@cdxgen/cdxgen 0.0.1 → 13.0.0

package/data/rules/package-integrity.yaml

@@ -0,0 +1,364 @@
+# Package Integrity and Lifecycle Rules
+# Category: package-integrity
+# Detects deprecated, yanked, or tampered packages and suspicious metadata
+
+- id: INT-001
+  name: "npm package with install script"
+  description: "npm packages with lifecycle hooks (preinstall, postinstall, etc.) execute arbitrary code during installation"
+  severity: medium
+  category: package-integrity
+  dry-run-support: full
+  condition: |
+    components[
+      $prop($, 'cdx:npm:hasInstallScript') = 'true'
+    ]
+  location: |
+    { "bomRef": $."bom-ref", "purl": purl }
+  message: "npm package '{{ name }}@{{ version }}' has install-time execution hooks"
+  mitigation: "Review install scripts before use. Consider using --ignore-scripts or an allowlist-based approach"
+  evidence: |
+    {
+      "riskyScripts": $prop($, 'cdx:npm:risky_scripts'),
+      "isRegistryDependency": $prop($, 'cdx:npm:isRegistryDependency')
+    }
+
+- id: INT-002
+  name: "npm package name or version mismatch"
+  description: "Detected mismatch between expected and resolved package name or version, which may indicate dependency confusion or tampering"
+  severity: high
+  category: package-integrity
+  dry-run-support: full
+  condition: |
+    components[
+      $hasProp($, 'cdx:npm:nameMismatchError')
+      or $hasProp($, 'cdx:npm:versionMismatchError')
+    ]
+  location: |
+    { "bomRef": $."bom-ref", "purl": purl }
+  message: "npm package '{{ name }}@{{ version }}' has a name or version mismatch"
+  mitigation: "Investigate the mismatch immediately. This may indicate dependency confusion, registry tampering, or a corrupted lockfile"
+  evidence: |
+    {
+      "nameMismatch": $prop($, 'cdx:npm:nameMismatchError'),
+      "versionMismatch": $prop($, 'cdx:npm:versionMismatchError')
+    }
+
+- id: INT-003
+  name: "Deprecated Go module"
+  description: "Go modules marked as deprecated may contain known issues or be abandoned"
+  severity: medium
+  category: package-integrity
+  dry-run-support: no
+  condition: |
+    components[
+      $hasProp($, 'cdx:go:deprecated')
+    ]
+  location: |
+    { "bomRef": $."bom-ref", "purl": purl }
+  message: "Go module '{{ name }}' is deprecated: {{ $prop($, 'cdx:go:deprecated') }}"
+  mitigation: "Migrate to the recommended replacement module or assess continued usage risk"
+  evidence: |
+    {
+      "deprecationNotice": $prop($, 'cdx:go:deprecated'),
+      "isIndirect": $prop($, 'cdx:go:indirect')
+    }
+
+- id: INT-004
+  name: "Yanked Ruby gem in dependency tree"
+  description: "Yanked gems have been removed from RubyGems, typically due to security issues or critical bugs"
+  severity: high
+  category: package-integrity
+  dry-run-support: no
+  condition: |
+    components[
+      $prop($, 'cdx:gem:yanked') = 'true'
+    ]
+  location: |
+    { "bomRef": $."bom-ref", "purl": purl }
+  message: "Ruby gem '{{ name }}@{{ version }}' has been yanked from RubyGems"
+  mitigation: "Update to a non-yanked version immediately. Yanked gems are typically removed due to security or correctness issues"
+  evidence: |
+    {
+      "platform": $contains(purl, 'platform=') ? $substringAfter(purl, 'platform=') : 'ruby',
+      "isPrerelease": $prop($, 'cdx:gem:prerelease')
+    }
+
+- id: INT-005
+  name: "npm deprecated package"
+  description: "npm packages marked as deprecated may have known vulnerabilities or unmaintained code"
+  severity: low
+  category: package-integrity
+  dry-run-support: partial
+  condition: |
+    components[
+      $prop($, 'cdx:npm:deprecated') = 'true'
+    ]
+  location: |
+    { "bomRef": $."bom-ref", "purl": purl }
+  message: "npm package '{{ name }}@{{ version }}' is deprecated: {{ $prop($, 'cdx:npm:deprecation_notice') }}"
+  mitigation: "Migrate to a maintained alternative package"
+  evidence: |
+    {
+      "deprecationNotice": $prop($, 'cdx:npm:deprecation_notice')
+    }
+
+- id: INT-006
+  name: "Dart pub uses non-default registry"
+  description: "Dart packages from non-default registries may introduce unvetted code"
+  severity: low
+  category: package-integrity
+  dry-run-support: full
+  condition: |
+    components[
+      $hasProp($, 'cdx:pub:registry')
+    ]
+  location: |
+    { "bomRef": $."bom-ref", "purl": purl }
+  message: "Dart package '{{ name }}' sourced from non-default registry: {{ $prop($, 'cdx:pub:registry') }}"
+  mitigation: "Verify registry trustworthiness"
+  evidence: |
+    {
+      "registry": $prop($, 'cdx:pub:registry')
+    }
+
+- id: INT-007
+  name: "Maven shaded/relocated package"
+  description: "Maven packages with shaded or relocated classes may obscure the true dependency graph and introduce hidden vulnerabilities"
+  severity: low
+  category: package-integrity
+  dry-run-support: full
+  condition: |
+    components[
+      $prop($, 'cdx:maven:shaded') = 'true'
+    ]
+  location: |
+    { "bomRef": $."bom-ref", "purl": purl }
+  message: "Maven package '{{ name }}@{{ version }}' contains shaded/relocated classes"
+  mitigation: "Prefer non-shaded dependency variants where available to maintain transparent dependency resolution"
+  evidence: |
+    {
+      "unshadedNamespaces": $prop($, 'cdx:maven:unshadedNamespaces'),
+      "scope": $prop($, 'cdx:maven:component_scope')
+    }
+
+- id: INT-008
+  name: "README file contains hidden Unicode characters"
+  description: "Hidden Unicode in README files can conceal malicious or misleading content in code review, especially inside comments"
+  severity: medium
+  category: package-integrity
+  dry-run-support: full
+  condition: |
+    formulation.components[
+      $prop($, 'cdx:file:kind') = 'readme'
+      and $prop($, 'cdx:file:hasHiddenUnicode') = 'true'
+    ]
+  location: |
+    {
+      "bomRef": $."bom-ref",
+      "file": $prop($, 'internal:SrcFile')
+    }
+  message: "README file '{{ name }}' contains hidden Unicode characters"
+  mitigation: "Review the file with hidden-character rendering enabled, remove suspicious bidirectional or zero-width characters, and verify comment blocks carefully before merge"
+  evidence: |
+    {
+      "codePoints": $prop($, 'cdx:file:hiddenUnicodeCodePoints'),
+      "lineNumbers": $prop($, 'cdx:file:hiddenUnicodeLineNumbers'),
+      "inComments": $prop($, 'cdx:file:hiddenUnicodeInComments')
+    }
+
+- id: INT-009
+  name: "npm lifecycle hook contains obfuscated or encoded execution"
+  description: "Lifecycle hooks that decode base64 payloads, hide long encoded blobs, or blend obfuscation with install-time execution are high-confidence supply-chain abuse indicators"
+  severity: critical
+  category: package-integrity
+  dry-run-support: full
+  attack:
+    tactics: [TA0005]
+    techniques: [T1027]
+  condition: |
+    components[
+      $prop($, 'cdx:npm:hasObfuscatedLifecycleScript') = 'true'
+    ]
+  location: |
+    { "bomRef": $."bom-ref", "purl": purl }
+  message: "npm package '{{ name }}@{{ version }}' contains obfuscated install-time lifecycle scripts '{{ $prop($, 'cdx:npm:obfuscatedLifecycleScripts') }}'"
+  mitigation: "Treat encoded or obfuscated lifecycle hooks as suspicious by default. Review the decoded payload, inspect any referenced script files, and avoid installing until provenance and maintainer intent are verified"
+  evidence: |
+    {
+      "scripts": $prop($, 'cdx:npm:obfuscatedLifecycleScripts'),
+      "obfuscationIndicators": $prop($, 'cdx:npm:lifecycleObfuscationIndicators'),
+      "executionIndicators": $prop($, 'cdx:npm:lifecycleExecutionIndicators'),
+      "indicatorMap": $prop($, 'cdx:npm:lifecycleIndicatorMap')
+    }
+
+- id: INT-010
+  name: "Yanked Cargo crate in dependency tree"
+  description: "Crates yanked from crates.io are often removed because of security, correctness, or ecosystem breakage issues"
+  severity: high
+  category: package-integrity
+  dry-run-support: no
+  condition: |
+    components[
+      $prop($, 'cdx:cargo:yanked') = 'true'
+    ]
+  location: |
+    { "bomRef": $."bom-ref", "purl": purl }
+  message: "Cargo crate '{{ name }}@{{ version }}' has been yanked from crates.io"
+  mitigation: "Update to a non-yanked release and review any recent publisher or release-cadence changes before upgrading"
+  evidence: |
+    {
+      "publisher": $prop($, 'cdx:cargo:publisher'),
+      "priorPublisher": $prop($, 'cdx:cargo:priorPublisher'),
+      "publishTime": $prop($, 'cdx:cargo:publishTime'),
+      "releaseGapDays": $prop($, 'cdx:cargo:releaseGapDays')
+    }
+
+- id: INT-011
+  name: "Rust project uses native Cargo build surface"
+  description: "Cargo build scripts and native build helpers expand execution surface during build and deserve additional review before release"
+  severity: medium
+  category: package-integrity
+  dry-run-support: full
+  condition: |
+    formulation.components[
+      $prop($, 'cdx:rust:buildTool') = 'cargo'
+      and $prop($, 'cdx:cargo:hasNativeBuild') = 'true'
+    ]
+  location: |
+    {
+      "bomRef": $."bom-ref",
+      "file": $prop($, 'internal:SrcFile')
+    }
+  message: "Rust project '{{ name }}' uses Cargo build.rs or native build helpers"
+  mitigation: "Review `build.rs`, native build dependencies, and release workflows to ensure the build remains hermetic and expected"
+  evidence: |
+    {
+      "buildScript": $prop($, 'cdx:cargo:buildScript'),
+      "nativeBuildIndicators": $prop($, 'cdx:cargo:nativeBuildIndicators'),
+      "releaseProfiles": $prop($, 'cdx:cargo:releaseProfiles')
+    }
+
+- id: INT-012
+  name: "Rust native build uses mutable Cargo setup action"
+  description: "Native Cargo build surfaces deserve additional scrutiny when the workflow relies on mutable Cargo toolchain setup actions instead of immutable SHA-pinned references"
+  severity: medium
+  category: package-integrity
+  dry-run-support: full
+  condition: |
+    formulation.components[
+      $prop($, 'cdx:rust:buildTool') = 'cargo'
+      and $prop($, 'cdx:cargo:hasNativeBuild') = 'true'
+      and $count($$.components[
+        $prop($, 'cdx:github:action:ecosystem') = 'cargo'
+        and $contains($prop($, 'cdx:github:action:role'), 'toolchain')
+        and $prop($, 'cdx:github:action:versionPinningType') != 'sha'
+      ]) > 0
+    ]
+  location: |
+    {
+      "bomRef": $."bom-ref",
+      "file": $prop($, 'internal:SrcFile')
+    }
+  message: "Rust project '{{ name }}' combines native Cargo build surfaces with mutable Cargo toolchain setup actions"
+  mitigation: "Prefer SHA-pinned Cargo toolchain setup actions for release workflows, especially when build.rs or native helpers run during CI"
+  evidence: |
+    {
+      "buildScript": $prop($, 'cdx:cargo:buildScript'),
+      "buildScriptCapabilities": $prop($, 'cdx:cargo:buildScriptCapabilities'),
+      "toolchainActions": $$.components[
+        $prop($, 'cdx:github:action:ecosystem') = 'cargo'
+        and $contains($prop($, 'cdx:github:action:role'), 'toolchain')
+        and $prop($, 'cdx:github:action:versionPinningType') != 'sha'
+      ].$prop($, 'cdx:github:action:uses')
+    }
+
+- id: INT-013
+  name: "Rust native build is exercised by Cargo workflow steps"
+  description: "Cargo workflows that execute build/test/package/publish steps against native build surfaces increase the impact of build-script or native-helper changes"
+  severity: medium
+  category: package-integrity
+  dry-run-support: full
+  condition: |
+    formulation.components[
+      $prop($, 'cdx:rust:buildTool') = 'cargo'
+      and $prop($, 'cdx:cargo:hasNativeBuild') = 'true'
+      and (
+        $contains($prop($, 'cdx:cargo:buildScriptCapabilities'), 'process-execution')
+        or $contains($prop($, 'cdx:cargo:buildScriptCapabilities'), 'network-access')
+        or $contains($prop($, 'cdx:cargo:nativeBuildIndicators'), '-sys')
+      )
+      and $count($$.components[
+        $prop($, 'cdx:github:step:usesCargo') = 'true'
+        and (
+          $contains($prop($, 'cdx:github:step:cargoSubcommands'), 'build')
+          or $contains($prop($, 'cdx:github:step:cargoSubcommands'), 'test')
+          or $contains($prop($, 'cdx:github:step:cargoSubcommands'), 'package')
+          or $contains($prop($, 'cdx:github:step:cargoSubcommands'), 'publish')
+        )
+      ]) > 0
+    ]
+  location: |
+    {
+      "bomRef": $."bom-ref",
+      "file": $prop($, 'internal:SrcFile')
+    }
+  message: "Rust project '{{ name }}' runs Cargo build/test/package workflow steps against a native build surface"
+  mitigation: "Review build.rs, native helper crates, and workflow command scope before merging or publishing releases that exercise native build logic"
+  evidence: |
+    {
+      "buildScriptCapabilities": $prop($, 'cdx:cargo:buildScriptCapabilities'),
+      "nativeBuildIndicators": $prop($, 'cdx:cargo:nativeBuildIndicators'),
+      "cargoCommands": $$.components[
+        $prop($, 'cdx:github:step:usesCargo') = 'true'
+        and (
+          $contains($prop($, 'cdx:github:step:cargoSubcommands'), 'build')
+          or $contains($prop($, 'cdx:github:step:cargoSubcommands'), 'test')
+          or $contains($prop($, 'cdx:github:step:cargoSubcommands'), 'package')
+          or $contains($prop($, 'cdx:github:step:cargoSubcommands'), 'publish')
+        )
+      ].$prop($, 'cdx:github:step:command')
+    }
+
+- id: INT-014
+  name: "Collider package missing valid wrap hash pin"
+  description: "Collider lock entries should carry a SHA-256 wrap_hash so the selected wrap file remains integrity-pinned and reproducible"
+  severity: high
+  category: package-integrity
+  dry-run-support: full
+  condition: |
+    components[
+      $hasProp($, 'cdx:collider:dependencyKind')
+      and $prop($, 'cdx:collider:hasWrapHash') = 'false'
+    ]
+  location: |
+    { "bomRef": $."bom-ref", "purl": purl }
+  message: "Collider package '{{ name }}@{{ version }}' is missing a valid wrap hash integrity pin"
+  mitigation: "Recreate collider.lock with valid wrap_hash values and verify the lockfile against the repository before release"
+  evidence: |
+    {
+      "wrapHash": $prop($, 'cdx:collider:wrapHash'),
+      "wrapHashInvalid": $prop($, 'cdx:collider:wrapHashInvalid'),
+      "origin": $prop($, 'cdx:collider:origin'),
+      "dependencyKind": $prop($, 'cdx:collider:dependencyKind')
+    }
+
+- id: INT-015
+  name: "Ruby gem compiles native extensions at install time"
+  description: "A gem that declares extensions runs extconf.rb and a compiler on the install host, so installing it executes arbitrary code from the gem author. This is the RubyGems equivalent of an npm install script"
+  severity: low
+  category: package-integrity
+  dry-run-support: full
+  condition: |
+    components[
+      $hasProp($, 'cdx:gem:extensions')
+    ]
+  location: |
+    { "bomRef": $."bom-ref", "purl": purl }
+  message: "Ruby gem '{{ name }}@{{ version }}' compiles native extensions at install time ({{ $prop($, 'cdx:gem:extensions') }})"
+  mitigation: "Prefer the precompiled native gem for your platform so that no compiler runs at install time, and review the extconf.rb of gems you build from source"
+  evidence: |
+    {
+      "extensions": $prop($, 'cdx:gem:extensions'),
+      "platform": $contains(purl, 'platform=') ? $substringAfter(purl, 'platform=') : 'ruby',
+      "requiredRubyVersion": $prop($, 'cdx:gem:rubyVersionSpecifiers')
+    }

package/data/rules/rootfs-hardening.yaml

@@ -0,0 +1,179 @@
+# Rootfs and Offline Host Hardening Rules
+# Category: rootfs-hardening
+# Evaluates repository trust, trust anchors, privileged helpers, and service execution paths
+
+- id: RFS-001
+  name: "Enabled OS repository uses plaintext HTTP transport"
+  description: "Plain HTTP package repositories weaken integrity guarantees and make mirror tampering easier when network controls are absent."
+  severity: high
+  category: rootfs-hardening
+  dry-run-support: full
+  condition: |
+    components[
+      type = 'data'
+      and $hasProp($, 'cdx:os:repo:type')
+      and $safeStr($prop($, 'cdx:os:repo:enabled')) = 'true'
+      and $startsWith($lowercase($safeStr($prop($, 'cdx:os:repo:url'))), 'http://')
+    ]
+  location: |
+    {
+      "bomRef": $."bom-ref",
+      "purl": purl
+    }
+  message: "Repository '{{ name }}' is enabled and still uses plaintext HTTP: {{ $prop($, 'cdx:os:repo:url') }}"
+  mitigation: "Move package sources to HTTPS or a trusted local mirror protected by authenticated transport and repository signing."
+  evidence: |
+    {
+      "sourceFile": $prop($, 'internal:SrcFile'),
+      "repoType": $prop($, 'cdx:os:repo:type'),
+      "repoUrl": $prop($, 'cdx:os:repo:url')
+    }
+
+- id: RFS-002
+  name: "YUM repository has package signature checks disabled"
+  description: "Disabling gpgcheck in a configured YUM repository removes a core package authenticity control."
+  severity: critical
+  category: rootfs-hardening
+  dry-run-support: full
+  condition: |
+    components[
+      type = 'data'
+      and $safeStr($prop($, 'cdx:os:repo:type')) = 'yum-repository'
+      and $safeStr($prop($, 'cdx:os:repo:enabled')) = 'true'
+      and $safeStr($prop($, 'cdx:os:repo:gpgcheck')) = '0'
+    ]
+  location: |
+    {
+      "bomRef": $."bom-ref",
+      "purl": purl
+    }
+  message: "YUM repository '{{ name }}' is enabled with gpgcheck disabled"
+  mitigation: "Enable gpgcheck, pin the expected signing keys, and review recent repository changes before continuing to trust packages from this source."
+  evidence: |
+    {
+      "sourceFile": $prop($, 'internal:SrcFile'),
+      "repoUrl": $prop($, 'cdx:os:repo:url'),
+      "gpgcheck": $prop($, 'cdx:os:repo:gpgcheck'),
+      "gpgkey": $prop($, 'cdx:os:repo:gpgkey')
+    }
+
+- id: RFS-003
+  name: "Offline trust anchor is marked expired"
+  description: "Expired trust anchors inside an image or rootfs can break planned rotations and hide stale trust relationships."
+  severity: high
+  category: rootfs-hardening
+  dry-run-support: full
+  condition: |
+    components[
+      type = 'cryptographic-asset'
+      and $safeStr(cryptoProperties.assetType) = 'related-crypto-material'
+      and $safeStr(cryptoProperties.relatedCryptoMaterialProperties.state) = 'expired'
+    ]
+  location: |
+    {
+      "bomRef": $."bom-ref"
+    }
+  message: "Trust anchor '{{ name }}' is marked expired and should be reviewed"
+  mitigation: "Remove stale keys, replace expired trust anchors, and confirm the remaining repository trust chain matches approved policy."
+  evidence: |
+    {
+      "path": $prop($, 'internal:SrcFile'),
+      "trustDomain": $prop($, 'cdx:crypto:trustDomain'),
+      "keyId": $prop($, 'cdx:crypto:keyId'),
+      "expiresAt": $prop($, 'cdx:crypto:expiresAt')
+    }
+
+- id: RFS-004
+  name: "Offline image retains setuid GTFOBins execution helper"
+  description: "Setuid GTFOBins-capable binaries increase privilege-escalation exposure inside rootfs and golden image baselines."
+  severity: critical
+  category: rootfs-hardening
+  dry-run-support: full
+  condition: |
+    components[
+      type = 'file'
+      and (
+        $prop($, 'internal:has_setuid') = 'true'
+        or $prop($, 'internal:has_setgid') = 'true'
+      )
+      and $prop($, 'cdx:gtfobins:matched') = 'true'
+      and (
+        $listContains($prop($, 'cdx:gtfobins:functions'), 'shell')
+        or $listContains($prop($, 'cdx:gtfobins:functions'), 'command')
+        or $listContains($prop($, 'cdx:gtfobins:functions'), 'library-load')
+      )
+    ]
+  location: |
+    {
+      "bomRef": $."bom-ref",
+      "purl": purl
+    }
+  message: "Privileged helper '{{ name }}' keeps GTFOBins execution capability in the offline image"
+  mitigation: "Remove unnecessary setuid or setgid bits, replace the helper with a safer alternative, or justify and baseline the exposure explicitly."
+  evidence: |
+    {
+      "path": $prop($, 'internal:SrcFile'),
+      "functions": $prop($, 'cdx:gtfobins:functions'),
+      "contexts": $prop($, 'cdx:gtfobins:contexts'),
+      "riskTags": $prop($, 'cdx:gtfobins:riskTags')
+    }
+
+- id: RFS-005
+  name: "Offline service executes from writable or temporary path"
+  description: "Services pointing at writable or temporary paths are a strong persistence and drift signal in base images and offline hosts."
+  severity: critical
+  category: rootfs-hardening
+  dry-run-support: full
+  condition: |
+    $auditServices($)[
+      $contains($lowercase($safeStr($prop($, 'cdx:service:ExecStart'))), '/tmp/')
+      or $contains($lowercase($safeStr($prop($, 'cdx:service:ExecStart'))), '/var/tmp/')
+      or $contains($lowercase($safeStr($prop($, 'cdx:service:ExecStart'))), '/dev/shm/')
+      or $contains($lowercase($safeStr($prop($, 'cdx:service:ExecStart'))), '/home/')
+      or $contains($lowercase($safeStr($prop($, 'cdx:service:ExecStart'))), '/run/user/')
+    ]
+  location: |
+    {
+      "bomRef": $."bom-ref"
+    }
+  message: "Service '{{ name }}' launches from a writable or temporary path"
+  mitigation: "Relocate approved service binaries into trusted system paths and investigate any service definition that executes from writable directories."
+  evidence: |
+    {
+      "sourceFile": $prop($, 'internal:SrcFile'),
+      "manager": $prop($, 'cdx:service:manager'),
+      "execStart": $prop($, 'cdx:service:ExecStart'),
+      "packageRef": $prop($, 'cdx:service:packageRef')
+    }
+
+- id: RFS-006
+  name: "Offline service pre-start step fetches or shells remote content"
+  description: "ExecStartPre hooks that fetch remote content or shell inline commands add bootstrap drift and weaken image reproducibility."
+  severity: high
+  category: rootfs-hardening
+  dry-run-support: full
+  condition: |
+    $auditServices($)[
+      (
+        $contains($lowercase($safeStr($prop($, 'cdx:service:ExecStartPre'))), 'curl ')
+        or $contains($lowercase($safeStr($prop($, 'cdx:service:ExecStartPre'))), 'wget ')
+      )
+      and (
+        $contains($lowercase($safeStr($prop($, 'cdx:service:ExecStartPre'))), 'http://')
+        or $contains($lowercase($safeStr($prop($, 'cdx:service:ExecStartPre'))), 'https://')
+        or $contains($lowercase($safeStr($prop($, 'cdx:service:ExecStartPre'))), '| sh')
+        or $contains($lowercase($safeStr($prop($, 'cdx:service:ExecStartPre'))), '| bash')
+      )
+    ]
+  location: |
+    {
+      "bomRef": $."bom-ref"
+    }
+  message: "Service '{{ name }}' uses a remote-fetching ExecStartPre hook: {{ $prop($, 'cdx:service:ExecStartPre') }}"
+  mitigation: "Move bootstrap downloads into the image build pipeline, pin artifacts, and keep service startup paths deterministic and locally sourced."
+  evidence: |
+    {
+      "sourceFile": $prop($, 'internal:SrcFile'),
+      "manager": $prop($, 'cdx:service:manager'),
+      "execStartPre": $prop($, 'cdx:service:ExecStartPre')
+    }