guarddog 2.4.0__py3-none-any.whl → 2.5.0__py3-none-any.whl

guarddog/analyzer/metadata/pypi/typosquatting.py

@@ -39,7 +39,7 @@ class PypiTyposquatDetector(TyposquatDetector):
                 }
         """
 
-        popular_packages_url = "https://hugovk.github.io/top-pypi-packages/top-pypi-packages-30-days.min.json"
+        popular_packages_url = "https://hugovk.github.io/top-pypi-packages/top-pypi-packages.min.json"
 
         top_packages_filename = "top_pypi_packages.json"
         resources_dir = TOP_PACKAGES_CACHE_LOCATION

guarddog/analyzer/sourcecode/shady-links.yml

@@ -41,7 +41,7 @@ rules:
             - pattern-regex: ((?:https?:\/\/)?[^\n\[\/\?#"']*?(ipinfo\.io|checkip\.dyndns\.org|\bip\.me|jsonip\.com|ipify\.org|ifconfig\.me)\b)
 
             # top-level domains
-            - pattern-regex: (https?:\/\/[^\n\[\/\?#"']*?\.(link|xyz|tk|ml|ga|cf|gq|pw|top|club|mw|bd|ke|am|sbs|date|quest|cd|bid|cd|ws|icu|cam|uno|email|stream)\/)
+            - pattern-regex: (https?:\/\/[^\n\[\/\?#"']*?\.(link|xyz|tk|ml|ga|cf|gq|pw|top|club|mw|bd|ke|am|sbs|date|quest|cd|bid|cd|ws|icu|cam|uno|email|stream|zip)\/)
             # IPv4
             - pattern-regex: (https?:\/\/[^\n\[\/\?#"']*?(?:\d{1,3}\.\d{1,3}\.\d{1,3}\.\d{1,3}))
             # IPv6

guarddog/scanners/__init__.py

@@ -1,5 +1,6 @@
 from typing import Optional
 
+from .github_action_project_scanner import GitHubActionDependencyScanner
 from .npm_package_scanner import NPMPackageScanner
 from .npm_project_scanner import NPMRequirementsScanner
 from .pypi_package_scanner import PypiPackageScanner
@@ -54,4 +55,6 @@ def get_project_scanner(ecosystem: ECOSYSTEM) -> Optional[ProjectScanner]:
             return NPMRequirementsScanner()
         case ECOSYSTEM.GO:
             return GoDependenciesScanner()
+        case ECOSYSTEM.GITHUB_ACTION:
+            return GitHubActionDependencyScanner()
     return None

guarddog/scanners/github_action_project_scanner.py

@@ -0,0 +1,101 @@
+import logging
+from typing import List, Dict, TypedDict
+from typing_extensions import NotRequired
+
+import yaml
+import re
+
+from guarddog.scanners.github_action_scanner import GithubActionScanner
+from guarddog.scanners.scanner import ProjectScanner
+
+log = logging.getLogger("guarddog")
+
+
+class GitHubWorkflowStep(TypedDict):
+    name: NotRequired[str]
+    uses: NotRequired[str]
+
+
+class GitHubWorkflowJob(TypedDict):
+    name: str
+    uses: str
+    runs_on: str
+    steps: List[GitHubWorkflowStep]
+
+
+class GitHubWorkflowFile(TypedDict):
+    name: str
+    jobs: Dict[str, GitHubWorkflowJob]
+
+
+class GitHubAction(TypedDict):
+    name: str
+    ref: str
+
+
+def parse_action_from_step(step: GitHubWorkflowStep) -> GitHubAction | None:
+    """
+    Parses a step in a GitHub workflow file and returns a GitHub action reference if it exists.
+
+    Args:
+        step (GitHubWorkflowStep): Step in a GitHub workflow file
+
+    Returns:
+        GitHubAction | None: GitHub action reference if it exists, None otherwise
+    """
+    if "uses" not in step:
+        return None
+
+    if step["uses"].startswith("/") or step["uses"].startswith("./"):
+        return None
+    parts = step["uses"].split("@", 1)
+    if len(parts) != 2:
+        log.debug(f"Invalid action reference: {step['uses']}")
+        return None
+
+    if re.search(r"^([\w-])+/([\w./-])+$", parts[0]):
+        return GitHubAction(name=parts[0], ref=parts[1])
+    return None
+
+
+class GitHubActionDependencyScanner(ProjectScanner):
+    """
+    Scans all 3rd party actions in a GitHub workflow file.
+    """
+
+    def __init__(self) -> None:
+        super().__init__(GithubActionScanner())
+
+    def parse_requirements(self, raw_requirements: str) -> dict[str, set[str]]:
+        actions = self.parse_workflow_3rd_party_actions(raw_requirements)
+
+        requirements: dict[str, set[str]] = {}
+        for action in actions:
+            repo, version = action["name"], action["ref"]
+            if repo in requirements:
+                requirements[repo].add(version)
+            else:
+                requirements[repo] = {version}
+        return requirements
+
+    def parse_workflow_3rd_party_actions(
+        self, workflow_file: str
+    ) -> List[GitHubAction]:
+        """
+        Parses a GitHub workflow file and returns a list of 3rd party actions
+        used in the workflow.
+
+        Args:
+            workflow_file (str): Contents of the GitHub workflow file
+
+        Returns:
+            List[GitHubAction]: List of 3rd party actions used in the workflow
+        """
+        f: GitHubWorkflowFile = yaml.safe_load(workflow_file)
+        actions = []
+        for job in f.get("jobs", {}).values():
+            for step in job.get("steps", []):
+                action = parse_action_from_step(step)
+                if action:
+                    actions.append(action)
+        return actions

{guarddog-2.4.0.dist-info → guarddog-2.5.0.dist-info}/METADATA

@@ -1,6 +1,6 @@
 Metadata-Version: 2.3
 Name: guarddog
-Version: 2.4.0
+Version: 2.5.0
 Summary: GuardDog is a CLI tool to Identify malicious PyPI packages
 License: Apache-2.0
 Author: Ellen Wang
@@ -15,7 +15,7 @@ Requires-Dist: click (>=8.1.3,<9.0.0)
 Requires-Dist: click-option-group (>=0.5.5,<0.6.0)
 Requires-Dist: colorama (>=0.4.6,<0.5.0)
 Requires-Dist: configparser (>=5.3,<8.0)
-Requires-Dist: disposable-email-domains (>=0.0.103,<0.0.118)
+Requires-Dist: disposable-email-domains (>=0.0.103,<0.0.119)
 Requires-Dist: prettytable (>=3.6.0,<4.0.0)
 Requires-Dist: pygit2 (>=1.11,<1.18)
 Requires-Dist: python-dateutil (>=2.8.2,<3.0.0)

{guarddog-2.4.0.dist-info → guarddog-2.5.0.dist-info}/RECORD

@@ -30,7 +30,7 @@ guarddog/analyzer/metadata/pypi/potentially_compromised_email_domain.py,sha256=3
 guarddog/analyzer/metadata/pypi/release_zero.py,sha256=GSHap4VSVF9_s3gD95kUD_5eZDHxrqQQoV5aFTgzrCw,716
 guarddog/analyzer/metadata/pypi/repository_integrity_mismatch.py,sha256=HNVEOj3cz43qHD47Chul05vpX_9uhfaPgjo6Q-fuCfA,11635
 guarddog/analyzer/metadata/pypi/single_python_file.py,sha256=CLAWaOJ_JNofGmtuCOT-37saryHeZzZAjfJQp31H6jU,1369
-guarddog/analyzer/metadata/pypi/typosquatting.py,sha256=Cn3r_2apz2rP2UGMggYNmtQlrDCq3ZDS_ix5TVj9FIk,4726
+guarddog/analyzer/metadata/pypi/typosquatting.py,sha256=Lk0MoIfsMw557PrpUxLAynqNhWSjZDSVI7GJPdyvoG8,4718
 guarddog/analyzer/metadata/pypi/unclaimed_maintainer_email_domain.py,sha256=4u3s4Jq51arMznv-_0NwZst40x7jGtLJQIEd3Pp2U30,406
 guarddog/analyzer/metadata/pypi/utils.py,sha256=7ipsnFN1KHcFwU9u1GK8wqINKDCXJ1vQEpTwwZfJFp4,199
 guarddog/analyzer/metadata/release_zero.py,sha256=7cIdReF3TU3XJq6ALemK81tqaG3Cz1HNwwtH65Y9uPU,438
@@ -59,14 +59,15 @@ guarddog/analyzer/sourcecode/npm-serialize-environment.yml,sha256=gFpr58INp44Zwx
 guarddog/analyzer/sourcecode/npm-silent-process-execution.yml,sha256=qnJHGesNPNpxGa8n2kQMpttLGck-6vZjI_SsweDyk7M,3513
 guarddog/analyzer/sourcecode/npm-steganography.yml,sha256=XH0udcriAQq_6WOHAG4TpIedw8GgKyWx9gsG_Q_Fki8,915
 guarddog/analyzer/sourcecode/obfuscation.yml,sha256=dp0BeCYShcTS8QiijSa9U53r6jkCjrFBW5jjNVoXdUU,1224
-guarddog/analyzer/sourcecode/shady-links.yml,sha256=nbq1WLZGVGpriHcPcpBOo39vfYtFU3fU6w3glG2NeQk,3083
+guarddog/analyzer/sourcecode/shady-links.yml,sha256=Jl2XO6O9vwyhfaj7K3u7-OtB4oQxKcdyb6-_qCrBdUo,3087
 guarddog/analyzer/sourcecode/silent-process-execution.yml,sha256=b6RjenMv7si7lXGak3uMmD7PMtQRuKPeJFggPW6UDNI,418
 guarddog/analyzer/sourcecode/steganography.yml,sha256=3ceO6SJhu4XpZEjfwelLdOxeZ4Ho1OgUjbcacwtOhR0,606
 guarddog/cli.py,sha256=TJT2yxoUokhoDm7P_FF-x0B9zbtxgDou5BFbu4vSWm4,13168
 guarddog/ecosystems.py,sha256=1-emct9cGLU3V0drEdNmGFEmxMEmJHEQOuyOiuuoCGA,489
 guarddog/reporters/__init__.py,sha256=47DEQpj8HBSa-_TImW-5JCeuQeRkm5NMpJWZG3hSuFU,0
 guarddog/reporters/sarif.py,sha256=92HjvASZFyv5otB1qbsUqj6423tNgZbmSQS4qApffAw,5820
-guarddog/scanners/__init__.py,sha256=rWKVvLADz9G0nraNwiJIiSuLFb9p8u_V4qAl7HVt3jw,1762
+guarddog/scanners/__init__.py,sha256=KNZcGjKNPOs60qpOE8Hr_HsiaRIpJLNzA8qbyvebRIk,1924
+guarddog/scanners/github_action_project_scanner.py,sha256=FY5UEIGeQlmyyjh2Z1LDXsHnzfs2gCQ-wIurpbPvXN4,2847
 guarddog/scanners/github_action_scanner.py,sha256=GxhUSetLvT8YxKUIZue9MWOE_IVugM2MdiluOy4f068,1745
 guarddog/scanners/go_package_scanner.py,sha256=OdCbwtjJow9AxEv34z7WBfgTamqKj5DxJh7dly_1NuY,2926
 guarddog/scanners/go_project_scanner.py,sha256=3D5dYSA7FVqc7IIM7uAHlCJZalshP_WhagWmOcYirog,2123
@@ -80,10 +81,10 @@ guarddog/utils/archives.py,sha256=jOXAhxZx-mTtpDidGGKxQg052CvaQOAVklvOeUn9HTQ,25
 guarddog/utils/config.py,sha256=Msz7altsmNKry0vBPtL2BJ_VdBXsBFZX5ksLvXc2ix4,1403
 guarddog/utils/exceptions.py,sha256=23Kzl3exqYK6X-bcGUeb8wPmSglWNX3GIDPkJ6lQzo4,54
 guarddog/utils/package_info.py,sha256=TFjE1xsGNf60SuHlIeDV2pzMUbogl5TKJdSzswat6jI,953
-guarddog-2.4.0.dist-info/LICENSE,sha256=w1aNZxHyoyOPJ4fSdiyrr06tCJZbTjCsH9K1uqeDVyU,11377
-guarddog-2.4.0.dist-info/LICENSE-3rdparty.csv,sha256=cS61ONZL_xlXaTMvQXyBEi3J3es-40Gg6G-6idoa5Qk,314
-guarddog-2.4.0.dist-info/METADATA,sha256=WsXluo_bRC7j4N5BJMceuhQkvhdURMZMz7T3xY9e8fY,1432
-guarddog-2.4.0.dist-info/NOTICE,sha256=nlyNt2IjG8IBoQkb7n6jszwAvmREpKAx0POzFO1s2JM,140
-guarddog-2.4.0.dist-info/WHEEL,sha256=IYZQI976HJqqOpQU6PHkJ8fb3tMNBFjg-Cn-pwAbaFM,88
-guarddog-2.4.0.dist-info/entry_points.txt,sha256=vX2fvhnNdkbEL4pDzrH2NqjWVxeOaEYi0sJYmNgS2-s,45
-guarddog-2.4.0.dist-info/RECORD,,
+guarddog-2.5.0.dist-info/LICENSE,sha256=w1aNZxHyoyOPJ4fSdiyrr06tCJZbTjCsH9K1uqeDVyU,11377
+guarddog-2.5.0.dist-info/LICENSE-3rdparty.csv,sha256=cS61ONZL_xlXaTMvQXyBEi3J3es-40Gg6G-6idoa5Qk,314
+guarddog-2.5.0.dist-info/METADATA,sha256=ZqDqDVCnZh05Dgy9jpJ4SKqEX9ltSWJR15Qd5ATC9QI,1432
+guarddog-2.5.0.dist-info/NOTICE,sha256=nlyNt2IjG8IBoQkb7n6jszwAvmREpKAx0POzFO1s2JM,140
+guarddog-2.5.0.dist-info/WHEEL,sha256=XbeZDeTWKc1w7CSIyre5aMDU_-PohRwTQceYnisIYYY,88
+guarddog-2.5.0.dist-info/entry_points.txt,sha256=vX2fvhnNdkbEL4pDzrH2NqjWVxeOaEYi0sJYmNgS2-s,45
+guarddog-2.5.0.dist-info/RECORD,,

{guarddog-2.4.0.dist-info → guarddog-2.5.0.dist-info}/WHEEL

@@ -1,4 +1,4 @@
 Wheel-Version: 1.0
-Generator: poetry-core 2.0.1
+Generator: poetry-core 2.1.1
 Root-Is-Purelib: true
 Tag: py3-none-any