patchi 0.7.5__py3-none-any.whl

patchi/core/fuzz/corpus.py

@@ -0,0 +1,137 @@
+"""FuzzCorpus — persistent corpus manager for accumulating interesting inputs.
+
+Stores fuzz inputs that triggered interesting behavior (crashes, errors,
+new code paths) so subsequent runs can build on prior discoveries.
+"""
+
+from __future__ import annotations
+
+import json
+import logging
+import time
+from dataclasses import dataclass
+from pathlib import Path
+from typing import Any
+
+_log = logging.getLogger("patchi.fuzz.corpus")
+
+CORPUS_FILE = ".patchi/fuzz_corpus.json"
+
+
+@dataclass
+class CorpusEntry:
+    """One entry in the fuzz corpus."""
+
+    label: str
+    value: Any
+    strategy: str
+    score: float  # interestingness score (higher = more interesting)
+    hits: int = 1  # how many times this triggered something
+    added_at: float = 0.0
+
+    def __post_init__(self):
+        if self.added_at == 0.0:
+            self.added_at = time.time()
+
+    def to_dict(self) -> dict:
+        return {
+            "label": self.label,
+            "value": str(self.value)[:500],
+            "strategy": self.strategy,
+            "score": self.score,
+            "hits": self.hits,
+            "added_at": self.added_at,
+        }
+
+    @classmethod
+    def from_dict(cls, d: dict) -> CorpusEntry:
+        return cls(
+            label=d.get("label", "?"),
+            value=d.get("value", ""),
+            strategy=d.get("strategy", "unknown"),
+            score=float(d.get("score", 0)),
+            hits=int(d.get("hits", 1)),
+            added_at=float(d.get("added_at", 0)),
+        )
+
+
+class FuzzCorpus:
+    """Persistent corpus for accumulating interesting fuzz inputs."""
+
+    def __init__(self, root: Path):
+        self._root = root
+        self._path = root / CORPUS_FILE
+        self._entries: dict[str, CorpusEntry] = {}
+        self._load()
+
+    def _load(self) -> None:
+        """Load corpus from disk."""
+        if not self._path.is_file():
+            return
+        try:
+            data = json.loads(self._path.read_text(encoding="utf-8"))
+            for ed in data.get("entries", []):
+                entry = CorpusEntry.from_dict(ed)
+                self._entries[entry.label] = entry
+        except Exception as e:
+            _log.warning("Failed to load fuzz corpus: %s", e)
+
+    def save(self) -> None:
+        """Persist corpus to disk."""
+        self._path.parent.mkdir(parents=True, exist_ok=True)
+        payload = {
+            "version": 1,
+            "entries": [e.to_dict() for e in self._entries.values()],
+        }
+        tmp = self._path.with_suffix(".json.tmp")
+        tmp.write_text(json.dumps(payload, indent=2), encoding="utf-8")
+        tmp.replace(self._path)
+
+    def add(self, entry: CorpusEntry) -> None:
+        """Add or update a corpus entry."""
+        if entry.label in self._entries:
+            existing = self._entries[entry.label]
+            existing.hits += 1
+            existing.score = max(existing.score, entry.score)
+        else:
+            self._entries[entry.label] = entry
+
+    def get_interesting(self, min_score: float = 0.5, limit: int = 50) -> list[CorpusEntry]:
+        """Get the most interesting entries, sorted by score."""
+        candidates = [e for e in self._entries.values() if e.score >= min_score]
+        candidates.sort(key=lambda e: (-e.score, -e.hits))
+        return candidates[:limit]
+
+    def get_all(self, limit: int = 200) -> list[CorpusEntry]:
+        """Get all entries, sorted by score."""
+        entries = list(self._entries.values())
+        entries.sort(key=lambda e: (-e.score, -e.hits))
+        return entries[:limit]
+
+    def update_score(self, label: str, score: float) -> bool:
+        """Update the score of an existing entry. Returns True if found."""
+        if label in self._entries:
+            self._entries[label].score = max(self._entries[label].score, score)
+            self._entries[label].hits += 1
+            return True
+        return False
+
+    def __len__(self) -> int:
+        return len(self._entries)
+
+    def stats(self) -> dict:
+        """Return corpus statistics."""
+        entries = list(self._entries.values())
+        if not entries:
+            return {"total": 0, "avg_score": 0, "strategies": {}}
+
+        strategies: dict[str, int] = {}
+        for e in entries:
+            strategies[e.strategy] = strategies.get(e.strategy, 0) + 1
+
+        return {
+            "total": len(entries),
+            "avg_score": sum(e.score for e in entries) / len(entries),
+            "max_score": max(e.score for e in entries),
+            "strategies": strategies,
+        }

patchi/core/fuzz/input_fuzzer.py

@@ -0,0 +1,256 @@
+"""InputFuzzer — mutate inputs for security boundary testing.
+
+Generates mutated variants of input values to test injection, overflow,
+encoding bypass, and format-string vulnerabilities.
+"""
+
+from __future__ import annotations
+
+import random
+from dataclasses import dataclass
+from typing import Any
+
+
+@dataclass
+class FuzzInput:
+    """A single fuzz input variant."""
+
+    label: str
+    value: Any
+    strategy: str  # "boundary", "injection", "encoding", "overflow", "format"
+    expected_impact: str = ""  # "crash", "injection", "bypass", "error"
+
+    def to_dict(self) -> dict:
+        return {
+            "label": self.label,
+            "value": str(self.value)[:200],
+            "strategy": self.strategy,
+            "expected_impact": self.expected_impact,
+        }
+
+
+# ── Boundary values per type ────────────────────────────────────────────────
+
+_BOUNDARY_STRINGS = [
+    "",  # empty
+    " ",  # whitespace
+    "a" * 10_000,  # long
+    "\x00",  # null byte
+    "🔥" * 100,  # emoji
+    "\n\r\t",  # control chars
+    "true",
+    "false",
+    "null",  # type confusion
+    "-1",
+    "0",
+    "2147483647",  # numeric boundaries
+    "99999999999999999999",  # overflow
+]
+
+_INJECTION_STRINGS = [
+    "' OR 1=1 --",
+    "'; DROP TABLE users; --",
+    "<script>alert(1)</script>",
+    "{{7*7}}",
+    "${7*7}",
+    "{{constructor.constructor('return this')()}}",
+    "../../etc/passwd",
+    "'; exec('ls'); --",
+    "| cat /etc/passwd",
+    "$(whoami)",
+    "`id`",
+    "1; rm -rf /",
+]
+
+_ENCODING_STRINGS = [
+    "%27%20OR%201%3D1",  # URL-encoded
+    "&lt;script&gt;",  # HTML entities
+    "JCBhbGVydCgxKQ==",  # base64
+    "%00",  # null byte URL
+    "\\u0027",  # unicode escape
+    "%EF%BC%87",  # fullwidth apostrophe
+    ".LogInformation",  # log injection
+    "\r\nSet-Cookie: admin=1",  # CRLF injection
+]
+
+_FORMAT_STRINGS = [
+    "%s%s%s%s%s%s%s%s",
+    "%x%x%x%x%x%x%x%x",
+    "%n%n%n%n%n%n%n%n",
+    "{0.__class__.__bases__}",
+    "${{7*7}}",
+]
+
+
+class InputFuzzer:
+    """Generate mutated input variants for endpoint/parameter testing."""
+
+    def __init__(self, seed: int | None = None):
+        self._rng = random.Random(seed)
+
+    def fuzz_string(self, original: str, count: int = 20) -> list[FuzzInput]:
+        """Generate mutated string variants."""
+        results: list[FuzzInput] = []
+
+        # Boundary values
+        for val in _BOUNDARY_STRINGS:
+            results.append(
+                FuzzInput(label=f"boundary_{val[:10]!r}", value=val, strategy="boundary")
+            )
+
+        # Injection payloads
+        for val in _INJECTION_STRINGS:
+            results.append(
+                FuzzInput(
+                    label=f"injection_{val[:10]!r}",
+                    value=val,
+                    strategy="injection",
+                    expected_impact="injection",
+                )
+            )
+
+        # Encoding bypasses
+        for val in _ENCODING_STRINGS:
+            results.append(
+                FuzzInput(
+                    label=f"encoding_{val[:10]!r}",
+                    value=val,
+                    strategy="encoding",
+                    expected_impact="bypass",
+                )
+            )
+
+        # Format strings
+        for val in _FORMAT_STRINGS:
+            results.append(
+                FuzzInput(
+                    label=f"format_{val[:10]!r}",
+                    value=val,
+                    strategy="format",
+                    expected_impact="error",
+                )
+            )
+
+        # Random mutations of the original
+        for i in range(max(0, count - len(results))):
+            mutated = self._mutate_string(original)
+            results.append(
+                FuzzInput(
+                    label=f"random_{i}",
+                    value=mutated,
+                    strategy="random",
+                )
+            )
+
+        return results[:count]
+
+    def fuzz_numeric(self, original: int, count: int = 10) -> list[FuzzInput]:
+        """Generate mutated numeric variants."""
+        boundaries = [0, -1, 1, 2**31 - 1, 2**31, 2**63 - 1, -(2**31), -(2**63)]
+        results = [
+            FuzzInput(label=f"boundary_{v}", value=v, strategy="boundary") for v in boundaries
+        ]
+        for i in range(max(0, count - len(results))):
+            results.append(
+                FuzzInput(
+                    label=f"random_{i}",
+                    value=self._rng.randint(-10_000, 10_000),
+                    strategy="random",
+                )
+            )
+        return results[:count]
+
+    def fuzz_dict(self, original: dict, count: int = 15) -> list[FuzzInput]:
+        """Generate mutated dict variants (extra keys, type confusion, nested depth)."""
+        results: list[FuzzInput] = []
+
+        # Extra keys
+        results.append(
+            FuzzInput(
+                label="extra_admin_key",
+                value={**original, "admin": True, "is_admin": True, "role": "admin"},
+                strategy="boundary",
+                expected_impact="privilege_escalation",
+            )
+        )
+
+        # Null values
+        results.append(
+            FuzzInput(
+                label="null_values",
+                value=dict.fromkeys(original),
+                strategy="boundary",
+            )
+        )
+
+        # Nested depth bomb
+        nested: Any = "leaf"
+        for _ in range(100):
+            nested = {"a": nested}
+        results.append(
+            FuzzInput(
+                label="nested_depth_100",
+                value={"__proto__": nested},
+                strategy="overflow",
+                expected_impact="crash",
+            )
+        )
+
+        # Prototype pollution
+        results.append(
+            FuzzInput(
+                label="proto_pollution",
+                value={**original, "__proto__": {"admin": True}},
+                strategy="injection",
+                expected_impact="privilege_escalation",
+            )
+        )
+
+        # Type confusion
+        for key in list(original.keys())[:3]:
+            confused = {**original}
+            confused[key] = [original[key]]
+            confused[f"{key}_array"] = original[key]
+            results.append(
+                FuzzInput(
+                    label=f"type_confusion_{key}",
+                    value=confused,
+                    strategy="injection",
+                )
+            )
+
+        return results[:count]
+
+    def _mutate_string(self, s: str) -> str:
+        """Apply a random mutation to a string."""
+        ops = [
+            self._flip_case,
+            self._insert_special,
+            self._truncate,
+            self._repeat,
+            self._shuffle,
+            self._append_null,
+        ]
+        return self._rng.choice(ops)(s)
+
+    def _flip_case(self, s: str) -> str:
+        return "".join(c.swapcase() if c.isalpha() else c for c in s)
+
+    def _insert_special(self, s: str) -> str:
+        specials = ["\x00", "\n", "\r", "'", '"', "\\", "%00"]
+        pos = self._rng.randint(0, max(len(s), 1))
+        return s[:pos] + self._rng.choice(specials) + s[pos:]
+
+    def _truncate(self, s: str) -> str:
+        return s[: self._rng.randint(0, max(len(s) - 1, 0))]
+
+    def _repeat(self, s: str) -> str:
+        return s * self._rng.randint(2, 5)
+
+    def _shuffle(self, s: str) -> str:
+        lst = list(s)
+        self._rng.shuffle(lst)
+        return "".join(lst)
+
+    def _append_null(self, s: str) -> str:
+        return s + "\x00" * self._rng.randint(1, 10)

patchi/core/fuzz/sequence_fuzzer.py

@@ -0,0 +1,162 @@
+"""SequenceFuzzer — reorder and combine API operations to find race conditions.
+
+Given a set of API operations, generates permutations that test TOCTOU,
+replay, and ordering vulnerabilities.
+"""
+
+from __future__ import annotations
+
+import itertools
+from dataclasses import dataclass
+from typing import Any
+
+
+@dataclass
+class FuzzSequence:
+    """A sequence of operations to execute against the target."""
+
+    label: str
+    operations: list[dict[str, Any]]
+    strategy: str  # "permutation", "replay", "concurrent", "interleaved"
+    description: str = ""
+
+    def to_dict(self) -> dict:
+        return {
+            "label": self.label,
+            "operations": self.operations[:10],  # cap for display
+            "strategy": self.strategy,
+            "description": self.description,
+        }
+
+
+class SequenceFuzzer:
+    """Generate operation sequences that test ordering vulnerabilities."""
+
+    def __init__(self, max_permutations: int = 20):
+        self._max_perm = max_permutations
+
+    def generate(
+        self,
+        operations: list[dict[str, Any]],
+        max_depth: int = 4,
+    ) -> list[FuzzSequence]:
+        """Generate fuzz sequences from a list of API operations."""
+        results: list[FuzzSequence] = []
+
+        if len(operations) < 1:
+            return results
+
+        # 1. Pairwise permutations (all 2-element orderings)
+        results.extend(self._pairwise_permutations(operations))
+
+        # 2. Replay sequences (same op repeated)
+        results.extend(self._replay_sequences(operations))
+
+        # 3. Concurrent pairs (two ops that should be atomic)
+        results.extend(self._concurrent_pairs(operations))
+
+        # 4. Full permutations (if small enough)
+        if len(operations) <= 6:
+            results.extend(self._full_permutations(operations))
+
+        return results[: self._max_perm]
+
+    def _pairwise_permutations(self, operations: list[dict[str, Any]]) -> list[FuzzSequence]:
+        """Test every pair of operations in both orderings."""
+        results: list[FuzzSequence] = []
+        for i, op_a in enumerate(operations):
+            for j, op_b in enumerate(operations):
+                if i >= j:
+                    continue
+                # Normal order
+                results.append(
+                    FuzzSequence(
+                        label=f"pair_{i}_{j}_normal",
+                        operations=[op_a, op_b],
+                        strategy="permutation",
+                        description=f"Execute {op_a.get('method', '?')} then {op_b.get('method', '?')}",
+                    )
+                )
+                # Reversed order
+                results.append(
+                    FuzzSequence(
+                        label=f"pair_{j}_{i}_reversed",
+                        operations=[op_b, op_a],
+                        strategy="permutation",
+                        description=f"Execute {op_b.get('method', '?')} then {op_a.get('method', '?')} (reversed)",
+                    )
+                )
+        return results
+
+    def _replay_sequences(self, operations: list[dict[str, Any]]) -> list[FuzzSequence]:
+        """Test replaying the same operation multiple times."""
+        results: list[FuzzSequence] = []
+        for i, op in enumerate(operations):
+            # Double replay
+            results.append(
+                FuzzSequence(
+                    label=f"replay_{i}_double",
+                    operations=[op, op],
+                    strategy="replay",
+                    description=f"Replay {op.get('method', '?')} twice (idempotency test)",
+                )
+            )
+            # Triple replay
+            results.append(
+                FuzzSequence(
+                    label=f"replay_{i}_triple",
+                    operations=[op, op, op],
+                    strategy="replay",
+                    description=f"Replay {op.get('method', '?')} three times (idempotency test)",
+                )
+            )
+        return results
+
+    def _concurrent_pairs(self, operations: list[dict[str, Any]]) -> list[FuzzSequence]:
+        """Mark operation pairs as concurrent (for testing race conditions)."""
+        results: list[FuzzSequence] = []
+        for i, op_a in enumerate(operations):
+            for j, op_b in enumerate(operations):
+                if i >= j:
+                    continue
+                if self._are_concurrent(op_a, op_b):
+                    results.append(
+                        FuzzSequence(
+                            label=f"concurrent_{i}_{j}",
+                            operations=[op_a, op_b],
+                            strategy="concurrent",
+                            description=f"Execute {op_a.get('method', '?')} and {op_b.get('method', '?')} concurrently (race condition test)",
+                        )
+                    )
+        return results
+
+    def _full_permutations(self, operations: list[dict[str, Any]]) -> list[FuzzSequence]:
+        """Generate all permutations of small operation sets."""
+        results: list[FuzzSequence] = []
+        for perm in itertools.permutations(range(len(operations))):
+            ops = [operations[i] for i in perm]
+            results.append(
+                FuzzSequence(
+                    label=f"perm_{'_'.join(map(str, perm))}",
+                    operations=ops,
+                    strategy="permutation",
+                    description=f"Permutation: {' → '.join(o.get('method', '?') for o in ops)}",
+                )
+            )
+        return results
+
+    def _are_concurrent(self, op_a: dict, op_b: dict) -> bool:
+        """Determine if two operations could race (same resource, different actions)."""
+        path_a = op_a.get("path", "")
+        path_b = op_b.get("path", "")
+        method_a = op_a.get("method", "")
+        method_b = op_b.get("method", "")
+
+        # Same path but different HTTP methods
+        if path_a == path_b and method_a != method_b:
+            return True
+        # Both mutating the same resource
+        mutating = {"POST", "PUT", "PATCH", "DELETE"}
+        if path_a == path_b and method_a in mutating and method_b in mutating:
+            return True
+        return False