@appland/scanner 1.65.0 → 1.68.0

package/built/cli/scan/ui/state/hitBreakpoint.js

@@ -0,0 +1,68 @@
+"use strict";
+var __createBinding = (this && this.__createBinding) || (Object.create ? (function(o, m, k, k2) {
+    if (k2 === undefined) k2 = k;
+    var desc = Object.getOwnPropertyDescriptor(m, k);
+    if (!desc || ("get" in desc ? !m.__esModule : desc.writable || desc.configurable)) {
+      desc = { enumerable: true, get: function() { return m[k]; } };
+    }
+    Object.defineProperty(o, k2, desc);
+}) : (function(o, m, k, k2) {
+    if (k2 === undefined) k2 = k;
+    o[k2] = m[k];
+}));
+var __setModuleDefault = (this && this.__setModuleDefault) || (Object.create ? (function(o, v) {
+    Object.defineProperty(o, "default", { enumerable: true, value: v });
+}) : function(o, v) {
+    o["default"] = v;
+});
+var __importStar = (this && this.__importStar) || function (mod) {
+    if (mod && mod.__esModule) return mod;
+    var result = {};
+    if (mod != null) for (var k in mod) if (k !== "default" && Object.prototype.hasOwnProperty.call(mod, k)) __createBinding(result, mod, k);
+    __setModuleDefault(result, mod);
+    return result;
+};
+var __awaiter = (this && this.__awaiter) || function (thisArg, _arguments, P, generator) {
+    function adopt(value) { return value instanceof P ? value : new P(function (resolve) { resolve(value); }); }
+    return new (P || (P = Promise))(function (resolve, reject) {
+        function fulfilled(value) { try { step(generator.next(value)); } catch (e) { reject(e); } }
+        function rejected(value) { try { step(generator["throw"](value)); } catch (e) { reject(e); } }
+        function step(result) { result.done ? resolve(result.value) : adopt(result.value).then(fulfilled, rejected); }
+        step((generator = generator.apply(thisArg, _arguments || [])).next());
+    });
+};
+var __importDefault = (this && this.__importDefault) || function (mod) {
+    return (mod && mod.__esModule) ? mod : { "default": mod };
+};
+Object.defineProperty(exports, "__esModule", { value: true });
+const userInteraction_1 = __importDefault(require("../userInteraction"));
+const initial_1 = __importDefault(require("./initial"));
+function hitBreakpoint(context) {
+    var _a, _b;
+    return __awaiter(this, void 0, void 0, function* () {
+        const choices = {
+            'show hints': 'hint',
+            'evaluate expression': 'eval',
+            'add breakpoint': 'addBreakpoint',
+            continue: 'scan',
+            quit: null,
+        };
+        userInteraction_1.default.progress(`In breakpoint: ${context.breakpoint}`);
+        if (context.progress.appMapFileName) {
+            const line = context.progress.appMapFileName;
+            const eventId = ((_a = context.progress.event) === null || _a === void 0 ? void 0 : _a.id) || ((_b = context.progress.scope) === null || _b === void 0 ? void 0 : _b.id);
+            userInteraction_1.default.progress([line, eventId].filter(Boolean).join(':'));
+        }
+        const { action: actionName } = yield userInteraction_1.default.prompt({
+            name: 'action',
+            type: 'list',
+            message: 'Choose action:',
+            choices: Object.keys(choices),
+        });
+        const action = choices[actionName];
+        if (!action)
+            return initial_1.default;
+        return (yield Promise.resolve().then(() => __importStar(require(`./${action}`)))).default;
+    });
+}
+exports.default = hitBreakpoint;

package/built/cli/scan/ui/state/initial.js

@@ -0,0 +1,58 @@
+"use strict";
+var __createBinding = (this && this.__createBinding) || (Object.create ? (function(o, m, k, k2) {
+    if (k2 === undefined) k2 = k;
+    var desc = Object.getOwnPropertyDescriptor(m, k);
+    if (!desc || ("get" in desc ? !m.__esModule : desc.writable || desc.configurable)) {
+      desc = { enumerable: true, get: function() { return m[k]; } };
+    }
+    Object.defineProperty(o, k2, desc);
+}) : (function(o, m, k, k2) {
+    if (k2 === undefined) k2 = k;
+    o[k2] = m[k];
+}));
+var __setModuleDefault = (this && this.__setModuleDefault) || (Object.create ? (function(o, v) {
+    Object.defineProperty(o, "default", { enumerable: true, value: v });
+}) : function(o, v) {
+    o["default"] = v;
+});
+var __importStar = (this && this.__importStar) || function (mod) {
+    if (mod && mod.__esModule) return mod;
+    var result = {};
+    if (mod != null) for (var k in mod) if (k !== "default" && Object.prototype.hasOwnProperty.call(mod, k)) __createBinding(result, mod, k);
+    __setModuleDefault(result, mod);
+    return result;
+};
+var __awaiter = (this && this.__awaiter) || function (thisArg, _arguments, P, generator) {
+    function adopt(value) { return value instanceof P ? value : new P(function (resolve) { resolve(value); }); }
+    return new (P || (P = Promise))(function (resolve, reject) {
+        function fulfilled(value) { try { step(generator.next(value)); } catch (e) { reject(e); } }
+        function rejected(value) { try { step(generator["throw"](value)); } catch (e) { reject(e); } }
+        function step(result) { result.done ? resolve(result.value) : adopt(result.value).then(fulfilled, rejected); }
+        step((generator = generator.apply(thisArg, _arguments || [])).next());
+    });
+};
+var __importDefault = (this && this.__importDefault) || function (mod) {
+    return (mod && mod.__esModule) ? mod : { "default": mod };
+};
+Object.defineProperty(exports, "__esModule", { value: true });
+const userInteraction_1 = __importDefault(require("../userInteraction"));
+function initial(_context) {
+    return __awaiter(this, void 0, void 0, function* () {
+        const choices = {
+            'add breakpoint': 'addBreakpoint',
+            'run scan': 'scan',
+            quit: null,
+        };
+        const { action: actionName } = yield userInteraction_1.default.prompt({
+            name: 'action',
+            type: 'list',
+            message: 'How would you like to proceed?:',
+            choices: Object.keys(choices),
+        });
+        const action = choices[actionName];
+        if (!action)
+            return;
+        return (yield Promise.resolve().then(() => __importStar(require(`./${action}`)))).default;
+    });
+}
+exports.default = initial;

package/built/cli/scan/ui/state/scan.js

@@ -0,0 +1,33 @@
+"use strict";
+var __awaiter = (this && this.__awaiter) || function (thisArg, _arguments, P, generator) {
+    function adopt(value) { return value instanceof P ? value : new P(function (resolve) { resolve(value); }); }
+    return new (P || (P = Promise))(function (resolve, reject) {
+        function fulfilled(value) { try { step(generator.next(value)); } catch (e) { reject(e); } }
+        function rejected(value) { try { step(generator["throw"](value)); } catch (e) { reject(e); } }
+        function step(result) { result.done ? resolve(result.value) : adopt(result.value).then(fulfilled, rejected); }
+        step((generator = generator.apply(thisArg, _arguments || [])).next());
+    });
+};
+var __importDefault = (this && this.__importDefault) || function (mod) {
+    return (mod && mod.__esModule) ? mod : { "default": mod };
+};
+Object.defineProperty(exports, "__esModule", { value: true });
+const hitBreakpoint_1 = __importDefault(require("./hitBreakpoint"));
+const initial_1 = __importDefault(require("./initial"));
+function scan(context) {
+    return __awaiter(this, void 0, void 0, function* () {
+        return new Promise((resolve) => {
+            context.on('breakpoint', (breakpoint) => {
+                context.removeAllListeners();
+                context.breakpoint = breakpoint;
+                resolve(hitBreakpoint_1.default);
+            });
+            context.on('complete', () => {
+                context.removeAllListeners();
+                resolve(initial_1.default);
+            });
+            context.scan();
+        });
+    });
+}
+exports.default = scan;

package/built/cli/scan/ui/state.js

@@ -0,0 +1,2 @@
+"use strict";
+Object.defineProperty(exports, "__esModule", { value: true });

package/built/cli/scan/ui/userInteraction.js

@@ -0,0 +1,97 @@
+"use strict";
+var __awaiter = (this && this.__awaiter) || function (thisArg, _arguments, P, generator) {
+    function adopt(value) { return value instanceof P ? value : new P(function (resolve) { resolve(value); }); }
+    return new (P || (P = Promise))(function (resolve, reject) {
+        function fulfilled(value) { try { step(generator.next(value)); } catch (e) { reject(e); } }
+        function rejected(value) { try { step(generator["throw"](value)); } catch (e) { reject(e); } }
+        function step(result) { result.done ? resolve(result.value) : adopt(result.value).then(fulfilled, rejected); }
+        step((generator = generator.apply(thisArg, _arguments || [])).next());
+    });
+};
+var __importDefault = (this && this.__importDefault) || function (mod) {
+    return (mod && mod.__esModule) ? mod : { "default": mod };
+};
+Object.defineProperty(exports, "__esModule", { value: true });
+exports.UserInteraction = void 0;
+const inquirer_1 = __importDefault(require("inquirer"));
+const ora_1 = __importDefault(require("ora"));
+const boxen_1 = __importDefault(require("boxen"));
+const util_1 = require("../../../rules/lib/util");
+// KEG: Sorry, copied from packages/cli/src/cmds/userInteraction.ts
+class UserInteraction {
+    constructor() {
+        this.spinner = (0, ora_1.default)();
+    }
+    prompt(questions, opts) {
+        return __awaiter(this, void 0, void 0, function* () {
+            const wasSpinning = this.spinner.isSpinning;
+            if (wasSpinning) {
+                this.spinner.stop();
+                this.spinner.clear();
+            }
+            const result = yield inquirer_1.default.prompt(questions);
+            if (wasSpinning && !(opts === null || opts === void 0 ? void 0 : opts.supressSpinner)) {
+                this.spinner.start();
+            }
+            return result;
+        });
+    }
+    continue(msg) {
+        return __awaiter(this, void 0, void 0, function* () {
+            yield inquirer_1.default.prompt({ type: 'input', name: 'confirm', message: msg });
+        });
+    }
+    confirm(msg) {
+        return __awaiter(this, void 0, void 0, function* () {
+            const { confirm } = yield inquirer_1.default.prompt({
+                type: 'confirm',
+                name: 'confirm',
+                message: msg,
+            });
+            return confirm;
+        });
+    }
+    progress(msg) {
+        console.log(msg);
+    }
+    success(msg, align = 'center') {
+        if (this.spinner.isSpinning) {
+            this.spinner.succeed();
+        }
+        if (msg) {
+            console.log((0, boxen_1.default)(msg, {
+                padding: 1,
+                margin: 1,
+                borderStyle: 'round',
+                textAlignment: align,
+            }));
+        }
+    }
+    error(msg) {
+        if (this.spinner.isSpinning) {
+            this.spinner.fail();
+        }
+        if (msg) {
+            console.error('');
+            console.error(msg);
+        }
+    }
+    warn(msg) {
+        console.error(msg);
+    }
+    get status() {
+        return this.spinner.text;
+    }
+    set status(value) {
+        if (this.spinner.isSpinning) {
+            this.spinner.succeed();
+        }
+        this.spinner.text = value;
+        if (!this.spinner.isSpinning && !(0, util_1.verbose)()) {
+            this.spinner.start();
+        }
+    }
+}
+exports.UserInteraction = UserInteraction;
+const UI = new UserInteraction();
+exports.default = UI;

package/built/configuration/configurationProvider.js

@@ -83,7 +83,7 @@ function loadFromDir(ruleName) {
         if ((0, util_1.verbose)())
             console.log(`Loaded rule ${ruleName}: ${rule}`);
         try {
-            options = yield Promise.resolve().then(() => __importStar(require(`../rules/${ruleName}/options`)));
+            options = (yield Promise.resolve().then(() => __importStar(require(`../rules/${ruleName}/options`)))).default;
             if ((0, util_1.verbose)())
                 console.log(`Loaded rule ${ruleName} options: ${options}`);
         }

package/built/database/index.js

@@ -126,14 +126,27 @@ function* sqlStrings(event, appMapIndex, filter = () => true) {
     }
 }
 exports.sqlStrings = sqlStrings;
-function countJoins(ast) {
+function countJoins(ast, filterTable) {
     if (!ast)
         return 0;
     let joins = 0;
     (0, visit_1.visit)(ast, {
         'map.join': (node) => {
             var _a;
-            joins += ((_a = node.map) !== null && _a !== void 0 ? _a : []).length;
+            const map = (_a = node.map) !== null && _a !== void 0 ? _a : [];
+            const tableCount = filterTable
+                ? map.filter((entry) => {
+                    const source = entry === null || entry === void 0 ? void 0 : entry.source;
+                    if (!source)
+                        return true;
+                    if (source.type !== 'identifier')
+                        return true;
+                    if (source.variant !== 'table')
+                        return true;
+                    return filterTable(source);
+                }).length
+                : map.length;
+            joins += tableCount;
         },
     });
     return joins;

package/built/progressReporter.js

@@ -0,0 +1,2 @@
+"use strict";
+Object.defineProperty(exports, "__esModule", { value: true });

package/built/ruleChecker.js

@@ -24,7 +24,8 @@ const eventUtil_1 = require("./eventUtil");
 const hashV1_1 = __importDefault(require("./algorithms/hash/hashV1"));
 const hashV2_1 = __importDefault(require("./algorithms/hash/hashV2"));
 class RuleChecker {
-    constructor() {
+    constructor(progress) {
+        this.progress = progress;
         this.scopes = {
             root: new rootScope_1.default(),
             command: new commandScope_1.default(),
@@ -33,15 +34,14 @@ class RuleChecker {
             transaction: new sqlTransactionScope_1.default(),
         };
     }
-    check(appMapFile, appMapIndex, check, findings) {
+    check(appMapFileName, appMapIndex, check, findings) {
         return __awaiter(this, void 0, void 0, function* () {
-            const scope = check.scope;
             if ((0, util_1.verbose)()) {
-                console.warn(`Checking AppMap ${appMapIndex.appMap.name} with scope ${scope}`);
+                console.warn(`Checking AppMap ${appMapIndex.appMap.name} with scope ${check.scope}`);
             }
-            const scopeIterator = this.scopes[scope];
+            const scopeIterator = this.scopes[check.scope];
             if (!scopeIterator) {
-                throw new errors_1.AbortError(`Invalid scope name "${scope}"`);
+                throw new errors_1.AbortError(`Invalid scope name "${check.scope}"`);
             }
             const callEvents = function* () {
                 const events = appMapIndex.appMap.events;
@@ -53,22 +53,28 @@ class RuleChecker {
                 if ((0, util_1.verbose)()) {
                     console.warn(`Scope ${scope.scope}`);
                 }
+                if (this.progress)
+                    yield this.progress.filterScope(check.scope, scope.scope);
                 const checkInstance = new checkInstance_1.default(check);
                 if (!check.filterScope(scope.scope, appMapIndex)) {
                     continue;
                 }
+                if (this.progress)
+                    yield this.progress.enterScope(scope.scope);
                 if (checkInstance.enumerateScope) {
                     for (const event of scope.events()) {
-                        yield this.checkEvent(event, scope.scope, appMapFile, appMapIndex, checkInstance, findings);
+                        yield this.checkEvent(event, scope.scope, appMapFileName, appMapIndex, checkInstance, findings);
                     }
                 }
                 else {
-                    yield this.checkEvent(scope.scope, scope.scope, appMapFile, appMapIndex, checkInstance, findings);
+                    yield this.checkEvent(scope.scope, scope.scope, appMapFileName, appMapIndex, checkInstance, findings);
                 }
+                if (this.progress)
+                    yield this.progress.leaveScope();
             }
         });
     }
-    checkEvent(event, scope, appMapFile, appMapIndex, checkInstance, findings) {
+    checkEvent(event, scope, appMapFileName, appMapIndex, checkInstance, findings) {
         return __awaiter(this, void 0, void 0, function* () {
             if (!event.isCall()) {
                 return;
@@ -82,6 +88,8 @@ class RuleChecker {
                 }
                 return;
             }
+            if (this.progress)
+                yield this.progress.filterEvent(event);
             if (!checkInstance.filterEvent(event, appMapIndex)) {
                 return;
             }
@@ -117,7 +125,7 @@ class RuleChecker {
                     relatedEvents.push((0, eventUtil_1.cloneEvent)(event));
                 });
                 return {
-                    appMapFile,
+                    appMapFile: appMapFileName,
                     checkId: checkInstance.checkId,
                     ruleId: checkInstance.ruleId,
                     ruleTitle: checkInstance.title,
@@ -134,7 +142,11 @@ class RuleChecker {
                     participatingEvents: Object.fromEntries(Object.entries(participatingEvents).map(([k, v]) => [k, (0, eventUtil_1.cloneEvent)(v)])),
                 };
             };
+            if (this.progress)
+                yield this.progress.matchEvent(event, appMapIndex);
             const matchResult = yield checkInstance.ruleLogic.matcher(event, appMapIndex, checkInstance.filterEvent.bind(checkInstance));
+            if (this.progress)
+                yield this.progress.matchResult(event, matchResult);
             const numFindings = findings.length;
             if (matchResult === true) {
                 let finding;

package/built/rules/deprecated-crypto-algorithm/metadata.js

@@ -0,0 +1,14 @@
+"use strict";
+Object.defineProperty(exports, "__esModule", { value: true });
+exports.labels = void 0;
+exports.labels = ['crypto.encrypt', 'crypto.decrypt', 'crypto.digest'];
+exports.default = {
+    title: 'Deprecated cryptographic algorithm',
+    scope: 'root',
+    enumerateScope: true,
+    impactDomain: 'Security',
+    references: {
+        'A02:2021': 'https://owasp.org/Top10/A02_2021-Cryptographic_Failures/',
+    },
+    labels: exports.labels,
+};

package/built/rules/deprecated-crypto-algorithm/rule.js

@@ -0,0 +1,44 @@
+"use strict";
+Object.defineProperty(exports, "__esModule", { value: true });
+exports.deprecatedAlgorithms = void 0;
+const metadata_1 = require("./metadata");
+exports.deprecatedAlgorithms = [
+    /\bcbc\b/i,
+    /\becb\b/i,
+    /\b3?des\b/i,
+    /\brc\d\b/i,
+    /\bmd\d\b/i,
+    /\bsha-?1\b/i,
+];
+// Also:
+// https://securitymusings.com/article/1587/algorithm-and-key-length-deprecation
+// http://www.daemonology.net/blog/2009-06-11-cryptographic-right-answers.html
+// Password handling: As soon as you receive a password, hash it using scrypt or PBKDF2 and erase the plaintext password from memory.
+// 1024-bit RSA or DSA
+// 160-bit ECDSA (elliptic curves)
+// 80/112-bit 2TDEA (two key triple DES)
+// PKCS #1 v1.5
+function matcher(event) {
+    if (!event.receiver)
+        return;
+    const receiverLabels = event.receiver.labels || [];
+    const deprecatedAlgorithm = receiverLabels
+        .filter((label) => label.startsWith('crypto.algorithm.'))
+        .map((label) => label.split('.').slice(2).join('.'))
+        .find((label) => exports.deprecatedAlgorithms.find((alg) => alg.test(label)));
+    if (deprecatedAlgorithm) {
+        return [
+            {
+                event,
+                message: `Deprecated crypto algorithm: ${deprecatedAlgorithm}`,
+            },
+        ];
+    }
+}
+function rule() {
+    return {
+        matcher,
+        where: (e) => !!metadata_1.labels.find((label) => e.labels.has(label)),
+    };
+}
+exports.default = rule;

package/built/rules/lib/parseRuleDescription.js

@@ -7,7 +7,10 @@ const fs_1 = __importDefault(require("fs"));
 const path_1 = require("path");
 const util_1 = require("./util");
 function parseRuleDescription(id) {
-    const content = fs_1.default.readFileSync((0, path_1.join)(__dirname, `../../../doc/rules/${(0, util_1.dasherize)(id)}.md`), 'utf-8');
+    const docPath = (0, path_1.join)(__dirname, `../../../doc/rules/${(0, util_1.dasherize)(id)}.md`);
+    if (!fs_1.default.existsSync(docPath))
+        return `No doc exists for rule ${id}`;
+    const content = fs_1.default.readFileSync(docPath, 'utf-8');
     const propertiesContent = content.match(/---\n((?:.*\n)+)---\n((?:.*\n)+?)##?#?/);
     if (!propertiesContent) {
         // This is probably a new doc that doesn't have front matter yet.

package/built/rules/lib/util.js

@@ -1,7 +1,37 @@
 "use strict";
+var __awaiter = (this && this.__awaiter) || function (thisArg, _arguments, P, generator) {
+    function adopt(value) { return value instanceof P ? value : new P(function (resolve) { resolve(value); }); }
+    return new (P || (P = Promise))(function (resolve, reject) {
+        function fulfilled(value) { try { step(generator.next(value)); } catch (e) { reject(e); } }
+        function rejected(value) { try { step(generator["throw"](value)); } catch (e) { reject(e); } }
+        function step(result) { result.done ? resolve(result.value) : adopt(result.value).then(fulfilled, rejected); }
+        step((generator = generator.apply(thisArg, _arguments || [])).next());
+    });
+};
+var __importDefault = (this && this.__importDefault) || function (mod) {
+    return (mod && mod.__esModule) ? mod : { "default": mod };
+};
 Object.defineProperty(exports, "__esModule", { value: true });
-exports.verbose = exports.toRegExpArray = exports.responseContentType = exports.toRegExp = exports.providesAuthentication = exports.pluralize = exports.dasherize = exports.camelize = exports.parseValue = exports.isRoot = exports.ideLink = exports.isTruthy = exports.isFalsey = exports.emptyValue = exports.capitalize = exports.appMapDir = void 0;
+exports.verbose = exports.toRegExpArray = exports.responseContentType = exports.toRegExp = exports.providesAuthentication = exports.pluralize = exports.dasherize = exports.camelize = exports.parseValue = exports.isRoot = exports.ideLink = exports.isTruthy = exports.isFalsey = exports.emptyValue = exports.capitalize = exports.appMapDir = exports.collectAppMapFiles = void 0;
 const path_1 = require("path");
+const util_1 = require("util");
+const glob_1 = require("glob");
+const assert_1 = __importDefault(require("assert"));
+function collectAppMapFiles(appmapFile, appmapDir) {
+    return __awaiter(this, void 0, void 0, function* () {
+        let files = [];
+        if (appmapDir) {
+            const glob = (0, util_1.promisify)(glob_1.glob);
+            files = yield glob(`${appmapDir}/**/*.appmap.json`);
+        }
+        else {
+            (0, assert_1.default)(appmapFile, 'Either appmapDir or appmapFile is required');
+            files = typeof appmapFile === 'string' ? [appmapFile] : appmapFile;
+        }
+        return files;
+    });
+}
+exports.collectAppMapFiles = collectAppMapFiles;
 let isVerbose = false;
 function verbose(v = null) {
     if (v === true || v === false) {

package/built/rules/too-many-joins/metadata.js

@@ -0,0 +1,10 @@
+"use strict";
+Object.defineProperty(exports, "__esModule", { value: true });
+exports.default = {
+    title: 'Too many joins',
+    enumerateScope: false,
+    impactDomain: 'Performance',
+    references: {
+        'CWE-1049': 'https://cwe.mitre.org/data/definitions/1049.html',
+    },
+};

package/built/rules/too-many-joins/options.js

@@ -0,0 +1,12 @@
+"use strict";
+Object.defineProperty(exports, "__esModule", { value: true });
+class Options {
+    constructor() {
+        this.warningLimit = 5;
+        this.excludeTables = [
+            { match: /^pg_/, ignoreCase: false },
+            { match: /^information_schema$/, ignoreCase: true },
+        ];
+    }
+}
+exports.default = Options;

package/built/rules/{tooManyJoins.js → too-many-joins/rule.js}

@@ -3,24 +3,26 @@ var __importDefault = (this && this.__importDefault) || function (mod) {
     return (mod && mod.__esModule) ? mod : { "default": mod };
 };
 Object.defineProperty(exports, "__esModule", { value: true });
-const database_1 = require("../database");
-const url_1 = require("url");
-const parseRuleDescription_1 = __importDefault(require("./lib/parseRuleDescription"));
-class Options {
-    constructor() {
-        this.warningLimit = 5;
+const assert_1 = __importDefault(require("assert"));
+const database_1 = require("../../database");
+const matchPattern_1 = require("../lib/matchPattern");
+function rule(options) {
+    const excludeTables = (0, matchPattern_1.buildFilters)(options.excludeTables);
+    function filterTable(table) {
+        (0, assert_1.default)(table.type === 'identifier');
+        (0, assert_1.default)(table.variant === 'table');
+        return !excludeTables.find((filter) => filter(table.name));
     }
-}
-// TODO: clean up (https://github.com/applandinc/scanner/issues/43)
-function build(options = new Options()) {
-    const joinCount = {};
+    // TODO: clean up (https://github.com/applandinc/scanner/issues/43)
     function matcher(command, appMapIndex, eventFilter) {
+        const joinCount = {};
         for (const sqlEvent of (0, database_1.sqlStrings)(command, appMapIndex, eventFilter)) {
             let occurrence = joinCount[sqlEvent.sql];
             if (!occurrence) {
+                const sqlAST = appMapIndex.sqlAST(sqlEvent.event);
                 occurrence = {
                     count: 1,
-                    joins: (0, database_1.countJoins)(appMapIndex.sqlAST(sqlEvent.event)),
+                    joins: (0, database_1.countJoins)(sqlAST, filterTable),
                     events: [sqlEvent.event],
                 };
                 joinCount[sqlEvent.sql] = occurrence;
@@ -46,16 +48,4 @@ function build(options = new Options()) {
         matcher,
     };
 }
-exports.default = {
-    id: 'too-many-joins',
-    title: 'Too many joins',
-    impactDomain: 'Performance',
-    enumerateScope: false,
-    references: {
-        'CWE-1049': new url_1.URL('https://cwe.mitre.org/data/definitions/1049.html'),
-    },
-    description: (0, parseRuleDescription_1.default)('tooManyJoins'),
-    url: 'https://appland.com/docs/analysis/rules-reference.html#too-many-joins',
-    Options,
-    build,
-};
+exports.default = rule;

package/built/sampleConfig/default.yml

@@ -1,6 +1,7 @@
 checks:
   - rule: authz-before-authn
   # - rule: circular-dependency
+  - rule: deprecated-crypto-algorithm
   - rule: deserialization-of-untrusted-data
   - rule: exec-of-untrusted-command
   - rule: http-500

package/doc/labels/crypto.decrypt.md

@@ -0,0 +1,7 @@
+---
+name: crypto.decrypt
+rules:
+  - deprecated-crypto-algorithm
+---
+
+A function that performs decryption.

package/doc/labels/crypto.digest.md

@@ -0,0 +1,7 @@
+---
+name: crypto.digest
+rules:
+  - deprecated-crypto-algorithm
+---
+
+A function that computes a cryptographic digest (or 'hash') of some data.

package/doc/labels/crypto.encrypt.md

@@ -1,6 +1,7 @@
 ---
 name: crypto.encrypt
 rules:
+  - deprecated-crypto-algorithm
   - unauthenticated-encryption
 ---
 

package/doc/rules/deprecated-crypto-algorithm.md

@@ -0,0 +1,15 @@
+---
+rule: deprecated-crypto-algorithm
+name: Deprecated crypto algorithm
+title: Deprecated cryptographic algorithm
+references:
+  A02:2021: https://owasp.org/Top10/A02_2021-Cryptographic_Failures/
+impactDomain: Security
+labels:
+  - crypto.encrypt
+  - crypto.decrypt
+  - crypto.digest
+scope: root
+---
+
+Ensure that cryptographic operations do not use deprecated algorithms.

package/doc/rules/http-500.md

@@ -8,7 +8,7 @@ impactDomain: Stability
 scope: http_server_request
 ---
 
-Identifies when an HTTP server requset has returned a 500 status code. HTTP 500 status code
+Identifies when an HTTP server request has returned a 500 status code. HTTP 500 status code
 generally indicate an unanticipated problem in the backend that is not handled in a predictable way.
 500 status codes are also hard for client code to handle, because they don't indicate any particular
 problem or suggest a solution.