0xray 2.1.1 → 2.1.3

package/src/mcps/shared/security-scanner.ts

@@ -0,0 +1,599 @@
+/**
+ * 0xRay Framework - Security Scanner
+ *
+ * Automated security vulnerability scanning and compliance validation
+ * Integrates with security tools and provides comprehensive security reports
+ */
+
+import { exec } from "child_process";
+import { promises as fs } from "fs";
+import { frameworkLogger } from "../../core/framework-logger.js";
+import { promisify } from "util";
+import {
+  promptSecurityValidator,
+  PromptSecurityValidator,
+} from "./prompt-security-validator.js";
+
+const execAsync = promisify(exec);
+
+export interface SecurityScanConfig {
+  enabled: boolean;
+  tools: {
+    npmAudit: boolean;
+    trivy: boolean;
+    eslintSecurity: boolean;
+    dependencyCheck: boolean;
+  };
+  severityThreshold: "low" | "moderate" | "high" | "critical";
+  reportPath: string;
+  failOnVulnerabilities: boolean;
+}
+
+export interface SecurityVulnerability {
+  id: string;
+  title: string;
+  description: string;
+  severity: "low" | "moderate" | "high" | "critical";
+  package?: string;
+  version?: string;
+  cve?: string;
+  url?: string;
+  recommendation: string;
+}
+
+export interface SecurityReport {
+  timestamp: string;
+  duration: number;
+  tools: {
+    npmAudit: SecurityVulnerability[];
+    trivy: SecurityVulnerability[];
+    eslintSecurity: SecurityVulnerability[];
+    dependencyCheck: SecurityVulnerability[];
+  };
+  summary: {
+    totalVulnerabilities: number;
+    bySeverity: Record<string, number>;
+    byTool: Record<string, number>;
+  };
+  recommendations: string[];
+  compliant: boolean;
+}
+
+export class SecurityScanner {
+  private config: SecurityScanConfig;
+
+  constructor(config: Partial<SecurityScanConfig> = {}) {
+    this.config = {
+      enabled: true,
+      tools: {
+        npmAudit: true,
+        trivy: false, // Requires separate installation
+        eslintSecurity: true,
+        dependencyCheck: false, // Requires separate installation
+        ...config.tools,
+      },
+      severityThreshold: "moderate",
+      reportPath: "./security-report.json",
+      failOnVulnerabilities: true,
+      ...config,
+    };
+  }
+
+  /**
+   * Run comprehensive security scan
+   */
+  async runSecurityScan(): Promise<SecurityReport> {
+    const jobId = `security-scan-${Date.now()}-${Math.random().toString(36).substring(2, 11)}`;
+    const startTime = Date.now();
+
+    if (!this.config.enabled) {
+      return this.createEmptyReport();
+    }
+
+    frameworkLogger.log("security-scanner", "scan-start", "info", {
+      jobId,
+      tools: this.config.tools,
+      severityThreshold: this.config.severityThreshold,
+    });
+
+    const results = await Promise.allSettled([
+      this.config.tools.npmAudit ? this.runNpmAudit() : Promise.resolve([]),
+      this.config.tools.trivy ? this.runTrivyScan() : Promise.resolve([]),
+      this.config.tools.eslintSecurity
+        ? this.runEslintSecurity()
+        : Promise.resolve([]),
+      this.config.tools.dependencyCheck
+        ? this.runDependencyCheck()
+        : Promise.resolve([]),
+    ]);
+
+    const tools = {
+      npmAudit: results[0].status === "fulfilled" ? results[0].value : [],
+      trivy: results[1].status === "fulfilled" ? results[1].value : [],
+      eslintSecurity: results[2].status === "fulfilled" ? results[2].value : [],
+      dependencyCheck:
+        results[3].status === "fulfilled" ? results[3].value : [],
+    };
+
+    const duration = Date.now() - startTime;
+    const report = this.generateReport(tools, duration);
+
+    // Save report
+    await this.saveReport(report, jobId);
+
+    // Log results
+    await this.logResults(report);
+
+    return report;
+  }
+
+  /**
+   * Run npm audit
+   */
+  private async runNpmAudit(): Promise<SecurityVulnerability[]> {
+    try {
+      const { stdout } = await execAsync("npm audit --json");
+      const auditResult = JSON.parse(stdout);
+
+      const vulnerabilities: SecurityVulnerability[] = [];
+
+      if (auditResult.vulnerabilities) {
+        for (const [packageName, vuln] of Object.entries(
+          auditResult.vulnerabilities,
+        ) as any) {
+          vulnerabilities.push({
+            id: vuln.name || packageName,
+            title: vuln.title || "Security vulnerability",
+            description: vuln.overview || "No description available",
+            severity: this.mapNpmSeverity(vuln.severity),
+            package: packageName,
+            version: vuln.version,
+            cve: vuln.cwe,
+            url: vuln.url,
+            recommendation: vuln.recommendation || "Update to a secure version",
+          });
+        }
+      }
+
+      return vulnerabilities;
+    } catch (error) {
+      const errorMessage =
+        error instanceof Error ? error.message : String(error);
+      frameworkLogger.log("security-scanner", "npm-audit-failed", "warning", { message: "⚠️ npm audit failed", error: errorMessage });
+      return [];
+    }
+  }
+
+  /**
+   * Run Trivy security scan
+   */
+  private async runTrivyScan(): Promise<SecurityVulnerability[]> {
+    try {
+      const { stdout } = await execAsync("trivy fs --format json .");
+      const trivyResult = JSON.parse(stdout);
+
+      const vulnerabilities: SecurityVulnerability[] = [];
+
+      if (trivyResult.Results) {
+        for (const result of trivyResult.Results) {
+          if (result.Vulnerabilities) {
+            for (const vuln of result.Vulnerabilities) {
+              vulnerabilities.push({
+                id: vuln.VulnerabilityID,
+                title: vuln.Title,
+                description: vuln.Description,
+                severity: this.mapTrivySeverity(vuln.Severity),
+                package: vuln.PkgName,
+                version: vuln.InstalledVersion,
+                cve: vuln.VulnerabilityID,
+                url: vuln.PrimaryURL,
+                recommendation: vuln.FixedVersion
+                  ? `Update to ${vuln.FixedVersion}`
+                  : "Review and mitigate",
+              });
+            }
+          }
+        }
+      }
+
+      return vulnerabilities;
+    } catch (error) {
+      const errorMessage =
+        error instanceof Error ? error.message : String(error);
+      frameworkLogger.log("security-scanner", "trivy-scan-failed", "warning", { message: "⚠️ Trivy scan failed", error: errorMessage });
+      return [];
+    }
+  }
+
+  /**
+   * Run ESLint security rules
+   */
+  private async runEslintSecurity(): Promise<SecurityVulnerability[]> {
+    try {
+      const { stdout } = await execAsync("npx eslint --format json src/");
+      const eslintResults = JSON.parse(stdout);
+
+      const vulnerabilities: SecurityVulnerability[] = [];
+
+      for (const result of eslintResults) {
+        for (const message of result.messages) {
+          if (
+            message.ruleId &&
+            (message.ruleId.includes("security") ||
+              message.ruleId.includes("xss") ||
+              message.ruleId.includes("injection"))
+          ) {
+            vulnerabilities.push({
+              id: message.ruleId,
+              title: message.message,
+              description: `Security issue in ${result.filePath}:${message.line}:${message.column}`,
+              severity: "moderate",
+              recommendation:
+                "Fix the security vulnerability according to ESLint recommendations",
+            });
+          }
+        }
+      }
+
+      return vulnerabilities;
+    } catch (error) {
+      const errorMessage =
+        error instanceof Error ? error.message : String(error);
+      frameworkLogger.log("security-scanner", "eslint-scan-failed", "warning", { message: "⚠️ ESLint security scan failed", error: errorMessage });
+      return [];
+    }
+  }
+
+  /**
+   * Run OWASP Dependency Check
+   */
+  private async runDependencyCheck(): Promise<SecurityVulnerability[]> {
+    try {
+      const { stdout } = await execAsync(
+        "dependency-check --format JSON --out . --scan .",
+      );
+      const dcResult = JSON.parse(stdout);
+
+      const vulnerabilities: SecurityVulnerability[] = [];
+
+      if (dcResult.dependencies) {
+        for (const dep of dcResult.dependencies) {
+          if (dep.vulnerabilities) {
+            for (const vuln of dep.vulnerabilities) {
+              vulnerabilities.push({
+                id: vuln.name,
+                title: vuln.description,
+                description: vuln.description,
+                severity: this.mapDependencyCheckSeverity(vuln.severity),
+                package: dep.fileName,
+                cve: vuln.name,
+                url: vuln.references?.[0]?.url,
+                recommendation: "Update dependency or apply security patches",
+              });
+            }
+          }
+        }
+      }
+
+      return vulnerabilities;
+    } catch (error) {
+      const errorMessage =
+        error instanceof Error ? error.message : String(error);
+      frameworkLogger.log("security-scanner", "dependency-check-failed", "warning", { message: "⚠️ Dependency check failed", error: errorMessage });
+      return [];
+    }
+  }
+
+  /**
+   * Generate comprehensive security report
+   */
+  private generateReport(
+    tools: SecurityReport["tools"],
+    duration: number,
+  ): SecurityReport {
+    const allVulnerabilities = [
+      ...tools.npmAudit,
+      ...tools.trivy,
+      ...tools.eslintSecurity,
+      ...tools.dependencyCheck,
+    ];
+
+    const bySeverity = allVulnerabilities.reduce(
+      (acc, vuln) => {
+        acc[vuln.severity] = (acc[vuln.severity] || 0) + 1;
+        return acc;
+      },
+      {} as Record<string, number>,
+    );
+
+    const byTool = {
+      npmAudit: tools.npmAudit.length,
+      trivy: tools.trivy.length,
+      eslintSecurity: tools.eslintSecurity.length,
+      dependencyCheck: tools.dependencyCheck.length,
+    };
+
+    const highSeverityCount =
+      (bySeverity.high || 0) + (bySeverity.critical || 0);
+    const shouldFail =
+      this.config.failOnVulnerabilities &&
+      highSeverityCount > 0 &&
+      this.config.severityThreshold !== "low";
+
+    const recommendations = this.generateRecommendations(allVulnerabilities);
+
+    return {
+      timestamp: new Date().toISOString(),
+      duration,
+      tools,
+      summary: {
+        totalVulnerabilities: allVulnerabilities.length,
+        bySeverity,
+        byTool,
+      },
+      recommendations,
+      compliant: !shouldFail,
+    };
+  }
+
+  /**
+   * Generate security recommendations
+   */
+  private generateRecommendations(
+    vulnerabilities: SecurityVulnerability[],
+  ): string[] {
+    const recommendations: string[] = [];
+
+    if (vulnerabilities.some((v) => v.severity === "critical")) {
+      recommendations.push(
+        "🚨 Critical security vulnerabilities found - immediate action required",
+      );
+    }
+
+    if (vulnerabilities.some((v) => v.severity === "high")) {
+      recommendations.push(
+        "⚠️ High-severity vulnerabilities detected - prioritize fixes",
+      );
+    }
+
+    if (vulnerabilities.filter((v) => v.package).length > 0) {
+      recommendations.push(
+        "📦 Update vulnerable dependencies to latest secure versions",
+      );
+    }
+
+    if (vulnerabilities.filter((v) => v.id.includes("eslint")).length > 0) {
+      recommendations.push("🔧 Fix code security issues identified by ESLint");
+    }
+
+    recommendations.push(
+      "🔍 Run regular security scans and keep dependencies updated",
+    );
+    recommendations.push(
+      "📋 Review security policies and implement security headers",
+    );
+
+    return recommendations;
+  }
+
+  /**
+   * Save report to file
+   */
+  private async saveReport(
+    report: SecurityReport,
+    jobId: string,
+  ): Promise<void> {
+    try {
+      await fs.writeFile(
+        this.config.reportPath,
+        JSON.stringify(report, null, 2),
+      );
+      frameworkLogger.log("security-scanner", "report-saved", "success", {
+        jobId,
+        reportPath: this.config.reportPath,
+      });
+    } catch (error) {
+      const errorMessage =
+        error instanceof Error ? error.message : String(error);
+      frameworkLogger.log("security-scanner", "save-report-failed", "warning", { message: "⚠️ Failed to save security report", error: errorMessage });
+    }
+  }
+
+  /**
+   * Log security scan results
+   */
+  private async logResults(report: SecurityReport): Promise<void> {
+    await frameworkLogger.log(
+      "security-scanner",
+      "-n-security-scan-complete-report-duration-ms-",
+      "info",
+      { message: `\n🔒 Security Scan Complete (${report.duration}ms)` },
+    );
+    await frameworkLogger.log(
+      "security-scanner",
+      "-total-vulnerabilities-report-summary-totalvulnera",
+      "info",
+      {
+        message: `📊 Total vulnerabilities: ${report.summary.totalVulnerabilities}`,
+      },
+    );
+
+    await frameworkLogger.log("security-scanner", "-n-by-severity-", "info", {
+      message: "\n📈 By Severity:",
+    });
+    for (const [severity, count] of Object.entries(report.summary.bySeverity)) {
+      await frameworkLogger.log(
+        "security-scanner",
+        "-severity-count-",
+        "info",
+        { message: `  ${severity}: ${count}` },
+      );
+    }
+
+    await frameworkLogger.log("security-scanner", "-n-by-tool-", "info", {
+      message: "\n🛠️ By Tool:",
+    });
+    for (const [tool, count] of Object.entries(report.summary.byTool)) {
+      await frameworkLogger.log("security-scanner", "-tool-count-", "info", {
+        message: `  ${tool}: ${count}`,
+      });
+    }
+
+    if (report.recommendations.length > 0) {
+      await frameworkLogger.log(
+        "security-scanner",
+        "-n-recommendations-",
+        "info",
+        { message: "\n💡 Recommendations:" },
+      );
+      for (const rec of report.recommendations) {
+        await frameworkLogger.log("security-scanner", "-rec-", "info", {
+          message: `  • ${rec}`,
+        });
+      }
+    }
+
+    if (report.compliant) {
+      // Security scan result - kept as console.log for user visibility
+    } else {
+      // Security scan failure - kept as console.log for user visibility
+    }
+  }
+
+  /**
+   * Map npm audit severity levels
+   */
+  private mapNpmSeverity(severity: string): SecurityVulnerability["severity"] {
+    switch (severity) {
+      case "critical":
+        return "critical";
+      case "high":
+        return "high";
+      case "moderate":
+        return "moderate";
+      case "low":
+        return "low";
+      default:
+        return "moderate";
+    }
+  }
+
+  /**
+   * Map Trivy severity levels
+   */
+  private mapTrivySeverity(
+    severity: string,
+  ): SecurityVulnerability["severity"] {
+    switch (severity.toUpperCase()) {
+      case "CRITICAL":
+        return "critical";
+      case "HIGH":
+        return "high";
+      case "MEDIUM":
+        return "moderate";
+      case "LOW":
+        return "low";
+      default:
+        return "moderate";
+    }
+  }
+
+  /**
+   * Map Dependency Check severity levels
+   */
+  private mapDependencyCheckSeverity(
+    severity: string,
+  ): SecurityVulnerability["severity"] {
+    switch (severity.toUpperCase()) {
+      case "CRITICAL":
+        return "critical";
+      case "HIGH":
+        return "high";
+      case "MEDIUM":
+        return "moderate";
+      case "LOW":
+        return "low";
+      default:
+        return "moderate";
+    }
+  }
+
+  /**
+   * Validate AI prompt security
+   */
+  async validatePrompt(prompt: string): Promise<{
+    isSafe: boolean;
+    violations: string[];
+    riskLevel: string;
+  }> {
+    const result = promptSecurityValidator.validatePrompt(prompt);
+
+    if (!result.isSafe) {
+      frameworkLogger.log("security-scanner", "prompt-violation", "warning", {
+        message: `🚨 Prompt security violation detected (risk: ${result.riskLevel})`,
+        violations: result.violations,
+      });
+    }
+
+    return {
+      isSafe: result.isSafe,
+      violations: result.violations,
+      riskLevel: result.riskLevel,
+    };
+  }
+
+  /**
+   * Validate AI response security
+   */
+  async validateResponse(response: string): Promise<{
+    isSafe: boolean;
+    violations: string[];
+    riskLevel: string;
+  }> {
+    const result = promptSecurityValidator.validateResponse(response);
+
+    if (!result.isSafe) {
+      frameworkLogger.log("security-scanner", "response-violation", "warning", {
+        message: `🚨 Response security violation detected (risk: ${result.riskLevel})`,
+        violations: result.violations,
+      });
+    }
+
+    return {
+      isSafe: result.isSafe,
+      violations: result.violations,
+      riskLevel: result.riskLevel,
+    };
+  }
+
+  /**
+   * Create empty report when scanning is disabled
+   */
+  private createEmptyReport(): SecurityReport {
+    return {
+      timestamp: new Date().toISOString(),
+      duration: 0,
+      tools: {
+        npmAudit: [],
+        trivy: [],
+        eslintSecurity: [],
+        dependencyCheck: [],
+      },
+      summary: {
+        totalVulnerabilities: 0,
+        bySeverity: {},
+        byTool: {
+          npmAudit: 0,
+          trivy: 0,
+          eslintSecurity: 0,
+          dependencyCheck: 0,
+        },
+      },
+      recommendations: ["Security scanning is disabled"],
+      compliant: true,
+    };
+  }
+}
+
+// Export singleton instance
+export const securityScanner = new SecurityScanner();