@appland/scanner 1.67.0 → 1.69.1

package/doc/rules/deserialization-of-untrusted-data.md

@@ -10,18 +10,35 @@ labels:
   - deserialize.unsafe
   - deserialize.safe
   - deserialize.sanitize
+scope: http_server_request
 ---
 
 Finds occurrances of deserialization in which the mechanism employed is known to be unsafe, and the
-data is not known to be trusted.
+data comes from an untrusted source and hasn't passed through a sanitization mechanism.
 
 ### Rule logic
 
-Finds all events labeled `deserialize.unsafe`, that are not a descendant of an event labeled
-`deserialize.safe`. For each of these events, all event parameters are checked.
+Finds all events labeled `deserialize.unsafe` that receive tainted data (as
+determined by object identity or string value) as an input.
 
-Each parameter whose type is `string` or `object` is verified to ensure that it's trusted. For data
-to be trusted, it must be the return value of a function labeled `deserialize.sanitize`.
+For each of these events; checks if all the inputs have been sanitized.
+
+Data that has been passed to a function labeled `deserialize.sanitize` is
+assumed to be sanitized from this point onwards. Such a function could either
+check the value is sanitized (note no verification is currently done to ensure
+this result is checked) or return the transformed value after any necessary sanitization.
+
+Data passed to a function labeled `deserialized.safe` is considered in all
+functions called by it (down the callstack). Functions that first sanitize data
+and then use an unsafe deserialization function should carry this label.
+
+The set of tracked tainted data initially includes the HTTP message parameters
+and is expanded to include any non-primitive (ie. longer than 5 characters)
+observed outputs of functions that consume tainted data.
+
+The reliability of this rule now depends on completeness of the AppMap.
+If there is a data transformation that is	not captured it's invisible to the
+rule and will result in failure to associate it with the tracked untrusted data.
 
 ### Notes
 
@@ -30,9 +47,12 @@ that executes code shortly after deserialization.
 
 ### Resolution
 
-If you can guarantee that you are using unsafe deserialization in a safe way, but it's not possible
-to obtain the raw data from a function labeled `deserialize.sanitize`, you can wrap the
-deserialization in a function labeled `deserialize.safe`.
+Consider if the library you're using offers a safe deserialization function variant that you can
+use instead. Using unsafe functions is only rarely needed and typically requires a good reason.
+
+If you need to use the unsafe function, make sure you're able to handle unexpected input safely.
+Sanitize the data thoroughly first; label the sanitization function with `deserialize.sanitize` label
+or wrap the whole sanitization and deserialization logic in a function labeled `deserialize.safe`.
 
 If you need to deserialize untrusted data, JSON is often a good choice as it is only capable of
 returning ‘primitive’ types such as strings, arrays, hashes, numbers and nil. If you need to

package/doc/rules/http-500.md

@@ -8,7 +8,7 @@ impactDomain: Stability
 scope: http_server_request
 ---
 
-Identifies when an HTTP server requset has returned a 500 status code. HTTP 500 status code
+Identifies when an HTTP server request has returned a 500 status code. HTTP 500 status code
 generally indicate an unanticipated problem in the backend that is not handled in a predictable way.
 500 status codes are also hard for client code to handle, because they don't indicate any particular
 problem or suggest a solution.

package/package.json

@@ -1,6 +1,6 @@
 {
   "name": "@appland/scanner",
-  "version": "1.67.0",
+  "version": "1.69.1",
   "description": "",
   "bin": "built/cli.js",
   "files": [
@@ -63,12 +63,14 @@
     "ajv": "^8.8.2",
     "applicationinsights": "^2.1.4",
     "async": "^3.2.3",
+    "boxen": "^5.0.1",
     "chalk": "^4.1.2",
     "chokidar": "applandinc/chokidar#fix/new-file-new-directory-race-on-linux",
     "cli-progress": "^3.11.0",
     "conf": "^10.0.2",
     "form-data": "^4.0.0",
     "glob": "7.2.3",
+    "inquirer": "^8.1.2",
     "js-yaml": "^4.1.0",
     "lru-cache": "^6.0.0",
     "minimatch": "^3.0.4",