mira-consciousness
Version:
Memory & Intelligence Retention Archive - Preserving The Spark
216 lines • 9.69 kB
JavaScript
/**
* Security Analyzer Orchestrator
* Coordinates all security analysis modules
*/
import { SecretScanner } from './SecretScanner.js';
import { DependencyScanner } from './DependencyScanner.js';
import { OWASPAnalyzer } from './OWASPAnalyzer.js';
export class SecurityAnalyzer {
projectRoot;
secretScanner;
dependencyScanner;
owaspAnalyzer;
constructor(projectRoot) {
this.projectRoot = projectRoot;
this.secretScanner = new SecretScanner(projectRoot);
this.dependencyScanner = new DependencyScanner(projectRoot);
this.owaspAnalyzer = new OWASPAnalyzer(projectRoot);
}
async quickScan() {
const vulnerabilities = [];
// Quick scan with basic checks
await Promise.all([
this.dependencyScanner.scan(vulnerabilities),
this.secretScanner.scan(vulnerabilities)
]);
const criticalIssues = vulnerabilities.filter(v => v.severity === 'critical').length;
return {
issues: vulnerabilities.length,
criticalIssues,
vulnerabilities,
securityScore: criticalIssues > 0 ? 20 : vulnerabilities.length > 10 ? 40 : 80,
riskLevel: criticalIssues > 0 ? 'critical' : vulnerabilities.length > 5 ? 'high' : 'medium',
recommendations: []
};
}
async fullAnalysis() {
const vulnerabilities = [];
// Comprehensive security analysis
await Promise.all([
this.secretScanner.scan(vulnerabilities),
this.dependencyScanner.scan(vulnerabilities),
this.owaspAnalyzer.analyze(vulnerabilities)
]);
// NPM Audit integration
const npmAuditSummary = await this.dependencyScanner.runNpmAudit(vulnerabilities);
// OWASP compliance analysis
const owaspCompliance = await this.owaspAnalyzer.analyzeCompliance(vulnerabilities);
// Entropy analysis for secret detection
const entropyAnalysis = await this.secretScanner.performEntropyAnalysis();
// Generate security score and risk level
const { securityScore, riskLevel } = this.calculateSecurityScore(vulnerabilities, owaspCompliance, entropyAnalysis);
// Generate recommendations
const recommendations = this.generateSecurityRecommendations(vulnerabilities, owaspCompliance, entropyAnalysis);
const criticalIssues = vulnerabilities.filter(v => v.severity === 'critical').length;
return {
issues: vulnerabilities.length,
criticalIssues,
vulnerabilities,
npmAuditSummary,
owaspCompliance,
entropyAnalysis,
securityScore,
riskLevel,
recommendations
};
}
async analyze() {
// Default to quick scan for standard analyze() method
return this.quickScan();
}
calculateSecurityScore(vulnerabilities, owaspCompliance, entropyAnalysis) {
let score = 100;
// Deduct points for vulnerabilities
const critical = vulnerabilities.filter(v => v.severity === 'critical').length;
const high = vulnerabilities.filter(v => v.severity === 'high').length;
const medium = vulnerabilities.filter(v => v.severity === 'medium').length;
const low = vulnerabilities.filter(v => v.severity === 'low').length;
score -= critical * 25; // 25 points per critical
score -= high * 10; // 10 points per high
score -= medium * 5; // 5 points per medium
score -= low * 1; // 1 point per low
// Factor in OWASP compliance
if (owaspCompliance) {
const complianceWeight = 0.3;
score = (score * (1 - complianceWeight)) + (owaspCompliance.overallCompliance * complianceWeight);
}
// Factor in entropy analysis
if (entropyAnalysis) {
const entropyWeight = 0.2;
let entropyScore = 100;
switch (entropyAnalysis.overallRisk) {
case 'critical':
entropyScore = 20;
break;
case 'high':
entropyScore = 50;
break;
case 'medium':
entropyScore = 75;
break;
case 'low':
entropyScore = 95;
break;
}
score = (score * (1 - entropyWeight)) + (entropyScore * entropyWeight);
}
score = Math.max(0, Math.min(100, score));
// Determine risk level
let riskLevel;
if (critical > 0 || score < 30) {
riskLevel = 'critical';
}
else if (high >= 3 || score < 50) {
riskLevel = 'high';
}
else if (high >= 1 || medium >= 5 || score < 70) {
riskLevel = 'medium';
}
else {
riskLevel = 'low';
}
return { securityScore: Math.round(score), riskLevel };
}
generateSecurityRecommendations(vulnerabilities, owaspCompliance, entropyAnalysis) {
const recommendations = [];
// Critical issues first
const critical = vulnerabilities.filter(v => v.severity === 'critical');
if (critical.length > 0) {
recommendations.push({
priority: 'critical',
category: 'Immediate Action Required',
title: 'Critical Security Vulnerabilities Detected',
description: `${critical.length} critical security issues require immediate attention`,
actionItems: [
'Review and fix all critical vulnerabilities immediately',
'Consider taking systems offline if actively exploitable',
'Implement emergency security patches',
'Notify security team and stakeholders'
],
estimatedEffort: 'high',
businessImpact: 'System compromise, data breach, business disruption'
});
}
// Entropy analysis recommendations
if (entropyAnalysis && entropyAnalysis.overallRisk !== 'low') {
recommendations.push({
priority: entropyAnalysis.overallRisk,
category: 'Secret Management',
title: 'Hardcoded Secrets Detected',
description: `${entropyAnalysis.totalHighEntropyStrings} potential secrets found in source code`,
actionItems: [
'Move secrets to environment variables',
'Implement secret management solution',
'Rotate potentially compromised credentials',
'Add pre-commit hooks to prevent future secret commits'
],
estimatedEffort: 'medium',
businessImpact: 'Credential theft, unauthorized access, compliance violations'
});
}
// OWASP compliance recommendations
if (owaspCompliance && owaspCompliance.overallCompliance < 80) {
const worstCategories = Object.entries(owaspCompliance.categoryScores)
.filter(([_, cat]) => cat.score < 70)
.sort((a, b) => a[1].score - b[1].score)
.slice(0, 3);
if (worstCategories.length > 0) {
recommendations.push({
priority: 'high',
category: 'OWASP Compliance',
title: 'OWASP Top 10 Compliance Issues',
description: `Security gaps identified in ${worstCategories.length} OWASP categories`,
actionItems: worstCategories.map(([cat, data]) => `Address ${cat.replace('_', ' ')}: ${data.recommendations[0] || 'Review category issues'}`),
estimatedEffort: 'high',
businessImpact: 'Regulatory compliance issues, security audit failures'
});
}
}
// General security improvements
const hasNpmVulns = vulnerabilities.some(v => v.type === 'npm_vulnerability');
if (hasNpmVulns) {
recommendations.push({
priority: 'medium',
category: 'Dependency Management',
title: 'Vulnerable Dependencies',
description: 'Dependencies with known security vulnerabilities detected',
actionItems: [
'Run npm audit and fix vulnerabilities',
'Update dependencies to latest secure versions',
'Implement automated dependency scanning',
'Set up dependency update alerts'
],
estimatedEffort: 'medium',
businessImpact: 'Supply chain attacks, known vulnerability exploitation'
});
}
// Security tooling recommendations
recommendations.push({
priority: 'medium',
category: 'Security Infrastructure',
title: 'Security Tooling & Processes',
description: 'Implement comprehensive security practices',
actionItems: [
'Set up automated security scanning in CI/CD',
'Implement security linting rules',
'Regular security training for development team',
'Establish security code review process',
'Create incident response procedures'
],
estimatedEffort: 'high',
businessImpact: 'Proactive security posture, reduced vulnerability introduction'
});
return recommendations;
}
}
//# sourceMappingURL=SecurityAnalyzer.js.map