jscope 0.4.2__py3-none-any.whl

jscope/analyzers/graphql_analyzer.py

@@ -0,0 +1,198 @@
+"""GraphQL Analyzer.
+
+Extracts operations (queries, mutations, subscriptions), their variables and
+root fields from three sources, strongest first:
+  1. precompiled documents   {kind:"OperationDefinition", ...}     (Apollo/codegen bundles)
+  2. gql`...` / graphql(`...`) tagged templates, and strings passed to client calls
+  3. bare string literals that parse as an operation (weakest, LITERAL only)
+plus client/endpoint configuration, introspection use and persisted queries.
+"""
+
+from __future__ import annotations
+
+import re
+
+from jscope.analyzers.base import Analyzer, ProjectContext
+from jscope.analyzers.common import PATH_RE, is_test_path
+from jscope.core.evidence import Candidate, Evidence, EvidenceType as ET
+from jscope.parsing import queries as Q
+
+# header may contain ONLY: name, (variables), @directives -- arbitrary prose before '{' is rejected
+_OP_RE = re.compile(r"^\s*(query|mutation|subscription)\b\s*([A-Za-z_]\w*)?\s*(\([^)]*\))?\s*(?:@\w+(?:\([^)]*\))?\s*)*\{", re.S)
+_VAR_RE = re.compile(r"\$(\w+)\s*:\s*([\w!\[\]]+)")
+_TOKEN_RE = re.compile(r"\{|\}|\([^)]*\)|\.\.\.\s*\w*|[A-Za-z_]\w*(?:\s*:\s*[A-Za-z_]\w*)?")
+_CLIENT_CALLS = {"request", "query", "mutate", "usequery", "usemutation", "uselazyquery", "usesubscription",
+                 "graphql", "gql", "execute", "subscribe"}
+_CLIENT_CTORS = {"apolloclient", "httplink", "createhttplink", "graphqlclient", "createclient", "urqlclient"}
+_ENDPOINT_KEYS = ("uri", "url", "endpoint", "httpurl")
+
+
+def parse_operation(text: str) -> dict | None:
+    text = re.sub(r"\$\{[^}]*\}", "", text)       # drop JS interpolations
+    m = _OP_RE.match(text)
+    if not m:
+        return None
+    op, name, vars_raw = m.group(1), m.group(2), m.group(3) or ""
+    variables = dict(_VAR_RE.findall(vars_raw))
+    depth, fields, i = 0, [], m.end() - 1
+    for tok in _TOKEN_RE.findall(text[i:]):
+        if tok == "{":
+            depth += 1
+        elif tok == "}":
+            depth -= 1
+            if depth == 0:
+                break
+        elif depth == 1 and not tok.startswith(("(", "...")):
+            fields.append(tok.split(":")[-1].strip())
+    if not fields:
+        return None
+    return {"operation": op, "name": name, "variables": variables, "root_fields": fields[:15]}
+
+
+class GraphQLAnalyzer(Analyzer):
+    name = "graphql_analyzer"
+    depends_on = ["framework_detector"]
+    produces_categories = ["graphql", "endpoint"]
+
+    def analyze_project(self, ctx: ProjectContext) -> list[Candidate]:
+        cands: dict[tuple[str, str], Candidate] = {}
+        ctx.shared.setdefault("graphql_ops", {})        # presence == "graphql_analyzer ran"
+
+        def add(cat: str, subject: str, ev: list[Evidence], surface: str | None, test: str | None, meta: dict):
+            c = cands.get((cat, subject))
+            if c is None:
+                c = cands[(cat, subject)] = Candidate(category=cat, subject=subject, analyzer=self.name, evidence=[],
+                                                      attack_surface=surface, suggested_test=test, metadata=dict(meta))
+            c.evidence += ev
+            if cat == "graphql" and meta.get("root_fields") is not None:
+                # shared fact for api_correlation: which schema root fields the client actually uses
+                dead = any(e.type == ET.DEAD_CODE for e in ev)
+                if not dead:
+                    first = next((e for e in ev if e.file), None)
+                    ctx.shared.setdefault("graphql_ops", {})[subject] = {
+                        "operation": meta.get("operation"), "root_fields": list(meta.get("root_fields", [])),
+                        "site": (first.file, first.line) if first else (None, None)}
+
+        for pf in ctx.files:
+            if pf.skipped_reason or pf.tree is None:
+                continue
+            bind = Q.bindings_for(ctx.ast, pf)
+            ops_in_file = 0
+
+            def base_ev(node, typ, desc):
+                ev = [Evidence(typ, desc, self.name, pf.path, pf.line_of(node), pf.node_text(node)[:100].replace("\n", " "))]
+                if ctx.ast.is_in_dead_branch(pf, node):
+                    ev.append(Evidence(ET.DEAD_CODE, "sits in a statically dead branch", self.name))
+                if is_test_path(pf.path):
+                    ev.append(Evidence(ET.TEST_FIXTURE_CONTEXT, "file looks like a test/mock", self.name))
+                return ev
+
+            def emit(info: dict, ev: list[Evidence]):
+                nonlocal ops_in_file
+                ops_in_file += 1
+                label = info["name"] or f"anonymous({','.join(info['root_fields'][:3])})"
+                subject = f"{info['operation']}:{label}"
+                id_vars = [v for v, t in info["variables"].items() if t.rstrip("!").startswith("ID") or re.search(r"id$", v, re.I)]
+                if info["operation"] == "mutation":
+                    test = ("Call this mutation as an unauthenticated and a low-privilege user; check field-level authorization, "
+                            "mass assignment through the input type, and rate limits.")
+                elif info["operation"] == "subscription":
+                    test = "Subscribe as another tenant/user and check for cross-account event leakage."
+                else:
+                    test = "Run as another account and without auth; check object-level authorization on every root field."
+                if id_vars:
+                    test += f" Variable(s) {', '.join('$' + v for v in id_vars)} look like object IDs: swap in another account's IDs (BOLA/IDOR)."
+                add("graphql", subject, ev, "graphql", test,
+                    {**info, "id_like_variables": id_vars})
+
+            for node in ctx.ast.walk(pf.tree.root_node):
+                # 1) precompiled document objects
+                if node.type == "object":
+                    props = Q.object_props(pf, node)
+                    if "kind" in props and pf.node_text(props["kind"]).strip("'\"") == "OperationDefinition" and "operation" in props:
+                        op = pf.node_text(props["operation"]).strip("'\"")
+                        nm = None
+                        if "name" in props:
+                            nm = pf.node_text(Q.object_props(pf, props["name"]).get("value") or props["name"]).strip("'\"")
+                            nm = nm if re.fullmatch(r"\w+", nm or "") else None
+                        fields = []
+                        sel = Q.object_props(pf, props.get("selectionSet")).get("selections")
+                        for item in Q.array_items(sel):
+                            fp = Q.object_props(pf, item)
+                            if "name" in fp:
+                                v = Q.object_props(pf, fp["name"]).get("value")
+                                if v is not None:
+                                    fields.append(pf.node_text(v).strip("'\""))
+                        vs = {}
+                        for item in Q.array_items(props.get("variableDefinitions")):
+                            vp = Q.object_props(pf, item)
+                            try:
+                                vname = pf.node_text(Q.object_props(pf, Q.object_props(pf, vp["variable"])["name"])["value"]).strip("'\"")
+                                vs[vname] = "?"
+                            except KeyError:
+                                pass
+                        if op in ("query", "mutation", "subscription") and (nm or fields):
+                            emit({"operation": op, "name": nm, "variables": vs, "root_fields": fields[:15]},
+                                 base_ev(node, ET.AST_PATTERN_MATCH, "precompiled GraphQL OperationDefinition document"))
+                    continue
+                # 2) gql`...`
+                if node.type == "call_expression":
+                    fn = node.child_by_field_name("function")
+                    args = Q.call_args(node)
+                    name = Q._callee_node_name(ctx.ast, pf, fn) if fn is not None else None
+                    if name and Q.last_segment(name).lower() in ("gql", "graphql") and args and args[0].type == "template_string":
+                        info = parse_operation(pf.node_text(args[0]).strip("`"))
+                        if info:
+                            emit(info, base_ev(node, ET.AST_PATTERN_MATCH, f"{name}`...` tagged template contains a {info['operation']}"))
+                    # client configuration
+                    if name and Q.last_segment(name).lower() in _CLIENT_CTORS and args and args[0].type == "object":
+                        self._client_cfg(ctx, pf, node, args[0], add, base_ev)
+                elif node.type == "new_expression":
+                    ctor = node.child_by_field_name("constructor")
+                    args = Q.call_args(node)
+                    if ctor is not None and pf.node_text(ctor).split(".")[-1].lower() in _CLIENT_CTORS and args and args[0].type == "object":
+                        self._client_cfg(ctx, pf, node, args[0], add, base_ev)
+                # 3) bare strings
+                elif node.type in ("string", "template_string"):
+                    raw = pf.node_text(node).strip("'\"`")
+                    if "__schema" in raw or "IntrospectionQuery" in raw:
+                        add("graphql", "introspection_query", base_ev(node, ET.LITERAL_STRING_MATCH, "introspection query text present"),
+                            "graphql", "Check whether introspection is enabled in production; if so dump the schema and diff against what the UI uses.", {})
+                    if "persistedQuery" in raw or "sha256Hash" in raw:
+                        add("graphql", "persisted_queries", base_ev(node, ET.LITERAL_STRING_MATCH, "persisted-query / sha256Hash reference"),
+                            "graphql", "Test whether the server accepts arbitrary query text or unregistered hashes (allow-list bypass).", {})
+                    info = parse_operation(raw)
+                    if info and node.parent is not None and not (node.parent.type == "arguments" and node.parent.parent is not None
+                                                                  and node.parent.parent.type == "call_expression"
+                                                                  and Q.last_segment(Q._callee_node_name(ctx.ast, pf, node.parent.parent.child_by_field_name("function")) or "").lower() in ("gql", "graphql")):
+                        ev = base_ev(node, ET.LITERAL_STRING_MATCH, "string literal parses as a GraphQL operation")
+                        par, ctxual = node.parent, False
+                        if par.type == "pair" and Q.key_name(pf, par.child_by_field_name("key")) in ("query", "mutation", "subscription", "document"):
+                            ctxual = True
+                        elif par.type == "arguments" and par.parent is not None and par.parent.type == "call_expression":
+                            nm = Q._callee_node_name(ctx.ast, pf, par.parent.child_by_field_name("function")) or ""
+                            ctxual = Q.last_segment(nm).lower() in _CLIENT_CALLS
+                        if ctxual:
+                            ev.append(Evidence(ET.AST_PATTERN_MATCH, "operation text is passed to a GraphQL client / sent as the `query` field", self.name, pf.path, pf.line_of(node)))
+                        emit(info, ev)
+
+            # GraphQL transport calls in a file that actually contains operations
+            if ops_in_file:
+                for site in ctx.ast.find_calls(pf):
+                    if site.args_resolved and site.args_resolved[0].value and PATH_RE.match(site.args_resolved[0].value) \
+                            and "graphql" in site.args_resolved[0].value.lower():
+                        p = site.args_resolved[0].value
+                        add("endpoint", p, [Evidence(ET.AST_PATTERN_MATCH,
+                                                      f"{site.callee}() to a GraphQL endpoint in a file defining {ops_in_file} operation(s)",
+                                                      self.name, pf.path, site.line, site.args_raw[0][:100])],
+                            "graphql", "Send introspection and batched/aliased queries; test per-field authorization.", {})
+        return list(cands.values())
+
+    def _client_cfg(self, ctx, pf, node, obj, add, base_ev) -> None:
+        props = Q.object_props(pf, obj)
+        for key in props:
+            if key.lower() in _ENDPOINT_KEYS:
+                rv = ctx.ast.resolve_value(pf, props[key], Q.bindings_for(ctx.ast, pf))
+                if rv.value and not rv.is_placeholder and PATH_RE.match(rv.value):
+                    add("endpoint", rv.value, base_ev(node, ET.AST_PATTERN_MATCH, f"GraphQL client configured with {key}={rv.value}"),
+                        "graphql", "Send introspection and batched/aliased queries; test per-field authorization.", {})

jscope/analyzers/graphql_schema_analyzer.py

@@ -0,0 +1,132 @@
+"""GraphQL Schema Analyzer (Phase 4).
+
+Reads a schema you already have (SDL file, or introspection JSON saved earlier) and correlates it with the operations the
+client really sends (from graphql_analyzer):
+
+  * client operation + schema agree on a root field -> the client operation finding gains ARTIFACT_RESOLVED from this
+    analyzer, and with it CROSS_ANALYZER_AGREEMENT
+  * sensitive or write root fields no analyzed client operation uses -> `graphql_schema_field` with client_referenced=False
+    (the UI never calls it: test authorization directly)
+  * root fields missing an auth directive that >=3 sibling root fields carry -> `graphql_authz_gap` (absence-based, LOW)
+"""
+
+from __future__ import annotations
+
+import re
+from pathlib import PurePosixPath
+
+from jscope.analyzers.base import Analyzer, ProjectContext
+from jscope.analyzers.common import is_test_path
+from jscope.core.artifacts import KIND_GRAPHQL_SCHEMA, Artifact, structured
+from jscope.core.evidence import Candidate, Evidence, EvidenceType as ET
+from jscope.parsing.graphql_schema import parse_introspection, parse_sdl
+
+_AUTH_DIRECTIVE = re.compile(r"(auth|hasrole|haspermission|permission|protected|private|rbac|authorize|requires|scope|guard)", re.I)
+_SENSITIVE = [
+    ("admin", re.compile(r"(admin|sudo|superuser|impersonat|grant|revoke|role|permission)", re.I)),
+    ("internal", re.compile(r"(internal|private)", re.I)),
+    ("debug", re.compile(r"(debug|diagnostic|_dump)", re.I)),
+    ("payment", re.compile(r"(payment|refund|invoice|billing|charge|payout|subscription(?!s?$))", re.I)),
+    ("export", re.compile(r"(export|download|backup)", re.I)),
+    ("upload", re.compile(r"(upload|import)", re.I)),
+    ("auth", re.compile(r"(password|token|apikey|api_key|secret|session|login|signin|resetpass)", re.I)),
+]
+_ID_ARG = re.compile(r"(^id$|id$)", re.I)
+
+
+def _sensitive(name: str) -> str | None:
+    for tag, rx in _SENSITIVE:
+        if rx.search(name):
+            return tag
+    return None
+
+
+class GraphQLSchemaAnalyzer(Analyzer):
+    name = "graphql_schema_analyzer"
+    depends_on = ["framework_detector"]
+    run_after = ["graphql_analyzer"]
+    produces_categories = ["graphql_schema", "graphql_schema_field", "graphql_authz_gap", "graphql"]
+
+    def analyze_project(self, ctx: ProjectContext) -> list[Candidate]:
+        out: list[Candidate] = []
+        for art in ctx.artifacts_of(KIND_GRAPHQL_SCHEMA):
+            try:
+                out.extend(self._schema(art, ctx))
+            except Exception as exc:                       # noqa: BLE001
+                ctx.diagnostics.append(f"[graphql_schema_analyzer] {art.path}: {type(exc).__name__}: {exc}")
+        return out
+
+    def _schema(self, art: Artifact, ctx: ProjectContext) -> list[Candidate]:
+        out: list[Candidate] = []
+        fname = PurePosixPath(art.path.replace("\\", "/")).name
+        penalty = [Evidence(ET.TEST_FIXTURE_CONTEXT, "schema lives in a test/fixture path", self.name)] if is_test_path(art.path) else []
+        doc = structured(art) if art.path.lower().endswith(".json") else None
+        introspection = isinstance(doc, dict)
+        schema = parse_introspection(doc) if introspection else parse_sdl(art.text)
+        types, roots = schema["types"], schema["roots"]
+        client_ops = ctx.shared.get("graphql_ops") or None   # None => analyzer did not run OR found no client operations: no "unused" claims
+        used: dict[str, set[str]] = {"query": set(), "mutation": set(), "subscription": set()}
+        for op in (client_ops or {}).values():
+            used.setdefault(op.get("operation") or "query", set()).update(op.get("root_fields", []))
+
+        counts = {r: len(types.get(tn, {}).get("fields", {})) for r, tn in roots.items() if tn}
+        out.append(Candidate(
+            category="graphql_schema", subject=fname, analyzer=self.name,
+            evidence=[Evidence(ET.ARTIFACT_RESOLVED, f"GraphQL schema parsed ({'introspection JSON' if introspection else 'SDL'}; "
+                               + ", ".join(f"{k}={v}" for k, v in counts.items()) + f"; {len(types)} types)", self.name, art.path),
+                      Evidence(ET.AST_PATTERN_MATCH, "root operation types located", self.name, art.path)] + penalty,
+            attack_surface="graphql" if introspection else None,
+            suggested_test=("This is an introspection result: check whether introspection is still enabled on the live endpoint, "
+                            "and diff the live schema against this one for newly added fields." if introspection else None),
+            metadata={"file": art.path, "format": "introspection" if introspection else "sdl", "root_field_counts": counts,
+                      "type_count": len(types)}))
+
+        for op_kind, tname in roots.items():
+            if not tname or tname not in types:
+                continue
+            fields = types[tname]["fields"]
+            guarded = [f for f, d in fields.items() if any(_AUTH_DIRECTIVE.search(x) for x in d["directives"])]
+            for fld, d in fields.items():
+                sens = _sensitive(fld)
+                id_args = [a for a, t in d["args"].items() if t.rstrip("!").startswith("ID") or _ID_ARG.search(a)]
+                interesting = op_kind in ("mutation", "subscription") or bool(sens) or bool(id_args)
+                referenced = (fld in used.get(op_kind, set())) if client_ops is not None else None
+                subject = f"{op_kind}:{fld}"
+                if interesting:
+                    surface = sens or ("idor_candidate" if id_args else "graphql")
+                    ev = [Evidence(ET.ARTIFACT_RESOLVED, f"root field defined in schema {fname}", self.name, art.path),
+                          Evidence(ET.AST_PATTERN_MATCH, f"{tname}.{fld}({', '.join(f'{a}: {t}' for a, t in d['args'].items())}): {d['type']}", self.name, art.path)]
+                    if sens:
+                        ev.append(Evidence(ET.NAMING_CONVENTION, f"field name matches '{sens}' naming convention", self.name))
+                    tests = []
+                    if op_kind == "mutation":
+                        tests.append("Call this mutation unauthenticated and as a low-privilege user; check field-level authorization, mass assignment through input types, and rate limits.")
+                    if id_args:
+                        tests.append(f"Argument(s) {', '.join(id_args)} look like object IDs: swap in another account's IDs (BOLA/IDOR).")
+                    if referenced is False:
+                        tests.append("No resolvable client operation uses this field, so the UI may never exercise it: authorization here is often an afterthought. Test it directly.")
+                    out.append(Candidate(
+                        category="graphql_schema_field", subject=subject, analyzer=self.name, evidence=ev + penalty,
+                        attack_surface=surface, suggested_test=" ".join(tests) or None,
+                        metadata={"schema_file": art.path, "args": d["args"], "returns": d["type"], "directives": d["directives"],
+                                  "client_referenced": referenced}))
+                if len(guarded) >= 3 and fld not in guarded and op_kind != "subscription":
+                    out.append(Candidate(
+                        category="graphql_authz_gap", subject=subject, analyzer=self.name,
+                        evidence=[Evidence(ET.AST_PATTERN_MATCH, f"{tname}.{fld} has no auth-style directive, while {len(guarded)} sibling root field(s) do", self.name, art.path),
+                                  Evidence(ET.LITERAL_STRING_MATCH, "siblings carrying a directive: " + ", ".join(guarded[:4]), self.name)] + penalty,
+                        attack_surface="authorization",
+                        suggested_test="Authorization is declared per field here and this one has no declaration. Call it without credentials: a missing directive is a classic gap (the schema may enforce it elsewhere, e.g. in a resolver).",
+                        metadata={"absence_based": True, "schema_file": art.path}))
+
+        # corroborate the client's own operation findings (-> CROSS_ANALYZER_AGREEMENT)
+        for subject, op in (client_ops or {}).items():
+            kind = op.get("operation") or "query"
+            tname = roots.get(kind)
+            fields = types.get(tname, {}).get("fields", {}) if tname else {}
+            known = [f for f in op.get("root_fields", []) if f in fields]
+            if known:
+                out.append(Candidate(
+                    category="graphql", subject=subject, analyzer=self.name,
+                    evidence=[Evidence(ET.ARTIFACT_RESOLVED, f"schema {fname} defines root field(s) {', '.join(known[:3])} on {tname}", self.name, art.path)] + penalty))
+        return out

jscope/analyzers/html_analyzer.py

@@ -0,0 +1,196 @@
+"""HTML Analyzer (Phase 4).
+
+Server-rendered and hybrid apps hide most of their attack surface in markup, not JS: forms, hidden fields, upload
+inputs, third-party scripts. Findings stay evidence-first:
+  * forms become `form` findings and, when the action is a path, `endpoint` candidates -- so an endpoint reached by BOTH
+    a <form> and a JS call earns CROSS_ANALYZER_AGREEMENT like any other independent corroboration
+  * absence-based checks (no CSRF token) are tagged `absence_based` and are LOW by construction
+  * external-script-without-SRI is only reported when the page's own origin is knowable from the document
+    (<base>, canonical, og:url); offline we cannot otherwise tell "third party" from "same site", so we say nothing
+Inline <script> bodies are NOT analyzed here: the pipeline turns them into ParsedFiles for the JS analyzers.
+"""
+
+from __future__ import annotations
+
+import re
+from pathlib import PurePosixPath
+from urllib.parse import urlparse
+
+from bs4 import Comment
+
+from jscope.analyzers.base import Analyzer, ProjectContext
+from jscope.analyzers.common import PATH_RE, classify, is_test_path
+from jscope.core.artifacts import KIND_HTML
+from jscope.core.evidence import Candidate, Evidence, EvidenceType as ET
+from jscope.core.graph import EdgeKind, NodeKind
+from jscope.parsing.html import soup
+
+_CSRF_NAME = re.compile(r"(csrf|xsrf|authenticity_token|_token$|__requestverificationtoken|antiforgery)", re.I)
+_CSRF_META = re.compile(r"(csrf|xsrf)", re.I)
+_WRITE = {"post", "put", "patch", "delete"}
+
+
+def _origin_host(doc) -> str | None:
+    for tag, attr, key in ((doc.find("base", href=True), "href", None),
+                           (doc.find("link", rel="canonical", href=True), "href", None),
+                           (doc.find("meta", property="og:url", content=True), "content", None)):
+        if tag:
+            host = urlparse(tag.get(attr, "")).netloc
+            if host:
+                return host.lower()
+    return None
+
+
+def _snippet(tag) -> str:
+    return re.sub(r"\s+", " ", str(tag))[:140]
+
+
+class HtmlAnalyzer(Analyzer):
+    name = "html_analyzer"
+    depends_on = ["framework_detector"]
+    produces_categories = ["form", "form_csrf", "cleartext_credentials", "html_resource", "csp", "html_comment", "endpoint"]
+
+    def analyze_project(self, ctx: ProjectContext) -> list[Candidate]:
+        out: list[Candidate] = []
+        for art in ctx.artifacts_of(KIND_HTML):
+            try:
+                out.extend(self._page(art, ctx))
+            except Exception as exc:                       # noqa: BLE001  one malformed page must not sink the rest
+                ctx.diagnostics.append(f"[html_analyzer] {art.path}: {type(exc).__name__}: {exc}")
+        return out
+
+    # ------------------------------------------------------------------
+    def _page(self, art, ctx: ProjectContext) -> list[Candidate]:
+        doc = soup(art)
+        out: list[Candidate] = []
+        page = PurePosixPath(art.path.replace("\\", "/")).name
+        test = is_test_path(art.path)
+        g = ctx.graph
+        pid = f"page:{art.path}"
+        g.add_node(pid, NodeKind.PAGE, page, file=art.path)
+
+        def ev(typ, desc, node=None, snippet=None):
+            line = getattr(node, "sourceline", None) if node is not None else None
+            items = [Evidence(typ, desc, self.name, art.path, line, snippet or (_snippet(node) if node is not None else None))]
+            return items
+
+        def test_penalty():
+            return [Evidence(ET.TEST_FIXTURE_CONTEXT, "file looks like a test/mock fixture", self.name)] if test else []
+
+        has_csrf_meta = any(_CSRF_META.search(m.get("name", "")) for m in doc.find_all("meta"))
+
+        # ---- scripts -> graph (page loads file)
+        for tag in doc.find_all("script", src=True):
+            src = tag["src"].strip()
+            parsed = urlparse(src)
+            if not parsed.netloc:
+                target = PurePosixPath(parsed.path).name
+                for pf in ctx.files:
+                    if pf.origin == "disk" and PurePosixPath(pf.path.replace("\\", "/")).name == target and target:
+                        fid = f"file:{pf.path}"
+                        g.add_node(fid, NodeKind.FILE, pf.path)
+                        g.add_edge(pid, fid, EdgeKind.LOADS, self.name, "ARTIFACT_RESOLVED", art.path,
+                                   getattr(tag, "sourceline", None))
+                        break
+
+        # ---- external scripts without SRI (only when our own origin is knowable)
+        host = _origin_host(doc)
+        if host:
+            for tag in list(doc.find_all("script", src=True)) + list(doc.find_all("link", href=True, rel="stylesheet")):
+                url = tag.get("src") or tag.get("href")
+                u = urlparse(url)
+                if u.netloc and u.netloc.lower() != host and not tag.get("integrity"):
+                    out.append(Candidate(
+                        category="html_resource", subject=url, analyzer=self.name,
+                        evidence=ev(ET.AST_PATTERN_MATCH, f"cross-origin ({u.netloc}) resource loaded without Subresource Integrity", tag) + test_penalty(),
+                        attack_surface="supply_chain",
+                        suggested_test="If the third party (or its CDN account/domain) is compromised or expires, this page runs attacker code. Check for takeover of the host and whether an SRI hash or self-hosting is feasible.",
+                        metadata={"page": art.path, "origin_inferred_from": "document"}))
+
+        # ---- meta CSP
+        for m in doc.find_all("meta", attrs={"http-equiv": re.compile("content-security-policy", re.I)}):
+            pol = m.get("content", "")
+            weak = [t for t in ("'unsafe-inline'", "'unsafe-eval'") if t in pol] + (["wildcard source"] if re.search(r"(^|[\s;])\*([\s;]|$)", pol) else [])
+            if weak:
+                out.append(Candidate(
+                    category="csp", subject=f"{page}: weak meta CSP ({', '.join(weak)})", analyzer=self.name,
+                    evidence=ev(ET.AST_PATTERN_MATCH, "CSP <meta> allows " + ", ".join(weak), m)
+                    + [Evidence(ET.LITERAL_STRING_MATCH, "policy text contains the weak directive", self.name)] + test_penalty(),
+                    attack_surface="csp_weak",
+                    suggested_test="A script-src that allows inline/eval weakens XSS containment: look for an HTML/DOM injection sink to pair with it. Also compare against the real response header, which this offline file cannot show."))
+
+        # ---- comments that point at sensitive paths
+        for c in doc.find_all(string=lambda s: isinstance(s, Comment)):
+            for m in re.finditer(r"(?<![\w.])(/[a-zA-Z0-9_\-./]{3,})", str(c)):
+                path = m.group(1)
+                tag = classify(path)
+                if tag in ("admin", "internal", "debug"):
+                    out.append(Candidate(
+                        category="html_comment", subject=path, analyzer=self.name,
+                        evidence=[Evidence(ET.LITERAL_STRING_MATCH, "path mentioned in an HTML comment", self.name, art.path, None, str(c).strip()[:120]),
+                                  Evidence(ET.NAMING_CONVENTION, f"path matches '{tag}' naming convention", self.name)] + test_penalty(),
+                        attack_surface=tag,
+                        suggested_test="Request the path directly; comments often reference routes the UI no longer links to."))
+
+        # ---- forms
+        for i, form in enumerate(doc.find_all("form"), 1):
+            method = (form.get("method") or "get").strip().lower()
+            action = (form.get("action") or "").strip()
+            inputs = form.find_all(["input", "textarea", "select"])
+            types = {(x.get("type") or "text").lower() for x in inputs}
+            names = [x.get("name") for x in inputs if x.get("name")]
+            has_pw, has_file = "password" in types, "file" in types or "multipart" in (form.get("enctype") or "")
+            has_csrf = any(_CSRF_NAME.search(n or "") for n in names) or has_csrf_meta
+            label = action or "(self)"
+            subject = f"{method.upper()} {label} [{page}]"
+            surface = "auth" if has_pw else "upload" if has_file else classify(action) if action else None
+            tests = []
+            if has_pw:
+                tests.append("Test credential handling: rate limiting/lockout, response differences for valid vs invalid users, password-reset and MFA bypass.")
+            if has_file:
+                tests.append("Test upload handling: extension/content-type/magic-byte checks, path traversal in filename, oversized files, stored-XSS via SVG/HTML.")
+            if method in _WRITE and not has_pw and not has_file:
+                tests.append("State-changing form: replay it from another origin/session to check CSRF protection and server-side authorization.")
+            fid = f"form:{art.path}#{i}"
+            g.add_node(fid, NodeKind.FORM, subject, file=art.path, method=method.upper(), fields=sorted(set(names)))
+            g.add_edge(pid, fid, EdgeKind.CONTAINS_FORM, self.name, "AST_PATTERN_MATCH", art.path, getattr(form, "sourceline", None))
+
+            fe = ev(ET.AST_PATTERN_MATCH, f"<form method={method.upper()}> with {len(inputs)} field(s)" + (" incl. password" if has_pw else "") + (" incl. file upload" if has_file else ""), form, _snippet(form)[:140])
+            out.append(Candidate(category="form", subject=subject, analyzer=self.name, evidence=fe + test_penalty(),
+                                 attack_surface=surface, suggested_test=" ".join(tests) or None,
+                                 metadata={"page": art.path, "method": method.upper(), "action": action, "fields": sorted(set(names)),
+                                           "has_password": has_pw, "has_file": has_file, "has_csrf_token": has_csrf}))
+
+            u = urlparse(action)
+            if has_pw and u.scheme == "http":
+                out.append(Candidate(
+                    category="cleartext_credentials", subject=f"{action} [{page}]", analyzer=self.name,
+                    evidence=fe[:1] + [Evidence(ET.LITERAL_STRING_MATCH, "password field submits to a literal http:// URL", self.name, art.path, getattr(form, "sourceline", None), action[:100])] + test_penalty(),
+                    attack_surface="auth",
+                    suggested_test="Credentials posted over cleartext HTTP are exposed to on-path attackers; confirm whether the origin redirects to HTTPS and whether HSTS is set."))
+
+            if method in _WRITE and not has_csrf:
+                out.append(Candidate(
+                    category="form_csrf", subject=subject, analyzer=self.name,
+                    evidence=fe[:1] + [Evidence(ET.LITERAL_STRING_MATCH, "no CSRF-style hidden field in the form and no csrf <meta> in the page", self.name)] + test_penalty(),
+                    attack_surface="csrf_candidate",
+                    suggested_test="Submit the request cross-site without a token. Cookies with SameSite=Lax/Strict or a custom-header requirement may already protect it: this is an absence-based hint only.",
+                    metadata={"absence_based": True}))
+
+            # the form's action is an endpoint too: lets markup and JS corroborate each other
+            path = u.path if (u.netloc or action.startswith("/")) else None
+            if path and not u.query and PATH_RE.match(path) and (not u.netloc or u.scheme in ("http", "https")):
+                idx = ctx.shared.setdefault("js_endpoints", {}).setdefault(
+                    path, {"methods": set(), "reliable_methods": set(), "fetch": False, "sites": []})
+                idx["methods"].add(method.upper())
+                idx["reliable_methods"].add(method.upper())     # a <form> states its method explicitly
+                idx["sites"].append((art.path, getattr(form, "sourceline", None)))
+                g.add_node(f"endpoint:{path}", NodeKind.ENDPOINT, path)
+                g.add_edge(fid, f"endpoint:{path}", EdgeKind.SUBMITS_TO, self.name, "AST_PATTERN_MATCH", art.path, getattr(form, "sourceline", None))
+                etag = classify(path)
+                out.append(Candidate(
+                    category="endpoint", subject=path, analyzer=self.name,
+                    evidence=fe[:1] + [Evidence(ET.LITERAL_STRING_MATCH, "literal form action", self.name)]
+                    + ([Evidence(ET.NAMING_CONVENTION, f"path matches '{etag}' naming convention", self.name)] if etag else []) + test_penalty(),
+                    attack_surface=etag or surface, metadata={"method": method.upper(), "callee": "form"}))
+        return out

jscope/analyzers/manager.py

@@ -0,0 +1,114 @@
+"""AnalyzerManager: topologically sorts analyzers by declared dependencies,
+runs each project-wide, feeds proposed Candidates into the EvidenceEngine.
+
+Phase 2 hardening -- the propose/promote boundary is now ENFORCED AT RUNTIME,
+not just by convention (Python type hints enforce nothing):
+  * anything that is not a Candidate is rejected (analyzers cannot emit Findings)
+  * evidence is re-attributed to the analyzer that actually produced it, so a
+    plugin cannot spoof another analyzer's name to fake CROSS_ANALYZER_AGREEMENT
+  * CROSS_ANALYZER_AGREEMENT (engine-only) and RUNTIME_* (prober-only, see apply_runtime_evidence) evidence is dropped
+  * a per-candidate evidence cap blocks "confidence farming"
+  * one analyzer crashing is recorded as a diagnostic; the run continues
+"""
+
+from __future__ import annotations
+
+import dataclasses
+import traceback
+
+from jscope.analyzers.base import Analyzer, ProjectContext
+from jscope.core.evidence import Candidate, EvidenceEngine, EvidenceType
+
+MAX_EVIDENCE_PER_CANDIDATE = 60
+_FORBIDDEN = {EvidenceType.CROSS_ANALYZER_AGREEMENT, EvidenceType.RUNTIME_CONTEXT, EvidenceType.RUNTIME_NOT_FOUND}
+
+
+class AnalyzerManager:
+    def __init__(self, analyzers: list[Analyzer]):
+        names = [a.name for a in analyzers]
+        dupes = {n for n in names if names.count(n) > 1}
+        if dupes:
+            raise ValueError(f"duplicate analyzer name(s): {', '.join(sorted(dupes))}")
+        self.analyzers = {a.name: a for a in analyzers}
+        self.diagnostics: list[str] = []
+
+    def _topo_sort(self) -> list[Analyzer]:
+        visited: set[str] = set()
+        temp: set[str] = set()
+        order: list[Analyzer] = []
+
+        def visit(name: str):
+            if name in visited:
+                return
+            if name in temp:
+                raise ValueError(f"circular analyzer dependency detected at '{name}'")
+            temp.add(name)
+            for dep in self.analyzers[name].depends_on:
+                if dep not in self.analyzers:
+                    raise ValueError(
+                        f"analyzer '{name}' depends on '{dep}', which is not registered/enabled"
+                    )
+                visit(dep)
+            for dep in getattr(self.analyzers[name], "run_after", []):
+                if dep in self.analyzers:
+                    visit(dep)
+            temp.discard(name)
+            visited.add(name)
+            order.append(self.analyzers[name])
+
+        for name in self.analyzers:
+            visit(name)
+        return order
+
+    def _sanitize(self, analyzer: Analyzer, produced: object) -> list[Candidate]:
+        diag = self.diagnostics
+        if not isinstance(produced, list):
+            diag.append(f"[{analyzer.name}] returned {type(produced).__name__}, expected list[Candidate]; ignored")
+            return []
+        clean: list[Candidate] = []
+        for c in produced:
+            if not isinstance(c, Candidate):
+                diag.append(f"[{analyzer.name}] emitted a {type(c).__name__}; only Candidates are accepted "
+                            "(analyzers cannot create Findings) -- dropped")
+                continue
+            c.analyzer = analyzer.name
+            kept = []
+            for e in c.evidence:
+                if e.type in _FORBIDDEN:
+                    diag.append(f"[{analyzer.name}] tried to emit {e.type.value} on '{c.subject}'; "
+                                "this evidence type is engine-controlled -- dropped")
+                    continue
+                if e.analyzer != analyzer.name:
+                    diag.append(f"[{analyzer.name}] evidence on '{c.subject}' claimed analyzer '{e.analyzer}'; "
+                                "re-attributed")
+                    e = dataclasses.replace(e, analyzer=analyzer.name)
+                kept.append(e)
+            if len(kept) > MAX_EVIDENCE_PER_CANDIDATE:
+                diag.append(f"[{analyzer.name}] '{c.subject}' had {len(kept)} evidence items; "
+                            f"truncated to {MAX_EVIDENCE_PER_CANDIDATE}")
+                kept = kept[:MAX_EVIDENCE_PER_CANDIDATE]
+            c.evidence = kept
+            if kept:
+                clean.append(c)
+        return clean
+
+    def run(self, ctx: ProjectContext, engine: EvidenceEngine, enabled: set[str] | None = None) -> dict[str, int]:
+        """Runs all (or `enabled`-filtered) analyzers in dependency order,
+        proposing every candidate to `engine`. Returns per-analyzer candidate counts."""
+        counts: dict[str, int] = {}
+        for analyzer in self._topo_sort():
+            if enabled is not None and analyzer.name not in enabled:
+                continue
+            try:
+                candidates = self._sanitize(analyzer, analyzer.analyze_project(ctx))
+            except Exception as exc:                      # isolate analyzer failures
+                self.diagnostics.append(
+                    f"[{analyzer.name}] crashed: {type(exc).__name__}: {exc} "
+                    f"({traceback.extract_tb(exc.__traceback__)[-1].name})")
+                counts[analyzer.name] = 0
+                continue
+            counts[analyzer.name] = len(candidates)
+            for c in candidates:
+                engine.propose(c)
+        ctx.diagnostics.extend(self.diagnostics)
+        return counts