frapast 0.1.0__py3-none-any.whl

frapast-0.1.0.dist-info/METADATA

@@ -0,0 +1,402 @@
+Metadata-Version: 2.4
+Name: frapast
+Version: 0.1.0
+Summary: Runtime-Proven Static Security Analysis Engine for Frappe and ERPNext
+Author-email: Pratheep S <pratheeps2024@gmail.com>
+License-Expression: MIT
+Project-URL: Homepage, https://github.com/pratheep-bit/frapast
+Project-URL: Repository, https://github.com/pratheep-bit/frapast
+Project-URL: Issues, https://github.com/pratheep-bit/frapast/issues
+Project-URL: Security, https://github.com/pratheep-bit/frapast/security/advisories
+Project-URL: Changelog, https://github.com/pratheep-bit/frapast/releases
+Keywords: frappe,erpnext,security,sast,static-analysis,vulnerability-scanner
+Classifier: Development Status :: 3 - Alpha
+Classifier: Intended Audience :: Developers
+Classifier: Topic :: Security
+Classifier: Topic :: Software Development :: Quality Assurance
+Classifier: Programming Language :: Python :: 3
+Classifier: Programming Language :: Python :: 3.10
+Classifier: Programming Language :: Python :: 3.11
+Classifier: Programming Language :: Python :: 3.12
+Classifier: Programming Language :: Python :: 3.13
+Classifier: Operating System :: OS Independent
+Requires-Python: >=3.10
+Description-Content-Type: text/markdown
+License-File: LICENSE
+Requires-Dist: pyyaml>=6.0
+Requires-Dist: rich>=13.0.0
+Requires-Dist: libcst>=1.0.0
+Requires-Dist: tomli>=2.0.0; python_version < "3.11"
+Provides-Extra: shell
+Requires-Dist: prompt_toolkit>=3.0; extra == "shell"
+Provides-Extra: dev
+Requires-Dist: pytest>=7.0; extra == "dev"
+Requires-Dist: pytest-cov>=4.0; extra == "dev"
+Requires-Dist: ruff>=0.1.0; extra == "dev"
+Requires-Dist: build>=1.0.0; extra == "dev"
+Requires-Dist: pip-audit>=2.7.0; extra == "dev"
+Requires-Dist: libcst>=1.0.0; extra == "dev"
+Dynamic: license-file
+
+<div align="center">
+
+<picture>
+  <source media="(prefers-color-scheme: dark)" srcset="scanner/web/static/logo.svg">
+  <img src="scanner/web/static/logo-light.svg" alt="frapAST Logo" width="96" height="96">
+</picture>
+
+# frapAST
+
+### Runtime-Proven Static Security and Performance Engine for Frappe and ERPNext
+
+[![PyPI version](https://img.shields.io/badge/pypi-v0.1.0-blue.svg)](https://pypi.org/project/frapast/)
+[![License: MIT](https://img.shields.io/badge/License-MIT-blue.svg)](LICENSE)
+[![Python 3.10+](https://img.shields.io/badge/python-3.10+-blue.svg)](https://www.python.org/downloads/)
+[![Tests](https://img.shields.io/badge/tests-287%20passed-green.svg)](#test-suite-and-quality-assurance)
+[![Rules](https://img.shields.io/badge/detectors-28%20active-blue.svg)](#rule-taxonomy)
+[![Benchmark Speed](https://img.shields.io/badge/speed-16%2C700%2B%20files%2Fsec-green.svg)](#industry-benchmarks-and-performance)
+[![Privacy](https://img.shields.io/badge/privacy-100%25%20Local%20and%20Airgapped-blue.svg)](#data-privacy-and-air-gapped-execution)
+
+Find the vulnerability. Synthesize the reproducer. Prove it live. Ship the autofix.
+
+[Quickstart](#quickstart) | [Industry Benchmarks](#industry-benchmarks-and-performance) | [Architecture Comparison](#architectural-comparison) | [Developer Experience](#developer-experience-dx) | [Rule Taxonomy](#rule-taxonomy) | [Engine Architecture](#how-it-works) | [Web Dashboard](#interactive-web-dashboard)
+
+</div>
+
+---
+
+## Overview
+
+Generic SAST tools analyze Frappe applications as generic Python scripts. Consequently, they fail to recognize that `@frappe.whitelist()` exposes a public HTTP endpoint, cannot resolve dynamic DocType schema permissions, miss string-literal dispatches such as `frappe.call("dotted.path")`, and generate significant false-positive noise.
+
+frapAST is designed from the Frappe framework layer outward. It indexes DocType JSON schemas, parses `hooks.py`, walks module AST structures, and constructs an interprocedural static call graph modeling direct calls, string-based RPC dispatches, lifecycle hooks, dynamic document methods, and report execution entry points.
+
+Candidate findings are scored across a multi-dimensional risk matrix and can be escalated through an Active Two-Tier Proof Engine that synthesizes standalone HTTP/RPC reproducers to verify exploitability against a running Frappe bench.
+
+---
+
+## Industry Benchmarks and Performance
+
+Evaluated against open-source enterprise Frappe codebases on macOS (Apple Silicon) and Linux (x86_64) using Python 3.10 through 3.14:
+
+### 1. Throughput and Scalability
+| Target Repository | Total Files | Code Volume | Scan Time | Indexing Throughput | Active Candidates |
+|---|:---:|:---:|:---:|:---:|:---:|
+| Synthetic Scale Corpus | 5,000 files | ~250,000 LOC | 0.30s | 16,728 files/sec | 0 |
+| Frappe HRMS (`hrms`) | 670 files | ~155,000 LOC | 0.95s | 705 files/sec | 150 |
+| ERPNext Core (`erpnext`) | 3,842 files | ~980,000 LOC | 5.82s | 660 files/sec | 684 |
+
+### 2. Empirical Detection Precision (Audited on Frappe HRMS)
+| Rule Family | Detection Target | Verified TP | Audited Precision | Ground-Truth Outcome |
+|---|---|:---:|:---:|---|
+| `FR-PERM-001` | Mutating whitelisted RPC lacking permission checks | 19 / 19 | 100.0% | Identified unauthenticated write operations (mutating tier) |
+| `FR-HOOK-001` | Controller `on_submit` without `on_cancel` | 6 / 7 | 85.7% | Identified uncancelled ledger and allocation records |
+| `FR-HOOK-004` | Un-deduplicated `frappe.enqueue()` background jobs | 11 / 11 | 100.0% | Prevented duplicate background job queue storms |
+| `FR-HOOK-006` | Bare `except:` statements swallowing framework signals | 3 / 3 | 100.0% | Prevented silent database transaction aborts in patches |
+| `FR-DATA-001` | Non-existent DocType schema field access | 3 / 3 | 100.0% | Identified invalid field references in controllers |
+| `FR-WKFL-003` | DocType `status` mutation without `docstatus` update | 4 / 4 | 100.0% | Identified state synchronization desyncs on submittables |
+| `FR-INJ-001` | Single-dict parameter injection into `frappe.get_doc` | 5 / 5 | 100.0% | Identified mass-assignment risks in batch endpoints |
+| `FR-PERF-001` | Database queries inside loops (N+1 query pattern) | 10 / 10 | 100.0% | Sampled batch loop database bottlenecks ($n=10$, seed=42) |
+| `FR-PATH-001` | User-controlled file path traversal | Synthetic | Verified | Validated against synthetic `TALOS-2020-1091` reproductions |
+| `FR-SQLI-001` | Script Report multi-hop dynamic SQL injection | Synthetic | Verified | Validated against synthetic `GHSA-745c-5q8r-vgj2` reproductions |
+
+---
+
+## Live-Bench Active Verification Case Study
+
+frapAST includes live integration testing against local and staging Frappe benches. The Tier 2 proof engine generates and executes direct HTTP RPC reproducers to verify whether a static candidate is exploitable over the wire:
+
+* **Unprotected RPC Endpoint (`frappe.client.get_time_zone`)**:
+  ```text
+  GET /api/method/frappe.client.get_time_zone HTTP/1.1 -> HTTP 200 OK
+  {"message":{"time_zone":"Asia/Kolkata"}}
+  [PROVEN]: Endpoint permits unauthenticated guest execution.
+  ```
+
+* **Protected RPC Endpoint (`frappe.auth.get_logged_user`)**:
+  ```text
+  GET /api/method/frappe.auth.get_logged_user HTTP/1.1 -> HTTP 403 Forbidden
+  {"exc_type":"PermissionError","message":"You are not permitted to access this resource"}
+  [REFUTED]: Endpoint enforces authentication guard.
+  ```
+
+---
+
+## Architectural Comparison
+
+| Capability | Generic SAST (Bandit / SonarQube) | Cloud Static Scanners | frapAST |
+|---|:---:|:---:|:---:|
+| Frappe Framework Modeling | None (generic Python only) | Partial regex matching | Full (DocType JSONs, `hooks.py`, ORM, DocEvents, Reports) |
+| Active Proof Verification | None (static alerts only) | None (static alerts only) | Two-Tier Active Proof (synthesizes live HTTP reproducers) |
+| Data Privacy and Sovereignty | Depends on deployment | Source code sent to third-party cloud | 100% Local and Air-Gapped (runs on localhost, zero data egress) |
+| Automated Remediation | None | Manual refactoring | CLI AST Autofix (`frapast fix` with diff previews) |
+| Native Bench Integration | None | None | Native `bench frapast` CLI command group |
+| CI/CD Pipeline Support | Generic exit codes | Proprietary webhooks | OASIS SARIF 2.1.0 and Reusable GitHub Composite Action |
+| Indexing Speed | 100-300 files/sec | Queue-dependent | 16,700+ files/sec (sub-second local execution) |
+
+---
+
+## Data Privacy and Air-Gapped Execution
+
+frapAST is engineered with strict data confidentiality:
+
+1. **Zero Data Egress**: All parsing, AST traversal, call graph generation, and proof execution run locally on `127.0.0.1`. No telemetry or source code is transmitted externally.
+2. **Confidentiality by Design**: No company names, client data, or proprietary identifiers are stored or required. All references in reports adhere strictly to open-source repository paths.
+3. **Local Origin Gating**: The web dashboard is bound exclusively to localhost and enforces origin headers against unauthorized cross-origin requests.
+
+---
+
+## Quickstart
+
+### Installation
+
+```bash
+# Install via pip
+pip install frapast
+
+# Or install in editable mode for development
+pip install -e .
+```
+
+### 1. Launch the Visual Dashboard
+```bash
+frapast
+# Automatically starts local server and opens http://localhost:7777
+```
+
+### 2. Run a CLI Security and Performance Audit
+```bash
+# Perform static scan
+frapast scan /path/to/frappe-app
+
+# Perform scan with active bench verification
+frapast scan /path/to/frappe-app --prove --bench-url http://localhost:8000
+
+# Export SARIF 2.1.0 for GitHub Code Scanning
+frapast scan /path/to/frappe-app --format sarif > results.sarif
+```
+
+### 3. Apply Automated Fixes via CLI
+> **Note**: Automated code remediation is provided via the command-line interface (`frapast fix`) and the Python library. It is intentionally decoupled from the web dashboard REST API.
+
+```bash
+# Preview AST modifications as unified diffs (dry-run)
+frapast fix /path/to/frappe-app
+
+# Apply modifications directly to source files
+frapast fix /path/to/frappe-app --apply
+```
+
+---
+
+## Developer Experience (DX)
+
+### 1. Native Frappe Bench CLI (`bench frapast`)
+frapAST registers directly into Frappe's native `bench` CLI:
+
+```bash
+# Run security and performance audit on an app
+bench frapast audit my_custom_app
+
+# Apply automated security patches
+bench frapast fix my_custom_app --apply
+
+# Verify live HTTP exploitability on an active bench site
+bench frapast prove my_custom_app --site dev.local
+
+# Diagnose bench connectivity and port availability
+bench frapast check --port 8000
+```
+
+### 2. Reusable GitHub Action
+Add `.github/workflows/frapast.yml` to your repository for automated PR security checks and SARIF code scanning annotations:
+
+```yaml
+name: frapAST Security Audit
+
+on:
+  push:
+    branches: [ main, develop ]
+  pull_request:
+    branches: [ main, develop ]
+
+jobs:
+  security-audit:
+    runs-on: ubuntu-latest
+    steps:
+      - uses: actions/checkout@v4
+
+      - name: Run frapAST Audit
+        uses: pratheep-bit/frapast@main
+        with:
+          repo-path: '.'
+          fail-on: 'critical'
+          upload-sarif: 'true'
+```
+
+### 3. Automated Autofix Engine (`frapast fix`)
+Automated AST patch generation handles routine security boilerplate:
+- `FR-HOOK-001`: Automatically generates symmetrical `on_cancel(self)` methods for DocTypes implementing `on_submit`.
+- `FR-HOOK-004`: Injects `deduplicate=True` into `frappe.enqueue()` calls.
+- `FR-HOOK-006`: Replaces bare `except:` blocks with `except Exception:` to preserve framework execution signals.
+- `FR-PERM-001`: Injects `frappe.only_for("System Manager")` permission checks into unguarded mutating endpoints.
+
+---
+
+## Rule Taxonomy
+
+frapAST includes 28 active rule detectors and 2 explicitly disabled rules across core security and operational areas:
+
+```
+Proof Basis:
+  Tier 2 : Live HTTP/RPC verification against a running Frappe bench
+  Tier 1 : Standalone local AST reproducer (independent of bench)
+  Static : Structural code pattern and dataflow verification
+```
+
+### Injection and Access Control
+| Rule ID | Severity | Description | Proof Basis | Status |
+|---|:---:|---|:---:|:---:|
+| `FR-SQLI-001` | Critical | Dynamic `frappe.db.sql()` query with f-string or string concatenation lacking parameter bindings | Tier 2 | Validated (Synthetic GHSA-745c-5q8r-vgj2) |
+| `FR-SQLI-002` | Critical | Raw SQL query referencing a submittable DocType table without a `docstatus` filter | Static | Validated |
+| `FR-SQLI-003` | High | `frappe.db.set_value` invoked from whitelisted RPC bypassing controller `validate()` and `before_save()` hooks | Tier 2 | Validated |
+| `FR-SQLI-004` | High | `frappe.qb.DocType()` or `frappe.qb.from_()` using request-controlled dynamic table identifiers | Tier 2 | Validated |
+| `FR-INJ-001` | Critical | Request parameters unpacked directly into `frappe.get_doc(kwargs)` (mass assignment risk) | Tier 2 | Validated |
+| `FR-INJ-002` | Critical | `eval()` or `exec()` called with request-controlled input reachable from whitelisted RPC | Tier 2 | Validated |
+| `FR-INJ-005` | Disabled | `frappe.msgprint()` or `frappe.throw()` format strings | Static | Disabled (requires interprocedural taint analysis) |
+| `FR-PATH-001` | High | User-controlled file path passed to file I/O operations without directory containment checks | Tier 2 | Validated (Synthetic TALOS-2020-1091) |
+| `FR-SSRF-001` | High | User-controlled URL passed to outbound HTTP requests (`requests.get`, `urlopen`) with no allowlist | Tier 2 | Validated |
+| `FR-CSRF-001` | High | Guest-accessible (`allow_guest=True`) endpoint performing state-changing database modifications | Tier 2 | Validated |
+
+### Authorization and Permission Enforcement
+| Rule ID | Severity | Description | Proof Basis | Status |
+|---|:---:|---|:---:|:---:|
+| `FR-PERM-001` | High / Critical | `@frappe.whitelist()` endpoint lacking explicit permission validation (`has_permission`, `only_for`) | Tier 2 | Validated (100% on Mutating Tier) |
+| `FR-PERM-002` | High | `ignore_permissions=True` reachable within one hop of an unguarded public whitelisted endpoint | Tier 2 | Validated |
+| `FR-PERM-003` | High | `frappe.db.set_value` on an `if_owner`-scoped DocType bypassing owner permission enforcement | Tier 2 | Validated |
+| `FR-PERM-004` | Medium | Report query bypassing DocType `permission_query_conditions` hooks | Static | Validated |
+| `FR-PERM-005` | Medium | Internal SQL query bypassing DocType `has_permission` row-level security hooks | Static | Validated |
+| `FR-PERM-006` | High | `frappe.db.set_value` on a child table DocType (`istable=1`) leaving parent document totals uncalculated | Static | Validated |
+
+### Framework Lifecycle and Workflow Integrity
+| Rule ID | Severity | Description | Proof Basis | Status |
+|---|:---:|---|:---:|:---:|
+| `FR-HOOK-001` | Medium | Controller class defines `on_submit` but not `on_cancel` (missing reversal logic) | Tier 1 | Validated |
+| `FR-HOOK-002` | Medium | Multiple applications registering conflicting handlers on the same `(doctype, event)` hook | Static | Validated |
+| `FR-HOOK-003` | Medium | Whitelisted fast-path writing fields directly without validating lifecycle state transitions | Static | Validated |
+| `FR-HOOK-004` | Medium | `frappe.enqueue()` invoked without deduplication keys, risking duplicate queue execution | Tier 1 | Validated |
+| `FR-HOOK-005` | Low | `frappe.db.commit()` called within a lifecycle hook, breaking atomic transaction rollbacks | Tier 1 | Validated |
+| `FR-WKFL-001` | Medium | `frappe.db.set_value` on submittable DocType without validating document draft status (`docstatus == 0`) | Static | Validated |
+| `FR-WKFL-002` | Medium | Direct database write to `workflow_state` bypassing the Frappe workflow transition engine | Static | Validated |
+| `FR-WKFL-003` | Medium | `status` updated without updating `docstatus` on submittable DocTypes | Tier 1 | Validated |
+| `FR-WKFL-004` | Disabled | Amendment chain field leakage | Static | Disabled (natively handled by Frappe `no_copy=1`) |
+
+### Performance, Correctness and Reliability
+| Rule ID | Severity | Description | Proof Basis | Status |
+|---|:---:|---|:---:|:---:|
+| `FR-PERF-001` | Low | `frappe.get_doc()` called inside a loop over query results (N+1 query bottleneck) | Tier 1 | Validated |
+| `FR-HOOK-006` | Low | Bare `except:` block swallowing framework execution signals and exceptions | Tier 1 | Validated |
+| `FR-HOOK-007` | Low | Mutable default argument (`[]`, `{}`) in function definition signature | Tier 1 | Validated |
+| `FR-DATA-001` | Low | DocType field reference accessing a non-existent schema fieldname | Tier 1 | Validated |
+| `FR-DATA-002` | Low | Missing `db.commit()` after asynchronous background processing state writes | Tier 1 | Validated |
+| `FR-DATA-003` | Low | Raw database delete on parent document leaving orphan child table rows | Static | Validated |
+| `FR-I18N-001` | Low | Hardcoded user-facing message string in `msgprint` or `throw` without `frappe._()` | Tier 1 | Validated |
+
+---
+
+## How It Works
+
+```
++-----------------+   +-----------------+   +-----------------+
+|  Schema Index   |   |   Hook Index    |   |  Python AST     |
+|  (DocType JSON) |   |  (hooks.py AST) |   |  (Source Files) |
++--------+--------+   +--------+--------+   +--------+--------+
+         |                     |                     |
+         +---------------------+---------------------+
+                               |
+                      +--------v--------+
+                      |   Call Graph    |  5 Edge Types:
+                      |                 |  - direct_call
+                      |                 |  - string_dispatch (frappe.call)
+                      |                 |  - hook_dispatch (doc_events)
+                      |                 |  - dynamic_method (get_doc.method)
+                      |                 |  - report_entry (report.execute)
+                      +--------+--------+
+                               |
+                      +--------v--------+
+                      |   Rule Engine   |  28 Active Detectors
+                      +--------+--------+
+                               |
+                      +--------v--------+
+                      | Severity Matrix |  Multi-Dimensional Composite Scoring
+                      +--------+--------+
+                               |
+            +------------------+------------------+
+            |                                     |
+   +--------v-------+                    +--------v-------+
+   |  CLI / SARIF   |                    | Web Dashboard  |
+   +--------+-------+                    +--------+-------+
+            |                                     |
+            +------------------+------------------+
+                               |
+                      +--------v--------+
+                      |  Proof Engine   |  Tier 0 (Static) -> Tier 1 (AST) -> Tier 2 (HTTP/RPC)
+                      +--------+--------+
+                               |
+                      +--------v--------+
+                      | Autofix Engine  |  CLI AST Code Patch Generator and Diff Viewer
+                      +-----------------+
+```
+
+1. **Schema and Hook Indexing**: Parses all DocType JSON definitions (`fields`, `permissions`, `is_submittable`, `istable`) and `hooks.py` dispatch trees.
+2. **AST Parsing and Call Graph Construction**: Analyzes AST structures to extract whitelisted endpoints, database calls, parameters, string-literal dispatches (`frappe.call("dotted.path")`), and script report entry points (`execute(filters)`).
+3. **Composite Severity Matrix**: Computes severity using required privileges (guest vs authenticated user), impact classification, and blast radius.
+4. **Active Proof Verification**:
+   - **Tier 1 (AST Proof)**: Standalone verification programs executed locally.
+   - **Tier 2 (HTTP/RPC Proof)**: Authenticated HTTP requests executed by `FrappeHTTPClient` against a Frappe bench.
+5. **Autofix Engine**: Automatically generates and applies AST modifications via the CLI to eliminate manual boilerplate updates.
+
+---
+
+## Interactive Web Dashboard
+
+Launch the local web dashboard:
+```bash
+frapast
+```
+
+Features provided in the web interface:
+- **Real-Time Scan Streaming**: Server-Sent Events (SSE) update the dashboard as files are processed.
+- **Visual Proof Drawer**: Inspect synthesized reproducers and view live verification outcomes.
+- **Bench Connectivity Diagnostics**: Test connection to local Frappe bench instances with diagnostic reporting.
+- **Persistent Storage**: SQLite with WAL mode preserves scan and proof history across application restarts.
+
+---
+
+## Test Suite and Quality Assurance
+
+The codebase includes an automated test suite:
+
+```bash
+pytest -v
+```
+
+- **287 passed tests** covering AST visitors, call graph resolution, rule detectors, server security, reproducer synthesis, adversarial suppression handling, and autofix patches.
+- **Security hardening**: Hardened shell script generation (`shlex.quote`), path traversal directory containment, and localhost origin gating.
+
+---
+
+## Contributing
+
+Contributions are welcome. To report an architectural pattern or false-positive edge case:
+
+1. Fork the repository
+2. Create your feature branch (`git checkout -b feature/new-rule`)
+3. Run tests (`pytest`)
+4. Commit your changes and submit a Pull Request
+
+---
+
+## License
+
+MIT (c) 2026 Frappe Security Scanner Contributors - see [LICENSE](LICENSE).

frapast-0.1.0.dist-info/RECORD

@@ -0,0 +1,141 @@
+frapast-0.1.0.dist-info/licenses/LICENSE,sha256=EZ122ZWAhHmbYLthqzf6pdhYCKOBTlLQGg2uengKzT0,1093
+scanner/__init__.py,sha256=wG2fR912n3vnMJCJjAwZohmGSDtWnq6A11ZdUtslR94,480
+scanner/__main__.py,sha256=1VjVH6HhgkNukO0F7tkM5YrWFEA3MZOZ1iFHi9TFm0o,154
+scanner/bench_commands.py,sha256=4B3RpL7Ggg7RpgXseAPKJtsxBTUkDcZPDqYroRLxB5Y,3138
+scanner/cli.py,sha256=NZjaJmjTTHc4Fr0trA9eEJokfjnsBGh33XjgEKYTRa8,46557
+scanner/config.py,sha256=wv69UhgAMeFV00ML_Tkn2gYSiL0U2q479CQSnux05as,1945
+scanner/fp_analyzer.py,sha256=6tFXheWBfG29BLK0dZUxBWQPHf6x1J94AWc-LbG49Fs,2398
+scanner/ledger_io.py,sha256=1RYpWk-qWBm_Whzu3HujbAlVG-H75_-6UP7t38LPnOc,6554
+scanner/ledger_schema.py,sha256=2o6PoXq91_aWf0YvvRzBblug6JEin38VIuKYgMLSdVA,1284
+scanner/logger.py,sha256=PS-n_9cob3XdFIy3dW1AXRKVCXB5aq3i73LguyEzU-M,618
+scanner/suppression.py,sha256=_Y13D7EdkxqmRuJIfY37VfXk8TNA33WtmITBMUQZlEk,9561
+scanner/validate_ledger.py,sha256=jLBqbzuhmVwfdHOxvyz6shRQhy5knrQ3buApW0BcQTc,975
+scanner/validate_taxonomy.py,sha256=6i51KkTXCXkKp4M4deMUYmFRps7WOjMxsXxz42TFs7k,2799
+scanner/verify_ledger_integrity.py,sha256=nKnqUaC8BsLU5bc-Q6nNlyAwe8-IF9ofpR2c_oz5Jw4,2006
+scanner/autofix/__init__.py,sha256=FszLp1CINiPSyI75R6VSIDRgGyfIlJP17IVZ-B-jsLI,157
+scanner/autofix/engine.py,sha256=86UfhNYMohR6YV0SqAd8drcqR4y-Ndo2iojgp8gIUz0,11133
+scanner/autofix/models.py,sha256=aEBE96PXkXKWq2VjlKPXA3oVGOKYrPvObchUMO2HcGQ,468
+scanner/callgraph/__init__.py,sha256=saN1uW6CFpp5KOIh3mYtoTfG9rl_dfD5DzFo5y63ZPw,191
+scanner/callgraph/builder.py,sha256=afHjsZysJwrvPxHYCuEbBYz0yEEaXZWpn7DxVgKbsJc,5617
+scanner/callgraph/models.py,sha256=LKTAKxtehxhymoJIFifdb03nKCoLPVRoa0SNPj3gAUk,2492
+scanner/fp/__init__.py,sha256=nUTZw9Z6Y67Evow5Uwr9uZPP3-I02gK5qp8CDSofGos,331
+scanner/fp/engine.py,sha256=a2ZEQGGOsLrgwAjL-JP04awg7S2lhvBBZzhXTT4Mbug,3511
+scanner/fp/models.py,sha256=7GAoWBS-jLyEL1tGJ9a-7aVWrNxYUXi6Gj4zPuLt_Fc,514
+scanner/hooks/__init__.py,sha256=sZ_UXsY3ni4k3swMFszGdTj43jjCEQuuXGVjShvlze8,326
+scanner/hooks/engine.py,sha256=S9H3cPzZEJvt5KYxAD_mWszMWXVrJuREaQJg_isAh8Q,3884
+scanner/hooks/models.py,sha256=S6gPhQeLGwiwEyK6XXpPSuuD_RGSyxhOoATjrw37jTk,1560
+scanner/proof/__init__.py,sha256=GnyNLMopiH-6LGWJGyGMTP8vWZP5PE8VhhyQl3HWh1k,531
+scanner/proof/bench_runner.py,sha256=mqod21dxLIjQsFMykm-g64fDQ-7R_PUNa7Iyeeldjk0,23807
+scanner/proof/http_client.py,sha256=YCLP9b5FJPNCRAJ70IU21JhKmirGGQ2Y48YV_WEPWZY,13032
+scanner/proof/http_synthesis.py,sha256=blwhd9BE-rmJTRuU0iTjlISNJIVYc4qFtK0du0dqN8s,26203
+scanner/proof/models.py,sha256=HnkJp8UqoW5SHaEfmIMQrCEISJxgWVNEBJ98mAisT6Q,661
+scanner/proof/orchestrator.py,sha256=jDzy6U1WHfkAgE8ZyWG-2akryFX4dgdPY5GG5jPH_qA,29919
+scanner/proof/validate_reproducer_markers.py,sha256=fIZoWZ0uCtve623gfpE7Tz5YhBUyYf9n-DHm6FvGaN8,3792
+scanner/python/__init__.py,sha256=aczlaB_mP7-Oefsavt_-C8H1MW-WKFdGb_LyA21NyUE,875
+scanner/python/engine.py,sha256=0EhEMTHqQNfIHQo-PqGL8NdqkCmlfqi2O8KjeIF7IXU,47296
+scanner/python/models.py,sha256=Xy7Q1DEfVc4zxzCCOKTPpL94w49pd-B9jwvP0TTfbT4,6411
+scanner/regression/__init__.py,sha256=m-rhcdBlv3g4lvqiwuQdivMlUfYSPM9b7BWQCSQmTXQ,240
+scanner/regression/generator.py,sha256=NXJfq26HPFKtd_eZpqV74d7rlStdQPTIClSIiLJq9Ak,3692
+scanner/reporting/__init__.py,sha256=K82WGCTVneKzIXwDYHtvUwaEPxrdTa1n1RPD7O26VmU,92
+scanner/reporting/engine.py,sha256=tjER7tM7TwCGUaIvAzLSi6bQQLCLE48CweiphjlLrVU,4938
+scanner/reporting/formatters.py,sha256=KMM8YNw9rTZcfBTBcSfrDpT8d-udPuYtF9Fi5nEAJZ0,153
+scanner/reporting/sarif.py,sha256=Iu2PfpmpnK8KEtLokzBumOU2ugx6gNDYTjUO4pcsSZ8,2123
+scanner/rules/FR-CORR-001.yaml,sha256=IZMbAo-kygIqaDdX0hGvCDuXKHre-JBPIU8u5REv9NY,270
+scanner/rules/FR-CORR-002.yaml,sha256=oiyVgf4stg_2-dHA23Zcbg6zcP9BTBZ-veiGn3sMe-s,260
+scanner/rules/FR-CSRF-001.yaml,sha256=O8V5OGaDu0YWp5Ba8cJAU1GLkS9_UW8XSFuIeq3O0Zs,517
+scanner/rules/FR-DATA-001.yaml,sha256=tjVIvgdxOGlGh972qgGcxBLpjQzy4zkJIEtisZjFdmo,278
+scanner/rules/FR-HOOK-001.yaml,sha256=P4g1KylupXfHN8fHybegwlz5f9mR4gYKsLGePgNSafw,308
+scanner/rules/FR-HOOK-002.yaml,sha256=4w0KNxypZ8Z9OBFyAjMESqJ1zcOW3pAE5g9Xum7LFz8,285
+scanner/rules/FR-HOOK-003.yaml,sha256=nF-A0PHp6M1CzS7GMHu4jydYBh2mybr5EeOVWDftOlk,340
+scanner/rules/FR-HOOK-004.yaml,sha256=nknVcDIwEj3M7sFkXIfnB1FlQIZbmGcFOqEwTuJ0nVI,300
+scanner/rules/FR-HOOK-005.yaml,sha256=t_wTzznX3BrhWzQosK85O5wXlvk7r4zk5HNgs6xn9EA,307
+scanner/rules/FR-HOOK-006.yaml,sha256=DyWIJKfRk0s03QIajQ7vBt8dmnhVxnew6jGfpa-rhfM,270
+scanner/rules/FR-HOOK-007.yaml,sha256=R8rTW4hCTctzqSzsSL1_3VpE6QnGc0P8n-00J3-mj38,260
+scanner/rules/FR-I18N-001.yaml,sha256=5_5GLeEQP5OzYnUNInHCN2CGF65YEfnd4ITQ0cZGvWY,297
+scanner/rules/FR-INJ-001.yaml,sha256=1uWXLBVLxeaazGIQGbRSNE7-cJfw4XLo2VoJRC1u9sA,342
+scanner/rules/FR-INJ-002.yaml,sha256=lXQ6IH_iXVTMvIva0w5EOJ7-lW-y7ssPKs3mVblT9gM,342
+scanner/rules/FR-INJ-005.yaml,sha256=9wbhnTxA8puCYJcmVW6rpBWONWlTNRoqqnZ_tl1W6Tc,443
+scanner/rules/FR-PATH-001.yaml,sha256=CwZAKea4daa7hkA09xtT-lJvs0ZeWnAb6QaJ8Pq5DVM,402
+scanner/rules/FR-PERF-001.yaml,sha256=H1dgh9pt3oQAGhegrey_e2JUd03tGM6-xFjD6b0SKgU,284
+scanner/rules/FR-PERM-001.yaml,sha256=6iMELJtCHj_CAUWiNqYGQTL7bGKSrXpKbJJuEcU9QKs,340
+scanner/rules/FR-PERM-002.yaml,sha256=8kt3rfBzV63xUVqjROL6A9y-t0Ekng7hdvA8IKxSJyo,345
+scanner/rules/FR-PERM-003.yaml,sha256=5uTSpcjLVXA2HXnFMiGwlbnuSJK7FwKJx5QXGVz_LHI,335
+scanner/rules/FR-PERM-004.yaml,sha256=_ojgIqKmuEdS8D33V2KrWmg3E7ABT2y7Uzv0IyQzFl4,338
+scanner/rules/FR-PERM-005.yaml,sha256=DKHMszdCyYs25KMfW1toHcM4JPaUdrNjIip5aJukL3I,355
+scanner/rules/FR-PERM-006.yaml,sha256=Ffe7Hphkvg85owuUfCj9xRCZgCXGWUrSkDMRoZ9Igoo,339
+scanner/rules/FR-SQLI-001.yaml,sha256=gEdjvclHIzkbWexv4kRPC6G-ju0NWIUax8nIsN6WgYM,295
+scanner/rules/FR-SQLI-002.yaml,sha256=T58NGHfwkedL0I0NE_ZbhiX8_94G0EGsIinvSlYsPvY,334
+scanner/rules/FR-SQLI-003.yaml,sha256=JK0RN9gPEdxR--fhiMt7E448bDJ-sFegIvFwZv7IsU4,348
+scanner/rules/FR-SQLI-004.yaml,sha256=ahEjp9lD9Ws2GgeJ985ip7I-l1sx5Z-UdO2BmouTuT8,331
+scanner/rules/FR-SSRF-001.yaml,sha256=RQkJUgaV_ZApjmckcLRlGsAjBmS9C_nMl9YHcMGNzDA,429
+scanner/rules/FR-WKFL-001.yaml,sha256=VbuR-zmx8MHOcnhJHFFIcWWuwIoa2aeKWPro2RTgJGY,363
+scanner/rules/FR-WKFL-002.yaml,sha256=x3R0u5wC-eRyOsXvr4bAFsfudyMLWBf-ztKD4iadKm0,342
+scanner/rules/FR-WKFL-003.yaml,sha256=Rn9XKJ3zuLbvB1v58dOgjwYXhLIxbTZ2GNu-Zn6DrA0,306
+scanner/rules/FR-WKFL-004.yaml,sha256=fLxhtor3Z39TLRwrSGi2MJiG8wuvPIQhyLwC6j-_YMY,330
+scanner/rules/FR-XSS-001.yaml,sha256=_lRngJmMOT-uea1U2f54RM2fktF6lRPMKw552xAa-I8,443
+scanner/rules/__init__.py,sha256=SvKySOBVbPTN7l3CB9odAtSDt6HyDE6siQ8yK3cr0rA,164
+scanner/rules/engine.py,sha256=Z0NLDmfTPgCR-x9Bbp2Y8V-DTG_bQYOqmxXlwVLnsyc,47233
+scanner/rules/schema.yaml,sha256=qhqfBehZjCgkaQdFmxaTHhV4cSlulub-bX1obEDeim8,127
+scanner/schema/__init__.py,sha256=26gGVHyqmnrnGGWUJiIkP2uTAy6B0kUN8hG73FqoiZM,367
+scanner/schema/engine.py,sha256=JIsisBkuC7X-lf4_RrdY8A6jSeuUKTUeSafMXBwyJhE,4943
+scanner/schema/models.py,sha256=ldE_AUUEwoNTw0_gmMuTNew0dZTP0-2qEz1kEdhmj5w,2853
+scanner/severity/__init__.py,sha256=cVzTzbmi1xZI7g7B33zvMOvRUXR7D-5U9GRqdQksNYs,188
+scanner/severity/engine.py,sha256=mLbXIU8iDXbf9qE6NaxocIy0bw6jbIuBa4st1lu4uR4,7465
+scanner/severity/models.py,sha256=V_1Tc3zBAyOinpb6un2pNQMN7B30ckbOuArW3yaAiJA,685
+scanner/severity/taxonomy.py,sha256=5n9ZaR-4VElyhpzeNnd6Mh83dqeYsC98vHfkGLiZlj8,296
+scanner/shared/__init__.py,sha256=GEC3zaWczhz1J9wCxDsxIaHOCmWfMQzCBK8ud1uf2cA,126
+scanner/shared/records.py,sha256=P52uPlOt_kPd5aNHhEWjK931z8vPpl3rKolitJ0D8ik,580
+scanner/taxonomy/FR-DATA-001.yaml,sha256=HMWsoV4KtF5aUuclZWy0BQe07KBQxN0farQStTITstw,283
+scanner/taxonomy/FR-DATA-002.yaml,sha256=PGbwKf3_Vq4XXW8ry8i1HTlnqyvZOvuRmHosA224e9E,248
+scanner/taxonomy/FR-DATA-003.yaml,sha256=YalgCiKAukvDZ57XeKBOtmfcItj4LS85blXFiYWAqMU,243
+scanner/taxonomy/FR-HOOK-001.yaml,sha256=US-HBCVJS8SQxP3YF0NCRrxbLYuogFZ6d_Ms_VvFO5M,250
+scanner/taxonomy/FR-HOOK-002.yaml,sha256=s8KUagTXlbxJbekvXs8-rMyjqhNmTNi5O5aflh5jfaU,273
+scanner/taxonomy/FR-HOOK-003.yaml,sha256=M-iGlCyW8G1IULoI1klWl953VViXX0_bsFFGL9UBz_s,273
+scanner/taxonomy/FR-HOOK-004.yaml,sha256=IdSvkoTEmspo5bBPGITrS5XqiN8DB5ZR0XoaqoXc_2Y,275
+scanner/taxonomy/FR-HOOK-005.yaml,sha256=hnh9OHlJ_p7q177mX-I8yAiihEKMReIS9cblnIwBHWA,273
+scanner/taxonomy/FR-INJ-001.yaml,sha256=QY1LlNH3Y9PLZ-LwIxf0u4vdazOEvJi_bO-oIyQ5wWU,266
+scanner/taxonomy/FR-INJ-002.yaml,sha256=1GCTuZndQLxk8aPZDvw75tT5BSusPO2aZZ93GcudSUc,255
+scanner/taxonomy/FR-INJ-003.yaml,sha256=rEih6DiHS0yU5lGjlHlXmc5-_Ylfkl2iwkDHucJSCEc,240
+scanner/taxonomy/FR-INJ-004.yaml,sha256=jaSMirbUa2jv5sVr0Sd43Z7i_DOHFjXUU7BHFBZIDcA,269
+scanner/taxonomy/FR-PERM-001.yaml,sha256=XBKv7Ic-9TA6Kg6MsIgk5AqYAwt2xNiJEvg2QB5halk,362
+scanner/taxonomy/FR-PERM-002.yaml,sha256=qGYJnIuP4gOMJGsBNTLvoxA57wI1mG052-4s0kodq4M,307
+scanner/taxonomy/FR-PERM-003.yaml,sha256=QYEaD5cTwC141njnkrGDmJDlyjQPkJwF2wEFuu46Jlk,283
+scanner/taxonomy/FR-PERM-004.yaml,sha256=jX4WFUudQryffjQpry6KvEjVFJlw_0iRNVRDL6VfUGs,257
+scanner/taxonomy/FR-PERM-005.yaml,sha256=wsm6fcVkb5El8iZNuH3weca8MReB0WHp8cSUgmhHniA,252
+scanner/taxonomy/FR-PERM-006.yaml,sha256=XzT1hvGs3Zq4fJDTDrxCHzusojs5W1LZ0yw25D8o-Co,283
+scanner/taxonomy/FR-SQLI-001.yaml,sha256=aOuO3z1dpernX8fskzcYCrFGQ5httxiBJPeiE4nzZ6w,341
+scanner/taxonomy/FR-SQLI-002.yaml,sha256=L9x3SG55w-zq_fgtNTVHnVU-gQievVV3x75Cb5uX0KY,271
+scanner/taxonomy/FR-SQLI-003.yaml,sha256=X9gXTBdTiRtz-UzeaPS5c9YC49h2wWP4jBACynPYsWs,273
+scanner/taxonomy/FR-SQLI-004.yaml,sha256=zDAm_ISJqDlAGjg0f1SmKq89AtsUIvhu7KmaAb3Pk3o,244
+scanner/taxonomy/FR-WKFL-001.yaml,sha256=pAtjPoDXL7U0EEztWcp5DZZx6fle4BBAFf8e4DBh5FA,253
+scanner/taxonomy/FR-WKFL-002.yaml,sha256=6-p_tUOMnlJ28yEtMyEdmb-pzf9E5gWZnsr8F5EsQSs,261
+scanner/taxonomy/FR-WKFL-003.yaml,sha256=qvAex5EZyja88JllxGIftHUKzjOsH8K9qy-VoiyUg24,265
+scanner/taxonomy/FR-WKFL-004.yaml,sha256=pbUBntwkhWEZYTOhSE_cuAGN-LgL1DTxONpZ2hAowX4,252
+scanner/taxonomy/taxonomy_registry.yaml,sha256=p6u7tvRZBIvnxHJ53T-zSLSdOG-dCx0W7bckvvTAZHo,3418
+scanner/ui/__init__.py,sha256=HhvKaE82x7dT7cP15P_-T7VbqN6xUYqylSvSu6p68Ps,623
+scanner/ui/banner.py,sha256=1iYdnin9xh1yXsRXIHjNHuK7VSMoUn6MJ-Zi-7opHO8,2658
+scanner/ui/flow.py,sha256=4NKkCy6FNC4nftFwzYEvWBm63O5LYnsKtep93mpvocY,16075
+scanner/ui/menus.py,sha256=VqYZlkt8L_eXtZhFw_SPTw3BdFfbF1kCOEEg-s1V8g0,7616
+scanner/ui/progress.py,sha256=GHVlmpocK9yuUXZeojv3Zdpg_kcc23ZkXaGL-VhQRj0,2071
+scanner/ui/results.py,sha256=BOwbjZYyyLEM59Lo65jKsfDYfbJVnV8lLvsXxyt_B5o,12793
+scanner/ui/shell.py,sha256=2jt_P690ToO3KJN1DSiyImi1nupxGsfVl1mHuoIRHOo,15548
+scanner/ui/theme.py,sha256=0DSTOGQ12vwjTl3OiIdiquw75qnOrhz691fElU7I6zc,2144
+scanner/validate/__init__.py,sha256=mLvo2IH-hS-Z2jgeiNiRl9F0bq4FAJZPgPqg802LYk4,89
+scanner/validate/engine.py,sha256=1-WHJia1DV0psOi2eDgbRhDl5zP2fk8mGqQs_wVsyyo,2855
+scanner/web/__init__.py,sha256=jwz7uT8QRMBLLfzUEe9EFTJcWcHysTbu0oU5a-vi1Mw,30
+scanner/web/db.py,sha256=BW4Ed-qD62E_h48DVHwEhAfVZFgmmFVhvrlXTkwzfX0,12220
+scanner/web/server.py,sha256=sDOHFZ2BYkFOdXn_RF5v3JY0POTjgm4g39SSMjJL-mo,50476
+scanner/web/static/app.js,sha256=qztv4VXfrP98UoQ1bkJ3f0S2GQqvdj2BHt5eSFqvGaw,68450
+scanner/web/static/index.html,sha256=k-XU0oL3tpXyxHRz5DYSwpVyRrWt-2uqY6GBcYKdt14,27528
+scanner/web/static/logo-dark-mark.png,sha256=7h9ttJfSHW7-wjWXO3v2VMlTx5uqVN9kqrqmtyp2tCI,7859
+scanner/web/static/logo-light-mark.png,sha256=MgWAB9GdWqQNCwsl3vvYpxoFUTONsA6vZfu7kmtRWkY,7864
+scanner/web/static/logo-light.png,sha256=B4ibn91RnHKCCsAvMY_u2CO1l50CUcFZIVGs-Y98kyk,7965
+scanner/web/static/logo-light.svg,sha256=zT6hNBOjk5nNLsuDBmn7XCsRH8kdgwPBAeedO6vnB5Q,10989
+scanner/web/static/logo.png,sha256=i89aaoMgBTjI2R_l0qzICjzZb1gY6v_3m7JiXZyMt2k,24072
+scanner/web/static/logo.svg,sha256=B8l4-FBLzOAFdMXtaJrftJ5ppwjyTLdmPJ1VSmS8igY,32353
+scanner/web/static/style.css,sha256=U4VxmuG1tsOHOARm3xab9c789nzTFMpzNAcQqTixMNk,50523
+frapast-0.1.0.dist-info/METADATA,sha256=s3gfN7WtvjFGNyEa4Jab5tWVKy0Kg-i-Gr0nmP5eOcg,21231
+frapast-0.1.0.dist-info/WHEEL,sha256=YVMoNqKzERt-wjUZwJ33xBGAwnFl-4cqbYkTtWa4itE,91
+frapast-0.1.0.dist-info/entry_points.txt,sha256=MOYj6MVv49N55bpKDSZ3rTjbqo7Y9YBGQWw_KJB7SoU,106
+frapast-0.1.0.dist-info/top_level.txt,sha256=uVdh7ZIJC9rjZQex7pba18nBuRRxFhjkFu4vHPiWTcw,8
+frapast-0.1.0.dist-info/RECORD,,

frapast-0.1.0.dist-info/WHEEL

@@ -0,0 +1,5 @@
+Wheel-Version: 1.0
+Generator: setuptools (84.0.0)
+Root-Is-Purelib: true
+Tag: py3-none-any
+

frapast-0.1.0.dist-info/entry_points.txt

@@ -0,0 +1,5 @@
+[console_scripts]
+frapast = scanner.cli:main
+
+[frappe.commands]
+frapast = scanner.bench_commands:commands

frapast-0.1.0.dist-info/licenses/LICENSE

@@ -0,0 +1,21 @@
+MIT License
+
+Copyright (c) 2026 Frappe Security Scanner Contributors
+
+Permission is hereby granted, free of charge, to any person obtaining a copy
+of this software and associated documentation files (the "Software"), to deal
+in the Software without restriction, including without limitation the rights
+to use, copy, modify, merge, publish, distribute, sublicense, and/or sell
+copies of the Software, and to permit persons to whom the Software is
+furnished to do so, subject to the following conditions:
+
+The above copyright notice and this permission notice shall be included in all
+copies or substantial portions of the Software.
+
+THE SOFTWARE IS PROVIDED "AS IS", WITHOUT WARRANTY OF ANY KIND, EXPRESS OR
+IMPLIED, INCLUDING BUT NOT LIMITED TO THE WARRANTIES OF MERCHANTABILITY,
+FITNESS FOR A PARTICULAR PURPOSE AND NONINFRINGEMENT. IN NO EVENT SHALL THE
+AUTHORS OR COPYRIGHT HOLDERS BE LIABLE FOR ANY CLAIM, DAMAGES OR OTHER
+LIABILITY, WHETHER IN AN ACTION OF CONTRACT, TORT OR OTHERWISE, ARISING FROM,
+OUT OF OR IN CONNECTION WITH THE SOFTWARE OR THE USE OR OTHER DEALINGS IN THE
+SOFTWARE.

frapast-0.1.0.dist-info/top_level.txt

@@ -0,0 +1 @@
+scanner

scanner/__init__.py

@@ -0,0 +1,23 @@
+try:
+	from importlib.metadata import version
+	__version__ = version("frapast")
+except Exception:
+	__version__ = "0.1.0"
+
+from scanner.cli import scan, scan_multi
+from scanner.config import RepoConfig, ScanConfig, load_config
+from scanner.logger import logger
+from scanner.rules import Candidate, clear_rule_caches, execute_rules
+
+__all__ = [
+	"Candidate",
+	"RepoConfig",
+	"ScanConfig",
+	"clear_rule_caches",
+	"execute_rules",
+	"load_config",
+	"logger",
+	"scan",
+	"scan_multi",
+]
+

scanner/__main__.py

@@ -0,0 +1,7 @@
+"""Main package entrypoint for running via `python -m scanner`."""
+import sys
+
+from scanner.cli import main
+
+if __name__ == "__main__":
+	sys.exit(main())

scanner/autofix/__init__.py

@@ -0,0 +1,5 @@
+"""scanner/autofix package."""
+from scanner.autofix.engine import FixEngine
+from scanner.autofix.models import FixPatch
+
+__all__ = ["FixEngine", "FixPatch"]