Initial commit

backend/toolbox/workflows/__init__.py

@@ -0,0 +1,11 @@
+# Copyright (c) 2025 FuzzingLabs
+#
+# Licensed under the Business Source License 1.1 (BSL). See the LICENSE file
+# at the root of this repository for details.
+#
+# After the Change Date (four years from publication), this version of the
+# Licensed Work will be made available under the Apache License, Version 2.0.
+# See the LICENSE-APACHE file or http://www.apache.org/licenses/LICENSE-2.0
+#
+# Additional attribution and requirements are provided in the NOTICE file.
+

backend/toolbox/workflows/comprehensive/__init__.py

@@ -0,0 +1,12 @@
+# Copyright (c) 2025 FuzzingLabs
+#
+# Licensed under the Business Source License 1.1 (BSL). See the LICENSE file
+# at the root of this repository for details.
+#
+# After the Change Date (four years from publication), this version of the
+# Licensed Work will be made available under the Apache License, Version 2.0.
+# See the LICENSE-APACHE file or http://www.apache.org/licenses/LICENSE-2.0
+#
+# Additional attribution and requirements are provided in the NOTICE file.
+
+

backend/toolbox/workflows/registry.py

@@ -0,0 +1,187 @@
+"""
+Manual Workflow Registry for Prefect Deployment
+
+This file contains the manual registry of all workflows that can be deployed.
+Developers MUST add their workflows here after creating them.
+
+This approach is required because:
+1. Prefect cannot deploy dynamically imported flows
+2. Docker deployment needs static flow references
+3. Explicit registration provides better control and visibility
+"""
+
+# Copyright (c) 2025 FuzzingLabs
+#
+# Licensed under the Business Source License 1.1 (BSL). See the LICENSE file
+# at the root of this repository for details.
+#
+# After the Change Date (four years from publication), this version of the
+# Licensed Work will be made available under the Apache License, Version 2.0.
+# See the LICENSE-APACHE file or http://www.apache.org/licenses/LICENSE-2.0
+#
+# Additional attribution and requirements are provided in the NOTICE file.
+
+from typing import Dict, Any, Callable
+import logging
+
+logger = logging.getLogger(__name__)
+
+# Import only essential workflows
+# Import each workflow individually to handle failures gracefully
+security_assessment_flow = None
+secret_detection_flow = None
+
+# Try to import each workflow individually
+try:
+    from .security_assessment.workflow import main_flow as security_assessment_flow
+except ImportError as e:
+    logger.warning(f"Failed to import security_assessment workflow: {e}")
+
+try:
+    from .comprehensive.secret_detection_scan.workflow import main_flow as secret_detection_flow
+except ImportError as e:
+    logger.warning(f"Failed to import secret_detection_scan workflow: {e}")
+
+
+# Manual registry - developers add workflows here after creation
+# Only include workflows that were successfully imported
+WORKFLOW_REGISTRY: Dict[str, Dict[str, Any]] = {}
+
+# Add workflows that were successfully imported
+if security_assessment_flow is not None:
+    WORKFLOW_REGISTRY["security_assessment"] = {
+        "flow": security_assessment_flow,
+        "module_path": "toolbox.workflows.security_assessment.workflow",
+        "function_name": "main_flow",
+        "description": "Comprehensive security assessment workflow that scans files, analyzes code for vulnerabilities, and generates SARIF reports",
+        "version": "1.0.0",
+        "author": "FuzzForge Team",
+        "tags": ["security", "scanner", "analyzer", "static-analysis", "sarif"]
+    }
+
+if secret_detection_flow is not None:
+    WORKFLOW_REGISTRY["secret_detection_scan"] = {
+        "flow": secret_detection_flow,
+        "module_path": "toolbox.workflows.comprehensive.secret_detection_scan.workflow",
+        "function_name": "main_flow",
+        "description": "Comprehensive secret detection using TruffleHog and Gitleaks for thorough credential scanning",
+        "version": "1.0.0",
+        "author": "FuzzForge Team",
+        "tags": ["secrets", "credentials", "detection", "trufflehog", "gitleaks", "comprehensive"]
+    }
+
+#
+# To add a new workflow, follow this pattern:
+#
+# "my_new_workflow": {
+#     "flow": my_new_flow_function,  # Import the flow function above
+#     "module_path": "toolbox.workflows.my_new_workflow.workflow",
+#     "function_name": "my_new_flow_function",
+#     "description": "Description of what this workflow does",
+#     "version": "1.0.0",
+#     "author": "Developer Name",
+#     "tags": ["tag1", "tag2"]
+# }
+
+
+def get_workflow_flow(workflow_name: str) -> Callable:
+    """
+    Get the flow function for a workflow.
+
+    Args:
+        workflow_name: Name of the workflow
+
+    Returns:
+        Flow function
+
+    Raises:
+        KeyError: If workflow not found in registry
+    """
+    if workflow_name not in WORKFLOW_REGISTRY:
+        available = list(WORKFLOW_REGISTRY.keys())
+        raise KeyError(
+            f"Workflow '{workflow_name}' not found in registry. "
+            f"Available workflows: {available}. "
+            f"Please add the workflow to toolbox/workflows/registry.py"
+        )
+
+    return WORKFLOW_REGISTRY[workflow_name]["flow"]
+
+
+def get_workflow_info(workflow_name: str) -> Dict[str, Any]:
+    """
+    Get registry information for a workflow.
+
+    Args:
+        workflow_name: Name of the workflow
+
+    Returns:
+        Registry information dictionary
+
+    Raises:
+        KeyError: If workflow not found in registry
+    """
+    if workflow_name not in WORKFLOW_REGISTRY:
+        available = list(WORKFLOW_REGISTRY.keys())
+        raise KeyError(
+            f"Workflow '{workflow_name}' not found in registry. "
+            f"Available workflows: {available}"
+        )
+
+    return WORKFLOW_REGISTRY[workflow_name]
+
+
+def list_registered_workflows() -> Dict[str, Dict[str, Any]]:
+    """
+    Get all registered workflows.
+
+    Returns:
+        Dictionary of all workflow registry entries
+    """
+    return WORKFLOW_REGISTRY.copy()
+
+
+def validate_registry() -> bool:
+    """
+    Validate the workflow registry for consistency.
+
+    Returns:
+        True if valid, raises exceptions if not
+
+    Raises:
+        ValueError: If registry is invalid
+    """
+    if not WORKFLOW_REGISTRY:
+        raise ValueError("Workflow registry is empty")
+
+    required_fields = ["flow", "module_path", "function_name", "description"]
+
+    for name, entry in WORKFLOW_REGISTRY.items():
+        # Check required fields
+        missing_fields = [field for field in required_fields if field not in entry]
+        if missing_fields:
+            raise ValueError(
+                f"Workflow '{name}' missing required fields: {missing_fields}"
+            )
+
+        # Check if flow is callable
+        if not callable(entry["flow"]):
+            raise ValueError(f"Workflow '{name}' flow is not callable")
+
+        # Check if flow has the required Prefect attributes
+        if not hasattr(entry["flow"], "deploy"):
+            raise ValueError(
+                f"Workflow '{name}' flow is not a Prefect flow (missing deploy method)"
+            )
+
+    logger.info(f"Registry validation passed. {len(WORKFLOW_REGISTRY)} workflows registered.")
+    return True
+
+
+# Validate registry on import
+try:
+    validate_registry()
+    logger.info(f"Workflow registry loaded successfully with {len(WORKFLOW_REGISTRY)} workflows")
+except Exception as e:
+    logger.error(f"Workflow registry validation failed: {e}")
+    raise

backend/toolbox/workflows/security_assessment/Dockerfile

@@ -0,0 +1,30 @@
+FROM prefecthq/prefect:3-python3.11
+
+WORKDIR /app
+
+# Create toolbox directory structure to match expected import paths
+RUN mkdir -p /app/toolbox/workflows /app/toolbox/modules
+
+# Copy base module infrastructure
+COPY modules/__init__.py /app/toolbox/modules/
+COPY modules/base.py /app/toolbox/modules/
+
+# Copy only required modules (manual selection)
+COPY modules/scanner /app/toolbox/modules/scanner
+COPY modules/analyzer /app/toolbox/modules/analyzer
+COPY modules/reporter /app/toolbox/modules/reporter
+
+# Copy this workflow
+COPY workflows/security_assessment /app/toolbox/workflows/security_assessment
+
+# Install workflow-specific requirements if they exist
+RUN if [ -f /app/toolbox/workflows/security_assessment/requirements.txt ]; then pip install --no-cache-dir -r /app/toolbox/workflows/security_assessment/requirements.txt; fi
+
+# Install common requirements
+RUN pip install --no-cache-dir pyyaml
+
+# Set Python path
+ENV PYTHONPATH=/app:$PYTHONPATH
+
+# Create workspace directory
+RUN mkdir -p /workspace

backend/toolbox/workflows/security_assessment/__init__.py

@@ -0,0 +1,11 @@
+# Copyright (c) 2025 FuzzingLabs
+#
+# Licensed under the Business Source License 1.1 (BSL). See the LICENSE file
+# at the root of this repository for details.
+#
+# After the Change Date (four years from publication), this version of the
+# Licensed Work will be made available under the Apache License, Version 2.0.
+# See the LICENSE-APACHE file or http://www.apache.org/licenses/LICENSE-2.0
+#
+# Additional attribution and requirements are provided in the NOTICE file.
+

backend/toolbox/workflows/security_assessment/metadata.yaml

@@ -0,0 +1,111 @@
+name: security_assessment
+version: "2.0.0"
+description: "Comprehensive security assessment workflow that scans files, analyzes code for vulnerabilities, and generates SARIF reports"
+author: "FuzzForge Team"
+category: "comprehensive"
+tags:
+  - "security"
+  - "scanner"
+  - "analyzer"
+  - "static-analysis"
+  - "sarif"
+  - "comprehensive"
+
+supported_volume_modes:
+  - "ro"
+  - "rw"
+
+default_volume_mode: "ro"
+default_target_path: "/workspace"
+
+requirements:
+  tools:
+    - "file_scanner"
+    - "security_analyzer"
+    - "sarif_reporter"
+  resources:
+    memory: "512Mi"
+    cpu: "500m"
+    timeout: 1800
+
+has_docker: true
+
+default_parameters:
+  target_path: "/workspace"
+  volume_mode: "ro"
+  scanner_config: {}
+  analyzer_config: {}
+  reporter_config: {}
+
+parameters:
+  type: object
+  properties:
+    target_path:
+      type: string
+      default: "/workspace"
+      description: "Path to analyze"
+    volume_mode:
+      type: string
+      enum: ["ro", "rw"]
+      default: "ro"
+      description: "Volume mount mode"
+    scanner_config:
+      type: object
+      description: "File scanner configuration"
+      properties:
+        patterns:
+          type: array
+          items:
+            type: string
+          description: "File patterns to scan"
+        check_sensitive:
+          type: boolean
+          description: "Check for sensitive files"
+        calculate_hashes:
+          type: boolean
+          description: "Calculate file hashes"
+        max_file_size:
+          type: integer
+          description: "Maximum file size to scan (bytes)"
+    analyzer_config:
+      type: object
+      description: "Security analyzer configuration"
+      properties:
+        file_extensions:
+          type: array
+          items:
+            type: string
+          description: "File extensions to analyze"
+        check_secrets:
+          type: boolean
+          description: "Check for hardcoded secrets"
+        check_sql:
+          type: boolean
+          description: "Check for SQL injection risks"
+        check_dangerous_functions:
+          type: boolean
+          description: "Check for dangerous function calls"
+    reporter_config:
+      type: object
+      description: "SARIF reporter configuration"
+      properties:
+        include_code_flows:
+          type: boolean
+          description: "Include code flow information"
+
+output_schema:
+  type: object
+  properties:
+    sarif:
+      type: object
+      description: "SARIF-formatted security findings"
+    summary:
+      type: object
+      description: "Scan execution summary"
+      properties:
+        total_findings:
+          type: integer
+        severity_counts:
+          type: object
+        tool_counts:
+          type: object

backend/toolbox/workflows/security_assessment/requirements.txt

@@ -0,0 +1,4 @@
+# Requirements for security assessment workflow
+pydantic>=2.0.0
+pyyaml>=6.0
+aiofiles>=23.0.0

backend/toolbox/workflows/security_assessment/workflow.py

@@ -0,0 +1,252 @@
+"""
+Security Assessment Workflow - Comprehensive security analysis using multiple modules
+"""
+
+# Copyright (c) 2025 FuzzingLabs
+#
+# Licensed under the Business Source License 1.1 (BSL). See the LICENSE file
+# at the root of this repository for details.
+#
+# After the Change Date (four years from publication), this version of the
+# Licensed Work will be made available under the Apache License, Version 2.0.
+# See the LICENSE-APACHE file or http://www.apache.org/licenses/LICENSE-2.0
+#
+# Additional attribution and requirements are provided in the NOTICE file.
+
+import sys
+import logging
+from pathlib import Path
+from typing import Dict, Any, Optional
+from prefect import flow, task
+import json
+
+# Add modules to path
+sys.path.insert(0, '/app')
+
+# Import modules
+from toolbox.modules.scanner import FileScanner
+from toolbox.modules.analyzer import SecurityAnalyzer
+from toolbox.modules.reporter import SARIFReporter
+
+# Configure logging
+logging.basicConfig(level=logging.INFO)
+logger = logging.getLogger(__name__)
+
+
+@task(name="file_scanning")
+async def scan_files_task(workspace: Path, config: Dict[str, Any]) -> Dict[str, Any]:
+    """
+    Task to scan files in the workspace.
+
+    Args:
+        workspace: Path to the workspace
+        config: Scanner configuration
+
+    Returns:
+        Scanner results
+    """
+    logger.info(f"Starting file scanning in {workspace}")
+    scanner = FileScanner()
+
+    result = await scanner.execute(config, workspace)
+
+    logger.info(f"File scanning completed: {result.summary.get('total_files', 0)} files found")
+    return result.dict()
+
+
+@task(name="security_analysis")
+async def analyze_security_task(workspace: Path, config: Dict[str, Any]) -> Dict[str, Any]:
+    """
+    Task to analyze security vulnerabilities.
+
+    Args:
+        workspace: Path to the workspace
+        config: Analyzer configuration
+
+    Returns:
+        Analysis results
+    """
+    logger.info("Starting security analysis")
+    analyzer = SecurityAnalyzer()
+
+    result = await analyzer.execute(config, workspace)
+
+    logger.info(
+        f"Security analysis completed: {result.summary.get('total_findings', 0)} findings"
+    )
+    return result.dict()
+
+
+@task(name="report_generation")
+async def generate_report_task(
+    scan_results: Dict[str, Any],
+    analysis_results: Dict[str, Any],
+    config: Dict[str, Any],
+    workspace: Path
+) -> Dict[str, Any]:
+    """
+    Task to generate SARIF report from all findings.
+
+    Args:
+        scan_results: Results from scanner
+        analysis_results: Results from analyzer
+        config: Reporter configuration
+        workspace: Path to the workspace
+
+    Returns:
+        SARIF report
+    """
+    logger.info("Generating SARIF report")
+    reporter = SARIFReporter()
+
+    # Combine findings from all modules
+    all_findings = []
+
+    # Add scanner findings (only sensitive files, not all files)
+    scanner_findings = scan_results.get("findings", [])
+    sensitive_findings = [f for f in scanner_findings if f.get("severity") != "info"]
+    all_findings.extend(sensitive_findings)
+
+    # Add analyzer findings
+    analyzer_findings = analysis_results.get("findings", [])
+    all_findings.extend(analyzer_findings)
+
+    # Prepare reporter config
+    reporter_config = {
+        **config,
+        "findings": all_findings,
+        "tool_name": "FuzzForge Security Assessment",
+        "tool_version": "1.0.0"
+    }
+
+    result = await reporter.execute(reporter_config, workspace)
+
+    # Extract SARIF from result
+    sarif = result.dict().get("sarif", {})
+
+    logger.info(f"Report generated with {len(all_findings)} total findings")
+    return sarif
+
+
+@flow(name="security_assessment", log_prints=True)
+async def main_flow(
+    target_path: str = "/workspace",
+    volume_mode: str = "ro",
+    scanner_config: Optional[Dict[str, Any]] = None,
+    analyzer_config: Optional[Dict[str, Any]] = None,
+    reporter_config: Optional[Dict[str, Any]] = None
+) -> Dict[str, Any]:
+    """
+    Main security assessment workflow.
+
+    This workflow:
+    1. Scans files in the workspace
+    2. Analyzes code for security vulnerabilities
+    3. Generates a SARIF report with all findings
+
+    Args:
+        target_path: Path to the mounted workspace (default: /workspace)
+        volume_mode: Volume mount mode (ro/rw)
+        scanner_config: Configuration for file scanner
+        analyzer_config: Configuration for security analyzer
+        reporter_config: Configuration for SARIF reporter
+
+    Returns:
+        SARIF-formatted findings report
+    """
+    logger.info(f"Starting security assessment workflow")
+    logger.info(f"Workspace: {target_path}, Mode: {volume_mode}")
+
+    # Set workspace path
+    workspace = Path(target_path)
+
+    if not workspace.exists():
+        logger.error(f"Workspace does not exist: {workspace}")
+        return {
+            "error": f"Workspace not found: {workspace}",
+            "sarif": None
+        }
+
+    # Default configurations
+    if not scanner_config:
+        scanner_config = {
+            "patterns": ["*"],
+            "check_sensitive": True,
+            "calculate_hashes": False,
+            "max_file_size": 10485760  # 10MB
+        }
+
+    if not analyzer_config:
+        analyzer_config = {
+            "file_extensions": [".py", ".js", ".java", ".php", ".rb", ".go"],
+            "check_secrets": True,
+            "check_sql": True,
+            "check_dangerous_functions": True
+        }
+
+    if not reporter_config:
+        reporter_config = {
+            "include_code_flows": False
+        }
+
+    try:
+        # Execute workflow tasks
+        logger.info("Phase 1: File scanning")
+        scan_results = await scan_files_task(workspace, scanner_config)
+
+        logger.info("Phase 2: Security analysis")
+        analysis_results = await analyze_security_task(workspace, analyzer_config)
+
+        logger.info("Phase 3: Report generation")
+        sarif_report = await generate_report_task(
+            scan_results,
+            analysis_results,
+            reporter_config,
+            workspace
+        )
+
+        # Log summary
+        if sarif_report and "runs" in sarif_report:
+            results_count = len(sarif_report["runs"][0].get("results", []))
+            logger.info(f"Workflow completed successfully with {results_count} findings")
+        else:
+            logger.info("Workflow completed successfully")
+
+        return sarif_report
+
+    except Exception as e:
+        logger.error(f"Workflow failed: {e}")
+        # Return error in SARIF format
+        return {
+            "$schema": "https://raw.githubusercontent.com/oasis-tcs/sarif-spec/master/Schemata/sarif-schema-2.1.0.json",
+            "version": "2.1.0",
+            "runs": [
+                {
+                    "tool": {
+                        "driver": {
+                            "name": "FuzzForge Security Assessment",
+                            "version": "1.0.0"
+                        }
+                    },
+                    "results": [],
+                    "invocations": [
+                        {
+                            "executionSuccessful": False,
+                            "exitCode": 1,
+                            "exitCodeDescription": str(e)
+                        }
+                    ]
+                }
+            ]
+        }
+
+
+if __name__ == "__main__":
+    # For local testing
+    import asyncio
+
+    asyncio.run(main_flow(
+        target_path="/tmp/test",
+        scanner_config={"patterns": ["*.py"]},
+        analyzer_config={"check_secrets": True}
+    ))