codeframe-ai 0.9.0__py3-none-any.whl

codeframe/lib/quality/security_scanner.py

@@ -0,0 +1,250 @@
+"""Security scanning using bandit.
+
+Scans code for security vulnerabilities using bandit and maps severity levels.
+"""
+
+import json
+import logging
+import subprocess
+from pathlib import Path
+from typing import List
+
+from codeframe.core.models import ReviewFinding
+
+logger = logging.getLogger(__name__)
+
+
+class SecurityScanner:
+    """Scans code for security vulnerabilities using bandit.
+
+    Severity mapping:
+    - bandit HIGH → critical
+    - bandit MEDIUM → high
+    - bandit LOW → medium
+    """
+
+    def __init__(self, project_path: Path):
+        """Initialize SecurityScanner.
+
+        Args:
+            project_path: Path to project root directory
+        """
+        self.project_path = Path(project_path)
+
+    def analyze_file(self, file_path: Path) -> List[ReviewFinding]:
+        """Analyze a single file for security vulnerabilities.
+
+        Args:
+            file_path: Path to Python file to analyze
+
+        Returns:
+            List of ReviewFinding objects for security issues
+
+        Raises:
+            FileNotFoundError: If file doesn't exist
+        """
+        file_path = Path(file_path)
+
+        if not file_path.exists():
+            raise FileNotFoundError(f"File not found: {file_path}")
+
+        # Skip non-Python files
+        if file_path.suffix != ".py":
+            return []
+
+        # Read file to check if empty
+        try:
+            code = file_path.read_text()
+        except Exception as e:
+            logger.error(f"Error reading file {file_path}: {e}")
+            return []
+
+        if not code.strip():
+            return []
+
+        findings = []
+
+        try:
+            # Run bandit on the file
+            result = subprocess.run(
+                ["bandit", "-f", "json", str(file_path)],
+                capture_output=True,
+                text=True,
+                timeout=30,
+            )
+
+            # Parse JSON output
+            if result.stdout:
+                bandit_output = json.loads(result.stdout)
+                findings = self._parse_bandit_output(bandit_output, file_path)
+
+        except subprocess.TimeoutExpired:
+            logger.error(f"Bandit timeout analyzing {file_path}")
+        except json.JSONDecodeError as e:
+            logger.error(f"Error parsing bandit output for {file_path}: {e}")
+        except FileNotFoundError:
+            logger.warning("bandit not found. Install with: pip install bandit")
+        except Exception as e:
+            logger.error(f"Error running bandit on {file_path}: {e}")
+
+        return findings
+
+    def _parse_bandit_output(self, bandit_output: dict, file_path: Path) -> List[ReviewFinding]:
+        """Parse bandit JSON output into ReviewFinding objects.
+
+        Args:
+            bandit_output: Parsed JSON output from bandit
+            file_path: Path to file being analyzed
+
+        Returns:
+            List of ReviewFinding objects
+        """
+        findings = []
+
+        results = bandit_output.get("results", [])
+
+        for result in results:
+            # Map bandit severity to our severity levels
+            bandit_severity = result.get("issue_severity", "LOW")
+            severity = self._map_severity(bandit_severity)
+
+            # Extract details
+            issue_text = result.get("issue_text", "Security issue detected")
+            line_number = result.get("line_number", 1)
+            test_id = result.get("test_id", "")
+            test_name = result.get("test_name", "")
+
+            # Generate suggestion based on issue type
+            suggestion = self._generate_suggestion(test_id, test_name, issue_text)
+
+            # Create message
+            message = f"{issue_text}"
+            if test_id:
+                message = f"[{test_id}] {message}"
+
+            findings.append(
+                ReviewFinding(
+                    category="security",
+                    severity=severity,
+                    file_path=str(file_path),
+                    line_number=line_number,
+                    message=message,
+                    suggestion=suggestion,
+                    tool="bandit",
+                )
+            )
+
+        return findings
+
+    def _map_severity(self, bandit_severity: str) -> str:
+        """Map bandit severity levels to our severity levels.
+
+        Args:
+            bandit_severity: Bandit severity (HIGH, MEDIUM, LOW)
+
+        Returns:
+            Our severity level (critical, high, medium, low)
+        """
+        mapping = {
+            "HIGH": "critical",
+            "MEDIUM": "high",
+            "LOW": "medium",
+        }
+        return mapping.get(bandit_severity.upper(), "medium")
+
+    def _generate_suggestion(self, test_id: str, test_name: str, issue_text: str) -> str:
+        """Generate remediation suggestion based on issue type.
+
+        Args:
+            test_id: Bandit test ID (e.g., B105, B608)
+            test_name: Bandit test name
+            issue_text: Issue description
+
+        Returns:
+            Remediation suggestion
+        """
+        # Common suggestions based on test ID
+        suggestions = {
+            "B105": "Use environment variables or a secrets manager instead of hardcoding passwords",
+            "B106": "Use environment variables or a secrets manager instead of hardcoding passwords",
+            "B107": "Use environment variables or a secrets manager instead of hardcoding sensitive data",
+            "B201": "Avoid using flask with debug=True in production",
+            "B608": "Use parameterized queries to prevent SQL injection",
+            "B602": "Use subprocess with shell=False and validate inputs",
+            "B603": "Use subprocess with shell=False to prevent command injection",
+            "B301": "Avoid using pickle for untrusted data",
+            "B506": "Avoid using yaml.load(), use yaml.safe_load() instead",
+        }
+
+        suggestion = suggestions.get(test_id)
+
+        if suggestion:
+            return suggestion
+
+        # Generic suggestions based on keywords
+        if "sql" in issue_text.lower():
+            return "Use parameterized queries or an ORM to prevent SQL injection"
+        elif "password" in issue_text.lower() or "secret" in issue_text.lower():
+            return "Store sensitive data in environment variables or a secrets manager"
+        elif "shell" in issue_text.lower() or "command" in issue_text.lower():
+            return "Avoid shell=True in subprocess calls and validate all inputs"
+        elif "pickle" in issue_text.lower():
+            return "Use safer serialization formats like JSON for untrusted data"
+        elif "yaml" in issue_text.lower():
+            return "Use yaml.safe_load() instead of yaml.load()"
+        else:
+            return "Review and fix this security issue before merging"
+
+    def analyze_files(self, file_paths: List[Path]) -> List[ReviewFinding]:
+        """Analyze multiple files for security vulnerabilities.
+
+        Args:
+            file_paths: List of file paths to analyze
+
+        Returns:
+            List of all findings from all files
+        """
+        all_findings = []
+
+        for file_path in file_paths:
+            try:
+                findings = self.analyze_file(file_path)
+                all_findings.extend(findings)
+            except Exception as e:
+                logger.error(f"Error analyzing {file_path}: {e}")
+
+        return all_findings
+
+    def calculate_score(self, file_paths: List[Path]) -> float:
+        """Calculate overall security score (0-100, higher is better).
+
+        Args:
+            file_paths: List of file paths to analyze
+
+        Returns:
+            Overall security score (0-100)
+        """
+        if not file_paths:
+            return 100.0  # No files = perfect score
+
+        findings = self.analyze_files(file_paths)
+
+        # Calculate penalty based on severity
+        penalty = 0
+        for finding in findings:
+            if finding.severity == "critical":
+                penalty += 30  # Critical security issues are very bad
+            elif finding.severity == "high":
+                penalty += 15
+            elif finding.severity == "medium":
+                penalty += 5
+            elif finding.severity == "low":
+                penalty += 2
+
+        # Normalize penalty based on number of files
+        penalty_per_file = penalty / len(file_paths)
+
+        # Calculate score (start at 100, subtract penalties)
+        score = max(0, 100 - penalty_per_file)
+
+        return score

codeframe/lib/rate_limiter.py

@@ -0,0 +1,312 @@
+"""Rate limiting middleware for CodeFRAME API.
+
+This module provides rate limiting functionality using slowapi, with support
+for different rate limits per endpoint category and proper 429 responses.
+
+Rate limit categories:
+- auth: Authentication endpoints (login, register)
+- standard: Standard API endpoints (CRUD operations)
+- ai: AI/expensive operations (chat, generation)
+- websocket: WebSocket connections
+
+Key extraction:
+- Authenticated requests: User ID from token
+- Unauthenticated requests: Client IP address
+
+Security:
+- X-Forwarded-For is only trusted when request comes from a configured trusted proxy
+- "unknown" IPs are logged and tracked for security monitoring
+- Configure RATE_LIMIT_TRUSTED_PROXIES to define trusted proxy networks
+"""
+
+import logging
+from typing import Callable, Optional
+
+from fastapi import Request
+from fastapi.responses import JSONResponse
+from slowapi import Limiter
+from slowapi.errors import RateLimitExceeded
+
+from codeframe.config.rate_limits import get_rate_limit_config
+
+logger = logging.getLogger(__name__)
+
+# Global limiter instance
+_limiter: Optional[Limiter] = None
+# Track if we've logged the disabled message to avoid duplicate logs
+_logged_disabled: bool = False
+
+
+def get_client_ip(request: Request) -> str:
+    """Extract client IP address from request with trusted proxy validation.
+
+    Only trusts X-Forwarded-For and X-Real-IP headers when the direct
+    connection is from a configured trusted proxy. This prevents header
+    spoofing attacks.
+
+    Security Note:
+    - If RATE_LIMIT_TRUSTED_PROXIES is not configured, proxy headers are ignored
+    - Configure trusted proxies when running behind a reverse proxy (nginx, ALB, etc.)
+
+    Args:
+        request: FastAPI request object
+
+    Returns:
+        Client IP address string, or "unknown" if not determinable
+    """
+    config = get_rate_limit_config()
+
+    # Get the direct connection IP
+    direct_ip = None
+    if request.client and request.client.host:
+        direct_ip = request.client.host
+
+    # Only trust proxy headers if direct connection is from a trusted proxy
+    if direct_ip and config.is_trusted_proxy(direct_ip):
+        # Check X-Forwarded-For header (may contain multiple IPs)
+        forwarded_for = request.headers.get("X-Forwarded-For")
+        if forwarded_for:
+            # Return first IP in the chain (real client)
+            client_ip = forwarded_for.split(",")[0].strip()
+            if client_ip:
+                return client_ip
+
+        # Check X-Real-IP header
+        real_ip = request.headers.get("X-Real-IP")
+        if real_ip:
+            return real_ip.strip()
+    elif direct_ip:
+        # Not from trusted proxy - check if headers were spoofed
+        if request.headers.get("X-Forwarded-For") or request.headers.get("X-Real-IP"):
+            logger.warning(
+                f"Proxy headers present from non-trusted IP {direct_ip}. "
+                f"Headers ignored. Configure RATE_LIMIT_TRUSTED_PROXIES if "
+                f"running behind a reverse proxy."
+            )
+
+    # Use direct connection IP
+    if direct_ip:
+        return direct_ip
+
+    # Unable to determine IP - log for security monitoring
+    logger.warning(
+        "Unable to determine client IP address. "
+        "This may indicate proxy misconfiguration. "
+        f"Path: {request.url.path}"
+    )
+    return "unknown"
+
+
+def get_rate_limit_key(request: Request) -> str:
+    """Generate rate limit key for a request.
+
+    Uses user ID for authenticated requests, IP address for unauthenticated.
+    Applies stricter rate limiting for "unknown" IPs to mitigate DoS risk.
+
+    Args:
+        request: FastAPI request object
+
+    Returns:
+        Rate limit key string in format "user:{id}" or "ip:{address}"
+    """
+    # Check if user is authenticated (set by auth middleware)
+    user = getattr(getattr(request, "state", None), "user", None)
+
+    if user and hasattr(user, "id") and user.id:
+        return f"user:{user.id}"
+
+    # Fall back to IP address
+    client_ip = get_client_ip(request)
+
+    # Mark "unknown" IPs specially for potential stricter handling
+    if client_ip == "unknown":
+        # Use a unique key per request for unknown IPs
+        # This effectively gives each "unknown" request its own bucket
+        # preventing the shared bucket DoS attack
+        request_id = id(request)
+        return f"ip:unknown:{request_id}"
+
+    return f"ip:{client_ip}"
+
+
+def get_rate_limiter() -> Optional[Limiter]:
+    """Get or create the rate limiter instance.
+
+    Returns:
+        Limiter instance if rate limiting is enabled, None otherwise
+    """
+    global _limiter
+    global _logged_disabled
+
+    config = get_rate_limit_config()
+
+    if not config.enabled:
+        if not _logged_disabled:
+            logger.info("Rate limiting is disabled")
+            _logged_disabled = True
+        return None
+
+    if _limiter is None:
+        # Create limiter with appropriate storage
+        if config.storage == "redis" and config.redis_url:
+            try:
+                _limiter = Limiter(
+                    key_func=get_rate_limit_key,
+                    storage_uri=config.redis_url,
+                )
+                logger.info("Rate limiter initialized with Redis storage")
+            except ImportError as e:
+                logger.error(f"Redis storage requested but redis module not available: {e}. Falling back to memory.")
+                _limiter = Limiter(key_func=get_rate_limit_key)
+        else:
+            _limiter = Limiter(key_func=get_rate_limit_key)
+            logger.info("Rate limiter initialized with in-memory storage")
+
+    return _limiter
+
+
+async def rate_limit_exceeded_handler(request: Request, exc: RateLimitExceeded) -> JSONResponse:
+    """Custom exception handler for rate limit exceeded errors.
+
+    Returns a proper 429 response with standard rate limit headers.
+    Also logs the event to the audit log for security monitoring.
+
+    Args:
+        request: FastAPI request object
+        exc: RateLimitExceeded exception
+
+    Returns:
+        JSONResponse with 429 status and rate limit headers
+    """
+    # Extract request info
+    client_ip = get_client_ip(request)
+    user = getattr(getattr(request, "state", None), "user", None)
+    user_id = user.id if user and hasattr(user, "id") and user.id else None
+    endpoint = request.url.path
+
+    # Log to standard logger
+    logger.warning(
+        f"Rate limit exceeded: path={endpoint}, "
+        f"ip={client_ip}, user_id={user_id}"
+    )
+
+    # Log to audit log for security monitoring
+    try:
+        db = getattr(getattr(request, "app", None), "state", None)
+        db = getattr(db, "db", None) if db else None
+        if db:
+            from codeframe.lib.audit_logger import AuditLogger, AuditEventType
+
+            audit = AuditLogger(db)
+            audit.log_rate_limit_event(
+                event_type=AuditEventType.RATE_LIMIT_EXCEEDED,
+                user_id=user_id,
+                ip_address=client_ip,
+                endpoint=endpoint,
+                limit_category=None,  # Not easily determinable from exception
+                metadata={
+                    "limit": str(exc.limit) if hasattr(exc, "limit") else None,
+                    "retry_after": str(exc.detail) if hasattr(exc, "detail") else "60",
+                },
+            )
+    except Exception as e:
+        # Don't let audit logging failure affect the rate limit response
+        logger.debug(f"Failed to log rate limit event to audit log: {e}")
+
+    # Build response headers
+    headers = {
+        "Retry-After": str(exc.detail) if hasattr(exc, "detail") else "60",
+    }
+
+    # Add rate limit info headers if available
+    if hasattr(exc, "limit"):
+        headers["X-RateLimit-Limit"] = str(exc.limit)
+
+    response = JSONResponse(
+        status_code=429,
+        content={
+            "error": "rate_limit_exceeded",
+            "detail": "Too many requests. Please try again later.",
+            "retry_after": headers.get("Retry-After", "60"),
+        },
+        headers=headers,
+    )
+
+    return response
+
+
+def _create_rate_limit_decorator(limit_key: str) -> Callable:
+    """Create a rate limit decorator for a specific limit category.
+
+    Args:
+        limit_key: Configuration key for the limit (e.g., 'standard_limit')
+
+    Returns:
+        Decorator function that applies the rate limit
+    """
+
+    def decorator():
+        """Rate limit decorator that reads limit from config."""
+
+        def wrapper(func: Callable) -> Callable:
+            # Get the limiter (returns None when rate limiting is disabled)
+            limiter = get_rate_limiter()
+
+            if limiter is None:
+                # Rate limiting globally disabled, return function as-is
+                return func
+
+            # Get the limit value from config
+            config = get_rate_limit_config()
+            limit_value = getattr(config, limit_key, "100/minute")
+
+            # Always apply the slowapi decorator, let slowapi handle the logic
+            return limiter.limit(limit_value)(func)
+
+        return wrapper
+
+    return decorator
+
+
+# Rate limit decorators for each category
+def rate_limit_auth() -> Callable:
+    """Decorator for authentication endpoint rate limits.
+
+    Default: 10 requests/minute (configurable via RATE_LIMIT_AUTH)
+    """
+    return _create_rate_limit_decorator("auth_limit")()
+
+
+def rate_limit_standard() -> Callable:
+    """Decorator for standard API endpoint rate limits.
+
+    Default: 100 requests/minute (configurable via RATE_LIMIT_STANDARD)
+    """
+    return _create_rate_limit_decorator("standard_limit")()
+
+
+def rate_limit_ai() -> Callable:
+    """Decorator for AI/expensive operation rate limits.
+
+    Default: 20 requests/minute (configurable via RATE_LIMIT_AI)
+    """
+    return _create_rate_limit_decorator("ai_limit")()
+
+
+def rate_limit_websocket() -> Callable:
+    """Decorator for WebSocket connection rate limits.
+
+    Default: 30 connections/minute (configurable via RATE_LIMIT_WEBSOCKET)
+    """
+    return _create_rate_limit_decorator("websocket_limit")()
+
+
+def reset_rate_limiter() -> None:
+    """Reset the global rate limiter instance.
+
+    Useful for testing to ensure clean state between tests.
+    """
+    global _limiter
+    global _logged_disabled
+    _limiter = None
+    _logged_disabled = False