@avi770/testteam 1.2.0 → 2.0.0

package/agents/35-csrf-tester.ts

@@ -0,0 +1,82 @@
+import type { Finding } from '../core/types';
+import { BaseAgent } from './base-agent';
+import { resolveEnvironment } from '../helpers/env-resolver';
+
+/** Common POST endpoints to test for CSRF protection. */
+const DEFAULT_POST_ENDPOINTS = [
+  '/api/auth/login',
+  '/api/tasks',
+  '/api/clients',
+] as const;
+
+const REQUEST_TIMEOUT_MS = 10_000;
+
+export class CsrfTesterAgent extends BaseAgent {
+  readonly agentId = 35;
+  readonly agentName = 'CSRF Tester';
+  private baseUrl = '';
+
+  protected async preFlight(): Promise<void> {
+    const { env } = await resolveEnvironment(this.config, this.phase);
+    this.baseUrl = env.baseUrl;
+  }
+
+  protected async execute(): Promise<Finding[]> {
+    const findings: Finding[] = [];
+    const endpoints = this.discoverEndpoints();
+
+    for (const endpoint of endpoints) {
+      const url = `${this.baseUrl}${endpoint}`;
+
+      try {
+        const response = await Promise.race([
+          fetch(url, {
+            method: 'POST',
+            headers: { 'Content-Type': 'application/json' },
+            body: JSON.stringify({ test: 'csrf-probe' }),
+            signal: AbortSignal.timeout(REQUEST_TIMEOUT_MS),
+          }),
+          new Promise<never>((_, reject) =>
+            setTimeout(() => reject(new Error('CSRF test timeout')), REQUEST_TIMEOUT_MS),
+          ),
+        ]) as Response;
+
+        if (response.status === 200 || response.status === 201) {
+          findings.push({
+            id: `${this.agentId}-no-csrf-${endpoint.replace(/\//g, '_')}`,
+            type: 'code-bug-security',
+            severity: 'high',
+            agentId: this.agentId,
+            module: 'csrf-tester',
+            description: `Endpoint ${endpoint} accepts POST requests without CSRF protection (status ${response.status})`,
+          });
+        }
+
+        this.addEvidence({
+          type: 'log',
+          path: `csrf-test-${endpoint.replace(/\//g, '_')}`,
+          description: `POST ${endpoint} without auth/CSRF headers: status=${response.status}`,
+        });
+      } catch (error) {
+        findings.push({
+          id: `${this.agentId}-request-failed-${endpoint.replace(/\//g, '_')}`,
+          type: 'infra-issue',
+          severity: 'low',
+          agentId: this.agentId,
+          module: 'csrf-tester',
+          description: `Failed to test endpoint ${endpoint}: ${error instanceof Error ? error.message : String(error)}`,
+        });
+      }
+    }
+
+    return findings;
+  }
+
+  private discoverEndpoints(): string[] {
+    if (this.config.modules && this.config.modules.length > 0) {
+      const moduleEndpoints = this.config.modules.map(m => `/api${m.route}`);
+      return [...new Set([...DEFAULT_POST_ENDPOINTS, ...moduleEndpoints])];
+    }
+    return [...DEFAULT_POST_ENDPOINTS];
+  }
+}

package/agents/36-auth-fuzzer.ts

@@ -0,0 +1,194 @@
+import type { Finding } from '../core/types';
+import { BaseAgent } from './base-agent';
+import { resolveEnvironment } from '../helpers/env-resolver';
+
+const REQUEST_TIMEOUT_MS = 10_000;
+const LOCKOUT_ATTEMPTS = 10;
+
+export class AuthFuzzerAgent extends BaseAgent {
+  readonly agentId = 36;
+  readonly agentName = 'Auth Fuzzer';
+  private baseUrl = '';
+
+  protected async preFlight(): Promise<void> {
+    const { env } = await resolveEnvironment(this.config, this.phase);
+    this.baseUrl = env.baseUrl;
+  }
+
+  protected async execute(): Promise<Finding[]> {
+    const findings: Finding[] = [];
+
+    // Test 1: SQL injection in login
+    const sqlInjectionFindings = await this.testSqlInjection();
+    findings.push(...sqlInjectionFindings);
+
+    // Test 2: Account lockout
+    const lockoutFindings = await this.testAccountLockout();
+    findings.push(...lockoutFindings);
+
+    // Test 3: JWT alg:none bypass
+    const jwtFindings = await this.testJwtAlgNone();
+    findings.push(...jwtFindings);
+
+    return findings;
+  }
+
+  private async testSqlInjection(): Promise<Finding[]> {
+    const findings: Finding[] = [];
+    const loginUrl = `${this.baseUrl}/api/auth/login`;
+
+    try {
+      const response = await Promise.race([
+        fetch(loginUrl, {
+          method: 'POST',
+          headers: { 'Content-Type': 'application/json' },
+          body: JSON.stringify({
+            email: "' OR 1=1 --",
+            password: 'anything',
+          }),
+          signal: AbortSignal.timeout(REQUEST_TIMEOUT_MS),
+        }),
+        new Promise<never>((_, reject) =>
+          setTimeout(() => reject(new Error('Timeout')), REQUEST_TIMEOUT_MS),
+        ),
+      ]) as Response;
+
+      if (response.status === 200 || response.status === 201) {
+        findings.push({
+          id: `${this.agentId}-sql-injection-login`,
+          type: 'code-bug-security',
+          severity: 'critical',
+          agentId: this.agentId,
+          module: 'auth-fuzzer',
+          description: `SQL injection in login succeeded — endpoint returned ${response.status} for malicious email input`,
+        });
+      }
+
+      this.addEvidence({
+        type: 'log',
+        path: 'sql-injection-test',
+        description: `SQL injection login test: status=${response.status}`,
+      });
+    } catch (error) {
+      findings.push({
+        id: `${this.agentId}-sql-injection-error`,
+        type: 'infra-issue',
+        severity: 'low',
+        agentId: this.agentId,
+        module: 'auth-fuzzer',
+        description: `SQL injection test failed to execute: ${error instanceof Error ? error.message : String(error)}`,
+      });
+    }
+
+    return findings;
+  }
+
+  private async testAccountLockout(): Promise<Finding[]> {
+    const findings: Finding[] = [];
+    const loginUrl = `${this.baseUrl}/api/auth/login`;
+    let got429 = false;
+
+    for (let i = 0; i < LOCKOUT_ATTEMPTS; i++) {
+      try {
+        const response = await Promise.race([
+          fetch(loginUrl, {
+            method: 'POST',
+            headers: { 'Content-Type': 'application/json' },
+            body: JSON.stringify({
+              email: 'lockout-test@example.com',
+              password: `wrong-password-${i}`,
+            }),
+            signal: AbortSignal.timeout(REQUEST_TIMEOUT_MS),
+          }),
+          new Promise<never>((_, reject) =>
+            setTimeout(() => reject(new Error('Timeout')), REQUEST_TIMEOUT_MS),
+          ),
+        ]) as Response;
+
+        if (response.status === 429) {
+          got429 = true;
+          break;
+        }
+      } catch {
+        // Request failed — continue testing
+      }
+    }
+
+    if (!got429) {
+      findings.push({
+        id: `${this.agentId}-no-lockout`,
+        type: 'code-bug-security',
+        severity: 'medium',
+        agentId: this.agentId,
+        module: 'auth-fuzzer',
+        description: `No account lockout after ${LOCKOUT_ATTEMPTS} failed login attempts — no 429 response received`,
+      });
+    }
+
+    this.addEvidence({
+      type: 'log',
+      path: 'lockout-test',
+      description: `Account lockout test: ${got429 ? 'lockout triggered' : 'no lockout detected'} after ${LOCKOUT_ATTEMPTS} attempts`,
+    });
+
+    return findings;
+  }
+
+  private async testJwtAlgNone(): Promise<Finding[]> {
+    const findings: Finding[] = [];
+
+    // Create a JWT with alg: "none"
+    const header = Buffer.from(JSON.stringify({ alg: 'none', typ: 'JWT' })).toString('base64url');
+    const payload = Buffer.from(
+      JSON.stringify({ sub: '1', email: 'admin@test.com', role: 'admin', iat: Math.floor(Date.now() / 1000) }),
+    ).toString('base64url');
+    const fakeJwt = `${header}.${payload}.`;
+
+    // Try accessing a protected endpoint
+    const protectedUrl = `${this.baseUrl}/api/tasks`;
+
+    try {
+      const response = await Promise.race([
+        fetch(protectedUrl, {
+          method: 'GET',
+          headers: {
+            'Authorization': `Bearer ${fakeJwt}`,
+            'Content-Type': 'application/json',
+          },
+          signal: AbortSignal.timeout(REQUEST_TIMEOUT_MS),
+        }),
+        new Promise<never>((_, reject) =>
+          setTimeout(() => reject(new Error('Timeout')), REQUEST_TIMEOUT_MS),
+        ),
+      ]) as Response;
+
+      if (response.status === 200) {
+        findings.push({
+          id: `${this.agentId}-jwt-alg-none`,
+          type: 'code-bug-security',
+          severity: 'critical',
+          agentId: this.agentId,
+          module: 'auth-fuzzer',
+          description: `Protected endpoint accepts JWT with alg:"none" — authentication bypass vulnerability`,
+        });
+      }
+
+      this.addEvidence({
+        type: 'log',
+        path: 'jwt-alg-none-test',
+        description: `JWT alg:none test: status=${response.status}`,
+      });
+    } catch (error) {
+      findings.push({
+        id: `${this.agentId}-jwt-test-error`,
+        type: 'infra-issue',
+        severity: 'low',
+        agentId: this.agentId,
+        module: 'auth-fuzzer',
+        description: `JWT alg:none test failed to execute: ${error instanceof Error ? error.message : String(error)}`,
+      });
+    }
+
+    return findings;
+  }
+}

package/agents/37-dependency-scanner.ts

@@ -0,0 +1,176 @@
+import { execFile } from 'node:child_process';
+import { promisify } from 'node:util';
+import type { Finding } from '../core/types';
+import { BaseAgent } from './base-agent';
+
+const execFileAsync = promisify(execFile);
+
+interface AuditVulnerability {
+  severity: string;
+  name: string;
+  title?: string;
+  url?: string;
+  range?: string;
+}
+
+interface AuditReport {
+  vulnerabilities?: Record<string, AuditVulnerability>;
+}
+
+interface OutdatedEntry {
+  current: string;
+  wanted: string;
+  latest: string;
+  type?: string;
+}
+
+type SeverityMap = Record<string, 'critical' | 'high' | 'medium' | 'low'>;
+
+const SEVERITY_MAP: SeverityMap = {
+  critical: 'critical',
+  high: 'high',
+  moderate: 'medium',
+  low: 'low',
+  info: 'low',
+};
+
+export class DependencyScannerAgent extends BaseAgent {
+  readonly agentId = 37;
+  readonly agentName = 'Dependency Scanner';
+
+  protected async preFlight(): Promise<void> {
+    // No special pre-conditions
+  }
+
+  protected async execute(): Promise<Finding[]> {
+    const findings: Finding[] = [];
+    const projectRoot = this.config.projectRoot ?? process.cwd();
+
+    // Run npm audit
+    const auditFindings = await this.runAudit(projectRoot);
+    findings.push(...auditFindings);
+
+    // Run npm outdated
+    const outdatedFindings = await this.runOutdated(projectRoot);
+    findings.push(...outdatedFindings);
+
+    return findings;
+  }
+
+  private async runAudit(projectRoot: string): Promise<Finding[]> {
+    const findings: Finding[] = [];
+
+    try {
+      let stdout: string;
+      try {
+        const result = await execFileAsync('npm', ['audit', '--json'], {
+          cwd: projectRoot,
+          timeout: 60_000,
+        });
+        stdout = result.stdout;
+      } catch (execError) {
+        // npm audit exits non-zero when vulnerabilities are found
+        const err = execError as { stdout?: string; stderr?: string };
+        if (err.stdout) {
+          stdout = err.stdout;
+        } else {
+          throw execError;
+        }
+      }
+
+      const report: AuditReport = JSON.parse(stdout);
+      const vulnerabilities = report.vulnerabilities ?? {};
+
+      for (const [name, vuln] of Object.entries(vulnerabilities)) {
+        const severity = SEVERITY_MAP[vuln.severity] ?? 'medium';
+        findings.push({
+          id: `${this.agentId}-vuln-${name}`,
+          type: 'code-bug-security',
+          severity,
+          agentId: this.agentId,
+          module: 'dependency-scanner',
+          description: `Vulnerability in ${name}: ${vuln.title ?? vuln.severity} (${vuln.url ?? 'no URL'})`,
+        });
+      }
+
+      this.addEvidence({
+        type: 'report',
+        path: 'npm-audit',
+        description: `npm audit found ${Object.keys(vulnerabilities).length} vulnerable packages`,
+      });
+    } catch (error) {
+      findings.push({
+        id: `${this.agentId}-audit-error`,
+        type: 'infra-issue',
+        severity: 'medium',
+        agentId: this.agentId,
+        module: 'dependency-scanner',
+        description: `npm audit failed: ${error instanceof Error ? error.message : String(error)}`,
+      });
+    }
+
+    return findings;
+  }
+
+  private async runOutdated(projectRoot: string): Promise<Finding[]> {
+    const findings: Finding[] = [];
+
+    try {
+      let stdout: string;
+      try {
+        const result = await execFileAsync('npm', ['outdated', '--json'], {
+          cwd: projectRoot,
+          timeout: 60_000,
+        });
+        stdout = result.stdout;
+      } catch (execError) {
+        // npm outdated exits non-zero when there are outdated packages
+        const err = execError as { stdout?: string; stderr?: string };
+        if (err.stdout) {
+          stdout = err.stdout;
+        } else {
+          throw execError;
+        }
+      }
+
+      if (!stdout || stdout.trim() === '') {
+        return findings;
+      }
+
+      const outdated: Record<string, OutdatedEntry> = JSON.parse(stdout);
+
+      for (const [name, info] of Object.entries(outdated)) {
+        const currentMajor = parseInt(info.current.split('.')[0], 10);
+        const latestMajor = parseInt(info.latest.split('.')[0], 10);
+
+        if (latestMajor - currentMajor >= 1) {
+          findings.push({
+            id: `${this.agentId}-outdated-${name}`,
+            type: 'test-bug',
+            severity: 'low',
+            agentId: this.agentId,
+            module: 'dependency-scanner',
+            description: `Package ${name} is ${latestMajor - currentMajor} major version(s) behind: current=${info.current}, latest=${info.latest}`,
+          });
+        }
+      }
+
+      this.addEvidence({
+        type: 'report',
+        path: 'npm-outdated',
+        description: `npm outdated found ${Object.keys(outdated).length} outdated packages`,
+      });
+    } catch (error) {
+      findings.push({
+        id: `${this.agentId}-outdated-error`,
+        type: 'infra-issue',
+        severity: 'low',
+        agentId: this.agentId,
+        module: 'dependency-scanner',
+        description: `npm outdated failed: ${error instanceof Error ? error.message : String(error)}`,
+      });
+    }
+
+    return findings;
+  }
+}

package/agents/38-secrets-scanner.ts

@@ -0,0 +1,137 @@
+import { readdir, readFile, stat } from 'node:fs/promises';
+import { join, extname } from 'node:path';
+import type { Finding } from '../core/types';
+import { BaseAgent } from './base-agent';
+
+/** File extensions to scan for secrets. */
+const SCANNABLE_EXTENSIONS = new Set(['.ts', '.tsx', '.js', '.json', '.env']);
+
+/** Maximum file size to scan (1MB). */
+const MAX_FILE_SIZE = 1024 * 1024;
+
+/** Directories to skip. */
+const SKIP_DIRS = new Set(['node_modules', '.git', 'dist', 'out', 'coverage', '.next']);
+
+interface SecretPattern {
+  name: string;
+  regex: RegExp;
+}
+
+const SECRET_PATTERNS: SecretPattern[] = [
+  { name: 'AWS Access Key', regex: /AKIA[0-9A-Z]{16}/g },
+  { name: 'Stripe Live Key', regex: /sk_live_[a-zA-Z0-9]+/g },
+  { name: 'Hardcoded Password', regex: /password\s*[:=]\s*['"][^'"]+/gi },
+  { name: 'Private Key', regex: /-----BEGIN.*PRIVATE KEY-----/g },
+];
+
+export class SecretsScannerAgent extends BaseAgent {
+  readonly agentId = 38;
+  readonly agentName = 'Secrets Scanner';
+
+  protected async preFlight(): Promise<void> {
+    // No special pre-conditions
+  }
+
+  protected async execute(): Promise<Finding[]> {
+    const findings: Finding[] = [];
+    const projectRoot = this.config.projectRoot ?? process.cwd();
+
+    let scannedFiles = 0;
+    let totalMatches = 0;
+
+    try {
+      const files = await this.collectFiles(projectRoot);
+      scannedFiles = files.length;
+
+      for (const filePath of files) {
+        const fileFindings = await this.scanFile(filePath);
+        totalMatches += fileFindings.length;
+        findings.push(...fileFindings);
+      }
+    } catch (error) {
+      findings.push({
+        id: `${this.agentId}-scan-error`,
+        type: 'infra-issue',
+        severity: 'medium',
+        agentId: this.agentId,
+        module: 'secrets-scanner',
+        description: `Failed to scan project files: ${error instanceof Error ? error.message : String(error)}`,
+      });
+    }
+
+    this.addEvidence({
+      type: 'report',
+      path: 'secrets-scan',
+      description: `Scanned ${scannedFiles} files, found ${totalMatches} potential secrets`,
+    });
+
+    return findings;
+  }
+
+  private async collectFiles(dir: string, depth = 0): Promise<string[]> {
+    if (depth > 5) return [];
+
+    const files: string[] = [];
+
+    try {
+      const entries = await readdir(dir, { withFileTypes: true });
+
+      for (const entry of entries) {
+        if (SKIP_DIRS.has(entry.name)) continue;
+
+        const fullPath = join(dir, entry.name);
+
+        if (entry.isDirectory()) {
+          const subFiles = await this.collectFiles(fullPath, depth + 1);
+          files.push(...subFiles);
+        } else if (entry.isFile() && SCANNABLE_EXTENSIONS.has(extname(entry.name))) {
+          try {
+            const fileStat = await stat(fullPath);
+            if (fileStat.size <= MAX_FILE_SIZE) {
+              files.push(fullPath);
+            }
+          } catch {
+            // Skip inaccessible files
+          }
+        }
+      }
+    } catch {
+      // Skip inaccessible directories
+    }
+
+    return files;
+  }
+
+  private async scanFile(filePath: string): Promise<Finding[]> {
+    const findings: Finding[] = [];
+
+    try {
+      const content = await readFile(filePath, 'utf-8');
+      const lines = content.split('\n');
+
+      for (const pattern of SECRET_PATTERNS) {
+        for (let lineIdx = 0; lineIdx < lines.length; lineIdx++) {
+          const line = lines[lineIdx];
+          // Reset regex lastIndex for global patterns
+          pattern.regex.lastIndex = 0;
+          if (pattern.regex.test(line)) {
+            findings.push({
+              id: `${this.agentId}-secret-${pattern.name.replace(/\s/g, '-').toLowerCase()}-${filePath.replace(/[\\/]/g, '_')}-L${lineIdx + 1}`,
+              type: 'code-bug-security',
+              severity: 'high',
+              agentId: this.agentId,
+              module: 'secrets-scanner',
+              file: filePath,
+              line: lineIdx + 1,
+              description: `Potential ${pattern.name} found in ${filePath} at line ${lineIdx + 1}`,
+            });
+          }
+        }
+      }
+    } catch {
+      // Skip unreadable files
+    }
+
+    return findings;
+  }
+}