patchi 0.7.5__py3-none-any.whl

patchi/core/security/browser_tester.py

@@ -0,0 +1,333 @@
+"""
+Browser Tester — Playwright-based security testing for live web apps.
+
+Drives a real browser through the app map to test:
+- Authentication bypass (bad/empty credentials)
+- XSS injection in form fields
+- Authorization checks (accessing pages without session)
+- Form submission with malicious payloads
+- Coverage: clicking every button/link
+
+Requires: pip install playwright && playwright install
+Falls back gracefully when Playwright is not installed.
+"""
+
+from __future__ import annotations
+
+import logging
+
+from patchi.core.agents.base import (
+    AgentGroup,
+    AgentInput,
+    AgentResult,
+    BaseAgent,
+    Finding,
+    Severity,
+    register,
+)
+
+# ── Test payloads ─────────────────────────────────────────────────────────────
+
+_XSS_PAYLOADS = [
+    '<script>alert("xss")</script>',
+    '"><img src=x onerror=alert(1)>',
+    "javascript:alert(1)",
+    "<svg/onload=alert(1)>",
+    "{{7*7}}",
+    "${7*7}",
+]
+
+_AUTH_BYPASS_PAYLOADS = [
+    {"username": "admin", "password": ""},
+    {"username": "admin", "password": "admin"},
+    {"username": "' OR '1'='1", "password": "' OR '1'='1"},
+    {"username": "admin", "password": "password"},
+    {"username": "administrator", "password": ""},
+]
+
+_SQLI_PAYLOADS = [
+    "' OR '1'='1",
+    "1; DROP TABLE users--",
+    "' UNION SELECT NULL--",
+    "admin'--",
+]
+
+
+_log = logging.getLogger("patchi.security.browser_tester")
+
+
+def _check_playwright_available() -> bool:
+    try:
+        import importlib.util
+
+        return importlib.util.find_spec("playwright") is not None
+    except (ImportError, ValueError):
+        return False
+
+
+def patchi_browser_test(url: str, app_map: dict | None = None) -> list[dict]:
+    """Run browser-based security tests against a live app."""
+    if not _check_playwright_available():
+        return [
+            {
+                "type": "playwright_unavailable",
+                "message": "Playwright not installed — pip install playwright",
+            }
+        ]
+
+    findings = []
+
+    try:
+        from playwright.sync_api import sync_playwright
+
+        with sync_playwright() as p:
+            browser = p.chromium.launch(headless=True)
+            context = browser.new_context(
+                user_agent="Patchi-SecurityTester/1.0",
+                ignore_https_errors=True,
+            )
+            page = context.new_page()
+
+            # 1. Auth bypass test
+            findings.extend(_test_auth_bypass(page, url))
+
+            # 2. XSS injection in forms
+            findings.extend(_test_xss_in_forms(page, url, app_map))
+
+            # 3. SQLi in form fields
+            findings.extend(_test_sqli_in_forms(page, url, app_map))
+
+            browser.close()
+
+    except Exception as e:
+        findings.append({"type": "browser_test_error", "message": f"Browser test failed: {e}"})
+
+    return findings
+
+
+def _test_auth_bypass(page, url: str) -> list[dict]:
+    """Try logging in with bad credentials."""
+    findings = []
+    try:
+        page.goto(url, timeout=10000)
+
+        # Look for login forms
+        login_forms = page.query_selector_all(
+            'form[action*="login"], form[action*="auth"], form:has(input[type="password"])'
+        )
+
+        for form in login_forms:
+            for payload in _AUTH_BYPASS_PAYLOADS:
+                try:
+                    username_input = form.query_selector(
+                        'input[name="username"], input[name="email"], input[type="email"]'
+                    )
+                    password_input = form.query_selector('input[type="password"]')
+
+                    if username_input and password_input:
+                        username_input.fill(payload["username"])
+                        password_input.fill(payload["password"])
+                        form.evaluate("el => el.submit()")
+
+                        page.wait_for_timeout(2000)
+
+                        # Check if we got past login (no login form visible)
+                        still_on_login = page.query_selector('input[type="password"]')
+                        if not still_on_login:
+                            findings.append(
+                                {
+                                    "type": "auth_bypass",
+                                    "severity": "critical",
+                                    "message": f"Possible auth bypass with credentials: {payload['username']}/{payload['password']}",
+                                    "cwe": "CWE-287",
+                                }
+                            )
+                            break
+
+                        page.goto(url, timeout=10000)
+                except Exception as e:
+                    _log.warning("_test_auth_bypass failed: %s", e)
+                    continue
+
+    except Exception as e:
+        _log.warning("_test_auth_bypass failed: %s", e)
+
+    return findings
+
+
+def _test_xss_in_forms(page, url: str, app_map: dict | None) -> list[dict]:
+    """Inject XSS payloads into form fields."""
+    findings = []
+
+    pages_to_test = []
+    if app_map and "pages" in app_map:
+        pages_to_test = [(p["url"], p["forms"]) for p in app_map["pages"] if p["forms"]]
+    else:
+        pages_to_test = [(url, [])]
+
+    for page_url, _forms in pages_to_test:
+        try:
+            page.goto(page_url, timeout=10000)
+        except Exception as e:
+            _log.warning("_test_xss_in_forms failed: %s", e)
+            continue
+
+        page_forms = page.query_selector_all("form")
+        for form in page_forms:
+            inputs = form.query_selector_all('input[type="text"], input[type="search"], textarea')
+            for inp_field in inputs:
+                for payload in _XSS_PAYLOADS[:2]:
+                    try:
+                        name = inp_field.get_attribute("name") or ""
+                        inp_field.fill(payload)
+
+                        # Check if payload reflected in page source
+                        page_content = page.content()
+                        if payload in page_content and payload not in ("{{7*7}}", "${7*7}"):
+                            findings.append(
+                                {
+                                    "type": "reflected_xss",
+                                    "severity": "high",
+                                    "message": f"XSS payload reflected in form field '{name}' at {page_url}",
+                                    "cwe": "CWE-79",
+                                    "evidence": payload,
+                                }
+                            )
+                            break
+                    except Exception as e:
+                        _log.warning("_test_xss_in_forms failed: %s", e)
+                        continue
+
+    return findings
+
+
+def _test_sqli_in_forms(page, url: str, app_map: dict | None) -> list[dict]:
+    """Test for SQL error-based injection in form fields."""
+    findings = []
+
+    pages_to_test = []
+    if app_map and "pages" in app_map:
+        pages_to_test = [(p["url"], p["forms"]) for p in app_map["pages"] if p["forms"]]
+    else:
+        pages_to_test = [(url, [])]
+
+    SQL_ERROR_PATTERNS = [
+        "sql syntax",
+        "mysql_fetch",
+        "sqlite3.",
+        "postgresql",
+        "ora-",
+        "syntax error",
+        "unterminated",
+        "pg_query",
+        "warning:",
+        "fatal error",
+        "microsoft odbc",
+    ]
+
+    for page_url, _forms in pages_to_test:
+        try:
+            page.goto(page_url, timeout=10000)
+        except Exception as e:
+            _log.warning("_test_sqli_in_forms failed: %s", e)
+            continue
+
+        page_forms = page.query_selector_all("form")
+        for form in page_forms:
+            inputs = form.query_selector_all('input[type="text"], input[type="search"], textarea')
+            for inp_field in inputs:
+                for payload in _SQLI_PAYLOADS[:2]:
+                    try:
+                        name = inp_field.get_attribute("name") or ""
+                        inp_field.fill(payload)
+                        form.evaluate("el => el.submit()")
+
+                        page.wait_for_timeout(2000)
+                        page_content = page.content().lower()
+
+                        for pattern in SQL_ERROR_PATTERNS:
+                            if pattern in page_content:
+                                findings.append(
+                                    {
+                                        "type": "sql_injection_error",
+                                        "severity": "critical",
+                                        "message": f"SQL error pattern '{pattern}' after injecting '{payload}' in field '{name}' at {page_url}",
+                                        "cwe": "CWE-89",
+                                        "evidence": pattern,
+                                    }
+                                )
+                                break
+
+                        page.goto(page_url, timeout=10000)
+                    except Exception as e:
+                        _log.warning("_test_sqli_in_forms failed: %s", e)
+                        continue
+
+    return findings
+
+
+# ── Browser Tester Agent ──────────────────────────────────────────────────────
+
+
+@register
+class BrowserTesterAgent(BaseAgent):
+    """Playwright-based security testing for live web apps."""
+
+    name = "BrowserTesterAgent"
+    group = AgentGroup.SECURITY
+    timeout = 120
+
+    def _run(self, inp: AgentInput, result: AgentResult) -> None:
+        app_url = (
+            inp.brain.get("app_url", "")
+            or inp.config.get("app_url", "")
+            or inp.extra.get("app_url", "")
+        )
+
+        if not app_url:
+            result.add_finding(
+                Finding(
+                    agent=self.name,
+                    type="no_target_url",
+                    severity=Severity.INFO,
+                    file="",
+                    message="No app URL configured — set 'app_url' in config to enable browser testing",
+                )
+            )
+            return
+
+        app_map = inp.extra.get("app_map", None)
+        test_results = patchi_browser_test(app_url, app_map)
+
+        for tr in test_results:
+            if tr.get("type") == "playwright_unavailable":
+                result.add_finding(
+                    Finding(
+                        agent=self.name,
+                        type="playwright_unavailable",
+                        severity=Severity.INFO,
+                        file="",
+                        message=tr["message"],
+                    )
+                )
+                continue
+            if tr.get("type") == "browser_test_error":
+                result.add_error(tr["message"])
+                continue
+
+            sev = tr.get("severity", "medium")
+            result.add_finding(
+                Finding(
+                    agent=self.name,
+                    type=tr.get("type", "browser_finding"),
+                    severity=Severity(sev)
+                    if sev in ("critical", "high", "medium", "low", "info")
+                    else Severity.MEDIUM,
+                    file="",
+                    message=tr.get("message", ""),
+                    cwe=tr.get("cwe", ""),
+                    evidence=tr.get("evidence", ""),
+                )
+            )
+
+        result.files_scanned = 1

patchi/core/security/business_logic_agent.py

@@ -0,0 +1,263 @@
+"""
+BusinessLogicAgent — Business logic abuse detection.
+
+Detects:
+- Mass assignment / broken object property level mapping
+- Excessive data exposure (returning full models)
+- Missing pagination on list endpoints
+- Missing ownership checks (IDOR)
+- Rate limiting missing on mutation endpoints
+- Unvalidated business flow state transitions
+
+Structural detections (mass assignment, pagination, state transitions) use
+tree-sitter AST (find_calls / find_assignments). Route markers, ownership
+checks, and serialization calls use high-quality literal-pattern regex.
+Does NOT call AI. Does NOT write to disk. Does NOT touch the queue.
+"""
+
+from __future__ import annotations
+
+import re
+
+from ..agents.base import (
+    AgentDomain,
+    AgentGroup,
+    AgentInput,
+    AgentResult,
+    BaseAgent,
+    Finding,
+    Severity,
+    register,
+    safe_rglob,
+)
+from ..brain.ast_utils import find_assignments, find_calls
+from ..brain.languages import EXTENSION_MAP, Lang
+
+# Source extensions to scan (language parity).
+_SOURCE_EXTENSIONS = [
+    "*.py",
+    "*.js",
+    "*.jsx",
+    "*.ts",
+    "*.tsx",
+    "*.java",
+    "*.rb",
+    "*.php",
+    "*.go",
+    "*.rs",
+    "*.cs",
+    "*.kt",
+    "*.kts",
+]
+
+# Path keywords that indicate an API/route file (early-exit gate).
+_API_KEYWORDS = [
+    "route",
+    "view",
+    "api",
+    "controller",
+    "serializer",
+    "resource",
+    "handler",
+    "endpoint",
+    "action",
+]
+
+# Request-body sources passed directly to model updates (mass assignment).
+_REQUEST_BODY_RE = re.compile(r"(?:request\.(?:json|data|form|args)|body)", re.I)
+# Model mutation methods that, applied to a request body, are mass assignment.
+_MUTATION_CALLS = {"update", "put", "patch", "save"}
+# Pagination call names.
+_PAGINATION_CALLS = {"limit", "paginate", "offset", "page"}
+# Objects whose status/state changes are business-critical.
+_STATE_BASES = {"order", "payment", "subscription", "ticket", "workflow"}
+_STATE_VALIDATION_RE = re.compile(
+    r"(?i)(?:\ballowed\b|\bvalid\b|\btransition\b|state_machine|STATUS_FLOW|\benum\b)"
+)
+# Ownership-identifying symbols for IDOR checks, including Patchi's own
+# tenant-isolation idiom (with tenant_context(...) + per-project ownership
+# comparison) so fixed endpoints stop flagging.
+_OWNERSHIP_RE = re.compile(
+    r"(?i)(?:current_user|user\.id|\bowner\b|request\.user|\.user_id\s*=|user_id\s*=="
+    r"|tenant_context|patch_project|\btenant\b)"
+)
+_RATE_LIMIT_RE = re.compile(r"(?i)@(?:ratelimit|throttle|limit)")
+
+
+@register
+class BusinessLogicAgent(BaseAgent):
+    """Detects business logic abuse, mass assignment, IDOR, excessive data exposure."""
+
+    group = AgentGroup.SECURITY
+    domain = AgentDomain.SECURITY
+    name = "BusinessLogicAgent"
+    description = (
+        "Business logic abuse: mass assignment, IDOR, excessive data exposure, missing pagination"
+    )
+
+    def _run(self, inp: AgentInput, result: AgentResult) -> None:
+        route_guard = re.compile(
+            r"(?i)(?:@(?:app\.)?route|def\s+\w+|class\s+\w+[^(]*View|/api/)", re.I
+        )
+
+        for pattern in _SOURCE_EXTENSIONS:
+            for fpath in safe_rglob(inp.root, pattern):
+                if not fpath.is_file():
+                    continue
+                rel = fpath.relative_to(inp.root).as_posix()
+                ext = fpath.suffix.lower()
+                lang = EXTENSION_MAP.get(ext)
+
+                # Skip non-route files early.
+                if not any(kw in rel.lower() for kw in _API_KEYWORDS):
+                    try:
+                        first_kb = fpath.read_text(encoding="utf-8", errors="ignore")[:1024]
+                    except OSError:
+                        continue
+                    if not route_guard.search(first_kb):
+                        continue
+                    content = first_kb
+                else:
+                    try:
+                        content = fpath.read_text(encoding="utf-8", errors="ignore")
+                    except OSError:
+                        continue
+
+                result.files_scanned += 1
+                self._scan_business_logic(content, rel, result, lang)
+
+    def _scan_business_logic(
+        self, content: str, rel: str, result: AgentResult, lang: Lang | None
+    ) -> None:
+        # ── Mass assignment detection (AST) ───────────────────────────────────
+        if lang is not None:
+            for call in find_calls(content, lang, _MUTATION_CALLS):
+                if _REQUEST_BODY_RE.search(call.get("full_text", "")):
+                    result.add_finding(
+                        Finding(
+                            agent=self.name,
+                            type="mass_assignment",
+                            severity=Severity.HIGH,
+                            file=rel,
+                            line=call.get("line", 0),
+                            message="Mass assignment — request body applied directly to model without field whitelist",
+                            suggestion="Define an explicit field allowlist and only update whitelisted fields",
+                            cwe="CWE-915",
+                            extra={"skill": "api-security.skill"},
+                        )
+                    )
+
+        # ── Excessive data exposure (__dict__, vars(), .to_dict()) ──────────
+        if any(kw in rel.lower() for kw in _API_KEYWORDS):
+            for m in re.finditer(
+                r"(?i)(?:__dict__|vars\s*\(|\.to_dict\s*\(|\.serialize\s*\()", content
+            ):
+                result.add_finding(
+                    Finding(
+                        agent=self.name,
+                        type="excessive_data_exposure",
+                        severity=Severity.MEDIUM,
+                        file=rel,
+                        line=content[: m.start()].count("\n") + 1,
+                        message="Returning full model serialization — may leak sensitive fields",
+                        suggestion="Define explicit response fields; never return __dict__ or vars()",
+                        cwe="CWE-200",
+                        extra={"skill": "api-security.skill"},
+                    )
+                )
+
+        # ── Missing pagination on collection endpoints (AST) ──────────────────
+        if lang is not None:
+            all_calls = find_calls(content, lang, {"all"})
+            paginate_calls = find_calls(content, lang, _PAGINATION_CALLS)
+            if all_calls and not paginate_calls:
+                result.add_finding(
+                    Finding(
+                        agent=self.name,
+                        type="missing_pagination",
+                        severity=Severity.LOW,
+                        file=rel,
+                        line=0,
+                        message="Collection endpoint uses .all() without pagination — unbounded resource consumption",
+                        suggestion="Add pagination with .paginate() or .limit()/.offset()",
+                        cwe="CWE-770",
+                        extra={"skill": "api-security.skill"},
+                    )
+                )
+
+        # ── IDOR — missing ownership check (route marker regex) ───────────────
+        for m in re.finditer(
+            r"(?i)(?:@(?:app\.)?route|(?:app|router)\.(?:get|post|put|delete|patch))\s*\([^)]*\{(\w+_)?id\}",
+            content,
+        ):
+            line_start = content[: m.start()].count("\n") + 1
+            lines = content.splitlines()
+            surrounding = "\n".join(lines[line_start : min(line_start + 15, len(lines))])
+            if not _OWNERSHIP_RE.search(surrounding):
+                result.add_finding(
+                    Finding(
+                        agent=self.name,
+                        type="idor_missing_ownership_check",
+                        severity=Severity.HIGH,
+                        file=rel,
+                        line=line_start,
+                        message="Endpoint with ID parameter lacks ownership verification — potential IDOR",
+                        suggestion="Add ownership check: filter query by current_user.id or owner_id",
+                        cwe="CWE-862",
+                        extra={"skill": "api-security.skill"},
+                    )
+                )
+
+        # ── Missing rate limiting on mutation endpoints (route marker regex) ──
+        for m in re.finditer(
+            r"(?i)(?:@(?:app\.)?route|(?:app|router)\.(?:get|post|put|delete|patch))\s*\(", content
+        ):
+            line_start = content[: m.start()].count("\n") + 1
+            lines = content.splitlines()
+            surrounding = "\n".join(
+                lines[max(0, line_start - 3) : min(line_start + 10, len(lines))]
+            )
+            decorator_line = lines[line_start - 1] if line_start <= len(lines) else ""
+            method_line = lines[line_start] if line_start < len(lines) else ""
+            if re.search(r"(?i)(?:post|put|delete|patch)", decorator_line[:80]) or re.search(
+                r"(?i)(?:post|put|delete|patch)", method_line[:80]
+            ):
+                if not _RATE_LIMIT_RE.search(surrounding[:200]):
+                    result.add_finding(
+                        Finding(
+                            agent=self.name,
+                            type="missing_rate_limit",
+                            severity=Severity.LOW,
+                            file=rel,
+                            line=line_start,
+                            message="Mutation endpoint missing rate limiting — potential for abuse",
+                            suggestion="Add @ratelimit decorator with appropriate limits",
+                            cwe="CWE-799",
+                            extra={"skill": "api-security.skill"},
+                        )
+                    )
+
+        # ── Unvalidated state transitions (AST assignments) ───────────────────
+        if lang is not None:
+            for asn in find_assignments(content, lang):
+                target = asn.get("target", "")
+                if "." not in target:
+                    continue
+                base, _, leaf = target.rpartition(".")
+                if leaf in ("status", "state") and base.lower() in _STATE_BASES:
+                    line_start = asn.get("line", 0)
+                    ctx = content[max(0, line_start - 15) : line_start + 5]
+                    if not _STATE_VALIDATION_RE.search(ctx):
+                        result.add_finding(
+                            Finding(
+                                agent=self.name,
+                                type="unvalidated_state_transition",
+                                severity=Severity.MEDIUM,
+                                file=rel,
+                                line=line_start,
+                                message="Status/state change without transition validation — business logic bypass",
+                                suggestion="Validate state transitions against allowed flow matrix",
+                                cwe="CWE-284",
+                                extra={"skill": "api-security.skill"},
+                            )
+                        )