stryx-cli 0.1.0__py3-none-any.whl

stryx/reports/sarif_report.py

@@ -0,0 +1,200 @@
+"""SARIF 2.1.0 report generator for CI/CD integration.
+
+Generates Static Analysis Results Interchange Format (SARIF) reports
+compatible with GitHub Security tab, Azure DevOps, and other SARIF consumers.
+"""
+
+from __future__ import annotations
+
+import json
+from datetime import datetime, timezone
+from typing import Any
+
+from stryx.utils.evidence import Finding, Severity
+from stryx.utils.logging import get_logger
+
+logger = get_logger("reports.sarif")
+
+# SARIF severity mapping
+SEVERITY_MAP = {
+    "critical": {"level": "error", "score": 1.0},
+    "high": {"level": "error", "score": 0.8},
+    "medium": {"level": "warning", "score": 0.5},
+    "low": {"level": "note", "score": 0.2},
+    "info": {"level": "none", "score": 0.0},
+}
+
+
+class SarifReport:
+    """Generates SARIF 2.1.0 compliant reports."""
+
+    def __init__(
+        self,
+        target_url: str,
+        findings: list[Finding],
+        scan_time: str | None = None,
+    ):
+        self.target_url = target_url
+        self.findings = findings
+        self.scan_time = scan_time or datetime.now(timezone.utc).isoformat()
+
+    def generate(self) -> dict[str, Any]:
+        """Generate SARIF report as a dictionary."""
+        # Build rules from findings
+        rules: list[dict[str, Any]] = []
+        rule_ids: set[str] = set()
+
+        for finding in self.findings:
+            rule_id = self._get_rule_id(finding)
+            if rule_id not in rule_ids:
+                rule_ids.add(rule_id)
+                rules.append(self._build_rule(finding, rule_id))
+
+        # Build results
+        results = [self._build_result(f) for f in self.findings]
+
+        sarif = {
+            "$schema": "https://raw.githubusercontent.com/oasis-tcs/sarif-spec/master/Schemata/sarif-schema-2.1.0.json",
+            "version": "2.1.0",
+            "runs": [
+                {
+                    "tool": {
+                        "driver": {
+                            "name": "STRYX",
+                            "version": "0.1.0",
+                            "semanticVersion": "0.1.0",
+                            "informationUri": "https://github.com/medusa-Security/stryx",
+                            "rules": rules,
+                        }
+                    },
+                    "artifacts": [
+                        {
+                            "location": {
+                                "uri": self.target_url,
+                                "uriBaseId": "%SRCROOT%",
+                            },
+                        }
+                    ],
+                    "results": results,
+                    "invocations": [
+                        {
+                            "startTimeUtc": self.scan_time,
+                            "toolExecutionNotifications": [],
+                        }
+                    ],
+                }
+            ],
+        }
+
+        return sarif
+
+    def to_json(self, indent: int = 2) -> str:
+        """Generate SARIF report as JSON string."""
+        return json.dumps(self.generate(), indent=indent, default=str)
+
+    def save(self, path: str) -> None:
+        """Save SARIF report to file."""
+        with open(path, "w", encoding="utf-8") as f:
+            f.write(self.to_json())
+        logger.info(f"SARIF report saved to {path}")
+
+    def _get_rule_id(self, finding: Finding) -> str:
+        """Generate a stable rule ID for a finding."""
+        # Use CWE if available
+        if finding.cwe:
+            cwe_num = finding.cwe.replace("CWE-", "")
+            return f"stryx-cwe-{cwe_num}"
+
+        # Use scanner + title hash
+        import hashlib
+        title_hash = hashlib.md5(finding.title.encode()).hexdigest()[:8]
+        return f"stryx-{finding.scanner}-{title_hash}"
+
+    def _build_rule(self, finding: Finding, rule_id: str) -> dict[str, Any]:
+        """Build a SARIF rule definition."""
+        rule: dict[str, Any] = {
+            "id": rule_id,
+            "name": finding.title[:80],
+            "shortDescription": {
+                "text": finding.title,
+            },
+            "fullDescription": {
+                "text": finding.description or finding.title,
+            },
+            "helpUri": "",
+            "properties": {
+                "tags": finding.tags if hasattr(finding, 'tags') and finding.tags else [],
+            },
+        }
+
+        # Add CWE reference
+        if finding.cwe:
+            cwe_num = finding.cwe.replace("CWE-", "")
+            rule["helpUri"] = f"https://cwe.mitre.org/data/definitions/{cwe_num}.html"
+            rule["properties"]["tags"].append(f"security")
+            rule["properties"]["tags"].append(f"external/cwe/cwe-{cwe_num}")
+
+        # Add OWASP reference
+        if finding.owasp:
+            rule["properties"]["owasp"] = finding.owasp
+
+        return rule
+
+    def _build_result(self, finding: Finding) -> dict[str, Any]:
+        """Build a SARIF result for a finding."""
+        sev_data = SEVERITY_MAP.get(finding.severity.value, SEVERITY_MAP["info"])
+
+        result: dict[str, Any] = {
+            "ruleId": self._get_rule_id(finding),
+            "level": sev_data["level"],
+            "message": {
+                "text": finding.description or finding.title,
+            },
+            "locations": [
+                {
+                    "physicalLocation": {
+                        "artifactLocation": {
+                            "uri": finding.endpoint or self.target_url,
+                        },
+                        "region": {
+                            "startLine": 1,
+                        },
+                    }
+                }
+            ],
+            "properties": {
+                "severity": finding.severity.value,
+                "confidence": finding.evidence.confidence,
+                "scanner": finding.scanner,
+            },
+        }
+
+        # Add CWE/OWASP to properties
+        if finding.cwe:
+            result["properties"]["cwe"] = finding.cwe
+        if finding.owasp:
+            result["properties"]["owasp"] = finding.owasp
+
+        # Add remediation as help text
+        if finding.remediation:
+            result["fixes"] = [
+                {
+                    "description": {
+                        "text": finding.remediation,
+                    },
+                }
+            ]
+
+        # Add request/response evidence
+        if finding.evidence:
+            evidence_parts = []
+            evidence_parts.append(f"Request: {finding.evidence.request_method} {finding.evidence.request_url}")
+            evidence_parts.append(f"Status: {finding.evidence.response_status}")
+            if finding.evidence.payload:
+                evidence_parts.append(f"Payload: {finding.evidence.payload}")
+            if finding.evidence.response_snippet:
+                evidence_parts.append(f"Response: {finding.evidence.response_snippet[:200]}")
+
+            result["properties"]["evidence"] = "\n".join(evidence_parts)
+
+        return result

stryx/reports/templates/report.html.j2

@@ -0,0 +1,163 @@
+<!DOCTYPE html>
+<html lang="en">
+<head>
+    <meta charset="UTF-8">
+    <meta name="viewport" content="width=device-width, initial-scale=1.0">
+    <title>STRYX Security Report - {{ target }}</title>
+    <style>
+        * { margin: 0; padding: 0; box-sizing: border-box; }
+        body { font-family: -apple-system, BlinkMacSystemFont, 'Segoe UI', Roboto, sans-serif; background: #0d1117; color: #c9d1d9; line-height: 1.6; }
+        .container { max-width: 1200px; margin: 0 auto; padding: 20px; }
+        .header { background: #161b22; border: 1px solid #30363d; border-radius: 8px; padding: 24px; margin-bottom: 24px; }
+        .header h1 { color: #58a6ff; font-size: 24px; margin-bottom: 8px; }
+        .header .meta { color: #8b949e; font-size: 14px; }
+        .summary { display: grid; grid-template-columns: repeat(auto-fit, minmax(150px, 1fr)); gap: 16px; margin-bottom: 24px; }
+        .summary-card { background: #161b22; border: 1px solid #30363d; border-radius: 8px; padding: 16px; text-align: center; }
+        .summary-card .count { font-size: 32px; font-weight: bold; }
+        .summary-card .label { color: #8b949e; font-size: 12px; text-transform: uppercase; }
+        .critical { color: #f85149; }
+        .high { color: #f0883e; }
+        .medium { color: #d29922; }
+        .low { color: #58a6ff; }
+        .info { color: #8b949e; }
+        .finding { background: #161b22; border: 1px solid #30363d; border-radius: 8px; margin-bottom: 16px; overflow: hidden; }
+        .finding-header { padding: 16px; border-bottom: 1px solid #30363d; display: flex; justify-content: space-between; align-items: center; }
+        .finding-title { font-size: 16px; font-weight: 600; }
+        .severity-badge { padding: 4px 8px; border-radius: 4px; font-size: 12px; font-weight: bold; text-transform: uppercase; }
+        .severity-critical { background: #f85149; color: #fff; }
+        .severity-high { background: #f0883e; color: #fff; }
+        .severity-medium { background: #d29922; color: #fff; }
+        .severity-low { background: #58a6ff; color: #fff; }
+        .severity-info { background: #8b949e; color: #fff; }
+        .finding-body { padding: 16px; }
+        .finding-section { margin-bottom: 12px; }
+        .finding-section h3 { color: #8b949e; font-size: 12px; text-transform: uppercase; margin-bottom: 4px; }
+        .finding-section p { margin: 0; }
+        .tags { display: flex; gap: 8px; flex-wrap: wrap; margin-top: 4px; }
+        .tag { background: #21262d; color: #8b949e; padding: 2px 8px; border-radius: 12px; font-size: 11px; }
+        .evidence-block { background: #0d1117; border: 1px solid #30363d; border-radius: 4px; padding: 12px; font-family: 'SFMono-Regular', Consolas, monospace; font-size: 13px; overflow-x: auto; white-space: pre-wrap; word-break: break-all; }
+        .evidence-header { color: #58a6ff; margin-bottom: 8px; }
+        .evidence-label { color: #8b949e; }
+        .chain { background: #161b22; border: 1px solid #30363d; border-radius: 8px; margin-bottom: 16px; padding: 16px; }
+        .chain h2 { color: #f0883e; margin-bottom: 12px; font-size: 18px; }
+        .chain-meta { color: #8b949e; margin-bottom: 12px; }
+        .chain-step { padding: 8px 12px; border-left: 3px solid #30363d; margin-bottom: 8px; background: #0d1117; border-radius: 0 4px 4px 0; }
+        .chain-step-title { font-weight: 600; color: #c9d1d9; }
+        .chain-step-desc { color: #8b949e; font-size: 13px; margin-top: 4px; }
+        .footer { text-align: center; color: #8b949e; padding: 24px; font-size: 12px; border-top: 1px solid #30363d; margin-top: 24px; }
+        .no-findings { text-align: center; padding: 40px; color: #3fb950; font-size: 18px; }
+    </style>
+</head>
+<body>
+    <div class="container">
+        <div class="header">
+            <h1>🛡️ STRYX Security Report</h1>
+            <div class="meta">
+                <p><strong>Target:</strong> {{ target }}</p>
+                <p><strong>Generated:</strong> {{ generated_at }}</p>
+                <p><strong>Tool:</strong> STRYX v0.1.0 - AI-Powered DAST</p>
+            </div>
+        </div>
+
+        <div class="summary">
+            <div class="summary-card">
+                <div class="count">{{ total_findings }}</div>
+                <div class="label">Total Findings</div>
+            </div>
+            <div class="summary-card">
+                <div class="count critical">{{ critical_count }}</div>
+                <div class="label">Critical</div>
+            </div>
+            <div class="summary-card">
+                <div class="count high">{{ high_count }}</div>
+                <div class="label">High</div>
+            </div>
+            <div class="summary-card">
+                <div class="count medium">{{ medium_count }}</div>
+                <div class="label">Medium</div>
+            </div>
+            <div class="summary-card">
+                <div class="count low">{{ low_count }}</div>
+                <div class="label">Low</div>
+            </div>
+        </div>
+
+        {% if findings %}
+        <h2 style="color: #c9d1d9; margin-bottom: 16px;">Findings ({{ findings|length }})</h2>
+
+        {% for finding in findings %}
+        <div class="finding">
+            <div class="finding-header">
+                <span class="finding-title">{{ finding.title }}</span>
+                <span class="severity-badge severity-{{ finding.severity }}">{{ finding.severity }}</span>
+            </div>
+            <div class="finding-body">
+                <div class="finding-section">
+                    <h3>Endpoint</h3>
+                    <p><code>{{ finding.endpoint }}</code></p>
+                </div>
+                <div class="finding-section">
+                    <h3>Description</h3>
+                    <p>{{ finding.description }}</p>
+                </div>
+                {% if finding.remediation %}
+                <div class="finding-section">
+                    <h3>Remediation</h3>
+                    <p>{{ finding.remediation }}</p>
+                </div>
+                {% endif %}
+                {% if finding.cwe or finding.owasp %}
+                <div class="finding-section">
+                    <h3>References</h3>
+                    <p>
+                        {% if finding.cwe %}<strong>CWE:</strong> {{ finding.cwe }}{% endif %}
+                        {% if finding.cwe and finding.owasp %} | {% endif %}
+                        {% if finding.owasp %}<strong>OWASP:</strong> {{ finding.owasp }}{% endif %}
+                    </p>
+                </div>
+                {% endif %}
+                <div class="finding-section">
+                    <h3>Evidence</h3>
+                    <div class="evidence-block"><span class="evidence-header">{{ finding.evidence.request_method }} {{ finding.evidence.request_url }}</span>
+<span class="evidence-label">Status:</span> {{ finding.evidence.response_status }}
+<span class="evidence-label">Confidence:</span> {{ "%.0f"|format(finding.evidence.confidence * 100) }}%
+{% if finding.evidence.payload %}<span class="evidence-label">Payload:</span> {{ finding.evidence.payload }}{% endif %}
+
+<span class="evidence-label">Response Snippet:</span>
+{{ finding.evidence.response_snippet[:500] }}</div>
+                </div>
+            </div>
+        </div>
+        {% endfor %}
+        {% else %}
+        <div class="no-findings">✅ No security findings detected</div>
+        {% endif %}
+
+        {% if attack_chains %}
+        <h2 style="color: #f0883e; margin: 24px 0 16px;">⚔️ Attack Chains ({{ attack_chains|length }})</h2>
+
+        {% for chain in attack_chains %}
+        <div class="chain">
+            <h2>{{ chain.name }}</h2>
+            <div class="chain-meta">
+                <p><strong>Impact:</strong> {{ chain.total_impact }}</p>
+                <p><strong>Estimated Severity:</strong> {{ chain.estimated_severity }}</p>
+            </div>
+            {% for step in chain.steps %}
+            <div class="chain-step">
+                <div class="chain-step-title">Step {{ loop.index }}: {{ step.title }}</div>
+                <div class="chain-step-desc">{{ step.description }}</div>
+            </div>
+            {% endfor %}
+        </div>
+        {% endfor %}
+        {% endif %}
+
+        <div class="footer">
+            <p>STRYX v0.1.0 - AI-Powered Dynamic Application Security Testing</p>
+            <p>Built by Akhilesh Varma under Medusa Security</p>
+            <p>Generated {{ generated_at }}</p>
+        </div>
+    </div>
+</body>
+</html>

stryx/reports/terminal_report.py

@@ -0,0 +1,138 @@
+"""Terminal report generator using Rich."""
+
+from __future__ import annotations
+
+from rich.panel import Panel
+from rich.table import Table
+
+from stryx.attacks.attack_chain import AttackChain
+from stryx.utils.evidence import Finding
+from stryx.utils.logging import console as stryx_console
+
+
+class TerminalReport:
+    """Generates rich terminal output for scan results."""
+
+    def __init__(
+        self,
+        target_url: str,
+        findings: list[Finding],
+        attack_chains: list[AttackChain] | None = None,
+    ):
+        self.target_url = target_url
+        self.findings = findings
+        self.attack_chains = attack_chains or []
+        self.console = stryx_console
+
+    def display(self) -> None:
+        """Display the terminal report."""
+        self._display_summary()
+        self._display_findings_table()
+        self._display_findings_detail()
+        self._display_attack_chains()
+
+    def _display_summary(self) -> None:
+        """Display summary panel."""
+        severity_counts: dict[str, int] = {}
+        for f in self.findings:
+            sev = f.severity.value
+            severity_counts[sev] = severity_counts.get(sev, 0) + 1
+
+        summary_parts = []
+        for sev in ["critical", "high", "medium", "low", "info"]:
+            count = severity_counts.get(sev, 0)
+            if count > 0:
+                summary_parts.append(f"[severity.{sev}]{sev.upper()}: {count}[/]")
+
+        summary = " | ".join(summary_parts) if summary_parts else "No findings"
+
+        self.console.print(Panel(
+            f"[bold]Target:[/] {self.target_url}\n"
+            f"[bold]Total Findings:[/] {len(self.findings)}\n"
+            f"[bold]Breakdown:[/] {summary}",
+            title="[bold]STRYX Scan Results[/]",
+            border_style="cyan",
+        ))
+
+    def _display_findings_table(self) -> None:
+        """Display findings in a table."""
+        if not self.findings:
+            self.console.print("[green]No findings detected.[/]")
+            return
+
+        table = Table(title="Findings", show_lines=True)
+        table.add_column("#", style="dim", width=4)
+        table.add_column("Severity", width=10)
+        table.add_column("Title", min_width=30)
+        table.add_column("Endpoint", min_width=20)
+        table.add_column("Confidence", width=10)
+
+        for i, f in enumerate(self.findings, 1):
+            severity_colors = {
+                "critical": "bold red",
+                "high": "red",
+                "medium": "yellow",
+                "low": "blue",
+                "info": "dim",
+            }
+            color = severity_colors.get(f.severity.value, "white")
+
+            table.add_row(
+                str(i),
+                f"[{color}]{f.severity.value.upper()}[/]",
+                f.title,
+                f.endpoint[:50] + ("..." if len(f.endpoint) > 50 else ""),
+                f"{f.evidence.confidence:.0%}",
+            )
+
+        self.console.print(table)
+
+    def _display_findings_detail(self) -> None:
+        """Display detailed findings."""
+        if not self.findings:
+            return
+
+        self.console.print("\n[bold]Detailed Findings:[/]\n")
+
+        for i, f in enumerate(self.findings, 1):
+            severity_colors = {
+                "critical": "bold red",
+                "high": "red",
+                "medium": "yellow",
+                "low": "blue",
+                "info": "dim",
+            }
+            color = severity_colors.get(f.severity.value, "white")
+
+            detail = (
+                f"[bold]{f.title}[/]\n"
+                f"  Severity: [{color}]{f.severity.value.upper()}[/] | "
+                f"CWE: {f.cwe} | Scanner: {f.scanner}\n"
+                f"  Endpoint: {f.endpoint}\n"
+                f"  Description: {f.description}\n"
+                f"  Remediation: {f.remediation}\n"
+                f"  Evidence: {f.evidence.request_method} {f.evidence.request_url} "
+                f"-> {f.evidence.response_status}"
+            )
+            if f.evidence.payload:
+                detail += f"\n  Payload: {f.evidence.payload}"
+            if f.evidence.response_snippet:
+                detail += f"\n  Response: {f.evidence.response_snippet[:200]}"
+
+            self.console.print(Panel(detail, border_style=color))
+
+    def _display_attack_chains(self) -> None:
+        """Display attack chains."""
+        if not self.attack_chains:
+            return
+
+        self.console.print("\n[bold]Attack Chains:[/]\n")
+
+        for chain in self.attack_chains:
+            chain_text = f"[bold]{chain.name}[/]\n"
+            chain_text += f"Impact: {chain.total_impact}\n"
+            chain_text += f"Severity: {chain.estimated_severity.upper()}\n\n"
+            for j, step in enumerate(chain.steps, 1):
+                chain_text += f"  {j}. {step.finding.title} - {step.description}\n"
+
+            self.console.print(Panel(chain_text, border_style="magenta"))

stryx/scanners/__init__.py

@@ -0,0 +1,17 @@
+"""Scanner modules for STRYX."""
+
+from stryx.scanners.auth import AuthScanner
+from stryx.scanners.authorization import AuthorizationScanner
+from stryx.scanners.cors import CorsScanner
+from stryx.scanners.fuzz import FuzzScanner
+from stryx.scanners.graphql import GraphQLScanner
+from stryx.scanners.injection import InjectionScanner
+
+__all__ = [
+    "AuthScanner",
+    "AuthorizationScanner",
+    "InjectionScanner",
+    "FuzzScanner",
+    "CorsScanner",
+    "GraphQLScanner",
+]