patchi 0.7.5__py3-none-any.whl

patchi/core/security/tool_adapters.py

@@ -0,0 +1,135 @@
+"""
+Tool Adapters — shared normalization for external SAST tools (bandit, pysa, codeql).
+
+Every wrapper agent used to hand-build Finding objects and crash on the
+first finding (Severity("MEDIUM") vs lowercase enum; nonexistent
+``confidence=`` kwarg). This module is the single honest conversion layer:
+
+    normalize_severity(raw)   -> Severity   (every known convention)
+    make_tool_finding(...)    -> Finding    (valid fields, provenance kept)
+
+Max-potential details preserved instead of discarded:
+  - the TOOL's own confidence tier (bandit HIGH/MEDIUM/LOW) lands in
+    ``extra["tool_confidence"]`` so the ConfidenceGate can weigh it;
+  - a code snippet rides along in ``code_snippet`` — the gate's
+    method-precision scorer needs it, and AI review gets real context;
+  - numeric SARIF security-severity (0.0-10.0) maps to severity bands.
+"""
+
+from __future__ import annotations
+
+from typing import Any
+
+from patchi.core.agents.base import Finding, Severity
+
+# ── Severity normalization ───────────────────────────────────────────────────
+
+_WORD_MAP: dict[str, str] = {
+    # bandit / generic uppercase
+    "LOW": "low",
+    "MEDIUM": "medium",
+    "HIGH": "high",
+    "CRITICAL": "critical",
+    # already-lowercase passthrough
+    "low": "low",
+    "medium": "medium",
+    "high": "high",
+    "critical": "critical",
+    "info": "info",
+    "informational": "info",
+    # compiler-style levels (pysa/codeql text output)
+    "ERROR": "high",
+    "WARNING": "medium",
+    "WARN": "medium",
+    "NOTE": "info",
+    "NOTICE": "info",
+    "SEGMENT": "info",
+}
+
+_DEFAULT = "medium"
+
+
+def normalize_severity(raw: Any, default: str = _DEFAULT) -> Severity:
+    """Map any tool's severity spelling to our Severity enum. Never raises."""
+    if isinstance(raw, (int, float)):
+        return Severity(_numeric_band(float(raw)))
+    value = str(raw).strip() if raw is not None else ""
+    mapped = _WORD_MAP.get(value)
+    if mapped is None:
+        # last resort: case-insensitive lookup
+        mapped = _WORD_MAP.get(value.upper(), default)
+        if mapped not in ("low", "medium", "high", "critical", "info"):
+            mapped = default
+    try:
+        return Severity(mapped)
+    except ValueError:
+        return Severity(default)
+
+
+def _numeric_band(score_0_to_10: float) -> str:
+    """CodeQL SARIF security-severity banding."""
+    if score_0_to_10 >= 9.0:
+        return "critical"
+    if score_0_to_10 >= 7.0:
+        return "high"
+    if score_0_to_10 >= 4.0:
+        return "medium"
+    return "low"
+
+
+# ── Tool confidence tiers ────────────────────────────────────────────────────
+
+_TIER_MAP = {"HIGH": 0.9, "MEDIUM": 0.6, "LOW": 0.3}
+
+
+def tool_confidence(raw: Any, default: float = 0.5) -> float:
+    """Bandit-style HIGH/MEDIUM/LOW tier -> float; passthrough numbers."""
+    if isinstance(raw, (int, float)):
+        return max(0.0, min(1.0, float(raw)))
+    return _TIER_MAP.get(str(raw).strip().upper(), default)
+
+
+# ── Finding construction ─────────────────────────────────────────────────────
+
+
+def make_tool_finding(
+    agent: str,
+    ftype: str,
+    raw_severity: Any,
+    file: str,
+    line: int,
+    message: str,
+    cwe: str = "",
+    snippet: str = "",
+    confidence_raw: Any = None,
+    extra: dict | None = None,
+) -> Finding:
+    """Build one valid Finding from a raw tool record. Never raises for data."""
+    payload_extra: dict = {"tool": agent}
+    conf = None
+    if confidence_raw is not None:
+        conf = tool_confidence(confidence_raw)
+        payload_extra["tool_confidence"] = conf
+    if extra:
+        payload_extra.update(extra)
+
+    # Normalize bare-number / int CWEs ("89", 89) to "CWE-89"
+    cwe_str = str(cwe or "").strip()
+    if cwe_str and cwe_str.isdigit():
+        cwe_str = f"CWE-{int(cwe_str)}"
+
+    kwargs: dict[str, Any] = {}
+    if snippet:
+        kwargs["code_snippet"] = str(snippet)[:500]
+
+    return Finding(
+        agent=agent,
+        type=(ftype or f"{agent.lower()}_finding")[:80],
+        severity=normalize_severity(raw_severity),
+        file=file or "",
+        line=int(line or 0),
+        message=str(message or "")[:400],
+        cwe=cwe_str,
+        extra=payload_extra,
+        **kwargs,
+    )

patchi/core/security/tool_verify.py

@@ -0,0 +1,173 @@
+"""
+Tool verification — close the fix loop with the same SAST tools that found the bug.
+
+After the AutoFixer writes a patch, we want real evidence the vulnerability is
+gone, not a simulated "True". This module runs Bandit or Semgrep against the
+*patched* file and reports whether the original finding still appears.
+
+Both tools are invoked through their existing Patchi agents so we inherit the
+exact same severity/confidence/CWE normalization the scanner uses elsewhere.
+"""
+
+from __future__ import annotations
+
+import logging
+import shutil
+import tempfile
+from pathlib import Path
+
+from patchi.core.agents.base import AgentInput, Finding, Severity
+
+_log = logging.getLogger("patchi.security.tool_verify")
+
+# Map the playbook `deterministic_tool` name -> registered agent name.
+_TOOL_AGENT = {
+    "bandit": "BanditAgent",
+    "semgrep": "SemgrepAgent",
+}
+
+
+def _extract_identity(finding: Finding | object) -> tuple[str, str]:
+    """Return (cwe, type) for a Finding or CorrelatedFinding-like object."""
+    cwe = ""
+    ftype = ""
+    for attr in ("cwe", "type"):
+        if hasattr(finding, attr):
+            val = getattr(finding, attr)
+            if attr == "cwe":
+                cwe = str(val or "")
+            else:
+                ftype = str(val or "")
+        elif hasattr(finding, "finding"):
+            val = getattr(finding.finding, attr, "")
+            if attr == "cwe":
+                cwe = str(val or "")
+            else:
+                ftype = str(val or "")
+    return cwe, ftype
+
+
+def run_tool_on_file(tool: str, file_path: Path) -> list[Finding]:
+    """Run one SAST tool against a single file via an isolated temp copy.
+
+    Copying the file into a temp dir keeps the scan scoped to just that file
+    (fast, no project-wide noise) while still exercising the real tool binary
+    through its Patchi agent wrapper.
+    """
+    import patchi.core.security.security_agents  # noqa: F401  (registers agents)
+    from patchi.core.agents.base import list_agents
+
+    agent_name = _TOOL_AGENT.get(tool.lower())
+    if not agent_name:
+        raise ValueError(f"tool_verify: unsupported tool {tool!r}")
+
+    agents = {a.name: a for a in list_agents("security")}
+    cls = agents.get(agent_name)
+    if not cls:
+        _log.warning("tool_verify: agent %s not available", agent_name)
+        return []
+
+    src = Path(file_path)
+    if not src.exists():
+        return []
+
+    with tempfile.TemporaryDirectory() as tmp:
+        tmp_path = Path(tmp)
+        dest = tmp_path / src.name
+        shutil.copy2(src, dest)
+        res = cls().run(AgentInput(root=tmp_path, scope=[], brain={}, config={}, extra={}))
+        return list(res.findings or [])
+
+
+def finding_resolved(tool: str, file_path: Path, original: Finding | object) -> bool:
+    """True if `original` no longer appears in the tool's output for the file.
+
+    Matching prefers CWE (most specific). When the tool reports no findings at
+    all we treat the issue as resolved.
+    """
+    findings = run_tool_on_file(tool, file_path)
+    if not findings:
+        return True
+
+    orig_cwe, orig_type = _extract_identity(original)
+    orig_short = orig_type.split(".")[-1] if orig_type else ""
+
+    for f in findings:
+        if orig_cwe and f.cwe and f.cwe.upper() == orig_cwe.upper():
+            return False
+        if orig_short and f.type and orig_short in f.type:
+            return False
+    return True
+
+
+def high_findings_on_file(file_path: Path) -> list[Finding]:
+    """Run Bandit + Semgrep on a single file; return only HIGH/CRITICAL findings.
+
+    Used to verify that an applied proactive fix did not introduce or leave a
+    serious vulnerability. Returns an empty list on tool failure (fail-open) so
+    a slow/missing tool never blocks the watch loop. The returned findings carry
+    the real (non-temp) file path.
+    """
+    out: list[Finding] = []
+    real = str(file_path)
+    for tool in ("bandit", "semgrep"):
+        try:
+            findings = run_tool_on_file(tool, file_path)
+        except Exception as e:
+            _log.warning("high_findings_on_file: %s failed on %s: %s", tool, file_path, e)
+            continue
+        for f in findings:
+            if f.severity in (Severity.HIGH, Severity.CRITICAL):
+                try:
+                    f.file = real
+                except Exception as _exc:
+                    _log.warning('high_findings_on_file failed: %s', _exc)
+                out.append(f)
+    return out
+
+
+def verify_proactive_fixes(
+    root: Path,
+    applied_files: list[str],
+    pre_highs: dict[str, set],
+) -> list[dict]:
+    """Diff SAST HIGH/CRITICAL findings before vs after applied proactive fixes.
+
+    For each file a proactive fix touched, re-runs Bandit + Semgrep and reports
+    only findings that are NEW relative to ``pre_highs`` (so pre-existing
+    findings are never re-flagged on every save). Returns a list of issue dicts
+    ready for ``mem.save_issue``. Fail-open: any tool failure yields no issue.
+    """
+    issues: list[dict] = []
+    for vf in sorted(set(applied_files)):
+        vpath = Path(root) / vf
+        if not vpath.exists() or vpath.suffix != ".py":
+            continue
+        try:
+            post_findings = high_findings_on_file(vpath)
+        except Exception as e:
+            _log.warning("verify_proactive_fixes skipped %s: %s", vf, e)
+            continue
+        post = {(h.type, h.cwe) for h in post_findings}
+        new_sigs = post - pre_highs.get(vf, set())
+        if not new_sigs:
+            continue
+        for hf in post_findings:
+            if (hf.type, hf.cwe) not in new_sigs:
+                continue
+            issues.append(
+                {
+                    "source": "proactive_sast_verify",
+                    "fix_type": "sast_regression",
+                    "file": vf,
+                    "name": hf.cwe or hf.type,
+                    "line": hf.line,
+                    "description": (
+                        f"Proactive fix introduced a HIGH/CRITICAL SAST "
+                        f"finding ({hf.type}{' ' + hf.cwe if hf.cwe else ''}) "
+                        f"at line {hf.line}"
+                    ),
+                    "severity": "high",
+                }
+            )
+    return issues

patchi/core/security/websocket_security_agent.py

@@ -0,0 +1,188 @@
+"""
+WebSocketSecurityAgent — WebSocket security vulnerability detection.
+
+Detects:
+- Unencrypted WebSocket connections (ws:// instead of wss://)
+- Missing origin validation
+- Unvalidated message input (injection via WebSocket messages)
+- Missing authentication in WebSocket handshake
+- Unlimited message size / rate
+- WebSocket message type confusion
+- Sensitive data in WebSocket messages
+
+Uses static pattern matching, NOT AI.
+Does NOT write to disk. Does NOT touch the queue.
+"""
+
+from __future__ import annotations
+
+import re
+
+from ..agents.base import (
+    AgentDomain,
+    AgentGroup,
+    AgentInput,
+    AgentResult,
+    BaseAgent,
+    Finding,
+    Severity,
+    register,
+    safe_rglob,
+)
+
+
+@register
+class WebSocketSecurityAgent(BaseAgent):
+    """Detects WebSocket security vulnerabilities."""
+
+    group = AgentGroup.SECURITY
+    domain = AgentDomain.SECURITY
+    name = "WebSocketSecurityAgent"
+    description = "WebSocket injection, origin validation, unencrypted WS, message validation"
+
+    def _run(self, inp: AgentInput, result: AgentResult) -> None:
+        # Only scan files likely to contain WebSocket code (not every .py in the project)
+        patterns = ["*.py", "*.js", "*.ts", "*.jsx", "*.tsx", "*.java", "*.go"]
+
+        # Pre-scan: skip files that lack any WebSocket keyword (fast path)
+        ws_guard = re.compile(
+            r"(?i)(?:websocket|wss?://|socket\.io|fastapi\.websocket|starlette\.websocket|flask-socketio|django\.channels|aiohttp\.web\.WebSocketResponse|tornado\.websocket|\.ws\.route)",
+            re.I,
+        )
+        for pat in patterns:
+            for fpath in safe_rglob(inp.root, pat):
+                if not fpath.is_file():
+                    continue
+                rel = fpath.relative_to(inp.root).as_posix()
+                try:
+                    content = fpath.read_text(encoding="utf-8", errors="ignore")
+                except OSError:
+                    continue
+                if not ws_guard.search(content):
+                    continue
+                result.files_scanned += 1
+                self._scan_websocket(content, rel, result)
+
+    def _scan_websocket(self, content: str, rel: str, result: AgentResult) -> None:
+        # ── Unencrypted WebSocket connection ────────────────────────────────
+        for m in re.finditer(r"""(?i)["']ws://""", content):
+            line = content[: m.start()].count("\n") + 1
+            result.add_finding(
+                Finding(
+                    agent=self.name,
+                    type="unencrypted_websocket",
+                    severity=Severity.HIGH,
+                    file=rel,
+                    line=line,
+                    message="Unencrypted WebSocket connection (ws://) — use wss:// for production",
+                    suggestion="Replace ws:// with wss:// and ensure TLS is configured",
+                    cwe="CWE-319",
+                    extra={"skill": "api-security.skill"},
+                )
+            )
+
+        # ── Missing origin validation ───────────────────────────────────────
+        if not re.search(
+            r"(?i)(?:\borigin\b|check_origin|allowed_origins|validate_origin)", content
+        ):
+            result.add_finding(
+                Finding(
+                    agent=self.name,
+                    type="missing_origin_validation",
+                    severity=Severity.MEDIUM,
+                    file=rel,
+                    line=0,
+                    message="WebSocket handler lacks origin validation — potential cross-origin hijacking",
+                    suggestion="Validate Origin header on WebSocket upgrade, configure allowed_origins",
+                    cwe="CWE-346",
+                    extra={"skill": "api-security.skill"},
+                )
+            )
+
+        # ── Message without input validation ───────────────────────────────
+        for m in re.finditer(
+            r'(?i)(?:websocket|socketio)\.(?:on_message|receive|recv|on\s*\(\s*["\']message)',
+            content,
+        ):
+            line_start = content[: m.start()].count("\n") + 1
+            surrounding = content[m.start() : m.start() + 500]
+            if not re.search(
+                r"(?i)(?:validate|sanitize|check|json\.loads|parse)", surrounding[:200]
+            ):
+                result.add_finding(
+                    Finding(
+                        agent=self.name,
+                        type="websocket_no_input_validation",
+                        severity=Severity.HIGH,
+                        file=rel,
+                        line=line_start,
+                        message="WebSocket message processed without input validation — injection risk",
+                        suggestion="Validate/sanitize all WebSocket message content before processing",
+                        cwe="CWE-20",
+                        extra={"skill": "api-security.skill"},
+                    )
+                )
+
+        # ── Missing authentication on WebSocket upgrade ────────────────────
+        for m in re.finditer(
+            r"(?i)(?:@(?:ws|websocket)\.route|\bdef\s+websocket\b|\basync\s+def\s+websocket\b|socketio\.on\b)",
+            content,
+        ):
+            line_start = content[: m.start()].count("\n") + 1
+            surrounding = content[m.start() : m.start() + 300]
+            if not re.search(
+                r"(?i)(?:auth|token|jwt|session|api_key|authenticate)", surrounding[:150]
+            ):
+                result.add_finding(
+                    Finding(
+                        agent=self.name,
+                        type="websocket_no_auth",
+                        severity=Severity.CRITICAL,
+                        file=rel,
+                        line=line_start,
+                        message="WebSocket endpoint lacks authentication — unauthenticated access",
+                        suggestion="Add authentication handshake (JWT, session, or API key) to WebSocket upgrade",
+                        cwe="CWE-287",
+                        extra={"skill": "api-security.skill"},
+                    )
+                )
+
+        # ── Message size / rate limiting missing ───────────────────────────
+        for m in re.finditer(
+            r'(?i)(?:@app\.ws|\bwebsocket_route\b|\.on\s*\(\s*["\']?connect)', content
+        ):
+            line_start = content[: m.start()].count("\n") + 1
+            surrounding = content[m.start() : m.start() + 300]
+            if not re.search(r"(?i)(?:max_size|max_length|limit|throttle|rate)", surrounding[:150]):
+                result.add_finding(
+                    Finding(
+                        agent=self.name,
+                        type="websocket_no_limit",
+                        severity=Severity.MEDIUM,
+                        file=rel,
+                        line=line_start,
+                        message="WebSocket missing message size/rate limiting — DoS vector",
+                        suggestion="Configure max_message_size and rate limiting for WebSocket messages",
+                        cwe="CWE-770",
+                        extra={"skill": "api-security.skill"},
+                    )
+                )
+
+        # ── Sensitive data sent over WebSocket ─────────────────────────────
+        for m in re.finditer(
+            r'(?i)(?:send|emit)\(.*["\']?(?:\bpassword\b|\btoken\b|\bsecret\b|api_key|secret_key|\bssn\b|\bcredit\b)',
+            content,
+        ):
+            result.add_finding(
+                Finding(
+                    agent=self.name,
+                    type="sensitive_data_in_websocket",
+                    severity=Severity.HIGH,
+                    file=rel,
+                    line=content[: m.start()].count("\n") + 1,
+                    message="Sensitive data potentially sent over WebSocket — data leak risk",
+                    suggestion="Avoid sending secrets/tokens over WebSocket; use server-side operations",
+                    cwe="CWE-200",
+                    extra={"skill": "api-security.skill"},
+                )
+            )