trapline 0.1.0

data/lib/trapline/templates/cwe/cwe-327.yml

@@ -0,0 +1,124 @@
+cwe: CWE-327
+name: "Use of a Broken or Risky Cryptographic Algorithm"
+title: Weak cryptography
+owasp: ["A02:2021 - Cryptographic Failures"]
+keywords: ["weak cryptograph", "broken cryptograph", "md5", "sha1", "sha-1", "des", "rc4", "ecb mode", "weak hash", "weak cipher"]
+message: >-
+  A broken or weak cryptographic algorithm is used. Use SHA-256 or better for
+  hashing (bcrypt/argon2 for passwords) and AES-GCM for encryption.
+languages:
+  ruby:
+    rule: |
+      pattern-either:
+        - pattern: Digest::MD5.$FN(...)
+        - pattern: Digest::SHA1.$FN(...)
+        - pattern: OpenSSL::Digest::MD5.new(...)
+        - pattern: OpenSSL::Digest::SHA1.new(...)
+        - patterns:
+            - pattern-either:
+                - pattern: OpenSSL::Digest.new($ALG, ...)
+                - pattern: OpenSSL::Cipher.new($ALG, ...)
+            - metavariable-regex:
+                metavariable: $ALG
+                regex: (?i).*(md5|sha1|\bdes\b|des-|rc4|-ecb)
+    test: |
+      # ruleid: __RULE_ID__
+      token = Digest::MD5.hexdigest(secret)
+      # ruleid: __RULE_ID__
+      cipher = OpenSSL::Cipher.new("des-ede3-cbc")
+      # ok: __RULE_ID__
+      token = Digest::SHA256.hexdigest(secret)
+      # ok: __RULE_ID__
+      cipher = OpenSSL::Cipher.new("aes-256-gcm")
+  python:
+    rule: |
+      pattern-either:
+        - pattern: hashlib.md5(...)
+        - pattern: hashlib.sha1(...)
+        - pattern: Crypto.Cipher.DES.new(...)
+        - pattern: Crypto.Cipher.ARC4.new(...)
+        - pattern: Cryptodome.Cipher.DES.new(...)
+        - patterns:
+            - pattern: hashlib.new($ALG, ...)
+            - metavariable-regex:
+                metavariable: $ALG
+                regex: (?i).*(md5|sha1|md4)
+    test: |
+      import hashlib
+
+      # ruleid: __RULE_ID__
+      digest = hashlib.md5(data).hexdigest()
+      # ruleid: __RULE_ID__
+      digest = hashlib.new("sha1", data).hexdigest()
+      # ok: __RULE_ID__
+      digest = hashlib.sha256(data).hexdigest()
+  javascript:
+    rule: |
+      patterns:
+        - pattern-either:
+            - pattern: crypto.createHash($ALG)
+            - pattern: crypto.createCipheriv($ALG, ...)
+            - pattern: crypto.createCipher($ALG, ...)
+            - pattern: require("crypto").createHash($ALG)
+        - metavariable-regex:
+            metavariable: $ALG
+            regex: (?i).*(md5|md4|sha1|\bdes\b|des-|rc4|-ecb)
+    test: |
+      const crypto = require("crypto");
+
+      // ruleid: __RULE_ID__
+      const h = crypto.createHash("md5").update(data).digest("hex");
+      // ok: __RULE_ID__
+      const s = crypto.createHash("sha256").update(data).digest("hex");
+  java:
+    rule: |
+      patterns:
+        - pattern-either:
+            - pattern: MessageDigest.getInstance($ALG, ...)
+            - pattern: Cipher.getInstance($ALG, ...)
+        - metavariable-regex:
+            metavariable: $ALG
+            regex: (?i).*("md5"|"md4"|"sha-?1"|"des|"rc4|/ecb/|"aes")
+    test: |
+      import java.security.MessageDigest;
+      import javax.crypto.Cipher;
+
+      public class Hashing {
+          public void run() throws Exception {
+              // ruleid: __RULE_ID__
+              MessageDigest md = MessageDigest.getInstance("MD5");
+              // ruleid: __RULE_ID__
+              Cipher c = Cipher.getInstance("DES/CBC/PKCS5Padding");
+              // ruleid: __RULE_ID__
+              Cipher e = Cipher.getInstance("AES/ECB/PKCS5Padding");
+              // ok: __RULE_ID__
+              MessageDigest ok = MessageDigest.getInstance("SHA-256");
+              // ok: __RULE_ID__
+              Cipher g = Cipher.getInstance("AES/GCM/NoPadding");
+          }
+      }
+  go:
+    rule: |
+      pattern-either:
+        - pattern: md5.New()
+        - pattern: md5.Sum(...)
+        - pattern: sha1.New()
+        - pattern: sha1.Sum(...)
+        - pattern: des.NewCipher(...)
+        - pattern: des.NewTripleDESCipher(...)
+        - pattern: rc4.NewCipher(...)
+    test: |
+      package main
+
+      import (
+      	"crypto/md5"
+      	"crypto/sha256"
+      )
+
+      func digest(data []byte) {
+      	// ruleid: __RULE_ID__
+      	a := md5.Sum(data)
+      	// ok: __RULE_ID__
+      	b := sha256.Sum256(data)
+      	_, _ = a, b
+      }

data/lib/trapline/templates/cwe/cwe-502.yml

@@ -0,0 +1,123 @@
+cwe: CWE-502
+name: "Deserialization of Untrusted Data"
+title: Insecure deserialization
+owasp: ["A08:2021 - Software and Data Integrity Failures"]
+keywords: ["deserialization", "deserialize", "unserialize", "untrusted data", "gadget chain", "object injection", "pickle", "marshal"]
+message: >-
+  Untrusted data is deserialized with a format that can instantiate arbitrary
+  objects, which can lead to remote code execution. Use a data-only format
+  (JSON) or a safe loader.
+languages:
+  ruby:
+    rule: |
+      mode: taint
+      pattern-sources:
+        - pattern: params
+        - pattern: cookies
+        - pattern: request.body
+        - pattern: request.raw_post
+      pattern-sinks:
+        - pattern: Marshal.load(...)
+        - pattern: Marshal.restore(...)
+        - pattern: YAML.unsafe_load(...)
+        - pattern: Psych.unsafe_load(...)
+        - pattern: Oj.load(...)
+    test: |
+      class SessionsController < ApplicationController
+        def restore
+          # ruleid: __RULE_ID__
+          state = Marshal.load(Base64.decode64(cookies[:state]))
+          # ruleid: __RULE_ID__
+          config = YAML.unsafe_load(request.body.read)
+          # ok: __RULE_ID__
+          state = JSON.parse(Base64.decode64(cookies[:state]))
+        end
+      end
+  python:
+    rule: |
+      mode: taint
+      pattern-sources:
+        - pattern: flask.request.$ANY
+        - patterns:
+            - pattern-inside: |
+                def $VIEW(request, ...):
+                  ...
+            - pattern: request.$ANY
+      pattern-sinks:
+        - pattern: pickle.loads(...)
+        - pattern: pickle.load(...)
+        - pattern: cPickle.loads(...)
+        - pattern: dill.loads(...)
+        - pattern: marshal.loads(...)
+        - pattern: jsonpickle.decode(...)
+        - pattern: yaml.unsafe_load(...)
+        - pattern: yaml.load(..., Loader=yaml.Loader, ...)
+        - pattern: yaml.load(..., Loader=yaml.UnsafeLoader, ...)
+        - patterns:
+            - pattern: yaml.load($DATA)
+            - focus-metavariable: $DATA
+    test: |
+      import base64
+      import json
+      import pickle
+      import yaml
+      from flask import request
+
+      def restore():
+          raw = base64.b64decode(request.cookies.get("state"))
+          # ruleid: __RULE_ID__
+          state = pickle.loads(raw)
+          # ruleid: __RULE_ID__
+          config = yaml.load(request.data, Loader=yaml.Loader)
+          # ok: __RULE_ID__
+          config = yaml.safe_load(request.data)
+          # ok: __RULE_ID__
+          state = json.loads(raw)
+  javascript:
+    rule: |
+      mode: taint
+      pattern-sources:
+        - pattern: $REQ.query
+        - pattern: $REQ.body
+        - pattern: $REQ.params
+        - pattern: $REQ.cookies
+      pattern-sinks:
+        - pattern: $SER.unserialize(...)
+        - pattern: require("node-serialize").unserialize(...)
+        - pattern: $FUNSTER.deepDeserialize(...)
+    test: |
+      const serialize = require("node-serialize");
+
+      app.post("/restore", (req, res) => {
+        // ruleid: __RULE_ID__
+        const state = serialize.unserialize(Buffer.from(req.cookies.state, "base64").toString());
+        // ok: __RULE_ID__
+        const safe = JSON.parse(Buffer.from(req.cookies.state, "base64").toString());
+        res.json(safe);
+      });
+  java:
+    rule: |
+      mode: taint
+      pattern-sources:
+        - pattern: (javax.servlet.http.HttpServletRequest $REQ).$GET(...)
+        - pattern: (jakarta.servlet.http.HttpServletRequest $REQ).$GET(...)
+      pattern-sinks:
+        - pattern: new ObjectInputStream(...)
+        - pattern: new java.beans.XMLDecoder(...)
+        - pattern: new XMLDecoder(...)
+        - pattern: (com.thoughtworks.xstream.XStream $X).fromXML(...)
+        - pattern: (XStream $X).fromXML(...)
+    test: |
+      import javax.servlet.http.HttpServletRequest;
+      import java.io.ObjectInputStream;
+      import com.fasterxml.jackson.databind.ObjectMapper;
+
+      public class RestoreServlet {
+          public void doPost(HttpServletRequest request) throws Exception {
+              // ruleid: __RULE_ID__
+              ObjectInputStream in = new ObjectInputStream(request.getInputStream());
+              Object state = in.readObject();
+              // ok: __RULE_ID__
+              Object safe = new ObjectMapper().readTree(request.getInputStream());
+          }
+      }

data/lib/trapline/templates/cwe/cwe-601.yml

@@ -0,0 +1,124 @@
+cwe: CWE-601
+name: "URL Redirection to Untrusted Site ('Open Redirect')"
+title: Open redirect
+owasp: ["A01:2021 - Broken Access Control"]
+keywords: ["open redirect", "url redirection", "redirect to arbitrary", "untrusted site"]
+message: >-
+  The application redirects to a URL taken from the request (open redirect).
+  Redirect only to relative paths or to an allowlist of hosts.
+languages:
+  ruby:
+    rule: |
+      mode: taint
+      pattern-sources:
+        - pattern: params
+        - pattern: cookies
+        - pattern: request.referer
+      pattern-sinks:
+        - patterns:
+            - pattern: redirect_to($U, ...)
+            - pattern-not: "redirect_to($U, ..., allow_other_host: false, ...)"
+            - focus-metavariable: $U
+    test: |
+      class SessionsController < ApplicationController
+        def create
+          # ruleid: __RULE_ID__
+          redirect_to params[:return_to]
+          # ok: __RULE_ID__
+          redirect_to params[:return_to], allow_other_host: false
+          # ok: __RULE_ID__
+          redirect_to root_path
+        end
+      end
+  python:
+    rule: |
+      mode: taint
+      pattern-sources:
+        - pattern: flask.request.$ANY
+        - patterns:
+            - pattern-inside: |
+                def $VIEW(request, ...):
+                  ...
+            - pattern: request.$ANY
+      pattern-sanitizers:
+        - pattern: url_has_allowed_host_and_scheme(...)
+      pattern-sinks:
+        - pattern: flask.redirect(...)
+        - pattern: django.shortcuts.redirect(...)
+        - pattern: django.http.HttpResponseRedirect(...)
+    test: |
+      from flask import request, redirect, url_for
+
+      def login():
+          # ruleid: __RULE_ID__
+          return redirect(request.args.get("next"))
+
+      def logout():
+          # ok: __RULE_ID__
+          return redirect(url_for("index"))
+  javascript:
+    rule: |
+      mode: taint
+      pattern-sources:
+        - pattern: $REQ.query
+        - pattern: $REQ.body
+        - pattern: $REQ.params
+      pattern-sinks:
+        - patterns:
+            - pattern-either:
+                - pattern: $RES.redirect($U)
+                - pattern: $RES.redirect($STATUS, $U)
+            - focus-metavariable: $U
+    test: |
+      app.get("/login", (req, res) => {
+        // ruleid: __RULE_ID__
+        res.redirect(req.query.next);
+      });
+
+      app.get("/logout", (req, res) => {
+        // ok: __RULE_ID__
+        res.redirect("/");
+      });
+  java:
+    rule: |
+      mode: taint
+      pattern-sources:
+        - pattern: (javax.servlet.http.HttpServletRequest $REQ).$GET(...)
+        - pattern: (jakarta.servlet.http.HttpServletRequest $REQ).$GET(...)
+      pattern-sinks:
+        - pattern: (javax.servlet.http.HttpServletResponse $RESP).sendRedirect(...)
+        - pattern: (jakarta.servlet.http.HttpServletResponse $RESP).sendRedirect(...)
+    test: |
+      import javax.servlet.http.HttpServletRequest;
+      import javax.servlet.http.HttpServletResponse;
+
+      public class LoginServlet {
+          public void doGet(HttpServletRequest request, HttpServletResponse response) throws Exception {
+              // ruleid: __RULE_ID__
+              response.sendRedirect(request.getParameter("next"));
+              // ok: __RULE_ID__
+              response.sendRedirect("/home");
+          }
+      }
+  go:
+    rule: |
+      mode: taint
+      pattern-sources:
+        - pattern: '($R : *http.Request).URL.Query().Get(...)'
+        - pattern: '($R : *http.Request).FormValue(...)'
+      pattern-sinks:
+        - patterns:
+            - pattern: http.Redirect($W, $REQ, $U, ...)
+            - focus-metavariable: $U
+    test: |
+      package main
+
+      import "net/http"
+
+      func login(w http.ResponseWriter, r *http.Request) {
+      	next := r.URL.Query().Get("next")
+      	// ruleid: __RULE_ID__
+      	http.Redirect(w, r, next, http.StatusFound)
+      	// ok: __RULE_ID__
+      	http.Redirect(w, r, "/home", http.StatusFound)
+      }

data/lib/trapline/templates/cwe/cwe-611.yml

@@ -0,0 +1,87 @@
+cwe: CWE-611
+name: "Improper Restriction of XML External Entity Reference"
+title: XML external entities (XXE)
+owasp: ["A05:2021 - Security Misconfiguration"]
+keywords: ["xml external entity", "xxe", "external entities", "dtd"]
+message: >-
+  The XML parser is created without disabling DTDs/external entities, which
+  allows XXE attacks. Disable doctype declarations or external entity
+  resolution before parsing.
+languages:
+  java:
+    rule: |
+      patterns:
+        - pattern-either:
+            - pattern-inside: |
+                $F = DocumentBuilderFactory.newInstance();
+                ...
+            - pattern-inside: |
+                $F = SAXParserFactory.newInstance();
+                ...
+            - pattern-inside: |
+                $F = XMLInputFactory.newInstance();
+                ...
+        - pattern-not-inside: |
+            $F = $FACTORY.newInstance();
+            ...
+            $F.setFeature("http://apache.org/xml/features/disallow-doctype-decl", true);
+            ...
+        - pattern-not-inside: |
+            $F = $FACTORY.newInstance();
+            ...
+            $F.setProperty(XMLInputFactory.SUPPORT_DTD, false);
+            ...
+        - pattern-either:
+            - pattern: $F.newDocumentBuilder()
+            - pattern: $F.newSAXParser()
+            - pattern: $F.createXMLStreamReader(...)
+    test: |
+      import javax.xml.parsers.DocumentBuilder;
+      import javax.xml.parsers.DocumentBuilderFactory;
+
+      public class XmlParser {
+          public void unsafe() throws Exception {
+              DocumentBuilderFactory dbf = DocumentBuilderFactory.newInstance();
+              // ruleid: __RULE_ID__
+              DocumentBuilder db = dbf.newDocumentBuilder();
+          }
+
+          public void safe() throws Exception {
+              DocumentBuilderFactory dbf = DocumentBuilderFactory.newInstance();
+              dbf.setFeature("http://apache.org/xml/features/disallow-doctype-decl", true);
+              // ok: __RULE_ID__
+              DocumentBuilder db = dbf.newDocumentBuilder();
+          }
+      }
+  python:
+    rule: |
+      pattern-either:
+        - pattern: lxml.etree.XMLParser(..., resolve_entities=True, ...)
+        - pattern: xml.sax.make_parser(...)
+        - pattern: xml.dom.pulldom.parse(...)
+    test: |
+      from lxml import etree
+      import defusedxml.ElementTree as SafeET
+
+      # ruleid: __RULE_ID__
+      parser = etree.XMLParser(resolve_entities=True)
+      # ok: __RULE_ID__
+      parser = etree.XMLParser(resolve_entities=False, no_network=True)
+      # ok: __RULE_ID__
+      tree = SafeET.fromstring("<a/>")
+  ruby:
+    rule: |
+      pattern-either:
+        - pattern: Nokogiri::XML(..., Nokogiri::XML::ParseOptions::NOENT, ...)
+        - pattern: Nokogiri::XML(..., Nokogiri::XML::ParseOptions::DTDLOAD, ...)
+        - pattern: $CFG.noent
+        - pattern: $CFG.dtdload
+    test: |
+      class ImportController < ApplicationController
+        def create
+          # ruleid: __RULE_ID__
+          doc = Nokogiri::XML(request.body.read) { |config| config.noent }
+          # ok: __RULE_ID__
+          doc = Nokogiri::XML(request.body.read) { |config| config.nonet }
+        end
+      end

data/lib/trapline/templates/cwe/cwe-78.yml

@@ -0,0 +1,166 @@
+cwe: CWE-78
+name: "Improper Neutralization of Special Elements used in an OS Command ('OS Command Injection')"
+title: OS command injection
+owasp: ["A03:2021 - Injection"]
+keywords: ["command injection", "os command", "shell command", "shell metacharacters", "arbitrary command"]
+message: >-
+  Untrusted input reaches a shell command. Pass arguments as a list (no shell)
+  and validate them against an allowlist.
+languages:
+  ruby:
+    rule: |
+      mode: taint
+      pattern-sources:
+        - pattern: params
+        - pattern: cookies
+      pattern-sanitizers:
+        - pattern: Shellwords.escape(...)
+        - pattern: $X.shellescape
+      pattern-sinks:
+        - patterns:
+            - pattern-either:
+                - pattern: system($CMD)
+                - pattern: exec($CMD)
+                - pattern: spawn($CMD)
+                - pattern: Kernel.system($CMD)
+                - pattern: IO.popen($CMD, ...)
+                - pattern: Open3.$FN($CMD)
+                - pattern: "`...`"
+            - focus-metavariable: $CMD
+        - pattern: "`...`"
+    test: |
+      class ToolsController < ApplicationController
+        def ping
+          # ruleid: __RULE_ID__
+          system("ping -c 1 #{params[:host]}")
+          # ruleid: __RULE_ID__
+          out = `nslookup #{params[:host]}`
+          # ok: __RULE_ID__
+          system("ping", "-c", "1", params[:host])
+          # ok: __RULE_ID__
+          system("ping -c 1 #{Shellwords.escape(params[:host])}")
+        end
+      end
+  python:
+    rule: |
+      mode: taint
+      pattern-sources:
+        - pattern: flask.request.$ANY
+        - patterns:
+            - pattern-inside: |
+                def $VIEW(request, ...):
+                  ...
+            - pattern: request.$ANY
+      pattern-sanitizers:
+        - pattern: shlex.quote(...)
+      pattern-sinks:
+        - pattern: os.system(...)
+        - pattern: os.popen(...)
+        - patterns:
+            - pattern-either:
+                - pattern: subprocess.$FN($CMD, ..., shell=True, ...)
+            - focus-metavariable: $CMD
+    test: |
+      import os
+      import shlex
+      import subprocess
+      from flask import request
+
+      def ping():
+          host = request.args.get("host")
+          # ruleid: __RULE_ID__
+          os.system("ping -c 1 " + host)
+          # ruleid: __RULE_ID__
+          subprocess.run("ping -c 1 " + host, shell=True)
+          # ok: __RULE_ID__
+          subprocess.run(["ping", "-c", "1", host])
+          # ok: __RULE_ID__
+          os.system("ping -c 1 " + shlex.quote(host))
+  javascript:
+    rule: |
+      mode: taint
+      pattern-sources:
+        - pattern: $REQ.query
+        - pattern: $REQ.body
+        - pattern: $REQ.params
+      pattern-sinks:
+        - patterns:
+            - pattern-either:
+                - pattern: $CP.exec($CMD, ...)
+                - pattern: $CP.execSync($CMD, ...)
+                - pattern: exec($CMD, ...)
+                - pattern: execSync($CMD, ...)
+                - pattern: '$CP.spawn($CMD, ..., {..., shell: true, ...})'
+            - focus-metavariable: $CMD
+    test: |
+      const { exec, execFile } = require("child_process");
+
+      app.get("/ping", (req, res) => {
+        // ruleid: __RULE_ID__
+        exec("ping -c 1 " + req.query.host, (err, out) => res.send(out));
+        // ok: __RULE_ID__
+        execFile("ping", ["-c", "1", req.query.host], (err, out) => res.send(out));
+      });
+  java:
+    rule: |
+      mode: taint
+      pattern-sources:
+        - pattern: (javax.servlet.http.HttpServletRequest $REQ).$GET(...)
+        - pattern: (jakarta.servlet.http.HttpServletRequest $REQ).$GET(...)
+        - patterns:
+            - pattern-inside: |
+                $RET $METHOD(..., @RequestParam $T $P, ...) { ... }
+            - pattern: $P
+      pattern-sinks:
+        - patterns:
+            - pattern-either:
+                - pattern: (Runtime $RT).exec($CMD, ...)
+                - pattern: Runtime.getRuntime().exec($CMD, ...)
+                - pattern: new ProcessBuilder("sh", "-c", $CMD)
+                - pattern: new ProcessBuilder("bash", "-c", $CMD)
+                - pattern: new ProcessBuilder("cmd.exe", "/c", $CMD)
+            - focus-metavariable: $CMD
+    test: |
+      import javax.servlet.http.HttpServletRequest;
+
+      public class PingServlet {
+          public void ping(HttpServletRequest request) throws Exception {
+              String host = request.getParameter("host");
+              // ruleid: __RULE_ID__
+              Runtime.getRuntime().exec("ping -c 1 " + host);
+              // ruleid: __RULE_ID__
+              new ProcessBuilder("sh", "-c", "ping -c 1 " + host).start();
+              // ok: __RULE_ID__
+              new ProcessBuilder("ping", "-c", "1", host).start();
+          }
+      }
+  go:
+    rule: |
+      mode: taint
+      pattern-sources:
+        - pattern: '($R : *http.Request).URL.Query().Get(...)'
+        - pattern: '($R : *http.Request).FormValue(...)'
+        - pattern: '($R : *http.Request).PostFormValue(...)'
+      pattern-sinks:
+        - patterns:
+            - pattern-either:
+                - pattern: exec.Command("sh", "-c", $CMD)
+                - pattern: exec.Command("bash", "-c", $CMD)
+                - pattern: exec.CommandContext($CTX, "sh", "-c", $CMD)
+                - pattern: exec.CommandContext($CTX, "bash", "-c", $CMD)
+            - focus-metavariable: $CMD
+    test: |
+      package main
+
+      import (
+      	"net/http"
+      	"os/exec"
+      )
+
+      func ping(w http.ResponseWriter, r *http.Request) {
+      	host := r.URL.Query().Get("host")
+      	// ruleid: __RULE_ID__
+      	exec.Command("sh", "-c", "ping -c 1 "+host).Run()
+      	// ok: __RULE_ID__
+      	exec.Command("ping", "-c", "1", host).Run()
+      }