attackmap-analyzer-omeka-s 0.1.0__py3-none-any.whl

attackmap_analyzer_omeka_s/__init__.py

@@ -0,0 +1,3 @@
+from .analyzer import OmekaSAnalyzer
+
+__all__ = ["OmekaSAnalyzer"]

attackmap_analyzer_omeka_s/analyzer.py

@@ -0,0 +1,249 @@
+from __future__ import annotations
+
+import json
+import re
+from pathlib import Path
+
+from .contracts import AnalyzerMetadata, AuthHint, DatabaseHint, ExternalCall, Route, ScanResult, SecretHint
+
+ROUTE_PATH_PATTERN = re.compile(r"['\"]route['\"]\s*=>\s*['\"]([^'\"]+)['\"]", re.IGNORECASE)
+ROUTE_NAME_PATTERN = re.compile(r"['\"]([A-Za-z0-9_\\-]+)['\"]\s*=>\s*\[\s*['\"]type['\"]\s*=>", re.IGNORECASE)
+CONTROLLER_PATTERN = re.compile(r"([A-Za-z_\\][A-Za-z0-9_\\]*Controller[A-Za-z0-9_\\]*)::class", re.IGNORECASE)
+SERVICE_PATTERN = re.compile(
+    r"([A-Za-z_\\][A-Za-z0-9_\\]*(?:Service|Manager|Repository|Adapter|Connection)[A-Za-z0-9_\\]*)::class",
+    re.IGNORECASE,
+)
+OMEKA_SERVICE_PATTERN = re.compile(r"Omeka\\([A-Za-z_\\\\][A-Za-z0-9_\\\\]*)", re.IGNORECASE)
+OUTBOUND_PATTERNS = [
+    re.compile(r"curl_init\s*\(\s*['\"](https?://[^'\"]+)['\"]", re.IGNORECASE),
+    re.compile(r"file_get_contents\s*\(\s*['\"](https?://[^'\"]+)['\"]", re.IGNORECASE),
+    re.compile(r"->(?:get|post|put|patch|delete|request)\s*\(\s*['\"](https?://[^'\"]+)['\"]", re.IGNORECASE),
+]
+SECRET_PATTERNS = [
+    re.compile(r"getenv\s*\(\s*['\"]([A-Z0-9_]*(SECRET|TOKEN|KEY|PASSWORD|API|DB)[A-Z0-9_]*)['\"]", re.IGNORECASE),
+    re.compile(r"\$_ENV\s*\[\s*['\"]([A-Z0-9_]*(SECRET|TOKEN|KEY|PASSWORD|API|DB)[A-Z0-9_]*)['\"]\s*\]", re.IGNORECASE),
+]
+
+
+class OmekaSAnalyzer:
+    metadata = AnalyzerMetadata(
+        name="omeka-s",
+        display_name="Omeka S Analyzer",
+        version="0.1.0",
+        description="Application-aware Omeka S analyzer for Laminas module config, services, and extension surfaces.",
+        scope="Omeka S and Omeka-style Laminas MVC projects with module config-driven routes and services.",
+        targets=["omeka-s", "php-laminas", "php-web"],
+        languages=["php"],
+        priority=20,
+        experimental=True,
+        enabled_by_default=False,
+    )
+
+    @property
+    def name(self) -> str:
+        return self.metadata.name
+
+    def detect(self, repo_path: str | Path) -> bool:
+        root = Path(repo_path).resolve()
+        if not root.exists() or not root.is_dir():
+            return False
+
+        if self._has_omeka_composer_signals(root / "composer.json"):
+            return True
+
+        if (root / "config" / "application.config.php").exists() and any(root.rglob("module.config.php")):
+            if (root / "module").is_dir():
+                return True
+
+        for file_path in root.rglob("*.php"):
+            if any(part in {"vendor", ".git", "node_modules"} for part in file_path.parts):
+                continue
+            content = self._read_text(file_path)
+            if content and ("namespace Omeka" in content or "Omeka\\Connection" in content):
+                return True
+        return False
+
+    def analyze(self, repo_path: str | Path) -> ScanResult:
+        root = Path(repo_path).resolve()
+        result = ScanResult(root=str(root))
+        if not root.exists() or not root.is_dir():
+            return result
+
+        composer_path = root / "composer.json"
+        if composer_path.exists():
+            self._extract_composer_signals(composer_path, result)
+
+        for file_path in root.rglob("*.php"):
+            if not file_path.is_file():
+                continue
+            if any(part in {"vendor", ".git", "node_modules"} for part in file_path.parts):
+                continue
+
+            result.files_scanned += 1
+            if "php" not in result.languages:
+                result.languages.append("php")
+
+            content = self._read_text(file_path)
+            if content is None:
+                continue
+
+            relative = str(file_path.relative_to(root))
+            self._extract_routes_and_surfaces(content, relative, result)
+            self._extract_controllers_and_services(content, relative, result)
+            self._extract_extension_points(content, relative, result)
+            self._extract_external_calls(content, relative, result)
+            self._extract_datastores(content, relative, result)
+            self._extract_secret_hints(content, relative, result)
+
+        result.languages.sort()
+        return result
+
+    def _has_omeka_composer_signals(self, composer_path: Path) -> bool:
+        if not composer_path.exists():
+            return False
+        try:
+            data = json.loads(composer_path.read_text(encoding="utf-8"))
+        except (UnicodeDecodeError, json.JSONDecodeError):
+            return False
+
+        requirements = {
+            **(data.get("require", {}) if isinstance(data.get("require", {}), dict) else {}),
+            **(data.get("require-dev", {}) if isinstance(data.get("require-dev", {}), dict) else {}),
+        }
+        for package in requirements:
+            lowered = package.lower()
+            if lowered.startswith("omeka/") or lowered == "omeka-s":
+                return True
+        return False
+
+    def _extract_composer_signals(self, composer_path: Path, result: ScanResult) -> None:
+        try:
+            data = json.loads(composer_path.read_text(encoding="utf-8"))
+        except (UnicodeDecodeError, json.JSONDecodeError):
+            return
+
+        requirements = {
+            **(data.get("require", {}) if isinstance(data.get("require", {}), dict) else {}),
+            **(data.get("require-dev", {}) if isinstance(data.get("require-dev", {}), dict) else {}),
+        }
+        for package in requirements:
+            lowered = package.lower()
+            if lowered.startswith("omeka/") or lowered == "omeka-s":
+                self._append_unique_auth(result, "omeka_dependency", "composer.json")
+            if lowered.startswith("laminas/") or lowered.startswith("zendframework/"):
+                self._append_unique_auth(result, "laminas_dependency", "composer.json")
+            if "doctrine" in lowered:
+                self._append_unique_database(result, "sql", "composer.json")
+
+    def _extract_routes_and_surfaces(self, content: str, relative: str, result: ScanResult) -> None:
+        for match in ROUTE_PATH_PATTERN.finditer(content):
+            path = match.group(1)
+            self._append_unique_route(result, path, "ANY", relative)
+            self._append_surface_hint_for_path(result, path, relative)
+
+        for match in ROUTE_NAME_PATTERN.finditer(content):
+            route_name = match.group(1).lower()
+            if "admin" in route_name:
+                self._append_unique_auth(result, "omeka_surface:admin", relative)
+            elif "api" in route_name:
+                self._append_unique_auth(result, "omeka_surface:api", relative)
+            elif "site" in route_name:
+                self._append_unique_auth(result, "omeka_surface:site", relative)
+
+    def _extract_controllers_and_services(self, content: str, relative: str, result: ScanResult) -> None:
+        found_controller = False
+        for match in CONTROLLER_PATTERN.finditer(content):
+            found_controller = True
+            self._append_unique_auth(result, f"controller:{match.group(1)}", relative)
+        if found_controller:
+            self._append_unique_auth(result, "laminas_controller_mapping", relative)
+
+        for match in SERVICE_PATTERN.finditer(content):
+            service_name = match.group(1)
+            self._append_unique_auth(result, f"service:{service_name}", relative)
+            if "Connection" in service_name:
+                self._append_unique_database(result, "sql", relative)
+
+        for match in OMEKA_SERVICE_PATTERN.finditer(content):
+            service_name = match.group(1)
+            self._append_unique_auth(result, f"omeka_service:{service_name}", relative)
+            if service_name.lower().endswith("connection"):
+                self._append_unique_database(result, "sql", relative)
+
+    def _extract_extension_points(self, content: str, relative: str, result: ScanResult) -> None:
+        lowered = content.lower()
+        if "'service_manager'" in lowered or '"service_manager"' in lowered:
+            self._append_unique_auth(result, "omeka_extension:service_manager", relative)
+        if "'factories'" in lowered or '"factories"' in lowered:
+            self._append_unique_auth(result, "omeka_extension:factory", relative)
+        if "'navigation'" in lowered or '"navigation"' in lowered:
+            self._append_unique_auth(result, "omeka_extension:navigation", relative)
+        normalized = relative.replace("\\", "/")
+        if "/module/" in f"/{normalized}/":
+            self._append_unique_auth(result, "omeka_extension:module", relative)
+
+    def _extract_external_calls(self, content: str, relative: str, result: ScanResult) -> None:
+        for pattern in OUTBOUND_PATTERNS:
+            for match in pattern.finditer(content):
+                self._append_unique_external(result, match.group(1), relative)
+
+    def _extract_datastores(self, content: str, relative: str, result: ScanResult) -> None:
+        lowered = content.lower()
+        if "omeka\\connection" in lowered or "new pdo(" in lowered or "doctrine" in lowered:
+            self._append_unique_database(result, "sql", relative)
+
+    def _extract_secret_hints(self, content: str, relative: str, result: ScanResult) -> None:
+        for pattern in SECRET_PATTERNS:
+            for match in pattern.finditer(content):
+                self._append_unique_secret(result, match.group(1), relative)
+
+    def _append_surface_hint_for_path(self, result: ScanResult, path: str, relative: str) -> None:
+        lowered = path.lower()
+        if lowered.startswith("/admin") or "/admin/" in lowered:
+            self._append_unique_auth(result, "omeka_surface:admin", relative)
+        elif lowered.startswith("/api") or "/api/" in lowered:
+            self._append_unique_auth(result, "omeka_surface:api", relative)
+        elif lowered.startswith("/s/") or lowered.startswith("/site"):
+            self._append_unique_auth(result, "omeka_surface:site", relative)
+
+    @staticmethod
+    def _read_text(path: Path) -> str | None:
+        try:
+            return path.read_text(encoding="utf-8")
+        except UnicodeDecodeError:
+            return None
+
+    @staticmethod
+    def _append_unique_route(result: ScanResult, path: str, method: str, file: str) -> None:
+        key = (path, method, file)
+        if any((item.path, item.method, item.file) == key for item in result.routes):
+            return
+        result.routes.append(Route(path=path, method=method, file=file))
+
+    @staticmethod
+    def _append_unique_external(result: ScanResult, target: str, file: str) -> None:
+        key = (target, file)
+        if any((item.target, item.file) == key for item in result.external_calls):
+            return
+        result.external_calls.append(ExternalCall(target=target, file=file))
+
+    @staticmethod
+    def _append_unique_database(result: ScanResult, kind: str, file: str) -> None:
+        key = (kind, file)
+        if any((item.kind, item.file) == key for item in result.databases):
+            return
+        result.databases.append(DatabaseHint(kind=kind, file=file))
+
+    @staticmethod
+    def _append_unique_auth(result: ScanResult, hint: str, file: str) -> None:
+        key = (hint, file)
+        if any((item.hint, item.file) == key for item in result.auth_hints):
+            return
+        result.auth_hints.append(AuthHint(hint=hint, file=file))
+
+    @staticmethod
+    def _append_unique_secret(result: ScanResult, name: str, file: str) -> None:
+        key = (name, file)
+        if any((item.name, item.file) == key for item in result.secret_hints):
+            return
+        result.secret_hints.append(SecretHint(name=name, file=file))

attackmap_analyzer_omeka_s/contracts.py

@@ -0,0 +1,18 @@
+from __future__ import annotations
+
+from attackmap.sdk.contracts import AnalyzerMetadata, AnalyzerProtocol
+from attackmap.sdk.models import AuthHint, DatabaseHint, ExternalCall, Route, ScanResult, SecretHint
+
+# Compatibility alias used by existing analyzer implementations.
+AttackMapAnalyzerProtocol = AnalyzerProtocol
+
+__all__ = [
+    "AnalyzerMetadata",
+    "AttackMapAnalyzerProtocol",
+    "Route",
+    "ExternalCall",
+    "DatabaseHint",
+    "AuthHint",
+    "SecretHint",
+    "ScanResult",
+]

attackmap_analyzer_omeka_s-0.1.0.dist-info/METADATA

@@ -0,0 +1,63 @@
+Metadata-Version: 2.4
+Name: attackmap-analyzer-omeka-s
+Version: 0.1.0
+Summary: Application-aware Omeka S analyzer plugin for AttackMap
+Author: AttackMap Contributors
+Author-email: Matthew Davis <matthewd@matthewd.xyz>
+Maintainer-email: Matthew Davis <matthewd@matthewd.xyz>
+License: MIT
+Project-URL: Homepage, https://github.com/mlaify/attack-map-analyzer-omeka-s
+Project-URL: Repository, https://github.com/mlaify/attack-map-analyzer-omeka-s
+Project-URL: Issues, https://github.com/mlaify/attack-map-analyzer-omeka-s/issues
+Project-URL: Changelog, https://github.com/mlaify/attack-map-analyzer-omeka-s/blob/main/CHANGELOG.md
+Project-URL: AttackMap core, https://github.com/mlaify/AttackMap
+Keywords: security,static-analysis,appsec,defensive-security,attackmap,attackmap-plugin
+Classifier: Development Status :: 4 - Beta
+Classifier: Intended Audience :: Developers
+Classifier: Intended Audience :: Information Technology
+Classifier: Intended Audience :: System Administrators
+Classifier: License :: OSI Approved :: MIT License
+Classifier: Operating System :: OS Independent
+Classifier: Programming Language :: Python :: 3
+Classifier: Programming Language :: Python :: 3.11
+Classifier: Programming Language :: Python :: 3.12
+Classifier: Programming Language :: Python :: 3.13
+Classifier: Programming Language :: Python :: 3 :: Only
+Classifier: Topic :: Security
+Classifier: Topic :: Software Development :: Quality Assurance
+Classifier: Typing :: Typed
+Requires-Python: >=3.11
+Description-Content-Type: text/markdown
+License-File: LICENSE
+Requires-Dist: pydantic>=2.7.0
+Provides-Extra: core
+Requires-Dist: attackmap>=0.1.0; extra == "core"
+Provides-Extra: dev
+Requires-Dist: pytest>=8.0.0; extra == "dev"
+Requires-Dist: build>=1.2.0; extra == "dev"
+Requires-Dist: attackmap>=0.1.0; extra == "dev"
+Dynamic: license-file
+
+# AttackMap Omeka S Analyzer
+
+`attackmap-analyzer-omeka-s` is an application-aware analyzer module for AttackMap.
+
+It focuses on Omeka S and emits structured scan signals for:
+- likely admin, site, and API surfaces
+- route and controller hints from Laminas-style module config
+- Omeka service usage (for example `Omeka\\Connection`)
+- module extension points such as navigation and service manager factories
+
+This module is intentionally heuristic and incremental.
+
+## Install
+
+```bash
+pip install git+https://github.com/mlaify/attackmap-analyzer-omeka-s.git
+```
+
+## Usage with AttackMap
+
+```bash
+attackmap analyze /path/to/repo --module omeka-s
+```

attackmap_analyzer_omeka_s-0.1.0.dist-info/RECORD

@@ -0,0 +1,9 @@
+attackmap_analyzer_omeka_s/__init__.py,sha256=f7tmiXptI52ZS3IqUAgfFJE37U8SvmSiCfVvIeg6iNQ,67
+attackmap_analyzer_omeka_s/analyzer.py,sha256=n_cHB_mqBBpFvq6GuD0JuAMcEGB_VuF1sUuPVrq410c,11567
+attackmap_analyzer_omeka_s/contracts.py,sha256=uwshWT7fHGD_lTg8LGS-4JxuHlRQJ7ejBS92Ls3p6Vc,496
+attackmap_analyzer_omeka_s-0.1.0.dist-info/licenses/LICENSE,sha256=vtPQVGUyxq359j0JmD3_eJaXyHmaHyjzaMOtaLwJc88,1097
+attackmap_analyzer_omeka_s-0.1.0.dist-info/METADATA,sha256=a5Fx7yuNVeaFfi4oFuGWIPFotoy7VdxwAvF4kMSXydQ,2470
+attackmap_analyzer_omeka_s-0.1.0.dist-info/WHEEL,sha256=aeYiig01lYGDzBgS8HxWXOg3uV61G9ijOsup-k9o1sk,91
+attackmap_analyzer_omeka_s-0.1.0.dist-info/entry_points.txt,sha256=8nPbTJ6M_cG9JJbnX55LBWvirSBkIMcGc7QBhrFmy1o,74
+attackmap_analyzer_omeka_s-0.1.0.dist-info/top_level.txt,sha256=D1Kpe1jvHYM75EpPrSiZEomxazbJH3fYM4trBT89AVk,27
+attackmap_analyzer_omeka_s-0.1.0.dist-info/RECORD,,

attackmap_analyzer_omeka_s-0.1.0.dist-info/WHEEL

@@ -0,0 +1,5 @@
+Wheel-Version: 1.0
+Generator: setuptools (82.0.1)
+Root-Is-Purelib: true
+Tag: py3-none-any
+

attackmap_analyzer_omeka_s-0.1.0.dist-info/entry_points.txt

@@ -0,0 +1,2 @@
+[attackmap.analyzers]
+omeka_s = attackmap_analyzer_omeka_s:OmekaSAnalyzer

attackmap_analyzer_omeka_s-0.1.0.dist-info/licenses/LICENSE

@@ -0,0 +1,21 @@
+MIT License
+
+Copyright (c) 2026 Matthew Davis and AttackMap Contributors
+
+Permission is hereby granted, free of charge, to any person obtaining a copy
+of this software and associated documentation files (the "Software"), to deal
+in the Software without restriction, including without limitation the rights
+to use, copy, modify, merge, publish, distribute, sublicense, and/or sell
+copies of the Software, and to permit persons to whom the Software is
+furnished to do so, subject to the following conditions:
+
+The above copyright notice and this permission notice shall be included in all
+copies or substantial portions of the Software.
+
+THE SOFTWARE IS PROVIDED "AS IS", WITHOUT WARRANTY OF ANY KIND, EXPRESS OR
+IMPLIED, INCLUDING BUT NOT LIMITED TO THE WARRANTIES OF MERCHANTABILITY,
+FITNESS FOR A PARTICULAR PURPOSE AND NONINFRINGEMENT. IN NO EVENT SHALL THE
+AUTHORS OR COPYRIGHT HOLDERS BE LIABLE FOR ANY CLAIM, DAMAGES OR OTHER
+LIABILITY, WHETHER IN AN ACTION OF CONTRACT, TORT OR OTHERWISE, ARISING FROM,
+OUT OF OR IN CONNECTION WITH THE SOFTWARE OR THE USE OR OTHER DEALINGS IN THE
+SOFTWARE.

attackmap_analyzer_omeka_s-0.1.0.dist-info/top_level.txt

@@ -0,0 +1 @@
+attackmap_analyzer_omeka_s