- API: add `POST /api/analyze_script` (app/blueprints/api.py)
- Fetch one external script to artifacts, run rules, return findings + snippet
- Uses new ExternalScriptFetcher (results_path aware) and job UUID
- Returns: { ok, final_url, status_code, bytes, truncated, sha256, artifact_path, findings[], snippet, snippet_len }
- TODO: document in openapi/openapi.yaml
- Fetcher: update `app/utils/external_fetch.py`
- Constructed with `results_path` (UUID dir); writes to `<results_path>/scripts/fetched/<index>.js`
- Loads settings via `get_settings()`, logs via std logging
- UI (results.html):
- Move “Analyze external script” action into **Content Snippet** column for external rows
- Clicking replaces button with `<details>` snippet, shows rule matches, and adds “open in viewer” link
- Robust fetch handler (checks JSON, shows errors); builds viewer URL from absolute artifact path
- Viewer:
- New route: `GET /view/artifact/<run_uuid>/<path:filename>` (app/blueprints/ui.py)
- New template: Monaco-based read-only code viewer (viewer.html)
- Removes SRI on loader to avoid integrity block; loads file via `raw_url` and detects language by extension
- Forms:
- Refactor `analyze_forms` to mirror scripts analysis:
- Uses rule engine (`category == "form"`) across regex/function rules
- Emits rows only when matches exist
- Includes `content_snippet`, `action`, `method`, `inputs`, `rules`
- Replace legacy plumbing (`flagged`, `flag_reasons`, `status`) in output
- Normalize form function rules to canonical returns `(bool, Optional[str])`:
- `form_action_missing`
- `form_http_on_https_page`
- `form_submits_to_different_host`
- Add minor hardening (lowercasing hosts, no-op actions, clearer reasons)
- CSS: add `.forms-table` to mirror `.scripts-table` (5 columns)
- Fixed table layout, widths per column, chip/snippet styling, responsive tweaks
- Misc:
- Fix “working outside app context” issue by avoiding `current_app` at import time (left storage logic inside routes)
- Add “View Source” link to open page source in viewer
Refs:
- Roadmap: mark “Source code viewer” done; keep TODO to add `/api/analyze_script` to OpenAPI
158 lines
4.7 KiB
Python
158 lines
4.7 KiB
Python
#
|
|
# Note the settings file is hardcoded in this class at the top after imports.
|
|
#
|
|
# To make a new settings section, just add the setting dict to your yaml
|
|
# and then define the data class below in the config data classes area.
|
|
#
|
|
# Example use from anywhere - this will always return the same singleton
|
|
# from settings import get_settings
|
|
# def main():
|
|
# settings = get_settings()
|
|
# print(settings.database.host) # Autocomplete works
|
|
# print(settings.logging.level)
|
|
|
|
# if __name__ == "__main__":
|
|
# main()
|
|
|
|
import functools
|
|
from pathlib import Path
|
|
from typing import Any, Callable, TypeVar
|
|
from dataclasses import dataclass, fields, is_dataclass, field, MISSING
|
|
|
|
import logging
|
|
import sys
|
|
logger = logging.getLogger(__file__)
|
|
|
|
try:
|
|
import yaml
|
|
except ModuleNotFoundError:
|
|
msg = (
|
|
"Required modules are not installed. "
|
|
"Can not continue with module / application loading.\n"
|
|
"Install it with: pip install -r requirements"
|
|
)
|
|
print(msg, file=sys.stderr)
|
|
logger.error(msg)
|
|
exit()
|
|
|
|
BASE_DIR = Path(__file__).resolve().parent.parent
|
|
DEFAULT_SETTINGS_FILE = BASE_DIR / "config" / "settings.yaml"
|
|
|
|
# ---------- CONFIG DATA CLASSES ----------
|
|
@dataclass
|
|
class External_FetchConfig:
|
|
enabled: bool = True
|
|
max_total_mb: int = 5
|
|
max_time_ms: int = 3000
|
|
max_redirects: int = 3
|
|
concurrency: int = 3
|
|
|
|
@dataclass
|
|
class UIConfig:
|
|
snippet_preview_len: int = 160
|
|
|
|
@dataclass
|
|
class Cache_Config:
|
|
whois_cache_days: int = 7
|
|
geoip_cache_days: int = 7
|
|
recent_runs_count: int = 10
|
|
|
|
|
|
@dataclass
|
|
class AppConfig:
|
|
name: str = "MyApp"
|
|
version_major: int = 1
|
|
version_minor: int = 0
|
|
|
|
|
|
@dataclass
|
|
class Settings:
|
|
cache: Cache_Config = field(default_factory=Cache_Config)
|
|
ui: UIConfig = field(default_factory=UIConfig)
|
|
external_fetch: External_FetchConfig = field(default_factory=External_FetchConfig)
|
|
app: AppConfig = field(default_factory=AppConfig)
|
|
|
|
@classmethod
|
|
def from_yaml(cls, path: str | Path) -> "Settings":
|
|
try:
|
|
"""Load settings from YAML file into a Settings object."""
|
|
with open(path, "r", encoding="utf-8") as f:
|
|
raw: dict[str, Any] = yaml.safe_load(f) or {}
|
|
except FileNotFoundError:
|
|
logger.warning(f"Settings file {path} not found! Using default settings.")
|
|
raw = {}
|
|
|
|
init_kwargs = {}
|
|
for f_def in fields(cls):
|
|
yaml_value = raw.get(f_def.name, None)
|
|
|
|
# Determine default value from default_factory or default
|
|
if f_def.default_factory is not MISSING:
|
|
default_value = f_def.default_factory()
|
|
elif f_def.default is not MISSING:
|
|
default_value = f_def.default
|
|
else:
|
|
default_value = None
|
|
|
|
# Handle nested dataclasses
|
|
if is_dataclass(f_def.type):
|
|
if isinstance(yaml_value, dict):
|
|
# Merge YAML values with defaults
|
|
merged_data = {fld.name: getattr(default_value, fld.name) for fld in fields(f_def.type)}
|
|
merged_data.update(yaml_value)
|
|
init_kwargs[f_def.name] = f_def.type(**merged_data)
|
|
else:
|
|
init_kwargs[f_def.name] = default_value
|
|
else:
|
|
init_kwargs[f_def.name] = yaml_value if yaml_value is not None else default_value
|
|
|
|
return cls(**init_kwargs)
|
|
|
|
|
|
# ---------- SINGLETON DECORATOR ----------
|
|
T = TypeVar("T")
|
|
|
|
def singleton_loader(func: Callable[..., T]) -> Callable[..., T]:
|
|
"""Ensure the function only runs once, returning the cached value."""
|
|
cache: dict[str, T] = {}
|
|
|
|
@functools.wraps(func)
|
|
def wrapper(*args, **kwargs) -> T:
|
|
if func.__name__ not in cache:
|
|
cache[func.__name__] = func(*args, **kwargs)
|
|
return cache[func.__name__]
|
|
|
|
return wrapper
|
|
|
|
|
|
# ---------- SINGLETON DECORATOR ----------
|
|
T = TypeVar("T")
|
|
|
|
def singleton_loader(func: Callable[..., T]) -> Callable[..., T]:
|
|
"""Decorator to ensure the settings are loaded only once."""
|
|
cache: dict[str, T] = {}
|
|
|
|
@functools.wraps(func)
|
|
def wrapper(*args, **kwargs) -> T:
|
|
if func.__name__ not in cache:
|
|
cache[func.__name__] = func(*args, **kwargs)
|
|
return cache[func.__name__]
|
|
|
|
return wrapper
|
|
|
|
|
|
@singleton_loader
|
|
def get_settings(config_path: str | Path | None = None) -> Settings:
|
|
"""
|
|
Returns the singleton Settings instance.
|
|
|
|
Args:
|
|
config_path: Optional path to the YAML config file. If not provided,
|
|
defaults to 'config/settings.yaml' in the current working directory.
|
|
"""
|
|
if config_path is None:
|
|
config_path = DEFAULT_SETTINGS_FILE
|
|
else:
|
|
config_path = Path(config_path)
|
|
|
|
return Settings.from_yaml(config_path) |