secscan 0.1.0

data/lib/secscan/report.rb

@@ -0,0 +1,249 @@
+# frozen_string_literal: true
+
+require "json"
+
+module Secscan
+  module Report
+    SARIF_SCHEMA = "https://raw.githubusercontent.com/oasis-tcs/sarif-spec/master/Schemata/sarif-schema-2.1.0.json"
+
+    module_function
+
+    def to_h(report, reveal_secrets: false)
+      {
+        "scanner" => report.scanner,
+        "version" => report.version,
+        "timestamp" => report.timestamp,
+        "target" => report.target,
+        "totalFiles" => report.total_files,
+        "scannedFilesCount" => report.scanned_files_count,
+        "ignoredFilesCount" => report.ignored_files_count,
+        "findings" => report.findings.map { |finding| finding_hash(finding, reveal_secrets) },
+        "apiEndpoints" => report.api_endpoints.map { |endpoint| endpoint_hash(endpoint) },
+        "metrics" => metrics_hash(report.metrics),
+        "durationMs" => report.duration_ms
+      }
+    end
+
+    def to_json(report, reveal_secrets: false)
+      JSON.pretty_generate(to_h(report, reveal_secrets: reveal_secrets))
+    end
+
+    def to_csv(report, reveal_secrets: false)
+      rows = [["ID", "Severity", "Rule Name", "Category", "File", "Line", "Column", "Entropy", "Masked Secret", "Remediation"]]
+      report.findings.each do |finding|
+        shown = reveal_secrets ? finding.matched_secret : finding.masked_secret
+        rows << [
+          finding.id, finding.severity, finding.rule_name, finding.category, finding.file,
+          finding.line, finding.column, finding.entropy, shown, finding.remediation
+        ]
+      end
+      rows.map { |row| row.map { |cell| csv_cell(cell) }.join(",") }.join("\n") + "\n"
+    end
+
+    def csv_cell(value)
+      text = value.to_s
+      return text unless text.match?(/[",\n]/)
+
+      "\"#{text.gsub('"', '""')}\""
+    end
+
+    def to_sarif(report, reveal_secrets: false)
+      rules = []
+      seen = {}
+      report.findings.each do |finding|
+        next if seen[finding.rule_id]
+
+        seen[finding.rule_id] = true
+        level = %w[CRITICAL HIGH].include?(finding.severity) ? "error" : "warning"
+        rules << {
+          "id" => finding.rule_id,
+          "name" => finding.rule_name,
+          "shortDescription" => { "text" => finding.description },
+          "help" => { "text" => finding.remediation },
+          "defaultConfiguration" => { "level" => level }
+        }
+      end
+
+      results = report.findings.map do |finding|
+        level = %w[CRITICAL HIGH].include?(finding.severity) ? "error" : "warning"
+        shown = reveal_secrets ? finding.matched_secret : finding.masked_secret
+        {
+          "ruleId" => finding.rule_id,
+          "level" => level,
+          "message" => { "text" => "#{finding.rule_name}. Value: #{shown}" },
+          "locations" => [
+            {
+              "physicalLocation" => {
+                "artifactLocation" => { "uri" => finding.file },
+                "region" => {
+                  "startLine" => finding.line,
+                  "startColumn" => finding.column,
+                  "snippet" => { "text" => finding.public_snippet(reveal_secrets) }
+                }
+              }
+            }
+          ]
+        }
+      end
+
+      JSON.pretty_generate(
+        "$schema" => SARIF_SCHEMA,
+        "version" => "2.1.0",
+        "runs" => [
+          {
+            "tool" => {
+              "driver" => {
+                "name" => "SecScan",
+                "semanticVersion" => report.version,
+                "informationUri" => "https://github.com/saulofilho/secscan",
+                "rules" => rules
+              }
+            },
+            "results" => results
+          }
+        ]
+      )
+    end
+
+    def to_markdown(report, reveal_secrets: false)
+      metrics = report.metrics
+      findings_md = if report.findings.empty?
+                      "_No secrets or sensitive routes found._"
+                    else
+                      report.findings.map { |finding| finding_markdown(finding, reveal_secrets) }.join("\n\n")
+                    end
+      routes = if report.api_endpoints.empty?
+                 "_No endpoints mapped._"
+               else
+                 report.api_endpoints.map do |item|
+                   suffix = item.is_internal_or_admin ? " **(sensitive)**" : ""
+                   "- `#{item.method}` `#{item.path}` in `#{item.file}:#{item.line}`#{suffix}"
+                 end.join("\n")
+               end
+
+      <<~MARKDOWN
+        # SecScan report
+
+        - **Target:** `#{report.target}`
+        - **When:** #{report.timestamp}
+        - **Files scanned:** #{report.scanned_files_count} (ignored: #{report.ignored_files_count})
+        - **Findings:** #{report.findings.length}
+        - **Security score:** #{metrics.security_score}/100
+        - **Impact score:** #{metrics.security_impact_score}/100 (#{metrics.impact_level})
+
+        ## Severity
+
+        | Severity | Count |
+        |---|---|
+        | CRITICAL | #{metrics.critical_count} |
+        | HIGH | #{metrics.high_count} |
+        | MEDIUM | #{metrics.medium_count} |
+        | LOW | #{metrics.low_count} |
+        | INFO | #{metrics.info_count} |
+
+        ## Findings
+
+        #{findings_md}
+
+        ## Endpoints (#{report.api_endpoints.length})
+
+        #{routes}
+      MARKDOWN
+    end
+
+    def to_table(report, reveal_secrets: false)
+      metrics = report.metrics
+      lines = [
+        "SecScan Static Security Analysis",
+        "Target: #{report.target} | Files: #{report.scanned_files_count} | Findings: #{report.findings.length} | #{report.duration_ms}ms",
+        "Impact: #{metrics.security_impact_score}/100 (#{metrics.impact_level}) | Security score: #{metrics.security_score}/100",
+        "-" * 72
+      ]
+      lines << "No exposed secrets or sensitive API paths detected." if report.findings.empty?
+      report.findings.each do |finding|
+        shown = reveal_secrets ? finding.matched_secret : finding.masked_secret
+        lines << format("%-8s [%s]", finding.severity, finding.rule_name)
+        lines << "  File:    #{finding.file}:#{finding.line}"
+        lines << "  Secret:  #{shown} (entropy #{finding.entropy})"
+        lines << "  Snippet: #{finding.public_snippet(reveal_secrets)}"
+        lines << "  Info:    #{finding.description}"
+        lines << ""
+      end
+      "#{lines.join("\n")}\n"
+    end
+
+    def render(report, format, reveal_secrets: false)
+      case format.to_s.downcase
+      when "json" then "#{to_json(report, reveal_secrets: reveal_secrets)}\n"
+      when "csv" then to_csv(report, reveal_secrets: reveal_secrets)
+      when "sarif" then "#{to_sarif(report, reveal_secrets: reveal_secrets)}\n"
+      when "markdown" then to_markdown(report, reveal_secrets: reveal_secrets)
+      when "table" then to_table(report, reveal_secrets: reveal_secrets)
+      else
+        raise InputError, "unknown format: #{format}"
+      end
+    end
+
+    def finding_hash(finding, reveal_secrets)
+      item = {
+        "id" => finding.id,
+        "ruleId" => finding.rule_id,
+        "ruleName" => finding.rule_name,
+        "category" => finding.category,
+        "severity" => finding.severity,
+        "file" => finding.file,
+        "line" => finding.line,
+        "column" => finding.column,
+        "snippet" => finding.public_snippet(reveal_secrets),
+        "maskedSecret" => finding.masked_secret,
+        "entropy" => finding.entropy,
+        "description" => finding.description,
+        "remediation" => finding.remediation,
+        "fileCriticality" => finding.file_criticality,
+        "fileCriticalityWeight" => finding.file_criticality_weight,
+        "weightedScore" => finding.weighted_score
+      }
+      item["matchedSecret"] = finding.matched_secret if reveal_secrets
+      item
+    end
+
+    def endpoint_hash(endpoint)
+      {
+        "id" => endpoint.id,
+        "file" => endpoint.file,
+        "line" => endpoint.line,
+        "method" => endpoint.method,
+        "path" => endpoint.path,
+        "isInternalOrAdmin" => endpoint.is_internal_or_admin,
+        "snippet" => endpoint.snippet
+      }
+    end
+
+    def metrics_hash(metrics)
+      {
+        "criticalCount" => metrics.critical_count,
+        "highCount" => metrics.high_count,
+        "mediumCount" => metrics.medium_count,
+        "lowCount" => metrics.low_count,
+        "infoCount" => metrics.info_count,
+        "securityScore" => metrics.security_score,
+        "securityImpactScore" => metrics.security_impact_score,
+        "impactLevel" => metrics.impact_level,
+        "totalWeightedRisk" => metrics.total_weighted_risk,
+        "averageEntropy" => metrics.average_entropy
+      }
+    end
+
+    def finding_markdown(finding, reveal_secrets)
+      shown = reveal_secrets ? finding.matched_secret : finding.masked_secret
+      <<~BLOCK.chomp
+        ### [#{finding.severity}] #{finding.rule_name}
+        - **File:** `#{finding.file}` (line #{finding.line})
+        - **Value:** `#{shown}`
+        - **Entropy:** #{finding.entropy}
+        - **Description:** #{finding.description}
+        - **Remediation:** #{finding.remediation}
+      BLOCK
+    end
+  end
+end

data/lib/secscan/rules.rb

@@ -0,0 +1,205 @@
+# frozen_string_literal: true
+
+module Secscan
+  SEVERITY_RANK = {
+    "INFO" => 0,
+    "LOW" => 1,
+    "MEDIUM" => 2,
+    "HIGH" => 3,
+    "CRITICAL" => 4
+  }.freeze
+
+  SEVERITY_BASE_WEIGHTS = {
+    "CRITICAL" => 25,
+    "HIGH" => 14,
+    "MEDIUM" => 7,
+    "LOW" => 3,
+    "INFO" => 1
+  }.freeze
+
+  FILE_CRITICALITY_MULTIPLIERS = {
+    "CRITICAL" => 2.0,
+    "HIGH" => 1.5,
+    "MEDIUM" => 1.0,
+    "LOW" => 0.5
+  }.freeze
+
+  Rule = Struct.new(
+    :id, :name, :pattern, :severity, :category, :description,
+    :remediation, :flags, :min_entropy, :enabled,
+    keyword_init: true
+  ) do
+    def initialize(**kwargs)
+      kwargs[:severity] = kwargs.fetch(:severity, "MEDIUM").to_s.upcase
+      kwargs[:category] ||= "CUSTOM"
+      kwargs[:description] ||= ""
+      kwargs[:remediation] ||= ""
+      kwargs[:flags] ||= "g"
+      kwargs[:enabled] = true if kwargs[:enabled].nil?
+      super
+      raise ArgumentError, "invalid severity #{severity} on rule #{id}" unless SEVERITY_RANK.key?(severity)
+    end
+  end
+
+  module DefaultRules
+    def self.build(id:, name:, pattern:, severity:, category:, description:, remediation:, flags: "g", min_entropy: nil)
+      Rule.new(
+        id: id,
+        name: name,
+        pattern: pattern,
+        severity: severity,
+        category: category,
+        description: description,
+        remediation: remediation,
+        flags: flags,
+        min_entropy: min_entropy
+      )
+    end
+
+    ALL = [
+      build(
+        id: "sec-aws-akid",
+        name: "AWS Access Key ID",
+        pattern: "\\b(A3T[A-Z0-9]|AKIA|AGPA|AIDA|AROA|AIPA|ANPA|ANVA|ASIA)[A-Z0-9]{16}\\b",
+        severity: "CRITICAL",
+        category: "CLOUD_CREDENTIAL",
+        description: "Chave de acesso pública da AWS encontrada hardcoded no código.",
+        remediation: "Utilize AWS IAM Roles, variáveis de ambiente ou AWS Secrets Manager.",
+        min_entropy: 3.5
+      ),
+      build(
+        id: "sec-aws-secret",
+        name: "AWS Secret Access Key",
+        pattern: "(?:aws_secret_access_key|aws_secret|aws_key)\\s*[:=]\\s*['\"][A-Za-z0-9/+=]{40}['\"]",
+        flags: "gi",
+        severity: "CRITICAL",
+        category: "CLOUD_CREDENTIAL",
+        description: "Segredo de autenticação da AWS exposto diretamente.",
+        remediation: "Rotacione a chave no console da AWS e migre para credenciais temporárias.",
+        min_entropy: 4.2
+      ),
+      build(
+        id: "sec-google-api",
+        name: "Google Cloud / Gemini API Key",
+        pattern: "\\bAIza[-0-9A-Za-z_]{35}\\b",
+        severity: "HIGH",
+        category: "API_KEY",
+        description: "Chave de API do Google Cloud ou Gemini exposta no código.",
+        remediation: "Restrinja a chave no Google Cloud Console ou mova a chamada para o servidor.",
+        min_entropy: 4.0
+      ),
+      build(
+        id: "sec-github-pat",
+        name: "GitHub Personal Access Token",
+        pattern: "\\b(?:ghp_[0-9a-zA-Z]{36}|gho_[0-9a-zA-Z]{36}|github_pat_[0-9a-zA-Z_]{82})\\b",
+        severity: "CRITICAL",
+        category: "AUTH_TOKEN",
+        description: "Token de acesso pessoal do GitHub exposto no repositório.",
+        remediation: "Revogue o token e armazene o valor como secret do CI.",
+        min_entropy: 4.1
+      ),
+      build(
+        id: "sec-stripe-secret",
+        name: "Stripe Secret API Key",
+        pattern: "\\b(?:sk|rk)_(?:live|test)_[0-9a-zA-Z]{24,99}\\b",
+        severity: "CRITICAL",
+        category: "API_KEY",
+        description: "Chave secreta ou restrita do Stripe exposta.",
+        remediation: "Rotacione a chave no painel do Stripe. Não envie chaves secretas ao frontend.",
+        min_entropy: 4.0
+      ),
+      build(
+        id: "sec-jwt-token",
+        name: "JSON Web Token (JWT)",
+        pattern: "\\beyJ[-_A-Za-z0-9=]+\\.[-_A-Za-z0-9=]+\\.[-+/=_A-Za-z0-9.]*\\b",
+        severity: "HIGH",
+        category: "AUTH_TOKEN",
+        description: "Token JWT estático embutido no código-fonte.",
+        remediation: "Substitua tokens estáticos por um fluxo de autenticação.",
+        min_entropy: 4.3
+      ),
+      build(
+        id: "sec-slack-webhook",
+        name: "Slack Incoming Webhook / Bot Token",
+        pattern: "https://hooks\\.slack\\.com/services/T[a-zA-Z0-9_]{8}/B[a-zA-Z0-9_]{8,12}/[a-zA-Z0-9_]{24}|xox[baprs]-[0-9]{10,13}-[0-9]{10,13}[a-zA-Z0-9-]*",
+        severity: "HIGH",
+        category: "AUTH_TOKEN",
+        description: "URL de webhook do Slack ou token de bot hardcoded.",
+        remediation: "Mova a URL ou o token para uma variável de ambiente.",
+        min_entropy: 3.8
+      ),
+      build(
+        id: "sec-private-key",
+        name: "RSA / OpenSSH Private Key",
+        pattern: "-----BEGIN (?:RSA|EC|OPENSSH|DSA|PGP|PRIVATE) KEY-----[\\s\\S]*?-----END (?:RSA|EC|OPENSSH|DSA|PGP|PRIVATE) KEY-----",
+        severity: "CRITICAL",
+        category: "PRIVATE_KEY",
+        description: "Chave criptográfica privada encontrada embutida no arquivo.",
+        remediation: "Remova a chave do controle de versão e carregue-a por um cofre ou agent."
+      ),
+      build(
+        id: "sec-db-uri",
+        name: "Database Connection URI with Credentials",
+        pattern: "(?:mongodb(?:\\+srv)?|postgres(?:ql)?|mysql|redis)://[^\\s:\"']+:[^\\s:\"']+@[^\\s:\"']+",
+        flags: "gi",
+        severity: "CRITICAL",
+        category: "DATABASE_URI",
+        description: "String de conexão com usuário e senha em texto claro.",
+        remediation: "Extraia as credenciais para uma variável de ambiente."
+      ),
+      build(
+        id: "sec-hardcoded-pass",
+        name: "Hardcoded Password Assignment",
+        pattern: "(?:password|passwd|pwd|db_pass|secret_key|client_secret)\\s*[:=]\\s*['\"][^'\"]{8,64}['\"]",
+        flags: "gi",
+        severity: "HIGH",
+        category: "PASSWORD",
+        description: "Atribuição de senha ou chave secreta fixa no código.",
+        remediation: "Injete o valor em tempo de execução por variável de ambiente.",
+        min_entropy: 3.2
+      ),
+      build(
+        id: "sec-openai-key",
+        name: "OpenAI API Secret Key",
+        pattern: "\\bsk-(?:proj-|live-)?[-_a-zA-Z0-9]{32,80}\\b",
+        severity: "CRITICAL",
+        category: "API_KEY",
+        description: "Chave secreta de API da OpenAI encontrada no código.",
+        remediation: "Revogue a chave e mantenha-a apenas no servidor.",
+        min_entropy: 4.1
+      ),
+      build(
+        id: "sec-sendgrid-key",
+        name: "SendGrid API Key",
+        pattern: "\\bSG\\.[-0-9A-Za-z_]{22}\\.[-0-9A-Za-z_]{43}\\b",
+        severity: "HIGH",
+        category: "API_KEY",
+        description: "Chave de envio de e-mails do SendGrid exposta.",
+        remediation: "Rotacione a chave e mova o valor para o ambiente do backend.",
+        min_entropy: 4.0
+      ),
+      build(
+        id: "sec-sensitive-api-path",
+        name: "Sensitive or Admin API Route",
+        pattern: "['\"](?:/api/v[0-9]+)?/(?:admin|internal|superadmin|debug|actuator|metrics|management|auth/token|users/export|billing/charge)[^\\s'\"]*['\"]",
+        flags: "gi",
+        severity: "MEDIUM",
+        category: "API_PATH",
+        description: "Rota de API administrativa ou sensível mapeada no código.",
+        remediation: "Exija autorização na rota e evite publicá-la em bundles sem controle de acesso."
+      ),
+      build(
+        id: "sec-api-endpoint",
+        name: "Hardcoded API Path / Endpoint",
+        pattern: "['\"](?:https?://[-.a-zA-Z0-9]+)?/(?:api|v1|v2|graphql|rest|webhook)/[-./_a-zA-Z0-9]+['\"]",
+        flags: "gi",
+        severity: "LOW",
+        category: "API_PATH",
+        description: "Endpoint ou caminho de API fixo no código.",
+        remediation: "Use uma URL base configurável por ambiente."
+      )
+    ].freeze
+  end
+
+  DEFAULT_RULES = DefaultRules::ALL
+end