patchi 0.7.5__py3-none-any.whl

patchi/core/security/network_agent.py

@@ -0,0 +1,376 @@
+"""
+NetworkAgent — network security configuration issues.
+
+Detects network-related security issues:
+- Insecure SSL/TLS configurations
+- Missing HTTPS redirects
+- Weak cipher suites
+- Open ports/services
+- Missing security headers
+- Improper firewall rules
+- Unencrypted communication
+
+Uses pattern matching and configuration analysis.
+Does NOT call AI.
+Does NOT write to disk.
+Does NOT touch the queue.
+"""
+
+from __future__ import annotations
+
+import re
+from pathlib import Path
+
+from ..agents.base import (
+    AgentDomain,
+    AgentGroup,
+    AgentInput,
+    AgentResult,
+    AgentStatus,
+    BaseAgent,
+    Finding,
+    Severity,
+    make_finding,
+    register,
+    safe_rglob,
+)
+
+
+@register
+class NetworkAgent(BaseAgent):
+    """Agent for detecting network security issues."""
+
+    group = AgentGroup.SECURITY
+    domain = AgentDomain.SECURITY
+    name = "NetworkAgent"
+    description = "Network security: SSL/TLS, HTTPS redirects, cipher suites, security headers"
+
+    def _run(self, inp: AgentInput, result: AgentResult) -> None:
+        """Run network security configuration detection."""
+        findings = []
+
+        # Define configuration and source file patterns to scan
+        patterns = [
+            "*.py",
+            "*.js",
+            "*.jsx",
+            "*.ts",
+            "*.tsx",
+            "*.java",
+            "*.php",
+            "*.rb",
+            "*.go",
+            "*.rs",
+            "*.cpp",
+            "*.cxx",
+            "*.cc",
+            "*.c",
+            "*.h",
+            "*.hpp",
+            "*.cs",
+            "*.json",
+            "*.yml",
+            "*.yaml",
+            "*.toml",
+            "*.config",
+            "*.conf",
+            "*.ini",
+            "*.xml",
+            "Dockerfile*",
+            "docker-compose*.yml",
+            "**/config/**",
+            "**/nginx/**",
+            "**/apache/**",
+            "**/ssl/**",
+            "**/tls/**",
+        ]
+
+        # Search for files
+        for pattern in patterns:
+            for file_path in safe_rglob(inp.root, pattern):
+                if file_path.is_file():
+                    rel_path = file_path.relative_to(inp.root).as_posix()
+                    if not self._should_skip_file(rel_path, inp):
+                        findings.extend(self._scan_file_network_security(file_path, rel_path))
+
+        result.status = AgentStatus.SUCCEEDED
+        result.findings = findings
+        result.data.update(
+            {
+                "network_findings": len(
+                    [
+                        f
+                        for f in findings
+                        if any(
+                            word in f.title.lower()
+                            for word in [
+                                "ssl",
+                                "tls",
+                                "https",
+                                "cipher",
+                                "header",
+                                "redirect",
+                                "encryption",
+                            ]
+                        )
+                    ]
+                ),
+                "needs_ai": False,
+            }
+        )
+        return
+
+    def _should_skip_file(self, file_path: str, inp: AgentInput) -> bool:
+        """Check if file should be skipped based on restrictions."""
+        from pathlib import PurePosixPath
+
+        # Check restrictions
+        restrictions = inp.config.get("restrictions", [])
+        for r in restrictions:
+            if r.get("enabled", True):
+                path = r["path"]
+                if file_path.startswith(path) or PurePosixPath(file_path).match(path):
+                    if r["type"] == "NO_TOUCH":
+                        return True
+                    elif r["type"] == "SCAN_ONLY" and self.__class__.__name__ == "FixAgent":
+                        return True
+        return False
+
+    def _scan_file_network_security(self, file_path: Path, rel_path: str) -> list[Finding]:
+        """Scan a file for network security issues."""
+        findings = []
+
+        try:
+            content = file_path.read_text(encoding="utf-8")
+
+            # Check for SSL/TLS issues
+            findings.extend(self._scan_ssl_tls_issues(content, rel_path))
+
+            # Check for HTTPS redirect issues
+            findings.extend(self._scan_https_redirects(content, rel_path))
+
+            # Check for weak cipher suites
+            findings.extend(self._scan_cipher_suites(content, rel_path))
+
+            # Check for missing security headers
+            findings.extend(self._scan_security_headers(content, rel_path))
+
+            # Check for other network security issues
+            findings.extend(self._scan_other_network_issues(content, rel_path))
+
+        except Exception as e:
+            findings.append(
+                make_finding(
+                    severity=Severity.LOW,
+                    file=rel_path,
+                    line_start=0,
+                    title="Network security scanner file read error",
+                    description=f"Could not analyze {file_path.name} for network security issues: {str(e)}",
+                    evidence=str(e),
+                )
+            )
+
+        return findings
+
+    def _scan_ssl_tls_issues(self, content: str, rel_path: str) -> list[Finding]:
+        """Scan for SSL/TLS configuration issues."""
+        findings = []
+
+        # Look for weak SSL/TLS protocol versions
+        ssl_patterns = [
+            (r"SSLv2|SSLv3|TLSv1(\.0)?", "Weak SSL/TLS Protocol", Severity.CRITICAL),
+            (r"ssl_version.*TLSv1(_0|0)?", "Weak TLS Version", Severity.CRITICAL),
+            (r"tls_min_version.*TLSv1(_0|0)?", "Weak TLS Minimum Version", Severity.CRITICAL),
+            (
+                r"protocol.*SSLv2|protocol.*SSLv3|protocol.*TLSv1(\.0)?",
+                "Weak Protocol Configuration",
+                Severity.CRITICAL,
+            ),
+        ]
+
+        lines = content.splitlines()
+        for i, line in enumerate(lines, 1):
+            for pattern, description, severity in ssl_patterns:
+                matches = re.finditer(pattern, line, re.IGNORECASE)
+                for match in matches:
+                    findings.append(
+                        make_finding(
+                            severity=severity,
+                            file=rel_path,
+                            line_start=i,
+                            title=description,
+                            description=f"Weak SSL/TLS protocol configuration found: {match.group(0)}",
+                            evidence=line.strip(),
+                        )
+                    )
+
+        return findings
+
+    def _scan_https_redirects(self, content: str, rel_path: str) -> list[Finding]:
+        """Scan for HTTPS redirect issues."""
+        findings = []
+
+        has_https_enforcement = bool(
+            re.search(
+                r"redirect.*https|enable.*https|hsts|strict-transport-security",
+                content,
+                re.IGNORECASE,
+            )
+        )
+        has_plain_http = bool(
+            re.search(
+                r"http://(?!localhost|127\.0\.0\.1|0\.0\.0\.0)",
+                content,
+            )
+        )
+
+        if has_plain_http and not has_https_enforcement:
+            lines = content.splitlines()
+            for i, line in enumerate(lines, 1):
+                if re.search(r"http://(?!localhost|127\.0\.0\.1|0\.0\.0\.0)", line):
+                    findings.append(
+                        make_finding(
+                            severity=Severity.MEDIUM,
+                            file=rel_path,
+                            line_start=i,
+                            title="Plain HTTP without HTTPS enforcement",
+                            description="Plain HTTP URL found without HTTPS redirect/enforcement",
+                            evidence=line.strip(),
+                        )
+                    )
+
+        return findings
+
+    def _scan_cipher_suites(self, content: str, rel_path: str) -> list[Finding]:
+        """Scan for weak cipher suite configurations."""
+        findings = []
+
+        # Look for weak cipher suites
+        weak_cipher_patterns = [
+            (r"\bRC4\b|\bDES\b|\b3DES\b|\bMD5\b|\bSHA1\b", "Weak Cipher Suite", Severity.HIGH),
+            (
+                r"cipher.*\bRC4\b|cipher.*\bDES\b|cipher.*\b3DES\b|cipher.*\bMD5\b",
+                "Weak Cipher Configuration",
+                Severity.HIGH,
+            ),
+            (r"\baes-128\b|\bdes-cbc\b", "Potentially Weak Cipher", Severity.MEDIUM),
+        ]
+
+        lines = content.splitlines()
+        for i, line in enumerate(lines, 1):
+            for pattern, description, severity in weak_cipher_patterns:
+                matches = re.finditer(pattern, line, re.IGNORECASE)
+                for match in matches:
+                    findings.append(
+                        make_finding(
+                            severity=severity,
+                            file=rel_path,
+                            line_start=i,
+                            title=description,
+                            description=f"Weak cipher suite configuration found: {match.group(0)}",
+                            evidence=line.strip(),
+                        )
+                    )
+
+        return findings
+
+    def _scan_security_headers(self, content: str, rel_path: str) -> list[Finding]:
+        """Scan for missing security headers."""
+        findings = []
+
+        # Look for missing security headers
+        security_headers = [
+            "Strict-Transport-Security",
+            "X-Frame-Options",
+            "X-Content-Type-Options",
+            "X-XSS-Protection",
+            "Content-Security-Policy",
+        ]
+
+        # Check if security headers are set
+        lines = content.splitlines()
+        for _i, line in enumerate(lines, 1):
+            # Look for response header setting
+            if any(header.lower() in line.lower() for header in security_headers):
+                continue  # Header is being set, no issue here
+            elif any(
+                setting_pattern in line.lower()
+                for setting_pattern in ["header(", "setheader", "response.header"]
+            ):
+                # Check if it's setting a security header
+                has_security_header = False
+                for header in security_headers:
+                    if header.lower() in line.lower():
+                        has_security_header = True
+                        break
+                if not has_security_header:
+                    # This line sets a header but not a security header
+                    # This alone isn't necessarily bad, but let's check for missing headers in context
+                    pass
+
+        # Look for common web frameworks where security headers should be set
+        framework_indicators = ["express", "django", "flask", "fastapi", "spring", "laravel"]
+        if any(indicator in content.lower() for indicator in framework_indicators):
+            # Check if security headers are configured
+            has_hsts = any(
+                hsts_pattern in content.lower()
+                for hsts_pattern in ["strict-transport-security", "hsts"]
+            )
+            has_xfo = any(
+                xfo_pattern in content.lower()
+                for xfo_pattern in ["x-frame-options", "frame-options"]
+            )
+            has_xcto = any(
+                xcto_pattern in content.lower()
+                for xcto_pattern in ["x-content-type-options", "nosniff"]
+            )
+
+            missing_headers = []
+            if not has_hsts:
+                missing_headers.append("HSTS")
+            if not has_xfo:
+                missing_headers.append("X-Frame-Options")
+            if not has_xcto:
+                missing_headers.append("X-Content-Type-Options")
+
+            if missing_headers:
+                findings.append(
+                    make_finding(
+                        severity=Severity.MEDIUM,
+                        file=rel_path,
+                        line_start=0,
+                        title=f"Missing Security Headers: {', '.join(missing_headers)}",
+                        description=f"Common security headers not configured: {', '.join(missing_headers)}",
+                        evidence=f"Detected web framework but missing security headers: {', '.join(missing_headers)}",
+                    )
+                )
+
+        return findings
+
+    def _scan_other_network_issues(self, content: str, rel_path: str) -> list[Finding]:
+        """Scan for other network security issues."""
+        findings = []
+
+        # Look for plain HTTP URLs in secure contexts
+        http_patterns = [
+            (r'http://[^s][^"\'\s]+', "Plain HTTP URL", Severity.MEDIUM),
+            (r'"http://|\'http://', "Plain HTTP Reference", Severity.MEDIUM),
+        ]
+
+        lines = content.splitlines()
+        for i, line in enumerate(lines, 1):
+            for pattern, description, severity in http_patterns:
+                matches = re.finditer(pattern, line, re.IGNORECASE)
+                for match in matches:
+                    findings.append(
+                        make_finding(
+                            severity=severity,
+                            file=rel_path,
+                            line_start=i,
+                            title=description,
+                            description=f"Plain HTTP URL found in potentially secure context: {match.group(0)}",
+                            evidence=line.strip(),
+                        )
+                    )
+
+        return findings

patchi/core/security/noise_filter.py

@@ -0,0 +1,274 @@
+"""
+Noise Filter — classifies and suppresses findings from non-source files.
+
+The scanner's largest false-positive source is not weak detection logic —
+it is scanning files whose contents are *supposed* to look dangerous:
+test fixtures with fake secrets, migration SQL strings, lockfile blobs,
+minified bundles, generated protobuf stubs.
+
+NoiseFilter assigns every finding's file path to a category and either
+discards or severity-caps the finding per config (``noise_filter``):
+
+    enabled        default true
+    mode           "cap" (default: downgrade to info + tag) | "discard"
+    skip_tests     default true   — test_*, *_test.*, conftest, spec/, fixtures/
+    skip_locks     default true   — package-lock.json, yarn.lock, poetry.lock, ...
+    skip_generated default true   — *.min.js, *_pb2.py, *.map, *_pb2_grpc.py, ...
+    skip_docs      default true   — *.md, *.rst, *.txt, *.csv
+
+Honesty rule: capped findings are never deleted silently — they keep their
+data, marked ``noise_category`` so the user can see exactly what was muted
+and why.
+"""
+
+from __future__ import annotations
+
+import fnmatch
+import logging
+from dataclasses import dataclass, field
+from pathlib import PurePosixPath
+
+_log = logging.getLogger("patchi.noise_filter")
+
+# ── Category definitions ─────────────────────────────────────────────────────
+
+_LOCKFILE_NAMES = frozenset(
+    {
+        "package-lock.json",
+        "npm-shrinkwrap.json",
+        "yarn.lock",
+        "pnpm-lock.yaml",
+        "poetry.lock",
+        "Pipfile.lock",
+        "Cargo.lock",
+        "composer.lock",
+        "Gemfile.lock",
+        "packages.locker",
+        "mix.lock",
+        "go.sum",
+        "bun.lockb",
+    }
+)
+
+_GENERATED_PATTERNS = (
+    "*.min.js",
+    "*.min.css",
+    "*.min.mjs",
+    "*.map",
+    "*.bundle.js",
+    "*_pb2.py",
+    "*_pb2_grpc.py",
+    "*_pb.py",
+    "*.pb.go",
+    "*_pb2.pyi",
+    "*-gen.py",
+    "*_gen.go",
+    "*.generated.*",
+    "*.g.cs",
+    "*.Designer.cs",
+    "*.snap",
+    "__snapshots__/*",
+)
+
+_DOC_PATTERNS = ("*.md", "*.mdx", "*.rst", "*.txt", "*.csv", "*.log")
+
+_TEST_FILE_PATTERNS = (
+    "test_*.py",
+    "*_test.py",
+    "*_test.go",
+    "*_test.dart",
+    "conftest.py",
+    "test_utils.py",
+    "*.spec.ts",
+    "*.spec.tsx",
+    "*.spec.js",
+    "*.spec.jsx",
+    "*.spec.mjs",
+    "*.test.ts",
+    "*.test.tsx",
+    "*.test.js",
+    "*.test.jsx",
+    "*.test.mjs",
+    "*_test.rb",
+    "*.spec.rb",
+)
+
+_TEST_DIR_MARKERS = frozenset(
+    {
+        "test",
+        "tests",
+        "spec",
+        "specs",
+        "fixtures",
+        "fixture",
+        "testdata",
+        "test_data",
+        "mock",
+        "mocks",
+        "stubs",
+        "__snapshots__",
+        "__tests__",
+        "testing",
+    }
+)
+
+
+def classify(path: str) -> str | None:
+    """Return the noise category for a path, or None if it looks like source.
+
+    Categories: "lockfile", "generated", "docs", "tests".
+    Order matters: lockfile > generated > docs > tests.
+    """
+    p = PurePosixPath(path.replace("\\", "/"))
+    name = p.name
+
+    # 1. Lockfiles — exact name match anywhere in the tree
+    if name in _LOCKFILE_NAMES:
+        return "lockfile"
+
+    # 2. Generated/minified — pattern match on filename
+    for pat in _GENERATED_PATTERNS:
+        if "/" not in pat and fnmatch.fnmatch(name, pat):
+            return "generated"
+
+    # 3. Docs — extension-based
+    for pat in _DOC_PATTERNS:
+        if fnmatch.fnmatch(name, pat):
+            return "docs"
+
+    # 4. Tests — filename pattern OR directory marker in path
+    for pat in _TEST_FILE_PATTERNS:
+        if fnmatch.fnmatch(name, pat):
+            return "tests"
+    parts = {seg.lower() for seg in p.parts[:-1]}
+    if parts & _TEST_DIR_MARKERS:
+        return "tests"
+
+    return None
+
+
+@dataclass
+class NoiseReport:
+    """Summary of what the filter suppressed and why."""
+
+    total_in: int = 0
+    kept: int = 0
+    capped: int = 0
+    discarded: int = 0
+    by_category: dict = field(default_factory=dict)
+
+    def to_dict(self) -> dict:
+        return {
+            "total_in": self.total_in,
+            "kept": self.kept,
+            "capped": self.capped,
+            "discarded": self.discarded,
+            "by_category": dict(self.by_category),
+            "statement": (
+                f"{self.kept}/{self.total_in} findings kept "
+                f"({self.capped} noise-capped, {self.discarded} discarded)"
+            ),
+        }
+
+
+class NoiseFilter:
+    """Filters or severity-caps findings originating from noise files."""
+
+    def __init__(self, root=None, config: dict | None = None):
+        cfg = (config or {}).get("noise_filter", {})
+        self.enabled: bool = bool(cfg.get("enabled", True))
+        self.mode: str = cfg.get("mode", "cap")  # "cap" | "discard"
+        self.skip_tests: bool = bool(cfg.get("skip_tests", True))
+        self.skip_locks: bool = bool(cfg.get("skip_locks", True))
+        self.skip_generated: bool = bool(cfg.get("skip_generated", True))
+        self.skip_docs: bool = bool(cfg.get("skip_docs", True))
+
+    # ── Single-path API ─────────────────────────────────────────────────────
+
+    def category_for(self, path: str) -> str | None:
+        """Category for this path, honoring the skip_* toggles."""
+        cat = classify(path)
+        if cat == "lockfile" and not self.skip_locks:
+            return None
+        if cat == "generated" and not self.skip_generated:
+            return None
+        if cat == "docs" and not self.skip_docs:
+            return None
+        if cat == "tests" and not self.skip_tests:
+            return None
+        return cat
+
+    def is_noise(self, path: str) -> bool:
+        return self.category_for(path) is not None
+
+    # ── Finding-list API ────────────────────────────────────────────────────
+
+    def apply(self, findings: list) -> tuple[list, NoiseReport]:
+        """Split findings into (kept, report).
+
+        Accepts Finding objects *or* plain dicts (as produced by
+        ``merge_results``); each entry needs a ``file`` key/attribute.
+        In "cap" mode noisy findings stay in the kept list but their
+        severity is downgraded to info and they gain a ``noise_category``
+        annotation. In "discard" mode they are removed entirely.
+        """
+        report = NoiseReport(total_in=len(findings))
+        kept: list = []
+        for f in findings:
+            path = _get(f, "file", "") or ""
+            cat = self.category_for(path) if (self.enabled and path) else None
+            if cat is None:
+                kept.append(f)
+                report.kept += 1
+                continue
+            report.by_category[cat] = report.by_category.get(cat, 0) + 1
+            if self.mode == "discard":
+                report.discarded += 1
+                continue
+            # cap mode: downgrade + annotate, never delete silently
+            _set_severity_info(f)
+            _set(f, "noise_category", cat)
+            kept.append(f)
+            report.capped += 1
+            report.kept += 1
+        if report.total_in and (report.capped or report.discarded):
+            _log.info(
+                "Noise filter: %d/%d findings from noise files (%s)",
+                report.capped + report.discarded,
+                report.total_in,
+                ", ".join(f"{k}={v}" for k, v in sorted(report.by_category.items())),
+            )
+        return kept, report
+
+
+# ── Polymorphic accessors (Finding objects vs merged dicts) ─────────────
+
+
+def _get(f, key: str, default=None):
+    if isinstance(f, dict):
+        return f.get(key, default)
+    return getattr(f, key, default)
+
+
+def _set(f, key: str, value) -> None:
+    if isinstance(f, dict):
+        f[key] = value
+        return
+    try:
+        setattr(f, key, value)
+    except Exception as _exc:  # noqa: BLE001 — frozen/sealed objects: skip silently
+        _log.debug('_set skipped: %s', _exc)
+
+
+def _set_severity_info(f) -> None:
+    """Downgrade severity to INFO, matching the container's own encoding."""
+    if isinstance(f, dict):
+        # merge_results dicts carry severity as a plain string
+        f["severity"] = "info"
+        return
+    try:
+        from patchi.core.agents.base import Severity
+
+        f.severity = Severity.INFO
+    except Exception as _exc:  # noqa: BLE001 — frozen/sealed objects: annotate only
+        _log.debug('_set_severity_info skipped: %s', _exc)