CalvinBackup/fuzzforge_ai
1
0
Fork 0
mirror of https://github.com/FuzzingLabs/fuzzforge_ai.git synced 2026-07-11 07:43:43 +02:00
Code Issues Packages Projects Releases Wiki Activity

refactor: Update all modules to use new create_finding signature

Browse Source 
Updated 10 modules to use the new create_finding() signature with required rule_id and found_by parameters:

- llm_analyzer.py: Added FoundBy and LLMContext for AI-detected findings
- bandit_analyzer.py: Added tool attribution and moved CWE/confidence to proper fields
- security_analyzer.py: Updated all three finding types (secrets, SQL injection, dangerous functions)
- mypy_analyzer.py: Added tool attribution and moved column info to column_start
- mobsf_scanner.py: Updated all 6 finding types (permissions, manifest, code analysis, behavior) with proper line number handling
- opengrep_android.py: Added tool attribution, proper CWE/OWASP formatting, and confidence mapping
- dependency_scanner.py: Added pip-audit attribution for CVE findings
- file_scanner.py: Updated both sensitive file and enumeration findings
- cargo_fuzzer.py: Added fuzzer type attribution for crash findings
- atheris_fuzzer.py: Added fuzzer type attribution for Python crash findings

All modules now properly track:
- Finding source (module, tool name, version, type)
- Confidence levels (high/medium/low)
- CWE and OWASP mappings where applicable
- LLM context for AI-detected issues
This commit is contained in:
tduhamel42
2025-11-02 15:36:30 +01:00
parent 99cee284b6
commit fccd8f32ab
10 changed files with 275 additions and 46 deletions
Download Patch File Download Diff File Expand all files Collapse all files
backend/toolbox/modules/analyzer/bandit_analyzer.py
+25 -5
View File
@@ -21,12 +21,12 @@ from pathlib import Path
from typing import Dict, Any, List
try:
from toolbox.modules.base import BaseModule, ModuleMetadata, ModuleResult, ModuleFinding
from toolbox.modules.base import BaseModule, ModuleMetadata, ModuleResult, ModuleFinding, FoundBy
except ImportError:
try:
from modules.base import BaseModule, ModuleMetadata, ModuleResult, ModuleFinding
from modules.base import BaseModule, ModuleMetadata, ModuleResult, ModuleFinding, FoundBy
except ImportError:
from src.toolbox.modules.base import BaseModule, ModuleMetadata, ModuleResult, ModuleFinding
from src.toolbox.modules.base import BaseModule, ModuleMetadata, ModuleResult, ModuleFinding, FoundBy
logger = logging.getLogger(__name__)
@@ -237,12 +237,34 @@ class BanditAnalyzer(BaseModule):
except (ValueError, TypeError):
rel_path = Path(filename).name
# Extract confidence and CWE
confidence = issue.get("issue_confidence", "LOW").lower()
cwe_info = issue.get("issue_cwe", {})
cwe_id = f"CWE-{cwe_info.get('id')}" if cwe_info and cwe_info.get("id") else None
# Create FoundBy attribution
# Try to get Bandit version from metrics, fall back to unknown
bandit_version = "unknown"
if "metrics" in bandit_result:
bandit_version = bandit_result["metrics"].get("_version", "unknown")
found_by = FoundBy(
module="bandit_analyzer",
tool_name="Bandit",
tool_version=bandit_version,
type="tool"
)
# Create finding
finding = self.create_finding(
rule_id=test_id,
title=f"{test_name} ({test_id})",
description=issue_text,
severity=severity,
category="security-issue",
found_by=found_by,
confidence=confidence,
cwe=cwe_id,
file_path=str(rel_path),
line_start=line_number,
line_end=line_number,
@@ -251,8 +273,6 @@ class BanditAnalyzer(BaseModule):
metadata={
"test_id": test_id,
"test_name": test_name,
"confidence": issue.get("issue_confidence", "LOW").lower(),
"cwe": issue.get("issue_cwe", {}).get("id") if issue.get("issue_cwe") else None,
"more_info": issue.get("more_info", "")
}
)
backend/toolbox/modules/analyzer/llm_analyzer.py
+53 -8
View File
@@ -18,12 +18,12 @@ from pathlib import Path
from typing import Dict, Any, List
try:
from toolbox.modules.base import BaseModule, ModuleMetadata, ModuleResult
from toolbox.modules.base import BaseModule, ModuleMetadata, ModuleResult, FoundBy, LLMContext
except ImportError:
try:
from modules.base import BaseModule, ModuleMetadata, ModuleResult
from modules.base import BaseModule, ModuleMetadata, ModuleResult, FoundBy, LLMContext
except ImportError:
from src.toolbox.modules.base import BaseModule, ModuleMetadata, ModuleResult
from src.toolbox.modules.base import BaseModule, ModuleMetadata, ModuleResult, FoundBy, LLMContext
logger = logging.getLogger(__name__)
@@ -270,10 +270,14 @@ class LLMAnalyzer(BaseModule):
return []
# Parse LLM response into findings
full_prompt = f"{system_prompt}\n\n{user_message}"
findings = self._parse_llm_response(
llm_response=llm_response,
file_path=file_path,
workspace=workspace
workspace=workspace,
llm_model=llm_model,
llm_provider=llm_provider,
prompt=full_prompt
)
return findings
@@ -282,7 +286,10 @@ class LLMAnalyzer(BaseModule):
self,
llm_response: str,
file_path: Path,
workspace: Path
workspace: Path,
llm_model: str,
llm_provider: str,
prompt: str
) -> List:
"""Parse LLM response into structured findings"""
@@ -302,7 +309,9 @@ class LLMAnalyzer(BaseModule):
if line.startswith("ISSUE:"):
# Save previous issue if exists
if current_issue:
findings.append(self._create_module_finding(current_issue, relative_path))
findings.append(self._create_module_finding(
current_issue, relative_path, llm_model, llm_provider, prompt
))
current_issue = {"title": line.replace("ISSUE:", "").strip()}
elif line.startswith("SEVERITY:"):
@@ -320,11 +329,20 @@ class LLMAnalyzer(BaseModule):
# Save last issue
if current_issue:
findings.append(self._create_module_finding(current_issue, relative_path))
findings.append(self._create_module_finding(
current_issue, relative_path, llm_model, llm_provider, prompt
))
return findings
def _create_module_finding(self, issue: Dict[str, Any], file_path: str):
def _create_module_finding(
self,
issue: Dict[str, Any],
file_path: str,
llm_model: str,
llm_provider: str,
prompt: str
):
"""Create a ModuleFinding from parsed issue"""
severity_map = {
@@ -334,12 +352,39 @@ class LLMAnalyzer(BaseModule):
"info": "low"
}
# Determine confidence based on severity (LLM is more confident on critical issues)
confidence_map = {
"error": "high",
"warning": "medium",
"note": "medium",
"info": "low"
}
# Create FoundBy attribution
found_by = FoundBy(
module="llm_analyzer",
tool_name=f"{llm_provider}/{llm_model}",
tool_version="1.0.0",
type="llm"
)
# Create LLM context
llm_context = LLMContext(
model=llm_model,
prompt=prompt,
temperature=None # Not exposed in current config
)
# Use base class helper to create proper ModuleFinding
return self.create_finding(
rule_id=f"llm_security_{issue.get('severity', 'warning')}",
title=issue.get("title", "Security issue detected"),
description=issue.get("description", ""),
severity=severity_map.get(issue.get("severity", "warning"), "medium"),
category="security",
found_by=found_by,
confidence=confidence_map.get(issue.get("severity", "warning"), "medium"),
llm_context=llm_context,
file_path=file_path,
line_start=issue.get("line"),
metadata={
backend/toolbox/modules/analyzer/mypy_analyzer.py
+15 -4
View File
@@ -21,12 +21,12 @@ from pathlib import Path
from typing import Dict, Any, List
try:
from toolbox.modules.base import BaseModule, ModuleMetadata, ModuleResult, ModuleFinding
from toolbox.modules.base import BaseModule, ModuleMetadata, ModuleResult, ModuleFinding, FoundBy
except ImportError:
try:
from modules.base import BaseModule, ModuleMetadata, ModuleResult, ModuleFinding
from modules.base import BaseModule, ModuleMetadata, ModuleResult, ModuleFinding, FoundBy
except ImportError:
from src.toolbox.modules.base import BaseModule, ModuleMetadata, ModuleResult, ModuleFinding
from src.toolbox.modules.base import BaseModule, ModuleMetadata, ModuleResult, ModuleFinding, FoundBy
logger = logging.getLogger(__name__)
@@ -189,18 +189,29 @@ class MypyAnalyzer(BaseModule):
title = f"Type error: {error_code or 'type-issue'}"
description = message
# Create FoundBy attribution
found_by = FoundBy(
module="mypy_analyzer",
tool_name="Mypy",
tool_version="unknown", # Mypy doesn't include version in output
type="tool"
)
finding = self.create_finding(
rule_id=error_code or "type-issue",
title=title,
description=description,
severity=severity,
category="type-error",
found_by=found_by,
confidence="high", # Mypy is highly confident in its type checking
file_path=str(rel_path),
line_start=int(line_num),
line_end=int(line_num),
column_start=int(column) if column else None,
recommendation="Review and fix the type inconsistency or add appropriate type annotations",
metadata={
"error_code": error_code or "unknown",
"column": int(column) if column else None,
"level": level
}
)
backend/toolbox/modules/analyzer/security_analyzer.py
+37 -3
View File
@@ -19,12 +19,12 @@ from pathlib import Path
from typing import Dict, Any, List
try:
from toolbox.modules.base import BaseModule, ModuleMetadata, ModuleResult, ModuleFinding
from toolbox.modules.base import BaseModule, ModuleMetadata, ModuleResult, ModuleFinding, FoundBy
except ImportError:
try:
from modules.base import BaseModule, ModuleMetadata, ModuleResult, ModuleFinding
from modules.base import BaseModule, ModuleMetadata, ModuleResult, ModuleFinding, FoundBy
except ImportError:
from src.toolbox.modules.base import BaseModule, ModuleMetadata, ModuleResult, ModuleFinding
from src.toolbox.modules.base import BaseModule, ModuleMetadata, ModuleResult, ModuleFinding, FoundBy
logger = logging.getLogger(__name__)
@@ -217,11 +217,22 @@ class SecurityAnalyzer(BaseModule):
if self._is_false_positive_secret(match.group(0)):
continue
# Create FoundBy attribution
found_by = FoundBy(
module="security_analyzer",
tool_name="Security Analyzer",
tool_version="1.0.0",
type="tool"
)
findings.append(self.create_finding(
rule_id=f"hardcoded_{secret_type.lower().replace(' ', '_')}",
title=f"Hardcoded {secret_type} detected",
description=f"Found potential hardcoded {secret_type} in {file_path}",
severity="high" if "key" in secret_type.lower() else "medium",
category="hardcoded_secret",
found_by=found_by,
confidence="medium",
file_path=str(file_path),
line_start=line_num,
code_snippet=line_content.strip()[:100],
@@ -261,11 +272,23 @@ class SecurityAnalyzer(BaseModule):
line_num = content[:match.start()].count('\n') + 1
line_content = lines[line_num - 1] if line_num <= len(lines) else ""
# Create FoundBy attribution
found_by = FoundBy(
module="security_analyzer",
tool_name="Security Analyzer",
tool_version="1.0.0",
type="tool"
)
findings.append(self.create_finding(
rule_id=f"sql_injection_{vuln_type.lower().replace(' ', '_')}",
title=f"Potential SQL Injection: {vuln_type}",
description=f"Detected potential SQL injection vulnerability via {vuln_type}",
severity="high",
category="sql_injection",
found_by=found_by,
confidence="medium",
cwe="CWE-89",
file_path=str(file_path),
line_start=line_num,
code_snippet=line_content.strip()[:100],
@@ -323,11 +346,22 @@ class SecurityAnalyzer(BaseModule):
line_num = content[:match.start()].count('\n') + 1
line_content = lines[line_num - 1] if line_num <= len(lines) else ""
# Create FoundBy attribution
found_by = FoundBy(
module="security_analyzer",
tool_name="Security Analyzer",
tool_version="1.0.0",
type="tool"
)
findings.append(self.create_finding(
rule_id=f"dangerous_function_{func_name.replace('()', '').replace('.', '_')}",
title=f"Dangerous function: {func_name}",
description=f"Use of potentially dangerous function {func_name}: {risk_type}",
severity="medium",
category="dangerous_function",
found_by=found_by,
confidence="medium",
file_path=str(file_path),
line_start=line_num,
code_snippet=line_content.strip()[:100],