attackmap 0.4.4__tar.gz → 0.4.5__tar.gz

{attackmap-0.4.4/src/attackmap.egg-info → attackmap-0.4.5}/PKG-INFO

@@ -1,6 +1,6 @@
 Metadata-Version: 2.4
 Name: attackmap
-Version: 0.4.4
+Version: 0.4.5
 Summary: AI-assisted defensive security analyzer for codebases — scans a repository, models assets and controls, finds cross-cutting weaknesses, and generates an evidence-grounded review with MITRE ATT&CK mappings and detection-engineering hints.
 Author: AttackMap Contributors
 Author-email: Matthew Davis <matthewd@matthewd.xyz>

{attackmap-0.4.4 → attackmap-0.4.5}/pyproject.toml

@@ -4,7 +4,7 @@ build-backend = "setuptools.build_meta"
 
 [project]
 name = "attackmap"
-version = "0.4.4"
+version = "0.4.5"
 description = "AI-assisted defensive security analyzer for codebases — scans a repository, models assets and controls, finds cross-cutting weaknesses, and generates an evidence-grounded review with MITRE ATT&CK mappings and detection-engineering hints."
 readme = "README.md"
 requires-python = ">=3.11"

{attackmap-0.4.4 → attackmap-0.4.5}/src/attackmap/__init__.py

@@ -1,2 +1,2 @@
 __all__ = ["__version__"]
-__version__ = "0.4.4"
+__version__ = "0.4.5"

{attackmap-0.4.4 → attackmap-0.4.5}/src/attackmap/config_scanner.py

@@ -15,11 +15,45 @@ want structural analysis can extend on top; this layer stays regex-only.
 
 from __future__ import annotations
 
+import bisect
 import re
 from pathlib import Path
 
 from .models import DatabaseHint, ExternalCall, ScanResult, SecretHint
-from .scanner import _line_of, _line_snippet
+from .scanner import _line_snippet
+
+# Config files larger than this are skipped — at that size they're invariably
+# generated (lock files, minified bundles, or AttackMap's own JSON reports)
+# rather than hand-written config, and scanning multi-megabyte text for URL /
+# secret regexes is pointlessly slow.
+_MAX_CONFIG_BYTES = 5_000_000
+
+
+class _LineIndex:
+    """O(log n) line-number lookups for a file's text.
+
+    `scanner._line_of` counts newlines from the start on every call — O(n) each,
+    which degrades to O(n^2) when a large file yields many matches (the cause of
+    a scan hang on multi-megabyte JSON). Precomputing the line-start offsets once
+    and binary-searching keeps extraction linear.
+    """
+
+    __slots__ = ("_starts",)
+
+    def __init__(self, content: str) -> None:
+        starts = [0]
+        find = content.find
+        idx = find("\n")
+        while idx != -1:
+            starts.append(idx + 1)
+            idx = find("\n", idx + 1)
+        self._starts = starts
+
+    def line_of(self, offset: int) -> int:
+        """1-indexed line number for a character offset."""
+        if offset <= 0:
+            return 1
+        return bisect.bisect_right(self._starts, offset)
 
 
 CONFIG_SUFFIXES = {".yaml", ".yml", ".toml", ".json", ".ini", ".cfg", ".env"}
@@ -48,6 +82,8 @@ CONFIG_EXCLUDE_FILENAMES = frozenset({
 _SKIP_DIRS = frozenset({
     "node_modules",
     ".git",
+    ".attackmap-gui",  # the macOS GUI's report output dir — never scan our own output
+    ".attackmap",      # CLI cache / output dir
     ".venv",
     "venv",
     "dist",
@@ -183,6 +219,8 @@ def scan_config_repo(root: str | Path) -> ScanResult:
         if not should_scan_config_file(path):
             continue
         try:
+            if path.stat().st_size > _MAX_CONFIG_BYTES:
+                continue
             content = path.read_text(encoding="utf-8")
         except (UnicodeDecodeError, OSError):
             continue
@@ -196,6 +234,7 @@ def scan_config_repo(root: str | Path) -> ScanResult:
 
 def _extract_db_urls(content: str, relative: str, result: ScanResult) -> None:
     seen: set[str] = {(h.kind, h.file) for h in result.databases if h.file == relative}
+    index = _LineIndex(content)
     for match in _DB_URL_PATTERN.finditer(content):
         scheme = match.group("scheme").lower()
         kind = _DB_SCHEME_TO_KIND.get(scheme, scheme)
@@ -205,7 +244,7 @@ def _extract_db_urls(content: str, relative: str, result: ScanResult) -> None:
                 DatabaseHint(
                     kind=kind,
                     file=relative,
-                    line=_line_of(content, match.start()),
+                    line=index.line_of(match.start()),
                     evidence_text=_line_snippet(content, match.start()),
                 )
             )
@@ -221,7 +260,7 @@ def _extract_db_urls(content: str, relative: str, result: ScanResult) -> None:
                     SecretHint(
                         name=_redact(password),
                         file=relative,
-                        line=_line_of(content, match.start()),
+                        line=index.line_of(match.start()),
                         evidence_text=_line_snippet(content, match.start()),
                         confidence=1.0,
                         kind=f"{kind}_url_password",
@@ -231,6 +270,7 @@ def _extract_db_urls(content: str, relative: str, result: ScanResult) -> None:
 
 def _extract_http_targets(content: str, relative: str, result: ScanResult) -> None:
     seen_targets = {(c.target, c.file) for c in result.external_calls if c.file == relative}
+    index = _LineIndex(content)
     for match in _HTTP_URL_PATTERN.finditer(content):
         target = match.group(0)
         # Trim trailing punctuation that looks like URL end
@@ -244,7 +284,7 @@ def _extract_http_targets(content: str, relative: str, result: ScanResult) -> No
             ExternalCall(
                 target=target,
                 file=relative,
-                line=_line_of(content, match.start()),
+                line=index.line_of(match.start()),
                 evidence_text=_line_snippet(content, match.start()),
             )
         )
@@ -258,12 +298,13 @@ def _extract_host(url: str) -> str | None:
 
 def _extract_secret_kvs(content: str, relative: str, result: ScanResult) -> None:
     seen: set[tuple[str, int]] = {(h.name, h.line or 0) for h in result.secret_hints if h.file == relative}
+    index = _LineIndex(content)
     for match in _SECRET_KEY_RE.finditer(content):
         key = match.group("key")
         value = match.group("value") or match.group("bare") or ""
         if not value or _is_placeholder(value):
             continue
-        line = _line_of(content, match.start())
+        line = index.line_of(match.start())
         # Store `key` as the SecretHint.name so consumers see WHICH secret
         # was leaked (auth vs stripe vs db). Value itself is redacted into
         # evidence_text via the same helper hardcoded-secret detection uses.

{attackmap-0.4.4 → attackmap-0.4.5/src/attackmap.egg-info}/PKG-INFO

@@ -1,6 +1,6 @@
 Metadata-Version: 2.4
 Name: attackmap
-Version: 0.4.4
+Version: 0.4.5
 Summary: AI-assisted defensive security analyzer for codebases — scans a repository, models assets and controls, finds cross-cutting weaknesses, and generates an evidence-grounded review with MITRE ATT&CK mappings and detection-engineering hints.
 Author: AttackMap Contributors
 Author-email: Matthew Davis <matthewd@matthewd.xyz>

{attackmap-0.4.4 → attackmap-0.4.5}/tests/test_config_scanner.py

@@ -263,3 +263,43 @@ def test_analyze_repository_preserves_provenance_on_config_signals(tmp_path: Pat
     config_dbs = [d for d in result.databases if d.file == "app.yaml"]
     assert config_dbs
     assert config_dbs[0].source_analyzer == "config"
+
+
+# ---------------------------------------------------------------------------
+# Large-file / feedback-loop hang regression (config_scanner _line_of O(n^2))
+# ---------------------------------------------------------------------------
+
+import attackmap.config_scanner as _cfg
+from attackmap.config_scanner import _LineIndex
+
+
+def test_line_index_matches_naive_line_numbers() -> None:
+    content = "a\nbb\n\nccc\nd"
+    expected = {0: 1, 1: 1, 2: 2, 4: 2, 5: 3, 6: 4, 9: 4, 10: 5}
+    index = _LineIndex(content)
+    for offset, line in expected.items():
+        assert index.line_of(offset) == line, (offset, index.line_of(offset))
+    assert index.line_of(-5) == 1
+
+
+def test_skips_attackmap_output_dir(tmp_path: Path) -> None:
+    # AttackMap writes reports into .attackmap-gui/ inside scanned repos; scanning
+    # them back is a feedback loop that hung on the multi-MB report (#gui-hang).
+    (tmp_path / "app.json").write_text('{"api": "https://api.real-service.com/v1"}')
+    reports = tmp_path / ".attackmap-gui" / "reports"
+    reports.mkdir(parents=True)
+    (reports / "attackmap-report.json").write_text('{"u": "https://leaked.internal-host.net/x"}')
+
+    files = {c.file for c in scan_config_repo(tmp_path).external_calls}
+    assert not any(".attackmap-gui" in f for f in files)
+    assert any("app.json" in f for f in files)
+
+
+def test_skips_oversized_config_file(tmp_path: Path, monkeypatch) -> None:
+    monkeypatch.setattr(_cfg, "_MAX_CONFIG_BYTES", 200)
+    (tmp_path / "big.json").write_text('{"u":"https://api.real-service.com/"}' + " " * 500)
+    (tmp_path / "small.json").write_text('{"u":"https://api.real-service.com/"}')
+
+    files = {c.file for c in scan_config_repo(tmp_path).external_calls}
+    assert "big.json" not in files
+    assert "small.json" in files