466 lines
15 KiB
Python
466 lines
15 KiB
Python
|
#!/usr/bin/env python3
|
||
|
|
"""
|
||
|
|
vulnerability_scanner.py — Check Python dependencies against CVE databases (Issue #108)
|
||
|
|
|
||
|
|
Scans requirements.txt (or any pip-compatible dependency file) and queries
|
||
|
|
the Open Source Vulnerability (OSV) database for known security issues.
|
||
|
|
|
||
|
|
OSV API: https://api.osv.dev/v1/query (free, no auth, PyPI ecosystem supported)
|
||
|
|
|
||
|
|
Output:
|
||
|
|
- Human-readable summary on stdout
|
||
|
|
- JSON report with full vulnerability details
|
||
|
|
- Exit code: 0 if no vulnerabilities found, 1 if critical/high found, 2 otherwise
|
||
|
|
|
||
|
|
Usage:
|
||
|
|
python3 scripts/vulnerability_scanner.py
|
||
|
|
python3 scripts/vulnerability_scanner.py --deps requirements.txt --output json
|
||
|
|
python3 scripts/vulnerability_scanner.py --min-severity high
|
||
|
|
python3 scripts/vulnerability_scanner.py --deps requirements.txt --report-format markdown
|
||
|
|
"""
|
||
|
|
|
||
|
|
import argparse
|
||
|
|
import json
|
||
|
|
import os
|
||
|
|
import re
|
||
|
|
import sys
|
||
|
|
import urllib.request
|
||
|
|
import urllib.error
|
||
|
|
from dataclasses import dataclass
|
||
|
|
from pathlib import Path
|
||
|
|
from typing import Dict, List, Optional, Tuple
|
||
|
|
|
||
|
|
# --- Configuration ---
|
||
|
|
|
||
|
|
OSV_API_URL = "https://api.osv.dev/v1/query"
|
||
|
|
DEFAULT_REQUIREMENTS_PATH = "requirements.txt"
|
||
|
|
SEVERITY_LEVELS = ["critical", "high", "medium", "low", "unknown"]
|
||
|
|
|
||
|
|
# Map OSV severities to our buckets
|
||
|
|
CVSS_SEVERITY_MAP = {
|
||
|
|
"CRITICAL": "critical",
|
||
|
|
"HIGH": "high",
|
||
|
|
"MEDIUM": "medium",
|
||
|
|
"LOW": "low",
|
||
|
|
"NONE": "none",
|
||
|
|
}
|
||
|
|
|
||
|
|
# --- Data Structures ---
|
||
|
|
|
||
|
|
|
||
|
|
@dataclass
|
||
|
|
class Vulnerability:
|
||
|
|
"""A single vulnerability finding."""
|
||
|
|
package: str
|
||
|
|
version: str
|
||
|
|
vuln_id: str
|
||
|
|
severity: str
|
||
|
|
cvss_score: Optional[float]
|
||
|
|
summary: str
|
||
|
|
details_url: str
|
||
|
|
fixed_versions: List[str]
|
||
|
|
|
||
|
|
|
||
|
|
@dataclass
|
||
|
|
class ScanResult:
|
||
|
|
"""Results from a vulnerability scan."""
|
||
|
|
scanned_packages: int
|
||
|
|
vulnerabilities: List[Vulnerability]
|
||
|
|
errors: List[Tuple[str, str]] # (package, error_message)
|
||
|
|
|
||
|
|
|
||
|
|
# --- Requirement Parsing ---
|
||
|
|
|
||
|
|
|
||
|
|
def parse_requirements_file(path: str) -> Dict[str, str]:
|
||
|
|
"""
|
||
|
|
Parse a requirements.txt file into {package_name: version_spec}.
|
||
|
|
|
||
|
|
Handles:
|
||
|
|
- pkg==1.2.3
|
||
|
|
- pkg>=1.0.0
|
||
|
|
- pkg[extra]==1.2.3
|
||
|
|
- -e/--editable entries (skipped)
|
||
|
|
- -r inclusions (recursive, limited depth)
|
||
|
|
- comments and blank lines
|
||
|
|
"""
|
||
|
|
packages = {}
|
||
|
|
processed_includes = set()
|
||
|
|
|
||
|
|
def parse_line(line: str, filename: str, depth: int = 0) -> None:
|
||
|
|
if depth > 3:
|
||
|
|
print(f"WARNING: Max include depth exceeded in {filename}", file=sys.stderr)
|
||
|
|
return
|
||
|
|
|
||
|
|
line = line.strip()
|
||
|
|
if not line or line.startswith('#'):
|
||
|
|
return
|
||
|
|
|
||
|
|
# Handle -r or --requirement includes
|
||
|
|
if line.startswith('-r ') or line.startswith('--requirement '):
|
||
|
|
if depth >= 3:
|
||
|
|
return
|
||
|
|
include_path = line.split(None, 1)[1].strip()
|
||
|
|
# Resolve relative to current file's directory
|
||
|
|
base_dir = os.path.dirname(os.path.abspath(filename))
|
||
|
|
full_path = os.path.join(base_dir, include_path)
|
||
|
|
if full_path not in processed_includes:
|
||
|
|
processed_includes.add(full_path)
|
||
|
|
try:
|
||
|
|
with open(full_path, 'r', encoding='utf-8') as f:
|
||
|
|
for incl_line in f:
|
||
|
|
parse_line(incl_line, full_path, depth + 1)
|
||
|
|
except FileNotFoundError:
|
||
|
|
print(f"WARNING: Could not read included file: {full_path}", file=sys.stderr)
|
||
|
|
return
|
||
|
|
|
||
|
|
# Skip editable installs and other flags
|
||
|
|
if line.startswith('-e ') or line.startswith('--editable ') or line.startswith('-'):
|
||
|
|
return
|
||
|
|
|
||
|
|
# Extract package name and version spec
|
||
|
|
# Handles: pkg==1.2.3, pkg>=1.0, pkg[extra]==1.2.3, pkg ~= 1.0
|
||
|
|
match = re.match(
|
||
|
|
r'^([a-zA-Z0-9]([a-zA-Z0-9._-]*[a-zA-Z0-9])?)(\s*[[,{])?.*?((==|>=|<=|~=|!=|===)\s*([^\s;#]+))?',
|
||
|
|
line
|
||
|
|
)
|
||
|
|
if not match:
|
||
|
|
# Try simpler: name at start before any comparison
|
||
|
|
simple = re.match(r'^([a-zA-Z0-9][-a-zA-Z0-9_.]*)', line)
|
||
|
|
if simple:
|
||
|
|
pkg = simple.group(1).lower()
|
||
|
|
packages[pkg] = ""
|
||
|
|
return
|
||
|
|
|
||
|
|
pkg_name = match.group(1).lower()
|
||
|
|
# Strip extras like django[argon2] -> django
|
||
|
|
pkg_name = re.sub(r'\[.*?\]', '', pkg_name).strip()
|
||
|
|
|
||
|
|
version = ""
|
||
|
|
if match.group(5): # comparison operator + version
|
||
|
|
version = match.group(5) + match.group(6)
|
||
|
|
|
||
|
|
packages[pkg_name] = version
|
||
|
|
|
||
|
|
# Read and parse the file
|
||
|
|
try:
|
||
|
|
with open(path, 'r', encoding='utf-8') as f:
|
||
|
|
for line in f:
|
||
|
|
parse_line(line, path, 0)
|
||
|
|
except FileNotFoundError:
|
||
|
|
print(f"ERROR: Requirements file not found: {path}", file=sys.stderr)
|
||
|
|
sys.exit(1)
|
||
|
|
|
||
|
|
return packages
|
||
|
|
|
||
|
|
|
||
|
|
# --- OSV API Queries ---
|
||
|
|
|
||
|
|
|
||
|
|
def query_osv(package: str, version: str) -> List[dict]:
|
||
|
|
"""
|
||
|
|
Query the OSV API for vulnerabilities affecting a specific package version.
|
||
|
|
|
||
|
|
Returns list of vulnerability dicts (raw API response) or empty list on error.
|
||
|
|
"""
|
||
|
|
# Normalize version spec for OSV query
|
||
|
|
# OSV expects a specific version, not a range. We query for the exact version
|
||
|
|
# if available, otherwise we query without version to get all vulns for the package
|
||
|
|
# and let the caller filter.
|
||
|
|
query_version = version if re.match(r'^[0-9]', version) else None
|
||
|
|
|
||
|
|
payload = {
|
||
|
|
"package": {
|
||
|
|
"name": package,
|
||
|
|
"ecosystem": "PyPI"
|
||
|
|
}
|
||
|
|
}
|
||
|
|
if query_version:
|
||
|
|
payload["version"] = query_version
|
||
|
|
|
||
|
|
data = json.dumps(payload).encode('utf-8')
|
||
|
|
req = urllib.request.Request(
|
||
|
|
OSV_API_URL,
|
||
|
|
data=data,
|
||
|
|
headers={'Content-Type': 'application/json'},
|
||
|
|
method='POST'
|
||
|
|
)
|
||
|
|
|
||
|
|
try:
|
||
|
|
with urllib.request.urlopen(req, timeout=15) as response:
|
||
|
|
result = json.loads(response.read().decode('utf-8'))
|
||
|
|
return result.get('vulns', []) + result.get('vulnerabilities', [])
|
||
|
|
except urllib.error.HTTPError as e:
|
||
|
|
if e.code == 404:
|
||
|
|
return [] # No vulnerabilities found
|
||
|
|
print(f"WARNING: OSV query failed for {package}: HTTP {e.code}", file=sys.stderr)
|
||
|
|
except (urllib.error.URLError, json.JSONDecodeError, TimeoutError) as e:
|
||
|
|
print(f"WARNING: OSV query failed for {package}: {e}", file=sys.stderr)
|
||
|
|
|
||
|
|
return []
|
||
|
|
|
||
|
|
|
||
|
|
def parse_osv_vuln(raw_vulns: List[dict], package: str, version_spec: str) -> List[Vulnerability]:
|
||
|
|
"""
|
||
|
|
Parse raw OSV API responses into Vulnerability objects.
|
||
|
|
"""
|
||
|
|
vulns = []
|
||
|
|
for v in raw_vulns:
|
||
|
|
vuln_id = v.get('id', 'UNKNOWN')
|
||
|
|
summary = v.get('summary', 'No summary provided.')
|
||
|
|
|
||
|
|
# Severity from CVSS or ecosystem-specific
|
||
|
|
severity = "unknown"
|
||
|
|
cvss_score = None
|
||
|
|
if 'severity' in v:
|
||
|
|
for sev_info in v['severity']:
|
||
|
|
if sev_info.get('type') == 'CVSS_V3':
|
||
|
|
score = sev_info.get('score', '')
|
||
|
|
if isinstance(score, dict):
|
||
|
|
cvss_score = score.get('baseScore')
|
||
|
|
sev_str = score.get('baseSeverity', '').upper()
|
||
|
|
severity = CVSS_SEVERITY_MAP.get(sev_str, 'unknown')
|
||
|
|
break
|
||
|
|
elif sev_info.get('type') == 'CVSS_V2':
|
||
|
|
# Fallback
|
||
|
|
score = sev_info.get('score', '')
|
||
|
|
if isinstance(score, dict):
|
||
|
|
cvss_score = score.get('baseScore')
|
||
|
|
sev_str = sev_info.get('type', '').upper()
|
||
|
|
severity = "unknown"
|
||
|
|
|
||
|
|
# Affected packages/ranges
|
||
|
|
affected = v.get('affected', [])
|
||
|
|
fixed_versions = []
|
||
|
|
for aff in affected:
|
||
|
|
for r in aff.get('ranges', []):
|
||
|
|
for event in r.get('events', []):
|
||
|
|
if event.get('introduced'):
|
||
|
|
# We have the version, fixed would be in 'fixed' events
|
||
|
|
pass
|
||
|
|
if event.get('fixed'):
|
||
|
|
fixed_versions.append(event['fixed'])
|
||
|
|
|
||
|
|
# Build details URL
|
||
|
|
details_url = f"https://osv.dev/vulnerability/{vuln_id}"
|
||
|
|
|
||
|
|
vuln = Vulnerability(
|
||
|
|
package=package,
|
||
|
|
version=version_spec,
|
||
|
|
vuln_id=vuln_id,
|
||
|
|
severity=severity,
|
||
|
|
cvss_score=cvss_score,
|
||
|
|
summary=summary,
|
||
|
|
details_url=details_url,
|
||
|
|
fixed_versions=list(set(fixed_versions))
|
||
|
|
)
|
||
|
|
vulns.append(vuln)
|
||
|
|
|
||
|
|
return vulns
|
||
|
|
|
||
|
|
|
||
|
|
# --- Filtering & Reporting ---
|
||
|
|
|
||
|
|
|
||
|
|
def filter_by_severity(vulns: List[Vulnerability], min_severity: str) -> List[Vulnerability]:
|
||
|
|
"""Filter vulnerabilities to include only those at or above the given severity."""
|
||
|
|
if min_severity.lower() not in SEVERITY_LEVELS:
|
||
|
|
return vulns # No filtering if invalid
|
||
|
|
|
||
|
|
min_idx = SEVERITY_LEVELS.index(min_severity.lower())
|
||
|
|
filtered = []
|
||
|
|
for v in vulns:
|
||
|
|
sev_idx = SEVERITY_LEVELS.index(v.severity.lower())
|
||
|
|
if sev_idx <= min_idx: # lower index = more severe
|
||
|
|
filtered.append(v)
|
||
|
|
return filtered
|
||
|
|
|
||
|
|
|
||
|
|
def generate_text_report(result: ScanResult, packages: Dict[str, str]) -> str:
|
||
|
|
"""Generate human-readable text report."""
|
||
|
|
lines = []
|
||
|
|
lines.append("=" * 60)
|
||
|
|
lines.append("Vulnerability Scan Report")
|
||
|
|
lines.append("=" * 60)
|
||
|
|
lines.append(f"Packages scanned: {result.scanned_packages}")
|
||
|
|
lines.append(f"Vulnerabilities found: {len(result.vulnerabilities)}")
|
||
|
|
|
||
|
|
if result.errors:
|
||
|
|
lines.append(f"Errors: {len(result.errors)}")
|
||
|
|
|
||
|
|
# Group by severity
|
||
|
|
by_severity: Dict[str, List[Vulnerability]] = {}
|
||
|
|
for v in result.vulnerabilities:
|
||
|
|
by_severity.setdefault(v.severity.upper(), []).append(v)
|
||
|
|
|
||
|
|
for sev in ["CRITICAL", "HIGH", "MEDIUM", "LOW", "UNKNOWN"]:
|
||
|
|
vuln_list = by_severity.get(sev, [])
|
||
|
|
if vuln_list:
|
||
|
|
lines.append(f"\n{sev}: {len(vuln_list)}")
|
||
|
|
for v in vuln_list:
|
||
|
|
lines.append(f" [{v.package} {packages.get(v.package, '')}] {v.vuln_id}")
|
||
|
|
lines.append(f" {v.summary[:80]}")
|
||
|
|
if v.cvss_score:
|
||
|
|
lines.append(f" CVSS: {v.cvss_score}")
|
||
|
|
if v.fixed_versions:
|
||
|
|
lines.append(f" Fixed in: {', '.join(v.fixed_versions[:3])}")
|
||
|
|
lines.append(f" {v.details_url}")
|
||
|
|
|
||
|
|
if result.errors:
|
||
|
|
lines.append("\nERRORS:")
|
||
|
|
for pkg, err in result.errors[:10]:
|
||
|
|
lines.append(f" {pkg}: {err}")
|
||
|
|
|
||
|
|
lines.append("\n" + "=" * 60)
|
||
|
|
return "\n".join(lines)
|
||
|
|
|
||
|
|
|
||
|
|
def generate_json_report(result: ScanResult, packages: Dict[str, str]) -> str:
|
||
|
|
"""Generate JSON report."""
|
||
|
|
report = {
|
||
|
|
"scanned_packages": result.scanned_packages,
|
||
|
|
"vulnerabilities": [
|
||
|
|
{
|
||
|
|
"package": v.package,
|
||
|
|
"version_spec": packages.get(v.package, v.version),
|
||
|
|
"vulnerability_id": v.vuln_id,
|
||
|
|
"severity": v.severity,
|
||
|
|
"cvss_score": v.cvss_score,
|
||
|
|
"summary": v.summary,
|
||
|
|
"details_url": v.details_url,
|
||
|
|
"fixed_versions": v.fixed_versions,
|
||
|
|
}
|
||
|
|
for v in result.vulnerabilities
|
||
|
|
],
|
||
|
|
"errors": [{"package": p, "error": e} for p, e in result.errors],
|
||
|
|
}
|
||
|
|
return json.dumps(report, indent=2)
|
||
|
|
|
||
|
|
|
||
|
|
# --- Main Orchestration ---
|
||
|
|
|
||
|
|
|
||
|
|
def run_scan(
|
||
|
|
deps_path: str,
|
||
|
|
min_severity: str = "low",
|
||
|
|
query_osv_api: bool = True
|
||
|
|
) -> ScanResult:
|
||
|
|
"""
|
||
|
|
Execute the full vulnerability scan pipeline.
|
||
|
|
|
||
|
|
Args:
|
||
|
|
deps_path: Path to requirements-style file
|
||
|
|
min_severity: Minimum severity to include in results
|
||
|
|
query_osv_api: If False, skip API calls (for testing/dry-run)
|
||
|
|
|
||
|
|
Returns:
|
||
|
|
ScanResult with all findings
|
||
|
|
"""
|
||
|
|
# 1. Parse dependencies
|
||
|
|
packages = parse_requirements_file(deps_path)
|
||
|
|
if not packages:
|
||
|
|
return ScanResult(scanned_packages=0, vulnerabilities=[], errors=[])
|
||
|
|
|
||
|
|
# 2. Query OSV for each package
|
||
|
|
vulnerabilities: List[Vulnerability] = []
|
||
|
|
errors: List[Tuple[str, str]] = []
|
||
|
|
|
||
|
|
for pkg, version_spec in packages.items():
|
||
|
|
if not query_osv_api:
|
||
|
|
continue
|
||
|
|
|
||
|
|
raw_vulns = query_osv(pkg, version_spec or "")
|
||
|
|
if raw_vulns:
|
||
|
|
parsed = parse_osv_vuln(raw_vulns, pkg, version_spec or "")
|
||
|
|
vulnerabilities.extend(parsed)
|
||
|
|
|
||
|
|
# 3. Filter by severity
|
||
|
|
filtered = filter_by_severity(vulnerabilities, min_severity)
|
||
|
|
|
||
|
|
# 4. Build result
|
||
|
|
return ScanResult(
|
||
|
|
scanned_packages=len(packages),
|
||
|
|
vulnerabilities=filtered,
|
||
|
|
errors=errors
|
||
|
|
)
|
||
|
|
|
||
|
|
|
||
|
|
def main() -> int:
|
||
|
|
parser = argparse.ArgumentParser(
|
||
|
|
description="Scan Python dependencies for known vulnerabilities using OSV database"
|
||
|
|
)
|
||
|
|
parser.add_argument(
|
||
|
|
'--deps', '-d',
|
||
|
|
default=DEFAULT_REQUIREMENTS_PATH,
|
||
|
|
help='Path to requirements.txt (default: requirements.txt)'
|
||
|
|
)
|
||
|
|
parser.add_argument(
|
||
|
|
'--output', '-o',
|
||
|
|
choices=['text', 'json', 'markdown'],
|
||
|
|
default='text',
|
||
|
|
help='Output format (default: text)'
|
||
|
|
)
|
||
|
|
parser.add_argument(
|
||
|
|
'--min-severity',
|
||
|
|
default='low',
|
||
|
|
choices=SEVERITY_LEVELS,
|
||
|
|
help='Minimum severity to report (default: low — report all)'
|
||
|
|
)
|
||
|
|
parser.add_argument(
|
||
|
|
'--json',
|
||
|
|
action='store_true',
|
||
|
|
help='Output JSON (shorthand for --output json)'
|
||
|
|
)
|
||
|
|
parser.add_argument(
|
||
|
|
'--quiet', '-q',
|
||
|
|
action='store_true',
|
||
|
|
help='Only print summary, skip detailed vulnerability list'
|
||
|
|
)
|
||
|
|
|
||
|
|
args = parser.parse_args()
|
||
|
|
|
||
|
|
# Update output if --json flag is used
|
||
|
|
if args.json:
|
||
|
|
args.output = 'json'
|
||
|
|
|
||
|
|
# Run the scan
|
||
|
|
result = run_scan(args.deps, args.min_severity, query_osv_api=True)
|
||
|
|
|
||
|
|
# Output
|
||
|
|
if args.output == 'json':
|
||
|
|
print(generate_json_report(result, parse_requirements_file(args.deps)))
|
||
|
|
elif args.output == 'markdown':
|
||
|
|
# Simple markdown table
|
||
|
|
print("# Vulnerability Scan Report\n")
|
||
|
|
print(f"**Packages scanned:** {result.scanned_packages}")
|
||
|
|
print(f"**Vulnerabilities:** {len(result.vulnerabilities)}\n")
|
||
|
|
if result.vulnerabilities:
|
||
|
|
print("| Severity | Package | Version | Vuln ID | Summary |")
|
||
|
|
print("|----------|---------|---------|---------|---------|")
|
||
|
|
for v in result.vulnerabilities:
|
||
|
|
print(f"| {v.severity.upper()} | {v.package} | {v.version} | [{v.vuln_id}]({v.details_url}) | {v.summary[:50]} |")
|
||
|
|
print("\n")
|
||
|
|
else:
|
||
|
|
# text (default)
|
||
|
|
if not args.quiet:
|
||
|
|
print(generate_text_report(result, parse_requirements_file(args.deps)))
|
||
|
|
else:
|
||
|
|
crit = sum(1 for v in result.vulnerabilities if v.severity == 'critical')
|
||
|
|
high = sum(1 for v in result.vulnerabilities if v.severity == 'high')
|
||
|
|
med = sum(1 for v in result.vulnerabilities if v.severity == 'medium')
|
||
|
|
print(f"CRITICAL={crit} HIGH={high} MEDIUM={med} TOTAL={len(result.vulnerabilities)}")
|
||
|
|
|
||
|
|
# Exit code logic: 0 if no vulns at min_severity+, 1 if critical/high found, 2 for other vulns
|
||
|
|
has_critical_high = any(v.severity in ('critical', 'high') for v in result.vulnerabilities)
|
||
|
|
has_other = any(v.severity not in ('critical', 'high') for v in result.vulnerabilities)
|
||
|
|
|
||
|
|
if has_critical_high:
|
||
|
|
return 1
|
||
|
|
elif has_other:
|
||
|
|
return 2
|
||
|
|
return 0
|
||
|
|
|
||
|
|
|
||
|
|
if __name__ == '__main__':
|
||
|
|
sys.exit(main())
|