attackmap-analyzer-swift 0.1.0__py3-none-any.whl

attackmap_analyzer_swift/__init__.py

@@ -0,0 +1,3 @@
+from .analyzer import SwiftAnalyzer
+
+__all__ = ["SwiftAnalyzer"]

attackmap_analyzer_swift/analyzer.py

@@ -0,0 +1,210 @@
+"""Swift ecosystem analyzer for AttackMap.
+
+Slice #186 (scaffold): SwiftPM project detection and a dependency SBOM parsed
+from ``Package.resolved`` (formats v1/v2/v3), plus light framework and entrypoint
+recon. Server-side route extraction (Vapor/Hummingbird, #187) and the iOS/macOS
+app attack surface (#188) land in later slices.
+"""
+
+from __future__ import annotations
+
+import json
+import re
+from pathlib import Path
+
+from .contracts import (
+    AnalyzerMetadata,
+    DependencyHint,
+    EntrypointHint,
+    FrameworkHint,
+    ScanResult,
+)
+
+SKIP_DIRS = {
+    ".git",
+    ".build",          # SwiftPM build products
+    "build",
+    "DerivedData",     # Xcode build products
+    "Pods",            # CocoaPods vendored sources
+    "Carthage",
+    "node_modules",
+    "__pycache__",
+}
+
+# Known server-side frameworks worth surfacing when seen in Package.swift deps.
+_FRAMEWORK_HINTS: dict[str, str] = {
+    "vapor": "Vapor (server-side Swift web framework)",
+    "hummingbird": "Hummingbird (server-side Swift web framework)",
+    "kitura": "Kitura (server-side Swift web framework)",
+    "perfect": "Perfect (server-side Swift web framework)",
+}
+
+# `.package(url: "https://github.com/vapor/vapor.git", ...)` and the newer
+# `.package(name: "X", url: "...")` / path-based forms.
+_PACKAGE_URL_RE = re.compile(r"\.package\s*\([^)]*?url\s*:\s*\"([^\"]+)\"", re.DOTALL)
+
+
+def _identity_from_url(url: str) -> str:
+    """SwiftPM identity = the last path component of the repo URL, lowercased,
+    without a trailing ``.git`` (matches how Package.resolved v2/v3 records it)."""
+    tail = url.rstrip("/").rsplit("/", 1)[-1]
+    if tail.endswith(".git"):
+        tail = tail[:-4]
+    return tail.lower()
+
+
+def _line_of(content: str, needle: str) -> int | None:
+    idx = content.find(needle)
+    if idx < 0:
+        return None
+    return content.count("\n", 0, idx) + 1
+
+
+class SwiftAnalyzer:
+    metadata = AnalyzerMetadata(
+        name="swift",
+        display_name="Swift Analyzer",
+        version="0.1.0",
+        description="Swift ecosystem analyzer: SwiftPM project detection and Package.resolved dependency SBOM. Server-side routes and app attack surface land in later slices.",
+        scope="Swift source trees and SwiftPM/Xcode projects. Detects the SwiftPM toolchain, server-side web frameworks in the manifest, and resolved package dependencies for CVE/SBOM.",
+        targets=["swift", "swiftpm", "vapor", "hummingbird"],
+        languages=["swift"],
+        priority=20,
+        experimental=True,  # Early scaffold — coverage is intentionally partial.
+        enabled_by_default=True,
+    )
+
+    @property
+    def name(self) -> str:
+        return self.metadata.name
+
+    # ---------- Public entry points ----------
+
+    def detect(self, repo_path: str | Path) -> bool:
+        root = Path(repo_path).resolve()
+        if not root.exists() or not root.is_dir():
+            return False
+        for path in root.rglob("*"):
+            if any(part in SKIP_DIRS for part in path.parts):
+                continue
+            name = path.name
+            if name in {"Package.swift", "Package.resolved"}:
+                return True
+            if path.is_dir() and path.suffix in {".xcodeproj", ".xcworkspace"}:
+                return True
+            if path.is_file() and path.suffix == ".swift":
+                return True
+        return False
+
+    def analyze(self, repo_path: str | Path) -> ScanResult:
+        root = Path(repo_path).resolve()
+        result = ScanResult(root=str(root))
+        if not root.exists() or not root.is_dir():
+            return result
+
+        direct = self._analyze_manifest(root, result)
+        self._analyze_resolved(root, result, direct)
+        self._analyze_entrypoints(root, result)
+        return result
+
+    # ---------- Package.swift (manifest) ----------
+
+    def _analyze_manifest(self, root: Path, result: ScanResult) -> set[str]:
+        """Record SwiftPM + framework hints; return the set of *direct* dependency
+        identities declared in the manifest (used to mark resolved pins direct)."""
+        direct: set[str] = set()
+        for manifest in root.rglob("Package.swift"):
+            if any(part in SKIP_DIRS for part in manifest.parts):
+                continue
+            try:
+                text = manifest.read_text(encoding="utf-8", errors="replace")
+            except OSError:
+                continue
+            rel = self._rel(manifest, root)
+            result.framework_hints.append(FrameworkHint(
+                hint="SwiftPM", file=rel, line=1,
+                evidence_text="Package.swift present — Swift Package Manager project."))
+            for m in _PACKAGE_URL_RE.finditer(text):
+                url = m.group(1)
+                identity = _identity_from_url(url)
+                direct.add(identity)
+                for key, label in _FRAMEWORK_HINTS.items():
+                    if key in identity:
+                        result.framework_hints.append(FrameworkHint(
+                            hint=label, file=rel, line=_line_of(text, url) or 1,
+                            evidence_text=f"Declared dependency: {url}"))
+        return direct
+
+    # ---------- Package.resolved (SBOM) ----------
+
+    def _analyze_resolved(self, root: Path, result: ScanResult, direct: set[str]) -> None:
+        for resolved in root.rglob("Package.resolved"):
+            if any(part in SKIP_DIRS for part in resolved.parts):
+                continue
+            try:
+                data = json.loads(resolved.read_text(encoding="utf-8", errors="replace"))
+            except (OSError, json.JSONDecodeError):
+                continue  # a malformed pin file must not abort the scan
+            rel = self._rel(resolved, root)
+            for pin in _iter_pins(data):
+                identity = (pin.get("identity") or pin.get("package") or "").lower()
+                if not identity:
+                    continue
+                state = pin.get("state") or {}
+                version = state.get("version") or ""  # branch/revision pins have no version
+                location = pin.get("location") or pin.get("repositoryURL") or ""
+                result.dependencies.append(DependencyHint(
+                    name=identity,
+                    version=version,
+                    ecosystem="swiftpm",
+                    file=rel,
+                    resolved=True,
+                    direct=identity in direct,
+                    evidence_text=location or None,
+                    source_analyzer="swift",
+                ))
+
+    # ---------- Entrypoints ----------
+
+    def _analyze_entrypoints(self, root: Path, result: ScanResult) -> None:
+        for path in root.rglob("*.swift"):
+            if any(part in SKIP_DIRS for part in path.parts):
+                continue
+            try:
+                text = path.read_text(encoding="utf-8", errors="replace")
+            except OSError:
+                continue
+            rel = self._rel(path, root)
+            if path.name == "main.swift":
+                result.entrypoint_hints.append(EntrypointHint(
+                    hint="main.swift (top-level executable entrypoint)",
+                    file=rel, line=1, evidence_text="Swift top-level main.swift"))
+            elif "@main" in text:
+                result.entrypoint_hints.append(EntrypointHint(
+                    hint="@main attribute (executable entrypoint)",
+                    file=rel, line=_line_of(text, "@main") or 1, evidence_text="@main"))
+
+    # ---------- helpers ----------
+
+    @staticmethod
+    def _rel(path: Path, root: Path) -> str:
+        try:
+            return str(path.resolve().relative_to(root)).replace("\\", "/")
+        except ValueError:
+            return path.name
+
+
+def _iter_pins(data: object):
+    """Yield pin dicts across Package.resolved formats: v1 nests them under
+    ``object.pins``; v2/v3 put ``pins`` at the top level."""
+    if not isinstance(data, dict):
+        return
+    pins = data.get("pins")
+    if pins is None:
+        obj = data.get("object")
+        if isinstance(obj, dict):
+            pins = obj.get("pins")
+    if isinstance(pins, list):
+        for pin in pins:
+            if isinstance(pin, dict):
+                yield pin

attackmap_analyzer_swift/contracts.py

@@ -0,0 +1,39 @@
+"""Re-exports of the AttackMap analyzer SDK surface this plugin depends on.
+
+Everything here comes from the stable ``attackmap.sdk`` contract (requires
+attackmap >= 0.4.29, which exports ``DependencyHint``). Kept in one place so a
+future SDK move is a one-file change.
+"""
+
+from __future__ import annotations
+
+from attackmap.sdk.contracts import AnalyzerMetadata, AnalyzerProtocol
+from attackmap.sdk.models import (
+    AuthHint,
+    DatabaseHint,
+    DependencyHint,
+    EntrypointHint,
+    ExternalCall,
+    FrameworkHint,
+    Route,
+    ScanResult,
+    SecretHint,
+    ServiceHint,
+)
+
+AttackMapAnalyzerProtocol = AnalyzerProtocol
+
+__all__ = [
+    "AnalyzerMetadata",
+    "AttackMapAnalyzerProtocol",
+    "AuthHint",
+    "DatabaseHint",
+    "DependencyHint",
+    "EntrypointHint",
+    "ExternalCall",
+    "FrameworkHint",
+    "Route",
+    "ScanResult",
+    "SecretHint",
+    "ServiceHint",
+]

attackmap_analyzer_swift-0.1.0.dist-info/METADATA

@@ -0,0 +1,93 @@
+Metadata-Version: 2.4
+Name: attackmap-analyzer-swift
+Version: 0.1.0
+Summary: Swift ecosystem analyzer plugin for AttackMap (SwiftPM projects, Package.resolved SBOM; server-side Vapor/Hummingbird and iOS/macOS app surface land in later slices).
+Author: AttackMap Contributors
+Author-email: Matthew Davis <matthewd@matthewd.xyz>
+Maintainer-email: Matthew Davis <matthewd@matthewd.xyz>
+License: MIT
+Project-URL: Homepage, https://github.com/mlaify/attackmap-analyzer-swift
+Project-URL: Repository, https://github.com/mlaify/attackmap-analyzer-swift
+Project-URL: Issues, https://github.com/mlaify/attackmap-analyzer-swift/issues
+Project-URL: Changelog, https://github.com/mlaify/attackmap-analyzer-swift/blob/main/CHANGELOG.md
+Project-URL: AttackMap core, https://github.com/mlaify/AttackMap
+Keywords: security,static-analysis,appsec,defensive-security,attackmap,attackmap-plugin,swift
+Classifier: Development Status :: 4 - Beta
+Classifier: Intended Audience :: Developers
+Classifier: Intended Audience :: Information Technology
+Classifier: Intended Audience :: System Administrators
+Classifier: License :: OSI Approved :: MIT License
+Classifier: Operating System :: OS Independent
+Classifier: Programming Language :: Python :: 3
+Classifier: Programming Language :: Python :: 3.11
+Classifier: Programming Language :: Python :: 3.12
+Classifier: Programming Language :: Python :: 3.13
+Classifier: Programming Language :: Python :: 3 :: Only
+Classifier: Topic :: Security
+Classifier: Topic :: Software Development :: Quality Assurance
+Classifier: Typing :: Typed
+Requires-Python: >=3.11
+Description-Content-Type: text/markdown
+License-File: LICENSE
+Requires-Dist: pydantic>=2.7.0
+Provides-Extra: core
+Requires-Dist: attackmap>=0.4.29; extra == "core"
+Provides-Extra: dev
+Requires-Dist: pytest>=8.0.0; extra == "dev"
+Requires-Dist: build>=1.2.0; extra == "dev"
+Requires-Dist: attackmap>=0.4.29; extra == "dev"
+Dynamic: license-file
+
+# attackmap-analyzer-swift
+
+Swift ecosystem analyzer plugin for [AttackMap](https://github.com/mlaify/AttackMap).
+Auto-discovered via the `attackmap.analyzers` entry point once installed.
+
+[![License: MIT](https://img.shields.io/badge/License-MIT-blue.svg)](LICENSE)
+
+> **Status: early scaffold (v0.1.0).** SwiftPM project detection + a
+> `Package.resolved` dependency SBOM. Server-side route extraction and the
+> iOS/macOS app attack surface are on the roadmap (below).
+
+## Install
+
+```bash
+pip install attackmap-analyzer-swift    # alongside attackmap>=0.4.29
+```
+
+Then AttackMap picks it up automatically:
+
+```bash
+attackmap analyze /path/to/swift/project
+```
+
+## What it does today
+
+- **SwiftPM detection** — recognizes `Package.swift`, `.xcodeproj` / `.xcworkspace`,
+  and `.swift` sources; emits a `SwiftPM` framework hint.
+- **Dependency SBOM** — parses `Package.resolved` (formats **v1**, **v2**, and **v3**,
+  including the copy Xcode stashes under `*.xcworkspace/xcshareddata/swiftpm/`) into
+  the scan's dependency inventory, marking direct vs. transitive by cross-referencing
+  the `Package.swift` manifest. Swift packages are inventoried but not CVE-matched —
+  OSV.dev has no SwiftPM ecosystem yet.
+- **Framework hints** — flags server-side frameworks (Vapor, Hummingbird, Kitura,
+  Perfect) when declared in the manifest.
+- **Entrypoints** — `main.swift` and `@main`.
+
+## Roadmap
+
+- **Server-side routes** ([AttackMap#187](https://github.com/mlaify/AttackMap/issues/187)) — Vapor / Hummingbird route + auth-middleware extraction.
+- **iOS/macOS app attack surface** ([AttackMap#188](https://github.com/mlaify/AttackMap/issues/188)) — URL schemes, universal links, `WKWebView` JS eval, Keychain / `UserDefaults` secrets, App Transport Security exceptions, pasteboard, XPC.
+
+Part of the [Swift analyzer epic](https://github.com/mlaify/AttackMap/issues/204).
+
+## Development
+
+```bash
+pip install -e ".[dev]"
+pytest -q
+```
+
+## License
+
+[MIT](LICENSE). Copyright (c) 2026 Matthew Davis and AttackMap Contributors.

attackmap_analyzer_swift-0.1.0.dist-info/RECORD

@@ -0,0 +1,9 @@
+attackmap_analyzer_swift/__init__.py,sha256=HWl7dOeWeXKWjEv33qWeioRMkzHct8u4aRU0ZmkkOB0,65
+attackmap_analyzer_swift/analyzer.py,sha256=y9S7TqN6WO11WDt0Sm1ZnqXNuDWfkLRssNPVh4lTByY,8210
+attackmap_analyzer_swift/contracts.py,sha256=G_cDkLCU_Uue4hErgzdiafFToi6rj0Mshq7txzzQmDk,894
+attackmap_analyzer_swift-0.1.0.dist-info/licenses/LICENSE,sha256=vtPQVGUyxq359j0JmD3_eJaXyHmaHyjzaMOtaLwJc88,1097
+attackmap_analyzer_swift-0.1.0.dist-info/METADATA,sha256=TSY9WDaeqLFebSfNHDVw0yfiaGErxfGFS-VZ56UHaDA,3962
+attackmap_analyzer_swift-0.1.0.dist-info/WHEEL,sha256=K260EYznzXsJYBQGqmI8VTxEdiZYNvDZwW9cBh9-_MA,91
+attackmap_analyzer_swift-0.1.0.dist-info/entry_points.txt,sha256=mK-fWLpGMGIXx34LpuTs8iinKAYfdE2eH4Uo9r0pjWw,69
+attackmap_analyzer_swift-0.1.0.dist-info/top_level.txt,sha256=zEpqb9TzFle_vNrDOOdgaAnLxKCsWflwn-qx7-SZJR0,25
+attackmap_analyzer_swift-0.1.0.dist-info/RECORD,,

attackmap_analyzer_swift-0.1.0.dist-info/WHEEL

@@ -0,0 +1,5 @@
+Wheel-Version: 1.0
+Generator: setuptools (83.0.0)
+Root-Is-Purelib: true
+Tag: py3-none-any
+

attackmap_analyzer_swift-0.1.0.dist-info/entry_points.txt

@@ -0,0 +1,2 @@
+[attackmap.analyzers]
+swift = attackmap_analyzer_swift:SwiftAnalyzer

attackmap_analyzer_swift-0.1.0.dist-info/licenses/LICENSE

@@ -0,0 +1,21 @@
+MIT License
+
+Copyright (c) 2026 Matthew Davis and AttackMap Contributors
+
+Permission is hereby granted, free of charge, to any person obtaining a copy
+of this software and associated documentation files (the "Software"), to deal
+in the Software without restriction, including without limitation the rights
+to use, copy, modify, merge, publish, distribute, sublicense, and/or sell
+copies of the Software, and to permit persons to whom the Software is
+furnished to do so, subject to the following conditions:
+
+The above copyright notice and this permission notice shall be included in all
+copies or substantial portions of the Software.
+
+THE SOFTWARE IS PROVIDED "AS IS", WITHOUT WARRANTY OF ANY KIND, EXPRESS OR
+IMPLIED, INCLUDING BUT NOT LIMITED TO THE WARRANTIES OF MERCHANTABILITY,
+FITNESS FOR A PARTICULAR PURPOSE AND NONINFRINGEMENT. IN NO EVENT SHALL THE
+AUTHORS OR COPYRIGHT HOLDERS BE LIABLE FOR ANY CLAIM, DAMAGES OR OTHER
+LIABILITY, WHETHER IN AN ACTION OF CONTRACT, TORT OR OTHERWISE, ARISING FROM,
+OUT OF OR IN CONNECTION WITH THE SOFTWARE OR THE USE OR OTHER DEALINGS IN THE
+SOFTWARE.

attackmap_analyzer_swift-0.1.0.dist-info/top_level.txt

@@ -0,0 +1 @@
+attackmap_analyzer_swift