mirror of
https://github.com/FuzzingLabs/fuzzforge_ai.git
synced 2026-07-05 20:17:52 +02:00
Initial commit
This commit is contained in:
Tanguy Duhamel
@@ -0,0 +1,399 @@
|
||||
#!/usr/bin/env python3
|
||||
# Copyright (c) 2025 FuzzingLabs
|
||||
#
|
||||
# Licensed under the Business Source License 1.1 (BSL). See the LICENSE file
|
||||
# at the root of this repository for details.
|
||||
#
|
||||
# After the Change Date (four years from publication), this version of the
|
||||
# Licensed Work will be made available under the Apache License, Version 2.0.
|
||||
# See the LICENSE-APACHE file or http://www.apache.org/licenses/LICENSE-2.0
|
||||
#
|
||||
# Additional attribution and requirements are provided in the NOTICE file.
|
||||
|
||||
"""
|
||||
Batch analysis example.
|
||||
|
||||
This example demonstrates how to:
|
||||
1. Analyze multiple projects or targets
|
||||
2. Run different workflows on the same target
|
||||
3. Collect and compare results
|
||||
4. Generate summary reports
|
||||
"""
|
||||
|
||||
import asyncio
|
||||
import json
|
||||
from pathlib import Path
|
||||
from typing import List, Dict, Any
|
||||
import time
|
||||
|
||||
from fuzzforge_sdk import (
|
||||
FuzzForgeClient,
|
||||
WorkflowSubmission,
|
||||
WorkflowFindings,
|
||||
RunSubmissionResponse
|
||||
)
|
||||
from fuzzforge_sdk.utils import (
|
||||
create_workflow_submission,
|
||||
format_sarif_summary,
|
||||
count_sarif_severity_levels,
|
||||
save_sarif_to_file,
|
||||
get_project_files,
|
||||
estimate_analysis_time
|
||||
)
|
||||
|
||||
|
||||
class BatchAnalyzer:
|
||||
"""Batch analysis manager."""
|
||||
|
||||
def __init__(self, client: FuzzForgeClient):
|
||||
self.client = client
|
||||
self.results: List[Dict[str, Any]] = []
|
||||
|
||||
async def analyze_project(
|
||||
self,
|
||||
project_path: Path,
|
||||
workflows: List[str],
|
||||
output_dir: Path
|
||||
) -> Dict[str, Any]:
|
||||
"""
|
||||
Analyze a single project with multiple workflows.
|
||||
|
||||
Args:
|
||||
project_path: Path to project to analyze
|
||||
workflows: List of workflow names to run
|
||||
output_dir: Directory to save results
|
||||
|
||||
Returns:
|
||||
Analysis results summary
|
||||
"""
|
||||
print(f"\n📁 Analyzing project: {project_path.name}")
|
||||
print(f" Path: {project_path}")
|
||||
print(f" Workflows: {', '.join(workflows)}")
|
||||
|
||||
project_results = {
|
||||
"project_name": project_path.name,
|
||||
"project_path": str(project_path),
|
||||
"workflows": {},
|
||||
"summary": {},
|
||||
"start_time": time.time()
|
||||
}
|
||||
|
||||
# Get project info
|
||||
try:
|
||||
files = get_project_files(project_path)
|
||||
project_results["file_count"] = len(files)
|
||||
project_results["total_size"] = sum(f.stat().st_size for f in files if f.exists())
|
||||
print(f" Files: {len(files)}")
|
||||
except Exception as e:
|
||||
print(f" ⚠️ Could not analyze project structure: {e}")
|
||||
project_results["file_count"] = 0
|
||||
project_results["total_size"] = 0
|
||||
|
||||
# Create project output directory
|
||||
project_output_dir = output_dir / project_path.name
|
||||
project_output_dir.mkdir(parents=True, exist_ok=True)
|
||||
|
||||
# Run each workflow
|
||||
for workflow_name in workflows:
|
||||
try:
|
||||
workflow_result = await self._run_workflow_on_project(
|
||||
project_path,
|
||||
workflow_name,
|
||||
project_output_dir
|
||||
)
|
||||
project_results["workflows"][workflow_name] = workflow_result
|
||||
|
||||
except Exception as e:
|
||||
print(f" ❌ Failed to run {workflow_name}: {e}")
|
||||
project_results["workflows"][workflow_name] = {
|
||||
"status": "failed",
|
||||
"error": str(e)
|
||||
}
|
||||
|
||||
# Calculate summary
|
||||
project_results["end_time"] = time.time()
|
||||
project_results["duration"] = project_results["end_time"] - project_results["start_time"]
|
||||
project_results["summary"] = self._calculate_project_summary(project_results)
|
||||
|
||||
# Save project summary
|
||||
summary_file = project_output_dir / "analysis_summary.json"
|
||||
with open(summary_file, 'w') as f:
|
||||
json.dump(project_results, f, indent=2, default=str)
|
||||
|
||||
print(f" ✅ Analysis complete in {project_results['duration']:.1f}s")
|
||||
return project_results
|
||||
|
||||
async def _run_workflow_on_project(
|
||||
self,
|
||||
project_path: Path,
|
||||
workflow_name: str,
|
||||
output_dir: Path
|
||||
) -> Dict[str, Any]:
|
||||
"""Run a single workflow on a project."""
|
||||
print(f" 🔄 Running {workflow_name}...")
|
||||
|
||||
# Get workflow metadata for better parameter selection
|
||||
try:
|
||||
metadata = await self.client.aget_workflow_metadata(workflow_name)
|
||||
|
||||
# Determine appropriate timeout based on workflow type
|
||||
if "fuzzing" in metadata.tags:
|
||||
timeout = 1800 # 30 minutes for fuzzing
|
||||
volume_mode = "rw"
|
||||
elif "dynamic" in metadata.tags:
|
||||
timeout = 900 # 15 minutes for dynamic analysis
|
||||
volume_mode = "rw"
|
||||
else:
|
||||
timeout = 300 # 5 minutes for static analysis
|
||||
volume_mode = "ro"
|
||||
|
||||
except Exception:
|
||||
# Fallback settings
|
||||
timeout = 600
|
||||
volume_mode = "ro"
|
||||
|
||||
# Create submission
|
||||
submission = create_workflow_submission(
|
||||
target_path=project_path,
|
||||
volume_mode=volume_mode,
|
||||
timeout=timeout
|
||||
)
|
||||
|
||||
# Submit workflow
|
||||
start_time = time.time()
|
||||
response = await self.client.asubmit_workflow(workflow_name, submission)
|
||||
|
||||
# Wait for completion
|
||||
try:
|
||||
final_status = await self.client.await_for_completion(
|
||||
response.run_id,
|
||||
poll_interval=10.0,
|
||||
timeout=float(timeout + 300) # Add buffer for completion timeout
|
||||
)
|
||||
|
||||
end_time = time.time()
|
||||
duration = end_time - start_time
|
||||
|
||||
# Get findings if successful
|
||||
findings = None
|
||||
if final_status.is_completed and not final_status.is_failed:
|
||||
try:
|
||||
findings = await self.client.aget_run_findings(response.run_id)
|
||||
|
||||
# Save SARIF results
|
||||
sarif_file = output_dir / f"{workflow_name}_results.sarif.json"
|
||||
save_sarif_to_file(findings.sarif, sarif_file)
|
||||
|
||||
print(f" ✅ {workflow_name} completed: {format_sarif_summary(findings.sarif)}")
|
||||
|
||||
except Exception as e:
|
||||
print(f" ⚠️ Could not retrieve findings for {workflow_name}: {e}")
|
||||
|
||||
result = {
|
||||
"status": "completed" if final_status.is_completed else "failed",
|
||||
"run_id": response.run_id,
|
||||
"duration": duration,
|
||||
"final_status": final_status.status,
|
||||
"findings_summary": format_sarif_summary(findings.sarif) if findings else None,
|
||||
"severity_counts": count_sarif_severity_levels(findings.sarif) if findings else None
|
||||
}
|
||||
|
||||
return result
|
||||
|
||||
except Exception as e:
|
||||
end_time = time.time()
|
||||
duration = end_time - start_time
|
||||
print(f" ❌ {workflow_name} failed after {duration:.1f}s: {e}")
|
||||
|
||||
return {
|
||||
"status": "failed",
|
||||
"run_id": response.run_id,
|
||||
"duration": duration,
|
||||
"error": str(e)
|
||||
}
|
||||
|
||||
def _calculate_project_summary(self, project_results: Dict[str, Any]) -> Dict[str, Any]:
|
||||
"""Calculate summary statistics for a project analysis."""
|
||||
workflows = project_results["workflows"]
|
||||
|
||||
total_findings = {}
|
||||
successful_workflows = 0
|
||||
failed_workflows = 0
|
||||
|
||||
for workflow_name, workflow_result in workflows.items():
|
||||
if workflow_result["status"] == "completed":
|
||||
successful_workflows += 1
|
||||
|
||||
# Aggregate severity counts
|
||||
severity_counts = workflow_result.get("severity_counts", {})
|
||||
for severity, count in severity_counts.items():
|
||||
total_findings[severity] = total_findings.get(severity, 0) + count
|
||||
|
||||
else:
|
||||
failed_workflows += 1
|
||||
|
||||
return {
|
||||
"successful_workflows": successful_workflows,
|
||||
"failed_workflows": failed_workflows,
|
||||
"total_workflows": len(workflows),
|
||||
"total_findings": total_findings,
|
||||
"total_issues": sum(total_findings.values())
|
||||
}
|
||||
|
||||
|
||||
async def main():
|
||||
"""Main batch analysis example."""
|
||||
# Configuration
|
||||
projects_to_analyze = [
|
||||
Path.cwd(), # Current directory
|
||||
# Add more project paths here
|
||||
# Path("/path/to/project1"),
|
||||
# Path("/path/to/project2"),
|
||||
]
|
||||
|
||||
workflows_to_run = [
|
||||
# "static-analysis",
|
||||
# "security-scan",
|
||||
# "dependency-check",
|
||||
# Add actual workflow names from your FuzzForge instance
|
||||
]
|
||||
|
||||
output_base_dir = Path("./analysis_results")
|
||||
|
||||
# Initialize client
|
||||
async with FuzzForgeClient(base_url="http://localhost:8000") as client:
|
||||
try:
|
||||
# Check API status
|
||||
print("🔗 Connecting to FuzzForge API...")
|
||||
status = await client.aget_api_status()
|
||||
print(f"✅ Connected to {status.name} v{status.version}")
|
||||
|
||||
# Get available workflows
|
||||
available_workflows = await client.alist_workflows()
|
||||
available_names = [w.name for w in available_workflows]
|
||||
|
||||
print(f"📋 Available workflows: {', '.join(available_names)}")
|
||||
|
||||
# Filter requested workflows to only include available ones
|
||||
valid_workflows = [w for w in workflows_to_run if w in available_names]
|
||||
|
||||
if not valid_workflows:
|
||||
print("⚠️ No valid workflows specified, using all available workflows")
|
||||
valid_workflows = available_names[:3] # Limit to first 3 for demo
|
||||
|
||||
print(f"🎯 Will run workflows: {', '.join(valid_workflows)}")
|
||||
|
||||
# Create output directory
|
||||
output_base_dir.mkdir(parents=True, exist_ok=True)
|
||||
|
||||
# Initialize batch analyzer
|
||||
analyzer = BatchAnalyzer(client)
|
||||
|
||||
# Analyze each project
|
||||
batch_start_time = time.time()
|
||||
|
||||
for project_path in projects_to_analyze:
|
||||
if not project_path.exists() or not project_path.is_dir():
|
||||
print(f"⚠️ Skipping invalid project path: {project_path}")
|
||||
continue
|
||||
|
||||
project_result = await analyzer.analyze_project(
|
||||
project_path,
|
||||
valid_workflows,
|
||||
output_base_dir
|
||||
)
|
||||
analyzer.results.append(project_result)
|
||||
|
||||
batch_end_time = time.time()
|
||||
batch_duration = batch_end_time - batch_start_time
|
||||
|
||||
# Generate batch summary report
|
||||
print(f"\n📊 Batch Analysis Complete!")
|
||||
print(f" Total time: {batch_duration:.1f}s")
|
||||
print(f" Projects analyzed: {len(analyzer.results)}")
|
||||
|
||||
# Create overall summary
|
||||
batch_summary = {
|
||||
"start_time": batch_start_time,
|
||||
"end_time": batch_end_time,
|
||||
"duration": batch_duration,
|
||||
"projects": analyzer.results,
|
||||
"overall_stats": {}
|
||||
}
|
||||
|
||||
# Calculate overall statistics
|
||||
total_successful = sum(r["summary"]["successful_workflows"] for r in analyzer.results)
|
||||
total_failed = sum(r["summary"]["failed_workflows"] for r in analyzer.results)
|
||||
total_issues = sum(r["summary"]["total_issues"] for r in analyzer.results)
|
||||
|
||||
batch_summary["overall_stats"] = {
|
||||
"total_successful_runs": total_successful,
|
||||
"total_failed_runs": total_failed,
|
||||
"total_issues_found": total_issues
|
||||
}
|
||||
|
||||
print(f" Successful runs: {total_successful}")
|
||||
print(f" Failed runs: {total_failed}")
|
||||
print(f" Total issues found: {total_issues}")
|
||||
|
||||
# Save batch summary
|
||||
batch_summary_file = output_base_dir / "batch_summary.json"
|
||||
with open(batch_summary_file, 'w') as f:
|
||||
json.dump(batch_summary, f, indent=2, default=str)
|
||||
|
||||
print(f"\n💾 Results saved to: {output_base_dir}")
|
||||
print(f" Batch summary: {batch_summary_file}")
|
||||
|
||||
# Display project summaries
|
||||
print(f"\n📈 Project Summaries:")
|
||||
for result in analyzer.results:
|
||||
print(f" {result['project_name']}: " +
|
||||
f"{result['summary']['successful_workflows']}/{result['summary']['total_workflows']} workflows successful, " +
|
||||
f"{result['summary']['total_issues']} issues found")
|
||||
|
||||
except Exception as e:
|
||||
print(f"❌ Batch analysis failed: {e}")
|
||||
|
||||
|
||||
def create_sample_batch_config():
|
||||
"""Create a sample batch configuration file."""
|
||||
config = {
|
||||
"projects": [
|
||||
{
|
||||
"name": "my-web-app",
|
||||
"path": "/path/to/my-web-app",
|
||||
"workflows": ["static-analysis", "security-scan"],
|
||||
"parameters": {
|
||||
"timeout": 600
|
||||
}
|
||||
},
|
||||
{
|
||||
"name": "api-service",
|
||||
"path": "/path/to/api-service",
|
||||
"workflows": ["dependency-check", "fuzzing"],
|
||||
"parameters": {
|
||||
"timeout": 1800
|
||||
}
|
||||
}
|
||||
],
|
||||
"output_directory": "./batch_analysis_results",
|
||||
"concurrent_limit": 2,
|
||||
"retry_failed": True
|
||||
}
|
||||
|
||||
config_file = Path("batch_config.json")
|
||||
with open(config_file, 'w') as f:
|
||||
json.dump(config, f, indent=2)
|
||||
|
||||
print(f"📄 Sample batch configuration created: {config_file}")
|
||||
|
||||
|
||||
if __name__ == "__main__":
|
||||
import sys
|
||||
|
||||
if len(sys.argv) > 1 and sys.argv[1] == "--create-config":
|
||||
create_sample_batch_config()
|
||||
else:
|
||||
print("🔄 Starting batch analysis...")
|
||||
print("💡 Use --create-config to generate sample configuration")
|
||||
asyncio.run(main())
|
||||
Reference in New Issue
Block a user