ARC/backend/app/sandbox/main.py

import subprocess
import json
import time
from fastapi import FastAPI
import logging

app = FastAPI()
logger = logging.getLogger(__name__)
SEMGREP_TIMEOUT = 300.0

@app.post("/scan/{repo_name}")
async def scan_repository(repo_name: str):
    repo_path = f"/src/{repo_name}"
    issues_list = []
    start_time = time.time()
    
    try:
        secure_command = f"ulimit -f 10240 && semgrep scan --config=p/r2c-security-audit --json --quiet {repo_path}"
        
        result = subprocess.run(
            secure_command,
            shell=True,
            capture_output=True,
            text=True,
            timeout=SEMGREP_TIMEOUT
        )
        
        duration = round(time.time() - start_time, 2)
        exit_code = result.returncode
        stderr_output = result.stderr
        timeout_triggered = False
        is_executable = True

    except subprocess.TimeoutExpired as te:
        logger.error(f"[Sandbox] Semgrep a dépassé le timeout sur {repo_name}")
        duration = round(time.time() - start_time, 2)
        exit_code = -1
        stderr_output = f"L'analyse statique a été coupée : Timeout de {SEMGREP_TIMEOUT}s dépassé."
        timeout_triggered = True
        is_executable = False
        return {
            "results": {
                "is_executable": is_executable,
                "runtime": {
                    "exit_code": exit_code,
                    "stdout": "",
                    "stderr": stderr_output,
                    "duration_seconds": duration,
                    "timeout_triggered": timeout_triggered
                },
                "issues": []
            }
        }
    
    try:
        if result.stdout.strip():
            scan_data = json.loads(result.stdout)
            for item in scan_data.get("results", []):
                issues_list.append({
                    "tool": "Semgrep",
                    "file": item.get("path", "").replace(f"{repo_path}/", ""),
                    "line": item.get("start", {}).get("line"),
                    "code": item.get("check_id"),
                    "severity": item.get("extra", {}).get("severity", "MEDIUM").upper(),
                    "message": item.get("extra", {}).get("message", "")
                })
        is_executable = True
        stderr_output = result.stderr
    except Exception as e:
        is_executable = False
        stderr_output = f"Erreur parsing JSON Semgrep: {str(e)}\n{result.stderr}"

    return {
        "results": {
            "is_executable": is_executable,
            "runtime": {
                "exit_code": exit_code,
                "stdout": "Scan statique universel effectué avec succès.",
                "stderr": stderr_output,
                "duration_seconds": duration,
                "timeout_triggered": timeout_triggered
            },
            "issues": issues_list
        }
    }