@akasecurity/cli 0.8.0 → 0.8.2

package/web-ui/rules/code-flaws/sql-inject-interp.json

@@ -0,0 +1,19 @@
+{
+  "specVersion": 1,
+  "id": "code-flaws/sql-inject-interp",
+  "name": "SQL injection via Ruby string interpolation or PHP variable",
+  "category": "code_flaw",
+  "severity": "high",
+  "matcher": {
+    "type": "regex",
+    "pattern": "(select|insert|update|delete|where)[^\\n]*?(#\\{|\\$[a-z_])",
+    "flags": "gi"
+  },
+  "examples": [
+    "\"SELECT * FROM users WHERE id = #{params[:id]}\"",
+    "\"SELECT * FROM users WHERE id = $userId\""
+  ],
+  "appliesTo": {
+    "extensions": [".rb", ".php"]
+  }
+}

package/web-ui/rules/code-flaws/ssrf-user-url.json

@@ -0,0 +1,16 @@
+{
+  "specVersion": 1,
+  "id": "code-flaws/ssrf-user-url",
+  "name": "Server-side request forgery via user-controlled URL",
+  "category": "code_flaw",
+  "severity": "high",
+  "matcher": {
+    "type": "regex",
+    "pattern": "(fetch|axios\\.\\w+|requests\\.get|urllib\\.request\\.urlopen)\\s*\\(\\s*(req|request|params|query|body)",
+    "flags": "gi"
+  },
+  "examples": ["fetch(req.query.url)", "requests.get(request.form['url'])"],
+  "appliesTo": {
+    "extensions": [".js", ".jsx", ".ts", ".tsx", ".mjs", ".cjs", ".py"]
+  }
+}

package/web-ui/rules/code-flaws/xss-dangerously-set.json

@@ -0,0 +1,16 @@
+{
+  "specVersion": 1,
+  "id": "code-flaws/xss-dangerously-set",
+  "name": "XSS via React dangerouslySetInnerHTML",
+  "category": "code_flaw",
+  "severity": "high",
+  "matcher": {
+    "type": "keyword",
+    "keywords": ["dangerouslySetInnerHTML"],
+    "caseSensitive": true
+  },
+  "examples": ["<div dangerouslySetInnerHTML={{ __html: userContent }} />"],
+  "appliesTo": {
+    "extensions": [".js", ".jsx", ".ts", ".tsx"]
+  }
+}

package/web-ui/rules/code-flaws/xss-inner-html.json

@@ -0,0 +1,16 @@
+{
+  "specVersion": 1,
+  "id": "code-flaws/xss-inner-html",
+  "name": "XSS via innerHTML assignment",
+  "category": "code_flaw",
+  "severity": "high",
+  "matcher": {
+    "type": "keyword",
+    "keywords": ["innerHTML =", "innerHTML="],
+    "caseSensitive": true
+  },
+  "examples": ["element.innerHTML = userInput"],
+  "appliesTo": {
+    "extensions": [".js", ".jsx", ".ts", ".tsx", ".mjs", ".cjs"]
+  }
+}

package/web-ui/rules/code-flaws/xss-unescaped-render.json

@@ -0,0 +1,16 @@
+{
+  "specVersion": 1,
+  "id": "code-flaws/xss-unescaped-render",
+  "name": "XSS via unescaped template rendering",
+  "category": "code_flaw",
+  "severity": "high",
+  "matcher": {
+    "type": "regex",
+    "pattern": "(\\braw\\s*\\(|\\bhtml_safe\\b|\\|\\s*safe\\b|\\bmark_safe\\s*\\()",
+    "flags": "gi"
+  },
+  "examples": ["<%= raw(user_comment) %>", "{{ user_input | safe }}", "mark_safe(user_html)"],
+  "appliesTo": {
+    "extensions": [".rb", ".py"]
+  }
+}

package/web-ui/rules/core-code-context/db-table-name.json

@@ -0,0 +1,30 @@
+{
+  "specVersion": 1,
+  "id": "core-code-context/db-table-name",
+  "name": "Internal database table/column name",
+  "category": "code_context",
+  "severity": "low",
+  "matcher": {
+    "type": "keyword",
+    "keywords": [
+      "SELECT * FROM ",
+      "SELECT COUNT(*) FROM ",
+      "INSERT INTO ",
+      "UPDATE ",
+      "DELETE FROM ",
+      "CREATE TABLE ",
+      "ALTER TABLE ",
+      "DROP TABLE ",
+      "FROM users",
+      "FROM orders",
+      "FROM employees",
+      "FROM customers",
+      "FROM accounts",
+      "FROM transactions",
+      "FROM products",
+      "FROM payments"
+    ],
+    "caseSensitive": false
+  },
+  "examples": ["SELECT * FROM users WHERE id = 1"]
+}

package/web-ui/rules/core-code-context/feature-flag.json

@@ -0,0 +1,24 @@
+{
+  "specVersion": 1,
+  "id": "core-code-context/feature-flag",
+  "name": "Feature flag / toggle name",
+  "category": "code_context",
+  "severity": "low",
+  "matcher": {
+    "type": "keyword",
+    "keywords": [
+      "feature_flag:",
+      "feature_toggle:",
+      "feature-flag:",
+      "feature-toggle:",
+      "FF_",
+      "FEATURE_FLAG_",
+      "FEATURE_TOGGLE_",
+      "unleash:",
+      "launchdarkly:",
+      "split.io:"
+    ],
+    "caseSensitive": false
+  },
+  "examples": ["feature_flag: new-checkout-flow", "FF_ENABLE_DARK_MODE"]
+}

package/web-ui/rules/core-code-context/file-path.json

@@ -0,0 +1,17 @@
+{
+  "specVersion": 1,
+  "id": "core-code-context/file-path",
+  "name": "User home / identity-bearing file path",
+  "category": "code_context",
+  "severity": "low",
+  "matcher": {
+    "type": "regex",
+    "pattern": "(?:/home|/Users)/[A-Za-z0-9_.@-]+(?:/[A-Za-z0-9_.@+-]+)*|/root(?:/[A-Za-z0-9_.@+-]+)+|[A-Za-z]:\\\\[Uu]sers\\\\[A-Za-z0-9_.-]+(?:\\\\[A-Za-z0-9_.-]+)*",
+    "flags": "g"
+  },
+  "examples": [
+    "/home/user/.ssh/id_rsa",
+    "/Users/jane/projects/acme/secrets.env",
+    "C:\\Users\\admin\\config.yml"
+  ]
+}

package/web-ui/rules/core-code-context/internal-domain.json

@@ -0,0 +1,13 @@
+{
+  "specVersion": 1,
+  "id": "core-code-context/internal-domain",
+  "name": "Internal domain / hostname",
+  "category": "code_context",
+  "severity": "low",
+  "matcher": {
+    "type": "regex",
+    "pattern": "(?<![A-Za-z0-9.-])[A-Za-z0-9][A-Za-z0-9.-]{0,251}\\.(?:internal|corp|local|lan|intranet|private|dev|staging|test|qa)(?:\\.(?:com|net|org|io|co|app))?\\b",
+    "flags": "gi"
+  },
+  "examples": ["db.internal.com", "app.corp.local", "api.staging.example.com"]
+}

package/web-ui/rules/core-code-context/internal-ip.json

@@ -0,0 +1,13 @@
+{
+  "specVersion": 1,
+  "id": "core-code-context/internal-ip",
+  "name": "Internal (RFC 1918) IP address",
+  "category": "code_context",
+  "severity": "low",
+  "matcher": {
+    "type": "regex",
+    "pattern": "(?<![\\d.])(?:10\\.(?:25[0-5]|2[0-4]\\d|[01]?\\d\\d?)\\.(?:25[0-5]|2[0-4]\\d|[01]?\\d\\d?)\\.(?:25[0-5]|2[0-4]\\d|[01]?\\d\\d?)|172\\.(?:1[6-9]|2\\d|3[01])\\.(?:25[0-5]|2[0-4]\\d|[01]?\\d\\d?)\\.(?:25[0-5]|2[0-4]\\d|[01]?\\d\\d?)|192\\.168\\.(?:25[0-5]|2[0-4]\\d|[01]?\\d\\d?)\\.(?:25[0-5]|2[0-4]\\d|[01]?\\d\\d?))(?![\\d])",
+    "flags": "g"
+  },
+  "examples": ["10.0.0.1", "192.168.1.1", "172.16.0.1"]
+}

package/web-ui/rules/core-code-context/internal-url.json

@@ -0,0 +1,27 @@
+{
+  "specVersion": 1,
+  "id": "core-code-context/internal-url",
+  "name": "Internal environment URL",
+  "category": "code_context",
+  "severity": "low",
+  "matcher": {
+    "type": "keyword",
+    "keywords": [
+      "https://staging.",
+      "https://dev.",
+      "https://qa.",
+      "https://test.",
+      "http://staging.",
+      "http://dev.",
+      "http://qa.",
+      "http://test.",
+      ".staging.com",
+      ".dev.com",
+      ".qa.com",
+      "staging.internal",
+      "dev.internal"
+    ],
+    "caseSensitive": false
+  },
+  "examples": ["https://staging.example.com"]
+}

package/web-ui/rules/core-code-context/localhost-ref.json

@@ -0,0 +1,13 @@
+{
+  "specVersion": 1,
+  "id": "core-code-context/localhost-ref",
+  "name": "Localhost reference",
+  "category": "code_context",
+  "severity": "low",
+  "matcher": {
+    "type": "regex",
+    "pattern": "\\b(?:localhost|127\\.0\\.0\\.1|0\\.0\\.0\\.0|::1)\\b",
+    "flags": "g"
+  },
+  "examples": ["localhost", "127.0.0.1"]
+}

package/web-ui/rules/core-code-context/stack-trace.json

@@ -0,0 +1,13 @@
+{
+  "specVersion": 1,
+  "id": "core-code-context/stack-trace",
+  "name": "Stack trace (internal code structure)",
+  "category": "code_context",
+  "severity": "low",
+  "matcher": {
+    "type": "regex",
+    "pattern": "(?:^|\\s+)at\\s+[A-Za-z0-9._$<>]+\\.[A-Za-z0-9_$]+\\s*\\([A-Za-z0-9._\\-/:]+:\\d+:\\d+\\)",
+    "flags": "g"
+  },
+  "examples": ["at com.example.service.UserService.findUser(UserService.java:42:13)"]
+}

package/web-ui/rules/core-financial/credit-card.json

@@ -0,0 +1,14 @@
+{
+  "specVersion": 1,
+  "id": "core-financial/credit-card",
+  "name": "Credit/debit card number",
+  "category": "financial",
+  "severity": "critical",
+  "matcher": {
+    "type": "regex",
+    "pattern": "\\b(?:4[0-9]{12}(?:[0-9]{3})?|5[1-5][0-9]{14}|3[47][0-9]{13}|6(?:011|5[0-9]{2})[0-9]{12})\\b",
+    "flags": "g"
+  },
+  "postValidators": ["luhn"],
+  "examples": ["4111111111111111", "5500000000000004"]
+}

package/web-ui/rules/core-financial/cusip.json

@@ -0,0 +1,14 @@
+{
+  "specVersion": 1,
+  "id": "core-financial/cusip",
+  "name": "CUSIP security identifier",
+  "category": "financial",
+  "severity": "medium",
+  "matcher": {
+    "type": "regex",
+    "pattern": "\\bcusip\\b[\\s#:=-]{0,8}(\\d{3}[A-Z0-9]{2}[A-Z0-9*#@]\\d{2}[0-9])\\b",
+    "flags": "gi",
+    "captureGroup": 1
+  },
+  "examples": ["CUSIP: 037833100", "CUSIP 931142103"]
+}

package/web-ui/rules/core-financial/cvv.json

@@ -0,0 +1,13 @@
+{
+  "specVersion": 1,
+  "id": "core-financial/cvv",
+  "name": "Card security code (CVV/CVC)",
+  "category": "financial",
+  "severity": "high",
+  "matcher": {
+    "type": "regex",
+    "pattern": "\\b(?:CVV|CVC|CID|security\\s+code|card\\s+code)[:\\s]*\\d{3,4}\\b",
+    "flags": "gi"
+  },
+  "examples": ["CVV: 123", "CVC: 456"]
+}

package/web-ui/rules/core-financial/iban.json

@@ -0,0 +1,17 @@
+{
+  "specVersion": 1,
+  "id": "core-financial/iban",
+  "name": "International Bank Account Number",
+  "category": "financial",
+  "severity": "high",
+  "matcher": {
+    "type": "regex",
+    "pattern": "\\b[A-Z]{2}\\d{2}[A-Z0-9 ]{10,30}\\b",
+    "flags": "g"
+  },
+  "requiresNearby": {
+    "labels": ["iban", "bank", "account", "bic", "swift"],
+    "windowChars": 160
+  },
+  "examples": ["IBAN: GB82 WEST 1234 5698 7654 32", "IBAN: DE89 3704 0044 0532 0130 00"]
+}

package/web-ui/rules/core-financial/paypal.json

@@ -0,0 +1,14 @@
+{
+  "specVersion": 1,
+  "id": "core-financial/paypal",
+  "name": "PayPal transaction/merchant ID",
+  "category": "financial",
+  "severity": "medium",
+  "matcher": {
+    "type": "regex",
+    "pattern": "paypal.{0,30}?\\b([A-Z0-9]{17})\\b",
+    "flags": "gi",
+    "captureGroup": 1
+  },
+  "examples": ["PayPal transaction ID: 9HW7382910ABCDEF1"]
+}

package/web-ui/rules/core-financial/routing-number.json

@@ -0,0 +1,14 @@
+{
+  "specVersion": 1,
+  "id": "core-financial/routing-number",
+  "name": "US bank routing number (ABA)",
+  "category": "financial",
+  "severity": "high",
+  "matcher": {
+    "type": "regex",
+    "pattern": "\\b(?:routing|aba|rtn)\\b[\\s#:=-]{0,8}(\\d{9})\\b",
+    "flags": "gi",
+    "captureGroup": 1
+  },
+  "examples": ["Routing: 021000021", "ABA 111000025"]
+}

package/web-ui/rules/core-financial/salary.json

@@ -0,0 +1,23 @@
+{
+  "specVersion": 1,
+  "id": "core-financial/salary",
+  "name": "Salary/compensation (contextual)",
+  "category": "financial",
+  "severity": "low",
+  "matcher": {
+    "type": "keyword",
+    "keywords": [
+      "my salary is",
+      "my base salary",
+      "annual compensation",
+      "total comp",
+      "my tc is",
+      "my package is",
+      "i make $",
+      "i earn $",
+      "offered $"
+    ],
+    "caseSensitive": false
+  },
+  "examples": ["My salary is $150,000"]
+}

package/web-ui/rules/core-financial/swift.json

@@ -0,0 +1,14 @@
+{
+  "specVersion": 1,
+  "id": "core-financial/swift",
+  "name": "SWIFT/BIC code",
+  "category": "financial",
+  "severity": "high",
+  "matcher": {
+    "type": "regex",
+    "pattern": "\\b(?:swift|bic)\\b[\\s#:=-]{0,8}([A-Z]{6}[A-Z0-9]{2}(?:[A-Z0-9]{3})?)\\b",
+    "flags": "gi",
+    "captureGroup": 1
+  },
+  "examples": ["SWIFT: BOFAUS3N", "BIC: CHASGB2LXXX"]
+}

package/web-ui/rules/core-phi/biometric-ref.json

@@ -0,0 +1,23 @@
+{
+  "specVersion": 1,
+  "id": "core-phi/biometric-ref",
+  "name": "Biometric data reference",
+  "category": "phi",
+  "severity": "high",
+  "matcher": {
+    "type": "keyword",
+    "keywords": [
+      "fingerprint data",
+      "fingerprint scan",
+      "my iris scan",
+      "my retina scan",
+      "my biometric",
+      "my facial recognition",
+      "my voiceprint",
+      "my palm print",
+      "my hand geometry"
+    ],
+    "caseSensitive": false
+  },
+  "examples": ["My fingerprint data is stored in the biometric database"]
+}

package/web-ui/rules/core-phi/genetic-data.json

@@ -0,0 +1,24 @@
+{
+  "specVersion": 1,
+  "id": "core-phi/genetic-data",
+  "name": "Genetic/DNA sequence reference",
+  "category": "phi",
+  "severity": "high",
+  "matcher": {
+    "type": "keyword",
+    "keywords": [
+      "my dna sequence",
+      "my genome",
+      "my genetic",
+      "dna test results",
+      "genetic test results",
+      "my 23andme",
+      "my ancestrydna",
+      "gene variant",
+      "my genotype",
+      "my haplogroup"
+    ],
+    "caseSensitive": false
+  },
+  "examples": ["My DNA sequence shows a variant in the BRCA1 gene"]
+}

package/web-ui/rules/core-phi/group-id.json

@@ -0,0 +1,19 @@
+{
+  "specVersion": 1,
+  "id": "core-phi/group-id",
+  "name": "Health plan group ID",
+  "category": "phi",
+  "severity": "high",
+  "matcher": {
+    "type": "regex",
+    "pattern": "\\bgroup\\s*(?:id|number|no|#)\\s*[:#]?\\s*[A-Za-z0-9]{6,20}\\b",
+    "flags": "gi"
+  },
+  "requiresNearby": {
+    "ruleIds": ["core-phi/member-id"],
+    "labels": ["member id", "subscriber", "health plan"],
+    "windowChars": 200,
+    "confidenceBoost": 0.05
+  },
+  "examples": ["Member ID: ABC987654321, Group ID: GRP12345678"]
+}

package/web-ui/rules/core-phi/hipaa-identifier.json

@@ -0,0 +1,13 @@
+{
+  "specVersion": 1,
+  "id": "core-phi/hipaa-identifier",
+  "name": "HIPAA standard identifier (health plan / beneficiary / claim number)",
+  "category": "phi",
+  "severity": "high",
+  "matcher": {
+    "type": "regex",
+    "pattern": "\\b(?:health\\s+plan|beneficiary|claim\\s+number|subscriber)[:\\s]*[A-Za-z0-9]{8,20}\\b",
+    "flags": "gi"
+  },
+  "examples": ["Health Plan: XYZ123456789", "Beneficiary: ABC987654321"]
+}

package/web-ui/rules/core-phi/icd10-code.json

@@ -0,0 +1,14 @@
+{
+  "specVersion": 1,
+  "id": "core-phi/icd10-code",
+  "name": "ICD-10 diagnosis code",
+  "category": "phi",
+  "severity": "medium",
+  "matcher": {
+    "type": "regex",
+    "pattern": "(?:icd[- ]?10|diagnosis|\\bdx\\b).{0,12}?([A-Z][0-9]{2}(?:\\.[0-9]{1,4})?)\\b",
+    "flags": "gi",
+    "captureGroup": 1
+  },
+  "examples": ["ICD-10: I10", "Diagnosis code E11.9", "dx: J45.909"]
+}

package/web-ui/rules/core-phi/member-id.json

@@ -0,0 +1,13 @@
+{
+  "specVersion": 1,
+  "id": "core-phi/member-id",
+  "name": "Health plan member ID",
+  "category": "phi",
+  "severity": "high",
+  "matcher": {
+    "type": "regex",
+    "pattern": "\\bmember\\s*(?:id|number|no|#)\\s*[:#]?\\s*[A-Za-z0-9]{6,20}\\b",
+    "flags": "gi"
+  },
+  "examples": ["Member ID: ABC987654321"]
+}

package/web-ui/rules/core-phi/mrn.json

@@ -0,0 +1,13 @@
+{
+  "specVersion": 1,
+  "id": "core-phi/mrn",
+  "name": "Medical Record Number",
+  "category": "phi",
+  "severity": "high",
+  "matcher": {
+    "type": "regex",
+    "pattern": "\\b(?:MRN|MR#|medical\\s+record)[:\\s]*[A-Za-z0-9]{6,16}\\b",
+    "flags": "gi"
+  },
+  "examples": ["MRN: 1234567890", "Medical Record: ABCD1234"]
+}

package/web-ui/rules/core-phi/ndc-code.json

@@ -0,0 +1,13 @@
+{
+  "specVersion": 1,
+  "id": "core-phi/ndc-code",
+  "name": "National Drug Code (NDC)",
+  "category": "phi",
+  "severity": "medium",
+  "matcher": {
+    "type": "regex",
+    "pattern": "\\b\\d{4,5}-\\d{3,4}-\\d{1,2}\\b",
+    "flags": "g"
+  },
+  "examples": ["0002-1427-01", "68788-6965-1"]
+}

package/web-ui/rules/core-pii/dob.json

@@ -0,0 +1,18 @@
+{
+  "specVersion": 1,
+  "id": "core-pii/dob",
+  "name": "Date of birth",
+  "category": "pii",
+  "severity": "high",
+  "matcher": {
+    "type": "regex",
+    "pattern": "\\b(?:(?:19[4-9]\\d|20[0-1]\\d)[/-]\\d{1,2}[/-]\\d{1,2}|\\d{1,2}[/-]\\d{1,2}[/-](?:19[4-9]\\d|20[0-1]\\d))\\b",
+    "flags": "g"
+  },
+  "requiresNearby": {
+    "categories": ["pii"],
+    "labels": ["dob", "date of birth", "birth", "d.o.b"],
+    "windowChars": 160
+  },
+  "examples": ["DOB: 1985-03-22", "Date of birth: 03/22/1985"]
+}

package/web-ui/rules/core-pii/drivers-license-us.json

@@ -0,0 +1,14 @@
+{
+  "specVersion": 1,
+  "id": "core-pii/drivers-license-us",
+  "name": "US driver's license number",
+  "category": "pii",
+  "severity": "high",
+  "matcher": {
+    "type": "regex",
+    "pattern": "(?:driver'?s?\\s*licen[sc]e|licen[sc]e|\\bDL\\b).{0,10}?([A-Z]\\d{6,8}|\\d{8,9})\\b",
+    "flags": "gi",
+    "captureGroup": 1
+  },
+  "examples": ["Driver's License: D1234567", "DL: 123456789"]
+}

package/web-ui/rules/core-pii/email.json

@@ -0,0 +1,13 @@
+{
+  "specVersion": 1,
+  "id": "core-pii/email",
+  "name": "Email address",
+  "category": "pii",
+  "severity": "medium",
+  "matcher": {
+    "type": "regex",
+    "pattern": "(?<![A-Za-z0-9._%+-])[A-Za-z0-9._%+-]{1,64}@[A-Za-z0-9.-]{1,255}\\.[A-Za-z]{2,24}\\b",
+    "flags": "g"
+  },
+  "examples": ["user@example.com"]
+}

package/web-ui/rules/core-pii/home-address.json

@@ -0,0 +1,21 @@
+{
+  "specVersion": 1,
+  "id": "core-pii/home-address",
+  "name": "Home address (contextual)",
+  "category": "pii",
+  "severity": "medium",
+  "matcher": {
+    "type": "keyword",
+    "keywords": [
+      "my address is",
+      "home address",
+      "shipping address",
+      "billing address",
+      "mailing address",
+      "my home is at",
+      "i reside at"
+    ],
+    "caseSensitive": false
+  },
+  "examples": ["My address is 123 Main St, Springfield, IL 62701"]
+}

package/web-ui/rules/core-pii/ip-address.json

@@ -0,0 +1,13 @@
+{
+  "specVersion": 1,
+  "id": "core-pii/ip-address",
+  "name": "IP address",
+  "category": "pii",
+  "severity": "low",
+  "matcher": {
+    "type": "regex",
+    "pattern": "\\b(?:(?:25[0-5]|2[0-4]\\d|[01]?\\d\\d?)\\.){3}(?:25[0-5]|2[0-4]\\d|[01]?\\d\\d?)\\b",
+    "flags": "g"
+  },
+  "examples": ["192.168.1.1", "10.0.0.1"]
+}

package/web-ui/rules/core-pii/mac-address.json

@@ -0,0 +1,13 @@
+{
+  "specVersion": 1,
+  "id": "core-pii/mac-address",
+  "name": "MAC address",
+  "category": "pii",
+  "severity": "low",
+  "matcher": {
+    "type": "regex",
+    "pattern": "\\b(?:[0-9A-Fa-f]{2}[:-]){5}[0-9A-Fa-f]{2}\\b",
+    "flags": "g"
+  },
+  "examples": ["AA:BB:CC:DD:EE:FF"]
+}

package/web-ui/rules/core-pii/name.json

@@ -0,0 +1,21 @@
+{
+  "specVersion": 1,
+  "id": "core-pii/name",
+  "name": "Personal name (contextual)",
+  "category": "pii",
+  "severity": "medium",
+  "matcher": {
+    "type": "keyword",
+    "keywords": [
+      "my name is",
+      "my full name",
+      "i am called",
+      "please call me",
+      "name:\n",
+      "\"full_name\": \"",
+      "\"fullName\": \""
+    ],
+    "caseSensitive": false
+  },
+  "examples": ["My name is John Doe"]
+}