patchi 0.7.5__py3-none-any.whl

patchi/core/security/attack_feedback.py

@@ -0,0 +1,141 @@
+"""
+Attack Feedback — closes the loop between attack outcomes and learning.
+
+When the RedTeamEngine or assurance attackers confirm a vulnerability:
+  1. The confirmed payload is added to the fuzz corpus as a high-score entry
+  2. False-positive paths are recorded in the ignore_learner
+  3. Agent trust scores are updated via the learning brain
+
+This turns every scan into training data for the next scan.
+"""
+
+from __future__ import annotations
+
+import logging
+import time
+from pathlib import Path
+from typing import Any
+
+from patchi.core.brain import learning as learn
+
+_log = logging.getLogger("patchi.security.attack_feedback")
+
+
+def record_confirmed_attack(
+    root: Path,
+    attack: dict[str, Any],
+    *,
+    agent_name: str = "red_team",
+) -> None:
+    """Feed a confirmed attack result into the learning loop.
+
+    ``attack`` is a dict from RedTeamEngine or AttackPlanner with keys:
+        hypothesis, payload, endpoint, severity, evidence, tool, success
+    """
+    payload = attack.get("payload", "")
+    endpoint = attack.get("endpoint", "")
+    severity = attack.get("severity", "medium")
+    evidence = attack.get("evidence", "")
+
+    # --- 1. Fuzz corpus: confirmed payloads are high-value seeds ---
+    try:
+        from patchi.core.fuzz.corpus import CorpusEntry, FuzzCorpus
+
+        corpus = FuzzCorpus(root)
+        label = f"confirmed_{attack.get('tool', 'unknown')}_{endpoint or 'global'}"
+        score = {"critical": 1.0, "high": 0.85, "medium": 0.6, "low": 0.4}.get(severity, 0.5)
+        corpus.add(
+            CorpusEntry(
+                label=label[:120],
+                value=payload[:500] if payload else evidence[:500],
+                strategy="attack_feedback",
+                score=score,
+            )
+        )
+        corpus.save()
+        _log.info("Fed confirmed attack into corpus: %s (score=%.2f)", label[:60], score)
+    except Exception as exc:
+        _log.debug("Corpus update failed: %s", exc)
+
+    # --- 2. Learning brain: record acceptance (confirmed = good detection) ---
+    finding_type = attack.get("tool", "unknown")
+    learn.record_acceptance(finding_type, agent_name, root)
+    _log.info("Recorded acceptance for %s via %s", finding_type, agent_name)
+
+
+def record_false_positive(
+    root: Path,
+    finding: dict[str, Any],
+    *,
+    agent_name: str = "unknown",
+) -> None:
+    """Feed a rejected/false-positive finding into the learning loop.
+
+    Updates the ignore_learner FP stats and records a rejection.
+    """
+    finding_type = finding.get("control_id", finding.get("type", "unknown"))
+    file_path = finding.get("file", "")
+
+    # --- 1. Learning brain: record rejection ---
+    learn.record_rejection(finding_type, agent_name, root)
+
+    # --- 2. Ignore learner: record FP for this file/directory ---
+    try:
+        from patchi.core.security.ignore_learner import IgnoreLearner
+
+        learner = IgnoreLearner(root)
+        # Build entries from known FP store
+        fp_store = root / ".patchi" / "known_false_positives.json"
+        fps: list[dict] = []
+        if fp_store.exists():
+            import json
+
+            fps = json.loads(fp_store.read_text(encoding="utf-8"))
+
+        # Add this new FP
+        fps.append(
+            {
+                "file": file_path,
+                "type": finding_type,
+                "timestamp": time.time(),
+                "agent": agent_name,
+            }
+        )
+        fp_store.parent.mkdir(parents=True, exist_ok=True)
+        import json
+
+        fp_store.write_text(json.dumps(fps[-500:], indent=2), encoding="utf-8")
+
+        # Rebuild learner with updated FP list
+        learner.build(known_fps=fps)
+        promoted = learner.promote_to_global()
+        if promoted:
+            _log.info("Promoted %d ignore patterns to global store", promoted)
+    except Exception as exc:
+        _log.debug("Ignore learner update failed: %s", exc)
+
+
+def record_fix_outcome(
+    root: Path,
+    finding_type: str,
+    file_path: str,
+    fix_strategy: str,
+    accepted: bool,
+) -> None:
+    """Record whether a generated fix was accepted or rejected."""
+    if accepted:
+        learn.record_fix_pattern(finding_type, file_path, fix_strategy, "accepted", root)
+        learn.record_acceptance(finding_type, "auto_fixer", root)
+    else:
+        learn.record_rejection(finding_type, "auto_fixer", root)
+    _log.info(
+        "Fix outcome recorded: %s on %s → %s",
+        finding_type,
+        file_path,
+        "accepted" if accepted else "rejected",
+    )
+
+
+def get_learning_summary(root: Path) -> dict:
+    """Return the full learning summary for display."""
+    return learn.get_summary(root)

patchi/core/security/attack_scenarios/__init__.py

@@ -0,0 +1 @@
+"""Attack scenario YAML library."""

patchi/core/security/attack_tree.py

@@ -0,0 +1,176 @@
+"""
+Attack Tree generation — renders exploit chains as goal-oriented trees.
+
+Where ChainAnalyzer answers "how do findings connect?", the attack tree
+answers "what could an attacker achieve, and via which paths?".
+
+A tree is built per GOAL (e.g. "Steal Secrets", "Execute Code", "Impersonate
+Users"). Each chain whose terminal impact maps to that goal becomes a path in
+the tree; intermediate nodes become branches. The result renders as an ASCII
+tree for the CLI and a nested dict for the web panel.
+
+Deterministic: same findings + graph -> same tree. Zero AI calls.
+"""
+
+from __future__ import annotations
+
+import logging
+from collections.abc import Iterable
+from dataclasses import dataclass, field
+from typing import Any
+
+from patchi.core.security.chain_analyzer import Chain, ChainAnalyzer
+
+_log = logging.getLogger("patchi.security.attack_tree")
+
+# Impact finding types -> attacker goals
+_GOAL_MAP: dict[str, str] = {
+    "secret": "Steal Credentials / Secrets",
+    "hardcoded": "Steal Credentials / Secrets",
+    "password": "Steal Credentials / Secrets",
+    "sensitive_data": "Exfiltrate Sensitive Data",
+    "session": "Impersonate Users",
+    "rce": "Execute Arbitrary Code",
+    "deserialization": "Execute Arbitrary Code",
+    "command_injection": "Execute Arbitrary Code",
+}
+
+_SEVERITY_ORDER = {"info": 0, "low": 1, "medium": 2, "high": 3, "critical": 4}
+
+
+@dataclass
+class TreeNode:
+    """One node in an attack tree."""
+
+    label: str
+    detail: str = ""
+    children: list[TreeNode] = field(default_factory=list)
+    severity: str = "medium"
+    score: float = 0.0
+
+    def to_dict(self) -> dict:
+        return {
+            "label": self.label,
+            "detail": self.detail,
+            "severity": self.severity,
+            "score": round(self.score, 1),
+            "children": [c.to_dict() for c in self.children],
+        }
+
+
+@dataclass
+class AttackTree:
+    """Goal-oriented view over a set of exploit chains."""
+
+    goal: str
+    root: TreeNode
+    chain_count: int = 0
+    worst_severity: str = "info"
+
+    def render(self) -> str:
+        """ASCII rendering for CLI output."""
+        lines = [f"[ATTACK TREE] Goal: {self.goal}"]
+        lines.append(f"  Paths: {self.chain_count}  Worst: {self.worst_severity}")
+
+        def _walk(node: TreeNode, prefix: str, is_last: bool) -> None:
+            connector = "`-- " if is_last else "|-- "
+            sev_tag = f" ({node.severity})" if node.severity != "medium" else ""
+            lines.append(f"{prefix}{connector}{node.label}{sev_tag}")
+            kids = node.children
+            for i, child in enumerate(kids):
+                ext = "    " if is_last else "|   "
+                _walk(child, prefix + ext, i == len(kids) - 1)
+
+        for i, child in enumerate(self.root.children):
+            _walk(child, "", i == len(self.root.children) - 1)
+        return "\n".join(lines)
+
+    def to_dict(self) -> dict:
+        return {
+            "goal": self.goal,
+            "chain_count": self.chain_count,
+            "worst_severity": self.worst_severity,
+            "root": self.root.to_dict(),
+        }
+
+
+def _goal_for(chain: Chain) -> str | None:
+    """Map a chain's terminal node to an attacker goal."""
+    terminal = chain.nodes[-1].finding.type.lower()
+    for pattern, goal in _GOAL_MAP.items():
+        if pattern in terminal:
+            return goal
+    return None
+
+
+def build_attack_trees(
+    chains: list[Chain],
+    max_depth: int = 6,
+) -> list[AttackTree]:
+    """
+    Group chains into goal-oriented attack trees.
+
+    Args:
+        chains: output of ChainAnalyzer.find_chains()
+        max_depth: cap on tree rendering depth
+
+    Returns:
+        Trees sorted by worst severity, highest first.
+    """
+    by_goal: dict[str, list[Chain]] = {}
+    for chain in chains:
+        goal = _goal_for(chain)
+        if goal is None:
+            continue
+        by_goal.setdefault(goal, []).append(chain)
+
+    trees: list[AttackTree] = []
+    for goal, goal_chains in by_goal.items():
+        worst = max((_SEVERITY_ORDER.get(c.severity, 0) for c in goal_chains), default=0)
+        root = TreeNode(label=f"Goal: {goal}")
+        # Each chain becomes one path under the root; branch labels come from
+        # the entry/exploit steps, leaf is the impact.
+        for chain in sorted(goal_chains, key=lambda c: c.score, reverse=True)[:max_depth]:
+            branch_label = f"{chain.nodes[0].finding.type} @ {chain.nodes[0].finding.file}"
+            branch = TreeNode(
+                label=branch_label,
+                detail=chain.narrative,
+                severity=chain.severity,
+                score=chain.score,
+            )
+            if len(chain.nodes) > 2:
+                mid = TreeNode(label=f"via {chain.nodes[1].finding.type}")
+                leaf_label = f"{chain.nodes[-1].finding.type} @ {chain.nodes[-1].finding.file}"
+                leaf = TreeNode(
+                    label=leaf_label,
+                    severity=chain.severity,
+                    score=chain.score,
+                )
+                mid.children.append(leaf)
+                branch.children.append(mid)
+            else:
+                leaf_label = f"{chain.nodes[-1].finding.type} @ {chain.nodes[-1].finding.file}"
+                branch.children.append(TreeNode(label=leaf_label, severity=chain.severity))
+            root.children.append(branch)
+
+        trees.append(
+            AttackTree(
+                goal=goal,
+                root=root,
+                chain_count=len(goal_chains),
+                worst_severity=[s for s, v in _SEVERITY_ORDER.items() if v == worst][0] or "info",
+            )
+        )
+
+    trees.sort(key=lambda t: _SEVERITY_ORDER.get(t.worst_severity, 0), reverse=True)
+    return trees
+
+
+def trees_from_findings(
+    findings: Iterable[Any],
+    import_edges: dict[str, set[str]] | None = None,
+) -> tuple[list[AttackTree], list[Chain]]:
+    """Convenience: findings -> chains -> trees in one call."""
+    analyzer = ChainAnalyzer(findings, import_edges=import_edges)
+    chains = analyzer.find_chains()
+    return build_attack_trees(chains), chains

patchi/core/security/auth_audit_agent.py

@@ -0,0 +1,344 @@
+"""
+AuthenticationAuditAgent — Authentication and session security analysis.
+
+Scans for:
+- Missing CSRF protection on state-changing endpoints
+- Weak password hashing (MD5, SHA1, no salt)
+- Session fixation vulnerabilities
+- Missing brute-force protection indicators
+- Insecure session cookie configuration
+- Missing MFA/2FA indicators
+- OAuth implementation issues
+- Hardcoded session secrets
+- Missing rate limiting on auth endpoints
+- Improper session invalidation on logout
+
+Multi-language: scans all tree-sitter-supported source languages. Hash-function
+calls are detected structurally via tree-sitter AST (find_calls); hardcoded
+secrets, CSRF markers, OAuth config and rate-limiting indicators are detected
+with high-quality literal-pattern regex (acceptable per the audit). Does NOT
+call AI. Does NOT write to disk. Does NOT touch the queue.
+"""
+
+from __future__ import annotations
+
+import logging
+import os
+import re
+from pathlib import Path
+
+from patchi.core.brain.languages import DEFAULT_IGNORE_DIRS, EXTENSION_MAP, Lang
+
+from ..agents.base import (
+    AgentDomain,
+    AgentGroup,
+    AgentInput,
+    AgentResult,
+    AgentStatus,
+    BaseAgent,
+    Finding,
+    Severity,
+    make_finding,
+    register,
+)
+from ..brain.ast_utils import find_calls
+
+# Source extensions to scan (language parity).
+_SCAN_EXTENSIONS = [
+    ".py",
+    ".js",
+    ".jsx",
+    ".ts",
+    ".tsx",
+    ".java",
+    ".rb",
+    ".php",
+    ".go",
+    ".rs",
+    ".cpp",
+    ".cxx",
+    ".cc",
+    ".c",
+    ".h",
+    ".hpp",
+    ".cs",
+    ".kt",
+    ".kts",
+    ".swift",
+    ".dart",
+]
+
+# Hash function call names that are weak (detected structurally via AST).
+_WEAK_HASH_NAMES = {"md5", "sha1", "sha256", "sha512", "crypt"}
+# Per-name severity / message for AST-detected weak hashes.
+_WEAK_HASH_INFO = {
+    "md5": (Severity.CRITICAL, "MD5 used for password hashing — cryptographically broken"),
+    "sha1": (Severity.CRITICAL, "SHA1 used for password hashing — cryptographically weak"),
+    "sha256": (
+        Severity.HIGH,
+        "SHA-256 used for password hashing — use bcrypt/scrypt/argon2 instead",
+    ),
+    "sha512": (Severity.MEDIUM, "SHA-512 used for password hashing — prefer bcrypt/scrypt/argon2"),
+    "crypt": (Severity.MEDIUM, "Unix crypt() for password hashing — use modern alternatives"),
+}
+_GOOD_HASH_PATTERNS = [
+    re.compile(r"(?:bcrypt|scrypt|argon2|pbkdf2)", re.I),
+]
+
+# ── Weak password hashing literal patterns (regex fallback / unsupported langs) ──
+_WEAK_HASH_PATTERNS = [
+    (
+        re.compile(r"(?:hashlib\.)?md5\s*\(", re.I),
+        Severity.CRITICAL,
+        "MD5 used for password hashing — cryptographically broken",
+    ),
+    (
+        re.compile(r"(?:hashlib\.)?sha1\s*\(", re.I),
+        Severity.CRITICAL,
+        "SHA1 used for password hashing — cryptographically weak",
+    ),
+    (
+        re.compile(r"(?:hashlib\.)?sha256\s*\(", re.I),
+        Severity.HIGH,
+        "SHA-256 used for password hashing — use bcrypt/scrypt/argon2 instead",
+    ),
+    (
+        re.compile(r"hashlib\.sha512\s*\(", re.I),
+        Severity.MEDIUM,
+        "SHA-512 used for password hashing — prefer bcrypt/scrypt/argon2",
+    ),
+    (
+        re.compile(r"crypt\s*\(", re.I),
+        Severity.MEDIUM,
+        "Unix crypt() for password hashing — use modern alternatives",
+    ),
+]
+
+# ── Session patterns ────────────────────────────────────────────────────
+_SESSION_PATTERNS = [
+    (
+        re.compile(r"session\[.*?\]\s*=", re.I),
+        Severity.LOW,
+        "Session assignment — verify secure configuration",
+    ),
+    (
+        re.compile(
+            r'(?:session\.secret|SECRET_KEY|session_secret)\s*[:=]\s*["\'][^"\']{4,}["\']', re.I
+        ),
+        Severity.CRITICAL,
+        "Hardcoded session secret in source code",
+    ),
+    (
+        re.compile(r"(?:cookie_httponly|httponly.*cookie|Secure.*cookie)", re.I),
+        Severity.LOW,
+        "Cookie security configuration found — verify all flags set",
+    ),
+    (
+        re.compile(r"(?:set_cookie|set_cookie_attr|response\.set_cookie)", re.I),
+        Severity.LOW,
+        "Cookie being set — verify httponly, secure, and samesite flags",
+    ),
+]
+
+# ── Auth endpoint patterns ──────────────────────────────────────────────
+_AUTH_ENDPOINT_PATTERNS = [
+    re.compile(r"(?:/login|/signin|/auth|/authenticate|/register|/signup|/token)", re.I),
+    re.compile(r"(?:login|signin|auth|authenticate|register|signup)\s*\(", re.I),
+]
+
+# ── Rate limiting patterns ──────────────────────────────────────────────
+_RATE_LIMIT_PATTERNS = [
+    re.compile(r"(?:rate.?limit|throttl|brute.?force|login.?attempt|max.?attempt)", re.I),
+]
+
+# ── OAuth patterns ──────────────────────────────────────────────────────
+_OAUTH_PATTERNS = [
+    (
+        re.compile(r"(?:oauth|openid|oidc)", re.I),
+        Severity.INFO,
+        "OAuth/OIDC code found — verify implementation security",
+    ),
+    (
+        re.compile(r'(?:redirect_uri|callback_url)\s*[:=]\s*["\'][^"\']*["\']', re.I),
+        Severity.MEDIUM,
+        "OAuth redirect URI — verify it's not open redirect",
+    ),
+    (
+        re.compile(r'(?:client_secret|client_id)\s*[:=]\s*["\'][^"\']{8,}["\']', re.I),
+        Severity.CRITICAL,
+        "OAuth client secret hardcoded in source",
+    ),
+]
+
+_SKIP_DIRS = DEFAULT_IGNORE_DIRS
+
+
+_log = logging.getLogger("patchi.security.auth_audit_agent")
+
+
+@register
+class AuthenticationAuditAgent(BaseAgent):
+    """Agent for auditing authentication and session security."""
+
+    group = AgentGroup.SECURITY
+    domain = AgentDomain.SECURITY
+    name = "AuthenticationAuditAgent"
+    description = (
+        "Auth security: CSRF, password hashing, session management, brute-force protection"
+    )
+
+    def _run(self, inp: AgentInput, result: AgentResult) -> None:
+        from patchi.core.brain.project_context import agent_is_relevant
+
+        relevant, reason = agent_is_relevant(inp.domain, inp.purpose, self.name, inp.active_domains)
+        if not relevant:
+            result.status = AgentStatus.SKIPPED
+            result.data.update({"skip_reason": reason})
+            return
+
+        findings = []
+        files_scanned = 0
+
+        for ext in _SCAN_EXTENSIONS:
+            for p in self._safe_rglob(inp.root, f"*{ext}"):
+                rel = str(p.relative_to(inp.root))
+                if self._should_skip(rel):
+                    continue
+                files_scanned += 1
+                try:
+                    content = p.read_text(encoding="utf-8", errors="ignore")
+                except Exception as e:
+                    _log.warning("AuthenticationAuditAgent._run failed: %s", e)
+                    continue
+                lang = EXTENSION_MAP.get(ext)
+                findings.extend(self._check_password_hashing(content, rel, lang))
+                findings.extend(self._check_session_security(content, rel))
+                findings.extend(self._check_oauth(content, rel))
+                findings.extend(self._check_rate_limiting(content, rel))
+
+        result.status = AgentStatus.DONE
+        result.findings = findings
+        result.files_scanned = files_scanned
+        result.data.update({"files_scanned": files_scanned, "finding_count": len(findings)})
+        return
+
+    # ── Password hashing (AST + regex) ─────────────────────────────────────
+
+    def _check_password_hashing(
+        self, content: str, rel_path: str, lang: Lang | None
+    ) -> list[Finding]:
+        findings = []
+        lines = content.splitlines()
+
+        # AST-based weak hash detection (structural, language-agnostic where possible).
+        ast_hits: dict[int, tuple[Severity, str]] = {}
+        if lang is not None:
+            for call in find_calls(content, lang, _WEAK_HASH_NAMES):
+                name = call.get("name", "")
+                leaf = name.split(".")[-1].lower()
+                info = _WEAK_HASH_INFO.get(leaf)
+                if info:
+                    ast_hits[call.get("line", 0)] = info
+
+        # Literal-pattern regex fallback (also catches hashlib.md5(...), etc.).
+        for line_num, line in enumerate(lines, 1):
+            stripped = line.strip()
+            if stripped.startswith("#"):
+                continue
+            for pattern, severity, message in _WEAK_HASH_PATTERNS:
+                if pattern.search(line):
+                    ast_hits.setdefault(line_num, (severity, message))
+
+        has_good_hash = any(p.search(content) for p in _GOOD_HASH_PATTERNS)
+
+        for line_num in sorted(ast_hits):
+            severity, message = ast_hits[line_num]
+            if has_good_hash:
+                severity = Severity.INFO
+                message += " (but good hash found elsewhere in file)"
+            findings.append(
+                make_finding(
+                    self.name,
+                    "weak_password_hash",
+                    severity,
+                    rel_path,
+                    message,
+                    line=line_num,
+                    code_snippet=lines[line_num - 1].strip()[:120],
+                    suggestion="Use bcrypt, scrypt, or argon2 for password hashing.",
+                )
+            )
+        return findings
+
+    # ── Literal-pattern checks (multi-language) ─────────────────────────────
+
+    def _check_session_security(self, content: str, rel_path: str) -> list[Finding]:
+        return self._line_scan(
+            content,
+            rel_path,
+            _SESSION_PATTERNS,
+            "session_security",
+            "Ensure session cookies use httponly, secure, and samesite flags.",
+        )
+
+    def _check_oauth(self, content: str, rel_path: str) -> list[Finding]:
+        return self._line_scan(
+            content,
+            rel_path,
+            _OAUTH_PATTERNS,
+            "oauth_security",
+            "Verify OAuth implementation follows security best practices.",
+        )
+
+    def _line_scan(self, content, rel_path, patterns, finding_type, suggestion) -> list[Finding]:
+        findings = []
+        for line_num, line in enumerate(content.splitlines(), 1):
+            stripped = line.strip()
+            if stripped.startswith("#"):
+                continue
+            for pattern, severity, message in patterns:
+                if pattern.search(line):
+                    findings.append(
+                        make_finding(
+                            self.name,
+                            finding_type,
+                            severity,
+                            rel_path,
+                            message,
+                            line=line_num,
+                            code_snippet=stripped[:120],
+                            suggestion=suggestion,
+                        )
+                    )
+        return findings
+
+    def _check_rate_limiting(self, content: str, rel_path: str) -> list[Finding]:
+        has_rate_limit = any(p.search(content) for p in _RATE_LIMIT_PATTERNS)
+        has_auth_endpoint = any(p.search(content) for p in _AUTH_ENDPOINT_PATTERNS)
+        if has_auth_endpoint and not has_rate_limit:
+            return [
+                make_finding(
+                    self.name,
+                    "missing_rate_limit",
+                    Severity.HIGH,
+                    rel_path,
+                    "Auth endpoints found but no rate limiting/brute-force protection detected",
+                    suggestion="Add rate limiting to login/auth endpoints to prevent brute-force attacks.",
+                )
+            ]
+        return []
+
+    # ── Helpers ───────────────────────────────────────────────────────────
+
+    def _should_skip(self, rel_path: str) -> bool:
+        parts = rel_path.replace("\\", "/").split("/")
+        return any(p in _SKIP_DIRS for p in parts)
+
+    def _safe_rglob(self, root: Path, pattern: str):
+        """Directory-walking with pruning."""
+        suffix = pattern.replace("*.", ".")
+        for dirpath, dirnames, filenames in os.walk(root):
+            dirnames[:] = [d for d in dirnames if d not in _SKIP_DIRS]
+            for fn in filenames:
+                if fn.endswith(suffix):
+                    yield Path(dirpath) / fn