirContext\.search\s*\([^)]*\+)'
+  languages: [java, kotlin]
+
+- id: java-path-traversal
+  title: Possible path traversal — user input in file path
+  severity: moderate
+  pattern: '(Paths\.get\s*\([^)]*\+|Files\.(read|write).*\+)'
+  languages: [java, kotlin, scala]
+
+- id: spring-csrf-disabled
+  title: Spring CSRF protection disabled
+  severity: moderate
+  pattern: '\.csrf\s*\(\s*\)\.disable\s*\(\)'
+  languages: [java, kotlin]
+
+- id: java-log-injection
+  title: Possible log injection — user input in log statement
+  severity: low
+  pattern: '(logger\.(info|warn|error|debug)\s*\([^)]*\+.*request\.|log\.(info|warn|error)\s*\([^)]*\+)'
+  languages: [java, kotlin]

argus_languages/bundled_rules/other.yaml

@@ -0,0 +1,111 @@
+- id: python-debug-enabled
+  title: Debug mode enabled
+  severity: low
+  pattern: '(DEBUG\s*=\s*True|app\.run\s*\([^)]*debug\s*=\s*True)'
+  flags: [i]
+  languages: [python]
+
+- id: python-flask-secret
+  title: Hardcoded Flask secret key
+  severity: high
+  pattern: 'SECRET_KEY\s*=\s*["''][^"'']+["'']'
+  languages: [python]
+
+- id: python-django-allowed-hosts
+  title: Django ALLOWED_HOSTS allows all (*)
+  severity: moderate
+  pattern: 'ALLOWED_HOSTS\s*=\s*\[[^\]]*[''"]\*[''"]'
+  languages: [python]
+
+- id: docker-secrets-env
+  title: Secret passed via ENV in Dockerfile
+  severity: high
+  pattern: '^ENV\s+.*(PASSWORD|SECRET|API_KEY|TOKEN)='
+  flags: [im]
+  languages: [docker]
+
+- id: docker-privileged
+  title: Docker Compose privileged mode enabled
+  severity: high
+  pattern: 'privileged:\s*true'
+  languages: [docker]
+
+- id: docker-host-network
+  title: Docker Compose uses host network mode
+  severity: moderate
+  pattern: 'network_mode:\s*["'']?host["'']?'
+  languages: [docker]
+
+- id: docker-socket-mount
+  title: Docker socket mounted — container escape risk
+  severity: high
+  pattern: '/var/run/docker\.sock'
+  languages: [docker]
+
+- id: k8s-privileged-container
+  title: Kubernetes container runs in privileged mode
+  severity: high
+  pattern: 'privileged:\s*true'
+  languages: [kubernetes]
+
+- id: k8s-run-as-root
+  title: Kubernetes pod runs as root (runAsUser 0)
+  severity: moderate
+  pattern: 'runAsUser:\s*0'
+  languages: [kubernetes]
+
+- id: k8s-host-network
+  title: Pod uses hostNetwork
+  severity: high
+  pattern: 'hostNetwork:\s*true'
+  languages: [kubernetes]
+
+- id: k8s-host-pid
+  title: Pod uses hostPID
+  severity: high
+  pattern: 'hostPID:\s*true'
+  languages: [kubernetes]
+
+- id: go-insecure-tls
+  title: TLS InsecureSkipVerify enabled
+  severity: high
+  pattern: 'InsecureSkipVerify:\s*true'
+  languages: [go]
+
+- id: go-sql-sprintf
+  title: SQL built with fmt.Sprintf — use parameterized queries
+  severity: high
+  pattern: '(fmt\.Sprintf\s*\(\s*["''].*(SELECT|INSERT|UPDATE|DELETE))'
+  flags: [i]
+  languages: [go]
+
+- id: shell-curl-pipe-bash
+  title: curl/wget piped to shell — supply chain risk
+  severity: high
+  pattern: '(curl|wget)[^\n|]*\|\s*(bash|sh|zsh)'
+  languages: [shell]
+
+- id: sql-grant-all
+  title: GRANT ALL privileges
+  severity: moderate
+  pattern: 'GRANT\s+ALL'
+  flags: [i]
+  languages: [sql]
+
+- id: csharp-binary-formatter
+  title: BinaryFormatter deserialization — RCE risk
+  severity: high
+  pattern: 'BinaryFormatter'
+  languages: [csharp]
+
+- id: rust-unsafe-block
+  title: Unsafe Rust block — review memory safety
+  severity: low
+  pattern: '\bunsafe\s*\{'
+  languages: [rust]
+
+- id: elixir-eval
+  title: Elixir Code.eval_string — code injection risk
+  severity: high
+  pattern: 'Code\.eval_string'
+  languages: [elixir]

argus_languages/bundled_rules/php.yaml

@@ -0,0 +1,35 @@
+- id: php-xss-echo
+  title: Possible XSS — unescaped output
+  severity: high
+  pattern: '(echo\s+\$_|print\s+\$_|<\?=\s*\$_)'
+  languages: [php]
+
+- id: php-include-user-input
+  title: Possible LFI — include/require with variable
+  severity: high
+  pattern: '((include|require)(_once)?\s*\(\s*\$)'
+  languages: [php]
+
+- id: php-sql-mysql
+  title: Possible SQL injection — mysql_query with variable
+  severity: high
+  pattern: '(mysql_query\s*\([^)]*\$|mysqli_query\s*\([^)]*\$)'
+  languages: [php]
+
+- id: php-deserialize
+  title: Unsafe unserialize() on user input
+  severity: high
+  pattern: 'unserialize\s*\(\s*\$_'
+  languages: [php]
+
+- id: php-dangerous-functions
+  title: Dangerous function — eval/assert/create_function
+  severity: high
+  pattern: '\b(assert\s*\(|create_function\s*\(|preg_replace\s*\([^)]*\/e)'
+  languages: [php]
+
+- id: php-open-redirect
+  title: Possible open redirect — header Location with user input
+  severity: moderate
+  pattern: 'header\s*\(\s*["'']Location:.*\$_(GET|POST|REQUEST)'
+  languages: [php]

argus_languages/bundled_rules/terraform.yaml

@@ -0,0 +1,59 @@
+- id: tf-public-s3-acl
+  title: S3 bucket ACL set to public-read or public-read-write
+  severity: high
+  pattern: 'acl\s*=\s*"(public-read|public-read-write|authenticated-read)"'
+  languages: [terraform]
+
+- id: tf-s3-public-access-block-off
+  title: S3 public access block disabled
+  severity: high
+  pattern: 'block_public_(acls|policy)\s*=\s*false'
+  languages: [terraform]
+
+- id: tf-open-security-group
+  title: Security group allows ingress from 0.0.0.0/0
+  severity: high
+  pattern: '(cidr_blocks\s*=\s*\[[^\]]*["'']0\.0\.0\.0\/0["'']|0\.0\.0\.0\/0)'
+  languages: [terraform]
+
+- id: tf-unencrypted-ebs
+  title: EBS volume encryption disabled
+  severity: moderate
+  pattern: 'encrypted\s*=\s*false'
+  languages: [terraform]
+
+- id: tf-rds-public
+  title: RDS instance publicly accessible
+  severity: high
+  pattern: 'publicly_accessible\s*=\s*true'
+  languages: [terraform]
+
+- id: tf-hardcoded-secret
+  title: Hardcoded secret in Terraform resource
+  severity: high
+  pattern: '(password\s*=\s*"[^"]{4,}"|secret_key\s*=\s*"[^"]+"|access_key\s*=\s*"AKIA)'
+  languages: [terraform]
+
+- id: tf-iam-wildcard
+  title: IAM policy allows wildcard actions or resources
+  severity: high
+  pattern: '(Action\s*=\s*"\*"|Resource\s*=\s*"\*")'
+  languages: [terraform]
+
+- id: tf-http-backend
+  title: Terraform HTTP backend without TLS verification
+  severity: moderate
+  pattern: '(skip_tls_verification\s*=\s*true|address\s*=\s*"http:\/\/)'
+  languages: [terraform]
+
+- id: tf-azure-storage-public
+  title: Azure storage allows public blob access
+  severity: high
+  pattern: 'allow_blob_public_access\s*=\s*true'
+  languages: [terraform]
+
+- id: tf-gcp-public-bucket
+  title: GCP bucket with allUsers or allAuthenticatedUsers
+  severity: high
+  pattern: '(allUsers|allAuthenticatedUsers)'
+  languages: [terraform]

argus_languages/cli.py

@@ -0,0 +1,46 @@
+from __future__ import annotations
+
+import argparse
+import json
+import sys
+
+from argus_languages import __version__, scan_directory
+
+
+def main(argv: list[str] | None = None) -> int:
+    parser = argparse.ArgumentParser(
+        prog="argus-languages",
+        description="Built-in multi-language security pattern scanner (Java, PHP, Terraform, Ansible, …)",
+    )
+    parser.add_argument("--version", action="version", version=f"argus-languages {__version__}")
+    sub = parser.add_subparsers(dest="command", required=True)
+
+    scan_p = sub.add_parser("scan", help="Scan a file or directory")
+    scan_p.add_argument("target", help="Path to scan")
+    scan_p.add_argument(
+        "--format", "-f", choices=["table", "json"], default="table", help="Output format"
+    )
+
+    args = parser.parse_args(argv)
+    if args.command != "scan":
+        return 2
+
+    result = scan_directory(args.target)
+    if args.format == "json":
+        print(json.dumps(result.to_dict(), indent=2))
+    else:
+        if result.errors:
+            for err in result.errors:
+                print(f"Note: {err}", file=sys.stderr)
+        if not result.findings:
+            print("No findings.")
+        for f in result.findings:
+            sev = f.severity.value.upper()
+            loc = f"{f.file}:{f.line}" if f.file else "?"
+            print(f"[{sev}] {loc} — {f.title} ({f.rule_id})")
+
+    return 1 if result.findings else 0
+
+
+if __name__ == "__main__":
+    raise SystemExit(main())

argus_languages/discover.py

@@ -0,0 +1,176 @@
+from __future__ import annotations
+
+import re
+from dataclasses import dataclass
+from pathlib import Path
+
+SKIP_DIRS = {
+    "node_modules", ".git", "dist", "build", ".next", "coverage", "vendor",
+    "__pycache__", "target", "bin", "obj", ".venv", "venv", ".terraform",
+    ".idea", ".vscode", "Pods", "DerivedData", ".dart_tool", ".pub-cache",
+    ".gradle",
+}
+
+# Flutter platform folders under android/ are scanned; skip build artifacts only
+FLUTTER_SKIP_DIR_NAMES = {".gradle", "build", "Pods", "DerivedData"}
+
+GENERATED_DART_SUFFIXES = (".g.dart", ".freezed.dart", ".gr.dart", ".mocks.dart")
+
+LanguageId = str
+
+EXT_MAP: dict[str, LanguageId] = {
+    ".js": "javascript", ".jsx": "javascript", ".mjs": "javascript", ".cjs": "javascript",
+    ".ts": "typescript", ".tsx": "typescript", ".mts": "typescript", ".cts": "typescript",
+    ".py": "python", ".pyw": "python",
+    ".java": "java", ".jsp": "java",
+    ".php": "php", ".phtml": "php",
+    ".go": "go",
+    ".rb": "ruby", ".erb": "ruby",
+    ".cs": "csharp",
+    ".rs": "rust",
+    ".tf": "terraform", ".tfvars": "terraform", ".hcl": "terraform",
+    ".sh": "shell", ".bash": "shell", ".zsh": "shell",
+    ".sql": "sql",
+    ".kt": "kotlin", ".kts": "kotlin",
+    ".swift": "swift",
+    ".scala": "scala",
+    ".pl": "perl", ".pm": "perl",
+    ".lua": "lua",
+    ".ex": "elixir", ".exs": "elixir",
+    ".vue": "vue",
+    ".dart": "dart",
+}
+
+ANSIBLE_PATH_MARKERS = (
+    "/roles/", "/playbooks/", "/tasks/", "/handlers/", "/vars/", "/defaults/",
+    "/group_vars/", "/host_vars/", "/inventory/",
+)
+
+
+@dataclass
+class ScannedFile:
+    path: Path
+    relative: str
+    language: LanguageId
+
+
+def _is_ansible_yaml(rel: str, content: str) -> bool:
+    lower = rel.lower()
+    if any(m in lower for m in ANSIBLE_PATH_MARKERS):
+        return True
+    if re.search(r"ansible\.builtin|ansible\.legacy|- hosts:|become:|gather_facts:", content):
+        return True
+    return "playbook" in Path(lower).name
+
+
+def _is_kubernetes_yaml(rel: str, content: str) -> bool:
+    lower = rel.lower()
+    if any(p in lower for p in ("/k8s/", "/kubernetes/", "/manifests/")):
+        return True
+    return bool(re.search(r"^\s*apiVersion:", content, re.M) and re.search(r"^\s*kind:", content, re.M))
+
+
+def _is_flutter_pubspec(name: str, content: str) -> bool:
+    if name != "pubspec.yaml":
+        return False
+    return "dependencies:" in content or "flutter:" in content
+
+
+def _is_generated_dart(name: str) -> bool:
+    lower = name.lower()
+    return any(lower.endswith(suffix) for suffix in GENERATED_DART_SUFFIXES)
+
+
+def classify_file(path: Path, root: Path, content: str) -> LanguageId | None:
+    rel = str(path.relative_to(root))
+    name = path.name.lower()
+
+    if _is_generated_dart(name):
+        return None
+
+    if name == "androidmanifest.xml":
+        return "flutter"
+    if name == "info.plist" and ("ios" in rel.lower() or "macos" in rel.lower() or "CFBundle" in content):
+        return "flutter"
+    if _is_flutter_pubspec(name, content):
+        return "flutter"
+
+    if name == "dockerfile" or name.endswith(".dockerfile"):
+        return "docker"
+    if name.startswith("docker-compose") and name.endswith((".yml", ".yaml")):
+        return "docker"
+
+    ext = path.suffix.lower()
+    if ext in (".yaml", ".yml"):
+        if _is_ansible_yaml(rel, content):
+            return "ansible"
+        if _is_kubernetes_yaml(rel, content):
+            return "kubernetes"
+        return None
+
+    if ext == ".json" and _is_kubernetes_yaml(rel, content):
+        return "kubernetes"
+
+    return EXT_MAP.get(ext)
+
+
+def discover_files(target: Path) -> list[ScannedFile]:
+    root = target if target.is_dir() else target.parent
+    out: list[ScannedFile] = []
+
+    def should_skip_dir(entry: Path, name: str) -> bool:
+        if name in SKIP_DIRS:
+            return True
+        if name.startswith("."):
+            return True
+        # Keep android/ but skip nested Gradle build dirs
+        if name in FLUTTER_SKIP_DIR_NAMES and "android" in str(entry).lower():
+            return True
+        return False
+
+    def walk(directory: Path, depth: int) -> None:
+        if depth > 16:
+            return
+        try:
+            entries = list(directory.iterdir())
+        except OSError:
+            return
+        for entry in entries:
+            if should_skip_dir(entry, entry.name):
+                continue
+            if entry.is_dir():
+                walk(entry, depth + 1)
+                continue
+            try:
+                content = entry.read_text(encoding="utf-8", errors="replace")
+            except OSError:
+                continue
+            language = classify_file(entry, root, content)
+            if not language:
+                continue
+            out.append(
+                ScannedFile(
+                    path=entry,
+                    relative=str(entry.relative_to(root)),
+                    language=language,
+                )
+            )
+
+    if target.is_file():
+        try:
+            content = target.read_text(encoding="utf-8", errors="replace")
+        except OSError:
+            return []
+        language = classify_file(target, root, content)
+        if language:
+            out.append(ScannedFile(path=target, relative=target.name, language=language))
+    else:
+        walk(target, 0)
+
+    return out
+
+
+SUPPORTED_LANGUAGES = sorted(
+    set(EXT_MAP.values())
+    | {"terraform", "ansible", "docker", "kubernetes", "shell", "sql", "flutter", "dart"}
+)

argus_languages/models.py

@@ -0,0 +1,69 @@
+from __future__ import annotations
+
+from dataclasses import dataclass, field
+from enum import Enum
+from typing import Any
+
+
+class Severity(str, Enum):
+    CRITICAL = "critical"
+    HIGH = "high"
+    MEDIUM = "medium"
+    MODERATE = "moderate"
+    LOW = "low"
+    INFO = "info"
+
+    @classmethod
+    def normalize(cls, value: str) -> Severity:
+        v = value.lower()
+        if v == "moderate":
+            return cls.MEDIUM
+        try:
+            return cls(v)
+        except ValueError:
+            return cls.INFO
+
+
+@dataclass
+class Finding:
+    title: str
+    severity: Severity
+    tool: str
+    file: str = ""
+    line: int = 0
+    rule_id: str = ""
+    description: str = ""
+    language: str = ""
+
+    def to_dict(self) -> dict[str, Any]:
+        sev = self.severity.value
+        if sev == "medium":
+            sev = "moderate"
+        return {
+            "title": self.title,
+            "severity": sev,
+            "tool": self.tool,
+            "file": self.file,
+            "line": self.line,
+            "rule_id": self.rule_id,
+            "description": self.description,
+            "language": self.language,
+        }
+
+
+@dataclass
+class ScanResult:
+    tool: str
+    target: str
+    findings: list[Finding] = field(default_factory=list)
+    errors: list[str] = field(default_factory=list)
+    metadata: dict[str, Any] = field(default_factory=dict)
+
+    def to_dict(self) -> dict[str, Any]:
+        return {
+            "tool": self.tool,
+            "target": self.target,
+            "findings": [f.to_dict() for f in self.findings],
+            "errors": self.errors,
+            "metadata": self.metadata,
+        }

argus_languages/rules_loader.py

@@ -0,0 +1,79 @@
+from __future__ import annotations
+
+import re
+from dataclasses import dataclass
+from importlib import resources
+from pathlib import Path
+from typing import Any
+
+import yaml
+
+from argus_languages.models import Severity
+
+RULE_FILES = (
+    "common.yaml",
+    "java.yaml",
+    "php.yaml",
+    "terraform.yaml",
+    "ansible.yaml",
+    "dart.yaml",
+    "flutter.yaml",
+    "other.yaml",
+)
+
+
+@dataclass
+class LoadedRule:
+    id: str
+    title: str
+    severity: Severity
+    pattern: re.Pattern[str]
+    languages: list[str] | None = None
+
+
+def _compile_pattern(raw: str, flags: list[str] | None) -> re.Pattern[str]:
+    flag_bits = 0
+    for f in flags or []:
+        if f.lower() == "i":
+            flag_bits |= re.IGNORECASE
+        elif f.lower() == "m":
+            flag_bits |= re.MULTILINE
+    return re.compile(raw, flag_bits)
+
+
+def _parse_yaml_rules(data: Any) -> list[LoadedRule]:
+    if not isinstance(data, list):
+        return []
+    out: list[LoadedRule] = []
+    for item in data:
+        if not isinstance(item, dict):
+            continue
+        out.append(
+            LoadedRule(
+                id=str(item["id"]),
+                title=str(item["title"]),
+                severity=Severity.normalize(str(item.get("severity", "info"))),
+                pattern=_compile_pattern(str(item["pattern"]), item.get("flags")),
+                languages=[str(x) for x in item["languages"]] if item.get("languages") else None,
+            )
+        )
+    return out
+
+
+def load_rules_from_dir(rules_dir: Path | None = None) -> list[LoadedRule]:
+    rules: list[LoadedRule] = []
+    if rules_dir is not None:
+        for path in sorted(rules_dir.glob("*.y*ml")):
+            data = yaml.safe_load(path.read_text(encoding="utf-8"))
+            rules.extend(_parse_yaml_rules(data))
+        return rules
+
+    base = resources.files("argus_languages").joinpath("bundled_rules")
+    for name in RULE_FILES:
+        resource = base.joinpath(name)
+        try:
+            text = resource.read_text(encoding="utf-8")
+        except (FileNotFoundError, OSError, AttributeError):
+            continue
+        rules.extend(_parse_yaml_rules(yaml.safe_load(text)))
+    return rules

argus_languages/scanner.py

@@ -0,0 +1,109 @@
+from __future__ import annotations
+
+from pathlib import Path
+
+from argus_languages.discover import SUPPORTED_LANGUAGES, discover_files
+from argus_languages.models import Finding, ScanResult, Severity
+from argus_languages.rules_loader import LoadedRule, load_rules_from_dir
+
+TOOL_NAME = "argus-languages"
+
+COMMENT_PREFIX: dict[str, tuple[str, ...]] = {
+    "javascript": ("//", "/*"),
+    "typescript": ("//", "/*"),
+    "vue": ("//", "/*"),
+    "python": ("#",),
+    "java": ("//", "/*"),
+    "kotlin": ("//", "/*"),
+    "scala": ("//", "/*"),
+    "php": ("//", "#", "/*"),
+    "go": ("//",),
+    "ruby": ("#",),
+    "csharp": ("//", "/*"),
+    "rust": ("//",),
+    "terraform": ("#", "//"),
+    "ansible": ("#",),
+    "docker": ("#",),
+    "kubernetes": ("#",),
+    "shell": ("#",),
+    "sql": ("--", "/*"),
+    "dart": ("//",),
+    "flutter": ("#", "//", "<!--"),
+}
+
+
+def _skip_line(line: str, language: str) -> bool:
+    stripped = line.strip()
+    for prefix in COMMENT_PREFIX.get(language, ("//", "#")):
+        if stripped.startswith(prefix):
+            return True
+    return False
+
+
+def _rule_applies(rule: LoadedRule, language: str) -> bool:
+    if rule.languages is None:
+        return True
+    return language in rule.languages
+
+
+def _scan_content(
+    relative: str,
+    language: str,
+    content: str,
+    rules: list[LoadedRule],
+) -> list[Finding]:
+    findings: list[Finding] = []
+    for i, line in enumerate(content.splitlines(), start=1):
+        if _skip_line(line, language):
+            continue
+        for rule in rules:
+            if not _rule_applies(rule, language):
+                continue
+            if rule.pattern.search(line):
+                findings.append(
+                    Finding(
+                        title=rule.title,
+                        severity=rule.severity,
+                        tool=TOOL_NAME,
+                        file=relative,
+                        line=i,
+                        rule_id=rule.id,
+                        description=f"Language: {language}",
+                        language=language,
+                    )
+                )
+    return findings
+
+
+def scan_path(target: str | Path, rules: list[LoadedRule] | None = None) -> ScanResult:
+    path = Path(target).resolve()
+    result = ScanResult(tool=TOOL_NAME, target=str(path))
+    if not path.exists():
+        result.errors.append(f"Target not found: {path}")
+        return result
+
+    loaded = rules if rules is not None else load_rules_from_dir()
+    files = discover_files(path)
+    if not files:
+        result.errors.append(
+            f"No scannable files found. Supported: {', '.join(SUPPORTED_LANGUAGES)}"
+        )
+        return result
+
+    lang_counts: dict[str, int] = {}
+    for scanned in files:
+        lang_counts[scanned.language] = lang_counts.get(scanned.language, 0) + 1
+        try:
+            content = scanned.path.read_text(encoding="utf-8", errors="replace")
+        except OSError:
+            continue
+        result.findings.extend(_scan_content(scanned.relative, scanned.language, content, loaded))
+
+    result.metadata["files_scanned"] = len(files)
+    result.metadata["languages"] = lang_counts
+    return result
+
+
+def scan_directory(target: str | Path) -> ScanResult:
+    """Scan a directory or file for security patterns across all supported languages."""
+    return scan_path(target)

argus_languages-0.1.1.dist-info/METADATA

@@ -0,0 +1,63 @@
+Metadata-Version: 2.4
+Name: argus-languages
+Version: 0.1.1
+Summary: Built-in multi-language security pattern scanner — Java, PHP, Terraform, Ansible, and 15+ languages. No external tools required.
+Project-URL: Homepage, https://github.com/OkiriGabriel/argus-codescan-mcp
+Project-URL: Repository, https://github.com/OkiriGabriel/argus-codescan-mcp
+Project-URL: Documentation, https://github.com/OkiriGabriel/argus-codescan-mcp/tree/main/packages/languages
+License: MIT
+License-File: LICENSE
+Keywords: ansible,argus,code-scanning,devsecops,iac,java,php,sast,security,terraform
+Classifier: Development Status :: 4 - Beta
+Classifier: Intended Audience :: Developers
+Classifier: License :: OSI Approved :: MIT License
+Classifier: Programming Language :: Python :: 3
+Classifier: Topic :: Security
+Requires-Python: >=3.10
+Requires-Dist: pyyaml>=6.0
+Description-Content-Type: text/markdown
+
+# argus-languages
+
+Built-in security pattern scanner for **all major languages and IaC** — pure Python, no external tools.
+
+Install on its own or as part of `argus-scan`:
+
+```bash
+pip install argus-languages
+argus-languages scan /path/to/project
+```
+
+Or via the full Argus CLI:
+
+```bash
+pip install argus-scan
+argus scan code /path/to/project
+```
+
+## Supported languages
+
+| Category | Languages / formats |
+|----------|---------------------|
+| **Web & app** | JavaScript, TypeScript, Python, Java, Kotlin, PHP, Go, Ruby, C#, Rust, Swift, Scala, Perl, Lua, Elixir, Vue, **Dart / Flutter** |
+| **Mobile (Flutter)** | `.dart` source, `pubspec.yaml`, `AndroidManifest.xml`, `Info.plist` |
+| **Infrastructure** | Terraform (`.tf`, `.hcl`), Ansible playbooks, Docker, Kubernetes manifests |
+| **Shell & SQL** | Bash/Shell scripts, SQL |
+
+Rules live in `src/argus_languages/bundled_rules/` as YAML so they can be shared across Python (and other packages later).
+
+## Usage
+
+```python
+from argus_languages import scan_directory
+
+result = scan_directory("/path/to/repo")
+for finding in result.findings:
+    print(finding.file, finding.line, finding.title)
+```
+
+## npm vs Python
+
+- **`packages/npm`** — Node.js only (JS/TS SCA + eslint-security)
+- **`packages/languages`** — all other languages (install via pip)
+- **`packages/python`** — full Argus CLI/MCP; depends on `argus-languages`

argus_languages-0.1.1.dist-info/RECORD

@@ -0,0 +1,20 @@
+argus_languages/__init__.py,sha256=XUmtPIIwj50HHoHpDg3c1T18EZNwbnQEM_MdIq0htxU,358
+argus_languages/cli.py,sha256=TILmOlWxaFE0vgFlxeVbhWcHQb7BXnwkg0wfg0Z_eJM,1476
+argus_languages/discover.py,sha256=4TeNyZmISwQSeq4zZb88uHm8SDccI4PMA_MiEw6ARLY,5465
+argus_languages/models.py,sha256=ylcnePcvxWJhpK2YYe17X8a4U649SblzltbUJKpa5Mw,1646
+argus_languages/rules_loader.py,sha256=2By8TgXxMgQRT1F-yQD4qYbde8e7A1UNzWBf0lIiZUM,2179
+argus_languages/scanner.py,sha256=Yhj_UZu6zCrkz16LJWRGJ52etriK3-VMqlwzY6caR2k,3360
+argus_languages/bundled_rules/__init__.py,sha256=RD0dhAfuvM2EbjeLQR7-l-4iQCdLY114d6LUe_UrTrM,35
+argus_languages/bundled_rules/ansible.yaml,sha256=K7D__N3rOAICRxdFccLCI7rqj2q_W9BdN7e2j0X88k4,1315
+argus_languages/bundled_rules/common.yaml,sha256=sFB3wl6utEpXce1if68Ypf9Cg2ZYijkBB6wqjoDa6Hc,2763
+argus_languages/bundled_rules/dart.yaml,sha256=nrSsO054K_Svyh8-zII1lDlZs5ebqvAiZTbvL3Ee2L0,1854
+argus_languages/bundled_rules/flutter.yaml,sha256=JF9C0tzo9uIZIPTX5613BFBqCDcHUl4HEpnPX-WtR8U,1848
+argus_languages/bundled_rules/java.yaml,sha256=BWbBEX6WPBM8kspemHTw3ZRAaTi-vwqJm1O-juZHGXk,1277
+argus_languages/bundled_rules/other.yaml,sha256=CSlFMVznyf29PgcbQZikoex5Nr0d_r7aUwNPISsYFf4,2788
+argus_languages/bundled_rules/php.yaml,sha256=ONhzScgCOM_zqS5VkA7OZG1OW7dQ3SWxK0kqPPzp5ds,1043
+argus_languages/bundled_rules/terraform.yaml,sha256=CWin5-bZfRaKLcYtU3-Wj98WMBbb4D3l6YomF3h9rZE,1803
+argus_languages-0.1.1.dist-info/METADATA,sha256=W0S0QgVG7L7eRH76us4Fslv7-vKxsgqXg9ObRy9HYec,2270
+argus_languages-0.1.1.dist-info/WHEEL,sha256=mffPy8wBnZQn2VnJUU5jE99KsxaSfiyMHV9Yt0aLVxs,87
+argus_languages-0.1.1.dist-info/entry_points.txt,sha256=hBUcxS7N6C3wvKwRADcWdjQ5NUQ8YTiLifp27QbdTYc,61
+argus_languages-0.1.1.dist-info/licenses/LICENSE,sha256=wQSjNH1sdVrIqz0TffGgFIhEqTtvJijBY3mLn9wFQ6Q,1085
+argus_languages-0.1.1.dist-info/RECORD,,

argus_languages-0.1.1.dist-info/WHEEL

@@ -0,0 +1,4 @@
+Wheel-Version: 1.0
+Generator: hatchling 1.30.1
+Root-Is-Purelib: true
+Tag: py3-none-any

argus_languages-0.1.1.dist-info/entry_points.txt

@@ -0,0 +1,2 @@
+[console_scripts]
+argus-languages = argus_languages.cli:main

argus_languages-0.1.1.dist-info/licenses/LICENSE

@@ -0,0 +1,21 @@
+MIT License
+
+Copyright (c) 2026 codetesting-mcp contributors
+
+Permission is hereby granted, free of charge, to any person obtaining a copy
+of this software and associated documentation files (the "Software"), to deal
+in the Software without restriction, including without limitation the rights
+to use, copy, modify, merge, publish, distribute, sublicense, and/or sell
+copies of the Software, and to permit persons to whom the Software is
+furnished to do so, subject to the following conditions:
+
+The above copyright notice and this permission notice shall be included in all
+copies or substantial portions of the Software.
+
+THE SOFTWARE IS PROVIDED "AS IS", WITHOUT WARRANTY OF ANY KIND, EXPRESS OR
+IMPLIED, INCLUDING BUT NOT LIMITED TO THE WARRANTIES OF MERCHANTABILITY,
+FITNESS FOR A PARTICULAR PURPOSE AND NONINFRINGEMENT. IN NO EVENT SHALL THE
+AUTHORS OR COPYRIGHT HOLDERS BE LIABLE FOR ANY CLAIM, DAMAGES OR OTHER
+LIABILITY, WHETHER IN AN ACTION OF CONTRACT, TORT OR OTHERWISE, ARISING FROM,
+OUT OF OR IN CONNECTION WITH THE SOFTWARE OR THE USE OR OTHER DEALINGS IN THE
+SOFTWARE.