#!/usr/bin/env bash
# CWE-407 scan — ExaBGP (Python BGP implementation)
# Network mode: semitrusted
set -euo pipefail
echo "# scan=exabgp host=$(hostname) date=$(date -u +%Y-%m-%dT%H:%M:%SZ)"

cd /tmp && git clone --depth 1 https://github.com/Exa-Networks/exabgp exabgp 2>&1 | tail -1

GRAPH_KW="loop|cycle|path|route|reachab|topolog|dfs\b|scc\b|visit"
PY_MEM="[^a-z]in (path|stack|visited|seen|queue|aspath|peers)\b|not in (path|stack|visited)\b|\.index\b|list\.append.*\bin "

echo "# roots: /tmp/exabgp/src"
find /tmp/exabgp/src -name "*.py" | sort | while IFS= read -r f; do
  gl=$(grep -inE "$GRAPH_KW" "$f" 2>/dev/null | cut -d: -f1 | head -5 || true)
  [ -z "$gl" ] && continue
  while IFS= read -r ln; do
    s=$(( ln > 20 ? ln - 20 : 1 )); e=$(( ln + 20 ))
    hit=$(sed -n "${s},${e}p" "$f" 2>/dev/null | grep -iE "$PY_MEM" | head -1 | sed 's/^\s*//' || true)
    [ -n "$hit" ] && echo "CANDIDATE	${f}:${ln}	${hit}"
  done <<< "$gl"
done
echo "# scan complete"