djcheckup 0.2.6__tar.gz → 0.4.0__tar.gz

{djcheckup-0.2.6 → djcheckup-0.4.0}/PKG-INFO

@@ -1,6 +1,6 @@
 Metadata-Version: 2.3
 Name: djcheckup
-Version: 0.2.6
+Version: 0.4.0
 Summary: DJ Checkup is a security scanner for Django sites.
 Author: Stuart Maxwell
 Author-email: Stuart Maxwell <stuart@amanzi.nz>

{djcheckup-0.2.6 → djcheckup-0.4.0}/pyproject.toml

@@ -1,6 +1,6 @@
 [project]
 name = "djcheckup"
-version = "0.2.6"
+version = "0.4.0"
 description = "DJ Checkup is a security scanner for Django sites."
 readme = "README.md"
 authors = [{ name = "Stuart Maxwell", email = "stuart@amanzi.nz" }]

djcheckup-0.4.0/src/djcheckup/__init__.py

@@ -0,0 +1,6 @@
+"""DJ Checkup CLI package."""
+
+from djcheckup.outputs import SiteCheckResultDict
+from djcheckup.run import run_checks
+
+__all__ = ["SiteCheckResultDict", "run_checks"]

{djcheckup-0.2.6 → djcheckup-0.4.0}/src/djcheckup/check_defs.py

@@ -75,12 +75,13 @@ Reference:
 csrf_samesite_check = CookieSameSiteCheck(
     check_id="csrf_samesite_check",
     depends_on="csrf_check",
-    name="Is the CSRF cookie SameSite=Lax?",
+    name="Does the CSRF cookie have a SameSite flag?",
     cookie_name="csrftoken",
-    samesite_value="Lax",
     success=True,
     severity=SeverityWeight.HIGH,
-    success_message="CSRF cookie is marked as SameSite=Lax, which helps prevent CSRF attacks via cross-site requests.",
+    success_message="""
+CSRF cookie is marked as SameSite=Lax or SameSite=Strict, which helps prevent CSRF attacks via cross-site requests.
+    """,
     failure_message="""
 Your CSRF cookie is not marked as SameSite=Lax. This increases the risk of CSRF attacks.
 Set `CSRF_COOKIE_SAMESITE = 'Lax'` in your Django settings.
@@ -263,12 +264,11 @@ Reference:
 sessionid_samesite_check = CookieSameSiteCheck(
     check_id="sessionid_samesite_check",
     depends_on="sessionid_cookie_check",
-    name="Is the sessionid cookie SameSite=Lax?",
+    name="Does the sessionid cookie have a SameSite flag?",
     cookie_name="sessionid",
-    samesite_value="Lax",
     success=True,
     severity=SeverityWeight.HIGH,
-    success_message="Sessionid cookie is marked as SameSite=Lax. This helps prevent CSRF attacks.",
+    success_message="Sessionid cookie is marked as SameSite=Lax or SameSite=Strict. This helps prevent CSRF attacks.",
     failure_message="""
 Your sessionid cookie is not marked as SameSite=Lax. This increases the risk of CSRF attacks.
 Set `SESSION_COOKIE_SAMESITE = 'Lax'` in your Django settings.

{djcheckup-0.2.6 → djcheckup-0.4.0}/src/djcheckup/checks.py

@@ -174,10 +174,14 @@ class CookieHttpOnlyCheck(_BaseCheck):
 
 @dataclass
 class CookieSameSiteCheck(_BaseCheck):
-    """A cookie SameSite check."""
+    """A cookie SameSite check.
+
+    Checks that the cookie has the expected SameSite value.
+    If the `samesite_value` is omitted, then it checks if the value is set to Lax or Strict.
+    """
 
     cookie_name: str
-    samesite_value: Literal["Strict", "Lax", "None"]
+    samesite_value: Literal["Strict", "Lax", "None"] | None = None
 
     def check(self, context: SiteCheckContext) -> bool:
         """Check if a specific cookie has a SameSite attribute."""
@@ -186,6 +190,9 @@ class CookieSameSiteCheck(_BaseCheck):
 
         for cookie in context.cookies:
             if cookie.name == self.cookie_name:
+                if not self.samesite_value:
+                    return cookie.get_nonstandard_attr("SameSite") in ["Lax", "Strict"]
+
                 return cookie.get_nonstandard_attr("SameSite") == self.samesite_value
 
         return False

{djcheckup-0.2.6 → djcheckup-0.4.0}/src/djcheckup/cli.py

@@ -7,7 +7,7 @@ import typer
 
 from djcheckup.check_defs import all_checks
 from djcheckup.checks import SiteChecker
-from djcheckup.outputs import output_results_as_json, rich_output
+from djcheckup.outputs import rich_output, sitecheck_as_json
 
 app = typer.Typer()
 
@@ -26,6 +26,6 @@ def run_checks(
     results = checker.run_checks(all_checks)
 
     if output_json:
-        rich.print_json(output_results_as_json(results))
+        rich.print_json(sitecheck_as_json(results))
     else:
         rich_output(results)

djcheckup-0.4.0/src/djcheckup/outputs.py

@@ -0,0 +1,96 @@
+"""Output formats for the site check results."""
+
+import json
+from collections.abc import Mapping, Sequence
+from dataclasses import asdict
+from enum import Enum
+from typing import TypedDict
+
+from rich.console import Console
+from rich.markdown import Markdown
+from rich.panel import Panel
+from rich.table import Table
+
+from djcheckup.checks import CheckResult, SiteCheckResult
+
+
+class CheckResponseDict(TypedDict):
+    """Represents the response for a single check."""
+
+    name: str
+    result: str  # from CheckResult
+    severity_score: int  # from SeverityWeight
+    message: str
+
+
+class SiteCheckResultDict(TypedDict):
+    """Represents the response for a site check."""
+
+    url: str
+    check_results: list[CheckResponseDict]
+
+
+def rich_output(check_results: SiteCheckResult) -> None:
+    """Display results using Rich."""
+    console = Console()
+
+    table = Table(title=f"DJ Checkup Results for {check_results.url}", show_lines=True)
+
+    table.add_column("Check", justify="left")
+    table.add_column("Result", justify="left")
+    table.add_column("Message", justify="left")
+
+    for result in check_results.check_results:
+        emoji = ""
+        if result.result == CheckResult.SUCCESS:
+            emoji = "🟢 "
+
+        if result.result == CheckResult.FAILURE:
+            emoji = "🔴 "
+
+        if result.result == CheckResult.SKIPPED:
+            emoji = "🟡 "
+
+        display_result = emoji + result.result.value.capitalize()
+        table.add_row(result.name, display_result, Markdown(result.message))
+
+    console.print(Panel(table))
+
+
+type JSONValue = str | int | Mapping[str, "JSONValue"] | Sequence["JSONValue"]
+
+
+def normalize_for_json(obj: JSONValue) -> JSONValue:
+    """Recursively convert a dict with Enums to a json-serialisable dict.
+
+    This is used to convert the SiteCheckResult object to one that can be converted directly to JSON.
+    """
+    # dict-like objects
+    if isinstance(obj, Mapping):
+        return {k: normalize_for_json(v) for k, v in obj.items()}
+
+    # list-like objects
+    if isinstance(obj, Sequence) and not isinstance(obj, (str, bytes, bytearray)):
+        return [normalize_for_json(v) for v in obj]
+
+    # Enums, e.g. SeverityWeight and CheckResult
+    if isinstance(obj, Enum):
+        return obj.value
+
+    if isinstance(obj, (str, int)):
+        return obj
+
+    # The following code should never be reached
+    msg = f"Unexpected type: {type(obj)}"  # pragma: no cover
+    raise TypeError(msg)  # pragma: no cover
+
+
+def sitecheck_as_dict(site_result: SiteCheckResult) -> SiteCheckResultDict:
+    """Convert SiteCheckResult into JSON-serialisable dict."""
+    return normalize_for_json(asdict(site_result))  # type: ignore  # noqa: PGH003
+
+
+def sitecheck_as_json(site_result: SiteCheckResult) -> str:
+    """Convert SiteCheckResult into JSON string."""
+    data = sitecheck_as_dict(site_result)
+    return json.dumps(data)

{djcheckup-0.2.6 → djcheckup-0.4.0}/src/djcheckup/run.py

@@ -5,8 +5,8 @@ from typing import Literal, overload
 import httpx
 
 from djcheckup.check_defs import all_checks
-from djcheckup.checks import SiteChecker, SiteCheckResult
-from djcheckup.outputs import output_results_as_json
+from djcheckup.checks import SiteChecker
+from djcheckup.outputs import SiteCheckResultDict, sitecheck_as_dict, sitecheck_as_json
 
 
 @overload
@@ -14,7 +14,7 @@ def run_checks(
     url: str,
     output_format: Literal["object"] = "object",
     client: httpx.Client | None = None,
-) -> SiteCheckResult: ...
+) -> SiteCheckResultDict: ...
 @overload
 def run_checks(url: str, output_format: Literal["json"], client: httpx.Client | None = None) -> str: ...
 
@@ -23,7 +23,7 @@ def run_checks(
     url: str,
     output_format: Literal["object", "json"] = "object",
     client: httpx.Client | None = None,
-) -> str | SiteCheckResult:
+) -> str | SiteCheckResultDict:
     """Run the DJ Checkup tool.
 
     Args:
@@ -42,7 +42,7 @@ def run_checks(
         raise ValueError(msg)
 
     if output_format == "json":
-        return output_results_as_json(results)
+        return sitecheck_as_json(results)
 
     # Default to object output
-    return results
+    return sitecheck_as_dict(results)

djcheckup-0.2.6/src/djcheckup/__init__.py

@@ -1,5 +0,0 @@
-"""DJ Checkup CLI package."""
-
-from djcheckup.run import run_checks
-
-__all__ = ["run_checks"]

djcheckup-0.2.6/src/djcheckup/outputs.py

@@ -1,56 +0,0 @@
-"""Output formats for the site check results."""
-
-import json
-from dataclasses import asdict
-
-from rich.console import Console
-from rich.markdown import Markdown
-from rich.panel import Panel
-from rich.table import Table
-
-from djcheckup.checks import CheckResult, SeverityWeight, SiteCheckResult
-
-
-def rich_output(check_results: SiteCheckResult) -> None:
-    """Display results using Rich."""
-    console = Console()
-
-    table = Table(title=f"DJ Checkup Results for {check_results.url}", show_lines=True)
-
-    table.add_column("Check", justify="left")
-    table.add_column("Result", justify="left")
-    table.add_column("Message", justify="left")
-
-    for result in check_results.check_results:
-        emoji = ""
-        if result.result == CheckResult.SUCCESS:
-            emoji = "🟢 "
-
-        if result.result == CheckResult.FAILURE:
-            emoji = "🔴 "
-
-        if result.result == CheckResult.SKIPPED:
-            emoji = "🟡 "
-
-        display_result = emoji + result.result.value.capitalize()
-        table.add_row(result.name, display_result, Markdown(result.message))
-
-    console.print(Panel(table))
-
-
-def json_encoder(obj: object) -> str | int:
-    """Custom JSON encoder for non-serialisable types."""
-    if isinstance(obj, SeverityWeight):
-        return obj.value
-
-    if isinstance(obj, CheckResult):
-        return obj.value
-
-    # The following should never happen since this encoder is only used for SeverityWeight and CheckResult
-    msg = f"Object of type {type(obj).__name__} is not JSON serialisable"  # pragma: no cover
-    raise TypeError(msg)  # pragma: no cover
-
-
-def output_results_as_json(results: SiteCheckResult) -> str:
-    """Convert the results to JSON format."""
-    return json.dumps(asdict(results), default=json_encoder)