Skip to content

Commit c2bfc18

Browse files
winezer0winezer0
committed
update
1 parent 093e924 commit c2bfc18

Some content is hidden

Large Commits have some content hidden by default. Use the searchbox below for content that may be hidden.

64 files changed

+3744
-499
lines changed

‎.gitignore‎

Lines changed: 177 additions & 2 deletions
Original file line numberDiff line numberDiff line change
@@ -1,3 +1,178 @@
1-
/.idea
2-
*.pyc
1+
# Byte-compiled / optimized / DLL files
2+
__pycache__/
3+
*.py[cod]
4+
*$py.class
5+
vendor/
6+
# C extensions
7+
*.so
8+
*.bak
9+
*.cache
10+
*.selected.*
11+
12+
# Distribution / packaging
13+
.Python
14+
build/
15+
develop-eggs/
16+
dist/
17+
downloads/
18+
eggs/
19+
.eggs/
20+
lib/
21+
lib64/
22+
parts/
23+
sdist/
24+
var/
25+
wheels/
26+
share/python-wheels/
27+
*.egg-info/
28+
.installed.cfg
29+
*.egg
30+
MANIFEST
31+
32+
# PyInstaller
33+
# Usually these files are written by a python script from a template
34+
# before PyInstaller builds the exe, so as to inject date/other infos into it.
35+
*.manifest
336
*.spec
37+
38+
# Installer logs
39+
pip-log.txt
40+
pip-delete-this-directory.txt
41+
42+
# Unit test / coverage reports
43+
htmlcov/
44+
.tox/
45+
.nox/
46+
.coverage
47+
.coverage.*
48+
.cache
49+
nosetests.xml
50+
coverage.xml
51+
*.cover
52+
*.py,cover
53+
.hypothesis/
54+
.pytest_cache/
55+
cover/
56+
57+
# Translations
58+
*.mo
59+
*.pot
60+
61+
# Django stuff:
62+
*.log
63+
local_settings.py
64+
db.sqlite3
65+
db.sqlite3-journal
66+
67+
# Flask stuff:
68+
instance/
69+
.webassets-cache
70+
71+
# Scrapy stuff:
72+
.scrapy
73+
74+
# Sphinx documentation
75+
docs/_build/
76+
77+
# PyBuilder
78+
.pybuilder/
79+
target/
80+
81+
# Jupyter Notebook
82+
.ipynb_checkpoints
83+
84+
# IPython
85+
profile_default/
86+
ipython_config.py
87+
88+
# pyenv
89+
# For a library or package, you might want to ignore these files since the code is
90+
# intended to run in multiple environments; otherwise, check them in:
91+
# .python-version
92+
93+
# pipenv
94+
# According to pypa/pipenv#598, it is recommended to include Pipfile.lock in version control.
95+
# However, in case of collaboration, if having platform-specific dependencies or dependencies
96+
# having no cross-platform support, pipenv may install dependencies that don't work, or not
97+
# install all needed dependencies.
98+
#Pipfile.lock
99+
100+
# UV
101+
# Similar to Pipfile.lock, it is generally recommended to include uv.lock in version control.
102+
# This is especially recommended for binary packages to ensure reproducibility, and is more
103+
# commonly ignored for libraries.
104+
#uv.lock
105+
106+
# poetry
107+
# Similar to Pipfile.lock, it is generally recommended to include poetry.lock in version control.
108+
# This is especially recommended for binary packages to ensure reproducibility, and is more
109+
# commonly ignored for libraries.
110+
# https://python-poetry.org/docs/basic-usage/#commit-your-poetrylock-file-to-version-control
111+
#poetry.lock
112+
113+
# pdm
114+
# Similar to Pipfile.lock, it is generally recommended to include pdm.lock in version control.
115+
#pdm.lock
116+
# pdm stores project-wide configurations in .pdm.toml, but it is recommended to not include it
117+
# in version control.
118+
# https://pdm.fming.dev/latest/usage/project/#working-with-version-control
119+
.pdm.toml
120+
.pdm-python
121+
.pdm-build/
122+
123+
# PEP 582; used by e.g. github.com/David-OConnor/pyflow and github.com/pdm-project/pdm
124+
__pypackages__/
125+
126+
# Celery stuff
127+
celerybeat-schedule
128+
celerybeat.pid
129+
130+
# SageMath parsed files
131+
*.sage.py
132+
133+
# Environments
134+
.env
135+
.venv
136+
env/
137+
venv/
138+
ENV/
139+
env.bak/
140+
venv.bak/
141+
142+
# Spyder project settings
143+
.spyderproject
144+
.spyproject
145+
146+
# Rope project settings
147+
.ropeproject
148+
149+
# mkdocs documentation
150+
/site
151+
152+
# mypy
153+
.mypy_cache/
154+
.dmypy.json
155+
dmypy.json
156+
157+
# Pyre type checker
158+
.pyre/
159+
160+
# pytype static type analyzer
161+
.pytype/
162+
163+
# Cython debug symbols
164+
cython_debug/
165+
166+
# PyCharm
167+
# JetBrains specific template is maintained in a separate JetBrains.gitignore that can
168+
# be found at https://github.com/github/gitignore/blob/main/Global/JetBrains.gitignore
169+
# and can be added to the global gitignore or merged into this file. For a more nuclear
170+
# option (not recommended) you can uncomment the following to ignore the entire idea folder.
171+
#.idea/
172+
173+
# PyPI configuration file
174+
.pypirc
175+
/.idea
176+
*.json
177+
*.cache
178+
config_auditor.yml

‎README.md‎

Lines changed: 52 additions & 8 deletions
Original file line numberDiff line numberDiff line change
@@ -7,7 +7,18 @@
77

88
## 产品说明
99

10-
付费支持|效果截图|其他介绍 请点击跳转至 [产品自述](产品自述.md)
10+
请点击跳转至 [产品自述](产品自述.md)
11+
12+
## XSASTGO License版
13+
14+
XSASTGO是基于XSAST的更新版本,对多方面功能进行优化
15+
16+
- 1、XSASTGO 使用GO进行重构,减小程序大小, 增强程序稳定性
17+
- 2、XSASTGO 已编写其他语言的的常见漏洞审计审计规则
18+
- 3、XSASTGO 已实现其他语言的语法分析，补充更多的代码信息
19+
20+
如有需求可以跳转到 [XSASTGO](https://github.com/winezer0/xsast-release)
21+
1122

1223
## 项目背景
1324

@@ -62,7 +73,7 @@ X-SAST 采用模块化设计，各组件可独立使用，也可协同工作：
6273

6374
- **X1_checker.exe**：规则检查引擎（命令行工具 开源）
6475
![X1](./doc/X1.png)
65-
- **X2_verifier.exe**：AI 验证引擎（命令行工具 提供可执行文件,使用需要License）
76+
- **X2_verifier.exe**：AI 验证引擎（命令行工具 开源）
6677
![X2](./doc/X2.png)
6778
- **X3_auditor.exe**：人工审计工具（GUI 程序 开源）
6879
- X3载入X1结果示例
@@ -94,7 +105,7 @@ X-SAST 专为以下用户设计：
94105

95106
- 开发语言：Python
96107
- 分发方式：Pyinstaller 打包的可执行程序
97-
- 支持平台：Windows（其他平台可定制）
108+
- 支持平台：Windows（其他平台请使用源代码运行）
98109
- AI 模型支持：集成多种本地和云端 AI 模型
99110

100111

@@ -114,11 +125,44 @@ X-SAST 专为以下用户设计：
114125
- 2、不需要对每种语言进行深度语法适配就可以快速适配各种语言类型
115126

116127

117-
### TODO优化方案
118-
- 1、使用GO进行重构,减小程序大小, 增强程序稳定性【进行中 预计2025年8月重构完成 性能提升极大 仅内部使用】
119-
- 2、编写其他语言的的常见漏洞审计审计规则 【进行中 目前已实现ANY PHP ASPX 部分JAVA 漏洞审计规则】
120-
- 3、实现其他语言的语法分析，补充更多的代码信息
128+
### 打包问题记录
129+
```
130+
X3_auditor打包 PyQt6 (6.9.0) 在部分主机下无法运行
131+
ImportError: DLL load failed while importing QtWidgets
132+
133+
解决方案:降级pyqt6
134+
https://blog.csdn.net/fenggege66/article/details/132220930
135+
"""
136+
卸载
137+
pip uninstall PyQt6-Qt6 -y
138+
pip uninstall pyqt6 -y
139+
pip uninstall PyQt6-sip -y
140+
141+
指定低版本下载，成功解决引包问题
142+
Python3.9.13
143+
pip install pyqt6==6.1.0 -i https://pypi.tuna.tsinghua.edu.cn/simple
144+
pip install PyQt6-Qt6==6.1.0 -i https://pypi.tuna.tsinghua.edu.cn/simple
145+
pip install PyQt6-sip==13.1.0 -i https://pypi.tuna.tsinghua.edu.cn/simple
146+
# 缺陷 Python3.9.13下打包文件特别大 200M+ 本来是50M
147+
148+
Python3.13 安装 pyqt6==6.1.0 报错 使用 pyqt6==6.2.0 成功
149+
pip install pyqt6==6.2.0 -i https://pypi.tuna.tsinghua.edu.cn/simple
150+
pip install PyQt6-Qt6==6.2.0 -i https://pypi.tuna.tsinghua.edu.cn/simple
151+
pip install PyQt6-sip==13.2.0 -i https://pypi.tuna.tsinghua.edu.cn/simple
152+
```
153+
154+
### 已知问题
155+
156+
```
157+
1、treesitter-php demo 存在多层次解析bug $sql = "SELECT COUNT(*) FROM " . $GLOBALS['ecs']->table('agency');
158+
```
159+
160+
## 联系方式
161+
如需获取更多信息、技术支持或定制服务，请通过以下方式联系我们：
162+
NOVASEC微信公众号或通过社交信息联系开发者【酒零】
163+
164+
![NOVASEC0](https://raw.githubusercontent.com/winezer0/mypics/refs/heads/main/NOVASEC0.jpg)
165+
121166

122-
---
123167

124168
*X-SAST - 为安全专业人员打造的新一代快速代码审计利器*

‎X0_parser_php.py‎

Lines changed: 29 additions & 0 deletions
Original file line numberDiff line numberDiff line change
@@ -0,0 +1,29 @@
1+
from libs_com.args_utils import check_required_path
2+
from tree_php.PhpTreeParser import PhpParser
3+
from tree_php.php_parser_args import parse_php_parser_args
4+
from tree_php.php_result_utils import split_store_parsed_infos
5+
6+
if __name__ == '__main__':
7+
args = parse_php_parser_args()
8+
9+
project_path = args.project_path
10+
check_required_path(project_path, "Scan Path")
11+
12+
project_name = args.project_name
13+
workers = args.workers
14+
save_cache = args.save_cache
15+
import_filter = args.import_filter
16+
exclude_keys = args.exclude_keys
17+
18+
# project_name = "default_project"
19+
# project_path = r"C:\phps\WWW\TestCode\EcShopBenTengAppSample"
20+
php_parser = PhpParser(project_name=project_name, project_path=project_path)
21+
parsed_infos = php_parser.analyse(save_cache=save_cache,
22+
workers=workers,
23+
import_filter=import_filter,
24+
exclude_keys=exclude_keys
25+
)
26+
27+
result_infos = split_store_parsed_infos(parsed_infos, project_name, project_path)
28+
print(f"The analysis results have been saved to:{result_infos}")
29+

‎X1_checker.py‎

Lines changed: 3 additions & 3 deletions
Original file line numberDiff line numberDiff line change
@@ -41,14 +41,14 @@ def main():
4141
if check_results:
4242
save_file = args.output or f"{project_name}.{get_path_hash(project_path)}.checker.json"
4343
if path_is_exist(save_file):
44-
print("历史分析结果已存在, 开始进行合并更新...")
44+
print("The historical analysis results are already available. Let's merging and updating....")
4545
check_results = merge_dicts_by_key(check_results, load_json(save_file), unique_key=CheckerKeys.CHECKER_HASH.value)
46-
print(f"历史分析结果已合并, 最终结果数量:{len(check_results)}...")
46+
print(f"The historical analysis results have been combined, and the final results:{len(check_results)}...")
4747

4848
dump_status, dump_error = dump_json(save_file, check_results)
4949
if dump_error:
5050
raise dump_error
51-
print(f"分析结果已保存至: {save_file}")
51+
print(f"The analysis results have been saved to: {save_file}")
5252

5353

5454
if __name__ == '__main__':

0 commit comments

Comments
 (0)