feat: SARIF exporter for UI

chitos_sarif.py

@@ -0,0 +1,122 @@
+# -*- coding: utf-8 -*-
+"""치토스 진단 결과 → SARIF 2.1.0 변환기 (Shannon 흡수, 클린룸·OASIS 공개표준).
+치토스 do_scan/do_deep 결과(dict)를 받아 CI/CD·DevSecOps 호환 SARIF 2.1.0 JSON으로 출력.
+finding 형식: [sev('hi'|'mid'|'low'), [ko,en]title, [ko,en]detail]. good/matrix 등은 결과에 미포함.
+AGPL 코드 미사용 — SARIF는 OASIS 공개표준이며 본 구현은 치토스 자체 코드다."""
+import re
+
+_LEVEL = {"hi": "error", "mid": "warning", "low": "note"}
+
+# 치토스 finding(영문 제목) 키워드 → OWASP Top 10 2021 · CWE 매핑 (공개표준)
+_MAP = [
+    ("security response headers", "A05:2021", "CWE-693"),
+    ("hsts", "A02:2021", "CWE-319"),
+    ("https", "A02:2021", "CWE-319"),
+    ("cookie", "A05:2021", "CWE-1004"),
+    ("cors", "A05:2021", "CWE-942"),
+    ("csp", "A05:2021", "CWE-693"),
+    ("sensitive", "A01:2021", "CWE-538"),
+    ("backup", "A05:2021", "CWE-530"),
+    ("server version", "A05:2021", "CWE-200"),
+    ("x-powered-by", "A05:2021", "CWE-200"),
+    ("tech stack", "A05:2021", "CWE-200"),
+    ("tls certificate", "A02:2021", "CWE-295"),
+    ("spf", "A07:2021", "CWE-290"),
+    ("dkim", "A07:2021", "CWE-290"),
+    ("dmarc", "A07:2021", "CWE-290"),
+    ("dnssec", "A05:2021", "CWE-350"),
+    ("caa", "A05:2021", "CWE-295"),
+    ("mixed content", "A02:2021", "CWE-311"),
+    ("external-script", "A08:2021", "CWE-353"),
+    ("sri", "A08:2021", "CWE-353"),
+    ("pii", "A01:2021", "CWE-359"),
+    ("noindex", "A05:2021", "CWE-16"),
+]
+
+
+def _owasp_cwe(en_title):
+    t = (en_title or "").lower()
+    for kw, owasp, cwe in _MAP:
+        if kw in t:
+            return owasp, cwe
+    return None, None
+
+
+def _pick(v, li):
+    if isinstance(v, (list, tuple)) and len(v) == 2:
+        return v[li]
+    return str(v)
+
+
+def _slug(s):
+    return (re.sub(r"[^a-zA-Z0-9]+", "-", str(s).lower()).strip("-")[:60]) or "finding"
+
+
+def to_sarif(d, lang="en"):
+    """d = do_scan/do_deep 결과. lang: 'en'(기본, SARIF 권장) | 'ko'."""
+    li = 0 if lang == "ko" else 1
+    host = d.get("host", "")
+    base_uri = "https://%s/" % host if host else ""
+    # 오류/차단은 결과 없이 빈 run
+    findings = []
+    for k in ("sec", "seo", "geo"):
+        findings += list(d.get(k, []))
+    dp = d.get("deep", {})
+    findings += list(dp.get("issues", []))
+
+    # 비침투(do_scan/do_deep)는 관찰 기반 → proofState=observed.
+    # 능동 PoC로 증명된 finding은 호출 측에서 it에 'proven' 표식을 넣어 proofState=proven 처리(향후 능동엔진 연계).
+    proof = "proven" if d.get("proven") else "observed"
+    rules = {}
+    results = []
+    for it in findings:
+        try:
+            sev = it[0]
+            title = _pick(it[1], li)
+            detail = _pick(it[2], li)
+            en_title = _pick(it[1], 1)
+            rid = _slug(en_title)   # ruleId는 영문 기준으로 언어 무관 고정
+        except Exception:
+            continue
+        lvl = _LEVEL.get(sev, "warning")
+        owasp, cwe = _owasp_cwe(en_title)
+        if rid not in rules:
+            rule = {
+                "id": rid,
+                "name": title,
+                "shortDescription": {"text": title},
+                "defaultConfiguration": {"level": lvl},
+                "properties": {"tags": [t for t in ["security", owasp, cwe] if t]},
+            }
+            if owasp or cwe:
+                rule["properties"]["owasp"] = owasp
+                rule["properties"]["cwe"] = cwe
+            rules[rid] = rule
+        results.append({
+            "ruleId": rid,
+            "level": lvl,
+            "message": {"text": "%s — %s" % (title, detail)},
+            "locations": [{"physicalLocation": {"artifactLocation": {"uri": base_uri or host or "target"}}}],
+            "properties": {"proofState": proof, "owasp": owasp, "cwe": cwe},
+        })
+
+    return {
+        "$schema": "https://json.schemastore.org/sarif-2.1.0.json",
+        "version": "2.1.0",
+        "runs": [{
+            "tool": {"driver": {
+                "name": "CHITOS",
+                "informationUri": "https://final-bench-freeweb-security-scan.hf.space",
+                "version": "1.1",
+                "rules": list(rules.values()),
+            }},
+            "results": results,
+            "properties": {"host": host, "engine": "CHITOS", "nonIntrusive": True, "proofModel": proof},
+        }],
+    }
+
+
+if __name__ == "__main__":
+    import json, sys
+    data = json.load(open(sys.argv[1], encoding="utf-8")) if len(sys.argv) > 1 else {"host": "example.com", "sec": [["mid", ["보안 헤더 누락", "Missing security headers"], ["꺼짐", "disabled"]]]}
+    print(json.dumps(to_sarif(data), ensure_ascii=False, indent=1))