app.py

"""
Code Security Risk Analyzer v2 - Gradio UI + REST API
=====================================================
IMPROVEMENTS OVER v1:
- Per-class threshold optimization (not global 0.3)
- Temperature scaling calibration (meaningful probabilities)
- Uses label_config.json for thresholds + calibration
- Better vulnerability detection across rare CWEs

Run AFTER notebooks 1-4 to use the improved models.
Upload this to: https://huggingface.co/spaces/ayshajavd/code-security-analyzer
"""
import json
import re
import time
import torch
import gradio as gr
from transformers import (
    AutoTokenizer,
    AutoModelForSequenceClassification,
    T5ForConditionalGeneration,
)
from huggingface_hub import hf_hub_download
import numpy as np

# ============================================================
# Label Mappings
# ============================================================
TARGET_CWES = [
    "safe", "CWE-20", "CWE-22", "CWE-78", "CWE-79", "CWE-89", "CWE-94",
    "CWE-119", "CWE-125", "CWE-190", "CWE-200", "CWE-264", "CWE-269",
    "CWE-276", "CWE-284", "CWE-287", "CWE-310", "CWE-327", "CWE-330",
    "CWE-352", "CWE-362", "CWE-399", "CWE-401", "CWE-416", "CWE-434",
    "CWE-476", "CWE-502", "CWE-601", "CWE-787", "CWE-798", "CWE-918",
]

CWE_NAMES = {
    "safe": "Safe Code",
    "CWE-20": "Improper Input Validation",
    "CWE-22": "Path Traversal",
    "CWE-78": "OS Command Injection",
    "CWE-79": "Cross-Site Scripting (XSS)",
    "CWE-89": "SQL Injection",
    "CWE-94": "Code Injection",
    "CWE-119": "Buffer Overflow",
    "CWE-125": "Out-of-bounds Read",
    "CWE-190": "Integer Overflow",
    "CWE-200": "Information Exposure",
    "CWE-264": "Permissions/Privileges/Access Controls",
    "CWE-269": "Improper Privilege Management",
    "CWE-276": "Incorrect Default Permissions",
    "CWE-284": "Improper Access Control",
    "CWE-287": "Improper Authentication",
    "CWE-310": "Cryptographic Issues",
    "CWE-327": "Broken Crypto Algorithm",
    "CWE-330": "Insufficient Randomness",
    "CWE-352": "Cross-Site Request Forgery (CSRF)",
    "CWE-362": "Race Condition",
    "CWE-399": "Resource Management Errors",
    "CWE-401": "Memory Leak",
    "CWE-416": "Use After Free",
    "CWE-434": "Unrestricted File Upload",
    "CWE-476": "NULL Pointer Dereference",
    "CWE-502": "Insecure Deserialization",
    "CWE-601": "Open Redirect",
    "CWE-787": "Out-of-bounds Write",
    "CWE-798": "Hardcoded Credentials",
    "CWE-918": "Server-Side Request Forgery (SSRF)",
}

CWE_TO_OWASP = {
    "CWE-22": "A01:2021 - Broken Access Control",
    "CWE-200": "A01:2021 - Broken Access Control",
    "CWE-264": "A01:2021 - Broken Access Control",
    "CWE-276": "A01:2021 - Broken Access Control",
    "CWE-284": "A01:2021 - Broken Access Control",
    "CWE-352": "A01:2021 - Broken Access Control",
    "CWE-601": "A01:2021 - Broken Access Control",
    "CWE-269": "A01:2021 - Broken Access Control",
    "CWE-310": "A02:2021 - Cryptographic Failures",
    "CWE-327": "A02:2021 - Cryptographic Failures",
    "CWE-330": "A02:2021 - Cryptographic Failures",
    "CWE-20": "A03:2021 - Injection",
    "CWE-78": "A03:2021 - Injection",
    "CWE-79": "A03:2021 - Injection",
    "CWE-89": "A03:2021 - Injection",
    "CWE-94": "A03:2021 - Injection",
    "CWE-119": "A03:2021 - Injection",
    "CWE-125": "A03:2021 - Injection",
    "CWE-190": "A03:2021 - Injection",
    "CWE-416": "A03:2021 - Injection",
    "CWE-476": "A03:2021 - Injection",
    "CWE-401": "A03:2021 - Injection",
    "CWE-787": "A03:2021 - Injection",
    "CWE-434": "A04:2021 - Insecure Design",
    "CWE-362": "A04:2021 - Insecure Design",
    "CWE-399": "A04:2021 - Insecure Design",
    "CWE-287": "A07:2021 - Identification & Auth Failures",
    "CWE-798": "A07:2021 - Identification & Auth Failures",
    "CWE-502": "A08:2021 - Software & Data Integrity Failures",
    "CWE-918": "A10:2021 - Server-Side Request Forgery",
}

SEVERITY_MAP = {
    "CWE-89": ("Critical", 95), "CWE-78": ("Critical", 93),
    "CWE-94": ("Critical", 92), "CWE-502": ("Critical", 90),
    "CWE-918": ("Critical", 88), "CWE-798": ("Critical", 87),
    "CWE-119": ("High", 85), "CWE-787": ("High", 84),
    "CWE-416": ("High", 83), "CWE-79": ("High", 80),
    "CWE-22": ("High", 78), "CWE-287": ("High", 77),
    "CWE-284": ("High", 76), "CWE-434": ("High", 75),
    "CWE-125": ("Medium", 70), "CWE-190": ("Medium", 68),
    "CWE-352": ("Medium", 67), "CWE-476": ("Medium", 65),
    "CWE-362": ("Medium", 63), "CWE-20": ("Medium", 60),
    "CWE-264": ("Medium", 58), "CWE-269": ("Medium", 57),
    "CWE-310": ("Medium", 65), "CWE-327": ("Medium", 62),
    "CWE-330": ("Medium", 55), "CWE-399": ("Low", 45),
    "CWE-401": ("Low", 42), "CWE-200": ("Low", 40),
    "CWE-276": ("Low", 38), "CWE-601": ("Medium", 55),
}

EXPLANATIONS = {
    "CWE-89": "**SQL Injection** means an attacker can manipulate your database queries by injecting malicious SQL code through user inputs. This could let them steal, modify, or delete ALL your data.",
    "CWE-79": "**Cross-Site Scripting (XSS)** lets attackers inject malicious JavaScript into your web pages. When other users visit the page, the script runs in their browser - stealing cookies, session tokens, or redirecting them to fake sites.",
    "CWE-78": "**OS Command Injection** means user input is being passed directly to system commands. An attacker could run ANY command on your server.",
    "CWE-94": "**Code Injection** allows attackers to inject and execute arbitrary code. Functions like `eval()`, `exec()`, or dynamic code compilation with untrusted input are the usual culprits.",
    "CWE-119": "**Buffer Overflow** happens when your code writes data beyond the allocated memory buffer. Attackers can exploit this to crash your program or execute malicious code.",
    "CWE-125": "**Out-of-bounds Read** means your code reads memory outside the intended buffer. This can leak sensitive data like passwords or encryption keys.",
    "CWE-190": "**Integer Overflow** occurs when an arithmetic operation produces a value too large for the data type, which can be chained with buffer overflows for code execution.",
    "CWE-200": "**Information Exposure** means sensitive data (API keys, passwords, stack traces) is being leaked to unauthorized parties.",
    "CWE-264": "**Improper Access Control** means users can access resources or perform actions they shouldn't be authorized for.",
    "CWE-287": "**Authentication Bypass** means the login/identity verification can be circumvented.",
    "CWE-310": "**Cryptographic Issues** - you're using weak, broken, or improperly configured encryption.",
    "CWE-352": "**CSRF** tricks authenticated users into performing unwanted actions on your site.",
    "CWE-362": "**Race Condition** means two operations compete for the same resource without proper synchronization.",
    "CWE-416": "**Use After Free** - memory is being used after it's been freed. Attackers can exploit this for arbitrary code execution.",
    "CWE-434": "**Unrestricted File Upload** lets attackers upload malicious files (like web shells) to your server.",
    "CWE-476": "**NULL Pointer Dereference** - your code tries to use a pointer that's NULL, causing crashes.",
    "CWE-502": "**Insecure Deserialization** means untrusted data is deserialized without validation, enabling code execution.",
    "CWE-601": "**Open Redirect** lets attackers redirect users from your trusted site to a malicious one for phishing.",
    "CWE-787": "**Out-of-bounds Write** - data is written outside the intended memory buffer, often leading to remote code execution.",
    "CWE-798": "**Hardcoded Credentials** - passwords, API keys, or tokens are embedded directly in the source code.",
    "CWE-918": "**SSRF** lets attackers make your server send requests to internal systems, accessing internal APIs or cloud metadata.",
    "CWE-22": "**Path Traversal** means user input is used in file paths without sanitization. Attackers can use `../` to access any file on the server.",
    "CWE-269": "**Privilege Escalation** - a user can gain higher privileges than intended.",
    "CWE-276": "**Incorrect Permissions** - files or resources have permissions that are too permissive.",
    "CWE-327": "**Broken Cryptography** - you're using algorithms like MD5 or SHA1 that are cryptographically broken.",
    "CWE-330": "**Insufficient Randomness** - security-critical random values (tokens, keys) are predictable.",
    "CWE-399": "**Resource Management Issues** - improper handling of system resources can lead to denial of service.",
    "CWE-401": "**Memory Leak** - memory is allocated but never freed, eventually causing crashes.",
    "CWE-20": "**Improper Input Validation** - user input isn't properly checked before use, enabling many other vulnerabilities.",
    "CWE-284": "**Broken Access Control** - authorization checks are missing or incorrectly implemented.",
}

# ============================================================
# Model Loading
# ============================================================
CLASSIFIER_ID = "ayshajavd/graphcodebert-vuln-classifier"
FIXER_ID = "ayshajavd/codet5p-vuln-fixer"

THRESHOLDS = {cwe: 0.3 for cwe in TARGET_CWES}
TEMPERATURE = 1.0

print("Loading classifier...")
try:
    cls_tokenizer = AutoTokenizer.from_pretrained(CLASSIFIER_ID)
    cls_model = AutoModelForSequenceClassification.from_pretrained(CLASSIFIER_ID)
    cls_model.eval()
    CLASSIFIER_LOADED = True
    print("Classifier loaded successfully")
    try:
        config_path = hf_hub_download(CLASSIFIER_ID, "label_config.json")
        with open(config_path) as f:
            label_config = json.load(f)
        if "optimized_thresholds" in label_config:
            THRESHOLDS = label_config["optimized_thresholds"]
            print(f"Per-class thresholds loaded ({len(THRESHOLDS)} classes)")
        if "temperature" in label_config:
            TEMPERATURE = label_config["temperature"]
            print(f"Temperature calibration loaded (T={TEMPERATURE:.4f})")
    except Exception as e:
        print(f"Could not load label_config: {e}. Using defaults.")
except Exception as e:
    print(f"Classifier not available: {e}")
    cls_tokenizer = AutoTokenizer.from_pretrained("huggingface/CodeBERTa-small-v1")
    cls_model = AutoModelForSequenceClassification.from_pretrained(
        "huggingface/CodeBERTa-small-v1", num_labels=31, problem_type="multi_label_classification",
    )
    cls_model.eval()
    CLASSIFIER_LOADED = False

print("Loading fix generator...")
try:
    fix_tokenizer = AutoTokenizer.from_pretrained(FIXER_ID)
    fix_model = T5ForConditionalGeneration.from_pretrained(FIXER_ID)
    fix_model.eval()
    FIXER_LOADED = True
    print("Fix generator loaded successfully")
except Exception as e:
    print(f"Fix generator not available: {e}")
    fix_tokenizer = AutoTokenizer.from_pretrained("Salesforce/codet5p-220m")
    fix_model = T5ForConditionalGeneration.from_pretrained("Salesforce/codet5p-220m")
    fix_model.eval()
    FIXER_LOADED = False


def detect_language(code: str) -> str:
    code_lower = code[:500].lower()
    if "<?php" in code_lower: return "PHP"
    if "package main" in code_lower and "func " in code_lower: return "Go"
    if "#include" in code_lower:
        if "class " in code_lower or "std::" in code_lower or "cout" in code_lower: return "C++"
        return "C"
    if "import java" in code_lower or "public class" in code_lower: return "Java"
    if re.search(r'\b(const |let |var |function |=>|require\(|module\.exports)', code_lower): return "JavaScript"
    if re.search(r'\b(def |import |from |class |self\.|print\()', code_lower): return "Python"
    return "Unknown"


def classify_code(code):
    inputs = cls_tokenizer(code, return_tensors="pt", max_length=512, truncation=True, padding=True)
    with torch.no_grad():
        logits = cls_model(**inputs).logits.squeeze()
        calibrated_logits = logits / TEMPERATURE
        probs = torch.sigmoid(calibrated_logits).numpy()
    detected = []
    for i, (cwe, p) in enumerate(zip(TARGET_CWES, probs)):
        if cwe == "safe":
            continue
        threshold = THRESHOLDS.get(cwe, 0.3)
        if p > threshold:
            detected.append((cwe, float(p)))
    detected.sort(key=lambda x: x[1], reverse=True)
    return detected, float(probs[0]), {cwe: float(p) for cwe, p in zip(TARGET_CWES, probs)}


def generate_fix(code, language, cwe_id=None):
    if cwe_id:
        cwe_name = CWE_NAMES.get(cwe_id, cwe_id)
        prefix = f"fix {cwe_name} vulnerability in {language.lower()}: "
    else:
        prefix = f"fix {language.lower()}: "
    input_ids = fix_tokenizer(prefix + code, return_tensors="pt", max_length=512, truncation=True).input_ids
    with torch.no_grad():
        out = fix_model.generate(input_ids, max_length=512, num_beams=5, early_stopping=True, no_repeat_ngram_size=3)
    return fix_tokenizer.decode(out[0], skip_special_tokens=True)


def build_json_report(code):
    language = detect_language(code)
    detected, safe_prob, all_probs = classify_code(code)
    if not detected:
        overall_risk = max(0, int(100 - 100 * safe_prob))
        risk_level = "Low"
    else:
        max_sev = max(SEVERITY_MAP.get(c, ("Low", 30))[1] for c, _ in detected)
        avg_conf = sum(p for _, p in detected) / len(detected)
        overall_risk = min(100, int(max_sev * avg_conf * 1.2))
        risk_level = "Critical" if overall_risk >= 80 else "High" if overall_risk >= 60 else "Medium" if overall_risk >= 40 else "Low"
    vulns = []
    for cwe, conf in detected:
        sev, score = SEVERITY_MAP.get(cwe, ("Medium", 50))
        threshold_used = THRESHOLDS.get(cwe, 0.3)
        vulns.append({
            "cwe_id": cwe, "name": CWE_NAMES.get(cwe, cwe),
            "owasp_category": CWE_TO_OWASP.get(cwe, "N/A"),
            "severity": sev, "severity_score": score,
            "detection_confidence": round(conf, 4),
            "threshold_used": round(threshold_used, 3),
            "exploit_likelihood": min(100, int(conf * score)),
            "explanation": EXPLANATIONS.get(cwe, "Security risk detected.").replace("**", ""),
        })
    chain = None
    if len(detected) > 1:
        steps = []
        cats = {c for c, _ in detected}
        if cats & {"CWE-20","CWE-89","CWE-79","CWE-78","CWE-94"}:
            steps.append({"step": len(steps)+1, "phase": "Initial Access", "description": "Exploit input validation weakness"})
        if cats & {"CWE-264","CWE-269","CWE-284","CWE-287"}:
            steps.append({"step": len(steps)+1, "phase": "Privilege Escalation", "description": "Bypass access controls"})
        if cats & {"CWE-200","CWE-22","CWE-125"}:
            steps.append({"step": len(steps)+1, "phase": "Data Exfiltration", "description": "Read sensitive files or memory"})
        if cats & {"CWE-119","CWE-416","CWE-787","CWE-502"}:
            steps.append({"step": len(steps)+1, "phase": "Code Execution", "description": "Exploit memory corruption"})
        if steps: chain = steps
    fix = None
    try:
        top_cwe = detected[0][0] if detected else None
        f = generate_fix(code, language, top_cwe)
        if f and f.strip(): fix = f
    except: pass
    return {
        "language": language,
        "model_status": {
            "classifier": "trained_v2" if CLASSIFIER_LOADED else "base_model",
            "fix_generator": "trained_v2" if FIXER_LOADED else "base_model",
            "calibration": f"T={TEMPERATURE:.4f}" if TEMPERATURE != 1.0 else "none",
            "thresholds": "per_class_optimized" if any(v != 0.3 for v in THRESHOLDS.values()) else "global_0.3",
        },
        "overall_risk_score": overall_risk, "risk_level": risk_level,
        "safe_probability": round(safe_prob, 4), "num_vulnerabilities": len(vulns),
        "vulnerabilities": vulns, "attack_chain": chain, "suggested_fix": fix,
        "all_class_probabilities": all_probs,
        "timestamp": time.strftime("%Y-%m-%dT%H:%M:%SZ", time.gmtime()),
    }


def analyze_code(code):
    if not code or not code.strip(): return "Please paste some code to analyze."
    data = build_json_report(code)
    r = ["# Code Security Analysis Report\n"]
    r.append(f"**Language:** {data['language']}")
    cls_status = "Trained v2 (GraphCodeBERT + ASL)" if data['model_status']['classifier'] == 'trained_v2' else "Base Model"
    fix_status = "Trained v2 (CodeT5+ CWE-aware)" if data['model_status']['fix_generator'] == 'trained_v2' else "Base Model"
    r.append(f"**Classifier:** {cls_status}")
    r.append(f"**Fix Generator:** {fix_status}")
    if data['model_status']['calibration'] != 'none':
        r.append(f"**Calibration:** {data['model_status']['calibration']} | **Thresholds:** {data['model_status']['thresholds']}")
    r.append("")
    if data['num_vulnerabilities'] == 0:
        r.append("## No Vulnerabilities Detected")
        r.append(f"**Risk Score:** {data['overall_risk_score']}/100 | **Safe Confidence:** {data['safe_probability']:.1%}\n")
        r.append("Code appears safe. Always supplement with manual review and SAST tools.")
        return "\n".join(r)
    emoji = {"Critical":"🔴","High":"🟠","Medium":"🟡","Low":"🟢"}.get(data['risk_level'],"⚪")
    r.append(f"## {emoji} {data['num_vulnerabilities']} Vulnerability(ies) Detected\n")
    r.append(f"**Risk Score:** {data['overall_risk_score']}/100 ({data['risk_level']}) | **Safe Probability:** {data['safe_probability']:.1%}\n---\n")
    for i, v in enumerate(data['vulnerabilities'], 1):
        se = {"Critical":"🔴","High":"🟠","Medium":"🟡","Low":"🟢"}.get(v['severity'],"⚪")
        r.append(f"### {i}. {se} {v['name']}")
        r.append("| Property | Value |\n|----------|-------|")
        r.append(f"| **CWE ID** | {v['cwe_id']} |")
        r.append(f"| **OWASP** | {v['owasp_category']} |")
        r.append(f"| **Severity** | {v['severity']} ({v['severity_score']}/100) |")
        r.append(f"| **Confidence** | {v['detection_confidence']:.1%} (calibrated) |")
        r.append(f"| **Threshold** | {v['threshold_used']:.3f} (per-class optimized) |")
        r.append(f"| **Exploit Likelihood** | {v['exploit_likelihood']}% |")
        r.append(f"\n**Why Dangerous:** {v['explanation']}\n")
    if data['attack_chain']:
        r.append("---\n## Attack Chain\n")
        for s in data['attack_chain']:
            r.append(f"{s['step']}. **{s['phase']}** — {s['description']}")
    r.append("\n---\n## Suggested Fix\n")
    if data['suggested_fix']:
        r.append(f"```{data['language'].lower()}\n{data['suggested_fix']}\n```")
    else:
        r.append("*Fix generation unavailable. Please review manually.*")
    r.append("\n---\n*AI-generated report (v2: calibrated probabilities + per-class thresholds). Verify with manual review and SAST tools.*")
    return "\n".join(r)


def get_json_report(code):
    if not code or not code.strip(): return {"error": "No code provided"}
    return build_json_report(code)


EXAMPLES = [
    ["""import sqlite3\n\ndef get_user(username):\n    conn = sqlite3.connect('users.db')\n    query = f"SELECT * FROM users WHERE username = '{username}'"\n    return conn.execute(query).fetchone()\n"""],
    ["""#include <stdio.h>\n#include <string.h>\n\nvoid process_input(char *user_input) {\n    char buffer[64];\n    strcpy(buffer, user_input);\n    printf("Processed: %s\\n", buffer);\n}\n"""],
    ["""const express = require('express');\nconst app = express();\n\napp.get('/search', (req, res) => {\n    const query = req.query.q;\n    res.send(`<h1>Results for: ${query}</h1>`);\n});\n"""],
    ["""import requests, hashlib\n\nAPI_KEY = "sk-proj-abc123def456"\nDB_PASSWORD = "admin123"\n\ndef hash_password(password):\n    return hashlib.md5(password.encode()).hexdigest()\n"""],
    ["""import sqlite3\nfrom hashlib import sha256\nimport hmac, secrets\n\ndef get_user(username):\n    conn = sqlite3.connect('users.db')\n    conn.execute("SELECT * FROM users WHERE username = ?", (username,))\n    return conn.fetchone()\n"""],
]

with gr.Blocks(
    title="Code Security Risk Analyzer v2",
    theme=gr.themes.Soft(),
    css=".gradio-container { max-width: 1200px; margin: auto; }",
) as demo:
    gr.Markdown("""
    # 🔒 AI-Powered Code Security Risk Analyzer v2
    ### Detect OWASP Top 10 & CWE vulnerabilities with calibrated confidence + per-class thresholds

    Paste code in Python, JavaScript, Java, C, C++, PHP, or Go.

    **Models:** [GraphCodeBERT](https://huggingface.co/ayshajavd/graphcodebert-vuln-classifier) (detection, Macro F1=0.476) + [CodeT5+](https://huggingface.co/ayshajavd/codet5p-vuln-fixer) (fixes, BLEU=81.0) | **Dataset:** [175K samples](https://huggingface.co/datasets/ayshajavd/code-security-vulnerability-dataset)

    **v2 Improvements:** Per-class threshold optimization | Temperature-calibrated probabilities | Asymmetric Loss training | GraphCodeBERT-base (125M params) | CodeT5+ 220M CWE-aware fixer
    """)

    with gr.Row():
        with gr.Column(scale=1):
            code_input = gr.Code(label="Paste Your Code Here", language="python", lines=20)
            with gr.Row():
                analyze_btn = gr.Button("🔍 Analyze Security", variant="primary", size="lg")
                json_btn = gr.Button("📋 JSON Report", variant="secondary", size="lg")
        with gr.Column(scale=1):
            report_output = gr.Markdown(label="Security Report")
            json_output = gr.JSON(label="JSON Report", visible=False)

    gr.Examples(examples=EXAMPLES, inputs=[code_input], label="Example Code Snippets")

    def show_json(code):
        return gr.update(visible=True, value=get_json_report(code))

    analyze_btn.click(fn=analyze_code, inputs=[code_input], outputs=[report_output], api_name="analyze")
    json_btn.click(fn=show_json, inputs=[code_input], outputs=[json_output])

    with gr.Row(visible=False):
        api_json_btn = gr.Button("get_json", visible=False)
        api_json_btn.click(fn=get_json_report, inputs=[code_input], outputs=[json_output], api_name="get_json_report")

    with gr.Accordion("🌐 REST API Documentation", open=False):
        gr.Markdown("""
### Python Client
```python
from gradio_client import Client
client = Client("ayshajavd/code-security-analyzer")
report = client.predict(code="your code here", api_name="/analyze")
json_report = client.predict(code="your code here", api_name="/get_json_report")
```

### cURL
```bash
curl -X POST https://ayshajavd-code-security-analyzer.hf.space/call/analyze \\
  -H "Content-Type: application/json" -d '{"data": ["your code here"]}'
```
        """)

    gr.Markdown("""
---
### 30 CWE Vulnerability Classes → OWASP Top 10

| OWASP Category | CWEs |
|---|---|
| **A01: Broken Access Control** | CWE-22, 200, 264, 269, 276, 284, 352, 601 |
| **A02: Cryptographic Failures** | CWE-310, 327, 330 |
| **A03: Injection** | CWE-20, 78, 79, 89, 94, 119, 125, 190, 401, 416, 476, 787 |
| **A04: Insecure Design** | CWE-362, 399, 434 |
| **A07: Auth Failures** | CWE-287, 798 |
| **A08: Integrity Failures** | CWE-502 |
| **A10: SSRF** | CWE-918 |
    """)

if __name__ == "__main__":
    demo.launch()