Code Security Auditor

# 完整安全审计
code-security-auditor audit <project_path>

# 快速扫描（仅高危漏洞）
code-security-auditor quick <project_path>

# 针对特定漏洞类型
code-security-auditor scan --type sql-injection <project_path>
code-security-auditor scan --type xss <project_path>
code-security-auditor scan --type ssrf <project_path>

# 生成修复建议
code-security-auditor fix <vulnerability_id>

# 与基线对比
code-security-auditor compare --baseline .security-baseline.json

# Python
pip-audit
safety check
pipx run pip-audit --format json

# Node.js
npm audit --json
npx audit-ci --config audit-ci.jsonc

# Rust
cargo audit --json

# Java/Maven
mvn org.owasp:dependency-check-maven:check -Dformat=JSON

{
  "phase": "dependency_scan",
  "verdict": "WARN",
  "findings": [
    {
      "id": "DEP-001",
      "severity": "HIGH",
      "package": "requests",
      "version": "2.28.0",
      "vulnerability": "CVE-2023-32681",
      "description": "信息泄露风险",
      "fix": "升级到 2.31.0+",
      "cvss": 7.5
    }
  ]
}

# API Keys
r'(api[_-]?key|apikey)\s*[:=]\s*["\'][a-zA-Z0-9]{20,}["\']'

# Passwords
r'(password|passwd|pwd)\s*[:=]\s*["\'].+["\']'

# Tokens
r'(token|secret|auth)\s*[:=]\s*["\'][a-zA-Z0-9_-]{20,}["\']'

# Private Keys
r'-----BEGIN (RSA |EC )?PRIVATE KEY-----'

# Cloud Credentials
r'AKIA[0-9A-Z]{16}'  # AWS Access Key
r'ghp_[a-zA-Z0-9]{36}'  # GitHub Token

# truffleHog
trufflehog filesystem <path> --json

# gitleaks
gitleaks detect --source <path> --report-format json

# detect-secrets
detect-secrets scan --all-files > .secrets.baseline

# 危险模式
cursor.execute(f"SELECT * FROM users WHERE id = {user_id}")  # ❌
cursor.execute("SELECT * FROM users WHERE id = " + user_id)  # ❌

# 安全模式
cursor.execute("SELECT * FROM users WHERE id = %s", (user_id,))  # ✅

# 危险模式
return f"<div>{user_input}</div>"  # ❌
html = "<span>" + request.args.get('name') + "</span>"  # ❌

# 安全模式
from markupsafe import escape
return f"<div>{escape(user_input)}</div>"  # ✅

# 危险模式
requests.get(user_url)  # ❌ 无 URL 验证
urllib.request.urlopen(user_input)  # ❌

# 安全模式
def safe_request(url: str) -> Response:
    parsed = urlparse(url)
    if not is_safe_url(parsed):
        raise ValueError("Unsafe URL")
    return requests.get(url)

# 污点源（Source）
user_input = request.args.get('id')  # tainted

# 污点传播
data = process(user_input)  # still tainted
query = build_query(data)  # still tainted

# 污点汇（Sink）
cursor.execute(query)  # VULNERABLE!

# CORS 检查
cors:
  allowed_origins: ["*"]  # ❌ 生产环境禁止
  allowed_methods: ["GET", "POST"]
  credentials: true  # ⚠️ 与 * 冲突

# CSP 检查
content_security_policy:
  default_src: ["'self'"]  # ✅
  script_src: ["'self'", "'unsafe-inline'"]  # ⚠️ 避免 unsafe-inline

ssl:
  min_version: "TLSv1.2"  # ✅ 禁止 TLSv1.0/1.1
  ciphers:  # ✅ 使用强加密套件
    - ECDHE-RSA-AES256-GCM-SHA384
    - ECDHE-RSA-AES128-GCM-SHA256
  hsts: true  # ✅ 启用 HSTS

# 检查敏感文件权限
chmod 600 .env          # ✅
chmod 644 config.yaml   # ✅
chmod 755 scripts/      # ✅
chmod 777 anything      # ❌ 禁止

# ✅ 正确的日志
logger.info(f"User {user_id} logged in from {ip}")

# ❌ 错误的日志（泄露敏感信息）
logger.info(f"Login attempt: user={username}, password={password}")

# AI 验证流程
def ai_verify_vulnerability(finding: Finding) -> VerificationResult:
    # 1. 分析代码上下文
    context = extract_context(finding.location)
    
    # 2. 检查是否有防护措施
    has_sanitizer = check_sanitizer(context)
    has_validation = check_input_validation(context)
    
    # 3. 生成利用路径
    exploit_path = generate_exploit_path(finding)
    
    # 4. 评估真实风险
    if has_sanitizer and not exploit_path:
        return VerificationResult.FALSE_POSITIVE
    
    return VerificationResult.CONFIRMED

def calculate_verdict(findings: List[Finding]) -> str:
    critical_count = sum(1 for f in findings if f.severity == "CRITICAL")
    high_count = sum(1 for f in findings if f.severity == "HIGH")
    
    if critical_count > 0:
        return "FAIL - CRITICAL VULNERABILITIES FOUND"
    elif high_count > 0:
        return "FAIL - HIGH SEVERITY VULNERABILITIES FOUND"
    elif any(f.severity == "MEDIUM" for f in findings):
        return "WARN - MEDIUM SEVERITY ISSUES FOUND"
    elif findings:
        return "PASS WITH INFO - LOW SEVERITY ISSUES FOUND"
    else:
        return "PASS - NO SECURITY ISSUES FOUND"

def get_user(user_id: str):
    query = f"SELECT * FROM users WHERE id = '{user_id}'"
    return cursor.execute(query)

def get_user(user_id: str):
    query = "SELECT * FROM users WHERE id = %s"
    return cursor.execute(query, (user_id,))

@app.route('/greet')
def greet():
    name = request.args.get('name')
    return f"<h1>Hello, {name}!</h1>"

from markupsafe import escape

@app.route('/greet')
def greet():
    name = request.args.get('name')
    return f"<h1>Hello, {escape(name)}!</h1>"

def fetch_url(url: str):
    return requests.get(url)

import socket
from urllib.parse import urlparse
import ipaddress

def is_safe_url(url: str) -> bool:
    parsed = urlparse(url)
    if parsed.scheme not in ['http', 'https']:
        return False
    
    try:
        ip = socket.gethostbyname(parsed.hostname)
        ip_obj = ipaddress.ip_address(ip)
        # 禁止私有 IP、链路本地、云元数据
        if ip_obj.is_private or ip_obj.is_loopback or ip_obj.is_link_local:
            return False
        if str(ip_obj) == '169.254.169.254':  # AWS metadata
            return False
        return True
    except:
        return False

def fetch_url(url: str):
    if not is_safe_url(url):
        raise ValueError("Unsafe URL detected")
    return requests.get(url, allow_redirects=False)

# 项目安全审计配置

# 扫描范围
scope:
  include:
    - "src/**/*"
    - "app/**/*"
  exclude:
    - "**/test/**"
    - "**/vendor/**"
    - "**/node_modules/**"
    - "**/*.min.js"

# 风险阈值
thresholds:
  critical: 0    # 0 个严重漏洞
  high: 0        # 0 个高危漏洞
  medium: 10     # 最多 10 个中危
  low: 50        # 最多 50 个低危

# 规则配置
rules:
  sql_injection:
    enabled: true
    severity: CRITICAL
  xss:
    enabled: true
    severity: HIGH
  ssrf:
    enabled: true
    severity: CRITICAL
  hardcoded_secrets:
    enabled: true
    severity: CRITICAL
  dependency_vulnerabilities:
    enabled: true
    min_severity: HIGH  # 只报告高危以上

# 修复建议
fix_suggestions:
  enabled: true
  auto_fix: false  # 谨慎启用自动修复
  review_required: true

# 报告配置
reporting:
  formats:
    - markdown
    - json
    - sarif  # IDE 集成
  include_code_snippets: true
  include_fix_examples: true

🔒 Code Security Audit Report
═══════════════════════════════════════════════════
Project: my-app @ abc1234
Date: 2026-03-07 14:30:00
Duration: 45.2s

Verdict: ❌ FAIL - HIGH SEVERITY VULNERABILITIES FOUND

Summary:
┌─────────────┬───────┬──────────┐
│ Severity    │ Count │ Status   │
├─────────────┼───────┼──────────┤
│ 🔴 Critical │   2   │  FAIL    │
│ 🟠 High     │   5   │  FAIL    │
│ 🟡 Medium   │  12   │  WARN    │
│ 🟢 Low      │  23   │  INFO    │
└─────────────┴───────┴──────────┘

Top Issues:
1. [CRITICAL] SQL Injection in user_controller.py:45
   → Use parameterized queries
   
2. [CRITICAL] Hardcoded AWS Key in config.py:12
   → Move to environment variables
   
3. [HIGH] XSS in template.html:78
   → Escape user input

4. [HIGH] SSRF in webhook_handler.py:34
   → Validate URL before request

5. [HIGH] Outdated dependency: requests@2.28.0
   → Upgrade to 2.31.0+

Next Steps:
• Run: code-security-auditor fix --all
• Review: .security-audit/report.md
• Compare: code-security-auditor compare --baseline

{
  "meta": {
    "timestamp": "2026-03-07T14:30:00Z",
    "commit": "abc1234",
    "tool_version": "1.0.0"
  },
  "verdict": "FAIL",
  "summary": {
    "critical": 2,
    "high": 5,
    "medium": 12,
    "low": 23,
    "total": 42
  },
  "findings": [
    {
      "id": "SQL-INJ-001",
      "type": "sql_injection",
      "severity": "CRITICAL",
      "cvss": 9.8,
      "location": {
        "file": "src/controllers/user_controller.py",
        "line": 45,
        "column": 12
      },
      "description": "用户输入直接进入 SQL 查询",
      "evidence": "cursor.execute(f\"SELECT * FROM users WHERE id = '{user_id}'\")",
      "remediation": {
        "description": "使用参数化查询",
        "code": "cursor.execute(\"SELECT * FROM users WHERE id = %s\", (user_id,))"
      },
      "references": [
        "https://owasp.org/www-community/attacks/SQL_Injection",
        "https://cwe.mitre.org/data/definitions/89.html"
      ]
    }
  ]
}

{
  "$schema": "https://raw.githubusercontent.com/oasis-tcs/sarif-spec/master/Schemata/sarif-schema-2.1.0.json",
  "version": "2.1.0",
  "runs": [
    {
      "tool": {
        "driver": {
          "name": "Code Security Auditor",
          "version": "1.0.0"
        }
      },
      "results": [
        {
          "ruleId": "SQL-INJ",
          "level": "error",
          "message": {
            "text": "SQL Injection vulnerability detected"
          },
          "locations": [
            {
              "physicalLocation": {
                "artifactLocation": {
                  "uri": "src/controllers/user_controller.py"
                },
                "region": {
                  "startLine": 45,
                  "startColumn": 12
                }
              }
            }
          ]
        }
      ]
    }
  ]
}

name: Security Audit

on:
  push:
    branches: [main, develop]
  pull_request:
    branches: [main]

jobs:
  security-audit:
    runs-on: ubuntu-latest
    steps:
      - uses: actions/checkout@v4
      
      - name: Run Security Audit
        run: |
          code-security-auditor audit . \
            --format sarif \
            --output security-results.sarif \
            --fail-on high
      
      - name: Upload to GitHub Security
        uses: github/codeql-action/upload-sarif@v3
        with:
          sarif_file: security-results.sarif
      
      - name: Check Baseline
        run: |
          code-security-auditor compare \
            --baseline .security-baseline.json \
            --current security-results.json

security-audit:
  stage: test
  image: python:3.11
  script:
    - pip install code-security-auditor
    - code-security-auditor audit . --fail-on high
  artifacts:
    reports:
      sast: security-results.sarif

# 开发阶段快速检查
code-security-auditor quick ./src

# 发布前完整审计
code-security-auditor audit . --output report.md

# 针对 PR 的变更审计
code-security-auditor audit . --changed-only

# 生成修复补丁
code-security-auditor fix --all --review

# 与基线对比（检测回归）
code-security-auditor compare --baseline last-release.json

# 导出 SARIF 供 IDE 使用
code-security-auditor audit . --format sarif --output results.sarif