attackmap 0.3.1__tar.gz → 0.3.2__tar.gz

{attackmap-0.3.1/src/attackmap.egg-info → attackmap-0.3.2}/PKG-INFO

@@ -1,6 +1,6 @@
 Metadata-Version: 2.4
 Name: attackmap
-Version: 0.3.1
+Version: 0.3.2
 Summary: AI-assisted defensive security analyzer for codebases — scans a repository, models assets and controls, finds cross-cutting weaknesses, and generates an evidence-grounded review with MITRE ATT&CK mappings and detection-engineering hints.
 Author: AttackMap Contributors
 Author-email: Matthew Davis <matthewd@matthewd.xyz>
@@ -75,7 +75,7 @@ managers who need to triage an unfamiliar codebase.
 [![Python: 3.11+](https://img.shields.io/badge/Python-3.11%2B-blue.svg)](https://www.python.org/)
 [![PyPI](https://img.shields.io/pypi/v/attackmap.svg)](https://pypi.org/project/attackmap/)
 
-> **Status: beta (v0.3.1).** Core engine and 14 analyzer plugins are published
+> **Status: beta (v0.3.2).** Core engine and 14 analyzer plugins are published
 > to PyPI, Homebrew, and GHCR and validated against real-world codebases.
 > AttackMap is heuristic by design — findings are confidence-tiered evidence,
 > not proof. See [Project status](#project-status) for what's solid and what's
@@ -541,7 +541,7 @@ introduces a new HIGH finding.
 
 ## Project status
 
-AttackMap is **beta** (v0.3.1) — published and validated on real codebases, but
+AttackMap is **beta** (v0.3.2) — published and validated on real codebases, but
 pre-1.0 and heuristic.
 
 **Solid today:**

{attackmap-0.3.1 → attackmap-0.3.2}/README.md

@@ -16,7 +16,7 @@ managers who need to triage an unfamiliar codebase.
 [![Python: 3.11+](https://img.shields.io/badge/Python-3.11%2B-blue.svg)](https://www.python.org/)
 [![PyPI](https://img.shields.io/pypi/v/attackmap.svg)](https://pypi.org/project/attackmap/)
 
-> **Status: beta (v0.3.1).** Core engine and 14 analyzer plugins are published
+> **Status: beta (v0.3.2).** Core engine and 14 analyzer plugins are published
 > to PyPI, Homebrew, and GHCR and validated against real-world codebases.
 > AttackMap is heuristic by design — findings are confidence-tiered evidence,
 > not proof. See [Project status](#project-status) for what's solid and what's
@@ -482,7 +482,7 @@ introduces a new HIGH finding.
 
 ## Project status
 
-AttackMap is **beta** (v0.3.1) — published and validated on real codebases, but
+AttackMap is **beta** (v0.3.2) — published and validated on real codebases, but
 pre-1.0 and heuristic.
 
 **Solid today:**

{attackmap-0.3.1 → attackmap-0.3.2}/pyproject.toml

@@ -4,7 +4,7 @@ build-backend = "setuptools.build_meta"
 
 [project]
 name = "attackmap"
-version = "0.3.1"
+version = "0.3.2"
 description = "AI-assisted defensive security analyzer for codebases — scans a repository, models assets and controls, finds cross-cutting weaknesses, and generates an evidence-grounded review with MITRE ATT&CK mappings and detection-engineering hints."
 readme = "README.md"
 requires-python = ">=3.11"

{attackmap-0.3.1 → attackmap-0.3.2}/src/attackmap/__init__.py

@@ -1,2 +1,2 @@
 __all__ = ["__version__"]
-__version__ = "0.3.1"
+__version__ = "0.3.2"

{attackmap-0.3.1 → attackmap-0.3.2}/src/attackmap/scanner.py

@@ -14,7 +14,7 @@ from .anomalies import find_anomalies
 from .authz import analyze_authz
 from .crypto import find_crypto_weaknesses
 from .sbom import analyze_sbom
-from .srcpaths import is_test_file
+from .srcpaths import is_test_file, is_vendored_file
 from .weaknesses import find_code_weaknesses
 from .webhardening import find_web_hardening_issues
 from .sdk.models import AuthHint, DatabaseHint, ExternalCall, Route, ScanResult, SecretHint
@@ -594,9 +594,11 @@ def scan_repo(
 
         _append_hardcoded_secret_hints(result, relative, content)
 
-        # The weakness passes below are noise in test scaffolding, so skip
-        # test/spec files by default (#67; ATTACKMAP_INCLUDE_TESTS opts in).
-        if not is_test_file(relative):
+        # The weakness passes below are noise in test scaffolding (#67) and in
+        # vendored/minified third-party code (#95) — a bug in a dependency the
+        # project doesn't maintain isn't this repo's finding. Skip both by
+        # default (ATTACKMAP_INCLUDE_TESTS / ATTACKMAP_INCLUDE_VENDORED opt in).
+        if not is_test_file(relative) and not is_vendored_file(relative):
             # Insecure crypto / weak randomness (#70). Content is already
             # read, so this rides the per-file pass rather than re-walking.
             result.crypto_weaknesses.extend(find_crypto_weaknesses(content, relative))
@@ -724,6 +726,8 @@ def _append_hardcoded_secret_hints(result: ScanResult, relative: str, content: s
             continue
         if not _looks_like_secret_candidate(literal):
             continue
+        if _looks_like_charset(literal):
+            continue  # base64/base32/hex alphabet constant, not a secret (#96)
         if _shannon_entropy(literal) < _ENTROPY_THRESHOLD:
             continue
         line = _line_of(content, pos)
@@ -743,6 +747,20 @@ def _append_hardcoded_secret_hints(result: ScanResult, relative: str, content: s
         )
 
 
+# Sequential alphabet runs that mark a well-known charset/alphabet constant
+# (base64/base32/base16 digit strings) — high-entropy but not a secret (#96).
+_CHARSET_MARKERS = (
+    "abcdefghijklmnop",  # lowercase alphabet run (base64/base32/base36)
+    "ABCDEFGHIJKLMNOP",  # uppercase alphabet run
+    "0123456789abcdef",  # lower hex
+    "0123456789ABCDEF",  # upper hex
+)
+
+
+def _looks_like_charset(value: str) -> bool:
+    return any(marker in value for marker in _CHARSET_MARKERS)
+
+
 def _is_jwt_shape(literal: str) -> bool:
     """Verify the header segment of a candidate JWT decodes to a JSON
     object with an `alg` field. Cheap and precise enough to keep the

{attackmap-0.3.1 → attackmap-0.3.2}/src/attackmap/srcpaths.py

@@ -80,4 +80,41 @@ def is_infra_route(path: str) -> bool:
     return _INFRA_ROUTE_RE.search(path) is not None
 
 
-__all__ = ["is_test_file", "is_infra_route"]
+# Directory segments that hold third-party / vendored code the project doesn't
+# maintain. Flagging weaknesses here is noise about someone else's dependency.
+_VENDORED_DIR_SEGMENTS = frozenset(
+    {
+        "node_modules",
+        "bower_components",
+        "vendor",
+        "vendored",
+        "third_party",
+        "third-party",
+        "thirdparty",
+        "external",
+        "externals",
+        "site-packages",
+        "jspm_packages",
+    }
+)
+
+# Minified / bundled build artifacts — not human-authored source.
+_MINIFIED_FILE_RE = re.compile(r"\.min\.(?:js|css|mjs|cjs)$|\.bundle\.js$", re.IGNORECASE)
+
+
+def is_vendored_file(rel_path: str) -> bool:
+    """Return True if ``rel_path`` is vendored third-party or minified/bundled
+    code (e.g. ``UserInterface/External/three.js``, ``vendor/…``, ``*.min.js``).
+
+    Honors ``ATTACKMAP_INCLUDE_VENDORED`` to scan it anyway (e.g. auditing a
+    pinned/forked dependency)."""
+    if os.environ.get("ATTACKMAP_INCLUDE_VENDORED"):
+        return False
+    norm = rel_path.replace("\\", "/")
+    parts = norm.split("/")
+    if any(segment.lower() in _VENDORED_DIR_SEGMENTS for segment in parts[:-1]):
+        return True
+    return _MINIFIED_FILE_RE.search(parts[-1]) is not None
+
+
+__all__ = ["is_test_file", "is_infra_route", "is_vendored_file"]

{attackmap-0.3.1 → attackmap-0.3.2}/src/attackmap/taint.py

@@ -268,7 +268,13 @@ def analyze_taint(scan: ScanResult, root: str | Path | None = None) -> list[Tain
 def _index_repo(root: Path) -> dict[str, Path]:
     """Return {rel_path: abs_path} for every taint-relevant source file."""
     out: dict[str, Path] = {}
-    skip_dirs = {".git", "node_modules", "__pycache__", "dist", "build", ".venv", "venv"}
+    skip_dirs = {
+        ".git", "node_modules", "__pycache__", "dist", "build", ".venv", "venv",
+        # Vendored third-party trees (#95) — import-walking someone else's
+        # bundled library adds sinks the project doesn't own.
+        "bower_components", "vendor", "third_party", "third-party",
+        "external", "externals", "jspm_packages", "site-packages",
+    }
     for path in root.rglob("*"):
         if not path.is_file() or path.suffix not in _SUPPORTED_SUFFIXES:
             continue

{attackmap-0.3.1 → attackmap-0.3.2}/src/attackmap/weaknesses.py

@@ -32,8 +32,19 @@ _PATTERNS: tuple[tuple[str, str, re.Pattern[str]], ...] = (
     (
         "prototype_pollution",
         "high",
-        # Literal __proto__ / constructor.prototype write.
-        _rx(r"\[\s*['\"]__proto__['\"]\s*\]|\.__proto__\s*[=.]|['\"]constructor['\"]\s*\]\s*\[\s*['\"]prototype['\"]"),
+        # Literal __proto__ / constructor.prototype *write* (assignment target).
+        # Requiring a trailing `=` (not `==`) avoids flagging prototype-chain
+        # *reads* like `x.prototype.__proto__.constructor` (#94).
+        _rx(
+            r"(?:"
+            r"\.__proto__"
+            r"|\[\s*['\"]__proto__['\"]\s*\]"
+            r"|\[\s*['\"]constructor['\"]\s*\]\s*\[\s*['\"]prototype['\"]\s*\]"
+            r"|\.constructor\s*\.\s*prototype"
+            r")"
+            r"(?:\s*\.\s*\w+|\s*\[[^\]]*\])*"  # optional further member/subscript access
+            r"\s*=(?!=)"
+        ),
     ),
     (
         "prototype_pollution",
@@ -158,6 +169,8 @@ def find_code_weaknesses(content: str, rel_file: str) -> list[CodeWeakness]:
     out: list[CodeWeakness] = []
     for kind, severity, pattern in _PATTERNS:
         for match in pattern.finditer(content):
+            if _in_line_comment(content, match.start()):
+                continue  # a pattern inside a `//` comment isn't real code (#94)
             line = content.count("\n", 0, match.start()) + 1
             key = (kind, line)
             if key in seen:
@@ -176,6 +189,14 @@ def find_code_weaknesses(content: str, rel_file: str) -> list[CodeWeakness]:
     return out
 
 
+def _in_line_comment(content: str, offset: int) -> bool:
+    """True if ``offset`` falls after a `//` line comment on its line. Cheap
+    heuristic (ignores `//` inside strings), used only to drop obvious
+    comment-embedded matches like `// x.__proto__.y = z`."""
+    line_start = content.rfind("\n", 0, offset) + 1
+    return "//" in content[line_start:offset]
+
+
 def _snippet(content: str, offset: int, radius: int = 120) -> str:
     start = max(0, content.rfind("\n", 0, offset) + 1)
     end = content.find("\n", offset)

{attackmap-0.3.1 → attackmap-0.3.2/src/attackmap.egg-info}/PKG-INFO

@@ -1,6 +1,6 @@
 Metadata-Version: 2.4
 Name: attackmap
-Version: 0.3.1
+Version: 0.3.2
 Summary: AI-assisted defensive security analyzer for codebases — scans a repository, models assets and controls, finds cross-cutting weaknesses, and generates an evidence-grounded review with MITRE ATT&CK mappings and detection-engineering hints.
 Author: AttackMap Contributors
 Author-email: Matthew Davis <matthewd@matthewd.xyz>
@@ -75,7 +75,7 @@ managers who need to triage an unfamiliar codebase.
 [![Python: 3.11+](https://img.shields.io/badge/Python-3.11%2B-blue.svg)](https://www.python.org/)
 [![PyPI](https://img.shields.io/pypi/v/attackmap.svg)](https://pypi.org/project/attackmap/)
 
-> **Status: beta (v0.3.1).** Core engine and 14 analyzer plugins are published
+> **Status: beta (v0.3.2).** Core engine and 14 analyzer plugins are published
 > to PyPI, Homebrew, and GHCR and validated against real-world codebases.
 > AttackMap is heuristic by design — findings are confidence-tiered evidence,
 > not proof. See [Project status](#project-status) for what's solid and what's
@@ -541,7 +541,7 @@ introduces a new HIGH finding.
 
 ## Project status
 
-AttackMap is **beta** (v0.3.1) — published and validated on real codebases, but
+AttackMap is **beta** (v0.3.2) — published and validated on real codebases, but
 pre-1.0 and heuristic.
 
 **Solid today:**

{attackmap-0.3.1 → attackmap-0.3.2}/tests/test_scanner.py

@@ -803,3 +803,23 @@ def refresh():
     # separate exposures). But the same line must not double-emit.
     lines = [h.line for h in aws_hints]
     assert len(lines) == len(set(lines))
+
+
+def test_base64_alphabet_constant_not_flagged_as_secret(tmp_path: Path) -> None:
+    """A base64/hex alphabet constant is high-entropy but not a secret (#96)."""
+    (tmp_path / "sourcemap.js").write_text(
+        'var base64Digits = '
+        '"ABCDEFGHIJKLMNOPQRSTUVWXYZabcdefghijklmnopqrstuvwxyz0123456789+/";\n',
+        encoding="utf-8",
+    )
+    result = scan_repo(tmp_path)
+    assert not [s for s in result.secret_hints if s.kind == "high_entropy"]
+
+
+def test_real_high_entropy_secret_still_flagged(tmp_path: Path) -> None:
+    (tmp_path / "cfg.js").write_text(
+        'const apiToken = "s3cr3tR4nd0mK3yZ9xQvB2mNw8LpT4hJ7";\n',
+        encoding="utf-8",
+    )
+    result = scan_repo(tmp_path)
+    assert any(s.kind == "high_entropy" for s in result.secret_hints)

{attackmap-0.3.1 → attackmap-0.3.2}/tests/test_srcpaths.py

@@ -7,7 +7,7 @@ from pathlib import Path
 import pytest
 
 from attackmap.scanner import scan_repo
-from attackmap.srcpaths import is_test_file
+from attackmap.srcpaths import is_test_file, is_vendored_file
 
 
 # ---------------------------------------------------------------------------
@@ -58,6 +58,68 @@ def test_include_tests_env_disables_exclusion(monkeypatch: pytest.MonkeyPatch) -
     assert is_test_file("pkg/foo.test.ts") is False
 
 
+# ---------------------------------------------------------------------------
+# is_vendored_file classification (#95)
+# ---------------------------------------------------------------------------
+
+
+@pytest.mark.parametrize(
+    "rel",
+    [
+        "node_modules/lodash/merge.js",
+        "UserInterface/External/three.js/three.js",
+        "vendor/github.com/x/y.go",
+        "third_party/zlib/zlib.js",
+        "src/bower_components/jquery/jquery.js",
+        "app/static/app.min.js",
+        "app/main.bundle.js",
+    ],
+)
+def test_vendored_paths_detected(rel: str) -> None:
+    assert is_vendored_file(rel) is True
+
+
+@pytest.mark.parametrize(
+    "rel",
+    [
+        "src/app.js",
+        "UserInterface/Models/PropertyPath.js",  # not under External/
+        "services/external_api.py",              # 'external_api' file, not an 'external' dir
+        "vendored_notes.md",                     # not a dir segment
+    ],
+)
+def test_non_vendored_paths_not_detected(rel: str) -> None:
+    assert is_vendored_file(rel) is False
+
+
+def test_include_vendored_env_disables_exclusion(monkeypatch: pytest.MonkeyPatch) -> None:
+    monkeypatch.setenv("ATTACKMAP_INCLUDE_VENDORED", "1")
+    assert is_vendored_file("node_modules/x/y.js") is False
+    assert is_vendored_file("a/b.min.js") is False
+
+
+def test_weakness_in_vendored_file_excluded_by_default(tmp_path: Path) -> None:
+    ext = tmp_path / "External" / "three.js"
+    ext.mkdir(parents=True)
+    # A ReDoS-shaped regex living in a vendored library.
+    (ext / "three.js").write_text(
+        "const re = /((?:WC+[\\/:])*)/\n", encoding="utf-8"
+    )
+    scan = scan_repo(tmp_path)
+    assert not [w for w in scan.code_weaknesses if w.kind == "redos"]
+
+
+def test_weakness_in_vendored_file_included_with_env(
+    tmp_path: Path, monkeypatch: pytest.MonkeyPatch
+) -> None:
+    monkeypatch.setenv("ATTACKMAP_INCLUDE_VENDORED", "1")
+    ext = tmp_path / "External"
+    ext.mkdir(parents=True)
+    (ext / "lib.js").write_text("const re = /^(a+)+$/\n", encoding="utf-8")
+    scan = scan_repo(tmp_path)
+    assert any(w.kind == "redos" for w in scan.code_weaknesses)
+
+
 # ---------------------------------------------------------------------------
 # Integration: weakness passes skip test files by default
 # ---------------------------------------------------------------------------

{attackmap-0.3.1 → attackmap-0.3.2}/tests/test_weaknesses.py

@@ -40,6 +40,27 @@ def test_safe_merge_of_constant_not_flagged() -> None:
     assert "prototype_pollution" not in _kinds("_.merge(target, { a: 1 })\n")
 
 
+def test_prototype_chain_read_not_flagged() -> None:
+    # Reading up the prototype chain (parent-constructor lookup) is not a write.
+    assert "prototype_pollution" not in _kinds(
+        "constructor = constructor.prototype.__proto__.constructor;\n"
+    )
+    assert "prototype_pollution" not in _kinds("const p = obj.__proto__.foo\n")
+
+
+def test_proto_in_comment_not_flagged() -> None:
+    assert "prototype_pollution" not in _kinds(
+        '// The path for "foo.__proto__.bar.__proto__.x" is shown as "foo.bar.x".\n'
+    )
+    # even a write-shaped example inside a line comment is ignored
+    assert "prototype_pollution" not in _kinds("// obj.__proto__.polluted = true\n")
+
+
+def test_proto_write_still_flagged() -> None:
+    assert "prototype_pollution" in _kinds("target.__proto__.polluted = true\n")
+    assert "prototype_pollution" in _kinds("obj['__proto__']['x'] = 1\n")
+
+
 # ---------------------------------------------------------------------------
 # Mass assignment
 # ---------------------------------------------------------------------------