patchi 0.7.5__py3-none-any.whl

patchi/core/security/dependency_vulnerability_agent.py

@@ -0,0 +1,616 @@
+"""
+DependencyVulnerabilityAgent — checks packages against CVE databases.
+
+Scans dependency files for known vulnerabilities:
+- package.json (npm/yarn)
+- requirements.txt (pip)
+- Pipfile (pipenv)
+- poetry.lock (Poetry)
+- Cargo.toml (Cargo/Rust)
+- go.mod (Go modules)
+- composer.json (Composer/PHP)
+- Gemfile (Bundler/Ruby)
+
+Checks versions against OSV (Open Source Vulnerability) database
+and other vulnerability feeds.
+
+Does NOT call AI.
+Does NOT write to disk.
+Does NOT touch the queue.
+"""
+
+from __future__ import annotations
+
+import json
+from pathlib import Path
+
+from ..agents.base import (
+    AgentDomain,
+    AgentGroup,
+    AgentInput,
+    AgentResult,
+    AgentStatus,
+    BaseAgent,
+    Finding,
+    Severity,
+    make_finding,
+    register,
+    safe_rglob,
+)
+from .cve_monitor import cached_osv_query
+
+
+@register
+class DependencyVulnerabilityAgent(BaseAgent):
+    """Agent for checking dependencies against CVE databases."""
+
+    group = AgentGroup.SECURITY
+    domain = AgentDomain.SECURITY
+    name = "DependencyVulnerabilityAgent"
+    description = "Dependency CVEs: checks packages against OSV database"
+
+    def _run(self, inp: AgentInput, result: AgentResult) -> None:
+        """Scan dependency files for known vulnerabilities."""
+        self._root = inp.root
+        findings = []
+
+        # Define dependency file patterns
+        dep_files = [
+            "package.json",
+            "requirements.txt",
+            "Pipfile",
+            "poetry.lock",
+            "Cargo.toml",
+            "Cargo.lock",
+            "go.mod",
+            "go.sum",
+            "composer.json",
+            "Gemfile",
+            "Gemfile.lock",
+            "yarn.lock",
+            "pnpm-lock.yaml",
+        ]
+
+        # Search for dependency files
+        total_vulns = 0
+        for dep_file in dep_files:
+            for file_path in safe_rglob(inp.root, dep_file):
+                if file_path.is_file():
+                    rel_path = file_path.relative_to(inp.root).as_posix()
+                    if not self._should_skip_file(rel_path, inp):
+                        file_findings, file_vulns = self._scan_dep_file(file_path, rel_path)
+                        findings.extend(file_findings)
+                        total_vulns += file_vulns
+
+        # Add summary
+        findings.append(
+            make_finding(
+                severity=Severity.INFO,
+                file="__summary__",
+                line_start=0,
+                title=f"Dependency Vulnerabilities: {total_vulns} found",
+                description=f"Checked dependencies for known CVEs, found {total_vulns} vulnerabilities",
+                evidence=f"Scanned {len([f for f in findings if 'Dependency' in f.title and 'VULNERABILITY' in f.title])} vulnerable packages",
+            )
+        )
+
+        result.status = AgentStatus.SUCCEEDED
+        result.findings = findings
+        result.data.update(
+            {
+                "total_vulnerabilities": total_vulns,
+                "vulnerable_packages": len([f for f in findings if "VULNERABILITY" in f.title]),
+                "needs_ai": False,
+            }
+        )
+        return
+
+    def _should_skip_file(self, file_path: str, inp: AgentInput) -> bool:
+        """Check if file should be skipped based on restrictions."""
+        from pathlib import PurePosixPath
+
+        # Check restrictions
+        restrictions = inp.config.get("restrictions", [])
+        for r in restrictions:
+            if r.get("enabled", True):
+                path = r["path"]
+                if file_path.startswith(path) or PurePosixPath(file_path).match(path):
+                    if r["type"] == "NO_TOUCH":
+                        return True
+                    elif r["type"] == "SCAN_ONLY" and self.__class__.__name__ == "FixAgent":
+                        return True
+        return False
+
+    def _scan_dep_file(self, file_path: Path, rel_path: str) -> tuple[list[Finding], int]:
+        """Scan a dependency file for vulnerabilities."""
+        findings = []
+        vuln_count = 0
+
+        try:
+            content = file_path.read_text(encoding="utf-8")
+
+            if file_path.name == "package.json":
+                findings, vuln_count = self._scan_package_json(file_path, rel_path, content)
+            elif file_path.name == "requirements.txt":
+                findings, vuln_count = self._scan_requirements_txt(file_path, rel_path, content)
+            elif file_path.name == "Pipfile":
+                findings, vuln_count = self._scan_pipfile(file_path, rel_path, content)
+            elif file_path.name == "poetry.lock":
+                findings, vuln_count = self._scan_poetry_lock(file_path, rel_path, content)
+            elif file_path.name in ["Cargo.toml", "Cargo.lock"]:
+                findings, vuln_count = self._scan_cargo_file(file_path, rel_path, content)
+            elif file_path.name == "go.mod":
+                findings, vuln_count = self._scan_go_mod(file_path, rel_path, content)
+            elif file_path.name == "composer.json":
+                findings, vuln_count = self._scan_composer_json(file_path, rel_path, content)
+            elif file_path.name in ["Gemfile", "Gemfile.lock"]:
+                findings, vuln_count = self._scan_gemfile(file_path, rel_path, content)
+            elif file_path.name in ["yarn.lock", "pnpm-lock.yaml"]:
+                findings, vuln_count = self._scan_lock_file(file_path, rel_path, content)
+
+            findings.append(
+                make_finding(
+                    severity=Severity.INFO,
+                    file=rel_path,
+                    line_start=0,
+                    title=f"Dependency File Scanned: {file_path.name}",
+                    description=f"Checked {file_path.name} for vulnerabilities",
+                    evidence=f"File: {file_path.name}",
+                )
+            )
+
+        except Exception as e:
+            findings.append(
+                make_finding(
+                    severity=Severity.LOW,
+                    file=rel_path,
+                    line_start=0,
+                    title="Dependency file read error",
+                    description=f"Could not read dependency file {file_path.name}: {str(e)}",
+                    evidence=str(e),
+                )
+            )
+
+        return findings, vuln_count
+
+    def _scan_package_json(
+        self, file_path: Path, rel_path: str, content: str
+    ) -> tuple[list[Finding], int]:
+        """Scan package.json for dependencies and vulnerabilities."""
+        findings = []
+        vuln_count = 0
+
+        try:
+            data = json.loads(content)
+            deps = data.get("dependencies", {})
+            dev_deps = data.get("devDependencies", {})
+
+            # Combine all dependencies
+            all_deps = {}
+            all_deps.update(dict(deps.items()))
+            all_deps.update(dict(dev_deps.items()))
+
+            for name, version in all_deps.items():
+                findings.append(
+                    make_finding(
+                        severity=Severity.INFO,
+                        file=rel_path,
+                        line_start=0,
+                        title=f"Dependency: {name}@{version}",
+                        description="JavaScript dependency",
+                        evidence=f"Version: {version}",
+                    )
+                )
+
+                # Check for vulnerabilities via OSV API
+                vulns = self._check_npm_vulnerabilities(name, version)
+                for vuln in vulns:
+                    vuln_count += 1
+                    severity = self._map_osv_severity(
+                        vuln.get("severity", [{}])[0].get("score", "UNKNOWN")
+                    )
+                    findings.append(
+                        make_finding(
+                            severity=severity,
+                            file=rel_path,
+                            line_start=0,
+                            title=f"VULNERABILITY: {name}@{version}",
+                            description=vuln.get("summary", "Unknown vulnerability"),
+                            evidence=json.dumps(vuln),
+                        )
+                    )
+
+        except json.JSONDecodeError as e:
+            findings.append(
+                make_finding(
+                    severity=Severity.HIGH,
+                    file=rel_path,
+                    line_start=e.lineno,
+                    title="Invalid package.json",
+                    description=f"JSON syntax error: {str(e)}",
+                    evidence=e.msg,
+                )
+            )
+
+        return findings, vuln_count
+
+    def _scan_requirements_txt(
+        self, file_path: Path, rel_path: str, content: str
+    ) -> tuple[list[Finding], int]:
+        """Scan requirements.txt for dependencies."""
+        findings = []
+        vuln_count = 0
+
+        lines = content.splitlines()
+        for i, line in enumerate(lines, 1):
+            line = line.strip()
+            if line and not line.startswith("#") and not line.startswith("-"):
+                # Extract package name and version
+                if "==" in line:
+                    pkg_name, version = line.split("==", 1)
+                elif ">=" in line:
+                    pkg_name, version = line.split(">=", 1)
+                elif "<=" in line:
+                    pkg_name, version = line.split("<=", 1)
+                elif ">" in line:
+                    pkg_name, version = line.split(">", 1)
+                elif "<" in line:
+                    pkg_name, version = line.split("<", 1)
+                else:
+                    pkg_name, version = line, "unknown"
+
+                pkg_name = pkg_name.strip()
+                version = version.strip()
+
+                findings.append(
+                    make_finding(
+                        severity=Severity.INFO,
+                        file=rel_path,
+                        line_start=i,
+                        title=f"Dependency: {pkg_name}@{version}",
+                        description="Python dependency",
+                        evidence=line,
+                    )
+                )
+
+                # Check for vulnerabilities via OSV API
+                vulns = self._check_pypi_vulnerabilities(pkg_name, version)
+                for vuln in vulns:
+                    vuln_count += 1
+                    severity = self._map_osv_severity(
+                        vuln.get("severity", [{}])[0].get("score", "UNKNOWN")
+                    )
+                    findings.append(
+                        make_finding(
+                            severity=severity,
+                            file=rel_path,
+                            line_start=i,
+                            title=f"VULNERABILITY: {pkg_name}@{version}",
+                            description=vuln.get("summary", "Unknown vulnerability"),
+                            evidence=json.dumps(vuln),
+                        )
+                    )
+
+        return findings, vuln_count
+
+    def _scan_pipfile(
+        self, file_path: Path, rel_path: str, content: str
+    ) -> tuple[list[Finding], int]:
+        """Scan Pipfile for dependencies."""
+        findings = []
+        vuln_count = 0
+
+        # Pipfiles are TOML format, but Python < 3.11 doesn't have built-in TOML support
+        # So we'll use regex for basic parsing
+        lines = content.splitlines()
+        current_section = ""
+
+        for i, line in enumerate(lines, 1):
+            line = line.strip()
+
+            # Identify section
+            if line.startswith("["):
+                current_section = line.strip("[]").strip()
+                continue
+
+            # Look for package declarations in the right sections
+            if current_section in ["packages", "dev-packages"]:
+                import re
+
+                pkg_match = re.match(r"^(\w[-\w]*)\s*=\s*", line)
+                if pkg_match:
+                    pkg_name = pkg_match.group(1)
+                    # Extract version from the rest of the line
+                    version_part = line[len(pkg_name) :].strip("= ").strip('"')
+                    findings.append(
+                        make_finding(
+                            severity=Severity.INFO,
+                            file=rel_path,
+                            line_start=i,
+                            title=f"Dependency: {pkg_name}@{version_part}",
+                            description="Python dependency from Pipfile",
+                            evidence=line,
+                        )
+                    )
+
+        return findings, vuln_count
+
+    def _scan_poetry_lock(
+        self, file_path: Path, rel_path: str, content: str
+    ) -> tuple[list[Finding], int]:
+        """Scan poetry.lock for dependencies."""
+        findings = []
+        vuln_count = 0
+
+        # Poetry lock files are TOML format
+        lines = content.splitlines()
+        current_package = {}
+
+        for i, line in enumerate(lines, 1):
+            line = line.strip()
+
+            # Look for package entries
+            if line.startswith("[[package]]"):
+                # Process previous package if exists
+                if current_package:
+                    pkg_name = current_package.get("name", "unknown")
+                    version = current_package.get("version", "unknown")
+                    findings.append(
+                        make_finding(
+                            severity=Severity.INFO,
+                            file=rel_path,
+                            line_start=i,
+                            title=f"Dependency: {pkg_name}@{version}",
+                            description="Python dependency from Poetry lock",
+                            evidence=f"{pkg_name}=={version}",
+                        )
+                    )
+
+                current_package = {}
+            elif "=" in line and current_package is not None:
+                # Parse key=value pairs
+                key, value = line.split("=", 1)
+                key = key.strip().strip('"')
+                value = value.strip().strip('"')
+                current_package[key] = value
+
+        # Process the last package
+        if current_package:
+            pkg_name = current_package.get("name", "unknown")
+            version = current_package.get("version", "unknown")
+            findings.append(
+                make_finding(
+                    severity=Severity.INFO,
+                    file=rel_path,
+                    line_start=len(lines),
+                    title=f"Dependency: {pkg_name}@{version}",
+                    description="Python dependency from Poetry lock",
+                    evidence=f"{pkg_name}=={version}",
+                )
+            )
+
+        return findings, vuln_count
+
+    def _scan_cargo_file(
+        self, file_path: Path, rel_path: str, content: str
+    ) -> tuple[list[Finding], int]:
+        """Scan Cargo.toml or Cargo.lock for dependencies."""
+        findings = []
+        vuln_count = 0
+
+        lines = content.splitlines()
+        in_deps_section = False
+
+        for i, line in enumerate(lines, 1):
+            line = line.strip()
+
+            # Identify dependencies section
+            if line.startswith("[dependencies]") or line.startswith("[dev-dependencies]"):
+                in_deps_section = True
+                continue
+            elif line.startswith("[") and in_deps_section:
+                in_deps_section = False
+
+            # Look for package declarations in dependencies section
+            if in_deps_section and "=" in line:
+                import re
+
+                pkg_match = re.match(r"^(\w[\w\-_]*)\s*=", line)
+                if pkg_match:
+                    pkg_name = pkg_match.group(1)
+                    # Extract version from the rest of the line
+                    version_part = line[len(pkg_name) :].strip("= ").strip('"')
+                    findings.append(
+                        make_finding(
+                            severity=Severity.INFO,
+                            file=rel_path,
+                            line_start=i,
+                            title=f"Dependency: {pkg_name}@{version_part}",
+                            description="Rust dependency",
+                            evidence=line,
+                        )
+                    )
+
+        return findings, vuln_count
+
+    def _scan_go_mod(
+        self, file_path: Path, rel_path: str, content: str
+    ) -> tuple[list[Finding], int]:
+        """Scan go.mod for dependencies."""
+        findings = []
+        vuln_count = 0
+
+        lines = content.splitlines()
+
+        for i, line in enumerate(lines, 1):
+            line = line.strip()
+
+            # Look for require statements
+            if line.startswith("require "):
+                # Extract package and version
+                req_parts = line[8:].strip().split()  # Remove "require " prefix
+                if len(req_parts) >= 2:
+                    pkg_name = req_parts[0]
+                    version = req_parts[1]
+                    findings.append(
+                        make_finding(
+                            severity=Severity.INFO,
+                            file=rel_path,
+                            line_start=i,
+                            title=f"Dependency: {pkg_name}@{version}",
+                            description="Go dependency",
+                            evidence=line,
+                        )
+                    )
+
+        return findings, vuln_count
+
+    def _scan_composer_json(
+        self, file_path: Path, rel_path: str, content: str
+    ) -> tuple[list[Finding], int]:
+        """Scan composer.json for PHP dependencies."""
+        findings = []
+        vuln_count = 0
+
+        try:
+            data = json.loads(content)
+            deps = data.get("require", {})
+            dev_deps = data.get("require-dev", {})
+
+            # Combine all dependencies
+            all_deps = {}
+            all_deps.update(dict(deps.items()))
+            all_deps.update(dict(dev_deps.items()))
+
+            for name, version in all_deps.items():
+                findings.append(
+                    make_finding(
+                        severity=Severity.INFO,
+                        file=rel_path,
+                        line_start=0,
+                        title=f"Dependency: {name}@{version}",
+                        description="PHP dependency",
+                        evidence=f"Version: {version}",
+                    )
+                )
+
+        except json.JSONDecodeError as e:
+            findings.append(
+                make_finding(
+                    severity=Severity.HIGH,
+                    file=rel_path,
+                    line_start=e.lineno,
+                    title="Invalid composer.json",
+                    description=f"JSON syntax error: {str(e)}",
+                    evidence=e.msg,
+                )
+            )
+
+        return findings, vuln_count
+
+    def _scan_gemfile(
+        self, file_path: Path, rel_path: str, content: str
+    ) -> tuple[list[Finding], int]:
+        """Scan Gemfile or Gemfile.lock for Ruby dependencies."""
+        findings = []
+        vuln_count = 0
+
+        lines = content.splitlines()
+
+        for i, line in enumerate(lines, 1):
+            line = line.strip()
+
+            # Look for gem statements
+            if "gem " in line and not line.startswith("#"):
+                import re
+
+                # Extract gem name
+                gem_match = re.search(r'gem\s+["\']([^"\']+)["\']', line)
+                if gem_match:
+                    gem_name = gem_match.group(1)
+                    findings.append(
+                        make_finding(
+                            severity=Severity.INFO,
+                            file=rel_path,
+                            line_start=i,
+                            title=f"Dependency: {gem_name}",
+                            description="Ruby dependency",
+                            evidence=line,
+                        )
+                    )
+
+        return findings, vuln_count
+
+    def _scan_lock_file(
+        self, file_path: Path, rel_path: str, content: str
+    ) -> tuple[list[Finding], int]:
+        """Scan lock files (yarn.lock, pnpm-lock.yaml) for dependencies."""
+        findings = []
+        vuln_count = 0
+
+        lines = content.splitlines()
+
+        # Different parsing for different lock file types
+        if file_path.name == "yarn.lock":
+            # Yarn lock files have "package@version" entries
+            for i, line in enumerate(lines, 1):
+                if line.strip().endswith(":") and "@" in line:
+                    # Extract package and version
+                    pkg_part = line.strip().rstrip(":")
+                    if "@" in pkg_part:
+                        pkg_name = pkg_part.split("@")[0]
+                        findings.append(
+                            make_finding(
+                                severity=Severity.INFO,
+                                file=rel_path,
+                                line_start=i,
+                                title=f"Dependency: {pkg_name}",
+                                description="JavaScript dependency from lock file",
+                                evidence=pkg_part,
+                            )
+                        )
+        elif file_path.name == "pnpm-lock.yaml":
+            # PNPM lock files have similar format to yarn
+            for i, line in enumerate(lines, 1):
+                if line.strip().endswith(":") and "/" in line:
+                    # Extract package name
+                    pkg_part = line.strip().rstrip(":")
+                    if "/" in pkg_part and "@" in pkg_part:
+                        pkg_name = pkg_part.split("/")[-1].split("@")[0]
+                        findings.append(
+                            make_finding(
+                                severity=Severity.INFO,
+                                file=rel_path,
+                                line_start=i,
+                                title=f"Dependency: {pkg_name}",
+                                description="JavaScript dependency from pnpm lock",
+                                evidence=pkg_part,
+                            )
+                        )
+
+        return findings, vuln_count
+
+    def _check_npm_vulnerabilities(self, package_name: str, version: str) -> list[dict]:
+        """Check npm package for vulnerabilities via OSV API (cached)."""
+        return cached_osv_query(package_name, version, "npm", self._root)
+
+    def _check_pypi_vulnerabilities(self, package_name: str, version: str) -> list[dict]:
+        """Check PyPI package for vulnerabilities via OSV API (cached)."""
+        return cached_osv_query(package_name, version, "PyPI", self._root)
+
+    def _map_osv_severity(self, osv_severity: str) -> Severity:
+        """Map OSV severity to our severity levels."""
+        if not osv_severity or osv_severity == "UNKNOWN":
+            return Severity.LOW
+
+        # Convert to uppercase for comparison
+        sev = osv_severity.upper()
+
+        if sev == "CRITICAL":
+            return Severity.CRITICAL
+        elif sev == "HIGH":
+            return Severity.HIGH
+        elif sev == "MEDIUM":
+            return Severity.MEDIUM
+        else:
+            return Severity.LOW