patchi 0.7.5__py3-none-any.whl

patchi/core/security/defectdojo.py

@@ -0,0 +1,238 @@
+"""
+DefectDojoReporter — optional push of Patchi defense results to DefectDojo.
+
+DefectDojo is an open-source vulnerability management platform.
+https://github.com/DefectDojo/django-DefectDojo
+
+Configuration (opt-in, disabled by default):
+  {
+    "defectdojo": {
+      "enabled": false,
+      "url": "https://demo.defectdojo.org",
+      "api_key": "",
+      "auto_create_product": true,
+      "product_name": "auto",        // "auto" = use project directory name
+      "engagement_prefix": "scan-"
+    }
+  }
+
+Usage:
+    reporter = DefectDojoReporter(config)
+    reporter.push_gated_report(gated_report, project_root)
+"""
+
+from __future__ import annotations
+
+import time
+from pathlib import Path
+from typing import Any
+
+from loguru import logger
+
+
+class DefectDojoReporter:
+    """
+    Push Patchi defense pipeline results to DefectDojo.
+
+    All operations are optional and fail gracefully — never block scans.
+    """
+
+    def __init__(self, config: dict | None = None):
+        self.config = config or {}
+        dd_cfg = self.config.get("defectdojo", {})
+        self.enabled = dd_cfg.get("enabled", False)
+        self.base_url = dd_cfg.get("url", "").rstrip("/")
+        self.api_key = dd_cfg.get("api_key", "")
+        self.auto_create_product = dd_cfg.get("auto_create_product", True)
+        self.product_name = dd_cfg.get("product_name", "auto")
+        self.engagement_prefix = dd_cfg.get("engagement_prefix", "scan-")
+
+        if self.enabled and not self.base_url:
+            logger.warning("DefectDojo enabled but no URL configured — disabling")
+            self.enabled = False
+        if self.enabled and not self.api_key:
+            logger.warning("DefectDojo enabled but no API key configured — disabling")
+            self.enabled = False
+
+    def push_gated_report(self, gated_report: Any, root: Path) -> dict:
+        """
+        Push a GatedReport to DefectDojo.
+
+        Args:
+            gated_report: GatedReport from DetectionPipeline.process()
+            root: Project root Path (used for product name)
+
+        Returns:
+            dict with status and details
+        """
+        if not self.enabled:
+            return {"status": "skipped", "reason": "DefectDojo not enabled"}
+
+        try:
+            import httpx  # noqa: F401 — used to check availability
+        except ImportError:
+            logger.warning("httpx not installed — cannot push to DefectDojo")
+            return {"status": "skipped", "reason": "httpx not installed"}
+
+        product_name = Path(root).name if self.product_name == "auto" else self.product_name
+
+        # Build findings payload
+        findings = []
+        for gf in getattr(gated_report, "findings", []):
+            f = getattr(gf, "finding", gf)
+            findings.append(self._finding_to_dd(f, gf))
+
+        if not findings:
+            return {"status": "skipped", "reason": "No findings to push"}
+
+        # Ensure product and engagement exist
+        product_id = self._get_or_create_product(product_name)
+        if not product_id:
+            return {"status": "error", "reason": "Failed to get/create product"}
+
+        engagement_id = self._create_engagement(product_id, product_name)
+        if not engagement_id:
+            return {"status": "error", "reason": "Failed to create engagement"}
+
+        # Push import scan
+        return self._import_scan(engagement_id, findings, product_name)
+
+    # ── Finding conversion ────────────────────────────────────────────────
+
+    def _finding_to_dd(self, finding: Any, gated_finding: Any = None) -> dict:
+        """Convert a Patchi Finding to DefectDojo finding format."""
+        severity_map = {
+            "critical": "Critical",
+            "high": "High",
+            "medium": "Medium",
+            "low": "Low",
+            "info": "Info",
+        }
+
+        cwe = 0
+        if hasattr(finding, "cwe") and finding.cwe:
+            try:
+                cwe = int(str(finding.cwe).replace("CWE-", ""))
+            except ValueError:
+                cwe = 0
+
+        can_defend = False
+        if gated_finding is not None:
+            can_defend = getattr(gated_finding, "can_defend", False)
+
+        severity = severity_map.get(
+            getattr(finding, "severity", "info").value
+            if hasattr(getattr(finding, "severity", ""), "value")
+            else str(getattr(finding, "severity", "info")).lower(),
+            "Info",
+        )
+
+        return {
+            "title": getattr(finding, "message", "Untitled finding")[:500],
+            "severity": severity,
+            "file_path": getattr(finding, "file", ""),
+            "line": getattr(finding, "line", 0),
+            "cwe": cwe,
+            "description": getattr(finding, "detail", "")[:2000],
+            "remediation": getattr(finding, "suggestion", "")[:1000],
+            "active": True,
+            "verified": can_defend,
+            "false_positive": False,
+            "duplicate": False,
+        }
+
+    # ── DefectDojo API calls ──────────────────────────────────────────────
+
+    def _api_call(self, method: str, endpoint: str, **kwargs) -> dict | None:
+        """Make an HTTP call to DefectDojo API."""
+        try:
+            import httpx
+        except ImportError:
+            return None
+
+        url = f"{self.base_url}/api/v2/{endpoint}"
+        headers = {
+            "Authorization": f"Token {self.api_key}",
+            "Content-Type": "application/json",
+        }
+
+        try:
+            if method == "GET":
+                r = httpx.get(url, headers=headers, params=kwargs.get("params"), timeout=30)
+            elif method == "POST":
+                r = httpx.post(url, headers=headers, json=kwargs.get("json", {}), timeout=30)
+            else:
+                return None
+
+            if r.status_code in (200, 201):
+                return r.json()
+            logger.debug(f"DefectDojo API error: {r.status_code} {r.text[:200]}")
+            return None
+        except Exception as e:
+            logger.debug(f"DefectDojo request failed: {e}")
+            return None
+
+    def _get_or_create_product(self, product_name: str) -> int | None:
+        """Get existing product or create new one. Returns product_id."""
+        # Try to find existing product
+        result = self._api_call("GET", "products", params={"limit": 100})
+        if result:
+            for p in result.get("results", []):
+                if p.get("name") == product_name:
+                    return p["id"]
+
+        # Create if auto-create enabled
+        if not self.auto_create_product:
+            logger.warning(f"Product '{product_name}' not found and auto_create is false")
+            return None
+
+        result = self._api_call(
+            "POST",
+            "products",
+            json={
+                "name": product_name,
+                "description": f"Patchi scan findings for {product_name}",
+                "prod_type": 1,  # default product type
+            },
+        )
+        if result:
+            return result["id"]
+        return None
+
+    def _create_engagement(self, product_id: int, product_name: str) -> int | None:
+        """Create a new engagement for a scan. Returns engagement_id."""
+        engagement_name = f"{self.engagement_prefix}{int(time.time())}"
+        result = self._api_call(
+            "POST",
+            "engagements",
+            json={
+                "name": engagement_name,
+                "product": product_id,
+                "target_start": time.strftime("%Y-%m-%d"),
+                "target_end": time.strftime("%Y-%m-%d"),
+                "engagement_type": "CI/CD",
+                "status": "In Progress",
+                "description": f"Patchi scan of {product_name}",
+            },
+        )
+        if result:
+            return result["id"]
+        return None
+
+    def _import_scan(self, engagement_id: int, findings: list[dict], product_name: str) -> dict:
+        """Push findings as an import-scan."""
+        result = self._api_call(
+            "POST",
+            "import-scan/",
+            json={
+                "engagement": engagement_id,
+                "scan_type": "Patchi Scan",
+                "product_name": product_name,
+                "findings": findings,
+            },
+        )
+        if result:
+            count = len(findings)
+            logger.info(f"Pushed {count} findings to DefectDojo (engagement {engagement_id})")
+            return {"status": "success", "finding_count": count, "engagement_id": engagement_id}
+        return {"status": "error", "reason": "Import scan API call failed"}

patchi/core/security/defenders/__init__.py

@@ -0,0 +1,75 @@
+"""Defenders package — adapter registry for defense actions.
+
+Usage::
+
+    from patchi.core.security.defenders import ADAPTER_REGISTRY, get_adapter
+    from patchi.core.security.defenders.base import DefenseAction
+
+    adapter = get_adapter("fix_code", root=path, risk_gate=gate)
+    result = adapter.execute(action)
+"""
+
+from __future__ import annotations
+
+from pathlib import Path
+
+from .auth_middleware import AuthMiddlewareAdapter
+from .base import BaseAdapter, DefendResult, DefenseAction
+from .block_ip import BlockIpAdapter
+from .block_ws_origin import BlockWsOriginAdapter
+from .crypto_fix import CryptoFixAdapter
+from .enforce_rate_limit import EnforceRateLimitAdapter
+from .fix_code import FixCodeAdapter
+from .invalidate_session import InvalidateSessionAdapter
+from .patch_config import PatchConfigAdapter
+from .rotate_secret import RotateSecretAdapter
+from .suspend_account import SuspendAccountAdapter
+from .update_dependency import UpdateDependencyAdapter
+
+# Registry: action_type string → adapter class
+ADAPTER_REGISTRY: dict[str, type[BaseAdapter]] = {
+    "fix_code": FixCodeAdapter,
+    "update_dependency": UpdateDependencyAdapter,
+    "block_ip": BlockIpAdapter,
+    "rotate_secret": RotateSecretAdapter,
+    "patch_config": PatchConfigAdapter,
+    "crypto_fix": CryptoFixAdapter,
+    "auth_middleware": AuthMiddlewareAdapter,
+    "invalidate_session": InvalidateSessionAdapter,
+    "enforce_rate_limit": EnforceRateLimitAdapter,
+    "suspend_account": SuspendAccountAdapter,
+    "block_ws_origin": BlockWsOriginAdapter,
+}
+
+__all__ = [
+    "ADAPTER_REGISTRY",
+    "BaseAdapter",
+    "DefenseAction",
+    "DefendResult",
+    "get_adapter",
+]
+
+
+def get_adapter(action_type: str, root: Path, risk_gate) -> BaseAdapter:
+    """Get an adapter instance for the given action type.
+
+    Falls back to a no-op adapter if the type is unknown.
+    """
+    cls = ADAPTER_REGISTRY.get(action_type)
+    if cls is not None:
+        return cls(root=root, risk_gate=risk_gate)
+
+    # Fallback: return a stub that queues for human review
+    class _FallbackAdapter(BaseAdapter):
+        action_type = ""  # overridden below
+
+        def execute(self, _action: DefenseAction) -> DefendResult:
+            return DefendResult(
+                action="queued",
+                reason=f"No auto-defense available for '{_action.type}' — queued for human review",
+                defense_action=_action,
+            )
+
+    adapter = _FallbackAdapter(root=root, risk_gate=risk_gate)
+    adapter.action_type = action_type
+    return adapter

patchi/core/security/defenders/auth_middleware.py

@@ -0,0 +1,115 @@
+"""Adapter: auth_middleware — add authentication middleware / decorator to an endpoint."""
+
+from __future__ import annotations
+
+import logging
+import uuid
+from pathlib import Path
+
+from patchi.core.fix.patch import FileChange, Patch
+
+from .base import BaseAdapter, DefendResult, DefenseAction
+
+_log = logging.getLogger("patchi.security.defenders.auth_middleware")
+
+
+class AuthMiddlewareAdapter(BaseAdapter):
+    """Add authentication middleware / decorator to an endpoint."""
+
+    action_type = "auth_middleware"
+
+    def execute(self, action: DefenseAction) -> DefendResult:
+        if not action.target or not Path(action.target).exists():
+            return DefendResult(
+                action="skipped",
+                reason=f"File does not exist: {action.target}",
+                defense_action=action,
+            )
+        fpath = Path(action.target)
+        try:
+            content = fpath.read_text(encoding="utf-8", errors="ignore")
+        except OSError as e:
+            return DefendResult(action="blocked", reason=f"Read error: {e}", defense_action=action)
+
+        changes = []
+        if "flask" in content.lower() or "from flask" in content:
+            if (
+                "from flask_login import login_required" not in content
+                and "from flask_login import" not in content
+            ):
+                lines = content.splitlines()
+                insert_at = 0
+                for i, line in enumerate(lines):
+                    if line.startswith("#!") or line.startswith("# -*-"):
+                        insert_at = i + 1
+                    else:
+                        break
+                lines.insert(insert_at, "from flask_login import login_required")
+                modified = "\n".join(lines)
+                changes.append(FileChange(path=str(fpath), original=content, proposed=modified))
+        elif "django" in content.lower() or "from django" in content:
+            if "from django.contrib.auth.decorators import login_required" not in content:
+                changes.append(
+                    FileChange(
+                        path=str(fpath),
+                        original=content,
+                        proposed="from django.contrib.auth.decorators import login_required\n"
+                        + content,
+                    )
+                )
+        elif "fastapi" in content.lower() or "from fastapi" in content:
+            if "Depends" not in content and "get_current_user" not in content:
+                changes.append(
+                    FileChange(
+                        path=str(fpath),
+                        original=content,
+                        proposed="from fastapi import Depends\nfrom .auth import get_current_user\n"
+                        + content,
+                    )
+                )
+
+        if not changes:
+            return DefendResult(
+                action="skipped",
+                reason="No recognizable framework found for auth middleware insertion",
+                defense_action=action,
+            )
+
+        patch = Patch(
+            id=uuid.uuid4().hex[:12],
+            agent=action.finding.agent,
+            finding_id=action.finding.type,
+            patch_type="SECURITY",
+            changes=changes,
+            description="Add authentication middleware",
+            risk_score=30,
+            confidence=70,
+            blast_radius=2,
+        )
+        gate_result = self.risk_gate.evaluate(patch)
+        if gate_result.is_auto:
+            try:
+                patch.apply()
+                return DefendResult(
+                    action="applied",
+                    reason="Auth middleware template added",
+                    defense_action=action,
+                    patch=patch,
+                    gate_result=gate_result,
+                )
+            except Exception as e:
+                return DefendResult(
+                    action="blocked",
+                    reason=f"Apply failed: {e}",
+                    defense_action=action,
+                    patch=patch,
+                    gate_result=gate_result,
+                )
+        else:
+            return DefendResult(
+                action="queued" if not gate_result.is_blocked else "blocked",
+                reason=gate_result.reason,
+                defense_action=action,
+                patch=patch,
+                gate_result=gate_result,
+            )

patchi/core/security/defenders/base.py

@@ -0,0 +1,97 @@
+"""Base adapter for defense actions.
+
+Each concrete adapter handles one defense action type
+(fix_code, block_ip, rotate_secret, etc.) and implements
+``execute(action) -> DefendResult``.
+"""
+
+from __future__ import annotations
+
+import abc
+import time
+from dataclasses import dataclass, field
+from pathlib import Path
+
+from patchi.core.agents.base import Finding
+from patchi.core.fix.patch import Patch
+from patchi.core.fix.risk_gate import GateResult
+
+_log_name = "patchi.security.defenders"
+
+
+@dataclass
+class DefenseAction:
+    """A concrete action to defend against a confirmed finding."""
+
+    type: str
+    target: str
+    finding: Finding
+    severity: str
+    fix_code: str = ""
+
+    def to_dict(self) -> dict:
+        return {
+            "type": self.type,
+            "target": self.target,
+            "severity": self.severity,
+            "finding_id": self.finding.type,
+            "finding_file": self.finding.file,
+        }
+
+
+@dataclass
+class DefendResult:
+    """Result of executing a defense action."""
+
+    action: str  # "applied" | "queued" | "blocked" | "skipped"
+    reason: str
+    defense_action: DefenseAction | None = None
+    patch: Patch | None = None
+    gate_result: GateResult | None = None
+    timestamp: float = field(default_factory=time.time)
+
+    def to_dict(self) -> dict:
+        d = {
+            "action": self.action,
+            "reason": self.reason,
+            "timestamp": self.timestamp,
+        }
+        if self.defense_action:
+            d["defense_action"] = self.defense_action.to_dict()
+        if self.patch:
+            d["patch_id"] = self.patch.id
+        return d
+
+
+class BaseAdapter(abc.ABC):
+    """All defense adapters must subclass this."""
+
+    action_type: str  # must be set by subclass
+
+    def __init__(self, root: Path, risk_gate):
+        self.root = root
+        self.risk_gate = risk_gate
+
+    @abc.abstractmethod
+    def execute(self, action: DefenseAction) -> DefendResult:
+        """Execute the defense action and return a result."""
+
+    def _estimate_risk(self, action: DefenseAction) -> int:
+        """Estimate risk score for a defense action (0-100)."""
+        sev_scores = {"critical": 80, "high": 60, "medium": 40, "low": 20, "info": 10}
+        base = sev_scores.get(action.severity, 30)
+        action_risk = {
+            "fix_code": 0,
+            "update_dependency": 10,
+            "block_ip": 5,
+            "rotate_secret": 15,
+            "patch_config": 20,
+            "crypto_fix": 5,
+            "auth_middleware": 15,
+            "invalidate_session": 25,
+            "enforce_rate_limit": 10,
+            "suspend_account": 40,
+            "block_ws_origin": 10,
+            "escalate": 0,
+        }
+        return min(100, base + action_risk.get(action.type, 0))

patchi/core/security/defenders/block_ip.py

@@ -0,0 +1,71 @@
+"""Adapter: block_ip — block IP via OS firewall and persist to .patchi/blocked_ips.json."""
+
+from __future__ import annotations
+
+import json
+import logging
+import subprocess
+
+from .base import BaseAdapter, DefendResult, DefenseAction
+
+_log = logging.getLogger("patchi.security.defenders.block_ip")
+
+
+class BlockIpAdapter(BaseAdapter):
+    """Block an IP address via OS firewall (hosted mode only)."""
+
+    action_type = "block_ip"
+
+    def execute(self, action: DefenseAction) -> DefendResult:
+        ip = action.target
+        if not ip:
+            return DefendResult(
+                action="skipped",
+                reason="No IP address to block",
+                defense_action=action,
+            )
+
+        blocked_path = self.root / ".patchi" / "blocked_ips.json"
+        blocked: list = []
+        if blocked_path.exists():
+            try:
+                blocked = json.loads(blocked_path.read_text(encoding="utf-8"))
+            except Exception as e:
+                _log.warning("BlockIpAdapter read failed: %s", e)
+                blocked = []
+        if ip not in blocked:
+            blocked.append(ip)
+        blocked_path.parent.mkdir(parents=True, exist_ok=True)
+        blocked_path.write_text(json.dumps(blocked, indent=2), encoding="utf-8")
+
+        try:
+            result = subprocess.run(
+                ["iptables", "-A", "INPUT", "-s", ip, "-j", "DROP"],
+                capture_output=True,
+                text=True,
+                timeout=10,
+            )
+            if result.returncode == 0:
+                return DefendResult(
+                    action="applied",
+                    reason=f"Blocked IP {ip} via iptables (persisted to .patchi/blocked_ips.json)",
+                    defense_action=action,
+                )
+            else:
+                return DefendResult(
+                    action="applied",
+                    reason=f"Blocked IP {ip} persisted to .patchi/blocked_ips.json (iptables unavailable: {result.stderr[:100]})",
+                    defense_action=action,
+                )
+        except FileNotFoundError:
+            return DefendResult(
+                action="applied",
+                reason=f"Blocked IP {ip} persisted to .patchi/blocked_ips.json (iptables not available)",
+                defense_action=action,
+            )
+        except subprocess.TimeoutExpired:
+            return DefendResult(
+                action="applied",
+                reason=f"Blocked IP {ip} persisted to .patchi/blocked_ips.json (iptables timed out)",
+                defense_action=action,
+            )

patchi/core/security/defenders/block_ws_origin.py

@@ -0,0 +1,36 @@
+"""Adapter: block_ws_origin — block a WebSocket origin via config patch."""
+
+from __future__ import annotations
+
+import json
+import logging
+
+from .base import BaseAdapter, DefendResult, DefenseAction
+
+_log = logging.getLogger("patchi.security.defenders.block_ws_origin")
+
+
+class BlockWsOriginAdapter(BaseAdapter):
+    """Block a WebSocket origin via config patch."""
+
+    action_type = "block_ws_origin"
+
+    def execute(self, action: DefenseAction) -> DefendResult:
+        ws_path = self.root / ".patchi" / "blocked_ws_origins.json"
+        target = action.target or "unknown_origin"
+        blocked: list = []
+        if ws_path.exists():
+            try:
+                blocked = json.loads(ws_path.read_text(encoding="utf-8"))
+            except Exception as e:
+                _log.warning("BlockWsOriginAdapter read failed: %s", e)
+                blocked = []
+        if target not in blocked:
+            blocked.append(target)
+        ws_path.parent.mkdir(parents=True, exist_ok=True)
+        ws_path.write_text(json.dumps(blocked, indent=2), encoding="utf-8")
+        return DefendResult(
+            action="applied",
+            reason=f"Blocked WebSocket origin: {target} — written to .patchi/blocked_ws_origins.json",
+            defense_action=action,
+        )