attackmap 0.4.4__tar.gz → 0.4.6__tar.gz

{attackmap-0.4.4/src/attackmap.egg-info → attackmap-0.4.6}/PKG-INFO

@@ -1,6 +1,6 @@
 Metadata-Version: 2.4
 Name: attackmap
-Version: 0.4.4
+Version: 0.4.6
 Summary: AI-assisted defensive security analyzer for codebases — scans a repository, models assets and controls, finds cross-cutting weaknesses, and generates an evidence-grounded review with MITRE ATT&CK mappings and detection-engineering hints.
 Author: AttackMap Contributors
 Author-email: Matthew Davis <matthewd@matthewd.xyz>

{attackmap-0.4.4 → attackmap-0.4.6}/pyproject.toml

@@ -4,7 +4,7 @@ build-backend = "setuptools.build_meta"
 
 [project]
 name = "attackmap"
-version = "0.4.4"
+version = "0.4.6"
 description = "AI-assisted defensive security analyzer for codebases — scans a repository, models assets and controls, finds cross-cutting weaknesses, and generates an evidence-grounded review with MITRE ATT&CK mappings and detection-engineering hints."
 readme = "README.md"
 requires-python = ">=3.11"

{attackmap-0.4.4 → attackmap-0.4.6}/src/attackmap/__init__.py

@@ -1,2 +1,2 @@
 __all__ = ["__version__"]
-__version__ = "0.4.4"
+__version__ = "0.4.6"

{attackmap-0.4.4 → attackmap-0.4.6}/src/attackmap/config_scanner.py

@@ -15,11 +15,45 @@ want structural analysis can extend on top; this layer stays regex-only.
 
 from __future__ import annotations
 
+import bisect
 import re
 from pathlib import Path
 
 from .models import DatabaseHint, ExternalCall, ScanResult, SecretHint
-from .scanner import _line_of, _line_snippet
+from .scanner import _line_snippet
+
+# Config files larger than this are skipped — at that size they're invariably
+# generated (lock files, minified bundles, or AttackMap's own JSON reports)
+# rather than hand-written config, and scanning multi-megabyte text for URL /
+# secret regexes is pointlessly slow.
+_MAX_CONFIG_BYTES = 5_000_000
+
+
+class _LineIndex:
+    """O(log n) line-number lookups for a file's text.
+
+    `scanner._line_of` counts newlines from the start on every call — O(n) each,
+    which degrades to O(n^2) when a large file yields many matches (the cause of
+    a scan hang on multi-megabyte JSON). Precomputing the line-start offsets once
+    and binary-searching keeps extraction linear.
+    """
+
+    __slots__ = ("_starts",)
+
+    def __init__(self, content: str) -> None:
+        starts = [0]
+        find = content.find
+        idx = find("\n")
+        while idx != -1:
+            starts.append(idx + 1)
+            idx = find("\n", idx + 1)
+        self._starts = starts
+
+    def line_of(self, offset: int) -> int:
+        """1-indexed line number for a character offset."""
+        if offset <= 0:
+            return 1
+        return bisect.bisect_right(self._starts, offset)
 
 
 CONFIG_SUFFIXES = {".yaml", ".yml", ".toml", ".json", ".ini", ".cfg", ".env"}
@@ -48,6 +82,8 @@ CONFIG_EXCLUDE_FILENAMES = frozenset({
 _SKIP_DIRS = frozenset({
     "node_modules",
     ".git",
+    ".attackmap-gui",  # the macOS GUI's report output dir — never scan our own output
+    ".attackmap",      # CLI cache / output dir
     ".venv",
     "venv",
     "dist",
@@ -183,6 +219,8 @@ def scan_config_repo(root: str | Path) -> ScanResult:
         if not should_scan_config_file(path):
             continue
         try:
+            if path.stat().st_size > _MAX_CONFIG_BYTES:
+                continue
             content = path.read_text(encoding="utf-8")
         except (UnicodeDecodeError, OSError):
             continue
@@ -196,6 +234,7 @@ def scan_config_repo(root: str | Path) -> ScanResult:
 
 def _extract_db_urls(content: str, relative: str, result: ScanResult) -> None:
     seen: set[str] = {(h.kind, h.file) for h in result.databases if h.file == relative}
+    index = _LineIndex(content)
     for match in _DB_URL_PATTERN.finditer(content):
         scheme = match.group("scheme").lower()
         kind = _DB_SCHEME_TO_KIND.get(scheme, scheme)
@@ -205,7 +244,7 @@ def _extract_db_urls(content: str, relative: str, result: ScanResult) -> None:
                 DatabaseHint(
                     kind=kind,
                     file=relative,
-                    line=_line_of(content, match.start()),
+                    line=index.line_of(match.start()),
                     evidence_text=_line_snippet(content, match.start()),
                 )
             )
@@ -221,7 +260,7 @@ def _extract_db_urls(content: str, relative: str, result: ScanResult) -> None:
                     SecretHint(
                         name=_redact(password),
                         file=relative,
-                        line=_line_of(content, match.start()),
+                        line=index.line_of(match.start()),
                         evidence_text=_line_snippet(content, match.start()),
                         confidence=1.0,
                         kind=f"{kind}_url_password",
@@ -231,6 +270,7 @@ def _extract_db_urls(content: str, relative: str, result: ScanResult) -> None:
 
 def _extract_http_targets(content: str, relative: str, result: ScanResult) -> None:
     seen_targets = {(c.target, c.file) for c in result.external_calls if c.file == relative}
+    index = _LineIndex(content)
     for match in _HTTP_URL_PATTERN.finditer(content):
         target = match.group(0)
         # Trim trailing punctuation that looks like URL end
@@ -244,7 +284,7 @@ def _extract_http_targets(content: str, relative: str, result: ScanResult) -> No
             ExternalCall(
                 target=target,
                 file=relative,
-                line=_line_of(content, match.start()),
+                line=index.line_of(match.start()),
                 evidence_text=_line_snippet(content, match.start()),
             )
         )
@@ -258,12 +298,13 @@ def _extract_host(url: str) -> str | None:
 
 def _extract_secret_kvs(content: str, relative: str, result: ScanResult) -> None:
     seen: set[tuple[str, int]] = {(h.name, h.line or 0) for h in result.secret_hints if h.file == relative}
+    index = _LineIndex(content)
     for match in _SECRET_KEY_RE.finditer(content):
         key = match.group("key")
         value = match.group("value") or match.group("bare") or ""
         if not value or _is_placeholder(value):
             continue
-        line = _line_of(content, match.start())
+        line = index.line_of(match.start())
         # Store `key` as the SecretHint.name so consumers see WHICH secret
         # was leaked (auth vs stripe vs db). Value itself is redacted into
         # evidence_text via the same helper hardcoded-secret detection uses.

{attackmap-0.4.4 → attackmap-0.4.6}/src/attackmap/llm_review.py

@@ -197,6 +197,14 @@ def _claude_cli_available() -> bool:
     return shutil.which("claude") is not None
 
 
+def _anthropic_sdk_available() -> bool:
+    try:
+        import anthropic  # noqa: F401
+    except ImportError:
+        return False
+    return True
+
+
 def _run_via_claude_cli(
     rendered_system: str,
     rendered_user: str,
@@ -412,6 +420,14 @@ def _codex_cli_available() -> bool:
     return shutil.which("codex") is not None
 
 
+def _openai_sdk_available() -> bool:
+    try:
+        import openai  # noqa: F401
+    except ImportError:
+        return False
+    return True
+
+
 def _run_via_codex_cli(
     rendered_system: str,
     rendered_user: str,
@@ -514,10 +530,18 @@ def _resolve_openai_backend(
             )
         return "cli"
     # auto
-    if client is not None or api_key or os.environ.get("OPENAI_API_KEY"):
+    if client is not None:
+        return "api"
+    has_key = bool(api_key or os.environ.get("OPENAI_API_KEY"))
+    # Prefer the API backend only when the openai SDK is importable; otherwise
+    # fall back to the `codex` CLI (needs no SDK) so a key set against an
+    # SDK-less install still works via subscription auth.
+    if has_key and _openai_sdk_available():
         return "api"
     if _codex_cli_available():
         return "cli"
+    if has_key:
+        return "api"  # no SDK and no CLI — surface the actionable SDK-missing error
     raise LlmReviewError(
         "No OpenAI backend available. Set OPENAI_API_KEY, or install the `codex` "
         "CLI and run `codex login`."
@@ -539,12 +563,23 @@ def _resolve_backend(
             )
         return "cli"
     # auto
-    if client is not None or api_key:
+    if client is not None:
         return "api"
-    if os.environ.get("ANTHROPIC_API_KEY") or os.environ.get("ANTHROPIC_AUTH_TOKEN"):
+    has_key = bool(
+        api_key
+        or os.environ.get("ANTHROPIC_API_KEY")
+        or os.environ.get("ANTHROPIC_AUTH_TOKEN")
+    )
+    # Prefer the API backend only when the SDK is actually importable. Otherwise
+    # fall back to the `claude` CLI (needs no SDK), so a key set against an
+    # SDK-less install (e.g. Homebrew, which doesn't vendor `attackmap[llm]`)
+    # still works via subscription auth instead of erroring.
+    if has_key and _anthropic_sdk_available():
         return "api"
     if _claude_cli_available():
         return "cli"
+    if has_key:
+        return "api"  # no SDK and no CLI — surface the actionable SDK-missing error
     raise LlmReviewError(
         "No LLM backend available. Set ANTHROPIC_API_KEY, set ANTHROPIC_AUTH_TOKEN, "
         "or install the `claude` CLI and run `claude login`."

{attackmap-0.4.4 → attackmap-0.4.6/src/attackmap.egg-info}/PKG-INFO

@@ -1,6 +1,6 @@
 Metadata-Version: 2.4
 Name: attackmap
-Version: 0.4.4
+Version: 0.4.6
 Summary: AI-assisted defensive security analyzer for codebases — scans a repository, models assets and controls, finds cross-cutting weaknesses, and generates an evidence-grounded review with MITRE ATT&CK mappings and detection-engineering hints.
 Author: AttackMap Contributors
 Author-email: Matthew Davis <matthewd@matthewd.xyz>

{attackmap-0.4.4 → attackmap-0.4.6}/tests/test_config_scanner.py

@@ -263,3 +263,43 @@ def test_analyze_repository_preserves_provenance_on_config_signals(tmp_path: Pat
     config_dbs = [d for d in result.databases if d.file == "app.yaml"]
     assert config_dbs
     assert config_dbs[0].source_analyzer == "config"
+
+
+# ---------------------------------------------------------------------------
+# Large-file / feedback-loop hang regression (config_scanner _line_of O(n^2))
+# ---------------------------------------------------------------------------
+
+import attackmap.config_scanner as _cfg
+from attackmap.config_scanner import _LineIndex
+
+
+def test_line_index_matches_naive_line_numbers() -> None:
+    content = "a\nbb\n\nccc\nd"
+    expected = {0: 1, 1: 1, 2: 2, 4: 2, 5: 3, 6: 4, 9: 4, 10: 5}
+    index = _LineIndex(content)
+    for offset, line in expected.items():
+        assert index.line_of(offset) == line, (offset, index.line_of(offset))
+    assert index.line_of(-5) == 1
+
+
+def test_skips_attackmap_output_dir(tmp_path: Path) -> None:
+    # AttackMap writes reports into .attackmap-gui/ inside scanned repos; scanning
+    # them back is a feedback loop that hung on the multi-MB report (#gui-hang).
+    (tmp_path / "app.json").write_text('{"api": "https://api.real-service.com/v1"}')
+    reports = tmp_path / ".attackmap-gui" / "reports"
+    reports.mkdir(parents=True)
+    (reports / "attackmap-report.json").write_text('{"u": "https://leaked.internal-host.net/x"}')
+
+    files = {c.file for c in scan_config_repo(tmp_path).external_calls}
+    assert not any(".attackmap-gui" in f for f in files)
+    assert any("app.json" in f for f in files)
+
+
+def test_skips_oversized_config_file(tmp_path: Path, monkeypatch) -> None:
+    monkeypatch.setattr(_cfg, "_MAX_CONFIG_BYTES", 200)
+    (tmp_path / "big.json").write_text('{"u":"https://api.real-service.com/"}' + " " * 500)
+    (tmp_path / "small.json").write_text('{"u":"https://api.real-service.com/"}')
+
+    files = {c.file for c in scan_config_repo(tmp_path).external_calls}
+    assert "big.json" not in files
+    assert "small.json" in files

{attackmap-0.4.4 → attackmap-0.4.6}/tests/test_llm_review.py

@@ -424,6 +424,35 @@ def test_auto_backend_falls_back_to_cli_when_no_creds(monkeypatch) -> None:
     assert result.backend == "cli"
 
 
+def test_auto_backend_falls_back_to_cli_when_key_set_but_sdk_missing(monkeypatch) -> None:
+    # Homebrew installs attackmap without the anthropic SDK. A key set in that
+    # environment must fall back to the `claude` CLI, not error.
+    monkeypatch.setenv("ANTHROPIC_API_KEY", "sk-ant-test")
+    monkeypatch.setattr("attackmap.llm_review._anthropic_sdk_available", lambda: False)
+    monkeypatch.setattr("attackmap.llm_review._claude_cli_available", lambda: True)
+
+    payload = {"type": "result", "is_error": False, "result": "hi"}
+    runner, _ = _make_cli_runner(json.dumps(payload))
+
+    result = generate_llm_review(
+        _trivial_scan(), _surfaces(), _findings(), [], backend="auto", cli_runner=runner
+    )
+    assert result.backend == "cli"
+
+
+def test_openai_auto_falls_back_to_codex_when_key_set_but_sdk_missing(monkeypatch) -> None:
+    monkeypatch.setenv("OPENAI_API_KEY", "sk-openai-test")
+    monkeypatch.setattr("attackmap.llm_review._openai_sdk_available", lambda: False)
+    monkeypatch.setattr("attackmap.llm_review._codex_cli_available", lambda: True)
+    runner, _ = _make_cli_runner("hi")
+
+    result = generate_llm_review(
+        _trivial_scan(), _surfaces(), _findings(), [],
+        provider="openai", backend="auto", codex_runner=runner,
+    )
+    assert result.backend == "cli"
+
+
 def test_auto_backend_raises_when_no_creds_and_no_cli(monkeypatch) -> None:
     monkeypatch.delenv("ANTHROPIC_API_KEY", raising=False)
     monkeypatch.delenv("ANTHROPIC_AUTH_TOKEN", raising=False)