| """Canonical CWE registry shared by pipeline, Advisor, UI payloads, and tests.""" |
|
|
| from __future__ import annotations |
|
|
| from dataclasses import dataclass |
| from typing import Any |
|
|
|
|
| @dataclass(frozen=True) |
| class CwePatternMeta: |
| cwe_id: str |
| owasp_category: str |
| severity: str |
| weakness_family: str |
| evidence_type: str = "code_scan" |
|
|
|
|
| DEFAULT_PATTERN_META = CwePatternMeta( |
| cwe_id="CWE-unknown", |
| owasp_category="A03:2021-Injection", |
| severity="MEDIUM", |
| weakness_family="unknown", |
| ) |
|
|
| SEVERITY_RANK = {"CRITICAL": 4, "HIGH": 3, "MEDIUM": 2, "LOW": 1, "UNKNOWN": 0} |
|
|
|
|
| def _family_for_cwe(cwe_id: str) -> str: |
| family_by_cwe = { |
| "CWE-22": "path_traversal", |
| "CWE-78": "command_injection", |
| "CWE-79": "xss", |
| "CWE-89": "sql_injection", |
| "CWE-90": "ldap_injection", |
| "CWE-94": "code_injection", |
| "CWE-98": "file_inclusion", |
| "CWE-119": "memory_safety", |
| "CWE-120": "memory_safety", |
| "CWE-134": "format_string", |
| "CWE-190": "integer_overflow", |
| "CWE-248": "exception_handling", |
| "CWE-327": "weak_crypto", |
| "CWE-362": "race_condition", |
| "CWE-377": "temporary_file", |
| "CWE-415": "memory_safety", |
| "CWE-416": "memory_safety", |
| "CWE-434": "file_upload", |
| "CWE-476": "null_dereference", |
| "CWE-502": "unsafe_deserialization", |
| "CWE-611": "xxe", |
| "CWE-798": "hardcoded_secret", |
| "CWE-917": "expression_injection", |
| "CWE-918": "ssrf", |
| "CWE-943": "nosql_injection", |
| "CWE-1321": "prototype_pollution", |
| "CWE-1333": "redos", |
| "CWE-915": "mass_assignment", |
| } |
| return family_by_cwe.get(cwe_id, "code_weakness") |
|
|
|
|
| def _meta(cwe_id: str, owasp_category: str, severity: str) -> CwePatternMeta: |
| return CwePatternMeta( |
| cwe_id=cwe_id, |
| owasp_category=owasp_category, |
| severity=severity, |
| weakness_family=_family_for_cwe(cwe_id), |
| ) |
|
|
|
|
| PATTERN_CWE_REGISTRY: dict[str, CwePatternMeta] = { |
| "SQL_INJECTION": _meta("CWE-89", "A03:2021-Injection", "CRITICAL"), |
| "SQL_CONCAT": _meta("CWE-89", "A03:2021-Injection", "CRITICAL"), |
| "SQL_CONCAT_PHP": _meta("CWE-89", "A03:2021-Injection", "CRITICAL"), |
| "SQL_FORMAT_RUST": _meta("CWE-89", "A03:2021-Injection", "CRITICAL"), |
| "SQL_INJECT_CS": _meta("CWE-89", "A03:2021-Injection", "CRITICAL"), |
| "SQL_STATEMENT": _meta("CWE-89", "A03:2021-Injection", "CRITICAL"), |
| "TAINT_SUPERGLOBAL": _meta("CWE-89", "A03:2021-Injection", "HIGH"), |
| "CMD_INJECTION": _meta("CWE-78", "A03:2021-Injection", "CRITICAL"), |
| "COMMAND_INJECTION": _meta("CWE-78", "A03:2021-Injection", "CRITICAL"), |
| "CMD_RUST": _meta("CWE-78", "A03:2021-Injection", "CRITICAL"), |
| "FFI_SYSTEM": _meta("CWE-78", "A03:2021-Injection", "CRITICAL"), |
| "DANGEROUS_ALIAS_PY": _meta("CWE-78", "A03:2021-Injection", "CRITICAL"), |
| "SUBPROCESS_SHELL_ALIAS_PY": _meta("CWE-78", "A03:2021-Injection", "CRITICAL"), |
| "OPEN_PIPE": _meta("CWE-78", "A03:2021-Injection", "CRITICAL"), |
| "SHELL_EXEC": _meta("CWE-78", "A03:2021-Injection", "CRITICAL"), |
| "CHILD_PROCESS": _meta("CWE-78", "A03:2021-Injection", "CRITICAL"), |
| "CMD_INJECTION_CS": _meta("CWE-78", "A03:2021-Injection", "CRITICAL"), |
| "CMD_UNSAFE": _meta("CWE-78", "A03:2021-Injection", "CRITICAL"), |
| "CMD_PATTERN": _meta("CWE-78", "A03:2021-Injection", "HIGH"), |
| "INNERHTML_XSS": _meta("CWE-79", "A03:2021-Injection", "HIGH"), |
| "REFLECTED_XSS_JS": _meta("CWE-79", "A03:2021-Injection", "HIGH"), |
| "XSS": _meta("CWE-79", "A03:2021-Injection", "HIGH"), |
| "XSS_ECHO_PHP": _meta("CWE-79", "A03:2021-Injection", "HIGH"), |
| "XSS_CS": _meta("CWE-79", "A03:2021-Injection", "HIGH"), |
| "TEMPLATE_UNESCAPED": _meta("CWE-79", "A03:2021-Injection", "HIGH"), |
| "EVAL_EXEC": _meta("CWE-94", "A03:2021-Injection", "CRITICAL"), |
| "EVAL_USAGE": _meta("CWE-94", "A03:2021-Injection", "CRITICAL"), |
| "EVAL_INJECTION": _meta("CWE-94", "A03:2021-Injection", "CRITICAL"), |
| "CODE_INJECTION": _meta("CWE-94", "A03:2021-Injection", "CRITICAL"), |
| "FILE_INCLUDE": _meta("CWE-98", "A03:2021-Injection", "HIGH"), |
| "FILE_INCLUSION": _meta("CWE-98", "A03:2021-Injection", "HIGH"), |
| "SSRF_RISK": _meta("CWE-918", "A10:2021-Server-Side Request Forgery", "HIGH"), |
| "SSRF": _meta("CWE-918", "A10:2021-Server-Side Request Forgery", "HIGH"), |
| "SSRF_VARIABLE": _meta("CWE-918", "A10:2021-Server-Side Request Forgery", "HIGH"), |
| "SSRF_PHP": _meta("CWE-918", "A10:2021-Server-Side Request Forgery", "HIGH"), |
| "SSRF_GO": _meta("CWE-918", "A10:2021-Server-Side Request Forgery", "HIGH"), |
| "SSRF_JAVA": _meta("CWE-918", "A10:2021-Server-Side Request Forgery", "HIGH"), |
| "SSRF_JS": _meta("CWE-918", "A10:2021-Server-Side Request Forgery", "HIGH"), |
| "PICKLE_UNSAFE": _meta("CWE-502", "A08:2021-Software and Data Integrity", "CRITICAL"), |
| "YAML_UNSAFE": _meta("CWE-502", "A08:2021-Software and Data Integrity", "HIGH"), |
| "UNSERIALIZE_PHP": _meta("CWE-502", "A08:2021-Software and Data Integrity", "CRITICAL"), |
| "DESERIALIZATION": _meta("CWE-502", "A08:2021-Software and Data Integrity", "CRITICAL"), |
| "INSECURE_DESERIALIZATION": _meta("CWE-502", "A08:2021-Software and Data Integrity", "CRITICAL"), |
| "DESERIALIZE_UNSAFE": _meta("CWE-502", "A08:2021-Software and Data Integrity", "CRITICAL"), |
| "DESERIALIZE_UNSAFE_CS": _meta("CWE-502", "A08:2021-Software and Data Integrity", "CRITICAL"), |
| "HARDCODED_SECRET": _meta("CWE-798", "A07:2021-Identification and Authentication Failures", "HIGH"), |
| "HARDCODED_CREDENTIALS": _meta("CWE-798", "A07:2021-Identification and Authentication Failures", "HIGH"), |
| "PATH_TRAVERSAL": _meta("CWE-22", "A01:2021-Broken Access Control", "HIGH"), |
| "PATH_TRAVERSAL_PHP": _meta("CWE-22", "A01:2021-Broken Access Control", "HIGH"), |
| "PATH_TRAVERSAL_JAVA": _meta("CWE-22", "A01:2021-Broken Access Control", "HIGH"), |
| "PATH_TRAVERSAL_JS": _meta("CWE-22", "A01:2021-Broken Access Control", "HIGH"), |
| "PATH_TRAVERSAL_CS": _meta("CWE-22", "A01:2021-Broken Access Control", "HIGH"), |
| "XXE": _meta("CWE-611", "A05:2021-Security Misconfiguration", "HIGH"), |
| "XXE_ENTITY": _meta("CWE-611", "A05:2021-Security Misconfiguration", "HIGH"), |
| "XXE_FACTORY": _meta("CWE-611", "A05:2021-Security Misconfiguration", "HIGH"), |
| "XXE_PHP": _meta("CWE-611", "A05:2021-Security Misconfiguration", "HIGH"), |
| "XXE_CS": _meta("CWE-611", "A05:2021-Security Misconfiguration", "HIGH"), |
| "XXE_FAULT": _meta("CWE-611", "A05:2021-Security Misconfiguration", "HIGH"), |
| "LDAP_INJECTION": _meta("CWE-90", "A03:2021-Injection", "HIGH"), |
| "LDAP_INJECT_CS": _meta("CWE-90", "A03:2021-Injection", "HIGH"), |
| "PROTOTYPE_POLLUTION": _meta("CWE-1321", "A03:2021-Injection", "CRITICAL"), |
| "NOSQL_INJECTION": _meta("CWE-943", "A03:2021-Injection", "HIGH"), |
| "LOG4SHELL_JNDI": _meta("CWE-917", "A09:2021-Security Logging and Monitoring", "CRITICAL"), |
| "LOG_INJECTION_JAVA": _meta("CWE-917", "A09:2021-Security Logging and Monitoring", "CRITICAL"), |
| "BUFFER_OVERFLOW": _meta("CWE-120", "A06:2021-Vulnerable Components", "CRITICAL"), |
| "GETS_UNSAFE": _meta("CWE-242", "A06:2021-Vulnerable Components", "HIGH"), |
| "DOUBLE_FREE_C": _meta("CWE-415", "A06:2021-Vulnerable Components", "CRITICAL"), |
| "INTEGER_OVERFLOW_C": _meta("CWE-190", "A06:2021-Vulnerable Components", "HIGH"), |
| "TMPNAM_UNSAFE": _meta("CWE-377", "A06:2021-Vulnerable Components", "HIGH"), |
| "FORMAT_STRING": _meta("CWE-134", "A03:2021-Injection", "HIGH"), |
| "UNSAFE_BLOCK": _meta("CWE-119", "A06:2021-Vulnerable Components", "HIGH"), |
| "RAW_PTR": _meta("CWE-119", "A06:2021-Vulnerable Components", "HIGH"), |
| "RAW_PTR_WRITE_RUST": _meta("CWE-119", "A06:2021-Vulnerable Components", "CRITICAL"), |
| "OUT_OF_BOUNDS_PTR_RUST": _meta("CWE-119", "A06:2021-Vulnerable Components", "CRITICAL"), |
| "NULL_PTR_RUST": _meta("CWE-476", "A06:2021-Vulnerable Components", "HIGH"), |
| "NULL_DEREF_RUST": _meta("CWE-476", "A06:2021-Vulnerable Components", "HIGH"), |
| "USE_AFTER_FREE": _meta("CWE-416", "A06:2021-Vulnerable Components", "CRITICAL"), |
| "UAF_RUST": _meta("CWE-416", "A06:2021-Vulnerable Components", "CRITICAL"), |
| "UAF_RUST_DEREF": _meta("CWE-416", "A06:2021-Vulnerable Components", "CRITICAL"), |
| "UNWRAP_PANIC": _meta("CWE-248", "A05:2021-Security Misconfiguration", "MEDIUM"), |
| "UNTRUSTED_UNWRAP_RUST": _meta("CWE-248", "A05:2021-Security Misconfiguration", "HIGH"), |
| "UPLOAD_PHP": _meta("CWE-434", "A05:2021-Security Misconfiguration", "HIGH"), |
| "CRYPTO_WEAK": _meta("CWE-327", "A02:2021-Cryptographic Failures", "HIGH"), |
| "RACE_CONDITION_GO": _meta("CWE-362", "A04:2021-Insecure Design", "HIGH"), |
| "MASS_ASSIGNMENT_JS": _meta("CWE-915", "A01:2021-Broken Access Control", "HIGH"), |
| "REDOS_JS": _meta("CWE-1333", "A06:2021-Vulnerable Components", "MEDIUM"), |
| "REDOS": _meta("CWE-1333", "A06:2021-Vulnerable Components", "MEDIUM"), |
| } |
|
|
|
|
| def severity_rank(severity: str | None) -> int: |
| return SEVERITY_RANK.get(str(severity or "UNKNOWN").upper(), 0) |
|
|
|
|
| def get_pattern_meta(pattern_type: str | None) -> CwePatternMeta: |
| if not pattern_type: |
| return DEFAULT_PATTERN_META |
| return PATTERN_CWE_REGISTRY.get(str(pattern_type).upper(), DEFAULT_PATTERN_META) |
|
|
|
|
| def pattern_type_to_cwe(pattern_type: str | None) -> str | None: |
| meta = get_pattern_meta(pattern_type) |
| if meta.cwe_id == DEFAULT_PATTERN_META.cwe_id: |
| return None |
| return meta.cwe_id |
|
|
|
|
| def build_cwe_reference(cwe_id: str | None) -> dict[str, Any] | None: |
| if not cwe_id or not str(cwe_id).startswith("CWE-"): |
| return None |
| normalized = str(cwe_id).upper() |
| try: |
| from tools.cwe_database import get_cwe_info |
| except ImportError: |
| info = None |
| else: |
| info = get_cwe_info(normalized) |
|
|
| if not info: |
| return { |
| "id": normalized, |
| "name": normalized, |
| "source": "ThreatHunter CWE registry", |
| "nist_severity": "UNKNOWN", |
| "cvss_base": None, |
| "owasp_2021": "", |
| "cwe_url": f"https://cwe.mitre.org/data/definitions/{normalized.replace('CWE-', '')}.html", |
| "description": "", |
| "remediation_zh": "", |
| "representative_cves": [], |
| "disclaimer": ( |
| "代表性 CVE 為同類弱點的真實被利用案例，" |
| "非本程式碼的直接 CVE 識別碼。" |
| "用於說明此類弱點的風險嚴重性。" |
| ), |
| } |
|
|
| return { |
| "id": normalized, |
| "name": info.get("name", normalized), |
| "source": info.get("source", "MITRE CWE v4.14"), |
| "nist_severity": info.get("nist_severity", "UNKNOWN"), |
| "cvss_base": info.get("cvss_base", None), |
| "owasp_2021": info.get("owasp_2021", ""), |
| "cwe_url": info.get("cwe_url", f"https://cwe.mitre.org/data/definitions/{normalized.replace('CWE-', '')}.html"), |
| "description": info.get("description", "")[:300], |
| "remediation_zh": info.get("remediation_zh", info.get("remediation_en", "")), |
| "representative_cves": info.get("representative_cves", [])[:3], |
| "disclaimer": ( |
| "代表性 CVE 為同類弱點的真實被利用案例，" |
| "非本程式碼的直接 CVE 識別碼。" |
| "用於說明此類弱點的風險嚴重性。" |
| ), |
| } |
|
|
|
|
| def registry_snapshot() -> dict[str, dict[str, str]]: |
| return { |
| pattern_type: { |
| "cwe_id": meta.cwe_id, |
| "owasp_category": meta.owasp_category, |
| "severity": meta.severity, |
| "weakness_family": meta.weakness_family, |
| "evidence_type": meta.evidence_type, |
| } |
| for pattern_type, meta in sorted(PATTERN_CWE_REGISTRY.items()) |
| } |
|
|
