From 3b9ad5c846bdcae7fe54b6ac7bda8aa972372cdb Mon Sep 17 00:00:00 2001
From: Alexandre Dulaunoy <a@foo.be>
Date: Fri, 15 Nov 2019 07:39:19 +0100
Subject: [PATCH] add: [pattern selection] regexp pattern can now be selected -
 3 default patterns

A new option -p has been added to select the pattern to use.

-p P        Matching pattern to use: [vulnpatterns, cryptopatterns,
              cpatterns]

The 3 default patterns are the following:

 - A generic "vulnpatterns" which contain mainly web vulnerability and
 common vulnerability messages including CVE numbers.
 - A specific "cryptopatterns" to match potential vulnerabilities
 matching cryptographic functionalities
 - A specific "cpatterns" to match common vulnerabilities in C/C++-like
language.

cryptopatterns and cpatterns still need some more work.
---
 bin/finder.py | 24 ++++++++++++++++++++----
 1 file changed, 20 insertions(+), 4 deletions(-)

diff --git a/bin/finder.py b/bin/finder.py
index 1b49d89..75cd919 100644
--- a/bin/finder.py
+++ b/bin/finder.py
@@ -21,10 +21,25 @@ parser.add_argument("-v", help="increase output verbosity", action="store_true")
 parser.add_argument("-r", type=str, help="git repository to analyse")
 parser.add_argument("-o", type=str, help="Output format: [json]", default="json")
 parser.add_argument("-s", type=str, help="State of the commit found", default="under-review")
+parser.add_argument("-p", type=str, help="Matching pattern to use: [vulnpatterns, cryptopatterns, cpatterns]", default="vulnpatterns")
 args = parser.parse_args()
 
 vulnpatterns = re.compile("(?i)(denial of service |\bXXE\b|remote code execution|\bopen redirect|OSVDB|\bvuln|\bCVE\b |\bXSS\b|\bReDoS\b|\bNVD\b|malicious|x−frame−options|attack|cross site |exploit|malicious|directory traversal |\bRCE\b|\bdos\b|\bXSRF \b|\bXSS\b|clickjack|session.fixation|hijack|\badvisory|\binsecure |security |\bcross−origin\b|unauthori[z|s]ed |infinite loop)")
 
+cryptopatterns = re.compile("(?i)(weak algorithm|weak cipher|weak entropy| weak crypto|lack of entropy)")
+
+cpatterns = re.compile("(?i)(double[-| ]free|buffer overflow|double free|race[-| ]condition)")
+
+if args.p == "vulnpatterns":
+    defaultpattern = vulnpatterns
+elif args.p == "cryptopatterns":
+    defaultpattern = cryptopatterns
+elif args.p == "cpatterns":
+    defaultpattern = cpatterns
+else:
+    parser.print_usage()
+    parser.exit()
+
 if not args.r:
     parser.print_usage()
     parser.exit()
@@ -36,8 +51,8 @@ found = 0
 potential_vulnerabilities = {}
 
 
-def find_vuln(commit):
-    m = vulnpatterns.search(commit.message)
+def find_vuln(commit, pattern=vulnpatterns):
+    m = pattern.search(commit.message)
     if m:
         if args.v:
             print("Match found: {}".format(m.group(0)), file=sys.stderr)
@@ -53,16 +68,16 @@ def find_vuln(commit):
         # print("Nothing match")
 
 
+
 repo_heads = repo.heads
 repo_heads_names = [h.name for h in repo_heads]
 print(repo_heads_names, file=sys.stderr)
 
-
 for branch in repo_heads_names:
     commits = list(repo.iter_commits(branch))
 
     for commit in commits:
-        ret = find_vuln(commit)
+        ret = find_vuln(commit, pattern=defaultpattern)
         if ret:
             #print("Vulnerability found: {}".format(ret))
             #print(ret.hexsha)
@@ -82,6 +97,7 @@ for branch in repo_heads_names:
                 potential_vulnerabilities[rcommit.hexsha]['committed_date'] = rcommit.committed_date
                 potential_vulnerabilities[rcommit.hexsha]['branches'] = []
                 potential_vulnerabilities[rcommit.hexsha]['branches'].append(branch)
+                potential_vulnerabilities[rcommit.hexsha]['pattern-selected'] = args.p
                 potential_vulnerabilities[rcommit.hexsha]['pattern-matches'] = ret['match']
                 potential_vulnerabilities[rcommit.hexsha]['state'] = args.s
                 found += 1