devguard 0.2.0__py3-none-any.whl

devguard/checkers/github.py

@@ -0,0 +1,210 @@
+"""GitHub repository security alerts checker."""
+
+import logging
+from datetime import datetime
+
+import httpx
+from github import Auth, Github
+from github.GithubException import GithubException
+
+from devguard.checkers.base import BaseChecker
+from devguard.config import Settings
+from devguard.http_client import create_client, retry_with_backoff
+from devguard.models import CheckResult, RepositoryAlert, Severity
+
+logger = logging.getLogger(__name__)
+
+
+class GitHubChecker(BaseChecker):
+    """Check GitHub repositories for security alerts."""
+
+    check_type = "gh"
+
+    def __init__(self, settings: Settings):
+        """Initialize GitHub checker."""
+        super().__init__(settings)
+        # Handle SecretStr if using newer pydantic settings
+        token = settings.github_token
+        if hasattr(token, "get_secret_value"):
+            token = token.get_secret_value()
+
+        auth = Auth.Token(token)
+        self.github = Github(auth=auth)
+
+    async def check(self) -> CheckResult:
+        """Check GitHub repositories for Dependabot alerts."""
+        alerts: list[RepositoryAlert] = []
+        errors: list[str] = []
+
+        # Skip if no repos or org explicitly configured
+        if not self.settings.github_repos_to_monitor and not self.settings.github_org:
+            return CheckResult(
+                check_type=self.check_type,
+                success=True,
+                repository_alerts=[],
+                errors=[],
+            )
+
+        try:
+            # Get repositories to check
+            repos = await self._get_repositories()
+
+            for repo in repos:
+                try:
+                    repo_alerts = await self._get_dependabot_alerts(repo)
+                    alerts.extend(repo_alerts)
+                except GithubException as e:
+                    errors.append(f"Error checking repo {repo.full_name}: {str(e)}")
+                except Exception as e:
+                    errors.append(f"Unexpected error checking repo {repo.full_name}: {str(e)}")
+
+        except Exception as e:
+            errors.append(f"Error getting repositories: {str(e)}")
+            return CheckResult(
+                check_type=self.check_type,
+                success=False,
+                repository_alerts=[],
+                errors=errors,
+            )
+
+        return CheckResult(
+            check_type=self.check_type,
+            success=len(errors) == 0,
+            repository_alerts=alerts,
+            errors=errors,
+        )
+
+    async def _get_repositories(self) -> list:
+        """Get list of repositories to monitor."""
+        repos = []
+
+        if self.settings.github_org:
+            # Get all repos in organization
+            try:
+                org = self.github.get_organization(self.settings.github_org)
+                repos.extend(list(org.get_repos()))
+            except GithubException as e:
+                org_name = self.settings.github_org
+                raise Exception(f"Error accessing organization {org_name}: {str(e)}")
+
+        # Add specific repos if configured
+        if self.settings.github_repos_to_monitor:
+            for repo_name in self.settings.github_repos_to_monitor:
+                try:
+                    repo = self.github.get_repo(repo_name)
+                    if repo not in repos:
+                        repos.append(repo)
+                except GithubException:
+                    # Repo might not exist or not accessible
+                    pass
+
+        # If no specific repos configured, get user's repos
+        if not repos:
+            try:
+                user = self.github.get_user()
+                repos.extend(list(user.get_repos()))
+            except GithubException:
+                pass
+
+        return repos
+
+    async def _get_dependabot_alerts(self, repo) -> list[RepositoryAlert]:
+        """Get Dependabot alerts for a repository."""
+        alerts: list[RepositoryAlert] = []
+
+        try:
+            # Use GitHub API to get Dependabot alerts
+            # Note: This requires the repository to have Dependabot enabled
+            # and the token to have security_events scope
+            # Using REST API directly as PyGithub doesn't fully support Dependabot alerts
+            headers = {
+                "Accept": "application/vnd.github+json",
+                "Authorization": f"token {self.settings.github_token}",
+                "X-GitHub-Api-Version": "2022-11-28",
+            }
+
+            async with create_client() as client:
+
+                async def fetch_alerts():
+                    response = await client.get(
+                        f"https://api.github.com/repos/{repo.full_name}/dependabot/alerts",
+                        headers=headers,
+                    )
+                    response.raise_for_status()
+                    return response
+
+                try:
+                    response = await retry_with_backoff(fetch_alerts, max_retries=3)
+                    data = response.json()
+                    for alert_data in data:
+                        alert = self._parse_alert(alert_data, repo.full_name)
+                        if alert:
+                            alerts.append(alert)
+                except httpx.HTTPStatusError as e:
+                    if e.response.status_code == 404:
+                        # Dependabot might not be enabled for this repo
+                        logger.debug(f"Dependabot not enabled for {repo.full_name}")
+                    else:
+                        logger.warning(
+                            f"Failed to fetch Dependabot alerts for {repo.full_name}: "
+                            f"HTTP {e.response.status_code}"
+                        )
+                except httpx.RequestError as e:
+                    logger.warning(
+                        f"Network error fetching Dependabot alerts for {repo.full_name}: {str(e)}"
+                    )
+
+        except Exception as e:
+            # If we can't get alerts, continue
+            logger.warning(f"Unexpected error fetching alerts for {repo.full_name}: {str(e)}")
+
+        return alerts
+
+    def _parse_alert(self, alert_data: dict, repo_name: str) -> RepositoryAlert | None:
+        """Parse a Dependabot alert from API response."""
+        try:
+            # Map severity
+            severity_str = alert_data.get("security_advisory", {}).get("severity", "low")
+            severity_map = {
+                "low": Severity.LOW,
+                "medium": Severity.MEDIUM,
+                "moderate": Severity.MEDIUM,
+                "high": Severity.HIGH,
+                "critical": Severity.CRITICAL,
+            }
+            severity = severity_map.get(severity_str.lower(), Severity.LOW)
+
+            # Parse dates
+            created_at = datetime.fromisoformat(
+                alert_data.get("created_at", "").replace("Z", "+00:00")
+            )
+            updated_at = datetime.fromisoformat(
+                alert_data.get("updated_at", "").replace("Z", "+00:00")
+            )
+
+            dismissed_at = None
+            if alert_data.get("dismissed_at"):
+                dismissed_at = datetime.fromisoformat(
+                    alert_data.get("dismissed_at", "").replace("Z", "+00:00")
+                )
+
+            fixed_at = None
+            if alert_data.get("fixed_at"):
+                fixed_at = datetime.fromisoformat(
+                    alert_data.get("fixed_at", "").replace("Z", "+00:00")
+                )
+
+            return RepositoryAlert(
+                repository=repo_name,
+                alert_id=alert_data.get("number", 0),
+                state=alert_data.get("state", "open"),
+                severity=severity,
+                dependency=alert_data.get("dependency", {}),
+                security_advisory=alert_data.get("security_advisory", {}),
+                created_at=created_at,
+                updated_at=updated_at,
+                dismissed_at=dismissed_at,
+                fixed_at=fixed_at,
+            )
+        except Exception:
+            return None

devguard/checkers/npm.py

@@ -0,0 +1,327 @@
+"""npm package vulnerability checker."""
+
+import logging
+from datetime import datetime
+
+import httpx
+
+from devguard.checkers.base import BaseChecker
+from devguard.http_client import create_client, retry_with_backoff
+from devguard.models import CheckResult, Severity, Vulnerability
+
+logger = logging.getLogger(__name__)
+
+
+class NpmChecker(BaseChecker):
+    """Check npm packages for vulnerabilities."""
+
+    check_type = "npm"
+
+    async def check(self) -> CheckResult:
+        """Check npm packages for vulnerabilities."""
+        vulnerabilities: list[Vulnerability] = []
+        errors: list[str] = []
+
+        if not self.settings.npm_packages_to_monitor:
+            return CheckResult(
+                check_type=self.check_type,
+                success=True,
+                vulnerabilities=[],
+                errors=["No npm packages configured for monitoring"],
+            )
+
+        for package in self.settings.npm_packages_to_monitor:
+            try:
+                # Use npm audit for vulnerability checking
+                # First, check if package.json exists or create a temporary one
+                pkg_vulns = await self._check_package_vulnerabilities(package)
+                vulnerabilities.extend(pkg_vulns)
+            except Exception as e:
+                error_msg = f"Error checking package {package}: {str(e)}"
+                errors.append(error_msg)
+                logger.warning(error_msg)
+
+        # Also check for Snyk if token is available
+        if self.settings.snyk_token:
+            try:
+                snyk_vulns = await self._check_snyk_vulnerabilities()
+                vulnerabilities.extend(snyk_vulns)
+            except Exception as e:
+                errors.append(f"Error checking Snyk: {str(e)}")
+
+        return CheckResult(
+            check_type=self.check_type,
+            success=len(errors) == 0,
+            vulnerabilities=vulnerabilities,
+            errors=errors,
+        )
+
+    async def _check_package_vulnerabilities(self, package: str) -> list[Vulnerability]:
+        """
+        Check a specific package for vulnerabilities using npm registry API.
+
+        Uses the npm registry security advisories endpoint to check for known vulnerabilities.
+        """
+        vulnerabilities: list[Vulnerability] = []
+
+        try:
+            # First, get the latest version of the package
+            async with create_client() as client:
+
+                async def fetch_package_info():
+                    # Get package info from npm registry
+                    response = await client.get(
+                        f"https://registry.npmjs.org/{package}",
+                    )
+                    response.raise_for_status()
+                    return response
+
+                response = await retry_with_backoff(fetch_package_info, max_retries=3)
+                package_data = response.json()
+
+                # Get latest version
+                dist_tags = package_data.get("dist-tags", {})
+                latest_version = dist_tags.get("latest")
+                if not latest_version:
+                    versions = package_data.get("versions", {})
+                    if versions:
+                        latest_version = max(versions.keys())
+
+                if not latest_version:
+                    logger.warning(f"Could not determine latest version for {package}")
+                    return vulnerabilities
+
+                # Check for vulnerabilities using npm audit API
+                # We construct a minimal package.json structure for the audit
+                audit_payload = {
+                    "name": f"devguard-check-{package}",
+                    "version": "1.0.0",
+                    "requires": {package: latest_version},
+                    "dependencies": {
+                        package: {
+                            "version": latest_version,
+                        }
+                    },
+                }
+
+                async def fetch_audit():
+                    response = await client.post(
+                        "https://registry.npmjs.org/-/npm/v1/security/audits",
+                        json=audit_payload,
+                    )
+                    response.raise_for_status()
+                    return response
+
+                try:
+                    audit_response = await retry_with_backoff(fetch_audit, max_retries=3)
+                    audit_data = audit_response.json()
+
+                    # Parse vulnerabilities from audit response
+                    advisories = audit_data.get("advisories", {})
+                    for advisory_id, advisory_data in advisories.items():
+                        severity_map = {
+                            "low": Severity.LOW,
+                            "moderate": Severity.MEDIUM,
+                            "high": Severity.HIGH,
+                            "critical": Severity.CRITICAL,
+                        }
+
+                        severity = severity_map.get(
+                            advisory_data.get("severity", "moderate").lower(), Severity.MEDIUM
+                        )
+
+                        # Find affected package
+                        findings = advisory_data.get("findings", [])
+                        for finding in findings:
+                            for version_range in finding.get("version", []):
+                                cves = advisory_data.get("cves", [])
+                                cve_id = cves[0] if cves else None
+
+                                created = advisory_data.get("created")
+                                published_at = None
+                                if created:
+                                    iso_str = created.replace("Z", "+00:00")
+                                    published_at = datetime.fromisoformat(iso_str)
+
+                                vuln = Vulnerability(
+                                    package_name=package,
+                                    package_version=latest_version,
+                                    severity=severity,
+                                    advisory_id=advisory_id,
+                                    cve_id=cve_id,
+                                    summary=advisory_data.get("title"),
+                                    description=advisory_data.get("overview"),
+                                    vulnerable_version_range=version_range,
+                                    published_at=published_at,
+                                    source="npm",
+                                )
+                                vulnerabilities.append(vuln)
+                                break  # Only add once per advisory
+                            break
+
+                except httpx.HTTPStatusError as e:
+                    if e.response.status_code == 404:
+                        # No vulnerabilities found or endpoint not available
+                        logger.debug(f"No vulnerabilities found for {package} via npm audit API")
+                    else:
+                        status_code = e.response.status_code
+                        logger.warning(
+                            f"Failed to check vulnerabilities for {package}: HTTP {status_code}"
+                        )
+                except httpx.RequestError as e:
+                    logger.warning(
+                        f"Network error checking vulnerabilities for {package}: {str(e)}"
+                    )
+
+        except httpx.HTTPStatusError as e:
+            status_code = e.response.status_code
+            error_msg = f"Failed to fetch package info for {package}: HTTP {status_code}"
+            logger.warning(error_msg)
+            # Re-raise so caller can add to errors list
+            raise Exception(error_msg) from e
+        except httpx.RequestError as e:
+            error_msg = f"Network error fetching package info for {package}: {str(e)}"
+            logger.warning(error_msg)
+            # Re-raise so caller can add to errors list
+            raise Exception(error_msg) from e
+        except Exception as e:
+            error_msg = f"Unexpected error checking {package}: {str(e)}"
+            logger.warning(error_msg)
+            # Re-raise so caller can add to errors list
+            raise
+
+        return vulnerabilities
+
+    async def _check_snyk_vulnerabilities(self) -> list[Vulnerability]:
+        """
+        Check vulnerabilities using Snyk API.
+
+        Note: This requires a Snyk API token and checks packages configured
+        in npm_packages_to_monitor.
+        """
+        vulnerabilities: list[Vulnerability] = []
+
+        if not self.settings.snyk_token:
+            return vulnerabilities
+
+        if not self.settings.npm_packages_to_monitor:
+            return vulnerabilities
+
+        # Handle SecretStr if using newer pydantic settings
+        snyk_token = self.settings.snyk_token
+        if hasattr(snyk_token, "get_secret_value"):
+            snyk_token = snyk_token.get_secret_value()
+
+        try:
+            async with create_client() as client:
+                headers = {
+                    "Authorization": f"token {snyk_token}",
+                    "Content-Type": "application/json",
+                }
+
+                for package in self.settings.npm_packages_to_monitor:
+                    try:
+                        # Get package info first to get latest version
+                        async def fetch_package_info():
+                            response = await client.get(
+                                f"https://registry.npmjs.org/{package}",
+                            )
+                            response.raise_for_status()
+                            return response
+
+                        package_response = await retry_with_backoff(
+                            fetch_package_info, max_retries=3
+                        )
+                        package_data = package_response.json()
+                        dist_tags = package_data.get("dist-tags", {})
+                        latest_version = dist_tags.get("latest")
+
+                        if not latest_version:
+                            continue
+
+                        # Check vulnerabilities using Snyk API
+                        # Note: Snyk API v1 endpoint for testing packages
+                        async def fetch_snyk_vulns():
+                            # Using Snyk's test endpoint for npm packages
+                            response = await client.post(
+                                "https://api.snyk.io/v1/test/npm",
+                                headers=headers,
+                                json={
+                                    "package": {
+                                        "name": package,
+                                        "version": latest_version,
+                                    }
+                                },
+                            )
+                            response.raise_for_status()
+                            return response
+
+                        try:
+                            snyk_response = await retry_with_backoff(
+                                fetch_snyk_vulns, max_retries=3
+                            )
+                            snyk_data = snyk_response.json()
+
+                            # Parse vulnerabilities from Snyk response
+                            issues = snyk_data.get("issues", {}).get("vulnerabilities", [])
+                            for issue in issues:
+                                severity_map = {
+                                    "low": Severity.LOW,
+                                    "medium": Severity.MEDIUM,
+                                    "high": Severity.HIGH,
+                                    "critical": Severity.CRITICAL,
+                                }
+
+                                severity = severity_map.get(
+                                    issue.get("severity", "medium").lower(), Severity.MEDIUM
+                                )
+
+                                identifiers = issue.get("identifiers", {})
+                                cves = identifiers.get("CVE", [])
+                                cve_id = cves[0] if cves else None
+
+                                semver = issue.get("semver", {})
+                                vulnerable = semver.get("vulnerable", [])
+                                vulnerable_range = vulnerable[0] if vulnerable else None
+
+                                patched = semver.get("patched", [])
+                                patched_version = patched[0] if patched else None
+
+                                pub_time = issue.get("publicationTime")
+                                published_at = None
+                                if pub_time:
+                                    iso_str = pub_time.replace("Z", "+00:00")
+                                    published_at = datetime.fromisoformat(iso_str)
+
+                                vuln = Vulnerability(
+                                    package_name=package,
+                                    package_version=latest_version,
+                                    severity=severity,
+                                    cve_id=cve_id,
+                                    summary=issue.get("title"),
+                                    description=issue.get("description"),
+                                    vulnerable_version_range=vulnerable_range,
+                                    first_patched_version=patched_version,
+                                    published_at=published_at,
+                                    source="snyk",
+                                )
+                                vulnerabilities.append(vuln)
+
+                        except httpx.HTTPStatusError as e:
+                            if e.response.status_code == 401:
+                                logger.warning("Snyk API authentication failed. Check your token.")
+                            elif e.response.status_code == 404:
+                                logger.debug(f"No vulnerabilities found for {package} via Snyk API")
+                            else:
+                                status_code = e.response.status_code
+                                logger.warning(f"Snyk API error for {package}: HTTP {status_code}")
+                        except httpx.RequestError as e:
+                            logger.warning(f"Network error checking Snyk for {package}: {str(e)}")
+
+                    except Exception as e:
+                        logger.warning(f"Error checking {package} with Snyk: {str(e)}")
+
+        except Exception as e:
+            logger.warning(f"Unexpected error checking Snyk vulnerabilities: {str(e)}")
+
+        return vulnerabilities