@appland/scanner 1.65.0 → 1.66.0

package/CHANGELOG.md

@@ -1,3 +1,16 @@
+# [@appland/scanner-v1.66.0](https://github.com/applandinc/appmap-js/compare/@appland/scanner-v1.65.0...@appland/scanner-v1.66.0) (2022-08-08)
+
+
+### Bug Fixes
+
+* Fix rule doc ([b99b6ae](https://github.com/applandinc/appmap-js/commit/b99b6aec90186bef312d04fb4f4c95f9b1ee62d5))
+
+
+### Features
+
+* Add deprecated-crypto-algorithm to default rule set ([3034489](https://github.com/applandinc/appmap-js/commit/303448974a73637493a72bea7ab8cfb28ccc8b10))
+* Detect deprecated crypto algorithm ([a17a537](https://github.com/applandinc/appmap-js/commit/a17a537334771a9f2cd64fa73c2396e517ff82ea))
+
 # [@appland/scanner-v1.65.0](https://github.com/applandinc/appmap-js/compare/@appland/scanner-v1.64.0...@appland/scanner-v1.65.0) (2022-08-08)
 
 

package/built/rules/deprecated-crypto-algorithm/metadata.js

@@ -0,0 +1,14 @@
+"use strict";
+Object.defineProperty(exports, "__esModule", { value: true });
+exports.labels = void 0;
+exports.labels = ['crypto.encrypt', 'crypto.decrypt', 'crypto.digest'];
+exports.default = {
+    title: 'Deprecated cryptographic algorithm',
+    scope: 'root',
+    enumerateScope: true,
+    impactDomain: 'Security',
+    references: {
+        'A02:2021': 'https://owasp.org/Top10/A02_2021-Cryptographic_Failures/',
+    },
+    labels: exports.labels,
+};

package/built/rules/deprecated-crypto-algorithm/rule.js

@@ -0,0 +1,44 @@
+"use strict";
+Object.defineProperty(exports, "__esModule", { value: true });
+exports.deprecatedAlgorithms = void 0;
+const metadata_1 = require("./metadata");
+exports.deprecatedAlgorithms = [
+    /\bcbc\b/i,
+    /\becb\b/i,
+    /\b3?des\b/i,
+    /\brc\d\b/i,
+    /\bmd\d\b/i,
+    /\bsha-?1\b/i,
+];
+// Also:
+// https://securitymusings.com/article/1587/algorithm-and-key-length-deprecation
+// http://www.daemonology.net/blog/2009-06-11-cryptographic-right-answers.html
+// Password handling: As soon as you receive a password, hash it using scrypt or PBKDF2 and erase the plaintext password from memory.
+// 1024-bit RSA or DSA
+// 160-bit ECDSA (elliptic curves)
+// 80/112-bit 2TDEA (two key triple DES)
+// PKCS #1 v1.5
+function matcher(event) {
+    if (!event.receiver)
+        return;
+    const receiverLabels = event.receiver.labels || [];
+    const deprecatedAlgorithm = receiverLabels
+        .filter((label) => label.startsWith('crypto.algorithm.'))
+        .map((label) => label.split('.').slice(2).join('.'))
+        .find((label) => exports.deprecatedAlgorithms.find((alg) => alg.test(label)));
+    if (deprecatedAlgorithm) {
+        return [
+            {
+                event,
+                message: `Deprecated crypto algorithm: ${deprecatedAlgorithm}`,
+            },
+        ];
+    }
+}
+function rule() {
+    return {
+        matcher,
+        where: (e) => !!metadata_1.labels.find((label) => e.labels.has(label)),
+    };
+}
+exports.default = rule;

package/built/sampleConfig/default.yml

@@ -1,6 +1,7 @@
 checks:
   - rule: authz-before-authn
   # - rule: circular-dependency
+  - rule: deprecated-crypto-algorithm
   - rule: deserialization-of-untrusted-data
   - rule: exec-of-untrusted-command
   - rule: http-500

package/doc/labels/crypto.decrypt.md

@@ -0,0 +1,7 @@
+---
+name: crypto.decrypt
+rules:
+  - deprecated-crypto-algorithm
+---
+
+A function that performs decryption.

package/doc/labels/crypto.digest.md

@@ -0,0 +1,7 @@
+---
+name: crypto.digest
+rules:
+  - deprecated-crypto-algorithm
+---
+
+A function that computes a cryptographic digest (or 'hash') of some data.

package/doc/labels/crypto.encrypt.md

@@ -1,6 +1,7 @@
 ---
 name: crypto.encrypt
 rules:
+  - deprecated-crypto-algorithm
   - unauthenticated-encryption
 ---
 

package/doc/rules/deprecated-crypto-algorithm.md

@@ -0,0 +1,15 @@
+---
+rule: deprecated-crypto-algorithm
+name: Deprecated crypto algorithm
+title: Deprecated cryptographic algorithm
+references:
+  A02:2021: https://owasp.org/Top10/A02_2021-Cryptographic_Failures/
+impactDomain: Security
+labels:
+  - crypto.encrypt
+  - crypto.decrypt
+  - crypto.digest
+scope: root
+---
+
+Ensure that cryptographic operations do not use deprecated algorithms.

package/package.json

@@ -1,6 +1,6 @@
 {
   "name": "@appland/scanner",
-  "version": "1.65.0",
+  "version": "1.66.0",
   "description": "",
   "bin": "built/cli.js",
   "files": [