attackmap-analyzer-atproto 0.1.0__py3-none-any.whl

attackmap_analyzer_atproto/__init__.py

@@ -0,0 +1,3 @@
+from .analyzer import AtprotoAnalyzer
+
+__all__ = ["AtprotoAnalyzer"]

attackmap_analyzer_atproto/analyzer.py

@@ -0,0 +1,257 @@
+from __future__ import annotations
+
+import json
+import re
+from pathlib import Path
+
+from .contracts import AnalyzerMetadata, AuthHint, ExternalCall, Route, ScanResult, SecretHint
+
+CODE_SUFFIXES = {".ts", ".tsx", ".js", ".mjs", ".cjs", ".json"}
+SKIP_DIRS = {"node_modules", ".git", "dist", "build", ".next"}
+
+NAMESPACE_PATTERN = re.compile(r"\b((?:com\.atproto|app\.bsky)(?:\.[a-z0-9_]+){1,})\b", re.IGNORECASE)
+XRPC_LITERAL_PATTERN = re.compile(r"['\"](?:https?://[^'\"]+)?/xrpc/((?:com\.atproto|app\.bsky)\.[a-z0-9_.]+)['\"]", re.IGNORECASE)
+ENV_URL_PATTERN = re.compile(r"process\.env\.([A-Z0-9_]+_URL)\b")
+
+AUTH_HINT_PATTERNS = [
+    (re.compile(r"\bjwt\b|\bjsonwebtoken\b", re.IGNORECASE), "atproto_auth:jwt"),
+    (re.compile(r"\bserviceauth\b|\bservice_auth\b", re.IGNORECASE), "atproto_auth:service_auth"),
+    (re.compile(r"\bdid:[a-z0-9:._-]+\b", re.IGNORECASE), "atproto_identity:did_reference"),
+    (re.compile(r"\bplc\b", re.IGNORECASE), "atproto_identity:plc"),
+    (re.compile(r"\bsign(?:ing|ature)?\b|\bverify(?:ing|signature)?\b", re.IGNORECASE), "atproto_crypto:signing"),
+    (re.compile(r"\brepo\b.*\bcommit\b|\bcommit\b.*\brepo\b", re.IGNORECASE), "atproto_repo:commit_flow"),
+]
+
+EVENT_STREAM_PATTERNS = [
+    (re.compile(r"\bsubscriberepos\b", re.IGNORECASE), "atproto_event_stream:subscribe_repos"),
+    (re.compile(r"\bwebsocket\b|\bws://\b|\bwss://\b", re.IGNORECASE), "atproto_event_stream:websocket"),
+    (re.compile(r"\bfirehose\b", re.IGNORECASE), "atproto_event_stream:firehose"),
+]
+
+
+class AtprotoAnalyzer:
+    metadata = AnalyzerMetadata(
+        name="atproto",
+        display_name="AT Protocol Analyzer",
+        version="0.1.0",
+        description="Thin protocol-aware overlay analyzer for AT Protocol namespace and XRPC exposure.",
+        scope="AT Protocol repositories with lexicons, XRPC namespace usage, and protocol auth/identity cues.",
+        targets=["atproto", "bluesky", "xrpc"],
+        languages=["typescript", "javascript", "json"],
+        priority=35,
+        experimental=True,
+        enabled_by_default=False,
+    )
+
+    @property
+    def name(self) -> str:
+        return self.metadata.name
+
+    def detect(self, repo_path: str | Path) -> bool:
+        root = Path(repo_path).resolve()
+        if not root.exists() or not root.is_dir():
+            return False
+
+        if (root / "lexicons").is_dir():
+            return True
+
+        for file_path in root.rglob("*"):
+            if not file_path.is_file():
+                continue
+            if any(part in SKIP_DIRS for part in file_path.parts):
+                continue
+            path_text = str(file_path).lower()
+            if "com.atproto" in path_text or "app.bsky" in path_text:
+                return True
+            if file_path.suffix not in CODE_SUFFIXES:
+                continue
+            content = self._read_text(file_path)
+            if not content:
+                continue
+            if (
+                "com.atproto." in content
+                or "app.bsky." in content
+                or "/xrpc/" in content
+                or "lexicon" in content.lower()
+            ):
+                return True
+        return False
+
+    def analyze(self, repo_path: str | Path) -> ScanResult:
+        root = Path(repo_path).resolve()
+        result = ScanResult(root=str(root))
+        if not root.exists() or not root.is_dir():
+            return result
+
+        lexicon_files = list(root.rglob("lexicons/**/*.json")) if (root / "lexicons").is_dir() else []
+        for lexicon_path in lexicon_files:
+            if any(part in SKIP_DIRS for part in lexicon_path.parts):
+                continue
+            result.files_scanned += 1
+            self._append_language(result, "json")
+            relative = str(lexicon_path.relative_to(root))
+            self._extract_lexicon_signals(lexicon_path, relative, result)
+
+        for file_path in root.rglob("*"):
+            if not file_path.is_file():
+                continue
+            if file_path in lexicon_files:
+                continue
+            if file_path.suffix not in CODE_SUFFIXES:
+                continue
+            if any(part in SKIP_DIRS for part in file_path.parts):
+                continue
+
+            result.files_scanned += 1
+            self._append_language(result, "typescript" if file_path.suffix in {".ts", ".tsx"} else ("javascript" if file_path.suffix in {".js", ".mjs", ".cjs"} else "json"))
+            content = self._read_text(file_path)
+            if content is None:
+                continue
+            relative = str(file_path.relative_to(root))
+
+            self._extract_namespace_signals(content, relative, result)
+            self._extract_xrpc_literals(content, relative, result)
+            self._extract_protocol_hints(content, relative, result)
+            self._extract_event_stream_hints(content, relative, result)
+            self._extract_env_url_signals(content, relative, result)
+            self._extract_service_notes(relative, result)
+            self._extract_secret_hints(content, relative, result)
+
+        result.languages.sort()
+        return result
+
+    def _extract_lexicon_signals(self, lexicon_path: Path, relative: str, result: ScanResult) -> None:
+        try:
+            data = json.loads(lexicon_path.read_text(encoding="utf-8"))
+        except (UnicodeDecodeError, json.JSONDecodeError):
+            return
+
+        lexicon_id = data.get("id")
+        if isinstance(lexicon_id, str) and lexicon_id:
+            namespace_root = self._namespace_root(lexicon_id)
+            if namespace_root:
+                self._append_unique_auth(result, f"atproto_namespace:{namespace_root}", relative)
+            self._append_unique_auth(result, f"atproto_lexicon:{lexicon_id}", relative)
+            self._append_unique_route(result, f"/xrpc/{lexicon_id}", "ANY", relative)
+
+        defs = data.get("defs")
+        if isinstance(defs, dict):
+            for _, value in defs.items():
+                if not isinstance(value, dict):
+                    continue
+                def_type = str(value.get("type", "")).lower()
+                if def_type in {"query", "procedure", "subscription"} and isinstance(lexicon_id, str):
+                    method = "SUBSCRIBE" if def_type == "subscription" else "ANY"
+                    self._append_unique_route(result, f"/xrpc/{lexicon_id}", method, relative)
+                    if def_type == "subscription":
+                        self._append_unique_auth(result, "atproto_event_stream:subscription_lexicon", relative)
+
+    def _extract_namespace_signals(self, content: str, relative: str, result: ScanResult) -> None:
+        for match in NAMESPACE_PATTERN.finditer(content):
+            namespace = match.group(1)
+            namespace_root = self._namespace_root(namespace)
+            if namespace_root:
+                self._append_unique_auth(result, f"atproto_namespace:{namespace_root}", relative)
+            self._append_unique_auth(result, f"atproto_namespace_ref:{namespace}", relative)
+
+    def _extract_xrpc_literals(self, content: str, relative: str, result: ScanResult) -> None:
+        for match in XRPC_LITERAL_PATTERN.finditer(content):
+            ns = match.group(1)
+            self._append_unique_route(result, f"/xrpc/{ns}", "ANY", relative)
+            self._append_unique_auth(result, f"atproto_xrpc_ref:{ns}", relative)
+
+    def _extract_protocol_hints(self, content: str, relative: str, result: ScanResult) -> None:
+        lowered = content.lower()
+        if "xrpc" in lowered:
+            self._append_unique_auth(result, "atproto_protocol:xrpc", relative)
+        for pattern, hint in AUTH_HINT_PATTERNS:
+            if pattern.search(content):
+                self._append_unique_auth(result, hint, relative)
+
+    def _extract_event_stream_hints(self, content: str, relative: str, result: ScanResult) -> None:
+        for pattern, hint in EVENT_STREAM_PATTERNS:
+            if pattern.search(content):
+                self._append_unique_auth(result, hint, relative)
+
+    def _extract_env_url_signals(self, content: str, relative: str, result: ScanResult) -> None:
+        for match in ENV_URL_PATTERN.finditer(content):
+            env_name = match.group(1)
+            self._append_unique_external(result, f"env://{env_name}", relative)
+            service_target = self._service_target_from_env(env_name)
+            if service_target:
+                self._append_unique_auth(result, f"atproto_service_edge:{service_target}", relative)
+
+    def _extract_service_notes(self, relative: str, result: ScanResult) -> None:
+        normalized = relative.replace("\\", "/")
+        parts = normalized.split("/")
+        for root in ("services", "packages"):
+            if root in parts:
+                idx = parts.index(root)
+                if idx + 1 < len(parts):
+                    self._append_unique_auth(result, f"atproto_service_note:{parts[idx + 1].lower()}", relative)
+                return
+
+    def _extract_secret_hints(self, content: str, relative: str, result: ScanResult) -> None:
+        for pattern in [
+            re.compile(r"process\.env\.([A-Z0-9_]*(?:SECRET|TOKEN|KEY|PASSWORD|SIGNING)[A-Z0-9_]*)"),
+            re.compile(r"['\"]([A-Z0-9_]*(?:SECRET|TOKEN|KEY|PASSWORD|SIGNING)[A-Z0-9_]*)['\"]"),
+        ]:
+            for match in pattern.finditer(content):
+                self._append_unique_secret(result, match.group(1), relative)
+
+    @staticmethod
+    def _namespace_root(namespace: str) -> str | None:
+        lowered = namespace.lower()
+        if lowered.startswith("com.atproto"):
+            return "com.atproto"
+        if lowered.startswith("app.bsky"):
+            return "app.bsky"
+        return None
+
+    @staticmethod
+    def _service_target_from_env(env_name: str) -> str | None:
+        token = env_name.upper().removesuffix("_URL")
+        token = token.replace("__", "_").strip("_")
+        if not token:
+            return None
+        return token.lower().replace("_", "-")
+
+    @staticmethod
+    def _append_language(result: ScanResult, language: str) -> None:
+        if language not in result.languages:
+            result.languages.append(language)
+
+    @staticmethod
+    def _read_text(path: Path) -> str | None:
+        try:
+            return path.read_text(encoding="utf-8")
+        except UnicodeDecodeError:
+            return None
+
+    @staticmethod
+    def _append_unique_route(result: ScanResult, path: str, method: str, file: str) -> None:
+        key = (path, method, file)
+        if any((item.path, item.method, item.file) == key for item in result.routes):
+            return
+        result.routes.append(Route(path=path, method=method, file=file))
+
+    @staticmethod
+    def _append_unique_external(result: ScanResult, target: str, file: str) -> None:
+        key = (target, file)
+        if any((item.target, item.file) == key for item in result.external_calls):
+            return
+        result.external_calls.append(ExternalCall(target=target, file=file))
+
+    @staticmethod
+    def _append_unique_auth(result: ScanResult, hint: str, file: str) -> None:
+        key = (hint, file)
+        if any((item.hint, item.file) == key for item in result.auth_hints):
+            return
+        result.auth_hints.append(AuthHint(hint=hint, file=file))
+
+    @staticmethod
+    def _append_unique_secret(result: ScanResult, name: str, file: str) -> None:
+        key = (name, file)
+        if any((item.name, item.file) == key for item in result.secret_hints):
+            return
+        result.secret_hints.append(SecretHint(name=name, file=file))

attackmap_analyzer_atproto/contracts.py

@@ -0,0 +1,18 @@
+from __future__ import annotations
+
+from attackmap.sdk.contracts import AnalyzerMetadata, AnalyzerProtocol
+from attackmap.sdk.models import AuthHint, DatabaseHint, ExternalCall, Route, ScanResult, SecretHint
+
+# Compatibility alias used by existing analyzer implementations.
+AttackMapAnalyzerProtocol = AnalyzerProtocol
+
+__all__ = [
+    "AnalyzerMetadata",
+    "AttackMapAnalyzerProtocol",
+    "Route",
+    "ExternalCall",
+    "DatabaseHint",
+    "AuthHint",
+    "SecretHint",
+    "ScanResult",
+]

attackmap_analyzer_atproto-0.1.0.dist-info/METADATA

@@ -0,0 +1,65 @@
+Metadata-Version: 2.4
+Name: attackmap-analyzer-atproto
+Version: 0.1.0
+Summary: Thin AT Protocol overlay analyzer plugin for AttackMap
+Author: AttackMap Contributors
+Author-email: Matthew Davis <matthewd@matthewd.xyz>
+Maintainer-email: Matthew Davis <matthewd@matthewd.xyz>
+License: MIT
+Project-URL: Homepage, https://github.com/mlaify/attackmap-analyzer-atproto
+Project-URL: Repository, https://github.com/mlaify/attackmap-analyzer-atproto
+Project-URL: Issues, https://github.com/mlaify/attackmap-analyzer-atproto/issues
+Project-URL: Changelog, https://github.com/mlaify/attackmap-analyzer-atproto/blob/main/CHANGELOG.md
+Project-URL: AttackMap core, https://github.com/mlaify/AttackMap
+Keywords: security,static-analysis,appsec,defensive-security,attackmap,attackmap-plugin
+Classifier: Development Status :: 4 - Beta
+Classifier: Intended Audience :: Developers
+Classifier: Intended Audience :: Information Technology
+Classifier: Intended Audience :: System Administrators
+Classifier: License :: OSI Approved :: MIT License
+Classifier: Operating System :: OS Independent
+Classifier: Programming Language :: Python :: 3
+Classifier: Programming Language :: Python :: 3.11
+Classifier: Programming Language :: Python :: 3.12
+Classifier: Programming Language :: Python :: 3.13
+Classifier: Programming Language :: Python :: 3 :: Only
+Classifier: Topic :: Security
+Classifier: Topic :: Software Development :: Quality Assurance
+Classifier: Typing :: Typed
+Requires-Python: >=3.11
+Description-Content-Type: text/markdown
+License-File: LICENSE
+Requires-Dist: pydantic>=2.7.0
+Provides-Extra: core
+Requires-Dist: attackmap>=0.1.0; extra == "core"
+Provides-Extra: dev
+Requires-Dist: pytest>=8.0.0; extra == "dev"
+Requires-Dist: build>=1.2.0; extra == "dev"
+Requires-Dist: attackmap>=0.1.0; extra == "dev"
+Dynamic: license-file
+
+# AttackMap ATProto Analyzer
+
+`attackmap-analyzer-atproto` is a thin protocol-aware overlay analyzer for AttackMap.
+
+It is designed to enrich Node/TypeScript service scans (such as `node-service`) with
+AT Protocol-specific exposure signals:
+- protocol namespaces (`com.atproto.*`, `app.bsky.*`)
+- lexicon-inferred XRPC endpoint surface
+- protocol auth/signing/identity hints
+- event stream/subscription exposure hints
+- service notes that complement service-level analyzers
+
+This module is heuristic and intentionally lightweight.
+
+## Install
+
+```bash
+pip install git+https://github.com/mlaify/attackmap-analyzer-atproto.git
+```
+
+## Usage
+
+```bash
+attackmap analyze /path/to/repo --module node-service --module atproto
+```

attackmap_analyzer_atproto-0.1.0.dist-info/RECORD

@@ -0,0 +1,9 @@
+attackmap_analyzer_atproto/__init__.py,sha256=ZS3jyYNlqIp2jQOV1kk4ACsk7KKN12yhnI2l8I_9lYk,69
+attackmap_analyzer_atproto/analyzer.py,sha256=8gIVLAitKeKUiPUdBzO3-9d5xQb9A4xku_NzkyWupNY,11541
+attackmap_analyzer_atproto/contracts.py,sha256=uwshWT7fHGD_lTg8LGS-4JxuHlRQJ7ejBS92Ls3p6Vc,496
+attackmap_analyzer_atproto-0.1.0.dist-info/licenses/LICENSE,sha256=vtPQVGUyxq359j0JmD3_eJaXyHmaHyjzaMOtaLwJc88,1097
+attackmap_analyzer_atproto-0.1.0.dist-info/METADATA,sha256=dbT2Dwx7DMMgZVRdDhW9kEGgxu0GG9ujCZvBrbLtbj4,2538
+attackmap_analyzer_atproto-0.1.0.dist-info/WHEEL,sha256=aeYiig01lYGDzBgS8HxWXOg3uV61G9ijOsup-k9o1sk,91
+attackmap_analyzer_atproto-0.1.0.dist-info/entry_points.txt,sha256=J0Z8vVkIvntkns9iVnkyePFyzsorhFZzrilUNATjXWw,75
+attackmap_analyzer_atproto-0.1.0.dist-info/top_level.txt,sha256=MfOAumzqUSeLu1xt53MWjrxgrrvwO3k1zTAu3gDDIwY,27
+attackmap_analyzer_atproto-0.1.0.dist-info/RECORD,,

attackmap_analyzer_atproto-0.1.0.dist-info/WHEEL

@@ -0,0 +1,5 @@
+Wheel-Version: 1.0
+Generator: setuptools (82.0.1)
+Root-Is-Purelib: true
+Tag: py3-none-any
+

attackmap_analyzer_atproto-0.1.0.dist-info/entry_points.txt

@@ -0,0 +1,2 @@
+[attackmap.analyzers]
+atproto = attackmap_analyzer_atproto:AtprotoAnalyzer

attackmap_analyzer_atproto-0.1.0.dist-info/licenses/LICENSE

@@ -0,0 +1,21 @@
+MIT License
+
+Copyright (c) 2026 Matthew Davis and AttackMap Contributors
+
+Permission is hereby granted, free of charge, to any person obtaining a copy
+of this software and associated documentation files (the "Software"), to deal
+in the Software without restriction, including without limitation the rights
+to use, copy, modify, merge, publish, distribute, sublicense, and/or sell
+copies of the Software, and to permit persons to whom the Software is
+furnished to do so, subject to the following conditions:
+
+The above copyright notice and this permission notice shall be included in all
+copies or substantial portions of the Software.
+
+THE SOFTWARE IS PROVIDED "AS IS", WITHOUT WARRANTY OF ANY KIND, EXPRESS OR
+IMPLIED, INCLUDING BUT NOT LIMITED TO THE WARRANTIES OF MERCHANTABILITY,
+FITNESS FOR A PARTICULAR PURPOSE AND NONINFRINGEMENT. IN NO EVENT SHALL THE
+AUTHORS OR COPYRIGHT HOLDERS BE LIABLE FOR ANY CLAIM, DAMAGES OR OTHER
+LIABILITY, WHETHER IN AN ACTION OF CONTRACT, TORT OR OTHERWISE, ARISING FROM,
+OUT OF OR IN CONNECTION WITH THE SOFTWARE OR THE USE OR OTHER DEALINGS IN THE
+SOFTWARE.

attackmap_analyzer_atproto-0.1.0.dist-info/top_level.txt

@@ -0,0 +1 @@
+attackmap_analyzer_atproto