gitrupt 0.1.0__py3-none-any.whl

gitrupt/scanners/suspicious_code.py

@@ -0,0 +1,208 @@
+"""
+Suspicious-code scanner.
+
+Language-agnostic orchestration over per-language regex rules.
+Parses the staged diff, runs language-specific rule sets against added lines,
+and returns normalized Finding objects.
+
+This scanner is a heuristic. Its findings carry a `confidence` value and
+should be treated as signals, not certainties.
+"""
+
+from __future__ import annotations
+
+import logging
+import re
+from typing import Iterator
+
+from gitrupt.models import Finding, ScanTarget, Severity
+from gitrupt.scanners.base import Scanner
+from gitrupt.scanners.code_rules import (
+    get_rules_for_language,
+    supported_languages,
+)
+from gitrupt.scanners.code_rules.base import CodeRule
+
+logger = logging.getLogger(__name__)
+
+
+# File extension → language id (matches rule `language` fields)
+_EXT_TO_LANG: tuple[tuple[str, str], ...] = (
+    (".py", "python"),
+    (".pyi", "python"),
+    (".js", "javascript"),
+    (".mjs", "javascript"),
+    (".cjs", "javascript"),
+    (".jsx", "javascript"),
+    (".ts", "javascript"),
+    (".tsx", "javascript"),
+    (".sh", "shell"),
+    (".bash", "shell"),
+    (".zsh", "shell"),
+    (".ps1", "powershell"),
+    (".psm1", "powershell"),
+    (".php", "php"),
+    (".phtml", "php"),
+    (".rb", "ruby"),
+    (".go", "go"),
+    (".rs", "rust"),
+)
+
+
+def detect_language(path: str) -> str | None:
+    """Return a rule language id for a path, or None if unsupported."""
+    lowered = path.lower()
+    for ext, lang in _EXT_TO_LANG:
+        if lowered.endswith(ext):
+            return lang
+    return None
+
+
+_HUNK_HEADER_RE = re.compile(r"\+(\d+)")
+
+
+def _iter_added_lines(diff: str) -> Iterator[tuple[str, int, str]]:
+    """
+    Yield (file_path, line_number, line_content) for every added (+) line
+    in a unified diff.
+
+    Handles `+++ b/path`, `@@ -a,b +c,d @@`, deleted and context lines.
+    """
+    if not diff:
+        return
+
+    current_file: str | None = None
+    current_line: int | None = None
+
+    for raw in diff.splitlines():
+        if raw.startswith("+++ "):
+            path = raw[4:].strip()
+            if path == "/dev/null":
+                current_file = None
+            elif path.startswith("b/"):
+                current_file = path[2:]
+            else:
+                current_file = path
+            current_line = None
+
+        elif raw.startswith("@@"):
+            m = _HUNK_HEADER_RE.search(raw)
+            current_line = int(m.group(1)) if m else None
+
+        elif raw.startswith("+++"):
+            # Defensive: unrecognized header
+            continue
+
+        elif raw.startswith("+"):
+            if current_file and current_line is not None:
+                yield current_file, current_line, raw[1:]
+            if current_line is not None:
+                current_line += 1
+
+        elif raw.startswith("---"):
+            continue
+
+        elif raw.startswith("-"):
+            # Deletion: does not advance new-file line counter
+            pass
+
+        elif raw.startswith(" "):
+            # Context: advances new-file line counter
+            if current_line is not None:
+                current_line += 1
+
+        # Anything else (diff --git, index, new file mode, etc.) is ignored
+
+
+class SuspiciousCodeScanner(Scanner):
+    """
+    Detects suspicious code patterns on added lines.
+
+    Behavior:
+        - Parses target.staged_diff
+        - For each added line, looks up the file's language
+        - Runs the language's rule set
+        - Emits normalized Findings with `file` and `line` populated
+
+    Never blocks. The Risk Engine owns the decision.
+    """
+
+    def __init__(
+        self,
+        min_confidence: float = 0.6,
+        languages: list[str] | None = None,
+    ) -> None:
+        self._min_confidence = max(0.0, min(1.0, min_confidence))
+        self._allowed_languages: set[str] | None = set(languages) if languages else None
+
+    # ── Scanner interface ────────────────────────────────────────────────────
+
+    @property
+    def name(self) -> str:
+        return "suspicious_code"
+
+    @property
+    def description(self) -> str:
+        return "Detects suspicious code patterns (download-and-execute, obfuscation, shell exec)."
+
+    def scan(self, target: ScanTarget) -> list[Finding]:
+        if not target.staged_diff:
+            return []
+
+        findings: list[Finding] = []
+        for file_path, line_no, line_text in _iter_added_lines(target.staged_diff):
+            language = detect_language(file_path)
+            if language is None:
+                continue
+            if self._allowed_languages is not None and language not in self._allowed_languages:
+                continue
+
+            for rule in get_rules_for_language(language):
+                if rule.confidence < self._min_confidence:
+                    continue
+                if rule.pattern.search(line_text):
+                    findings.append(
+                        self._to_finding(rule, file_path, line_no, line_text)
+                    )
+
+        return findings
+
+    # ── Helpers ──────────────────────────────────────────────────────────────
+
+    @staticmethod
+    def _to_finding(
+        rule: CodeRule,
+        file_path: str,
+        line_no: int,
+        line_text: str,
+    ) -> Finding:
+        return Finding(
+            scanner="suspicious_code",
+            rule_id=rule.rule_id,
+            severity=rule.severity,
+            confidence=rule.confidence,
+            file=file_path,
+            line=line_no,
+            message=rule.message,
+            description=rule.description,
+            evidence=_redact_line(line_text),
+            recommendation=rule.recommendation,
+            can_override=True,
+        )
+
+
+def _redact_line(line: str, max_len: int = 120) -> str:
+    """
+    Return a safe, truncated preview of a source line.
+
+    We never include whole lines verbatim in evidence — long lines could
+    leak adjacent secrets. Truncate and mark the cut.
+    """
+    stripped = line.strip()
+    if len(stripped) <= max_len:
+        return stripped
+    return stripped[:max_len] + " …"
+
+
+# Exposed for tests and for `gitrupt status`
+__all__ = ["SuspiciousCodeScanner", "detect_language", "supported_languages"]

gitrupt/scanners/yara_loader.py

@@ -0,0 +1,65 @@
+"""
+YARA engine loader with graceful degradation.
+
+If yara-python is not installed, load_rules() returns None and the
+malware scanner falls back to its always-on signature pass.
+"""
+
+from __future__ import annotations
+
+import logging
+from pathlib import Path
+from typing import Any
+
+from gitrupt.scanners import yara_rules_builtin
+
+logger = logging.getLogger(__name__)
+
+try:
+    import yara  # type: ignore[import-untyped]
+    YARA_AVAILABLE = True
+except ImportError:
+    yara = None  # type: ignore[assignment]
+    YARA_AVAILABLE = False
+
+
+def load_rules(custom_dirs: list[str] | None = None) -> Any | None:
+    """
+    Compile built-in YARA rules plus any .yar files found in custom_dirs.
+
+    Returns a compiled yara.Rules object, or None if YARA is not installed
+    or compilation failed.
+    """
+    if not YARA_AVAILABLE:
+        logger.info("yara-python not installed — malware scanner running in fallback mode")
+        return None
+
+    sources = yara_rules_builtin.all_rule_sources()
+
+    # Add external .yar files, namespaced by their filename stem.
+    # Compilation errors on a single external rule file are isolated —
+    # they don't take down the built-in rules.
+    if custom_dirs:
+        for directory in custom_dirs:
+            path = Path(directory)
+            if not path.is_dir():
+                logger.warning("Custom YARA dir does not exist: %s", directory)
+                continue
+            for yar_file in path.glob("*.yar"):
+                try:
+                    sources[f"external_{yar_file.stem}"] = yar_file.read_text(
+                        encoding="utf-8", errors="replace"
+                    )
+                except OSError as e:
+                    logger.warning("Could not read %s: %s", yar_file, e)
+
+    try:
+        return yara.compile(sources=sources)
+    except Exception as e:
+        logger.warning("YARA compilation failed: %s", e)
+        return None
+
+
+def is_available() -> bool:
+    """Whether the YARA engine is importable."""
+    return YARA_AVAILABLE

gitrupt/scanners/yara_rules_builtin.py

@@ -0,0 +1,141 @@
+"""
+Built-in YARA rules, embedded as Python strings.
+
+Why embedded instead of .yar files:
+    - No packaging/package-data configuration needed
+    - Works identically on Windows, Linux, macOS
+    - Users can still add external rules via `malware.custom_yara_dirs`
+
+The EICAR string is split into parts to avoid Gitrupt's own source
+tripping file-based antivirus scanners during development.
+"""
+
+from __future__ import annotations
+
+# ── EICAR ────────────────────────────────────────────────────────────────────
+# The EICAR test string is inert and standard; split here for readability.
+_EICAR_PARTS = [
+    "X5O!P%@AP[4\\",
+    "PZX54(P^)7CC)7}",
+    "$EICAR-STANDARD-",
+    "ANTIVIRUS-TEST-",
+    "FILE!$H+H*",
+]
+_EICAR_STR = "".join(_EICAR_PARTS)
+
+EICAR = r"""
+rule EICAR_Test_File
+{
+    meta:
+        description = "EICAR antivirus test file"
+        author = "Gitrupt"
+        severity = "critical"
+    strings:
+        $eicar = "EICAR_PLACEHOLDER"
+    condition:
+        $eicar
+}
+""".replace("EICAR_PLACEHOLDER", _EICAR_STR)
+
+# ── Packers ──────────────────────────────────────────────────────────────────
+PACKERS = r"""
+rule UPX_Packed_Executable
+{
+    meta:
+        description = "UPX-packed executable"
+        author = "Gitrupt"
+        severity = "high"
+    strings:
+        $upx0    = "UPX0" ascii
+        $upx1    = "UPX1" ascii
+        $upx_sig = "$Info: This file is packed with the UPX executable packer" ascii
+    condition:
+        2 of them
+}
+
+rule MPRESS_Packed_Executable
+{
+    meta:
+        description = "MPRESS-packed executable"
+        author = "Gitrupt"
+        severity = "high"
+    strings:
+        $s1 = ".MPRESS1" ascii
+        $s2 = ".MPRESS2" ascii
+    condition:
+        any of them
+}
+
+rule ASPack_Signature
+{
+    meta:
+        description = "ASPack packer signature"
+        author = "Gitrupt"
+        severity = "high"
+    strings:
+        $s1 = ".aspack" ascii nocase
+        $s2 = ".adata" ascii
+    condition:
+        all of them
+}
+"""
+
+# ── Office macros ────────────────────────────────────────────────────────────
+OFFICE_MACROS = r"""
+rule Office_VBA_Macro_Indicators
+{
+    meta:
+        description = "Office document contains VBA macro indicators"
+        author = "Gitrupt"
+        severity = "medium"
+    strings:
+        $vba1 = "Attribute VB_Name" ascii
+        $vba2 = "Attribute VB_Base" ascii
+        $vba3 = "AutoOpen" ascii
+        $vba4 = "AutoExec" ascii
+        $vba5 = "Document_Open" ascii
+        $vba6 = "Workbook_Open" ascii
+        $vba7 = "Shell(" ascii
+    condition:
+        3 of them
+}
+"""
+
+# ── Script obfuscation (higher-severity signals than Phase 5) ───────────────
+SUSPICIOUS_SCRIPTS = r"""
+rule Powershell_Download_Execute
+{
+    meta:
+        description = "PowerShell download-and-execute one-liner"
+        author = "Gitrupt"
+        severity = "critical"
+    strings:
+        $a = /IEX[\t ]*\(?[\t ]*New-Object[\t ]+Net\.WebClient/ ascii nocase
+        $b = /DownloadString[\t ]*\(/ ascii nocase
+    condition:
+        all of them
+}
+
+rule Base64_Decode_Pipe_Shell
+{
+    meta:
+        description = "Base64 decode piped directly to a shell"
+        author = "Gitrupt"
+        severity = "high"
+    strings:
+        $a = /base64[\t ]+(--decode|-d)/ ascii nocase
+        $b = /\|[\t ]*(ba|z)?sh\b/ ascii nocase
+    condition:
+        all of them
+}
+"""
+
+
+def all_rule_sources() -> dict[str, str]:
+    """Return namespace → rule source mapping for yara.compile(sources=...)."""
+    return {
+        "eicar": EICAR,
+        "packers": PACKERS,
+        "office": OFFICE_MACROS,
+        "scripts": SUSPICIOUS_SCRIPTS,
+    }