gitrupt 0.1.0__py3-none-any.whl

gitrupt/scanners/ecosystems/base.py

@@ -0,0 +1,60 @@
+"""Base types for ecosystem adapters."""
+
+from __future__ import annotations
+
+import re
+from dataclasses import dataclass
+from typing import Protocol
+
+from gitrupt.models import Severity
+
+
+@dataclass(frozen=True)
+class Dependency:
+    """A single dependency occurrence in a manifest or lockfile."""
+
+    osv_ecosystem: str   # "PyPI", "npm" — matches OSV's ecosystem names
+    name: str
+    version: str
+    source_file: str
+    line: int | None = None
+
+
+class EcosystemAdapter(Protocol):
+    """
+    Parses one ecosystem's manifest/lockfile into Dependency records.
+
+    Adapters are stateless. Add a language = add one module and register it
+    in __init__.py. No changes to the scanner, risk engine, or reporting.
+    """
+
+    name: str                        # "python", "node" — config name
+    osv_ecosystem: str               # "PyPI", "npm"
+    manifest_patterns: tuple[str, ...]   # fnmatch patterns against basename
+    lockfile_patterns: tuple[str, ...]
+
+    def parse(self, path: str, content: str) -> list[Dependency]:
+        """Return pinned dependencies found in this file. Empty if none."""
+        ...
+
+
+# ── Shared helpers ──────────────────────────────────────────────────────────
+
+_VERSION_EXACT = re.compile(r"^\d+\.\d+(?:\.\d+)?(?:[-+][\w.\-]+)?$")
+
+
+def is_exact_version(spec: str) -> bool:
+    """True if `spec` pins a specific version (no ranges, no caret/tilde)."""
+    return bool(_VERSION_EXACT.match(spec.strip()))
+
+
+def find_line_number(text: str, needle: str) -> int | None:
+    """First 1-based line containing `needle`. Heuristic — best effort."""
+    for i, line in enumerate(text.splitlines(), start=1):
+        if needle in line:
+            return i
+    return None
+
+
+# Default severity when OSV provides no usable signal.
+DEFAULT_OSV_SEVERITY = Severity.MEDIUM

gitrupt/scanners/ecosystems/node.py

@@ -0,0 +1,128 @@
+"""Node.js ecosystem: package.json, package-lock.json."""
+
+from __future__ import annotations
+
+import json
+
+from gitrupt.scanners.ecosystems.base import (
+    Dependency,
+    find_line_number,
+    is_exact_version,
+)
+
+_OSV = "npm"
+
+
+class NodeAdapter:
+    name = "node"
+    osv_ecosystem = _OSV
+    manifest_patterns = ("package.json",)
+    lockfile_patterns = ("package-lock.json",)
+
+    def parse(self, path: str, content: str) -> list[Dependency]:
+        lowered = path.lower()
+        if lowered.endswith("package-lock.json"):
+            return self._parse_lockfile(path, content)
+        if lowered.endswith("package.json"):
+            return self._parse_manifest(path, content)
+        return []
+
+    # ── package.json ────────────────────────────────────────────────────────
+
+    def _parse_manifest(self, path: str, content: str) -> list[Dependency]:
+        try:
+            data = json.loads(content)
+        except json.JSONDecodeError:
+            return []
+
+        deps: list[Dependency] = []
+        for section in ("dependencies", "devDependencies"):
+            block = data.get(section) or {}
+            if not isinstance(block, dict):
+                continue
+            for name, spec in block.items():
+                if not isinstance(spec, str):
+                    continue
+                # Strip leading v so "v1.2.3" matches
+                candidate = spec.strip().lstrip("v")
+                if not is_exact_version(candidate):
+                    continue
+                deps.append(
+                    Dependency(
+                        osv_ecosystem=_OSV,
+                        name=name,
+                        version=candidate,
+                        source_file=path,
+                        line=find_line_number(content, f'"{name}"'),
+                    )
+                )
+        return deps
+
+    # ── package-lock.json ───────────────────────────────────────────────────
+
+    def _parse_lockfile(self, path: str, content: str) -> list[Dependency]:
+        try:
+            data = json.loads(content)
+        except json.JSONDecodeError:
+            return []
+
+        deps: list[Dependency] = []
+        seen: set[tuple[str, str]] = set()
+
+        # v2/v3: "packages" key
+        packages = data.get("packages")
+        if isinstance(packages, dict):
+            for key, entry in packages.items():
+                if not isinstance(entry, dict):
+                    continue
+                version = entry.get("version")
+                if not isinstance(version, str):
+                    continue
+                # key is like "" (root) or "node_modules/<name>"
+                name = entry.get("name") or key.rsplit("node_modules/", 1)[-1]
+                if not name or not is_exact_version(version):
+                    continue
+                pair = (name, version)
+                if pair in seen:
+                    continue
+                seen.add(pair)
+                deps.append(
+                    Dependency(
+                        osv_ecosystem=_OSV,
+                        name=name,
+                        version=version,
+                        source_file=path,
+                        line=find_line_number(content, f'"node_modules/{name}"')
+                        or find_line_number(content, f'"{name}"'),
+                    )
+                )
+            return deps
+
+        # v1: recursive "dependencies"
+        def walk(block: dict, prefix: str = "") -> None:
+            for name, entry in block.items():
+                if not isinstance(entry, dict):
+                    continue
+                version = entry.get("version")
+                if isinstance(version, str) and is_exact_version(version):
+                    pair = (name, version)
+                    if pair not in seen:
+                        seen.add(pair)
+                        deps.append(
+                            Dependency(
+                                osv_ecosystem=_OSV,
+                                name=name,
+                                version=version,
+                                source_file=path,
+                                line=find_line_number(content, f'"{name}"'),
+                            )
+                        )
+                nested = entry.get("dependencies")
+                if isinstance(nested, dict):
+                    walk(nested, prefix + name + "/")
+
+        root = data.get("dependencies")
+        if isinstance(root, dict):
+            walk(root)
+
+        return deps

gitrupt/scanners/ecosystems/python.py

@@ -0,0 +1,157 @@
+"""Python ecosystem: requirements.txt, pyproject.toml, poetry.lock."""
+
+from __future__ import annotations
+
+import re
+import tomllib
+
+from gitrupt.scanners.ecosystems.base import (
+    Dependency,
+    find_line_number,
+    is_exact_version,
+)
+
+_OSV = "PyPI"
+
+# requirements.txt: name[extras]==1.2.3
+_REQ_PIN = re.compile(
+    r"^\s*([A-Za-z0-9][A-Za-z0-9_.\-]*)"
+    r"(?:\[[^\]]*\])?"
+    r"\s*==\s*"
+    r"([A-Za-z0-9_.\-+!]+)"
+)
+
+# PEP 508 pin inside a list string: "django==4.2.0"
+_PEP508_PIN = re.compile(
+    r"^\s*([A-Za-z0-9][A-Za-z0-9_.\-]*)"
+    r"(?:\[[^\]]*\])?"
+    r"\s*==\s*"
+    r"([A-Za-z0-9_.\-+!]+)"
+)
+
+
+class PythonAdapter:
+    name = "python"
+    osv_ecosystem = _OSV
+    manifest_patterns = ("requirements.txt", "requirements-*.txt", "pyproject.toml")
+    lockfile_patterns = ("poetry.lock", "Pipfile.lock")
+
+    def parse(self, path: str, content: str) -> list[Dependency]:
+        lowered = path.lower()
+        if lowered.endswith("requirements.txt") or "/requirements-" in lowered or lowered.startswith("requirements-"):
+            return self._parse_requirements(path, content)
+        if lowered.endswith("pyproject.toml"):
+            return self._parse_pyproject(path, content)
+        if lowered.endswith("poetry.lock"):
+            return self._parse_poetry_lock(path, content)
+        return []
+
+    # ── requirements.txt ────────────────────────────────────────────────────
+
+    def _parse_requirements(self, path: str, content: str) -> list[Dependency]:
+        deps: list[Dependency] = []
+        for i, raw in enumerate(content.splitlines(), start=1):
+            line = raw.split("#", 1)[0].strip()
+            if not line or line.startswith("-"):
+                continue
+            m = _REQ_PIN.match(line)
+            if not m:
+                continue
+            deps.append(
+                Dependency(
+                    osv_ecosystem=_OSV,
+                    name=m.group(1),
+                    version=m.group(2),
+                    source_file=path,
+                    line=i,
+                )
+            )
+        return deps
+
+    # ── pyproject.toml ──────────────────────────────────────────────────────
+
+    def _parse_pyproject(self, path: str, content: str) -> list[Dependency]:
+        try:
+            data = tomllib.loads(content)
+        except tomllib.TOMLDecodeError:
+            return []
+
+        deps: list[Dependency] = []
+
+        # PEP 621: [project] dependencies = ["django==4.2.0", ...]
+        project = data.get("project", {})
+        for spec in project.get("dependencies", []) or []:
+            if not isinstance(spec, str):
+                continue
+            m = _PEP508_PIN.match(spec)
+            if not m:
+                continue
+            deps.append(
+                Dependency(
+                    osv_ecosystem=_OSV,
+                    name=m.group(1),
+                    version=m.group(2),
+                    source_file=path,
+                    line=find_line_number(content, m.group(1)),
+                )
+            )
+
+        # Poetry: [tool.poetry.dependencies] name = "1.2.3"
+        poetry = (data.get("tool", {}) or {}).get("poetry", {}) or {}
+        for section in ("dependencies", "dev-dependencies"):
+            block = poetry.get(section, {}) or {}
+            for name, spec in block.items():
+                if name.lower() == "python":
+                    continue
+                if isinstance(spec, str) and is_exact_version(spec):
+                    deps.append(
+                        Dependency(
+                            osv_ecosystem=_OSV,
+                            name=name,
+                            version=spec.strip(),
+                            source_file=path,
+                            line=find_line_number(content, f'"{name}"')
+                            or find_line_number(content, name),
+                        )
+                    )
+                elif isinstance(spec, dict):
+                    ver = spec.get("version")
+                    if isinstance(ver, str) and is_exact_version(ver):
+                        deps.append(
+                            Dependency(
+                                osv_ecosystem=_OSV,
+                                name=name,
+                                version=ver.strip(),
+                                source_file=path,
+                                line=find_line_number(content, name),
+                            )
+                        )
+
+        return deps
+
+    # ── poetry.lock ─────────────────────────────────────────────────────────
+
+    def _parse_poetry_lock(self, path: str, content: str) -> list[Dependency]:
+        try:
+            data = tomllib.loads(content)
+        except tomllib.TOMLDecodeError:
+            return []
+
+        deps: list[Dependency] = []
+        for pkg in data.get("package", []) or []:
+            name = pkg.get("name")
+            version = pkg.get("version")
+            if not isinstance(name, str) or not isinstance(version, str):
+                continue
+            if not is_exact_version(version):
+                continue
+            deps.append(
+                Dependency(
+                    osv_ecosystem=_OSV,
+                    name=name,
+                    version=version,
+                    source_file=path,
+                    line=find_line_number(content, f'name = "{name}"'),
+                )
+            )
+        return deps

gitrupt/scanners/entropy.py

@@ -0,0 +1,123 @@
+"""
+Entropy-based secret detection with calibration and allowlisting.
+
+Design:
+    - Threshold: 4.5 bits/char (calibrated; see docs/entropy-calibration.md)
+    - Minimum length: 20 chars
+    - Allowlist: known-safe shapes (git SHA, UUID, semver, SRI hash, base64 PNG)
+    - Context bonus: lower the bar when a key/token/secret word is nearby
+"""
+
+from __future__ import annotations
+
+import math
+import re
+from collections import Counter
+from dataclasses import dataclass
+
+from gitrupt.models import Severity
+
+
+DEFAULT_THRESHOLD = 4.5
+MIN_LENGTH = 20
+CONTEXT_BONUS = 0.3      # lower threshold by this when context word is nearby
+CONTEXT_WINDOW = 120
+
+_CONTEXT_WORDS = (
+    "key", "token", "secret", "password", "passwd", "pwd",
+    "api_key", "apikey", "auth", "credential", "bearer",
+    "private", "access", "session",
+)
+
+
+def shannon_entropy(s: str) -> float:
+    """Byte-level Shannon entropy, 0.0 – ~6.5 for alphanumerics."""
+    if not s:
+        return 0.0
+    counts = Counter(s)
+    total = len(s)
+    return -sum((c / total) * math.log2(c / total) for c in counts.values())
+
+
+# ── Allowlist: shapes that look random but are not secrets ──────────────────
+
+_ALLOWLIST_PATTERNS: tuple[re.Pattern, ...] = (
+    # Git commit SHA (full or short)
+    re.compile(r"^[0-9a-f]{7,40}$"),
+    # UUID v4
+    re.compile(r"^[0-9a-f]{8}-[0-9a-f]{4}-4[0-9a-f]{3}-[89ab][0-9a-f]{3}-[0-9a-f]{12}$"),
+    # Semver (with optional prerelease/build)
+    re.compile(r"^\d+\.\d+\.\d+(?:-[\w.]+)?(?:\+[\w.]+)?$"),
+    # SRI hash (sha256-/sha384-/sha512- + base64)
+    re.compile(r"^sha(256|384|512)-[A-Za-z0-9+/=]+$"),
+    # Hex-encoded hash (MD5, SHA1, SHA256)
+    re.compile(r"^[0-9a-f]{32}$|^[0-9a-f]{40}$|^[0-9a-f]{64}$"),
+    # Base64-encoded small payloads (PNG header, etc.)
+    re.compile(r"^iVBORw0KGgo[A-Za-z0-9+/=]+$"),
+    # IPv6
+    re.compile(r"^[0-9a-fA-F:]{8,}$"),
+)
+
+
+def is_allowlisted(value: str) -> bool:
+    """True if value matches a known-safe shape."""
+    return any(p.match(value) for p in _ALLOWLIST_PATTERNS)
+
+
+# ── Candidate extraction ────────────────────────────────────────────────────
+
+# Strings of length >= MIN_LENGTH built from the token alphabet.
+_CANDIDATE_RE = re.compile(
+    rf"[A-Za-z0-9_\-+/=]{{{MIN_LENGTH},}}"
+)
+
+
+@dataclass(frozen=True)
+class EntropyHit:
+    value: str
+    entropy: float
+    reason: str
+
+
+def _context_present(line: str, start: int, end: int) -> bool:
+    window = line[max(0, start - CONTEXT_WINDOW): min(len(line), end + CONTEXT_WINDOW)]
+    lowered = window.lower()
+    return any(w in lowered for w in _CONTEXT_WORDS)
+
+
+def find_entropy_secrets(
+    line: str,
+    threshold: float = DEFAULT_THRESHOLD,
+) -> list[EntropyHit]:
+    """
+    Scan a single line for high-entropy candidates.
+
+    Returns one EntropyHit per candidate that clears the bar.
+    """
+    hits: list[EntropyHit] = []
+
+    for m in _CANDIDATE_RE.finditer(line):
+        candidate = m.group(0)
+        if len(candidate) < MIN_LENGTH:
+            continue
+        if is_allowlisted(candidate):
+            continue
+
+        ent = shannon_entropy(candidate)
+
+        # Lower the bar when the surrounding text hints at a secret.
+        effective_threshold = threshold
+        context = _context_present(line, m.start(), m.end())
+        if context:
+            effective_threshold -= CONTEXT_BONUS
+
+        if ent >= effective_threshold:
+            hits.append(
+                EntropyHit(
+                    value=candidate,
+                    entropy=ent,
+                    reason="context-assisted" if context else "high-entropy",
+                )
+            )
+
+    return hits

gitrupt/scanners/forbidden_files.py

@@ -0,0 +1,201 @@
+"""
+Forbidden file scanner.
+
+Checks staged files against a list of forbidden path patterns.
+Operates on file paths only — no content scanning needed.
+Language-agnostic by construction.
+"""
+
+from __future__ import annotations
+
+import fnmatch
+import logging
+from pathlib import PurePosixPath
+
+from gitrupt.config import AllowConfig, RulesConfig
+from gitrupt.models import Finding, ScanTarget, Severity
+from gitrupt.scanners.base import Scanner
+
+logger = logging.getLogger(__name__)
+
+# Default forbidden path patterns (always active, even without config file)
+DEFAULT_FORBIDDEN_PATTERNS: list[tuple[str, str, Severity]] = [
+    # (pattern, reason, severity)
+    (".env", "Environment file — likely contains credentials", Severity.CRITICAL),
+    (".env.*", "Environment file — likely contains credentials", Severity.CRITICAL),
+    ("*.pem", "PEM-encoded private key or certificate", Severity.CRITICAL),
+    ("*.key", "Private key file", Severity.CRITICAL),
+    ("*.p12", "PKCS#12 certificate store — may contain private keys", Severity.CRITICAL),
+    ("*.pfx", "PFX certificate file — may contain private keys", Severity.CRITICAL),
+    ("credentials.json", "Cloud credential file", Severity.CRITICAL),
+    ("service-account.json", "Service account credential file", Severity.CRITICAL),
+    ("*.secret", "Secret file", Severity.CRITICAL),
+    # High severity
+    (".htpasswd", "Apache password file", Severity.HIGH),
+    ("*.jks", "Java KeyStore — may contain private keys", Severity.HIGH),
+    ("*.keystore", "Key store file", Severity.HIGH),
+    # Suspicious executables
+    ("*.scr", "Windows screensaver executable", Severity.HIGH),
+]
+
+# Paths that are always allowed regardless of rules
+DEFAULT_ALLOW_PATTERNS: list[str] = [
+    ".env.example",
+    ".env.template",
+    ".env.sample",
+    ".env.test",
+]
+
+
+class ForbiddenFileScanner(Scanner):
+    """
+    Scans staged files against forbidden path patterns.
+
+    Checks file names and paths using glob patterns.
+    Does not read file content — purely path-based.
+    """
+
+    def __init__(
+        self,
+        rules: RulesConfig | None = None,
+        allow: AllowConfig | None = None,
+    ) -> None:
+        self._rules = rules
+        self._allow = allow
+
+    @property
+    def name(self) -> str:
+        return "forbidden-files"
+
+    @property
+    def description(self) -> str:
+        return "Detects forbidden file paths (credentials, keys, dangerous executables)"
+
+    def scan(self, target: ScanTarget) -> list[Finding]:
+        findings: list[Finding] = []
+
+        # Build effective allow list
+        allow_patterns = list(DEFAULT_ALLOW_PATTERNS)
+        if self._allow:
+            allow_patterns.extend(self._allow.paths)
+
+        # Build effective forbidden patterns
+        forbidden_patterns = self._build_forbidden_patterns()
+
+        for staged_file in target.staged_files:
+            # Skip deleted files (they're being removed, not added)
+            if staged_file.status == "D":
+                continue
+
+            file_path = staged_file.path
+
+            # Check allow list first
+            if self._is_allowed(file_path, allow_patterns):
+                logger.debug("File %s is on the allow list, skipping", file_path)
+                continue
+
+            # Check forbidden patterns
+            match = self._matches_forbidden(file_path, forbidden_patterns)
+            if match:
+                pattern, reason, severity = match
+                findings.append(
+                    Finding(
+                        scanner=self.name,
+                        rule_id=f"forbidden-file-{_pattern_to_rule_id(pattern)}",
+                        severity=severity,
+                        confidence=1.0,
+                        file=file_path,
+                        line=None,
+                        message=f"Forbidden file: {file_path}",
+                        description=reason,
+                        evidence=f"Path matches pattern: {pattern}",
+                        recommendation=(
+                            f"Remove this file from staging:\n"
+                            f"  git restore --staged {file_path}\n"
+                            f"If this file is intentional, add it to the 'allow.paths' "
+                            f"section of .gitrupt.yml"
+                        ),
+                        can_override=False,
+                    )
+                )
+
+        return findings
+
+    def _build_forbidden_patterns(self) -> list[tuple[str, str, Severity]]:
+        """Build the complete list of forbidden patterns."""
+        patterns = list(DEFAULT_FORBIDDEN_PATTERNS)
+
+        if self._rules:
+            # Add config-specified forbidden paths (default to HIGH severity)
+            for p in self._rules.forbidden_paths:
+                if not any(p == pat for pat, _, _ in DEFAULT_FORBIDDEN_PATTERNS):
+                    patterns.append((p, f"Forbidden by policy: {p}", Severity.HIGH))
+
+            # Add config-specified forbidden extensions
+            for ext in self._rules.forbidden_extensions:
+                pattern = f"*{ext}"
+                patterns.append(
+                    (pattern, f"Forbidden file extension: {ext}", Severity.HIGH)
+                )
+
+        return patterns
+
+    @staticmethod
+    def _is_allowed(file_path: str, allow_patterns: list[str]) -> bool:
+        """Check whether a file path matches any allow pattern."""
+        # Check the full path and just the filename
+        basename = PurePosixPath(file_path).name
+
+        for pattern in allow_patterns:
+            # Exact match
+            if file_path == pattern or basename == pattern:
+                return True
+            # Glob match on full path
+            if fnmatch.fnmatch(file_path, pattern):
+                return True
+            # Glob match on basename
+            if fnmatch.fnmatch(basename, pattern):
+                return True
+
+        return False
+
+    @staticmethod
+    def _matches_forbidden(
+        file_path: str,
+        patterns: list[tuple[str, str, Severity]],
+    ) -> tuple[str, str, Severity] | None:
+        """
+        Return the first forbidden pattern that matches, or None.
+
+        Checks both the full path and the filename.
+        """
+        basename = PurePosixPath(file_path).name
+
+        for pattern, reason, severity in patterns:
+            # Exact match on basename (most common case)
+            if basename == pattern:
+                return pattern, reason, severity
+            # Glob match on basename
+            if fnmatch.fnmatch(basename, pattern):
+                return pattern, reason, severity
+            # Glob match on full path (for path-specific rules like "config/secrets/*")
+            if fnmatch.fnmatch(file_path, pattern):
+                return pattern, reason, severity
+            # Also try matching against path components
+            path_parts = PurePosixPath(file_path).parts
+            for part in path_parts:
+                if fnmatch.fnmatch(part, pattern):
+                    return pattern, reason, severity
+
+        return None
+
+
+def _pattern_to_rule_id(pattern: str) -> str:
+    """Convert a glob pattern to a safe rule ID."""
+    return (
+        pattern.replace("*", "glob")
+        .replace(".", "-")
+        .replace("/", "-")
+        .strip("-")
+        .lower()
+    )