Skip to content

Latest commit

 

History

History
229 lines (177 loc) · 6.53 KB

README.md

File metadata and controls

229 lines (177 loc) · 6.53 KB

PyPatternGuard - Security Vulnerability Detection Engine

PyPatternGuard is a specialized code pattern detection system designed for cybersecurity specialists conducting security audits in fintech environments. It provides automated detection of security anti-patterns, vulnerability identification, and compliance reporting to ensure adherence to financial industry regulations.

Features

  • OWASP Top 10 Vulnerability Detection: Comprehensive detection of critical web application security risks
  • Cryptographic Misuse Detection: Identifies weak algorithms, hardcoded secrets, and improper cryptographic implementations
  • Input Validation Analysis: Detects SQL injection, XSS, and other input-related vulnerabilities
  • Compliance Reporting: Automated mapping to PCI-DSS and SOC2 requirements
  • False Positive Suppression: Intelligent suppression with full audit trail
  • Multiple Export Formats: JSON and XML report generation for integration with other tools

Installation

# Clone the repository
git clone <repository-url>
cd pypatternguard

# Create virtual environment
python -m venv venv
source venv/bin/activate  # On Windows: venv\Scripts\activate

# Install in development mode
pip install -e .

# Install with development dependencies
pip install -e ".[dev]"

Usage

Basic Scanning

from pypatternguard import SecurityScanner

# Create scanner instance
scanner = SecurityScanner()

# Scan a project directory
scan_result = scanner.scan("/path/to/project")

# Print summary
stats = scan_result.get_summary_stats()
print(f"Found {stats['total_vulnerabilities']} vulnerabilities")
print(f"Critical: {stats['severity_distribution']['critical']}")
print(f"High: {stats['severity_distribution']['high']}")

Advanced Configuration

from pypatternguard import SecurityScanner, ScannerConfig

# Configure scanner
config = ScannerConfig(
    max_workers=4,
    min_confidence_threshold=0.8,
    file_extensions=[".py", ".pyw"],
    exclude_patterns=["__pycache__", ".git", "venv"],
    suppression_file="/path/to/suppressions.json"
)

scanner = SecurityScanner(config)

Generating Compliance Reports

# Generate compliance report
compliance_report = scanner.generate_compliance_report(scan_result)

# Check compliance scores
print(f"PCI-DSS Score: {compliance_report.compliance_scores['PCI-DSS']}%")
print(f"SOC2 Score: {compliance_report.compliance_scores['SOC2']}%")

# Export reports
scanner.export_results(scan_result, "scan_results.json", "json")
scanner.export_results(scan_result, "scan_results.xml", "xml")

Managing False Positives

from pypatternguard.suppression import SuppressionManager
from pypatternguard.models import SuppressionRule

# Create suppression manager
suppression_manager = SuppressionManager()

# Add suppression rule
rule = SuppressionRule(
    id="suppress-test-files",
    pattern="tests/.*",
    reason="Test files contain intentional vulnerabilities",
    created_by="security_team",
    created_at=datetime.now()
)
suppression_manager.add_rule(rule)

# Save rules
suppression_manager.save_rules("suppressions.json")

Vulnerability Types Detected

OWASP Top 10

  • Injection (A03): SQL injection, command injection, code injection
  • Broken Authentication (A07): Weak password hashing, hardcoded credentials
  • Sensitive Data Exposure (A02): Hardcoded secrets, weak encryption
  • XML External Entities (A05): XXE vulnerabilities
  • Broken Access Control (A01): Authorization flaws
  • Security Misconfiguration (A05): Insecure defaults
  • Cross-Site Scripting (A03): XSS vulnerabilities
  • Insecure Deserialization (A08): Unsafe pickle/yaml usage
  • Using Components with Known Vulnerabilities (A06): Outdated dependencies
  • Insufficient Logging & Monitoring (A09): Missing security logging

Cryptographic Issues

  • Weak hashing algorithms (MD5, SHA1)
  • Weak encryption ciphers (DES, 3DES, RC4)
  • Insecure cipher modes (ECB)
  • Hardcoded encryption keys and IVs
  • Predictable random number generation

Input Validation

  • SQL injection via string concatenation
  • Command injection through os.system/subprocess
  • Code injection via eval/exec
  • Path traversal vulnerabilities
  • Cross-site scripting (XSS)

Compliance Mapping

PyPatternGuard automatically maps detected vulnerabilities to compliance requirements:

PCI-DSS

  • Requirement 2.3: Encrypt non-console administrative access
  • Requirement 3.4: Render PAN unreadable anywhere stored
  • Requirement 6.5.1: Injection flaws
  • Requirement 6.5.7: Cross-site scripting
  • Requirement 8.2.1: Strong authentication credentials

SOC2

  • CC6.1: Logical and physical access controls
  • CC6.7: Transmission and disclosure of information
  • CC7.1: System operations
  • CC7.2: System monitoring

Running Tests

# Install test dependencies
pip install -e ".[dev]"

# Run all tests
pytest

# Run with coverage
pytest --cov=pypatternguard

# Generate JSON test report (REQUIRED)
pip install pytest-json-report
pytest --json-report --json-report-file=pytest_results.json

Performance

PyPatternGuard is designed for high performance:

  • Scans 100,000 lines of code in under 5 minutes
  • Memory usage under 2GB for typical codebases
  • Supports parallel processing with configurable workers
  • Incremental scanning for faster re-analysis

Configuration Options

Option Default Description
max_file_size_mb 10.0 Maximum file size to scan
max_workers 4 Number of parallel workers
min_confidence_threshold 0.7 Minimum confidence for reporting
file_extensions [".py", ".pyw"] File types to scan
exclude_patterns ["pycache", ".git", "venv"] Patterns to exclude

Output Formats

JSON Report Structure

{
  "scan_id": "uuid",
  "timestamp": "2024-01-15T10:30:00",
  "total_files_scanned": 25,
  "vulnerabilities": [
    {
      "id": "SQLI-001",
      "type": "injection",
      "severity": "critical",
      "title": "SQL Injection",
      "location": {
        "file_path": "/app/db.py",
        "line_start": 42
      },
      "remediation": "Use parameterized queries",
      "compliance_mappings": {
        "PCI-DSS": ["6.5.1"],
        "SOC2": ["CC6.1"]
      }
    }
  ]
}

Contributing

  1. Fork the repository
  2. Create a feature branch
  3. Make your changes
  4. Run tests to ensure everything passes
  5. Submit a pull request

License

This project is licensed under the MIT License - see the LICENSE file for details.

Support

For issues, questions, or contributions, please open an issue on the GitHub repository.