126 lines
3.9 KiB
Rust
126 lines
3.9 KiB
Rust
//! C5 example 2 — exploratory (not a committed regression test). Four topically
|
|
//! distinct findings, to see whether tuned semantic retrieval maps each to the
|
|
//! right master-control family. Run:
|
|
//! export ... (LITELLM_* + BREAKPILOT_BASE_URL)
|
|
//! cargo test -p compliance-agent --test c5_example2 -- --ignored --nocapture
|
|
|
|
mod common;
|
|
|
|
use std::sync::Arc;
|
|
|
|
use compliance_agent::llm::LlmClient;
|
|
use compliance_core::config::BreakpilotConfig;
|
|
use compliance_core::models::finding::{Finding, Severity};
|
|
use compliance_core::models::scan::ScanType;
|
|
use secrecy::SecretString;
|
|
|
|
fn env(k: &str) -> String {
|
|
std::env::var(k).unwrap_or_else(|_| panic!("env {k} must be set"))
|
|
}
|
|
|
|
fn mk(file: &str, line: u32, title: &str, desc: &str) -> Finding {
|
|
let mut f = Finding::new(
|
|
"repo-c5b".into(),
|
|
format!("{file}:{line}"),
|
|
"semgrep".into(),
|
|
ScanType::Sast,
|
|
title.into(),
|
|
desc.into(),
|
|
Severity::High,
|
|
);
|
|
f.file_path = Some(file.into());
|
|
f.line_number = Some(line);
|
|
f
|
|
}
|
|
|
|
fn write(repo: &std::path::Path, rel: &str, body: &str) {
|
|
let p = repo.join(rel);
|
|
if let Some(parent) = p.parent() {
|
|
std::fs::create_dir_all(parent).unwrap();
|
|
}
|
|
std::fs::write(p, body).unwrap();
|
|
}
|
|
|
|
#[tokio::test]
|
|
#[ignore = "live: api-dev + LiteLLM"]
|
|
async fn c5b_varied_findings() {
|
|
let llm = Arc::new(LlmClient::new(
|
|
env("LITELLM_URL"),
|
|
SecretString::from(env("LITELLM_API_KEY")),
|
|
env("LITELLM_MODEL"),
|
|
env("LITELLM_EMBED_MODEL"),
|
|
));
|
|
let mut config = common::dev_config("mongodb://unused".into(), "c5b".into());
|
|
config.breakpilot = BreakpilotConfig {
|
|
base_url: Some(env("BREAKPILOT_BASE_URL")),
|
|
token: None,
|
|
snapshot_dir: std::env::temp_dir()
|
|
.join("c5-oscal-snap")
|
|
.to_string_lossy()
|
|
.into_owned(),
|
|
semantic_mapping: true,
|
|
grounded_control_checks: false,
|
|
};
|
|
|
|
let repo = std::env::temp_dir().join("c5b-fixture-repo");
|
|
let _ = std::fs::remove_dir_all(&repo);
|
|
write(
|
|
&repo,
|
|
"app/db.py",
|
|
"import sqlite3\n\ndef get_user(username):\n q = \"SELECT * FROM users WHERE name = '\" + username + \"'\"\n return conn.execute(q)\n",
|
|
);
|
|
write(
|
|
&repo,
|
|
"app/config.py",
|
|
"# service config\nAPI_KEY = \"sk_live_51H8xYz3kQ9v2bNmR7wT4uSpQ\"\nDB_HOST = \"db.internal\"\n",
|
|
);
|
|
write(
|
|
&repo,
|
|
"app/net.py",
|
|
"import requests\n\ndef fetch(url):\n return requests.get(url, verify=False, timeout=5)\n",
|
|
);
|
|
write(
|
|
&repo,
|
|
"app/ser.py",
|
|
"import pickle\n\ndef load_state(blob):\n return pickle.loads(blob)\n",
|
|
);
|
|
|
|
let mut findings = vec![
|
|
mk(
|
|
"app/db.py",
|
|
4,
|
|
"SQL injection via string-concatenated query",
|
|
"User input is concatenated directly into a SQL statement, allowing SQL injection.",
|
|
),
|
|
mk(
|
|
"app/config.py",
|
|
2,
|
|
"Hardcoded API credential in source",
|
|
"A live API key is hardcoded in source code instead of a secret store.",
|
|
),
|
|
mk(
|
|
"app/net.py",
|
|
4,
|
|
"TLS certificate verification disabled",
|
|
"requests is called with verify=False, disabling TLS certificate validation.",
|
|
),
|
|
mk(
|
|
"app/ser.py",
|
|
3,
|
|
"Insecure deserialization with pickle.loads",
|
|
"Untrusted data is deserialized with pickle.loads, allowing remote code execution.",
|
|
),
|
|
];
|
|
|
|
let tagged =
|
|
compliance_agent::controls::semantic_stamp_findings(&config, llm, &repo, &mut findings)
|
|
.await;
|
|
println!("\n=== C5 example 2: varied findings ===");
|
|
for f in &findings {
|
|
println!(" {:52} -> {:?}", f.title, f.control_refs);
|
|
}
|
|
println!("tagged: {tagged}/4");
|
|
let _ = std::fs::remove_dir_all(&repo);
|
|
assert!(tagged >= 1);
|
|
}
|