{"id":25252830,"url":"https://github.com/ky0tofu/mirror-flowers","last_synced_at":"2025-04-07T05:08:20.026Z","repository":{"id":275932071,"uuid":"927655999","full_name":"Ky0toFu/Mirror-Flowers","owner":"Ky0toFu","description":"基于 AI 的代码安全审计工具，支持多种编程语言的代码分析，可以帮助开发者快速发现代码中的潜在安全漏洞。支持DeepSeek-R1，ChatGPT-4o等多种大模型。","archived":false,"fork":false,"pushed_at":"2025-02-17T06:38:34.000Z","size":2713,"stargazers_count":178,"open_issues_count":9,"forks_count":32,"subscribers_count":4,"default_branch":"main","last_synced_at":"2025-04-07T05:07:52.351Z","etag":null,"topics":["ai","ai-code-audit","chatgpt","code-audit","cybersecurity","deepseek","mirror-flowers","multilingual-support","openai","openai-api","security","security-analysis","vulnerability-detection"],"latest_commit_sha":null,"homepage":"","language":"Python","has_issues":true,"has_wiki":null,"has_pages":null,"mirror_url":null,"source_name":null,"license":null,"status":null,"scm":"git","pull_requests_enabled":true,"icon_url":"https://github.com/Ky0toFu.png","metadata":{"files":{"readme":"README.MD","changelog":null,"contributing":null,"funding":null,"license":null,"code_of_conduct":null,"threat_model":null,"audit":null,"citation":null,"codeowners":null,"security":null,"support":null,"governance":null,"roadmap":null,"authors":null,"dei":null,"publiccode":null,"codemeta":null}},"created_at":"2025-02-05T10:19:28.000Z","updated_at":"2025-04-03T09:31:31.000Z","dependencies_parsed_at":"2025-02-05T11:27:02.081Z","dependency_job_id":"52f26e18-621e-4e52-b119-fd43a13c1f87","html_url":"https://github.com/Ky0toFu/Mirror-Flowers","commit_stats":null,"previous_names":["ky0tofu/mirror-flowers"],"tags_count":0,"template":false,"template_full_name":null,"repository_url":"https://repos.ecosyste.ms/api/v1/hosts/GitHub/repositories/Ky0toFu%2FMirror-Flowers","tags_url":"https://repos.ecosyste.ms/api/v1/hosts/GitHub/repositories/Ky0toFu%2FMirror-Flowers/tags","releases_url":"https://repos.ecosyste.ms/api/v1/hosts/GitHub/repositories/Ky0toFu%2FMirror-Flowers/releases","manifests_url":"https://repos.ecosyste.ms/api/v1/hosts/GitHub/repositories/Ky0toFu%2FMirror-Flowers/manifests","owner_url":"https://repos.ecosyste.ms/api/v1/hosts/GitHub/owners/Ky0toFu","download_url":"https://codeload.github.com/Ky0toFu/Mirror-Flowers/tar.gz/refs/heads/main","host":{"name":"GitHub","url":"https://github.com","kind":"github","repositories_count":247595334,"owners_count":20963943,"icon_url":"https://github.com/github.png","version":null,"created_at":"2022-05-30T11:31:42.601Z","updated_at":"2022-07-04T15:15:14.044Z","host_url":"https://repos.ecosyste.ms/api/v1/hosts/GitHub","repositories_url":"https://repos.ecosyste.ms/api/v1/hosts/GitHub/repositories","repository_names_url":"https://repos.ecosyste.ms/api/v1/hosts/GitHub/repository_names","owners_url":"https://repos.ecosyste.ms/api/v1/hosts/GitHub/owners"}},"keywords":["ai","ai-code-audit","chatgpt","code-audit","cybersecurity","deepseek","mirror-flowers","multilingual-support","openai","openai-api","security","security-analysis","vulnerability-detection"],"created_at":"2025-02-12T04:18:43.146Z","updated_at":"2025-04-07T05:08:20.009Z","avatar_url":"https://github.com/Ky0toFu.png","language":"Python","funding_links":[],"categories":[],"sub_categories":[],"readme":"# Mirror Flowers (镜花)\r\n\r\n![image-20250205181045094](https://raw.githubusercontent.com/Ky0toFu/Mirror-Flowers/refs/heads/main/Mirror%20Flowers.png)\r\n\r\nMirrorFlower(镜花)是一款基于 AI 的代码安全审计工具，支持多种编程语言的代码分析，可以帮助开发者快速发现代码中的潜在安全漏洞。支持DeepSeek-R1，ChatGPT-4o等多种大模型。\r\n\r\n## 更新记录\r\n\r\n### 2024-02-11\r\n- 完善了Python代码分析功能：\r\n  - 添加了完整的依赖分析，支持追踪导入关系和别名\r\n  - 增强了函数调用分析，支持类方法和实例方法的调用追踪\r\n  - 添加了变量使用分析，支持追踪全局变量和实例变量\r\n  - 改进了类继承分析，支持多级继承路径分析\r\n- 优化了分析器架构：\r\n  - 使用访问者模式重构了代码分析逻辑\r\n  - 添加了类型提示和详细文档\r\n  - 改进了错误处理机制\r\n\r\n## 支持的API接口\r\n\r\nFREEGPTAPI：https://github.com/popjane/free_chatgpt_api\r\n\r\nSiliconFlow(硅基流动)：https://cloud.siliconflow.cn/i/JzMCyiJ3\r\n\r\n如需要使用GPT大模型则使用FREEGPTAPI，使用DeepSeek-R1大模型则使用SiliconFlow API。\r\n\r\nSiliconFlow(硅基流动)注册可免费领取14元使用额度，可通过SMS接码平台注册账号，理论可无限免费使用API KEY。\r\n\r\n## 核心功能\r\n\r\n### 多语言支持\r\n- PHP\r\n- Java\r\n- Python\r\n- JavaScript\r\n\r\n### 依赖分析\r\n- Maven (pom.xml)\r\n- NPM (package.json)\r\n- Python (requirements.txt)\r\n- Composer (composer.json)\r\n\r\n### 框架安全分析\r\n- Spring Framework\r\n  - Spring Security配置审计\r\n  - 权限控制检查\r\n  - CSRF/XSS防护\r\n  - 跨域配置检查\r\n\r\n- Django\r\n  - 中间件配置检查\r\n  - CSRF Token验证\r\n  - XSS防护配置\r\n  - 调试模式检查\r\n\r\n- Express.js\r\n  - 安全中间件配置\r\n  - 认证机制检查\r\n  - CORS配置审计\r\n  - 输入验证检查\r\n\r\n- Hibernate\r\n  - HQL注入检测\r\n  - 缓存配置审计\r\n  - 实体验证检查\r\n  - 会话管理检查\r\n\r\n### 安全检查特性\r\n\r\n#### PHP安全检查\r\n- 文件包含漏洞（include/require）\r\n- SQL注入（mysql_*函数）\r\n- 命令注入（system, exec, shell_exec）\r\n- 文件上传漏洞\r\n- 反序列化漏洞（unserialize）\r\n- XSS（echo, print）\r\n- SSRF漏洞\r\n- 目录遍历\r\n- 会话管理问题\r\n- 配置文件泄露\r\n\r\n#### Java安全检查\r\n- SQL注入（PreparedStatement相关）\r\n- 命令注入（Runtime.exec, ProcessBuilder）\r\n- XXE漏洞（XML解析器配置）\r\n- 反序列化漏洞（readObject）\r\n- 不安全的文件操作\r\n- CSRF/XSS防护\r\n- 权限控制缺陷\r\n- 线程安全问题\r\n- 密码学实现缺陷\r\n- 日志信息泄露\r\n\r\n#### Python安全检查\r\n- 不安全的反序列化（pickle.loads, yaml.load）\r\n- 命令注入（os.system, eval, exec, subprocess）\r\n- 不安全的模块导入（__import__）\r\n- SQL注入（字符串格式化, execute）\r\n- 路径遍历（open, os.path）\r\n- 模板注入（render_template_string）\r\n- 密码学实现问题（weak random）\r\n- 环境变量泄露\r\n- 调试配置泄露\r\n- 不安全的依赖加载\r\n\r\n#### JavaScript安全检查\r\n- XSS（DOM型和反射型）\r\n- 原型污染\r\n- 不安全的第三方依赖\r\n- 客户端存储安全\r\n- 不安全的随机数生成\r\n- CSRF防护缺失\r\n- 跨域配置问题\r\n- 敏感信息泄露\r\n- 不安全的正则表达式\r\n- 事件监听器泄露\r\n\r\n### 分析器组件\r\n- TaintAnalyzer: 污点分析和数据流追踪\r\n- SecurityAnalyzer: 通用安全问题检测\r\n- DependencyAnalyzer: 依赖组件安全分析\r\n- FrameworkAnalyzer: 框架特定安全检查\r\n- ConfigAnalyzer: 配置文件安全分析\r\n- ContextAnalyzer: 上下文感知分析\r\n\r\n## 安装和配置\r\n\r\n### 环境要求\r\n- Python 3.8+\r\n- FastAPI\r\n- Node.js (前端开发)\r\n\r\n### 快速开始\r\n\r\n1. 克隆项目\r\n```bash\r\ngit clone https://github.com/Ky0toFu/Mirror-Flowers.git\r\ncd Mirror-Flowers\r\n```\r\n\r\n2. 安装依赖\r\n```bash\r\npip install -r requirements.txt\r\n```\r\n\r\n3. 配置环境变量\r\n```env\r\nOPENAI_API_KEY=your_api_key_here\r\nOPENAI_API_BASE=your_api_base_url\r\nOPENAI_MODEL=your_preferred_model\r\n```\r\n\r\n4. 启动服务\r\n```bash\r\nuvicorn backend.app:app --reload\r\n```\r\n\r\n## 注意事项\r\n\r\n1. 文件大小限制：10MB\r\n2. 支持的文件类型：.php, .java, .py, .js\r\n3. API密钥安全：请妥善保管API密钥\r\n4. 分析时间：大型项目可能需要较长时间\r\n5. 结果验证：建议结合人工审查\r\n6. API配置问题：如果提示\"API配置更新错误\"或\"不存在某个模型\"，请检查API Base URL格式，尝试在URL后添加/v1或删除/v1（例如：https://api.example.com 或 https://api.example.com/v1）\r\n\r\n## 许可证\r\n\r\nMIT License\r\n\r\n## 联系方式\r\n\r\n如有问题或建议，请通过 Issue 与我联系。\r\n","project_url":"https://awesome.ecosyste.ms/api/v1/projects/github.com%2Fky0tofu%2Fmirror-flowers","html_url":"https://awesome.ecosyste.ms/projects/github.com%2Fky0tofu%2Fmirror-flowers","lists_url":"https://awesome.ecosyste.ms/api/v1/projects/github.com%2Fky0tofu%2Fmirror-flowers/lists"}