narvy-cli 1.0.1__tar.gz → 1.0.3__tar.gz

{narvy_cli-1.0.1/narvy_cli.egg-info → narvy_cli-1.0.3}/PKG-INFO

@@ -1,6 +1,6 @@
 Metadata-Version: 2.4
 Name: narvy-cli
-Version: 1.0.1
+Version: 1.0.3
 Summary: Free, local SAST scanner for Android, iOS, and polyglot web/backend source - plus passive web, host-audit, and cloud-posture scanning.
 Author: Narvy
 License: Apache-2.0

{narvy_cli-1.0.1 → narvy_cli-1.0.3}/narvy/__init__.py

@@ -1,3 +1,3 @@
 """Narvy CLI - free, local SAST for Android, iOS and polyglot source."""
 
-__version__ = "1.0.1"
+__version__ = "1.0.3"

{narvy_cli-1.0.1 → narvy_cli-1.0.3}/narvy/android/source_analyzer.py

@@ -35,6 +35,102 @@ _SKIP_DIR_NAMES = frozenset({
 _NAMESPACE_RE = re.compile(r'\bnamespace\s*=?\s*["\']([\w.]+)["\']')
 _APPLICATION_ID_RE = re.compile(r'\bapplicationId\s*=?\s*["\']([\w.]+)["\']')
 
+# Name-based hardcoded-secret rules prone to preference-key / type-name echoes.
+_SECRET_NAME_RULE_IDS = frozenset({
+    "AND-S-001", "AND-S-002", "AND-S-010",
+    "android-hardcoded-credential-java", "android-hardcoded-credential-kotlin",
+})
+_TYPE_DECL_RE = re.compile(r'\b(?:class|interface|object|enum)\b\s+[A-Za-z_]')
+_QUOTED_RE = re.compile(r'"([^"\n]*)"')
+_IDENT_VALUE_RE = re.compile(r'^[a-z][a-z0-9_]*$')
+_LHS_NAME_RE = re.compile(r'([A-Za-z_][A-Za-z0-9_]*)\s*(?::[^=\n]*)?=\s*"')
+# Preference-key constant naming (KEY_.../PREF_...): its value is a settings-store
+# key string, not a secret.
+_PREFKEY_CONST_RE = re.compile(r'^(?:KEY|PREF|PREFS|PREFERENCE|SETTING|SETTINGS)_', re.IGNORECASE)
+
+# Test / fixture locations where a headline CRITICAL/HIGH is usually a fixture.
+_TEST_PATH_FRAGMENTS = (
+    "/test/", "/tests/", "/androidtest/", "/__tests__/", "/spec/", "/specs/",
+    "/fixtures/", "/fixture/", "/testdata/", "/mocks/", "/__mocks__/",
+)
+_TEST_FILE_RE = re.compile(
+    r"(?:^|[._-])(?:test|tests|spec|specs|mock|mocks|fixture|fixtures)(?:[._-]|$)",
+    re.IGNORECASE,
+)
+
+
+def _line_text(source_dir: str, rel_path: str, line: int) -> str:
+    try:
+        full = os.path.join(source_dir, rel_path)
+        with open(full, "r", encoding="utf-8", errors="ignore") as fh:
+            for i, text in enumerate(fh, start=1):
+                if i == line:
+                    return text
+    except OSError:
+        pass
+    return ""
+
+
+def _is_prefkey_echo_or_typename(line: str) -> bool:
+    """A preference-key-name literal echoing its constant, or a class/type name - not a real secret."""
+    if '"' not in line and _TYPE_DECL_RE.search(line):
+        return True
+    m = _QUOTED_RE.search(line)
+    if not m:
+        return False
+    val = m.group(1)
+    if not _IDENT_VALUE_RE.match(val):
+        return False
+    lhs = _LHS_NAME_RE.search(line)
+    if not lhs:
+        return False
+    name = lhs.group(1)
+    # Echo: the value repeats the constant name, or the constant is a KEY_*/PREF_*
+    # preference-key holding a settings-store key slug (e.g. KEY_SECRET_TOKEN =
+    # "secret_token_pref").
+    return val.lower() in name.lower() or bool(_PREFKEY_CONST_RE.match(name))
+
+
+def _has_no_string_literal_rhs(line: str) -> bool:
+    """A name-based secret match whose right-hand side has NO string literal - a
+    function call or identifier (e.g. `val apiKey = getApiKeyOrDefault()`), not a
+    hardcoded secret. A real hardcoded secret is always a quoted literal."""
+    return not _QUOTED_RE.search(line)
+
+
+def _drop_prefkey_echo_secrets(source_dir: str, findings: List[Dict[str, Any]]) -> List[Dict[str, Any]]:
+    kept = []
+    for f in findings:
+        if f.get("rule_id") in _SECRET_NAME_RULE_IDS:
+            line = _line_text(source_dir, f.get("file_path", ""), f.get("line") or 0)
+            if line and (_has_no_string_literal_rhs(line) or _is_prefkey_echo_or_typename(line)):
+                continue
+        kept.append(f)
+    return kept
+
+
+def _is_test_path(rel_path: str) -> bool:
+    p = "/" + rel_path.replace("\\", "/").lstrip("/")
+    if any(frag in p.lower() for frag in _TEST_PATH_FRAGMENTS):
+        return True
+    return bool(_TEST_FILE_RE.search(p.rsplit("/", 1)[-1]))
+
+
+def _downrank_test_findings(findings: List[Dict[str, Any]]) -> List[Dict[str, Any]]:
+    """Lower (never drop) CRITICAL/HIGH/MEDIUM findings in test/fixture paths to LOW and tag them."""
+    note = (
+        " [Narvy: this hit is in a test/fixture path, where such code is usually a "
+        "fixture rather than shipped app code, so severity is lowered - confirm it "
+        "is not a real production issue.]"
+    )
+    for f in findings:
+        if f.get("severity") in ("CRITICAL", "HIGH", "MEDIUM") and _is_test_path(f.get("file_path", "")):
+            f["severity"] = "LOW"
+            details = f.setdefault("details", {})
+            if isinstance(details, dict) and note.strip() not in (details.get("description") or ""):
+                details["description"] = (details.get("description") or "") + note
+    return findings
+
 # A module may use either source-root name, or both.
 _SRC_LEAF_DIRS = ("java", "kotlin")
 _MAX_INFER_DEPTH = 12
@@ -254,6 +350,9 @@ def analyze_source(source_dir: str, override_config: Optional[ScopeConfig] = Non
 
     rule_defs = list(rules) + semgrep_rule_defs
 
+    all_findings = _drop_prefkey_echo_secrets(source_dir, all_findings)
+    all_findings = _downrank_test_findings(all_findings)
+
     return {
         "ok": True,
         "error": None,

{narvy_cli-1.0.1 → narvy_cli-1.0.3}/narvy/apk_memory_preflight.py

@@ -209,9 +209,9 @@ def check_memory_preflight(apk_path: str, max_mem: str,
                 f"\n\nRaising --max-mem on its own will not be enough: {suggest_gb}g of heap needs "
                 f"roughly {_fmt_mb(need_rss_mb)} of real memory, and this machine only has "
                 f"{_fmt_mb(available_mb)} available right now. Options:\n"
-                f"  - free up that much memory (close other apps), then re-run with --max-mem {suggest_gb}g\n"
-                f"  - scan this app on a bigger machine, or use the hosted scan (`--upload`)\n"
-                f"  - run it anyway with --force if you know your setup can take it"
+                f"  - use the hosted scan (`--upload`): the platform decompiles any app size with no local memory ceiling\n"
+                f"  - or free up that much memory (close other apps) and re-run with --max-mem {suggest_gb}g\n"
+                f"  - or run it anyway with --force if your setup can take it"
             )
         else:
             avail_note = (f" (this machine has {_fmt_mb(available_mb)} available)"

narvy_cli-1.0.3/narvy/ci_templates/bitbucket.yml

@@ -0,0 +1,15 @@
+# Narvy SAST for Bitbucket Pipelines. Written by `narvy init-ci --bitbucket`; edit freely.
+# Already have a bitbucket-pipelines.yml? Copy the step below into it instead of overwriting.
+# Note: SARIF is stored as a build artifact (not Code Insights); the --fail-on gate still fails the build.
+image: python:3.11
+
+pipelines:
+  default:
+    - step:
+        name: Narvy SAST
+        script:
+          - pip install --upgrade pip
+          - pip install narvy-cli
+          - narvy scan . --output sarif --file narvy-results.sarif --fail-on high
+        artifacts:
+          - narvy-results.sarif

narvy_cli-1.0.3/narvy/ci_templates/github.yml

@@ -0,0 +1,48 @@
+# Narvy SAST for GitHub Actions. Written by `narvy init-ci --github`; edit freely.
+# Scans this repo, uploads SARIF to the Security tab, and fails the build on --fail-on.
+name: Narvy SAST
+
+on:
+  push:
+    branches: [ main, master ]
+  pull_request:
+  workflow_dispatch:
+
+permissions:
+  contents: read
+  security-events: write   # required to upload SARIF to code scanning
+
+jobs:
+  narvy:
+    runs-on: ubuntu-latest
+    steps:
+      - uses: actions/checkout@v4
+
+      - uses: actions/setup-python@v5
+        with:
+          python-version: '3.11'
+
+      - name: Install Narvy CLI
+        run: |
+          python -m pip install --upgrade pip
+          pip install narvy-cli
+
+      - name: Run Narvy scan
+        # SARIF is written before the --fail-on gate, so the Security tab fills even on a failing build.
+        run: |
+          narvy scan . \
+            --output sarif \
+            --file narvy-results.sarif \
+            --fail-on high
+
+      - name: Upload SARIF to GitHub code scanning
+        if: always()   # upload even when the scan step failed the build via --fail-on
+        uses: github/codeql-action/upload-sarif@v3
+        with:
+          sarif_file: narvy-results.sarif
+
+# To also scan a web app URL, add a step:
+#   - run: narvy web-scan "https://staging.example.com" --format sarif --output-file web.sarif --fail-on high
+#   - if: always()
+#     uses: github/codeql-action/upload-sarif@v3
+#     with: { sarif_file: web.sarif, category: narvy-web }

narvy_cli-1.0.3/narvy/ci_templates/gitlab.yml

@@ -0,0 +1,19 @@
+# Narvy SAST for GitLab CI. Written by `narvy init-ci --gitlab`; edit freely.
+# Already have a .gitlab-ci.yml? Copy the narvy_sast job below into it instead of overwriting.
+# Note: SARIF is stored as a plain artifact (not GitLab's SAST schema), but the --fail-on gate still blocks the MR.
+stages:
+  - test
+
+narvy_sast:
+  stage: test
+  image: python:3.11-slim
+  before_script:
+    - pip install --upgrade pip
+    - pip install narvy-cli
+  script:
+    - narvy scan . --output sarif --file narvy-results.sarif --fail-on high
+  artifacts:
+    when: always   # keep the SARIF even when --fail-on failed the pipeline
+    paths:
+      - narvy-results.sarif
+    expire_in: 1 week

{narvy_cli-1.0.1 → narvy_cli-1.0.3}/narvy/doctor.py

@@ -87,7 +87,7 @@ def _check_icdump():
     else:
         detail = "Not installed - iOS binary scans will fall back to symbol-table-only Obj-C detection"
     return True, detail, (
-        "Optional: `pip install narvy[ios-full]` (Linux/macOS/WSL only - no Windows wheel exists) "
+        "Optional: `pip install narvy-cli[ios-full]` (Linux/macOS/WSL only - no Windows wheel exists) "
         "for full Obj-C class/method/property introspection on .ipa scans. Not required - iOS binary "
         "scanning still works without it, just with coarser Obj-C detection (class names only, via LIEF's "
         "symbol table, no methods/properties/protocols)."
@@ -110,10 +110,10 @@ def _check_memory():
     )
     if avail < 5 * 1024:
         return True, detail, (
-            "Large commercial apps (large production app scale) need 8-24 GB of free "
-            "memory to decompile. `narvy scan` will tell you before it starts, and "
-            "won't waste your time failing halfway - but on this machine expect to be "
-            "limited to smaller apps, or use `--upload` for the hosted scan."
+            "Large commercial apps need 8-24 GB of free memory to decompile locally. "
+            "The hosted scan (`--upload`) removes the local memory ceiling and handles "
+            "any app size - use it for large apps, or scan locally within this "
+            "machine's memory."
         )
     return True, detail, None
 
@@ -183,7 +183,7 @@ def _check_boto3():
     except ImportError:
         return True, "Not installed", (
             "Needed only for `narvy cloud-scan`. Run: "
-            "pip install narvy[cloud]"
+            "pip install narvy-cli[cloud]"
         )
 
 

{narvy_cli-1.0.1 → narvy_cli-1.0.3}/narvy/ios/binary_analyzer.py

@@ -1021,25 +1021,15 @@ def analyze_ipa(ipa_path: str, override_config: Optional[ScopeConfig] = None) ->
                 result["encrypted"] = encrypted
                 if encrypted:
                     result["encrypted_message"] = (
-                        "This IPA is FairPlay-encrypted (Apple's App Store DRM, cryptid=1): "
-                        "the executable __TEXT code is ciphertext until the device that "
-                        "purchased/installed it decrypts it at launch time using a key Apple "
-                        "grants only to that device - no static analysis tool, Narvy "
-                        "included, can read the actual instruction stream of an encrypted "
-                        "App Store export. This is a physical limitation of the distribution "
-                        "format, not a gap in this scanner. What still works and was still "
-                        "run: Info.plist / entitlements / URL-scheme / ATS analysis (always "
-                        "cleartext), linked-framework and embedded-framework-name listing "
-                        "(load commands are never encrypted), and Objective-C class/method "
-                        "metadata recovery (this metadata typically lives outside the "
-                        "encrypted __TEXT range). What is unreliable: weak-"
-                        "crypto/hardcoded-secret/dangerous-API string matching against the "
-                        "app's OWN literal string constants, since those live inside the "
-                        "encrypted region and read as ciphertext noise - expect a near-empty "
-                        "result for those specific checks, not a false 'clean bill of "
-                        "health'. The ONLY way to read that encrypted code is a decrypted "
-                        "binary (a jailbroken-device dump). `--upload` does NOT decrypt "
-                        "anything: the same encrypted binary is analysed, not decrypted."
+                        "This IPA is FairPlay-encrypted (Apple App Store DRM). Narvy covers "
+                        "it across two surfaces. The hosted engine runs its full rule set + "
+                        "ML triage + MASVS mapping over the readable, cleartext surface "
+                        "(Info.plist, entitlements, URL schemes / ATS, linked and embedded "
+                        "frameworks, Objective-C class/method metadata), and Narvy dynamic "
+                        "analysis executes the app decrypted on a real device to cover the "
+                        "app's own code and strings. This local run reads the cleartext "
+                        "surface only - run `narvy scan --upload` and Narvy dynamic analysis "
+                        "on the platform for the complete picture of this app."
                     )
 
                 findings = _analyze_one_binary(main_binary_path, exe_name, is_main_binary=True)
@@ -1087,7 +1077,7 @@ def analyze_ipa(ipa_path: str, override_config: Optional[ScopeConfig] = None) ->
                     result["notes"].append(
                         "icdump not installed - full Obj-C class/method/property "
                         "introspection needs Linux/macOS/WSL "
-                        "(pip install narvy[ios-full]). Falling back to binary "
+                        "(pip install narvy-cli[ios-full]). Falling back to binary "
                         "symbol-table scanning only."
                     )
                 result["icdump_used"] = icdump_used