patchi 0.7.5__py3-none-any.whl

patchi/core/attackers/planner.py

@@ -0,0 +1,108 @@
+"""AttackPlanner — orchestrates all attackers, scores and prioritizes hypotheses."""
+
+from __future__ import annotations
+
+import logging
+from dataclasses import dataclass
+
+from patchi.core.assurance.graph import AssuranceGraph
+
+from .api_abuse import ApiAbuseAttacker
+from .auth_bypass import AuthBypassAttacker
+from .base import AttackResult, BaseAttacker, Hypothesis
+from .business_logic import BusinessLogicAttacker
+from .priv_escalation import PrivEscAttacker
+from .recon import ReconAttacker
+
+_log = logging.getLogger("patchi.core.attackers.planner")
+
+# Objective priority weights (higher = more important to test)
+_OBJECTIVE_PRIORITY: dict[str, float] = {
+    "authentication_bypass": 1.0,
+    "privilege_escalation": 0.9,
+    "api_abuse": 0.7,
+    "reconnaissance": 0.5,
+    "business_logic_abuse": 0.6,
+}
+
+_RISK_SCORES: dict[str, float] = {
+    "critical": 1.0,
+    "high": 0.7,
+    "medium": 0.4,
+    "low": 0.2,
+}
+
+
+@dataclass
+class AttackPlan:
+    """A prioritized plan of hypotheses to test."""
+
+    hypotheses: list[Hypothesis]
+    total_score: float = 0.0
+
+    def to_dict(self) -> dict:
+        return {
+            "hypotheses": [h.to_dict() for h in self.hypotheses[:20]],
+            "total_score": round(self.total_score, 2),
+            "count": len(self.hypotheses),
+        }
+
+
+class AttackPlanner:
+    """Orchestrate all attackers, score hypotheses, and run the top ones."""
+
+    def __init__(self, graph: AssuranceGraph, max_run: int = 50):
+        self._graph = graph
+        self._max_run = max_run
+        self._attackers: list[BaseAttacker] = [
+            ReconAttacker(graph),
+            AuthBypassAttacker(graph),
+            PrivEscAttacker(graph),
+            BusinessLogicAttacker(graph),
+            ApiAbuseAttacker(graph),
+        ]
+
+    def plan(self) -> AttackPlan:
+        """Generate and score all hypotheses."""
+        all_hypotheses: list[Hypothesis] = []
+        for attacker in self._attackers:
+            all_hypotheses.extend(attacker.hypothesize())
+
+        # Score and sort
+        for h in all_hypotheses:
+            h._score = self._score(h)  # type: ignore[attr-defined]
+
+        all_hypotheses.sort(key=lambda h: getattr(h, "_score", 0), reverse=True)
+        total = sum(getattr(h, "_score", 0) for h in all_hypotheses)
+
+        return AttackPlan(
+            hypotheses=all_hypotheses[: self._max_run],
+            total_score=total,
+        )
+
+    def run_all(self) -> list[AttackResult]:
+        """Run all attackers and collect results."""
+        results: list[AttackResult] = []
+        for attacker in self._attackers:
+            try:
+                results.extend(attacker.run())
+            except Exception as e:
+                _log.warning("Attacker %s failed: %s", attacker.name, e)
+        return results
+
+    def run_campaign(self, objective: str) -> list[AttackResult]:
+        """Run attackers matching a specific objective."""
+        results: list[AttackResult] = []
+        for attacker in self._attackers:
+            if attacker.objective == objective:
+                try:
+                    results.extend(attacker.run())
+                except Exception as e:
+                    _log.warning("Attacker %s failed: %s", attacker.name, e)
+        return results
+
+    def _score(self, hypothesis: Hypothesis) -> float:
+        """Score a hypothesis by risk × confidence × objective priority."""
+        risk = _RISK_SCORES.get(hypothesis.risk, 0.3)
+        priority = _OBJECTIVE_PRIORITY.get(hypothesis.objective, 0.3)
+        return risk * hypothesis.confidence * priority

patchi/core/attackers/priv_escalation.py

@@ -0,0 +1,88 @@
+"""PrivEscAttacker — test privilege escalation vulnerabilities."""
+
+from __future__ import annotations
+
+from .base import AttackResult, BaseAttacker, Hypothesis
+
+
+class PrivEscAttacker(BaseAttacker):
+    """Tests for illegal state transitions, missing isolation, shared endpoints."""
+
+    name = "priv_escalation"
+    objective = "privilege_escalation"
+
+    def hypothesize(self) -> list[Hypothesis]:
+        hypotheses: list[Hypothesis] = []
+
+        for claim in self._graph.claims.values():
+            # Authorization boundary claims
+            if "admin" in claim.statement.lower() or "escalat" in claim.statement.lower():
+                if claim.verdict.value in ("not_proved", "unproven"):
+                    hypotheses.append(
+                        Hypothesis(
+                            attacker=self.name,
+                            objective=self.objective,
+                            target=claim.id,
+                            risk="critical",
+                            confidence=0.6,
+                            description=f"Privilege boundary unverified: {claim.statement}",
+                        )
+                    )
+
+            # Missing tenant isolation
+            if "tenant" in claim.statement.lower() or "isolation" in claim.statement.lower():
+                hypotheses.append(
+                    Hypothesis(
+                        attacker=self.name,
+                        objective=self.objective,
+                        target=claim.id,
+                        risk="critical",
+                        confidence=0.7,
+                        description=f"Tenant isolation unverified: {claim.statement}",
+                    )
+                )
+
+            # Shared endpoints with different privilege levels
+            if "role" in claim.statement.lower() and "check" in claim.statement.lower():
+                if claim.verdict.value == "unproven":
+                    hypotheses.append(
+                        Hypothesis(
+                            attacker=self.name,
+                            objective=self.objective,
+                            target=claim.id,
+                            risk="high",
+                            confidence=0.5,
+                            description=f"Role-based access unverified: {claim.statement}",
+                        )
+                    )
+
+        return hypotheses
+
+    def test(self, hypothesis: Hypothesis) -> AttackResult:
+        claim = self._graph.claims.get(hypothesis.target)
+        if claim is None:
+            return AttackResult(hypothesis=hypothesis, confirmed=False, evidence="Claim not found")
+
+        refuting = [e for e in claim.evidence if not e.supports]
+        if refuting:
+            return AttackResult(
+                hypothesis=hypothesis,
+                confirmed=False,
+                evidence=f"Isolation verified: {refuting[0].detail}",
+            )
+
+        supporting = [e for e in claim.evidence if e.supports]
+        if supporting:
+            return AttackResult(
+                hypothesis=hypothesis,
+                confirmed=True,
+                evidence=f"Privilege escalation confirmed: {supporting[0].detail}",
+                severity="critical",
+                remediation="Add role/tenant check before this operation",
+            )
+
+        return AttackResult(
+            hypothesis=hypothesis,
+            confirmed=False,
+            evidence="Insufficient evidence",
+        )

patchi/core/attackers/recon.py

@@ -0,0 +1,87 @@
+"""ReconAttacker — test reconnaissance vulnerabilities.
+
+Looks for unprotected endpoints, excess permissions, info disclosure,
+and unsanitized data flows.
+"""
+
+from __future__ import annotations
+
+from .base import AttackResult, BaseAttacker, Hypothesis
+
+
+class ReconAttacker(BaseAttacker):
+    """Reconnaissance attacker — finds information disclosure and unprotected endpoints."""
+
+    name = "recon"
+    objective = "reconnaissance"
+
+    def hypothesize(self) -> list[Hypothesis]:
+        hypotheses: list[Hypothesis] = []
+
+        for claim in self._graph.claims.values():
+            # Unprotected endpoints
+            if "endpoint" in claim.domain.lower() and "auth" in claim.statement.lower():
+                if claim.verdict.value in ("not_proved", "unproven"):
+                    hypotheses.append(
+                        Hypothesis(
+                            attacker=self.name,
+                            objective=self.objective,
+                            target=claim.id,
+                            risk="medium",
+                            confidence=0.6,
+                            description=f"Endpoint may be unprotected: {claim.statement}",
+                            evidence_required=["route scan", "auth check"],
+                        )
+                    )
+
+            # Excess permissions
+            if "permission" in claim.statement.lower() or "access" in claim.statement.lower():
+                if claim.verdict.value == "unproven":
+                    hypotheses.append(
+                        Hypothesis(
+                            attacker=self.name,
+                            objective=self.objective,
+                            target=claim.id,
+                            risk="medium",
+                            confidence=0.5,
+                            description=f"Permission boundary unverified: {claim.statement}",
+                            evidence_required=["access control check"],
+                        )
+                    )
+
+        return hypotheses
+
+    def test(self, hypothesis: Hypothesis) -> AttackResult:
+        claim = self._graph.claims.get(hypothesis.target)
+        if claim is None:
+            return AttackResult(
+                hypothesis=hypothesis,
+                confirmed=False,
+                evidence="Claim not found in assurance graph",
+            )
+
+        # Check if any refuting evidence exists (someone already found it's protected)
+        refuting = [e for e in claim.evidence if not e.supports]
+        if refuting:
+            return AttackResult(
+                hypothesis=hypothesis,
+                confirmed=False,
+                evidence=f"Already disproved: {refuting[0].detail}",
+            )
+
+        # Check if any supporting evidence exists (someone confirmed it's unprotected)
+        supporting = [e for e in claim.evidence if e.supports]
+        if supporting:
+            return AttackResult(
+                hypothesis=hypothesis,
+                confirmed=True,
+                evidence=f"Confirmed: {supporting[0].detail}",
+                severity=hypothesis.risk,
+                remediation="Add authentication/authorization check",
+            )
+
+        return AttackResult(
+            hypothesis=hypothesis,
+            confirmed=False,
+            evidence="Insufficient evidence to confirm or deny",
+        )

patchi/core/brain/ast_utils/__init__.py

@@ -0,0 +1,81 @@
+"""
+AST utilities — language-generic tree-sitter / Python `ast` walking utilities.
+
+This package exposes language-generic helpers used by security agents, type
+checkers, and route detectors. The implementation is split into submodules
+but re-exported here so existing imports keep working:
+
+    from patchi.core.brain.ast_utils import find_calls, find_imports, node_text
+    calls = find_calls(content, Lang.PYTHON, ["execute", "eval"])
+
+Submodules:
+    config.py       — per-language node type configs + common sink sets
+    helpers.py      — node_text, child_by_field, children, get_call_arg, ...
+    calls.py        — find_calls (+ Python / tree-sitter walkers)
+    imports.py      — find_imports
+    decorators.py   — find_decorators
+    assignments.py  — find_assignments
+    control_flow.py — scope / argument walking helpers
+    taint.py        — source-to-sink taint tracking
+    dead_symbols.py — intra-file dead-symbol detection
+"""
+
+from __future__ import annotations
+
+from .assignments import find_assignments
+from .calls import find_calls
+
+# Re-export public API from submodules
+from .config import (
+    CALL_NODE_TYPES,
+    DECORATOR_NODE_TYPES,
+    EXEC_SINKS,
+    HTTP_CLIENTS,
+    IMPORT_NODE_TYPES,
+    SQL_SINKS,
+)
+from .control_flow import (
+    child_by_field_any,
+    collect_call_arguments,
+    named_children_of_type,
+    walk_blocks,
+)
+from .dead_symbols import find_dead_symbols
+from .decorators import find_decorators
+from .helpers import (
+    child_by_field,
+    children,
+    get_call_arg,
+    named_children,
+    node_text,
+    parse_source,
+)
+from .imports import find_imports
+from .taint import SANITIZERS, SOURCES, track_taint
+
+__all__ = [
+    "CALL_NODE_TYPES",
+    "DECORATOR_NODE_TYPES",
+    "EXEC_SINKS",
+    "HTTP_CLIENTS",
+    "IMPORT_NODE_TYPES",
+    "SQL_SINKS",
+    "child_by_field",
+    "children",
+    "get_call_arg",
+    "named_children",
+    "node_text",
+    "parse_source",
+    "find_calls",
+    "find_imports",
+    "find_decorators",
+    "find_assignments",
+    "child_by_field_any",
+    "collect_call_arguments",
+    "named_children_of_type",
+    "walk_blocks",
+    "SOURCES",
+    "SANITIZERS",
+    "track_taint",
+    "find_dead_symbols",
+]

patchi/core/brain/ast_utils/assignments.py

@@ -0,0 +1,219 @@
+"""
+AST utilities — variable assignment / declaration finding across languages.
+
+Used by env-var analysis, secret scanning, and taint tracking. Returns the
+assigned target name plus the source expression so callers can follow how a
+value (e.g. a secret, a user-controlled string) flows into code.
+"""
+
+from __future__ import annotations
+
+import logging
+
+from patchi.core.brain.languages import get_parser
+
+from .config import Lang
+from .helpers import child_by_field, children, node_text
+
+_log = logging.getLogger("patchi.brain.assignments")
+
+
+def find_assignments(content: str, lang: Lang) -> list[dict]:
+    """
+    Find all variable assignments in `content`.
+
+    Returns list of dicts with keys:
+        target   — assigned name (str)
+        value    — RHS expression text (str)
+        line     — 1-based line number (int)
+        full_text— full assignment text (str)
+
+    Python is served from the shared single-pass AST scan (one parse + walk
+    per file per process, cached).
+    """
+    if lang == Lang.PYTHON:
+        return _find_assignments_python(content)
+    parser = get_parser(lang)
+    if not parser:
+        return []
+    try:
+        tree = parser.parse(content.encode("utf-8"))
+    except Exception as e:
+        _log.warning("find_assignments failed: %s", e)
+        return []
+    results: list[dict] = []
+    _walk_assignments(tree.root_node, results, lang)
+    return results
+
+
+# ── Python ────────────────────────────────────────────────────────────────────
+
+
+def _find_assignments_python(content: str) -> list[dict]:
+    """Walk the AST for variable assignments."""
+    import ast
+
+    from .helpers import _py_assign_target_name
+
+    try:
+        tree = ast.parse(content)
+    except SyntaxError:
+        return []
+
+    src_lines = content.splitlines()
+    results: list[dict] = []
+
+    def _record(target_node: ast.AST, value_node: ast.AST | None, line_no: int) -> None:
+        target = _py_assign_target_name(target_node)
+        if not target:
+            return
+        full_text = src_lines[line_no - 1] if 0 < line_no <= len(src_lines) else ""
+        try:
+            value = ast.unparse(value_node) if value_node is not None else ""
+        except Exception:
+            value = ""
+        results.append(
+            {
+                "target": target,
+                "value": value,
+                "line": line_no,
+                "full_text": full_text,
+            }
+        )
+
+    for node in ast.walk(tree):
+        if isinstance(node, ast.Assign):
+            for target in node.targets:
+                _record(target, node.value, node.lineno)
+        elif isinstance(node, ast.AnnAssign):
+            # Annotated assignment: config.debug: bool = True (value may be None)
+            _record(node.target, node.value, node.lineno)
+    return results
+
+
+# ── Tree-sitter languages ──────────────────────────────────────────────────────
+
+# Per-language assignment node types
+_ASSIGN_NODE_TYPES: dict[Lang, set[str]] = {
+    Lang.JAVASCRIPT: {"variable_declarator", "assignment_expression"},
+    Lang.TYPESCRIPT: {"variable_declarator", "assignment_expression"},
+    Lang.JAVA: {"local_variable_declaration", "assignment_expression"},
+    Lang.GO: {"short_var_declaration", "var_declaration", "assignment_statement"},
+    Lang.RUST: {"let_declaration", "assignment_expression"},
+    Lang.C: {"declaration", "assignment_expression"},
+    Lang.CPP: {"declaration", "assignment_expression"},
+    Lang.SWIFT: {"variable_declaration"},
+    Lang.RUBY: {"assignment"},
+    Lang.PHP: {"assignment_expression"},
+    Lang.C_SHARP: {"local_declaration_statement", "assignment_expression"},
+    Lang.KOTLIN: {"property_declaration", "assignment"},
+    Lang.DART: {"variable_declaration"},
+}
+
+
+def _walk_assignments(node: object, results: list[dict], lang: Lang) -> None:
+    try:
+        ntype = node.type if hasattr(node, "type") else ""
+    except Exception as e:
+        _log.warning("_walk_assignments failed: %s", e)
+        return
+
+    assign_types = _ASSIGN_NODE_TYPES.get(lang, set())
+    if ntype in assign_types:
+        target, value = _extract_assignment(node, lang)
+        if target:
+            try:
+                line = node.start_point[0] + 1 if node.start_point else 0
+            except Exception as e:
+                _log.warning("_walk_assignments failed: %s", e)
+                line = 0
+            results.append(
+                {
+                    "target": target,
+                    "value": value,
+                    "line": line,
+                    "full_text": node_text(node),
+                }
+            )
+
+    for child in children(node):
+        _walk_assignments(child, results, lang)
+
+
+def _extract_assignment(node: object, lang: Lang) -> tuple[str, str]:
+    """Return (target_name, value_text) for an assignment node."""
+    if lang in (Lang.JAVASCRIPT, Lang.TYPESCRIPT):
+        # variable_declarator: name + value ; assignment_expression: left + right
+        if ntype := getattr(node, "type", ""):
+            if ntype == "variable_declarator":
+                name_node = child_by_field(node, "name")
+                val_node = child_by_field(node, "value")
+                return node_text(name_node), node_text(val_node)
+            if ntype == "assignment_expression":
+                left = child_by_field(node, "left")
+                right = child_by_field(node, "right")
+                return node_text(left), node_text(right)
+    if lang == Lang.RUST and getattr(node, "type", "") == "let_declaration":
+        # let x = ... ; pattern = identifier, value = value
+        pat = child_by_field(node, "pattern") or child_by_field(node, "name")
+        val = child_by_field(node, "value")
+        return node_text(pat), node_text(val)
+    if lang in (Lang.JAVA, Lang.C_SHARP) and getattr(node, "type", "") in (
+        "local_variable_declaration",
+        "local_declaration_statement",
+    ):
+        decl = children(node)
+        # Find the declarator child holding name/value
+        for child in decl:
+            ct = child.type
+            if ct in ("variable_declarator", "declarator"):
+                name_node = child_by_field(child, "name")
+                val_node = child_by_field(child, "value")
+                return node_text(name_node), node_text(val_node)
+        return "", ""
+    if lang == Lang.GO:
+        if getattr(node, "type", "") == "short_var_declaration":
+            left = child_by_field(node, "left")
+            right = child_by_field(node, "right")
+            return node_text(left), node_text(right)
+        if getattr(node, "type", "") in ("var_declaration", "assignment_statement"):
+            left = child_by_field(node, "name") or child_by_field(node, "left")
+            right = child_by_field(node, "value") or child_by_field(node, "right")
+            return node_text(left), node_text(right)
+    if lang in (Lang.C, Lang.CPP) and getattr(node, "type", "") == "declaration":
+        decl = children(node)
+        for child in decl:
+            if child.type == "init_declarator":
+                name_node = child_by_field(child, "declarator")
+                val_node = child_by_field(child, "value")
+                return node_text(name_node), node_text(val_node)
+        return "", ""
+    if lang == Lang.SWIFT and getattr(node, "type", "") == "variable_declaration":
+        pat = child_by_field(node, "pattern")
+        val = child_by_field(node, "value")
+        return node_text(pat), node_text(val)
+    if lang == Lang.RUBY and getattr(node, "type", "") == "assignment":
+        left = child_by_field(node, "left")
+        right = child_by_field(node, "right")
+        return node_text(left), node_text(right)
+    if lang == Lang.PHP and getattr(node, "type", "") == "assignment_expression":
+        left = child_by_field(node, "left")
+        right = child_by_field(node, "right")
+        return node_text(left), node_text(right)
+    if lang == Lang.KOTLIN and getattr(node, "type", "") in ("property_declaration", "assignment"):
+        if getattr(node, "type", "") == "property_declaration":
+            name_node = child_by_field(node, "name")
+            val = child_by_field(node, "initializer")
+            return node_text(name_node), node_text(val)
+        left = child_by_field(node, "left")
+        right = child_by_field(node, "right")
+        return node_text(left), node_text(right)
+    if lang == Lang.DART and getattr(node, "type", "") == "variable_declaration":
+        # Dart uses declarator children
+        for child in children(node):
+            if child.type == "declared_identifier":
+                name_node = child_by_field(child, "name")
+                val = child_by_field(node, "value")
+                return node_text(name_node), node_text(val)
+        return "", ""
+    return "", ""