patchi 0.7.5__py3-none-any.whl

patchi/core/security/runtime_validator.py

@@ -0,0 +1,245 @@
+"""
+Runtime Security Validation (Layer 5) — DAST for web apps.
+
+Deploys the generated app in an isolated environment and runs:
+- Security header validation on actual HTTP responses
+- TLS/SSL configuration checks
+- HTTP method tampering tests
+- Server information leakage detection
+- Basic active probing (when dev mode enabled)
+
+Requires the app to be running (or spins up via Docker if available).
+"""
+
+from __future__ import annotations
+
+import logging
+import subprocess
+import urllib.error
+import urllib.request
+
+from patchi.core.agents.base import (
+    AgentGroup,
+    AgentInput,
+    AgentResult,
+    BaseAgent,
+    Finding,
+    Severity,
+    register,
+)
+from patchi.core.constants import is_offline
+
+# ── Expected security headers ─────────────────────────────────────────────────
+
+_REQUIRED_HEADERS = {
+    "strict-transport-security": ("HSTS missing", Severity.HIGH, "CWE-319"),
+    "x-content-type-options": ("X-Content-Type-Options missing", Severity.MEDIUM, "CWE-693"),
+    "x-frame-options": ("X-Frame-Options missing (clickjacking)", Severity.MEDIUM, "CWE-1021"),
+    "x-xss-protection": ("X-XSS-Protection missing", Severity.LOW, "CWE-79"),
+    "content-security-policy": ("Content-Security-Policy missing", Severity.HIGH, "CWE-693"),
+    "referrer-policy": ("Referrer-Policy missing", Severity.LOW, "CWE-200"),
+    "permissions-policy": ("Permissions-Policy missing", Severity.LOW, "CWE-250"),
+}
+
+_DANGEROUS_HEADERS = {
+    "server": ("Server header leaks version info", Severity.LOW, "CWE-200"),
+    "x-powered-by": ("X-Powered-By header leaks technology stack", Severity.LOW, "CWE-200"),
+}
+
+_SENSITIVE_METHODS = ["PUT", "DELETE", "PATCH", "TRACE", "OPTIONS"]
+
+
+_log = logging.getLogger("patchi.security.runtime_validator")
+
+
+def _check_headers(url: str) -> list[dict]:
+    """Fetch URL and check security headers."""
+    findings = []
+    try:
+        req = urllib.request.Request(url, method="GET")
+        req.add_header("User-Agent", "Patchi-SecurityValidator/1.0")
+        with urllib.request.urlopen(req, timeout=10) as resp:
+            headers = {k.lower(): v for k, v in resp.headers.items()}
+
+            for header, (msg, sev, cwe) in _REQUIRED_HEADERS.items():
+                if header not in headers:
+                    findings.append(
+                        {"message": msg, "severity": sev.value, "cwe": cwe, "header": header}
+                    )
+
+            for header, (msg, sev, cwe) in _DANGEROUS_HEADERS.items():
+                if header in headers:
+                    findings.append(
+                        {
+                            "message": f"{msg}: {headers[header]}",
+                            "severity": sev.value,
+                            "cwe": cwe,
+                            "header": header,
+                        }
+                    )
+
+    except (urllib.error.URLError, urllib.error.HTTPError, OSError, ValueError):
+        pass
+
+    return findings
+
+
+def _check_method_tampering(base_url: str) -> list[dict]:
+    """Test if sensitive HTTP methods are allowed."""
+    findings = []
+    for method in _SENSITIVE_METHODS:
+        try:
+            req = urllib.request.Request(base_url, method=method)
+            req.add_header("User-Agent", "Patchi-SecurityValidator/1.0")
+            with urllib.request.urlopen(req, timeout=5) as resp:
+                if resp.status < 400:
+                    findings.append(
+                        {
+                            "message": f"HTTP {method} allowed on {base_url} (status {resp.status})",
+                            "severity": "medium" if method in ("PUT", "DELETE", "PATCH") else "low",
+                            "cwe": "CWE-749",
+                        }
+                    )
+        except (urllib.error.HTTPError, urllib.error.URLError, OSError):
+            # 405 Method Not Allowed is expected
+            pass
+        except Exception as e:
+            _log.warning("_check_method_tampering failed: %s", e)
+
+    return findings
+
+
+def _check_tls(url: str) -> list[dict]:
+    """Basic TLS check — verify HTTPS and cert validity."""
+    findings = []
+    if url.startswith("http://"):
+        findings.append(
+            {
+                "message": "Application uses plain HTTP — no TLS",
+                "severity": "high",
+                "cwe": "CWE-319",
+            }
+        )
+
+    # Try sslyze if available
+    try:
+        from urllib.parse import urlparse
+
+        parsed = urlparse(url)
+        hostname = parsed.hostname or ""
+        if hostname:
+            proc = subprocess.run(
+                ["sslyze", "--json", hostname],
+                capture_output=True,
+                text=True,
+                timeout=15,
+            )
+            if proc.returncode == 0 and proc.stdout.strip():
+                import json
+
+                data = json.loads(proc.stdout)
+                for scan in data.get("scan_result", {}).get("tls_cipher_suites", []):
+                    for suite in scan.get("tls_cipher_suites", []):
+                        name = suite.get("name", "")
+                        if any(
+                            weak in name.upper() for weak in ("RC4", "DES", "NULL", "EXPORT", "MD5")
+                        ):
+                            findings.append(
+                                {
+                                    "message": f"Weak TLS cipher: {name}",
+                                    "severity": "high",
+                                    "cwe": "CWE-326",
+                                }
+                            )
+    except (FileNotFoundError, subprocess.TimeoutExpired, Exception):
+        pass
+
+    return findings
+
+
+# ── Runtime Validator Agent ───────────────────────────────────────────────────
+
+
+@register
+class RuntimeValidatorAgent(BaseAgent):
+    """Runtime security validation: headers, TLS, method tampering."""
+
+    name = "RuntimeValidatorAgent"
+    group = AgentGroup.SECURITY
+    timeout = 60
+
+    def _run(self, inp: AgentInput, result: AgentResult) -> None:
+        if is_offline():
+            result.add_finding(
+                Finding(
+                    agent=self.name,
+                    type="skipped_offline",
+                    severity=Severity.INFO,
+                    file="",
+                    message="Runtime validation skipped — offline mode (no live probing)",
+                )
+            )
+            return
+
+        # Look for configured URL in brain or config
+        app_url = (
+            inp.brain.get("app_url", "")
+            or inp.config.get("app_url", "")
+            or inp.extra.get("app_url", "")
+        )
+
+        if not app_url:
+            result.add_finding(
+                Finding(
+                    agent=self.name,
+                    type="no_target_url",
+                    severity=Severity.INFO,
+                    file="",
+                    message="No app URL configured — set 'app_url' in config or brain to enable runtime validation",
+                )
+            )
+            return
+
+        # 1. Header checks
+        header_findings = _check_headers(app_url)
+        for f in header_findings:
+            result.add_finding(
+                Finding(
+                    agent=self.name,
+                    type="missing_header" if "missing" in f["message"] else "header_leak",
+                    severity=Severity(f["severity"]),
+                    file=app_url,
+                    message=f["message"],
+                    cwe=f["cwe"],
+                )
+            )
+
+        # 2. TLS check
+        tls_findings = _check_tls(app_url)
+        for f in tls_findings:
+            result.add_finding(
+                Finding(
+                    agent=self.name,
+                    type="tls_issue",
+                    severity=Severity(f["severity"]),
+                    file=app_url,
+                    message=f["message"],
+                    cwe=f["cwe"],
+                )
+            )
+
+        # 3. Method tampering
+        method_findings = _check_method_tampering(app_url)
+        for f in method_findings:
+            result.add_finding(
+                Finding(
+                    agent=self.name,
+                    type="method_tampering",
+                    severity=Severity(f["severity"]),
+                    file=app_url,
+                    message=f["message"],
+                    cwe=f["cwe"],
+                )
+            )
+
+        result.files_scanned = 1

patchi/core/security/saml_sso_agent.py

@@ -0,0 +1,401 @@
+"""SAML/SSO security agent — validates SAML implementations against known attack patterns."""
+
+from __future__ import annotations
+
+import logging
+import re
+import shutil
+import subprocess
+
+from ..agents.base import (
+    AgentDomain,
+    AgentGroup,
+    AgentInput,
+    AgentResult,
+    AgentStatus,
+    BaseAgent,
+    Finding,
+    Severity,
+    make_finding,
+    register,
+    safe_rglob,
+)
+from ..brain.trace_log import trace_agent
+
+# SAML library detection patterns
+SAML_LIBRARIES = {
+    "pysaml2": {
+        "import": r"from\s+saml2\b|import\s+saml2\b",
+        "config": r"saml2\.config|SPConfig|IdPConfig",
+    },
+    "onelogin": {
+        "import": r"from\s+onelogin\.saml2\b|import\s+onelogin\.saml2\b",
+        "auth": r"OneLogin_Saml2_Auth|AuthnRequest",
+    },
+    "python3-saml": {
+        "import": r"from\s+onelogin\.saml2\b|import\s+onelogin\.saml2\b",
+        "settings": r"saml_settings|SAML_SETTINGS",
+    },
+    "lxml-saml": {
+        "import": r"from\s+lxml\.etree\b|import\s+lxml\.etree\b",
+        "etree": r"etree\.fromstring|etree\.parse|etree\.XML",
+    },
+}
+
+# Dangerous XML patterns (XXE, XSW)
+XXE_PATTERNS = [
+    (r"resolve_entities\s*=\s*True", "XML entity resolution enabled"),
+    (r"no_network\s*=\s*False", "Network access during XML parsing"),
+    (r"DTDLOAD|dtd_load|load_dtd", "DTD loading enabled"),
+    (r"ENTITY|entity|<!ENTITY", "XML entity declaration (potential XXE)"),
+    (r"SYSTEM\s+[\"']", "XML SYSTEM entity reference"),
+]
+
+XSW_PATTERNS = [
+    (r"cloneNode|importNode|appendChild.*Signature", "XML Signature Wrapping — node cloning"),
+    (r"insertBefore.*Signature", "XML Signature Wrapping — insert before signature"),
+    (r"getElementById.*Signature", "XML Signature Wrapping — ID reference"),
+]
+
+SIGNATURE_VALIDATION_PATTERNS = [
+    (
+        r"check_signature|validate_signature|verify_signature|isValidSignature",
+        "Signature validation present",
+    ),
+    (r"assertion.*valid|validate.*assertion", "Assertion validation"),
+    (r"SignedInfo|Reference.*URI.*DigestValue", "XML signature structure detected"),
+]
+
+ASSERTION_LIFETIME_PATTERNS = [
+    (r"NotBefore|NotOnOrAfter", "Assertion time bounds present"),
+    (r"SessionIndex|session_not_on_or_after", "Session index tracking"),
+    (r"clock_slop|clockSkew|ALLOWED_CLOCK_SKEW", "Clock skew tolerance configured"),
+]
+
+RELAYSTATE_PATTERNS = [
+    (r"RelayState|relay_state", "RelayState handling detected"),
+    (r"redirect.*url|return.*url|target.*url", "Redirect URL handling"),
+]
+
+CONTROL_IDS = {
+    "SAML-01": ("SAML XXE in XML parsing", Severity.CRITICAL),
+    "SAML-02": ("XML Signature Wrapping attack vector", Severity.CRITICAL),
+    "SAML-03": ("Weak algorithm enforcement (SHA-1)", Severity.HIGH),
+    "SAML-04": ("Missing signature validation", Severity.HIGH),
+    "SAML-05": ("No assertion lifetime enforcement", Severity.HIGH),
+    "SAML-06": ("RelayState open redirect", Severity.MEDIUM),
+    "SAML-07": ("SAML library in use", Severity.INFO),
+    "SAML-08": ("Assertion replay protection missing", Severity.HIGH),
+    "SAML-09": ("Certificate trust not pinned", Severity.MEDIUM),
+}
+
+
+_log = logging.getLogger("patchi.security.saml_sso_agent")
+
+
+@register
+class SamlSSOAgent(BaseAgent):
+    name = "SamlSSOAgent"
+    group = AgentGroup.SECURITY
+    domain = AgentDomain.SECURITY
+    description = (
+        "SAML/SSO security: XSW, XXE, algorithm enforcement, assertion replay, certificate trust"
+    )
+
+    def _run(self, inp: AgentInput, result: AgentResult) -> None:
+        with trace_agent(self.name, inp.root) as trace:
+            findings: list[Finding] = []
+            files_scanned = 0
+
+            # Phase 1: Static analysis of source code
+            for fpath in safe_rglob(inp.root, "*.py"):
+                files_scanned += 1
+                try:
+                    content = fpath.read_text(encoding="utf-8", errors="replace")
+                except Exception as e:
+                    _log.warning("SamlSSOAgent._run failed: %s", e)
+                    continue
+
+                rel = str(fpath.relative_to(inp.root))
+
+                # Detect SAML library usage
+                for lib_name, lib_patterns in SAML_LIBRARIES.items():
+                    for pattern_key, pattern in lib_patterns.items():
+                        for m in re.finditer(pattern, content, re.IGNORECASE):
+                            line_no = content[: m.start()].count("\n") + 1
+                            findings.append(
+                                make_finding(
+                                    Severity.INFO,
+                                    rel,
+                                    line_no,
+                                    f"SAML library detected: {lib_name}",
+                                    f"Code uses {lib_name} library ({pattern_key} pattern). Verify SAML security configuration.",
+                                    code_snippet=m.group(),
+                                    suggestion=f"Review {lib_name} configuration for security best practices",
+                                    control_id="SAML-07",
+                                )
+                            )
+
+                # Check for XXE patterns
+                for pattern, desc in XXE_PATTERNS:
+                    for m in re.finditer(pattern, content, re.IGNORECASE):
+                        line_no = content[: m.start()].count("\n") + 1
+                        findings.append(
+                            make_finding(
+                                Severity.CRITICAL,
+                                rel,
+                                line_no,
+                                "SAML-01: XML External Entity (XXE) vulnerability",
+                                desc,
+                                code_snippet=m.group(),
+                                suggestion="Disable DTD loading and entity resolution in XML parser",
+                                cwe="CWE-611",
+                                control_id="SAML-01",
+                            )
+                        )
+
+                # Check for XSW patterns
+                for pattern, desc in XSW_PATTERNS:
+                    for m in re.finditer(pattern, content, re.IGNORECASE):
+                        line_no = content[: m.start()].count("\n") + 1
+                        findings.append(
+                            make_finding(
+                                Severity.CRITICAL,
+                                rel,
+                                line_no,
+                                "SAML-02: XML Signature Wrapping attack vector",
+                                desc,
+                                code_snippet=m.group(),
+                                suggestion="Use a SAML library that prevents Signature Wrapping attacks",
+                                cwe="CWE-327",
+                                control_id="SAML-02",
+                            )
+                        )
+
+                # Check for weak algorithms (SHA-1)
+                weak_algo = re.findall(r"sha-?1|SHA-?1|md5|MD5", content)
+                if weak_algo:
+                    for m in re.finditer(r"sha-?1|SHA-?1|md5|MD5", content):
+                        line_no = content[: m.start()].count("\n") + 1
+                        findings.append(
+                            make_finding(
+                                Severity.HIGH,
+                                rel,
+                                line_no,
+                                "SAML-03: Weak cryptographic algorithm (SHA-1/MD5)",
+                                "SAML assertion uses deprecated hash algorithm. SHA-1 is vulnerable to collision attacks.",
+                                code_snippet=m.group(),
+                                suggestion="Upgrade to SHA-256 or stronger algorithms",
+                                cwe="CWE-327",
+                                control_id="SAML-03",
+                            )
+                        )
+
+                # Check for missing signature validation
+                has_sig_validation = any(
+                    re.search(p, content, re.IGNORECASE) for p, _ in SIGNATURE_VALIDATION_PATTERNS
+                )
+                if (
+                    re.search(
+                        r"saml2?\b|onelogin|AuthnRequest|SAMLResponse", content, re.IGNORECASE
+                    )
+                    and not has_sig_validation
+                ):
+                    findings.append(
+                        make_finding(
+                            Severity.HIGH,
+                            rel,
+                            0,
+                            "SAML-04: Missing signature validation",
+                            "SAML processing code detected without signature validation. Assertions may be forged.",
+                            suggestion="Implement XML signature validation before processing assertions",
+                            cwe="CWE-347",
+                            control_id="SAML-04",
+                        )
+                    )
+
+                # Check for assertion lifetime
+                has_lifetime = any(
+                    re.search(p, content, re.IGNORECASE) for p, _ in ASSERTION_LIFETIME_PATTERNS
+                )
+                if (
+                    re.search(r"saml2?\b|assertion|SAMLResponse", content, re.IGNORECASE)
+                    and not has_lifetime
+                ):
+                    findings.append(
+                        make_finding(
+                            Severity.HIGH,
+                            rel,
+                            0,
+                            "SAML-05: No assertion lifetime enforcement",
+                            "SAML assertions processed without checking NotBefore/NotOnOrAfter. Replay attacks possible.",
+                            suggestion="Enforce assertion time bounds and session index tracking",
+                            cwe="CWE-294",
+                            control_id="SAML-05",
+                        )
+                    )
+
+                # Check for RelayState validation
+                has_relay = any(
+                    re.search(p, content, re.IGNORECASE) for p, _ in RELAYSTATE_PATTERNS
+                )
+                if has_relay:
+                    # Check if validation is present
+                    if not re.search(
+                        r"whitelist|allowlist|validate.*relay|check.*relay|sanitize.*relay",
+                        content,
+                        re.IGNORECASE,
+                    ):
+                        findings.append(
+                            make_finding(
+                                Severity.MEDIUM,
+                                rel,
+                                0,
+                                "SAML-06: RelayState open redirect potential",
+                                "RelayState parameter used without explicit validation. May allow open redirect attacks.",
+                                suggestion="Validate RelayState against an allowlist of permitted redirect URLs",
+                                cwe="CWE-601",
+                                control_id="SAML-06",
+                            )
+                        )
+
+                # Check for assertion replay protection
+                if re.search(r"saml2?\b|SAMLResponse", content, re.IGNORECASE):
+                    if not re.search(
+                        r"SessionIndex|session_index|replay|nonce|jti", content, re.IGNORECASE
+                    ):
+                        findings.append(
+                            make_finding(
+                                Severity.HIGH,
+                                rel,
+                                0,
+                                "SAML-08: Assertion replay protection missing",
+                                "No session index or nonce tracking detected. SAML assertions may be replayed.",
+                                suggestion="Track assertion IDs and session indices to prevent replay attacks",
+                                cwe="CWE-294",
+                                control_id="SAML-08",
+                            )
+                        )
+
+                # Check for certificate trust pinning
+                if re.search(r"certificate|cert|X509|trust", content, re.IGNORECASE):
+                    if not re.search(
+                        r"pin|trust_store|ca_bundle|certificate_file|verify.*cert",
+                        content,
+                        re.IGNORECASE,
+                    ):
+                        findings.append(
+                            make_finding(
+                                Severity.MEDIUM,
+                                rel,
+                                0,
+                                "SAML-09: Certificate trust not pinned",
+                                "SAML certificate handling without explicit trust pinning. May accept forged certificates.",
+                                suggestion="Pin IdP certificate or use a trusted CA bundle for validation",
+                                cwe="CWE-295",
+                                control_id="SAML-09",
+                            )
+                        )
+
+            # Phase 2: Scan YAML/JSON configs for SAML metadata
+            for fpath in safe_rglob(inp.root, "*.xml"):
+                files_scanned += 1
+                try:
+                    content = fpath.read_text(encoding="utf-8", errors="replace")
+                except Exception as e:
+                    _log.warning("SamlSSOAgent._run failed: %s", e)
+                    continue
+
+                rel = str(fpath.relative_to(inp.root))
+
+                # Check for SAML metadata files
+                if re.search(r"EntityDescriptor|SPSSODescriptor|IDPSSODescriptor", content):
+                    # Check for SHA-1 in metadata
+                    if re.search(r"SHA-1|sha1|DigestMethod.*SHA-1", content):
+                        findings.append(
+                            make_finding(
+                                Severity.HIGH,
+                                rel,
+                                0,
+                                "SAML-03: Weak algorithm in SAML metadata",
+                                "SAML metadata specifies SHA-1 digest method. Upgrade to SHA-256.",
+                                suggestion="Update DigestMethod and SignatureMethod to SHA-256 or stronger",
+                                cwe="CWE-327",
+                                control_id="SAML-03",
+                            )
+                        )
+
+                    # Check for WantAssertionsSigned
+                    if re.search(r"WantAssertionsSigned\s*=\s*[\"']false[\"']", content):
+                        findings.append(
+                            make_finding(
+                                Severity.HIGH,
+                                rel,
+                                0,
+                                "SAML-04: Assertions not required to be signed",
+                                "WantAssertionsSigned=false allows unsigned assertions. Forged assertions accepted.",
+                                suggestion="Set WantAssertionsSigned=true in SP metadata",
+                                cwe="CWE-347",
+                                control_id="SAML-04",
+                            )
+                        )
+
+            # Phase 3: Try external SAST tools (semgrep has SAML rules)
+            semgrep_path = shutil.which("semgrep")
+            if semgrep_path:
+                from .security_config import _semgrep_config_value
+                semgrep_config = _semgrep_config_value(inp.root)
+                if not semgrep_config:
+                    semgrep_path = None  # offline + no local pack -> skip
+            if semgrep_path:
+                try:
+                    proc = subprocess.run(
+                        [
+                            semgrep_path,
+                            "--config",
+                            semgrep_config,
+                            "--include",
+                            "*.py",
+                            "--json",
+                            "--quiet",
+                            str(inp.root),
+                        ],
+                        capture_output=True,
+                        text=True,
+                        timeout=120,
+                    )
+                    if proc.returncode == 0 and proc.stdout:
+                        import json
+
+                        try:
+                            data = json.loads(proc.stdout)
+                            for r in data.get("results", []):
+                                rule_id = r.get("check_id", "")
+                                if (
+                                    "saml" in rule_id.lower()
+                                    or "xxe" in rule_id.lower()
+                                    or "xml" in rule_id.lower()
+                                ):
+                                    findings.append(
+                                        make_finding(
+                                            Severity.HIGH,
+                                            r.get("path", ""),
+                                            r.get("start", {}).get("line", 0),
+                                            f"Semgrep: {rule_id}",
+                                            r.get("extra", {}).get("message", ""),
+                                            code_snippet=r.get("extra", {}).get("lines", ""),
+                                            suggestion="Review semgrep finding for SAML security impact",
+                                        )
+                                    )
+                        except json.JSONDecodeError:
+                            pass
+                except (subprocess.TimeoutExpired, Exception):
+                    pass
+
+            result.findings = findings
+            result.files_scanned = files_scanned
+            result.status = AgentStatus.DONE
+            trace.findings = len(findings)
+            trace.files_scanned = files_scanned
+
+            return