sec-scan 0.1.0__py3-none-any.whl

sec_scan/checks/registry.py

@@ -0,0 +1,21 @@
+import importlib
+import os
+
+
+def load_checks():
+    checks_dir = os.path.dirname(__file__)
+    modules = []
+
+    for filename in sorted(os.listdir(checks_dir)):
+        if not filename.endswith(".py"):
+            continue
+        if filename in ("__init__.py", "registry.py"):
+            continue
+
+        module_name = f"sec_scan.checks.{filename[:-3]}"
+        module = importlib.import_module(module_name)
+
+        if hasattr(module, "EXTENSIONS") and hasattr(module, "run"):
+            modules.append(module)
+
+    return modules

sec_scan/checks/sql_injection.py

@@ -0,0 +1,53 @@
+import re
+
+EXTENSIONS = {".py", ".js", ".ts", ".php", ".java", ".cs", ".rb", ".go"}
+
+SINK_PATTERN = re.compile(
+    r"\b(execute|executemany|executeQuery|executeUpdate|"
+    r"ExecuteReader|ExecuteNonQuery|ExecuteScalar|"
+    r"createStatement|query|raw)\s*\(",
+    re.IGNORECASE,
+)
+
+DANGER_PATTERNS = [
+    re.compile(r'["\']\s*\+\s*\w'),
+    re.compile(r'\w\s*\+\s*["\']'),
+    re.compile(r'f["\'].*\{.*\}'),
+    re.compile(r'\.format\('),
+    re.compile(r'\$\{'),
+    re.compile(r'\$"'),
+]
+
+SAFE_PATTERNS = [
+    re.compile(r'\?'),
+    re.compile(r'%s'),
+    re.compile(r'@\w+'),
+    re.compile(r':\w+'),
+]
+
+
+def run(file_path, content):
+    findings = []
+
+    for lineno, line in enumerate(content.splitlines(), start=1):
+        if not SINK_PATTERN.search(line):
+            continue
+
+        has_danger = any(p.search(line) for p in DANGER_PATTERNS)
+        has_safe = any(p.search(line) for p in SAFE_PATTERNS)
+
+        if has_danger and not has_safe:
+            findings.append({
+                "check_id": "SQL-INJECTION",
+                "severity": "HIGH",
+                "file": file_path,
+                "line": lineno,
+                "message": (
+                    "Query looks like it's built with string "
+                    "concatenation/interpolation instead of parameters. "
+                    "Possible SQL injection."
+                ),
+                "snippet": line,
+            })
+
+    return findings

sec_scan/checks/sql_injection_deep.py

@@ -0,0 +1,155 @@
+"""
+sql_injection_deep.py — Python-only, tree-based taint tracking for SQL
+injection. This is the upgrade over sql_injection.py's line-by-line
+regex approach: instead of reading text, it parses the file into a
+real syntax tree (via tree-sitter) and tracks which variables were
+built unsafely, following that variable across lines within the same
+function — which is exactly the gap the line-based check can't see:
+
+    query = "SELECT ... " + username   # tainted here
+    cursor.execute(query)               # caught here, two lines later
+
+LIMITATIONS (same honesty policy as the line-based check):
+  - Python only. Other languages still rely on sql_injection.py.
+  - Taint tracking stays within one function — it does not follow a
+    value if it's passed as an argument into another function.
+  - If a tainted variable is reassigned safely, taint is cleared —
+    but only for simple `name = ...` reassignment, not more complex
+    patterns (tuple unpacking, augmented assignment with +=, etc.).
+"""
+
+import re
+import tree_sitter_python as tspython
+from tree_sitter import Language, Parser
+
+EXTENSIONS = {".py"}
+
+_PY_LANGUAGE = Language(tspython.language())
+_parser = Parser(_PY_LANGUAGE)
+
+SINK_NAMES = {"execute", "executemany", "query", "raw"}
+SAFE_PLACEHOLDER = re.compile(r'\?|%s|@\w+|:\w+')
+
+
+def _node_text(node, source):
+    return source[node.start_byte:node.end_byte]
+
+
+def _is_unsafe_string(node):
+    # An f-string counts as unsafe if it actually interpolates a value.
+    if node.type == "string":
+        return any(c.type == "interpolation" for c in node.children)
+    return False
+
+
+def _contains_concat(node):
+    # Walks a binary_operator chain looking for a '+' anywhere in it.
+    if node.type == "binary_operator":
+        for c in node.children:
+            if c.type == "+":
+                return True
+        return any(_contains_concat(c) for c in node.children)
+    return False
+
+
+def _expr_is_unsafe(node):
+    if node.type == "string":
+        return _is_unsafe_string(node)
+    if node.type == "binary_operator":
+        return _contains_concat(node)
+    return False
+
+
+def _get_call_name(call_node):
+    func = call_node.child_by_field_name("function")
+    if func is None:
+        return None
+    if func.type == "attribute":
+        attr = func.child_by_field_name("attribute")
+        return attr.text.decode() if attr else None
+    if func.type == "identifier":
+        return func.text.decode()
+    return None
+
+
+def _build_finding(file_path, call_node, source, arg_src, tracked):
+    row = call_node.start_point[0] + 1
+    line_text = source.splitlines()[call_node.start_point[0]].decode(errors="ignore")
+    if tracked:
+        message = (
+            f"Variable '{arg_src}' was built from unsafe string "
+            f"concatenation/interpolation earlier, then passed into a "
+            f"SQL execution call."
+        )
+    else:
+        message = "Query built via unsafe string concatenation/interpolation directly in this call."
+    return {
+        "check_id": "SQL-INJECTION-DEEP",
+        "severity": "HIGH",
+        "file": file_path,
+        "line": row,
+        "message": message,
+        "snippet": line_text.strip(),
+    }
+
+
+def _check_call(call_node, tainted, source, file_path, findings):
+    name = _get_call_name(call_node)
+    if not name or name.lower() not in SINK_NAMES:
+        return
+
+    args_node = call_node.child_by_field_name("arguments")
+    if not args_node:
+        return
+
+    for arg in args_node.children:
+        if arg.type in ("(", ")", ","):
+            continue
+
+        arg_src = _node_text(arg, source).decode(errors="ignore")
+        if SAFE_PLACEHOLDER.search(arg_src):
+            continue
+
+        if arg.type == "identifier" and arg_src in tainted:
+            findings.append(_build_finding(file_path, call_node, source, arg_src, True))
+        elif _expr_is_unsafe(arg):
+            findings.append(_build_finding(file_path, call_node, source, arg_src, False))
+
+
+def _scan_scope(func_node, source, file_path, findings):
+    # tainted = names of variables currently known to hold an unsafely
+    # built string, within THIS function's scope only.
+    tainted = set()
+
+    def walk(node):
+        # Nested function = new scope, tracked separately.
+        if node.type == "function_definition" and node is not func_node:
+            _scan_scope(node, source, file_path, findings)
+            return
+
+        if node.type == "assignment":
+            left = node.child_by_field_name("left")
+            right = node.child_by_field_name("right")
+            if left is not None and right is not None and left.type == "identifier":
+                name = _node_text(left, source).decode()
+                if _expr_is_unsafe(right):
+                    tainted.add(name)
+                else:
+                    # Reassigned to something safe — taint no longer applies.
+                    tainted.discard(name)
+
+        if node.type == "call":
+            _check_call(node, tainted, source, file_path, findings)
+
+        for child in node.children:
+            walk(child)
+
+    walk(func_node)
+
+
+def run(file_path, content):
+    source = content.encode()
+    tree = _parser.parse(source)
+    findings = []
+    _scan_scope(tree.root_node, source, file_path, findings)
+    return findings

sec_scan/scanner.py

@@ -0,0 +1,108 @@
+#!/usr/bin/env python3
+"""
+scanner.py — entry point for the security scanner CLI.
+
+Usage:
+    python3 scanner.py <path-to-scan>
+
+How it works:
+    1. Walk every file under <path-to-scan>.
+    2. For each file, look at its extension to guess the language.
+    3. Ask every check module in checks/ whether it applies to that
+       language, and if so, run it against the file's content.
+    4. Collect all findings and print a report at the end.
+
+Adding a new check later = adding one new file to checks/ that
+follows the same shape as checks/sql_injection.py. Nothing in this
+file needs to change.
+"""
+
+import argparse
+import os
+import sys
+
+import colorama
+from colorama import Fore, Style
+
+from .checks.registry import load_checks
+
+# init(autoreset=True) means we don't have to manually reset color
+# after every colored print — colorama resets it for us automatically.
+# On Windows, this is also what makes ANSI colors render at all in
+# terminals that don't support them natively (older cmd.exe).
+colorama.init(autoreset=True)
+
+SKIP_DIRS = {".git", "node_modules", "venv", ".venv", "__pycache__",
+             "dist", "build", "bin", "obj", ".idea", ".vscode"}
+
+SEVERITY_COLORS = {
+    "HIGH": Fore.RED,
+    "MEDIUM": Fore.YELLOW,
+    "LOW": Fore.CYAN,
+}
+
+
+def collect_files(root):
+    for dirpath, dirnames, filenames in os.walk(root):
+        dirnames[:] = [d for d in dirnames if d not in SKIP_DIRS]
+        for name in filenames:
+            yield os.path.join(dirpath, name)
+
+
+def main():
+    parser = argparse.ArgumentParser(description="Scan a codebase for security issues.")
+    parser.add_argument("path", nargs="?", default=".",
+                         help="File or folder to scan (default: current directory)")
+    args = parser.parse_args()
+
+    if not os.path.exists(args.path):
+        print(f"{Fore.RED}Error: path '{args.path}' does not exist.{Style.RESET_ALL}")
+        sys.exit(1)
+
+    checks = load_checks()
+    if not checks:
+        print("No checks registered yet.")
+        sys.exit(0)
+
+    files = [args.path] if os.path.isfile(args.path) else list(collect_files(args.path))
+
+    all_findings = []
+    for file_path in files:
+        try:
+            with open(file_path, "r", encoding="utf-8", errors="ignore") as f:
+                content = f.read()
+        except (IsADirectoryError, PermissionError):
+            continue
+
+        ext = os.path.splitext(file_path)[1]
+
+        for check in checks:
+            if ext in check.EXTENSIONS:
+                findings = check.run(file_path, content)
+                all_findings.extend(findings)
+
+    print_report(all_findings, len(files), len(checks))
+
+
+def print_report(findings, file_count, check_count):
+    print(f"\nScanned {file_count} file(s) with {check_count} check(s).\n")
+
+    if not findings:
+        print(f"{Fore.GREEN}No issues found.{Style.RESET_ALL}")
+        return
+
+    findings.sort(key=lambda f: f["line"])
+
+    for f in findings:
+        color = SEVERITY_COLORS.get(f["severity"], "")
+        print(f"{color}[{f['severity']}] {f['check_id']}{Style.RESET_ALL}")
+        print(f"  {f['file']}:{f['line']}")
+        print(f"  {f['message']}")
+        print(f"  >> {f['snippet'].strip()}")
+        print()
+
+    print(f"{Fore.RED}Total findings: {len(findings)}{Style.RESET_ALL}")
+
+
+if __name__ == "__main__":
+    main()

sec_scan-0.1.0.dist-info/METADATA

@@ -0,0 +1,8 @@
+Metadata-Version: 2.4
+Name: sec-scan
+Version: 0.1.0
+Summary: A from-scratch CLI security scanner
+Requires-Python: >=3.8
+Requires-Dist: tree-sitter>=0.21
+Requires-Dist: tree-sitter-python>=0.21
+Requires-Dist: colorama>=0.4

sec_scan-0.1.0.dist-info/RECORD

@@ -0,0 +1,11 @@
+sec_scan/__init__.py,sha256=47DEQpj8HBSa-_TImW-5JCeuQeRkm5NMpJWZG3hSuFU,0
+sec_scan/scanner.py,sha256=gLGpBcxbGrecFFu45T4Yy3AFYGXij7sw_lWmVgUN18Q,3321
+sec_scan/checks/__init__.py,sha256=47DEQpj8HBSa-_TImW-5JCeuQeRkm5NMpJWZG3hSuFU,0
+sec_scan/checks/registry.py,sha256=q_wgfbGrPyyAi8MFrDD8gGGcIZtKx2Kb_o89sIUEsDM,535
+sec_scan/checks/sql_injection.py,sha256=BtQVzd-cIF64G7lagzA0bUoeXTQcNTPTPS7utNNM8hA,1436
+sec_scan/checks/sql_injection_deep.py,sha256=AwX58ehrS7KQsVYoRJdZxzYXDxY14ZbsJSUMGolv_pI,5281
+sec_scan-0.1.0.dist-info/METADATA,sha256=HOEcPiyDyqiqGXJKwPm2f9ZTBVCd2uIMgbpiKf2vC_g,222
+sec_scan-0.1.0.dist-info/WHEEL,sha256=YVMoNqKzERt-wjUZwJ33xBGAwnFl-4cqbYkTtWa4itE,91
+sec_scan-0.1.0.dist-info/entry_points.txt,sha256=Xcn-SBvZfjd2Lr0bnjuO1no3mY5-7erBzYhfDubdgUY,51
+sec_scan-0.1.0.dist-info/top_level.txt,sha256=TYGZDOhFNQjPro91cAC5Y59-bITlE4Hkb4QMMinLt_s,9
+sec_scan-0.1.0.dist-info/RECORD,,

sec_scan-0.1.0.dist-info/WHEEL

@@ -0,0 +1,5 @@
+Wheel-Version: 1.0
+Generator: setuptools (84.0.0)
+Root-Is-Purelib: true
+Tag: py3-none-any
+

sec_scan-0.1.0.dist-info/entry_points.txt

@@ -0,0 +1,2 @@
+[console_scripts]
+sec-scan = sec_scan.scanner:main

sec_scan-0.1.0.dist-info/top_level.txt

@@ -0,0 +1 @@
+sec_scan