
    Pih.                         d Z ddlZddlZddlZddlZddlZddlmZ ddlm	Z	m
Z
mZmZ  G d d      Zd Zedk(  r e        yy)	u  
Red Team Auto Review - 보안 취약점 분석 및 리스크 평가 도구

Usage:
    python3 memory/red-team-auto-review.py scan <파일경로>     # 전체 보안 검사
    python3 memory/red-team-auto-review.py vuln <파일경로>     # 취약점만 검사
    python3 memory/red-team-auto-review.py deps <파일경로>     # 의존성 검사
    python3 memory/red-team-auto-review.py risk <파일경로>     # 리스크 평가
    N)Path)AnyDictListOptionalc                       e Zd ZdZg dg dg dg dg dg dg dZd	d
dddZdefdZdefdZ	de
eef   fdZdedefdZde
eef   fdZdedefdZde
eef   fdZdedefdZde
eef   fdZy)RedTeamRevieweru6   보안 취약점 분석 및 리스크 평가 클래스)z(execute\s*\(\s*[\"'].*%s.*[\"']\s*%\s*\(zcursor\.execute\s*\(\s*f[\"']z\.raw\s*\(\s*[\"'].*\+.*[\"']zSELECT.*FROM.*WHERE.*\+)zinnerHTML\s*=zdocument\.write\s*\(z\.html\s*\(\s*[^\"']zrender_template_string\s*\()z password\s*=\s*[\"'][^\"']+[\"']zapi_key\s*=\s*[\"'][^\"']+[\"']zsecret\s*=\s*[\"'][^\"']+[\"']ztoken\s*=\s*[\"'][^\"']+[\"']z!private_key\s*=\s*[\"']-----BEGIN)	eval\s*\(z	exec\s*\(zcompile\s*\(z__import__\s*\()z\.\./z\.\.\\zos\.path\.join\s*\([^)]*\+)zos\.system\s*\(z*subprocess\.call\s*\([^)]*shell\s*=\s*Truez+subprocess\.Popen\s*\([^)]*shell\s*=\s*Truer
   zSQL InjectionzXSS (Cross-Site Scripting)zHardcoded SecretzCode InjectionzPath TraversalzCommand InjectionInsecure Dependenciesr            lowmediumhighcritical	file_pathc                 \    t        |      | _        d| _        g | _        g | _        d| _        y)u	   초기화 r   N)r   r   contentvulnerabilitiesdependency_issues
risk_level)selfr   s     L/home/jay/workspace/.worktrees/task-2117-dev1/memory/red-team-auto-review.py__init__zRedTeamReviewer.__init__D   s+    i!!#    returnc           	         	 | j                   j                         s/t        t        j                  d| j                    dd             yt        | j                   dd      5 }|j                         | _        ddd       y	# 1 sw Y   y	xY w# t        $ r7}t        t        j                  d
t        |       dd             Y d}~yd}~ww xY w)u   파일 로드zFile not found: unknown)errorr   Frzutf-8)encodingNTzFailed to read file: )
r   existsprintjsondumpsopenreadr   	Exceptionstr)r   fes      r   	load_filezRedTeamReviewer.load_fileL   s    
	>>((*djj-=dnn=M+N^g!hijdnncG< ( vvx(( 	$**)>s1vh'GW`abc	s<   AB B #B9B BB B 	C-C		Cc                    | j                         sg ddS g }| j                  j                         D ]  \  }}|dk(  r|D ]  }t        j                  || j
                  t        j                  t        j                  z        }|D ]  }| j
                  d|j                          j                  d      dz   }| j
                  j                  d      |dz
     }|j                         }	|	j                  d      s|	j                  d      r|j                  |||j                         dd	 | j                  |      d
          || _        |t!        |      dS )u   코드 취약점 스캔r"   )r   r   r   N
r   #z//d   )typelinesnippetseverity)r   count)r0   VULNERABILITY_PATTERNSitemsrefinditerr   
IGNORECASE	MULTILINEstartr9   splitstrip
startswithappend_get_severityr   len)
r   found_vulnerabilities	vuln_typepatternspatternmatchesmatchline_numr6   strippeds
             r   scan_vulnerabilitiesz$RedTeamReviewer.scan_vulnerabilitiesZ   sM   ~~')CC "#'#>#>#D#D#F 	Ix33# ++gt||R]]R\\=YZ$ E#||Oekkm<BB4H1LH<<--d3HqLAD  $zz|H**3/83F3Ft3L )00$-$,'+zz|DS'9(,(:(:9(E			2  5#83G\C]^^r   rH   c                 :    dddddddd}|j                  |d      S )u   취약점 심각도 반환r   r   r   r   r   get)r   rH   severity_maps      r   rE   zRedTeamReviewer._get_severity}   s5     $*2 &(&!+%-
 	511r   c           	      <   dg dd}| j                   j                  j                         }d| j                   j                  j                         v s|dk(  r;d|d<   | j	                  d      r	 t        j                  dd	t        | j                         d
dgddd      }|j                  dk7  r^|j                  rRt        j                  |j                        }t        |j                  dg             |d<   |j                  dg       |d<   n_| j                         rN| j                   j#                  d      D cg c]5  }|j%                         s|j'                  d      r&|j%                         7 }}|dd D cg c]  }|dd	 c}|d<   n|dk(  rd| j                   j                  j                         v rd|d<   | j	                  d      r	 t        j                  g ddddt        | j                   j(                              }|j                  rTt        j                  |j                        }|j                  di       j                  di       j                  dd      |d<   || _        |S # t        $ r Y w xY wc c}w c c}w # t        $ r Y -w xY w)u   의존성 취약점 검사r   N)vulnerable_depsdependencies	tool_usedrequirementsz.txtzpip-audit (simulated)rW   z	pip-auditz-rz--formatr(   T   )capture_outputtexttimeoutr   rU   rV   r2   r3      r"   )namestatusz.jsonpackageznpm audit (simulated)npm)ra   auditz--json)rZ   r[   r\   cwdmetadatatotal)r   suffixlowerr^   _check_tool_available
subprocessrunr-   
returncodestdoutr(   loadsrF   rR   r,   r0   r   rA   rB   rC   parentr   )r   resultsfile_extoutputaudit_resultsr6   depsdeps           r   check_dependenciesz"RedTeamReviewer.check_dependencies   sr   &'$O>>((..0 T^^006688H<N#:GK ))+6'^^$dC,?VT'+! "	F ((A-&--(,

6==(A589J9JK\^`9a5b 122?2C2CDUWY2Z/
 >>#151C1CD1I)-TZZ\bfbqbqrubv

D  ^bbdcd]e.fVYy/Q.fGN+  Y$..2E2E2K2K2M%M#:GK ))%0'^^2'+! " 5 56F }}(,

6==(A)--j"=AABSUWX\\]dfgh   12 ")? ! 
 /g& ! s>   .BI6 <JJ$J?J
BJ 6	JJ	JJtoolc                 X    	 t        j                  d|gdd       y# t        $ r Y yw xY w)u)   외부 도구 사용 가능 여부 확인whichTr]   )rZ   r\   F)ri   rj   r,   )r   rv   s     r   rh   z%RedTeamReviewer._check_tool_available   s0    	NNGT?4K 		s    	))c                    d}ddddd}| j                   D ]<  }|j                  dd      }|j                  |d      |j                  |d      kD  s;|}> | j                  j                  dd      dkD  r|dk(  rd	}t        | j                         }|d
kD  r|d	k(  rd}n|dkD  r|dk(  rd}|| _        ||| j                  j                  dd      | j                  |      dS )u   전체 리스크 평가r   r   r   r   r   r   r8   rU   r   r]   r   
   r   )r   vulnerability_countr   recommendation)r   rR   r   rF   r   _get_recommendation)r   max_severityseverity_scoresvulnvuln_severity
vuln_counts         r   assess_riskzRedTeamReviewer.assess_risk   s    "#q!K(( 	-D HHZ7M""=!47J7J<YZ7[[,	- !!%%&7;a?u$' --.
>lh6!L"_!7%L& '#-!%!7!7!;!;<Mq!Q"66|D	
 	
r   r   c                 4    ddddd}|j                  |d      S )u    리스크 레벨별 권장사항u$   낮은 위험 - 현재 수준 유지u   중간 위험 - 수정 권장u$   높은 위험 - 즉시 수정 필요u2   심각한 위험 - 즉시 중단 및 수정 필요r   u   알 수 없음rQ   )r   r   recommendationss      r   r}   z#RedTeamReviewer._get_recommendation   s-     :5:L	
 "":/?@@r   c                     | j                         }| j                         }| j                         }t        | j                        |d   |d   |d   |d   |d   |d   dv dS )u   전체 보안 검사r   r   r9   rU   r|   )r   r   )filer   r   r{   r   r|   passed)rO   ru   r   r-   r   )r   vuln_resultdeps_resultrisk_results       r   scan_securityzRedTeamReviewer.scan_security   s     //1 --/ &&( '%l3*+<=#.w#7!,->!?)*:;!,/3DD
 	
r   N)__name__
__module____qualname____doc__r:   RISK_LEVELSr-   r   boolr0   r   r   rO   rE   ru   rh   r   r}   r    r   r   r	   r	      s    @
'





 "$K&R q!CK #  4 !_d38n !_F2s 2s 25DcN 5n# $ 
T#s(^ 
@Ac Ac A
tCH~ 
r   r	   c                      t        t        j                        dk  r8t        t	        j
                  dg dd             t        j                  d       t        j                  d   } t        j                  d   }t        |      }| dk(  r|j                         }n| dk(  r'|j                         }|j                         d	   |d	<   n| d
k(  r |j                         }|d   dk(  rdnd|d	<   nq| dk(  r1|j                          |j                          |j                         }n;t        t	        j
                  d|  g dd             t        j                  d       t        t	        j
                  dd             y)u   메인 함수r   z7Usage: python3 red-team-auto-review.py <command> <file>)scanr   rs   risk)r#   commandsr   r   r   r   r   rs   rU   r   r   r   r   zUnknown command: F)indentensure_asciiN)rF   sysargvr'   r(   r)   exitr	   r   rO   r   ru   )commandr   reviewerresults       r   mainr   	  sB   
388}qJJV @	
 	hhqkGIy)H&'')	F	..0'335lC|	F	,,.(./@(AQ(FuH|	F	%%'##%%%'djj%6wi#@Nnopq	$**VAE
:;r   __main__)r   r(   osr<   ri   r   pathlibr   typingr   r   r   r   r	   r   r   r   r   r   <module>r      sK     	 	  
  , ,q
 q
h"<J zF r   