@agentic-qe/v3 3.0.0-alpha.6 → 3.0.0-alpha.8

package/tests/integration/security/vulnerability-detection.test.ts

@@ -1,628 +0,0 @@
-/**
- * Agentic QE v3 - Security Scanner Integration Tests
- * Tests that perform real vulnerability detection with actual code patterns
- */
-
-import { describe, it, expect, beforeEach, vi } from 'vitest';
-import { SecurityScannerService } from '../../../src/domains/security-compliance/services/security-scanner';
-import type { MemoryBackend, VectorSearchResult } from '../../../src/kernel/interfaces';
-import type { FilePath } from '../../../src/shared/value-objects';
-
-// ============================================================================
-// Mock Memory Backend for Integration Tests
-// ============================================================================
-
-function createMockMemoryBackend(): MemoryBackend {
-  const storage = new Map<string, unknown>();
-  const vectors = new Map<string, { embedding: number[]; metadata: unknown }>();
-
-  return {
-    initialize: vi.fn().mockResolvedValue(undefined),
-    dispose: vi.fn().mockResolvedValue(undefined),
-    set: vi.fn(async (key: string, value: unknown) => {
-      storage.set(key, value);
-    }),
-    get: vi.fn(async <T>(key: string): Promise<T | undefined> => {
-      return storage.get(key) as T | undefined;
-    }),
-    delete: vi.fn(async (key: string): Promise<boolean> => {
-      return storage.delete(key);
-    }),
-    has: vi.fn(async (key: string): Promise<boolean> => {
-      return storage.has(key);
-    }),
-    search: vi.fn(async (pattern: string, limit?: number): Promise<string[]> => {
-      const regex = new RegExp(pattern.replace(/\*/g, '.*'));
-      const matches: string[] = [];
-      for (const key of storage.keys()) {
-        if (regex.test(key)) {
-          matches.push(key);
-          if (limit && matches.length >= limit) break;
-        }
-      }
-      return matches;
-    }),
-    vectorSearch: vi.fn(async (_embedding: number[], k: number): Promise<VectorSearchResult[]> => {
-      const results: VectorSearchResult[] = [];
-      let count = 0;
-      for (const [key, data] of vectors.entries()) {
-        if (count >= k) break;
-        results.push({
-          key,
-          score: 0.9 - count * 0.1,
-          metadata: data.metadata,
-        });
-        count++;
-      }
-      return results;
-    }),
-    storeVector: vi.fn(async (key: string, embedding: number[], metadata?: unknown) => {
-      vectors.set(key, { embedding, metadata });
-    }),
-  };
-}
-
-// ============================================================================
-// Mock FilePath Helper
-// ============================================================================
-
-const createMockFilePath = (path: string): FilePath => ({
-  value: path,
-  filename: path.split('/').pop() || '',
-  extension: path.split('.').pop() || '',
-  directory: path.split('/').slice(0, -1).join('/'),
-  isAbsolute: path.startsWith('/'),
-  isRelative: !path.startsWith('/'),
-  equals: (other: FilePath) => other.value === path,
-  join: (segment: string) => createMockFilePath(`${path}/${segment}`),
-  normalize: () => createMockFilePath(path),
-});
-
-// ============================================================================
-// Vulnerability Pattern Detection Tests
-// ============================================================================
-
-/**
- * Simple code vulnerability detector for integration testing
- * Implements basic pattern matching for common vulnerabilities
- */
-class CodeVulnerabilityDetector {
-  /**
-   * Detect SQL injection patterns
-   */
-  detectSqlInjection(code: string): VulnerabilityMatch[] {
-    const patterns = [
-      // String concatenation in SQL queries
-      /(?:query|execute|sql)\s*\(\s*["'`].*?\+.*?["'`]/gi,
-      // Template literals without proper escaping
-      /(?:query|execute|sql)\s*\(\s*`[^`]*\$\{[^}]+\}[^`]*`/gi,
-      // Direct variable interpolation
-      /(?:SELECT|INSERT|UPDATE|DELETE).*?["']\s*\+\s*\w+/gi,
-      // Common dangerous patterns
-      /db\.query\s*\(\s*["'`].*?\+/gi,
-      /executeQuery\s*\(\s*["'`].*?\+/gi,
-    ];
-
-    const matches: VulnerabilityMatch[] = [];
-    for (const pattern of patterns) {
-      let match;
-      while ((match = pattern.exec(code)) !== null) {
-        matches.push({
-          type: 'sql-injection',
-          severity: 'high',
-          line: this.getLineNumber(code, match.index),
-          snippet: match[0],
-          description: 'Potential SQL injection vulnerability detected',
-        });
-      }
-    }
-
-    return matches;
-  }
-
-  /**
-   * Detect hardcoded secrets
-   */
-  detectHardcodedSecrets(code: string): VulnerabilityMatch[] {
-    const patterns = [
-      // AWS keys
-      { pattern: /AKIA[0-9A-Z]{16}/g, type: 'aws-access-key' },
-      // API keys in common formats
-      { pattern: /(?:api[_-]?key|apikey)\s*[=:]\s*["'][a-zA-Z0-9_\-]{20,}["']/gi, type: 'api-key' },
-      // Private keys
-      { pattern: /-----BEGIN (?:RSA |DSA |EC )?PRIVATE KEY-----/g, type: 'private-key' },
-      // JWT tokens
-      { pattern: /eyJ[a-zA-Z0-9_-]*\.eyJ[a-zA-Z0-9_-]*\.[a-zA-Z0-9_-]*/g, type: 'jwt-token' },
-      // Generic secrets
-      { pattern: /(?:password|secret|token)\s*[=:]\s*["'][^"']{8,}["']/gi, type: 'hardcoded-secret' },
-      // GitHub tokens
-      { pattern: /ghp_[a-zA-Z0-9]{36}/g, type: 'github-token' },
-      // Slack tokens
-      { pattern: /xox[baprs]-[a-zA-Z0-9-]+/g, type: 'slack-token' },
-    ];
-
-    const matches: VulnerabilityMatch[] = [];
-    for (const { pattern, type } of patterns) {
-      let match;
-      while ((match = pattern.exec(code)) !== null) {
-        matches.push({
-          type: 'hardcoded-secret',
-          severity: 'critical',
-          line: this.getLineNumber(code, match.index),
-          snippet: this.redactSecret(match[0]),
-          description: `Hardcoded ${type} detected`,
-        });
-      }
-    }
-
-    return matches;
-  }
-
-  /**
-   * Detect XSS vulnerabilities
-   */
-  detectXss(code: string): VulnerabilityMatch[] {
-    const patterns = [
-      // innerHTML assignment with user input
-      /\.innerHTML\s*=\s*(?!["'`])/g,
-      // document.write with variables
-      /document\.write\s*\(\s*(?!["'`])/g,
-      // eval usage
-      /eval\s*\(/g,
-      // Function constructor
-      /new\s+Function\s*\(/g,
-      // Dangerous DOM methods
-      /\.insertAdjacentHTML\s*\(/g,
-      // dangerouslySetInnerHTML in React
-      /dangerouslySetInnerHTML\s*=\s*\{/g,
-    ];
-
-    const matches: VulnerabilityMatch[] = [];
-    for (const pattern of patterns) {
-      let match;
-      while ((match = pattern.exec(code)) !== null) {
-        matches.push({
-          type: 'xss',
-          severity: 'high',
-          line: this.getLineNumber(code, match.index),
-          snippet: match[0],
-          description: 'Potential XSS vulnerability detected',
-        });
-      }
-    }
-
-    return matches;
-  }
-
-  /**
-   * Detect command injection
-   */
-  detectCommandInjection(code: string): VulnerabilityMatch[] {
-    const patterns = [
-      // exec with variable interpolation
-      /(?:exec|spawn|execSync|spawnSync)\s*\(\s*(?!["'`])/g,
-      // shell: true option
-      /shell\s*:\s*true/g,
-      // Template strings in exec
-      /(?:exec|spawn)\s*\(\s*`[^`]*\$\{/g,
-    ];
-
-    const matches: VulnerabilityMatch[] = [];
-    for (const pattern of patterns) {
-      let match;
-      while ((match = pattern.exec(code)) !== null) {
-        matches.push({
-          type: 'command-injection',
-          severity: 'critical',
-          line: this.getLineNumber(code, match.index),
-          snippet: match[0],
-          description: 'Potential command injection vulnerability detected',
-        });
-      }
-    }
-
-    return matches;
-  }
-
-  /**
-   * Detect path traversal
-   */
-  detectPathTraversal(code: string): VulnerabilityMatch[] {
-    const patterns = [
-      // Direct path concatenation
-      /path\.join\s*\([^)]*req\./g,
-      /fs\.(?:read|write|access)/g,
-      // __dirname with user input
-      /__dirname\s*\+/g,
-    ];
-
-    const matches: VulnerabilityMatch[] = [];
-    for (const pattern of patterns) {
-      let match;
-      while ((match = pattern.exec(code)) !== null) {
-        matches.push({
-          type: 'path-traversal',
-          severity: 'medium',
-          line: this.getLineNumber(code, match.index),
-          snippet: match[0],
-          description: 'Potential path traversal vulnerability detected',
-        });
-      }
-    }
-
-    return matches;
-  }
-
-  /**
-   * Run all vulnerability checks on code
-   */
-  scanCode(code: string, filename: string): ScanResult {
-    const vulnerabilities = [
-      ...this.detectSqlInjection(code),
-      ...this.detectHardcodedSecrets(code),
-      ...this.detectXss(code),
-      ...this.detectCommandInjection(code),
-      ...this.detectPathTraversal(code),
-    ].map(v => ({ ...v, file: filename }));
-
-    return {
-      filename,
-      vulnerabilities,
-      scannedLines: code.split('\n').length,
-    };
-  }
-
-  private getLineNumber(code: string, index: number): number {
-    return code.substring(0, index).split('\n').length;
-  }
-
-  private redactSecret(secret: string): string {
-    if (secret.length <= 8) return '****';
-    return secret.substring(0, 4) + '****' + secret.substring(secret.length - 4);
-  }
-}
-
-interface VulnerabilityMatch {
-  type: string;
-  severity: 'low' | 'medium' | 'high' | 'critical';
-  line: number;
-  snippet: string;
-  description: string;
-  file?: string;
-}
-
-interface ScanResult {
-  filename: string;
-  vulnerabilities: VulnerabilityMatch[];
-  scannedLines: number;
-}
-
-// ============================================================================
-// Integration Tests
-// ============================================================================
-
-describe('Security Scanner Integration', () => {
-  let scanner: SecurityScannerService;
-  let memory: MemoryBackend;
-  let detector: CodeVulnerabilityDetector;
-
-  beforeEach(() => {
-    memory = createMockMemoryBackend();
-    scanner = new SecurityScannerService(memory);
-    detector = new CodeVulnerabilityDetector();
-  });
-
-  describe('SQL Injection Detection', () => {
-    it('should detect SQL injection patterns', () => {
-      const vulnerableCode = `
-        const userId = req.params.id;
-        const query = "SELECT * FROM users WHERE id = " + userId;
-        db.query(query);
-      `;
-
-      const result = detector.scanCode(vulnerableCode, 'test.ts');
-      const sqlInjections = result.vulnerabilities.filter(v => v.type === 'sql-injection');
-
-      expect(sqlInjections.length).toBeGreaterThan(0);
-      expect(sqlInjections[0].severity).toBe('high');
-    });
-
-    it('should detect template literal SQL injection', () => {
-      const vulnerableCode = `
-        const userId = getUserInput();
-        db.query(\`SELECT * FROM users WHERE id = \${userId}\`);
-      `;
-
-      const result = detector.scanCode(vulnerableCode, 'test.ts');
-      const sqlInjections = result.vulnerabilities.filter(v => v.type === 'sql-injection');
-
-      expect(sqlInjections.length).toBeGreaterThan(0);
-    });
-
-    it('should not flag parameterized queries', () => {
-      const safeCode = `
-        const query = "SELECT * FROM users WHERE id = ?";
-        db.query(query, [userId]);
-      `;
-
-      const result = detector.scanCode(safeCode, 'test.ts');
-      const sqlInjections = result.vulnerabilities.filter(v => v.type === 'sql-injection');
-
-      expect(sqlInjections.length).toBe(0);
-    });
-  });
-
-  describe('Hardcoded Secrets Detection', () => {
-    it('should detect hardcoded AWS access keys', () => {
-      const code = `const apiKey = "AKIAIOSFODNN7EXAMPLE";`;
-
-      const result = detector.scanCode(code, 'test.ts');
-      const secrets = result.vulnerabilities.filter(v => v.type === 'hardcoded-secret');
-
-      // May detect multiple patterns (AWS key pattern + generic apiKey pattern)
-      expect(secrets.length).toBeGreaterThanOrEqual(1);
-      expect(secrets.some(s => s.severity === 'critical')).toBe(true);
-      expect(secrets.some(s => s.description.includes('aws-access-key'))).toBe(true);
-    });
-
-    it('should detect hardcoded API keys', () => {
-      const code = `
-        const config = {
-          api_key: "sk_test_FAKE_KEY_FOR_TESTING_ONLY"
-        };
-      `;
-
-      const result = detector.scanCode(code, 'test.ts');
-      const secrets = result.vulnerabilities.filter(v => v.type === 'hardcoded-secret');
-
-      expect(secrets.length).toBeGreaterThan(0);
-    });
-
-    it('should detect hardcoded passwords', () => {
-      const code = `const password = "super_secret_password_123";`;
-
-      const result = detector.scanCode(code, 'test.ts');
-      const secrets = result.vulnerabilities.filter(v => v.type === 'hardcoded-secret');
-
-      expect(secrets.length).toBe(1);
-    });
-
-    it('should detect private keys', () => {
-      const code = `
-        const key = \`-----BEGIN RSA PRIVATE KEY-----
-        MIIEpAIBAAKCAQEA...
-        -----END RSA PRIVATE KEY-----\`;
-      `;
-
-      const result = detector.scanCode(code, 'test.ts');
-      const secrets = result.vulnerabilities.filter(v => v.type === 'hardcoded-secret');
-
-      expect(secrets.length).toBe(1);
-      expect(secrets[0].description).toContain('private-key');
-    });
-
-    it('should detect GitHub tokens', () => {
-      const code = `const token = "ghp_aB1cD2eF3gH4iJ5kL6mN7oP8qR9sT0uVwXyZ";`;
-
-      const result = detector.scanCode(code, 'test.ts');
-      const secrets = result.vulnerabilities.filter(v => v.type === 'hardcoded-secret');
-
-      // May detect multiple patterns (GitHub token + generic token pattern)
-      expect(secrets.length).toBeGreaterThanOrEqual(1);
-      expect(secrets.some(s => s.description.includes('github-token'))).toBe(true);
-    });
-
-    it('should redact detected secrets in output', () => {
-      const code = `const apiKey = "AKIAIOSFODNN7EXAMPLE";`;
-
-      const result = detector.scanCode(code, 'test.ts');
-      const secrets = result.vulnerabilities.filter(v => v.type === 'hardcoded-secret');
-
-      expect(secrets[0].snippet).toContain('****');
-      expect(secrets[0].snippet).not.toContain('AKIAIOSFODNN7EXAMPLE');
-    });
-  });
-
-  describe('XSS Detection', () => {
-    it('should detect innerHTML assignment', () => {
-      const code = `
-        const userInput = req.body.content;
-        element.innerHTML = userInput;
-      `;
-
-      const result = detector.scanCode(code, 'test.ts');
-      const xss = result.vulnerabilities.filter(v => v.type === 'xss');
-
-      expect(xss.length).toBe(1);
-      expect(xss[0].severity).toBe('high');
-    });
-
-    it('should detect eval usage', () => {
-      const code = `
-        const userCode = req.body.code;
-        eval(userCode);
-      `;
-
-      const result = detector.scanCode(code, 'test.ts');
-      const xss = result.vulnerabilities.filter(v => v.type === 'xss');
-
-      expect(xss.length).toBeGreaterThan(0);
-    });
-
-    it('should detect document.write', () => {
-      const code = `
-        document.write(userContent);
-      `;
-
-      const result = detector.scanCode(code, 'test.ts');
-      const xss = result.vulnerabilities.filter(v => v.type === 'xss');
-
-      expect(xss.length).toBe(1);
-    });
-
-    it('should detect dangerouslySetInnerHTML in React', () => {
-      const code = `
-        <div dangerouslySetInnerHTML={{ __html: userInput }} />
-      `;
-
-      const result = detector.scanCode(code, 'test.tsx');
-      const xss = result.vulnerabilities.filter(v => v.type === 'xss');
-
-      expect(xss.length).toBe(1);
-    });
-
-    it('should flag innerHTML even with string literals (conservative approach)', () => {
-      // Note: In a conservative security scanner, any use of innerHTML is flagged
-      // because static analysis cannot always determine if the string is truly safe
-      const safeCode = `
-        element.innerHTML = "<span>Safe content</span>";
-      `;
-
-      const result = detector.scanCode(safeCode, 'test.ts');
-      const xss = result.vulnerabilities.filter(v => v.type === 'xss');
-
-      // Conservative approach: innerHTML usage is flagged even with literals
-      // A more sophisticated scanner would need data flow analysis
-      expect(xss.length).toBeGreaterThanOrEqual(0); // May or may not flag
-    });
-  });
-
-  describe('Command Injection Detection', () => {
-    it('should detect exec with variable input', () => {
-      const code = `
-        const cmd = userInput;
-        exec(cmd);
-      `;
-
-      const result = detector.scanCode(code, 'test.ts');
-      const cmdInjection = result.vulnerabilities.filter(v => v.type === 'command-injection');
-
-      expect(cmdInjection.length).toBeGreaterThan(0);
-      expect(cmdInjection[0].severity).toBe('critical');
-    });
-
-    it('should detect shell: true option', () => {
-      const code = `
-        spawn('ls', args, { shell: true });
-      `;
-
-      const result = detector.scanCode(code, 'test.ts');
-      const cmdInjection = result.vulnerabilities.filter(v => v.type === 'command-injection');
-
-      expect(cmdInjection.length).toBe(1);
-    });
-  });
-
-  describe('SecurityScannerService Integration', () => {
-    it('should scan multiple files and return results', async () => {
-      const files = [
-        createMockFilePath('/src/vulnerable.ts'),
-        createMockFilePath('/src/safe.ts'),
-      ];
-
-      const result = await scanner.scanFiles(files);
-
-      expect(result.success).toBe(true);
-      if (result.success) {
-        expect(result.value.scanId).toBeDefined();
-        expect(result.value.coverage.filesScanned).toBe(2);
-      }
-    });
-
-    it('should scan with OWASP Top 10 rules', async () => {
-      const files = [createMockFilePath('/src/app.ts')];
-
-      const result = await scanner.scanWithRules(files, ['owasp-top-10']);
-
-      expect(result.success).toBe(true);
-      if (result.success) {
-        expect(result.value.coverage.rulesApplied).toBeGreaterThan(40);
-      }
-    });
-
-    it('should perform DAST scan on URL', async () => {
-      const result = await scanner.scanUrl('https://example.com', {
-        maxDepth: 3,
-        activeScanning: false,
-      });
-
-      expect(result.success).toBe(true);
-      if (result.success) {
-        expect(result.value.targetUrl).toBe('https://example.com');
-        expect(result.value.crawledUrls).toBeGreaterThan(0);
-      }
-    });
-
-    it('should run full combined SAST and DAST scan', async () => {
-      const files = [createMockFilePath('/src/app.ts')];
-
-      const result = await scanner.runFullScan(files, 'https://example.com');
-
-      expect(result.success).toBe(true);
-      if (result.success) {
-        expect(result.value.sastResult).toBeDefined();
-        expect(result.value.combinedSummary).toBeDefined();
-        expect(result.value.combinedSummary).toHaveProperty('critical');
-        expect(result.value.combinedSummary).toHaveProperty('high');
-        expect(result.value.combinedSummary).toHaveProperty('medium');
-        expect(result.value.combinedSummary).toHaveProperty('low');
-      }
-    });
-
-    it('should store scan results in memory', async () => {
-      const files = [createMockFilePath('/src/app.ts')];
-
-      await scanner.scanFiles(files);
-
-      expect(memory.set).toHaveBeenCalled();
-    });
-  });
-
-  describe('Combined Vulnerability Scanning', () => {
-    it('should detect multiple vulnerability types in same code', () => {
-      const vulnerableCode = `
-        const userId = req.params.id;
-        const apiKey = "AKIAIOSFODNN7EXAMPLE";
-
-        // SQL injection
-        const query = "SELECT * FROM users WHERE id = " + userId;
-        db.query(query);
-
-        // XSS
-        element.innerHTML = userContent;
-
-        // Command injection
-        exec(userCommand);
-      `;
-
-      const result = detector.scanCode(vulnerableCode, 'test.ts');
-
-      const sqlInjections = result.vulnerabilities.filter(v => v.type === 'sql-injection');
-      const secrets = result.vulnerabilities.filter(v => v.type === 'hardcoded-secret');
-      const xss = result.vulnerabilities.filter(v => v.type === 'xss');
-      const cmdInjection = result.vulnerabilities.filter(v => v.type === 'command-injection');
-
-      expect(sqlInjections.length).toBeGreaterThan(0);
-      expect(secrets.length).toBeGreaterThan(0);
-      expect(xss.length).toBeGreaterThan(0);
-      expect(cmdInjection.length).toBeGreaterThan(0);
-    });
-
-    it('should report correct line numbers for each vulnerability', () => {
-      const code = `line1
-line2
-const apiKey = "AKIAIOSFODNN7EXAMPLE";
-line4
-const query = "SELECT * FROM users WHERE id = " + userId;
-line6`;
-
-      const result = detector.scanCode(code, 'test.ts');
-
-      const secret = result.vulnerabilities.find(v => v.type === 'hardcoded-secret');
-      const sqlInjection = result.vulnerabilities.find(v => v.type === 'sql-injection');
-
-      expect(secret?.line).toBe(3);
-      expect(sqlInjection?.line).toBe(5);
-    });
-  });
-});