gitrupt 0.1.0__py3-none-any.whl

gitrupt/scanners/code_rules/python.py

@@ -0,0 +1,153 @@
+"""Suspicious-code rules for Python."""
+
+from __future__ import annotations
+
+import re
+
+from gitrupt.models import Severity
+from gitrupt.scanners.code_rules.base import CodeRule
+
+RULES: tuple[CodeRule, ...] = (
+    CodeRule(
+        rule_id="py-download-exec",
+        language="python",
+        pattern=re.compile(
+            r"\b(requests|urllib|httpx|urllib3)\.\w+\s*\(",
+            re.IGNORECASE,
+        ),
+        severity=Severity.MEDIUM,
+        confidence=0.55,
+        message="Outbound HTTP call in committed code",
+        description=(
+            "Code makes a network request. Combined with exec/eval/subprocess "
+            "in the same file, this is a common download-and-execute pattern."
+        ),
+        recommendation="Verify the destination URL and the payload's handling.",
+    ),
+    CodeRule(
+        rule_id="py-eval-dynamic",
+        language="python",
+        pattern=re.compile(r"\beval\s*\(\s*(?!['\"])"),
+        severity=Severity.MEDIUM,
+        confidence=0.7,
+        message="Dynamic eval() call",
+        description="eval() on non-literal input can execute arbitrary code.",
+        recommendation="Replace eval() with an explicit parser or dispatch table.",
+    ),
+    CodeRule(
+        rule_id="py-exec-dynamic",
+        language="python",
+        pattern=re.compile(r"\bexec\s*\(\s*(?!['\"])"),
+        severity=Severity.HIGH,
+        confidence=0.75,
+        message="Dynamic exec() call",
+        description="exec() on non-literal input can execute arbitrary code.",
+        recommendation="Avoid exec(); restructure the logic explicitly.",
+    ),
+    CodeRule(
+        rule_id="py-os-system",
+        language="python",
+        pattern=re.compile(r"\bos\.system\s*\("),
+        severity=Severity.MEDIUM,
+        confidence=0.65,
+        message="os.system() call",
+        description="os.system() executes a shell command.",
+        recommendation="Prefer subprocess.run([...]) with an argument list.",
+    ),
+    CodeRule(
+        rule_id="py-subprocess-shell-true",
+        language="python",
+        pattern=re.compile(r"subprocess\.\w+\s*\([^)]*shell\s*=\s*True"),
+        severity=Severity.HIGH,
+        confidence=0.8,
+        message="subprocess with shell=True",
+        description="shell=True exposes the call to shell injection.",
+        recommendation="Pass an argument list and drop shell=True.",
+    ),
+    CodeRule(
+        rule_id="py-base64-exec",
+        language="python",
+        pattern=re.compile(r"base64\.b64decode\s*\("),
+        severity=Severity.MEDIUM,
+        confidence=0.6,
+        message="base64 decode in source",
+        description=(
+            "Encoded payloads are a common obfuscation technique. "
+            "Review what the decoded bytes are used for."
+        ),
+        recommendation="Ensure the decoded payload is not passed to exec/eval/subprocess.",
+    ),
+    CodeRule(
+        rule_id="py-pickle-loads",
+        language="python",
+        pattern=re.compile(r"\bpickle\.loads?\s*\("),
+        severity=Severity.MEDIUM,
+        confidence=0.65,
+        message="pickle deserialization",
+        description="pickle can execute arbitrary code during deserialization.",
+        recommendation="Use JSON or another safe format for untrusted data.",
+    ),
+    CodeRule(
+        rule_id="py-yaml-unsafe-load",
+        language="python",
+        pattern=re.compile(r"\byaml\.load\s*\((?![^)]*Loader\s*=)"),
+        severity=Severity.MEDIUM,
+        confidence=0.7,
+        message="yaml.load() without safe Loader",
+        description="yaml.load() without Loader can instantiate arbitrary objects.",
+        recommendation="Use yaml.safe_load() or pass Loader=yaml.SafeLoader.",
+    ),
+
+
+
+    CodeRule(
+    rule_id="py-marshal-loads",
+    language="python",
+    pattern=re.compile(r"\bmarshal\.loads?\s*\("),
+    severity=Severity.HIGH,
+    confidence=0.75,
+    message="marshal deserialization",
+    description="marshal can execute arbitrary code; used by compiled malware.",
+    recommendation="Avoid marshal on untrusted data.",
+),
+CodeRule(
+    rule_id="py-pty-spawn",
+    language="python",
+    pattern=re.compile(r"\bpty\.spawn\s*\("),
+    severity=Severity.HIGH,
+    confidence=0.8,
+    message="pty.spawn — interactive shell",
+    description="Common in reverse-shell payloads.",
+    recommendation="Review what command is being spawned.",
+),
+CodeRule(
+    rule_id="py-reverse-shell",
+    language="python",
+    pattern=re.compile(r"socket\.socket\s*\([^)]*\)\s*.*connect\s*\("),
+    severity=Severity.CRITICAL,
+    confidence=0.85,
+    message="Possible reverse shell — socket connect",
+    description="Raw socket connection followed by shell redirection.",
+    recommendation="Never run untrusted code containing this pattern.",
+),
+CodeRule(
+    rule_id="py-ctypes-call",
+    language="python",
+    pattern=re.compile(r"\bctypes\.(?:CDLL|WinDLL|cdll)\.\w+\s*\("),
+    severity=Severity.MEDIUM,
+    confidence=0.6,
+    message="ctypes native call",
+    description="Native library calls can bypass Python's safety model.",
+    recommendation="Audit the DLL and function being called.",
+),
+CodeRule(
+    rule_id="py-runpy",
+    language="python",
+    pattern=re.compile(r"\brunpy\.(?:run_path|run_module)\s*\("),
+    severity=Severity.HIGH,
+    confidence=0.75,
+    message="runpy dynamic execution",
+    description="Loads and runs arbitrary Python modules at runtime.",
+    recommendation="Avoid runpy on user-controlled paths.",
+),
+)

gitrupt/scanners/code_rules/ruby.py

@@ -0,0 +1,76 @@
+"""Suspicious-code rules for Ruby."""
+
+from __future__ import annotations
+
+import re
+
+from gitrupt.models import Severity
+from gitrupt.scanners.code_rules.base import CodeRule
+
+RULES: tuple[CodeRule, ...] = (
+    CodeRule(
+        rule_id="rb-shell-exec",
+        language="ruby",
+        pattern=re.compile(r"\b(?:system|exec|spawn)\s*\("),
+        severity=Severity.MEDIUM,
+        confidence=0.6,
+        message="Ruby shell execution",
+        description="Executes an OS-level command.",
+        recommendation="Prefer Open3 with argument arrays.",
+    ),
+    CodeRule(
+        rule_id="rb-backticks",
+        language="ruby",
+        pattern=re.compile(r"`[^`\n]*#\{[^}]*\}[^`\n]*`"),
+        severity=Severity.HIGH,
+        confidence=0.8,
+        message="Backtick shell with interpolation",
+        description="Backticks with #{...} interpolate into a shell command.",
+        recommendation="Avoid interpolating untrusted values into backticks.",
+    ),
+    CodeRule(
+        rule_id="rb-eval-dynamic",
+        language="ruby",
+        pattern=re.compile(r"\beval\s*\(\s*(?!['\"])"),
+        severity=Severity.HIGH,
+        confidence=0.75,
+        message="Dynamic eval() call",
+        description="eval() on non-literal input executes arbitrary code.",
+        recommendation="Avoid eval(); use send() with an allowlist.",
+    ),
+    CodeRule(
+        rule_id="rb-open-pipe",
+        language="ruby",
+        pattern=re.compile(r"\bIO\.popen\s*\("),
+        severity=Severity.MEDIUM,
+        confidence=0.65,
+        message="IO.popen() call",
+        description="Spawns a shell process.",
+        recommendation="Prefer Open3.capture3 with argument arrays.",
+    ),
+
+
+
+
+
+    CodeRule(
+    rule_id="rb-reverse-shell",
+    language="ruby",
+    pattern=re.compile(r"TCPSocket\.open\s*\([^)]*\)[^\n]*while"),
+    severity=Severity.CRITICAL,
+    confidence=0.85,
+    message="Ruby reverse shell via TCPSocket",
+    description="Raw TCP socket in a loop — typical backdoor shape.",
+    recommendation="Treat as malicious.",
+),
+CodeRule(
+    rule_id="rb-open-uri-exec",
+    language="ruby",
+    pattern=re.compile(r"open(?:-uri)?\s*\([^)]*\)\s*.*\beval\b", re.DOTALL),
+    severity=Severity.HIGH,
+    confidence=0.75,
+    message="Ruby remote fetch + eval",
+    description="Download and execute pattern.",
+    recommendation="Never eval remote content.",
+),
+)

gitrupt/scanners/code_rules/rust.py

@@ -0,0 +1,41 @@
+"""Suspicious-code rules for Rust."""
+
+from __future__ import annotations
+
+import re
+
+from gitrupt.models import Severity
+from gitrupt.scanners.code_rules.base import CodeRule
+
+RULES: tuple[CodeRule, ...] = (
+    CodeRule(
+        rule_id="rs-command-shell",
+        language="rust",
+        pattern=re.compile(r"Command::new\s*\(\s*\"(?:/bin/)?(?:ba)?sh\""),
+        severity=Severity.HIGH,
+        confidence=0.8,
+        message="Rust shell invocation",
+        description="Command::new on a shell binary.",
+        recommendation="Call the target binary directly.",
+    ),
+    CodeRule(
+        rule_id="rs-from-utf8-unchecked",
+        language="rust",
+        pattern=re.compile(r"from_utf8_unchecked\s*\("),
+        severity=Severity.MEDIUM,
+        confidence=0.6,
+        message="unsafe UTF-8 conversion",
+        description="from_utf8_unchecked bypasses validation.",
+        recommendation="Prefer std::str::from_utf8 with error handling.",
+    ),
+    CodeRule(
+        rule_id="rs-transmute",
+        language="rust",
+        pattern=re.compile(r"std::mem::transmute\s*(?:::<[^>]*>)?\s*\("),
+        severity=Severity.MEDIUM,
+        confidence=0.5,
+        message="std::mem::transmute",
+        description="Type-punning; unsafe and hard to audit.",
+        recommendation="Use safe conversions where possible.",
+    ),
+)

gitrupt/scanners/code_rules/shell.py

@@ -0,0 +1,112 @@
+"""Suspicious-code rules for shell scripts (sh, bash, zsh)."""
+
+from __future__ import annotations
+
+import re
+
+from gitrupt.models import Severity
+from gitrupt.scanners.code_rules.base import CodeRule
+
+RULES: tuple[CodeRule, ...] = (
+    CodeRule(
+        rule_id="sh-curl-pipe-shell",
+        language="shell",
+        pattern=re.compile(r"\b(?:curl|wget)\b[^\n|]*\|\s*(?:ba|z|k)?sh\b"),
+        severity=Severity.HIGH,
+        confidence=0.85,
+        message="curl/wget piped to shell",
+        description="Classic download-and-execute pattern.",
+        recommendation="Download to a file, verify its hash, then execute.",
+    ),
+    CodeRule(
+        rule_id="sh-base64-decode-exec",
+        language="shell",
+        pattern=re.compile(r"base64\s+(?:-d|--decode)\b[^\n|]*\|\s*(?:ba|z|k)?sh\b"),
+        severity=Severity.HIGH,
+        confidence=0.85,
+        message="base64 decode piped to shell",
+        description="Obfuscated command execution.",
+        recommendation="Decode and inspect the payload before executing.",
+    ),
+    CodeRule(
+        rule_id="sh-eval",
+        language="shell",
+        pattern=re.compile(r"\beval\s+[\"'\$]"),
+        severity=Severity.MEDIUM,
+        confidence=0.6,
+        message="eval in shell script",
+        description="eval on variable content can execute injected commands.",
+        recommendation="Avoid eval; use arrays and explicit arguments.",
+    ),
+    CodeRule(
+        rule_id="sh-rm-rf-root",
+        language="shell",
+        pattern=re.compile(r"\brm\s+-[a-z]*r[a-z]*f?[a-z]*\s+/(?:\s|$|\*)"),
+        severity=Severity.CRITICAL,
+        confidence=0.9,
+        message="rm -rf / (destructive command)",
+        description="Wipes the filesystem root.",
+        recommendation="Never run this. Review the surrounding script.",
+    ),
+    CodeRule(
+        rule_id="sh-chmod-777",
+        language="shell",
+        pattern=re.compile(r"\bchmod\s+(?:-R\s+)?777\b"),
+        severity=Severity.LOW,
+        confidence=0.6,
+        message="chmod 777 (world-writable)",
+        description="World-writable permissions are a security risk.",
+        recommendation="Grant the minimum required permissions.",
+    ),
+
+
+
+    CodeRule(
+    rule_id="sh-bash-reverse-shell",
+    language="shell",
+    pattern=re.compile(r"(?:bash|sh)\s+-i\s+>&\s+/dev/(?:tcp|udp)/"),
+    severity=Severity.CRITICAL,
+    confidence=0.95,
+    message="Bash reverse shell via /dev/tcp",
+    description="Classic reverse shell one-liner.",
+    recommendation="Never run this. Treat the whole script as malicious.",
+),
+CodeRule(
+    rule_id="sh-nc-reverse",
+    language="shell",
+    pattern=re.compile(r"\bnc\b[^\n]*-e\s+(?:/bin/)?(?:ba)?sh\b"),
+    severity=Severity.CRITICAL,
+    confidence=0.95,
+    message="Netcat reverse shell",
+    description="nc -e /bin/sh connects a shell to a remote host.",
+    recommendation="Never run this.",
+),
+CodeRule(
+    rule_id="sh-sudo-pipe",
+    language="shell",
+    pattern=re.compile(r"\bsudo\b[^\n]*\|"),
+    severity=Severity.LOW,
+    confidence=0.5,
+    message="sudo piped to another command",
+    description="Privilege-escalation pattern — review carefully.",
+    recommendation="Avoid piping sudo output to interpreters.",
+),
+CodeRule(
+    rule_id="sh-curl-exfil",
+    language="shell",
+    pattern=re.compile(
+        r"\bcurl\b[^\n]*(?:\$AWS_|\$SECRET|\$TOKEN|\$API_KEY|\$PASSWORD|\$GITHUB_TOKEN|\$STRIPE_)"
+    ),
+    severity=Severity.CRITICAL,
+    confidence=0.9,
+    message="curl with secret environment variable",
+    description="Exfiltrates a known secret env var to a remote host.",
+    recommendation="Audit the destination URL. This is a credential-theft pattern.",
+),
+
+
+
+
+
+
+)

gitrupt/scanners/dependencies.py

@@ -0,0 +1,244 @@
+"""
+Native dependency scanner.
+
+Parses manifests/lockfiles for enabled ecosystems, queries OSV for known
+vulnerabilities, and emits normalized Finding objects.
+
+Never blocks. Never requires a network. Never executes anything.
+"""
+
+from __future__ import annotations
+
+import logging
+import re
+from fnmatch import fnmatch
+from typing import Callable
+
+from gitrupt.config import DependenciesConfig
+from gitrupt.models import Finding, ScanTarget, Severity
+from gitrupt.scanners.base import Scanner
+from gitrupt.scanners.ecosystems import get_adapters
+from gitrupt.scanners.ecosystems.base import Dependency, EcosystemAdapter
+from gitrupt.scanners.osv_client import OSVClient
+
+logger = logging.getLogger(__name__)
+
+ContentProvider = Callable[[str, str], str | None]
+
+
+def _default_content_provider(repo_root: str, path: str) -> str | None:
+    from gitrupt.git import GitAdapter
+
+    return GitAdapter.get_staged_file_content(repo_root, path)
+
+
+# ── Severity extraction from an OSV vuln record ─────────────────────────────
+
+_SEVERITY_MAP = {
+    "LOW": Severity.LOW,
+    "MEDIUM": Severity.MEDIUM,
+    "MODERATE": Severity.MEDIUM,
+    "HIGH": Severity.HIGH,
+    "CRITICAL": Severity.CRITICAL,
+}
+
+
+def _extract_severity(vuln: dict) -> Severity:
+    """
+    Best-effort severity from an OSV record.
+
+    Order:
+        1. database_specific.severity (string or {score: str})
+        2. severity[].score CVSS vector prefix (best-effort)
+        3. Fallback: MEDIUM
+    """
+    db = vuln.get("database_specific") or {}
+    raw = db.get("severity")
+    if isinstance(raw, str):
+        s = _SEVERITY_MAP.get(raw.upper())
+        if s:
+            return s
+    elif isinstance(raw, dict):
+        score = raw.get("score")
+        if isinstance(score, str):
+            s = _SEVERITY_MAP.get(score.upper())
+            if s:
+                return s
+
+    for entry in vuln.get("severity") or []:
+        if not isinstance(entry, dict):
+            continue
+        # OSV usually gives a CVSS vector string in `score`.
+        vector = entry.get("score", "")
+        if isinstance(vector, str):
+            # Very rough: parse just the numeric base score if present as ".../X.X"
+            m = re.search(r"/(\d{1,2}\.\d)\b", vector)
+            if m:
+                try:
+                    v = float(m.group(1))
+                except ValueError:
+                    continue
+                if v >= 9.0:
+                    return Severity.CRITICAL
+                if v >= 7.0:
+                    return Severity.HIGH
+                if v >= 4.0:
+                    return Severity.MEDIUM
+                return Severity.LOW
+
+    return Severity.MEDIUM
+
+
+def _extract_fixed_version(vuln: dict) -> str | None:
+    """First fixed version appearing in any affected range."""
+    for affected in vuln.get("affected") or []:
+        for r in affected.get("ranges") or []:
+            for event in r.get("events") or []:
+                fixed = event.get("fixed")
+                if isinstance(fixed, str):
+                    return fixed
+    return None
+
+
+def _extract_summary(vuln: dict) -> str:
+    summary = vuln.get("summary")
+    if isinstance(summary, str) and summary.strip():
+        return summary.strip()
+    details = vuln.get("details")
+    if isinstance(details, str) and details.strip():
+        return details.strip().split("\n", 1)[0]
+    return "Vulnerable dependency"
+
+
+class DependencyScanner(Scanner):
+    """
+    Scans staged manifests/lockfiles for known vulnerabilities.
+
+    Config (DependenciesConfig):
+        ecosystems:        ["python", "node"]
+        offline:           skip network entirely
+        timeout_seconds:   HTTP timeout
+        cache_ttl_hours:   OSV cache lifetime
+    """
+
+    def __init__(
+        self,
+        config: DependenciesConfig | None = None,
+        content_provider: ContentProvider | None = None,
+        osv_client: OSVClient | None = None,
+    ) -> None:
+        self._config = config or DependenciesConfig()
+        self._content_provider = content_provider or _default_content_provider
+        self._adapters: list[EcosystemAdapter] = get_adapters(self._config.ecosystems)
+        self._osv = osv_client or OSVClient(
+            timeout=self._config.timeout_seconds,
+            cache_ttl_hours=self._config.cache_ttl_hours,
+        )
+
+    # ── Scanner interface ───────────────────────────────────────────────────
+
+    @property
+    def name(self) -> str:
+        return "dependencies"
+
+    @property
+    def description(self) -> str:
+        return "Detects vulnerable dependencies via OSV."
+
+    def scan(self, target: ScanTarget) -> list[Finding]:
+        deps = self._collect_dependencies(target)
+        if not deps:
+            return []
+
+        if self._config.offline:
+            logger.info(
+                "Dependency scanner offline; %d dependency(ies) not checked", len(deps)
+            )
+            return []
+
+        vulns_by_dep = self._osv.query_batch(deps)
+
+        findings: list[Finding] = []
+        for dep in deps:
+            key = (dep.osv_ecosystem, dep.name, dep.version)
+            for vuln in vulns_by_dep.get(key, []):
+                findings.append(self._to_finding(dep, vuln))
+        return findings
+
+    # ── Collection ──────────────────────────────────────────────────────────
+
+    def _collect_dependencies(self, target: ScanTarget) -> list[Dependency]:
+        deps: list[Dependency] = []
+        for staged in target.staged_files:
+            if staged.status == "D":
+                continue
+            for adapter in self._adapters:
+                if not self._matches(staged.path, adapter):
+                    continue
+                content = self._content_provider(target.repo_root, staged.path)
+                if content is None:
+                    continue
+                try:
+                    deps.extend(adapter.parse(staged.path, content))
+                except Exception as e:
+                    logger.warning(
+                        "Ecosystem %s failed to parse %s: %s",
+                        adapter.name,
+                        staged.path,
+                        e,
+                    )
+        # Deduplicate identical (ecosystem, name, version, source_file)
+        seen: set[tuple[str, str, str, str]] = set()
+        unique: list[Dependency] = []
+        for d in deps:
+            key = (d.osv_ecosystem, d.name, d.version, d.source_file)
+            if key in seen:
+                continue
+            seen.add(key)
+            unique.append(d)
+        return unique
+
+    @staticmethod
+    def _matches(path: str, adapter: EcosystemAdapter) -> bool:
+        name = path.replace("\\", "/").rsplit("/", 1)[-1]
+        patterns = adapter.manifest_patterns + adapter.lockfile_patterns
+        return any(fnmatch(name, p) for p in patterns)
+
+    # ── Finding construction ────────────────────────────────────────────────
+
+    def _to_finding(self, dep: Dependency, vuln: dict) -> Finding:
+        vuln_id = str(vuln.get("id") or "UNKNOWN")
+        aliases = [a for a in (vuln.get("aliases") or []) if isinstance(a, str)]
+        cve = next((a for a in aliases if a.startswith("CVE-")), None)
+
+        severity = _extract_severity(vuln)
+        fixed = _extract_fixed_version(vuln)
+
+        message = f"Vulnerable dependency: {dep.name} {dep.version} ({vuln_id})"
+        description = _extract_summary(vuln)
+        if cve:
+            description = f"{cve}: {description}"
+
+        if fixed:
+            recommendation = (
+                f"Upgrade {dep.name} to {fixed} or later "
+                f"({dep.source_file})."
+            )
+        else:
+            recommendation = (
+                f"Review and update {dep.name} in {dep.source_file}."
+            )
+
+        return Finding(
+            scanner="dependencies",
+            rule_id=f"osv-{vuln_id}",
+            severity=severity,
+            confidence=0.9,
+            file=dep.source_file,
+            line=dep.line,
+            message=message,
+            description=description,
+            evidence=f"{dep.name}=={dep.version}",
+            recommendation=recommendation,
+            can_override=True,
+        )

gitrupt/scanners/ecosystems/__init__.py

@@ -0,0 +1,30 @@
+"""Per-ecosystem dependency adapters."""
+
+from __future__ import annotations
+
+from gitrupt.scanners.ecosystems.base import Dependency, EcosystemAdapter
+from gitrupt.scanners.ecosystems.node import NodeAdapter
+from gitrupt.scanners.ecosystems.python import PythonAdapter
+
+# Registry of built-in adapters, keyed by config name.
+_ADAPTERS: dict[str, EcosystemAdapter] = {
+    "python": PythonAdapter(),
+    "node": NodeAdapter(),
+}
+
+
+def get_adapters(names: list[str]) -> list[EcosystemAdapter]:
+    """Return adapters for the given ecosystem names. Unknown names are ignored."""
+    return [_ADAPTERS[n] for n in names if n in _ADAPTERS]
+
+
+def supported_ecosystems() -> tuple[str, ...]:
+    return tuple(sorted(_ADAPTERS.keys()))
+
+
+__all__ = [
+    "Dependency",
+    "EcosystemAdapter",
+    "get_adapters",
+    "supported_ecosystems",
+]