patchi 0.7.5__py3-none-any.whl

patchi/core/campaigns/data_flow_abuse.py

@@ -0,0 +1,153 @@
+"""DataFlowAbuseCampaign — test data flow security.
+
+Maps data flows, tests sanitization, encoding bypass, cross-boundary
+flows, and security meaning changes.
+"""
+
+from __future__ import annotations
+
+import logging
+
+from .base import Campaign, CampaignStep
+
+_log = logging.getLogger("patchi.core.campaigns.data_flow_abuse")
+
+
+class DataFlowAbuseCampaign(Campaign):
+    """Test data flow injection and security meaning."""
+
+    name = "data_flow_abuse"
+    description = "Tests data flow injection and security"
+
+    def steps(self) -> list[CampaignStep]:
+        return [
+            CampaignStep(name="map_flows", description="Map all data flows from the graph"),
+            CampaignStep(
+                name="identify_transformations",
+                description="Identify data transformations in flows",
+            ),
+            CampaignStep(
+                name="test_sanitization", description="Test sanitization on sensitive flows"
+            ),
+            CampaignStep(
+                name="test_encoding_bypass", description="Test encoding bypass on transformations"
+            ),
+            CampaignStep(name="test_cross_boundary", description="Test cross-boundary data flows"),
+            CampaignStep(name="test_security_meaning", description="Test security meaning changes"),
+        ]
+
+    def _execute_step(self, step: CampaignStep) -> None:
+        if step.name == "map_flows":
+            self._map_flows(step)
+        elif step.name == "identify_transformations":
+            self._identify_transformations(step)
+        elif step.name == "test_sanitization":
+            self._test_sanitization(step)
+        elif step.name == "test_encoding_bypass":
+            self._test_encoding_bypass(step)
+        elif step.name == "test_cross_boundary":
+            self._test_cross_boundary(step)
+        elif step.name == "test_security_meaning":
+            self._test_security_meaning(step)
+
+    def _map_flows(self, step: CampaignStep) -> None:
+        """Map all data flows mentioned in the graph."""
+        flows: list[dict] = []
+        for claim in self._graph.claims.values():
+            for ev in claim.evidence:
+                a = ev.artifact
+                if "source" in a and "sink" in a:
+                    flows.append(
+                        {
+                            "source": a["source"],
+                            "sink": a["sink"],
+                            "sanitized": a.get("sanitized", False),
+                            "cross_boundary": a.get("cross_boundary", False),
+                        }
+                    )
+
+        if not flows:
+            step.findings.append(
+                {
+                    "type": "no_flows_found",
+                    "severity": "info",
+                    "detail": "No data flows discovered from the assurance graph",
+                }
+            )
+        else:
+            step.findings.append(
+                {
+                    "type": "flows_mapped",
+                    "severity": "info",
+                    "detail": f"Found {len(flows)} data flows",
+                }
+            )
+
+    def _identify_transformations(self, step: CampaignStep) -> None:
+        """Check for unsanitized transformations in data flows."""
+        for claim in self._graph.claims.values():
+            for ev in claim.evidence:
+                a = ev.artifact
+                if "source" in a and "sink" in a:
+                    if not a.get("sanitized", True):
+                        step.findings.append(
+                            {
+                                "type": "unsanitized_flow",
+                                "severity": "high",
+                                "detail": f"Unsanitized flow: {a['source']} → {a['sink']}",
+                            }
+                        )
+
+    def _test_sanitization(self, step: CampaignStep) -> None:
+        """Test that sensitive data flows are properly sanitized."""
+        for claim in self._graph.claims.values():
+            if "sanitiz" in claim.statement.lower():
+                if claim.verdict.value == "disproved":
+                    step.findings.append(
+                        {
+                            "type": "sanitization_bypass",
+                            "severity": "critical",
+                            "detail": f"Sanitization bypassed: {claim.statement}",
+                        }
+                    )
+
+    def _test_encoding_bypass(self, step: CampaignStep) -> None:
+        """Test for encoding bypass on data transformations."""
+        for claim in self._graph.claims.values():
+            if "encod" in claim.statement.lower() or "transform" in claim.statement.lower():
+                if claim.verdict.value == "disproved":
+                    step.findings.append(
+                        {
+                            "type": "encoding_bypass",
+                            "severity": "high",
+                            "detail": f"Encoding bypass found: {claim.statement}",
+                        }
+                    )
+
+    def _test_cross_boundary(self, step: CampaignStep) -> None:
+        """Test that cross-boundary flows have proper controls."""
+        for claim in self._graph.claims.values():
+            for ev in claim.evidence:
+                a = ev.artifact
+                if a.get("cross_boundary", False):
+                    if ev.supports:  # evidence supports that it's uncontrolled
+                        step.findings.append(
+                            {
+                                "type": "uncontrolled_cross_boundary",
+                                "severity": "critical",
+                                "detail": f"Cross-boundary flow without controls: {a.get('source', '?')} → {a.get('sink', '?')}",
+                            }
+                        )
+
+    def _test_security_meaning(self, step: CampaignStep) -> None:
+        """Test that data flow transformations don't change security meaning."""
+        for claim in self._graph.claims.values():
+            if "meaning" in claim.statement.lower() and "security" in claim.statement.lower():
+                if claim.verdict.value == "disproved":
+                    step.findings.append(
+                        {
+                            "type": "security_meaning_change",
+                            "severity": "high",
+                            "detail": f"Security meaning changed: {claim.statement}",
+                        }
+                    )

patchi/core/campaigns/orchestrator.py

@@ -0,0 +1,140 @@
+"""CampaignOrchestrator — run all registered campaigns and aggregate results."""
+
+from __future__ import annotations
+
+import logging
+from dataclasses import dataclass
+
+from patchi.core.assurance.graph import AssuranceGraph
+
+from .base import Campaign, CampaignStep
+from .data_flow_abuse import DataFlowAbuseCampaign
+from .state_transitions import StateTransitionCampaign
+
+_log = logging.getLogger("patchi.core.campaigns.orchestrator")
+
+# Registry of available campaigns
+CAMPAIGN_REGISTRY: dict[str, type[Campaign]] = {
+    "state_transitions": StateTransitionCampaign,
+    "data_flow_abuse": DataFlowAbuseCampaign,
+}
+
+
+@dataclass
+class CampaignResult:
+    """Result of running a single campaign."""
+
+    name: str
+    steps: list[CampaignStep]
+    total_findings: int = 0
+    critical: int = 0
+    high: int = 0
+
+    def to_dict(self) -> dict:
+        return {
+            "name": self.name,
+            "steps": [s.to_dict() for s in self.steps],
+            "total_findings": self.total_findings,
+            "critical": self.critical,
+            "high": self.high,
+        }
+
+
+@dataclass
+class OrchestratorResult:
+    """Aggregated result of all campaigns."""
+
+    campaigns: list[CampaignResult]
+    total_findings: int = 0
+    critical: int = 0
+    high: int = 0
+
+    def to_dict(self) -> dict:
+        return {
+            "campaigns": [c.to_dict() for c in self.campaigns],
+            "total_findings": self.total_findings,
+            "critical": self.critical,
+            "high": self.high,
+        }
+
+
+class CampaignOrchestrator:
+    """Orchestrate all registered campaigns against the assurance graph."""
+
+    def __init__(self, graph: AssuranceGraph):
+        self._graph = graph
+
+    def run_all(self) -> OrchestratorResult:
+        """Run all registered campaigns."""
+        results: list[CampaignResult] = []
+        total_findings = 0
+        critical = 0
+        high = 0
+
+        for name, cls in CAMPAIGN_REGISTRY.items():
+            try:
+                campaign = cls(self._graph)
+                steps = campaign.run()
+
+                campaign_findings = 0
+                campaign_critical = 0
+                campaign_high = 0
+                for step in steps:
+                    campaign_findings += len(step.findings)
+                    for f in step.findings:
+                        sev = f.get("severity", "")
+                        if sev == "critical":
+                            campaign_critical += 1
+                        elif sev == "high":
+                            campaign_high += 1
+
+                result = CampaignResult(
+                    name=name,
+                    steps=steps,
+                    total_findings=campaign_findings,
+                    critical=campaign_critical,
+                    high=campaign_high,
+                )
+                results.append(result)
+                total_findings += campaign_findings
+                critical += campaign_critical
+                high += campaign_high
+            except Exception as e:
+                _log.warning("Campaign %s failed: %s", name, e)
+                results.append(
+                    CampaignResult(
+                        name=name,
+                        steps=[CampaignStep(name="error", description=str(e), status="failed")],
+                        total_findings=1,
+                    )
+                )
+
+        return OrchestratorResult(
+            campaigns=results,
+            total_findings=total_findings,
+            critical=critical,
+            high=high,
+        )
+
+    def run_campaign(self, name: str) -> CampaignResult:
+        """Run a specific campaign by name."""
+        cls = CAMPAIGN_REGISTRY.get(name)
+        if cls is None:
+            raise ValueError(
+                f"Unknown campaign: {name}. Available: {list(CAMPAIGN_REGISTRY.keys())}"
+            )
+
+        campaign = cls(self._graph)
+        steps = campaign.run()
+
+        total = sum(len(s.findings) for s in steps)
+        critical = sum(1 for s in steps for f in s.findings if f.get("severity") == "critical")
+        high = sum(1 for s in steps for f in s.findings if f.get("severity") == "high")
+
+        return CampaignResult(
+            name=name,
+            steps=steps,
+            total_findings=total,
+            critical=critical,
+            high=high,
+        )

patchi/core/campaigns/state_transitions.py

@@ -0,0 +1,178 @@
+"""StateTransitionCampaign — test application state machine security.
+
+Discovers states, maps transitions, tests legal/illegal sequences,
+checks for replay attacks and concurrent race conditions.
+"""
+
+from __future__ import annotations
+
+import logging
+
+from .base import Campaign, CampaignStep
+
+_log = logging.getLogger("patchi.core.campaigns.state_transitions")
+
+
+class StateTransitionCampaign(Campaign):
+    """Test state machine security: legal transitions, illegal transitions, replay, concurrency."""
+
+    name = "state_transitions"
+    description = "Tests application state machine security"
+
+    def steps(self) -> list[CampaignStep]:
+        return [
+            CampaignStep(
+                name="discover_states", description="Discover all application states from the graph"
+            ),
+            CampaignStep(name="map_transitions", description="Map all legal state transitions"),
+            CampaignStep(
+                name="identify_guards", description="Identify guards protecting state transitions"
+            ),
+            CampaignStep(
+                name="test_legal_sequences", description="Test legal state transition sequences"
+            ),
+            CampaignStep(
+                name="test_illegal_sequences", description="Test illegal state transition sequences"
+            ),
+            CampaignStep(
+                name="test_replay", description="Test replay attacks on state transitions"
+            ),
+            CampaignStep(name="test_concurrent", description="Test concurrent state transitions"),
+        ]
+
+    def _execute_step(self, step: CampaignStep) -> None:
+        if step.name == "discover_states":
+            self._discover_states(step)
+        elif step.name == "map_transitions":
+            self._map_transitions(step)
+        elif step.name == "identify_guards":
+            self._identify_guards(step)
+        elif step.name == "test_legal_sequences":
+            self._test_legal_sequences(step)
+        elif step.name == "test_illegal_sequences":
+            self._test_illegal_sequences(step)
+        elif step.name == "test_replay":
+            self._test_replay(step)
+        elif step.name == "test_concurrent":
+            self._test_concurrent(step)
+
+    def _discover_states(self, step: CampaignStep) -> None:
+        """Find all states mentioned in the assurance graph."""
+        states: set[str] = set()
+        for claim in self._graph.claims.values():
+            for ev in claim.evidence:
+                a = ev.artifact
+                if "from_state" in a:
+                    states.add(a["from_state"])
+                if "to_state" in a:
+                    states.add(a["to_state"])
+
+        if not states:
+            step.findings.append(
+                {
+                    "type": "no_states_found",
+                    "severity": "info",
+                    "detail": "No application states discovered from the assurance graph",
+                }
+            )
+        else:
+            step.findings.append(
+                {
+                    "type": "states_discovered",
+                    "severity": "info",
+                    "detail": f"Found {len(states)} states: {', '.join(sorted(states))}",
+                }
+            )
+
+    def _map_transitions(self, step: CampaignStep) -> None:
+        """Map all legal transitions and check for completeness."""
+        transitions: list[dict] = []
+        for claim in self._graph.claims.values():
+            for ev in claim.evidence:
+                a = ev.artifact
+                if "from_state" in a and "to_state" in a:
+                    transitions.append(
+                        {
+                            "from": a["from_state"],
+                            "to": a["to_state"],
+                            "action": a.get("action", "unknown"),
+                            "guarded": a.get("guarded", False),
+                        }
+                    )
+
+        # Check for transitions without guards
+        unguarded = [t for t in transitions if not t["guarded"]]
+        if unguarded:
+            for t in unguarded:
+                step.findings.append(
+                    {
+                        "type": "unguarded_transition",
+                        "severity": "medium",
+                        "detail": f"Unguarded transition: {t['from']} → {t['to']} via {t['action']}",
+                    }
+                )
+
+    def _identify_guards(self, step: CampaignStep) -> None:
+        """Check that transitions have authorization guards."""
+        for claim in self._graph.claims.values():
+            if "guard" in claim.statement.lower() or "auth" in claim.statement.lower():
+                if claim.verdict.value == "disproved":
+                    step.findings.append(
+                        {
+                            "type": "guard_broken",
+                            "severity": "critical",
+                            "detail": f"Guard violated: {claim.statement}",
+                        }
+                    )
+
+    def _test_legal_sequences(self, step: CampaignStep) -> None:
+        """Test that legal transition sequences don't bypass guards."""
+        # Check for claims about legal sequences
+        for claim in self._graph.claims.values():
+            if "sequence" in claim.statement.lower() and claim.verdict.value == "disproved":
+                step.findings.append(
+                    {
+                        "type": "sequence_bypass",
+                        "severity": "high",
+                        "detail": f"Legal sequence bypasses guard: {claim.statement}",
+                    }
+                )
+
+    def _test_illegal_sequences(self, step: CampaignStep) -> None:
+        """Test that illegal transitions are properly blocked."""
+        # Find claims about forbidden transitions
+        for claim in self._graph.claims.values():
+            if "must not" in claim.statement.lower() or "forbidden" in claim.statement.lower():
+                if claim.verdict.value == "disproved":
+                    step.findings.append(
+                        {
+                            "type": "illegal_transition_allowed",
+                            "severity": "critical",
+                            "detail": f"Forbidden transition is possible: {claim.statement}",
+                        }
+                    )
+
+    def _test_replay(self, step: CampaignStep) -> None:
+        """Test for replay vulnerabilities in state transitions."""
+        for claim in self._graph.claims.values():
+            if "replay" in claim.statement.lower() and claim.verdict.value == "disproved":
+                step.findings.append(
+                    {
+                        "type": "replay_vulnerability",
+                        "severity": "high",
+                        "detail": f"Replay attack possible: {claim.statement}",
+                    }
+                )
+
+    def _test_concurrent(self, step: CampaignStep) -> None:
+        """Test for concurrent state transition race conditions."""
+        for claim in self._graph.claims.values():
+            if "concurrent" in claim.statement.lower() or "race" in claim.statement.lower():
+                if claim.verdict.value == "disproved":
+                    step.findings.append(
+                        {
+                            "type": "race_condition",
+                            "severity": "high",
+                            "detail": f"Race condition found: {claim.statement}",
+                        }
+                    )

patchi/core/ci_bundle.py

@@ -0,0 +1,104 @@
+"""
+CI/PR Bundle — Finding stable id + Baseline+delta + --since + SARIF + fix --safe-all.
+
+Stable id: hash(file+type+line//5) for dedup across runs.
+Renderer registry: markdown/json/sarif renderers via register_renderer().
+"""
+
+from __future__ import annotations
+
+import hashlib
+import json
+from collections.abc import Callable
+from pathlib import Path
+
+def stable_id(finding: dict) -> str:
+    raw = f"{finding.get('file','')}:{finding.get('type','')}:{finding.get('line',0)//5}"
+    return hashlib.sha256(raw.encode()).hexdigest()[:12]
+
+def baseline_delta(baseline: list[dict], current: list[dict]) -> dict:
+    b_ids = {stable_id(f) for f in baseline}
+    c_ids = {stable_id(f) for f in current}
+    added = [f for f in current if stable_id(f) not in b_ids]
+    fixed = [f for f in baseline if stable_id(f) not in c_ids]
+    return {"added": added, "fixed": fixed, "added_count": len(added), "fixed_count": len(fixed)}
+
+def filter_since(findings: list[dict], since_ref: str, root: Path) -> list[dict]:
+    """Filter findings to files changed since git ref."""
+    try:
+        import subprocess
+        out = subprocess.run(["git","diff","--name-only", since_ref], capture_output=True, text=True, timeout=5, cwd=str(root))
+        if out.returncode != 0:
+            return findings
+        changed = set(out.stdout.splitlines())
+        return [f for f in findings if f.get("file","") in changed]
+    except Exception:
+        return findings
+
+def to_sarif(findings: list[dict], root: Path | None = None) -> dict:
+    """Single SARIF implementation — delegates to export.sarif.
+
+    (root kept for compat; SARIF carries no repo-root field.)
+    """
+    from patchi.core.export.sarif import convert_findings
+
+    return convert_findings(findings)
+
+def write_sarif(findings: list[dict], out_path: Path) -> None:
+    out_path.parent.mkdir(parents=True, exist_ok=True)
+    out_path.write_text(json.dumps(to_sarif(findings), indent=2), encoding="utf-8")
+
+
+def render_markdown(findings: list[dict]) -> str:
+    lines = ["# Patchi Findings", ""]
+    order = {"critical": 0, "high": 1, "medium": 2, "low": 3, "info": 4}
+    def _sort_key(d: dict) -> tuple:
+        return (order.get(d.get("severity", "info"), 5), d.get("file", ""))
+    for f in sorted(findings, key=_sort_key):
+        lines.append(
+            f"- `{f.get('file', '?')}:{f.get('line', 0)}` "
+            f"[{f.get('severity', 'info')}] {f.get('type', '?')} — {f.get('message', '')}"
+        )
+    return "\n".join(lines) + "\n"
+
+
+RENDERERS: dict[str, Callable[[list[dict]], str]] = {
+    "markdown": render_markdown,
+    "json": lambda findings: json.dumps(findings, indent=2),
+    "sarif": lambda findings: json.dumps(to_sarif(findings), indent=2),
+}
+
+
+_SEV_ORDER = {"critical": 0, "high": 1, "medium": 2, "low": 3, "info": 4}
+
+
+def exit_code_for(findings: list[dict], fail_on: str | None) -> int:
+    """CI gate: 1 when any finding meets the --fail-on severity, else 0.
+
+    No threshold (None) never fails — plain `p scan` stays exit 0.
+    """
+    if not fail_on:
+        return 0
+    try:
+        bar = _SEV_ORDER[fail_on.lower()]
+    except KeyError:
+        raise ValueError(f"unknown severity {fail_on!r} (have: {sorted(_SEV_ORDER)})") from None
+    for f in findings:
+        sev = f.get("severity", "info")
+        sev = sev.value if hasattr(sev, "value") else str(sev)
+        if _SEV_ORDER.get(sev.lower(), 5) <= bar:
+            return 1
+    return 0
+
+
+def register_renderer(name: str, fn: Callable[[list[dict]], str]) -> None:
+    """Add or override a findings renderer (e.g. plugins)."""
+    RENDERERS[name.lower()] = fn
+
+
+def render_findings(findings: list[dict], fmt: str = "markdown") -> str:
+    try:
+        renderer = RENDERERS[fmt.lower()]
+    except KeyError:
+        raise ValueError(f"unknown findings format {fmt!r} (have: {sorted(RENDERERS)})") from None
+    return renderer(findings)