guarddog 2.0.0__py3-none-any.whl → 2.0.1__py3-none-any.whl

guarddog/analyzer/sourcecode/npm-install-script.yml

@@ -10,6 +10,17 @@ rules:
       # (typically when a dependency is a git repository, see https://github.com/npm/cli/issues/6031#issuecomment-1449119423)
       # however this happens pretty rarely so reporting every package with a "prepare" script would be too noisy;
       # see https://github.com/DataDog/guarddog/issues/308
+      - pattern-not: |
+            "...": "npx only-allow pnpm"
+      - pattern-not: |
+          "...": ""
+      - pattern-not: |
+          "...": "patch-package"
+      - pattern-not: |
+          "...": "husky"
+      - pattern-not: |
+          "preinstall": "echo \"preinstall script\""
+
       - pattern-either:
           - pattern: |
               "preinstall": "..."

guarddog/analyzer/sourcecode/shady-links.yml

@@ -5,10 +5,9 @@ rules:
     metadata:
       description: Identify when a package contains an URL to a domain with a suspicious extension
     patterns:
-      # Semgrep not robust enough to ignore comments in lists
-      - pattern-not-regex: \# .*
 
       # ignore comments
+      - pattern-not-regex: ^\s*\# .*
       - pattern-not-regex: ^\s*\/\*(.|\n)*?\*\/\s*$
       - pattern-not-regex: ^\s*\/\/.*$
 
@@ -16,19 +15,22 @@ rules:
       - pattern-not-regex: ^\s*"""(.|\n)*?"""\s*$
 
       # Exclude local IPv4 sometimes used in tests
-      - pattern-not-regex: (http[s]?:\/\/[^/?#]*(?:192\.168|10\.\d{1,3}|172\.(?:1[6-9]|2\d|3[0-1])|127\.\d{1,3})\.\d{1,3}\.\d{1,3}|0\.0\.0\.0|localhost)
+      - pattern-not-regex: (http[s]?:\/\/[^\n\[\/\?#"']*?(?:192\.168|10\.\d{1,3}|172\.(?:1[6-9]|2\d|3[0-1])|127\.\d{1,3})\.\d{1,3}\.\d{1,3}|0\.0\.0\.0|localhost)
 
       # Exclude public IPv4 sometimes used in tests
-      - pattern-not-regex: (http[s]?:\/\/[^/?#]*(?:1\.1\.1\.1|8\.8\.8\.8))
+      - pattern-not-regex: (http[s]?:\/\/[^\n\[\/\?#"']*?(?:1\.1\.1\.1|8\.8\.8\.8))
 
       - patterns:
         - pattern: ("...")
         - pattern-either:
-            - pattern-regex: (http[s]?:\/\/bit\.ly.*)$
-            - pattern-regex: (http[s]?:\/\/.*\.(link|xyz|tk|ml|ga|cf|gq|pw|top|club|mw|bd|ke|am|sbs|date|quest|cd|bid|cd|ws|icu|cam|uno|email|stream))$
-            - pattern-regex: (http[s]?:\/\/.*\.(link|xyz|tk|ml|ga|cf|gq|pw|top|club|mw|bd|ke|am|sbs|date|quest|cd|bid|cd|ws|icu|cam|uno|email|stream)\/)
-            - pattern-regex: (http[s]?:\/\/[^/?#]*(?:\d{1,3}\.\d{1,3}\.\d{1,3}\.\d{1,3}))
-            - pattern-regex: (http[s]?:\/\/[^\n\[/?#]*?(?:\[(([A-Fa-f0-9]{1,4}:){0,7}|:):?[A-Fa-f0-9]{1,4}(:[A-Fa-f0-9]{1,4}){0,7})\])
+            # complete domains
+            - pattern-regex: (http[s]?:\/\/[^\n\[\/\?#"']*?(bit\.ly|discord\.com|workers\.dev|transfer\.sh|filetransfer\.io|sendspace\.com|appdomain\.cloud|backblazeb2\.com\|paste\.ee|ngrok\.io|termbin\.com|localhost\.run|webhook\.site|oastify\.com|burpcollaborator\.me)\/)
+            # top-level domains
+            - pattern-regex: (http[s]?:\/\/[^\n\[\/\?#"']*?\.(link|xyz|tk|ml|ga|cf|gq|pw|top|club|mw|bd|ke|am|sbs|date|quest|cd|bid|cd|ws|icu|cam|uno|email|stream)\/)
+            # IPv4
+            - pattern-regex: (http[s]?:\/\/[^\n\[\/\?#"']*?(?:\d{1,3}\.\d{1,3}\.\d{1,3}\.\d{1,3}))
+            # IPv6
+            - pattern-regex: (http[s]?:\/\/[^\n\[\/\?#"']*?(?:\[(([A-Fa-f0-9]{1,4}:){0,7}|:):?[A-Fa-f0-9]{1,4}(:[A-Fa-f0-9]{1,4}){0,7})\])
     paths:
       exclude:
         - "*/test/*"

guarddog/cli.py

@@ -9,7 +9,8 @@ import json as js
 import logging
 import os
 import sys
-from typing import Optional, cast
+import tempfile
+from typing import Optional
 
 import click
 from prettytable import PrettyTable
@@ -19,8 +20,8 @@ from guarddog.analyzer.metadata import get_metadata_detectors
 from guarddog.analyzer.sourcecode import get_sourcecode_rules
 from guarddog.ecosystems import ECOSYSTEM
 from guarddog.reporters.sarif import report_verify_sarif
-from guarddog.scanners import get_scanner
-from guarddog.scanners.scanner import PackageScanner
+from guarddog.scanners import get_package_scanner, get_project_scanner
+from guarddog.utils.archives import safe_extract
 
 EXIT_CODE_ISSUES_FOUND = 1
 
@@ -156,7 +157,7 @@ def _verify(
     """
     return_value = None
     rule_param = _get_rule_param(rules, exclude_rules, ecosystem)
-    scanner = get_scanner(ecosystem, True)
+    scanner = get_project_scanner(ecosystem)
     if scanner is None:
         sys.stderr.write(f"Command verify is not supported for ecosystem {ecosystem}")
         exit(1)
@@ -208,46 +209,35 @@ def _scan(
     """
 
     rule_param = _get_rule_param(rules, exclude_rules, ecosystem)
-    scanner = cast(Optional[PackageScanner], get_scanner(ecosystem, False))
+    scanner = get_package_scanner(ecosystem)
     if scanner is None:
         sys.stderr.write(f"Command scan is not supported for ecosystem {ecosystem}")
         sys.exit(1)
 
-    results = []
-    if os.path.isdir(identifier):
-        log.debug(f"Considering that '{identifier}' is a local directory")
-        for package in os.listdir(identifier):
-            result = scanner.scan_local(f"{identifier}/{package}", rule_param)
-            result["package"] = package
-            results.append(result)
-    elif os.path.isfile(identifier):
-        log.debug(f"Considering that '{identifier}' is a local file")
-        result = scanner.scan_local(identifier, rule_param)
-        result["package"] = identifier
-        results.append(result)
-    else:
-        log.debug(f"Considering that '{identifier}' is a remote target")
-        try:
-            result = scanner.scan_remote(identifier, version, rule_param)
-            result["package"] = identifier
-            results.append(result)
-        except Exception as e:
-            sys.stderr.write(f"\nError '{e}' occurred while scanning remote package.")
-            sys.exit(1)
+    result = {"package": identifier}
+    try:
+        if os.path.isdir(identifier):
+            log.debug(f"Considering that '{identifier}' is a local directory")
+            result |= scanner.scan_local(identifier, rule_param)
+        elif os.path.isfile(identifier):
+            log.debug(f"Considering that '{identifier}' is a local archive file")
+            with tempfile.TemporaryDirectory() as tempdir:
+                safe_extract(identifier, tempdir)
+                result |= scanner.scan_local(tempdir, rule_param)
+        else:
+            log.debug(f"Considering that '{identifier}' is a remote target")
+            result |= scanner.scan_remote(identifier, version, rule_param)
+    except Exception as e:
+        sys.stderr.write(f"Error occurred while scanning target {identifier}: '{e}'\n")
+        sys.exit(1)
 
     if output_format == "json":
-        if len(results) == 1:
-            # return only a json like {}
-            print(js.dumps(results[0]))
-        else:
-            # Return a list of result like [{},{}]
-            print(js.dumps(results))
+        print(js.dumps(result))
     else:
-        for result in results:
-            print_scan_results(result, result["package"])
+        print_scan_results(result, result["package"])
 
     if exit_non_zero_on_finding:
-        exit_with_status_code(results)
+        exit_with_status_code([result])
 
 
 def _list_rules(ecosystem: ECOSYSTEM):

guarddog/scanners/__init__.py

@@ -6,22 +6,49 @@ from .pypi_package_scanner import PypiPackageScanner
 from .pypi_project_scanner import PypiRequirementsScanner
 from .go_package_scanner import GoModuleScanner
 from .go_project_scanner import GoDependenciesScanner
-from .scanner import Scanner
+from .scanner import PackageScanner, ProjectScanner
 from ..ecosystems import ECOSYSTEM
 
 
-def get_scanner(ecosystem: ECOSYSTEM, project: bool) -> Optional[Scanner]:
-    match (ecosystem, project):
-        case (ECOSYSTEM.PYPI, False):
+def get_package_scanner(ecosystem: ECOSYSTEM) -> Optional[PackageScanner]:
+    """
+    Return a `PackageScanner` for the given ecosystem or `None` if it
+    is not yet supported.
+
+    Args:
+        ecosystem (ECOSYSTEM): The ecosystem of the desired scanner
+
+    Returns:
+        Optional[PackageScanner]: The result of the scanner request
+
+    """
+    match ecosystem:
+        case ECOSYSTEM.PYPI:
             return PypiPackageScanner()
-        case (ECOSYSTEM.PYPI, True):
-            return PypiRequirementsScanner()
-        case (ECOSYSTEM.NPM, False):
+        case ECOSYSTEM.NPM:
             return NPMPackageScanner()
-        case (ECOSYSTEM.NPM, True):
-            return NPMRequirementsScanner()
-        case (ECOSYSTEM.GO, False):
+        case ECOSYSTEM.GO:
             return GoModuleScanner()
-        case (ECOSYSTEM.GO, True):
+    return None
+
+
+def get_project_scanner(ecosystem: ECOSYSTEM) -> Optional[ProjectScanner]:
+    """
+    Return a `ProjectScanner` for the given ecosystem or `None` if
+    it is not yet supported.
+
+    Args:
+        ecosystem (ECOSYSTEM): The ecosystem of the desired scanner
+
+    Returns:
+        Optional[ProjectScanner]: The result of the scanner request
+
+    """
+    match ecosystem:
+        case ECOSYSTEM.PYPI:
+            return PypiRequirementsScanner()
+        case ECOSYSTEM.NPM:
+            return NPMRequirementsScanner()
+        case ECOSYSTEM.GO:
             return GoDependenciesScanner()
     return None

guarddog/scanners/scanner.py

@@ -21,18 +21,7 @@ def noop(arg: typing.Any) -> None:
     pass
 
 
-class Scanner:
-    def __init__(self) -> None:
-        pass
-
-    @abstractmethod
-    def scan_local(
-        self, path, rules=None, callback: typing.Callable[[dict], None] = noop
-    ):
-        pass
-
-
-class ProjectScanner(Scanner):
+class ProjectScanner:
     def __init__(self, package_scanner):
         super().__init__()
         self.package_scanner = package_scanner
@@ -212,7 +201,7 @@ class ProjectScanner(Scanner):
         pass
 
 
-class PackageScanner(Scanner):
+class PackageScanner:
     """
     Scans package for attack vectors based on source code and metadata rules
 
@@ -231,7 +220,7 @@ class PackageScanner(Scanner):
         Scans local package
 
         Args:
-            path (str): path to package
+            path (str): Path to the directory containing the package to analyze
             rules (set, optional): Set of rule names to use. Defaults to all rules.
             callback (typing.Callable[[dict], None], optional): Callback to apply to Analyzer output
 
@@ -245,16 +234,7 @@ class PackageScanner(Scanner):
         if rules is not None:
             rules = set(rules)
 
-        results = None
-        if os.path.isdir(path):
-            results = self.analyzer.analyze_sourcecode(path, rules=rules)
-        elif os.path.isfile(path):
-            with tempfile.TemporaryDirectory() as tempdir:
-                safe_extract(path, tempdir)
-                results = self.analyzer.analyze_sourcecode(tempdir, rules=rules)
-        else:
-            raise Exception(f"Local scan target {path} is neither a directory nor a file.")
-
+        results = self.analyzer.analyze_sourcecode(path, rules=rules)
         callback(results)
 
         return results

guarddog/utils/archives.py

@@ -1,5 +1,6 @@
 import logging
 import os
+import stat
 import zipfile
 
 import tarsafe  # type:ignore
@@ -9,41 +10,25 @@ log = logging.getLogger("guarddog")
 
 def is_supported_archive(path: str) -> bool:
     """
-    Decide whether a file contains a supported archive.
+    Decide whether a file contains a supported archive based on its
+    file extension.
 
     Args:
         path (str): The local filesystem path to examine
 
     Returns:
         bool: Represents the decision reached for the file
-    """
-    return is_tar_archive(path) or is_zip_archive(path)
-
-
-def is_tar_archive(path: str) -> bool:
-    """
-    Decide whether a file contains a tar archive.
-
-    Args:
-        path (str): The local filesystem path to examine
 
-    Returns:
-        bool: Represents the decision reached for the file
     """
-    return any(path.endswith(ext) for ext in [".tar.gz", ".tgz"])
+    def is_tar_archive(path: str) -> bool:
+        tar_exts = [".bz2", ".bzip2", ".gz", ".gzip", ".tgz", ".xz"]
 
+        return any(path.endswith(ext) for ext in tar_exts)
 
-def is_zip_archive(path: str) -> bool:
-    """
-    Decide whether a file contains a zip, whl or egg archive.
+    def is_zip_archive(path: str) -> bool:
+        return any(path.endswith(ext) for ext in [".zip", ".whl", ".egg"])
 
-    Args:
-        path (str): The local filesystem path to examine
-
-    Returns:
-        bool: Represents the decision reached for the file
-    """
-    return any(path.endswith(ext) for ext in [".zip", ".whl", ".egg"])
+    return is_tar_archive(path) or is_zip_archive(path)
 
 
 def safe_extract(source_archive: str, target_directory: str) -> None:
@@ -61,9 +46,28 @@ def safe_extract(source_archive: str, target_directory: str) -> None:
 
     """
     log.debug(f"Extracting archive {source_archive} to directory {target_directory}")
-    if is_tar_archive(source_archive):
+    if tarsafe.is_tarfile(source_archive):
+
+        def add_exec(path):
+            st = os.stat(path)
+            os.chmod(path, st.st_mode | stat.S_IEXEC)
+
+        def add_read(path):
+            st = os.stat(path)
+            os.chmod(path, st.st_mode | stat.S_IREAD)
+
+        def recurse_add_perms(path):
+            add_exec(path)
+            for root, dirs, files in os.walk(path):
+                for d in dirs:
+                    add_exec(os.path.join(root, d))
+                for f in files:
+                    add_read(os.path.join(root, f))
+
         tarsafe.open(source_archive).extractall(target_directory)
-    elif is_zip_archive(source_archive):
+        recurse_add_perms(target_directory)
+
+    elif zipfile.is_zipfile(source_archive):
         with zipfile.ZipFile(source_archive, 'r') as zip:
             for file in zip.namelist():
                 # Note: zip.extract cleans up any malicious file name

{guarddog-2.0.0.dist-info → guarddog-2.0.1.dist-info}/METADATA

@@ -1,6 +1,6 @@
 Metadata-Version: 2.1
 Name: guarddog
-Version: 2.0.0
+Version: 2.0.1
 Summary: GuardDog is a CLI tool to Identify malicious PyPI packages
 Home-page: https://github.com/DataDog/guarddog
 License: Apache-2.0

{guarddog-2.0.0.dist-info → guarddog-2.0.1.dist-info}/RECORD

@@ -51,36 +51,36 @@ guarddog/analyzer/sourcecode/exfiltrate-sensitive-data.yml,sha256=e8dj10HABb36rS
 guarddog/analyzer/sourcecode/npm-dll-hijacking.yml,sha256=TPIXvWm8Ot9RVtDXWFmoNZw9-3PH7NuXK6x1fQCiRt4,3506
 guarddog/analyzer/sourcecode/npm-exec-base64.yml,sha256=xNIwJAmGP19wvxH_w1ySgDsxrUU3GkrxRcFjjnB9fWM,576
 guarddog/analyzer/sourcecode/npm-exfiltrate-sensitive-data.yml,sha256=UP-GlZ5VykHWFebgIiHrkrQL9PdtjxR99_m2FZddmuw,3011
-guarddog/analyzer/sourcecode/npm-install-script.yml,sha256=5wKz372bvqBdIzXjCUeZthg9iVnbK2ZImTZKwqcWwQc,1067
+guarddog/analyzer/sourcecode/npm-install-script.yml,sha256=0resBD7upjukUWsUEYv9sWLC1bCN8xD1pgCVDAxYa_I,1355
 guarddog/analyzer/sourcecode/npm-obfuscation.yml,sha256=BIyf7PP8F2dTX4BIWDiBOqDg0Wlj6_PRxe5pWMXUqeQ,1815
 guarddog/analyzer/sourcecode/npm-serialize-environment.yml,sha256=gFpr58INp44ZwxYZlIHyzpOgbVMDLv1ZRPTGAczX5dw,835
 guarddog/analyzer/sourcecode/npm-silent-process-execution.yml,sha256=qnJHGesNPNpxGa8n2kQMpttLGck-6vZjI_SsweDyk7M,3513
 guarddog/analyzer/sourcecode/npm-steganography.yml,sha256=XH0udcriAQq_6WOHAG4TpIedw8GgKyWx9gsG_Q_Fki8,915
 guarddog/analyzer/sourcecode/obfuscation.yml,sha256=QgvqJJ8ovyZ4NSjNGJabQiRJTKIExUCevnhLksueh9M,582
-guarddog/analyzer/sourcecode/shady-links.yml,sha256=umHNN1y5G8Tm-vc5_L_s3fTG67yt9kVZWZTlDnTi6Kw,1806
+guarddog/analyzer/sourcecode/shady-links.yml,sha256=a0TDoyVXes13VjSeg6NECtNVJWNigqQU54aELiJZ5qQ,1961
 guarddog/analyzer/sourcecode/silent-process-execution.yml,sha256=b6RjenMv7si7lXGak3uMmD7PMtQRuKPeJFggPW6UDNI,418
 guarddog/analyzer/sourcecode/steganography.yml,sha256=3ceO6SJhu4XpZEjfwelLdOxeZ4Ho1OgUjbcacwtOhR0,606
-guarddog/cli.py,sha256=g9CL8_vQnnNC_H-m-stdP0T1_-QannVp7CTZ-IgverU,13537
+guarddog/cli.py,sha256=P5pc_qkX_SHPHRoPnjjq7au2Vj7GYW906r7dh6ADzg4,13201
 guarddog/ecosystems.py,sha256=kgM4v5E8PZBQksWgzuWwODS5R7P16klDi1SGWKLy1e0,380
 guarddog/reporters/__init__.py,sha256=47DEQpj8HBSa-_TImW-5JCeuQeRkm5NMpJWZG3hSuFU,0
 guarddog/reporters/sarif.py,sha256=44Ixtfk9IhHHaU0MtRLsaBUnPl23kDRuCbtWJ84Z9LA,5866
-guarddog/scanners/__init__.py,sha256=BT4KfdXmJzY6SG0GUVuHJTcBgTP37Yot1PddV3katgw,1005
+guarddog/scanners/__init__.py,sha256=yEsDvThkIAhFkP59gSCFxYe5HTLmoSzfjAkDrtFT1LY,1628
 guarddog/scanners/go_package_scanner.py,sha256=OdCbwtjJow9AxEv34z7WBfgTamqKj5DxJh7dly_1NuY,2926
 guarddog/scanners/go_project_scanner.py,sha256=3D5dYSA7FVqc7IIM7uAHlCJZalshP_WhagWmOcYirog,2123
 guarddog/scanners/npm_package_scanner.py,sha256=qBU0tCbW2pTL3cy5Y4JVAJyAGdvb-HY69qSQmjWbPxU,1968
 guarddog/scanners/npm_project_scanner.py,sha256=L_gqinZit6KHE0dJTRnuJ49U4E3izNf4UBVGkHkiPjw,3585
 guarddog/scanners/pypi_package_scanner.py,sha256=Tg7M837vhNZim3Jy9OMJSQY2C_m9C75UDy0S_5WKT6M,2375
 guarddog/scanners/pypi_project_scanner.py,sha256=NY-xO27r9xIGik7y-btoBKX54_VPSV_RJfeClJDKAkA,5049
-guarddog/scanners/scanner.py,sha256=Jx1EU267GT5cHvQRvFT3ua4Zq459eFxVDtLGKSRO5aU,11494
+guarddog/scanners/scanner.py,sha256=7-OGs8GoRfyexEYOfVRSmV7P-7ZJDXtgj2Z1UrKGx30,10929
 guarddog/utils/__init__.py,sha256=47DEQpj8HBSa-_TImW-5JCeuQeRkm5NMpJWZG3hSuFU,0
-guarddog/utils/archives.py,sha256=jmMoLOew5idgSnvvTVKKPdb8paT9uCEVm7wfBxHuKjI,2335
+guarddog/utils/archives.py,sha256=jOXAhxZx-mTtpDidGGKxQg052CvaQOAVklvOeUn9HTQ,2593
 guarddog/utils/config.py,sha256=KCiGsaeautOo-1p0CSbHY5HWT8cC17-_8tqKH7hPa1E,883
 guarddog/utils/exceptions.py,sha256=23Kzl3exqYK6X-bcGUeb8wPmSglWNX3GIDPkJ6lQzo4,54
 guarddog/utils/package_info.py,sha256=TFjE1xsGNf60SuHlIeDV2pzMUbogl5TKJdSzswat6jI,953
-guarddog-2.0.0.dist-info/LICENSE,sha256=w1aNZxHyoyOPJ4fSdiyrr06tCJZbTjCsH9K1uqeDVyU,11377
-guarddog-2.0.0.dist-info/LICENSE-3rdparty.csv,sha256=cS61ONZL_xlXaTMvQXyBEi3J3es-40Gg6G-6idoa5Qk,314
-guarddog-2.0.0.dist-info/METADATA,sha256=opZAQ_WucUlT9-_nQW2rm3acUeqX8HBGWUUY1hDke5A,1417
-guarddog-2.0.0.dist-info/NOTICE,sha256=nlyNt2IjG8IBoQkb7n6jszwAvmREpKAx0POzFO1s2JM,140
-guarddog-2.0.0.dist-info/WHEEL,sha256=sP946D7jFCHeNz5Iq4fL4Lu-PrWrFsgfLXbbkciIZwg,88
-guarddog-2.0.0.dist-info/entry_points.txt,sha256=vX2fvhnNdkbEL4pDzrH2NqjWVxeOaEYi0sJYmNgS2-s,45
-guarddog-2.0.0.dist-info/RECORD,,
+guarddog-2.0.1.dist-info/LICENSE,sha256=w1aNZxHyoyOPJ4fSdiyrr06tCJZbTjCsH9K1uqeDVyU,11377
+guarddog-2.0.1.dist-info/LICENSE-3rdparty.csv,sha256=cS61ONZL_xlXaTMvQXyBEi3J3es-40Gg6G-6idoa5Qk,314
+guarddog-2.0.1.dist-info/METADATA,sha256=HRjSkYeNAJ7XuQA5C_namTiG6vt0-qpaE-6nNGMhX88,1417
+guarddog-2.0.1.dist-info/NOTICE,sha256=nlyNt2IjG8IBoQkb7n6jszwAvmREpKAx0POzFO1s2JM,140
+guarddog-2.0.1.dist-info/WHEEL,sha256=sP946D7jFCHeNz5Iq4fL4Lu-PrWrFsgfLXbbkciIZwg,88
+guarddog-2.0.1.dist-info/entry_points.txt,sha256=vX2fvhnNdkbEL4pDzrH2NqjWVxeOaEYi0sJYmNgS2-s,45
+guarddog-2.0.1.dist-info/RECORD,,