sec-scan 0.1.0__tar.gz

sec_scan-0.1.0/PKG-INFO

@@ -0,0 +1,8 @@
+Metadata-Version: 2.4
+Name: sec-scan
+Version: 0.1.0
+Summary: A from-scratch CLI security scanner
+Requires-Python: >=3.8
+Requires-Dist: tree-sitter>=0.21
+Requires-Dist: tree-sitter-python>=0.21
+Requires-Dist: colorama>=0.4

sec_scan-0.1.0/README.md

@@ -0,0 +1,91 @@
+# sec-scan
+
+A command-line security scanner, built from scratch and growing one
+vulnerability check at a time. It walks a codebase and flags patterns
+that look like known vulnerability classes. No external scanning
+services, no network calls, no data leaves your machine.
+
+## What it checks for right now
+
+- **SQL Injection (line-based)** — flags lines where a SQL-executing
+  call (`execute`, `query`, `ExecuteReader`, etc.) is combined with
+  string concatenation or interpolation (`+`, f-strings, `.format()`,
+  template literals, C#'s `$"..."`) instead of a safe parameterized
+  placeholder (`?`, `%s`, `@name`, `:name`).
+  Applies to: `.py .js .ts .php .java .cs .rb .go`
+
+- **SQL Injection (deep, Python only)** — parses Python into a real
+  syntax tree instead of reading text line by line, and tracks
+  variables built from unsafe string concatenation across multiple
+  lines within a function. This catches a common gap in the
+  line-based check: a query assembled on one line and executed
+  several lines later.
+
+For Python files, both checks run and you may see two findings for
+the same underlying bug — one from each check. That's expected for
+now; deduplication is a known future improvement.
+
+More checks, and deep analysis for more languages, will be added
+over time — each one gets its own section here, the same way the
+entries above do.
+
+## Install
+
+    pip install -e .
+
+If pip refuses with an "externally managed environment" error:
+
+    pip install -e . --break-system-packages
+
+(Or use a virtualenv if you'd rather keep it isolated — either works.)
+
+This installs two dependencies alongside sec-scan itself:
+`tree-sitter` and `tree-sitter-python`, which power the deep Python
+check above.
+
+## Use
+
+From inside any project you want to check:
+
+    sec-scan .
+
+That scans the current directory. To scan a specific folder or file
+instead:
+
+    sec-scan path/to/folder
+    sec-scan path/to/file.py
+
+## How it works
+
+This isn't a full production-grade static analyzer — it's
+intentionally lightweight detection, built in stages:
+
+- The line-based check reads each line as text and looks for a
+  dangerous pattern sitting next to a SQL call. Fast, works on any
+  of the eight supported languages, but only sees one line at a
+  time — a query built across multiple lines can slip past it.
+- The deep Python check instead parses the file into a proper syntax
+  tree and follows a variable's origin within a function, so it can
+  catch the multi-line case above. It's Python-only for now, and it
+  doesn't follow a value once it's passed into another function.
+
+Findings should be reviewed by a human, not treated as a guarantee
+of safety or the absence of bugs — that's true of every static
+analysis tool, not just this one. Known limitations for each check
+are documented in that check's own source file.
+
+## Project structure
+
+    sec-scan/
+    ├── pyproject.toml
+    └── sec_scan/
+        ├── scanner.py               # CLI entry point, walks files, runs checks
+        └── checks/
+            ├── registry.py          # auto-discovers check modules
+            ├── sql_injection.py       # line-based SQL injection check
+            └── sql_injection_deep.py  # tree-sitter based SQL injection check (Python)
+
+Adding a new check means adding one new file to `sec_scan/checks/`
+that defines `EXTENSIONS` (a set of file extensions) and
+`run(file_path, content)` (returns a list of finding dicts). It's
+picked up automatically — nothing else needs to change.

sec_scan-0.1.0/pyproject.toml

@@ -0,0 +1,20 @@
+[project]
+name = "sec-scan"
+version = "0.1.0"
+description = "A from-scratch CLI security scanner"
+requires-python = ">=3.8"
+dependencies = [
+    "tree-sitter>=0.21",
+    "tree-sitter-python>=0.21",
+    "colorama>=0.4",
+]
+
+[project.scripts]
+sec-scan = "sec_scan.scanner:main"
+
+[tool.setuptools]
+packages = ["sec_scan", "sec_scan.checks"]
+
+[build-system]
+requires = ["setuptools>=61.0"]
+build-backend = "setuptools.build_meta"

sec_scan-0.1.0/sec_scan/checks/registry.py

@@ -0,0 +1,21 @@
+import importlib
+import os
+
+
+def load_checks():
+    checks_dir = os.path.dirname(__file__)
+    modules = []
+
+    for filename in sorted(os.listdir(checks_dir)):
+        if not filename.endswith(".py"):
+            continue
+        if filename in ("__init__.py", "registry.py"):
+            continue
+
+        module_name = f"sec_scan.checks.{filename[:-3]}"
+        module = importlib.import_module(module_name)
+
+        if hasattr(module, "EXTENSIONS") and hasattr(module, "run"):
+            modules.append(module)
+
+    return modules

sec_scan-0.1.0/sec_scan/checks/sql_injection.py

@@ -0,0 +1,53 @@
+import re
+
+EXTENSIONS = {".py", ".js", ".ts", ".php", ".java", ".cs", ".rb", ".go"}
+
+SINK_PATTERN = re.compile(
+    r"\b(execute|executemany|executeQuery|executeUpdate|"
+    r"ExecuteReader|ExecuteNonQuery|ExecuteScalar|"
+    r"createStatement|query|raw)\s*\(",
+    re.IGNORECASE,
+)
+
+DANGER_PATTERNS = [
+    re.compile(r'["\']\s*\+\s*\w'),
+    re.compile(r'\w\s*\+\s*["\']'),
+    re.compile(r'f["\'].*\{.*\}'),
+    re.compile(r'\.format\('),
+    re.compile(r'\$\{'),
+    re.compile(r'\$"'),
+]
+
+SAFE_PATTERNS = [
+    re.compile(r'\?'),
+    re.compile(r'%s'),
+    re.compile(r'@\w+'),
+    re.compile(r':\w+'),
+]
+
+
+def run(file_path, content):
+    findings = []
+
+    for lineno, line in enumerate(content.splitlines(), start=1):
+        if not SINK_PATTERN.search(line):
+            continue
+
+        has_danger = any(p.search(line) for p in DANGER_PATTERNS)
+        has_safe = any(p.search(line) for p in SAFE_PATTERNS)
+
+        if has_danger and not has_safe:
+            findings.append({
+                "check_id": "SQL-INJECTION",
+                "severity": "HIGH",
+                "file": file_path,
+                "line": lineno,
+                "message": (
+                    "Query looks like it's built with string "
+                    "concatenation/interpolation instead of parameters. "
+                    "Possible SQL injection."
+                ),
+                "snippet": line,
+            })
+
+    return findings

sec_scan-0.1.0/sec_scan/checks/sql_injection_deep.py

@@ -0,0 +1,155 @@
+"""
+sql_injection_deep.py — Python-only, tree-based taint tracking for SQL
+injection. This is the upgrade over sql_injection.py's line-by-line
+regex approach: instead of reading text, it parses the file into a
+real syntax tree (via tree-sitter) and tracks which variables were
+built unsafely, following that variable across lines within the same
+function — which is exactly the gap the line-based check can't see:
+
+    query = "SELECT ... " + username   # tainted here
+    cursor.execute(query)               # caught here, two lines later
+
+LIMITATIONS (same honesty policy as the line-based check):
+  - Python only. Other languages still rely on sql_injection.py.
+  - Taint tracking stays within one function — it does not follow a
+    value if it's passed as an argument into another function.
+  - If a tainted variable is reassigned safely, taint is cleared —
+    but only for simple `name = ...` reassignment, not more complex
+    patterns (tuple unpacking, augmented assignment with +=, etc.).
+"""
+
+import re
+import tree_sitter_python as tspython
+from tree_sitter import Language, Parser
+
+EXTENSIONS = {".py"}
+
+_PY_LANGUAGE = Language(tspython.language())
+_parser = Parser(_PY_LANGUAGE)
+
+SINK_NAMES = {"execute", "executemany", "query", "raw"}
+SAFE_PLACEHOLDER = re.compile(r'\?|%s|@\w+|:\w+')
+
+
+def _node_text(node, source):
+    return source[node.start_byte:node.end_byte]
+
+
+def _is_unsafe_string(node):
+    # An f-string counts as unsafe if it actually interpolates a value.
+    if node.type == "string":
+        return any(c.type == "interpolation" for c in node.children)
+    return False
+
+
+def _contains_concat(node):
+    # Walks a binary_operator chain looking for a '+' anywhere in it.
+    if node.type == "binary_operator":
+        for c in node.children:
+            if c.type == "+":
+                return True
+        return any(_contains_concat(c) for c in node.children)
+    return False
+
+
+def _expr_is_unsafe(node):
+    if node.type == "string":
+        return _is_unsafe_string(node)
+    if node.type == "binary_operator":
+        return _contains_concat(node)
+    return False
+
+
+def _get_call_name(call_node):
+    func = call_node.child_by_field_name("function")
+    if func is None:
+        return None
+    if func.type == "attribute":
+        attr = func.child_by_field_name("attribute")
+        return attr.text.decode() if attr else None
+    if func.type == "identifier":
+        return func.text.decode()
+    return None
+
+
+def _build_finding(file_path, call_node, source, arg_src, tracked):
+    row = call_node.start_point[0] + 1
+    line_text = source.splitlines()[call_node.start_point[0]].decode(errors="ignore")
+    if tracked:
+        message = (
+            f"Variable '{arg_src}' was built from unsafe string "
+            f"concatenation/interpolation earlier, then passed into a "
+            f"SQL execution call."
+        )
+    else:
+        message = "Query built via unsafe string concatenation/interpolation directly in this call."
+    return {
+        "check_id": "SQL-INJECTION-DEEP",
+        "severity": "HIGH",
+        "file": file_path,
+        "line": row,
+        "message": message,
+        "snippet": line_text.strip(),
+    }
+
+
+def _check_call(call_node, tainted, source, file_path, findings):
+    name = _get_call_name(call_node)
+    if not name or name.lower() not in SINK_NAMES:
+        return
+
+    args_node = call_node.child_by_field_name("arguments")
+    if not args_node:
+        return
+
+    for arg in args_node.children:
+        if arg.type in ("(", ")", ","):
+            continue
+
+        arg_src = _node_text(arg, source).decode(errors="ignore")
+        if SAFE_PLACEHOLDER.search(arg_src):
+            continue
+
+        if arg.type == "identifier" and arg_src in tainted:
+            findings.append(_build_finding(file_path, call_node, source, arg_src, True))
+        elif _expr_is_unsafe(arg):
+            findings.append(_build_finding(file_path, call_node, source, arg_src, False))
+
+
+def _scan_scope(func_node, source, file_path, findings):
+    # tainted = names of variables currently known to hold an unsafely
+    # built string, within THIS function's scope only.
+    tainted = set()
+
+    def walk(node):
+        # Nested function = new scope, tracked separately.
+        if node.type == "function_definition" and node is not func_node:
+            _scan_scope(node, source, file_path, findings)
+            return
+
+        if node.type == "assignment":
+            left = node.child_by_field_name("left")
+            right = node.child_by_field_name("right")
+            if left is not None and right is not None and left.type == "identifier":
+                name = _node_text(left, source).decode()
+                if _expr_is_unsafe(right):
+                    tainted.add(name)
+                else:
+                    # Reassigned to something safe — taint no longer applies.
+                    tainted.discard(name)
+
+        if node.type == "call":
+            _check_call(node, tainted, source, file_path, findings)
+
+        for child in node.children:
+            walk(child)
+
+    walk(func_node)
+
+
+def run(file_path, content):
+    source = content.encode()
+    tree = _parser.parse(source)
+    findings = []
+    _scan_scope(tree.root_node, source, file_path, findings)
+    return findings

sec_scan-0.1.0/sec_scan/scanner.py

@@ -0,0 +1,108 @@
+#!/usr/bin/env python3
+"""
+scanner.py — entry point for the security scanner CLI.
+
+Usage:
+    python3 scanner.py <path-to-scan>
+
+How it works:
+    1. Walk every file under <path-to-scan>.
+    2. For each file, look at its extension to guess the language.
+    3. Ask every check module in checks/ whether it applies to that
+       language, and if so, run it against the file's content.
+    4. Collect all findings and print a report at the end.
+
+Adding a new check later = adding one new file to checks/ that
+follows the same shape as checks/sql_injection.py. Nothing in this
+file needs to change.
+"""
+
+import argparse
+import os
+import sys
+
+import colorama
+from colorama import Fore, Style
+
+from .checks.registry import load_checks
+
+# init(autoreset=True) means we don't have to manually reset color
+# after every colored print — colorama resets it for us automatically.
+# On Windows, this is also what makes ANSI colors render at all in
+# terminals that don't support them natively (older cmd.exe).
+colorama.init(autoreset=True)
+
+SKIP_DIRS = {".git", "node_modules", "venv", ".venv", "__pycache__",
+             "dist", "build", "bin", "obj", ".idea", ".vscode"}
+
+SEVERITY_COLORS = {
+    "HIGH": Fore.RED,
+    "MEDIUM": Fore.YELLOW,
+    "LOW": Fore.CYAN,
+}
+
+
+def collect_files(root):
+    for dirpath, dirnames, filenames in os.walk(root):
+        dirnames[:] = [d for d in dirnames if d not in SKIP_DIRS]
+        for name in filenames:
+            yield os.path.join(dirpath, name)
+
+
+def main():
+    parser = argparse.ArgumentParser(description="Scan a codebase for security issues.")
+    parser.add_argument("path", nargs="?", default=".",
+                         help="File or folder to scan (default: current directory)")
+    args = parser.parse_args()
+
+    if not os.path.exists(args.path):
+        print(f"{Fore.RED}Error: path '{args.path}' does not exist.{Style.RESET_ALL}")
+        sys.exit(1)
+
+    checks = load_checks()
+    if not checks:
+        print("No checks registered yet.")
+        sys.exit(0)
+
+    files = [args.path] if os.path.isfile(args.path) else list(collect_files(args.path))
+
+    all_findings = []
+    for file_path in files:
+        try:
+            with open(file_path, "r", encoding="utf-8", errors="ignore") as f:
+                content = f.read()
+        except (IsADirectoryError, PermissionError):
+            continue
+
+        ext = os.path.splitext(file_path)[1]
+
+        for check in checks:
+            if ext in check.EXTENSIONS:
+                findings = check.run(file_path, content)
+                all_findings.extend(findings)
+
+    print_report(all_findings, len(files), len(checks))
+
+
+def print_report(findings, file_count, check_count):
+    print(f"\nScanned {file_count} file(s) with {check_count} check(s).\n")
+
+    if not findings:
+        print(f"{Fore.GREEN}No issues found.{Style.RESET_ALL}")
+        return
+
+    findings.sort(key=lambda f: f["line"])
+
+    for f in findings:
+        color = SEVERITY_COLORS.get(f["severity"], "")
+        print(f"{color}[{f['severity']}] {f['check_id']}{Style.RESET_ALL}")
+        print(f"  {f['file']}:{f['line']}")
+        print(f"  {f['message']}")
+        print(f"  >> {f['snippet'].strip()}")
+        print()
+
+    print(f"{Fore.RED}Total findings: {len(findings)}{Style.RESET_ALL}")
+
+
+if __name__ == "__main__":
+    main()

sec_scan-0.1.0/sec_scan.egg-info/PKG-INFO

@@ -0,0 +1,8 @@
+Metadata-Version: 2.4
+Name: sec-scan
+Version: 0.1.0
+Summary: A from-scratch CLI security scanner
+Requires-Python: >=3.8
+Requires-Dist: tree-sitter>=0.21
+Requires-Dist: tree-sitter-python>=0.21
+Requires-Dist: colorama>=0.4

sec_scan-0.1.0/sec_scan.egg-info/SOURCES.txt

@@ -0,0 +1,14 @@
+README.md
+pyproject.toml
+sec_scan/__init__.py
+sec_scan/scanner.py
+sec_scan.egg-info/PKG-INFO
+sec_scan.egg-info/SOURCES.txt
+sec_scan.egg-info/dependency_links.txt
+sec_scan.egg-info/entry_points.txt
+sec_scan.egg-info/requires.txt
+sec_scan.egg-info/top_level.txt
+sec_scan/checks/__init__.py
+sec_scan/checks/registry.py
+sec_scan/checks/sql_injection.py
+sec_scan/checks/sql_injection_deep.py

sec_scan-0.1.0/sec_scan.egg-info/dependency_links.txt

@@ -0,0 +1 @@
+

sec_scan-0.1.0/sec_scan.egg-info/entry_points.txt

@@ -0,0 +1,2 @@
+[console_scripts]
+sec-scan = sec_scan.scanner:main

sec_scan-0.1.0/sec_scan.egg-info/requires.txt

@@ -0,0 +1,3 @@
+tree-sitter>=0.21
+tree-sitter-python>=0.21
+colorama>=0.4

sec_scan-0.1.0/sec_scan.egg-info/top_level.txt

@@ -0,0 +1 @@
+sec_scan

sec_scan-0.1.0/setup.cfg

@@ -0,0 +1,4 @@
+[egg_info]
+tag_build = 
+tag_date = 0
+