⚡ XecureX

开源源代码安全审计工具
检测硬编码的 secrets、SQL 注入、XSS、命令注入、弱加密等。

功能 • 快速开始 • CLI • 输出 • 开发 • 所有规则

## 功能 | 能力 | 详情 | |------------|---------| | **基于 AST 的分析** | Python `ast` 模块 — 精准且具备上下文感知 | | **66+ 种检测模式** | 9 大类别：CRED, INJECT, XSS, CRYPTO, DESERN, PATH, EXPOSE, HARDCODE, DEP | | **注释感知** | 忽略注释和 docstring 中的代码 | | **置信度评分** | 每个发现评级为 0.0–1.0 | | **多语言支持** | Python, JS, TS, Java, Go, PHP, Ruby, C#, Shell, SQL | | **适配 CI/CD** | JSON 输出、退出码、Docker、GitHub Actions | | **可配置** | 严重性过滤、置信度阈值、自定义排除项 | ## 快速开始 ``` # 安装 git clone https://github.com/s1d9e/xecurex.git && cd xecurex pip install -e . # 扫描 xecurex /path/to/repo # JSON 报告 xecurex /path/to/repo --format json -o report.json # 仅 HIGH 严重性 xecurex /path/to/repo --min-severity high ``` ## CLI ``` xecurex [OPTIONS] PATH ``` | 参数 | 描述 | 默认值 | |------|-------------|---------| | `--format {text,json}` | 输出格式 | `text` | | `-o, --output FILE` | 保存到文件 | stdout | | `--min-severity {low,medium,high}` | 按严重性过滤 | `low` | | `--exclude DIR ...` | 排除目录 | — | | `--no-ast` | 禁用 Python AST（仅使用 regex） | off | | `--min-confidence FLOAT` | 最低置信度 0.0–1.0 | `0.3` | | `-v, --verbose` | 显示扫描进度 | off | | `--version` | 显示版本 | — | | 退出码 | 含义 | |-----------|---------| | `0` | 未发现问题 | | `1` | 检测到问题 | | `2` | 错误 | ## 输出 ``` ====================================================================== SECURITY AUDIT REPORT ====================================================================== Files scanned: 42 Lines scanned: 1583 Scan duration: 0.12s Found 5 potential security issues: HIGH: 2 MEDIUM: 2 LOW: 1 !!! HIGH Severity (2) -------------------------------------------------- src/auth.py:15 [CRED-001] Hardcoded password detected Confidence: [#########.]. (90%) Code: password = "supersecret123" ! MEDIUM Severity (2) -------------------------------------------------- frontend/app.js:23 [XSS-001] Dangerous innerHTML assignment Confidence: [########..]. (80%) Code: .innerHTML = userInput i LOW Severity (1) -------------------------------------------------- src/config.py:5 [HARDCODE-002] Insecure HTTP URL Confidence: [######....]. (60%) Code: http://api.example.com/v1/users ``` ### JSON ``` { "stats": { "files_scanned": 42, "lines_scanned": 1583 }, "findings": [ { "file": "src/auth.py", "line": 15, "category": "Hardcoded Credentials", "severity": "HIGH", "rule_id": "CRED-001", "confidence": 0.9, "match": "password = \"supersecret123\"" } ], "summary": { "total": 5, "high": 2, "medium": 2, "low": 1 } } ``` ## 配置 创建 `xecurex.toml` 或添加到 `pyproject.toml`： ``` [xecurex] exclude_dirs = ["test_data", "fixtures"] min_severity = "medium" use_ast = true confidence_threshold = 0.5 ``` CLI 参数会覆盖文件配置。 ## Docker ``` docker build -t xecurex . docker run --rm -v /path/to/repo:/repo xecurex /repo ``` ## 开发 ``` make install # Install dev dependencies make test # Run tests with coverage make lint # Lint (ruff) make format # Format (ruff) make scan # Scan self ``` ## 项目结构 ``` src/xecurex/ ├── cli.py # CLI entry point ├── scanner.py # Scan orchestration ├── reporter.py # Text + JSON reports ├── models.py # Finding, ScanResult dataclasses ├── config.py # Configuration ├── rules/ # 9 rule categories (66+ patterns) │ ├── base.py # Abstract Rule class │ ├── credentials.py # CRED │ ├── injection.py # INJECT │ ├── xss.py # XSS │ ├── crypto.py # CRYPTO │ ├── deserialization.py # DESERN │ ├── path_traversal.py # PATH │ ├── data_exposure.py # EXPOSE │ ├── hardcoded.py # HARDCODE │ └── dependencies.py # DEP └── analyzers/ ├── generic_analyzer.py # Regex (all languages) └── python_analyzer.py # AST (Python) ``` ## License MIT — 见 [LICENSE](LICENSE) ## 免责声明

由 s1d9e 构建

标签：CISA项目, DevSecOps, LNA, Python, SAST, StruQ, 上游代理, 无后门, 盲注攻击, 请求拦截, 逆向工具, 错误基检测, 静态代码分析