@chiranthmoger/fortifyjs 1.1.0

package/src/detectors/cmdi.js

@@ -0,0 +1,82 @@
+'use strict';
+
+const DANGEROUS_COMMANDS = 'rm|cat|wget|curl|nc|bash|sh|cmd|powershell|python|perl|ruby|node|php';
+
+module.exports = {
+  name: 'cmdi',
+  label: 'cmdi',
+  getSignals() {
+    return [
+      {
+        id: 'shell-command-chain',
+        confidence: 0.80,
+        pattern: new RegExp(`(?:;|&&|\\|\\|)\\s*(?:${DANGEROUS_COMMANDS})\\b`, 'i')
+      },
+      {
+        id: 'backtick-execution',
+        confidence: 0.85,
+        pattern: /`[^`]+`/
+      },
+      {
+        id: 'subshell-execution',
+        confidence: 0.85,
+        pattern: /\$\([^\)]+\)/
+      },
+      {
+        id: 'pipe-to-shell',
+        confidence: 0.75,
+        pattern: /\|\s*(?:sh|bash|cmd)\b/i
+      },
+      {
+        id: 'shell-binary-path',
+        confidence: 0.80,
+        pattern: /(?:\/bin\/sh|\/bin\/bash|\/usr\/bin\/env|cmd\.exe|powershell\.exe)\b/i
+      },
+      {
+        id: 'reverse-shell-pattern',
+        confidence: 0.90,
+        pattern: /(?:bash\s+-i\s+>&|nc\s+-e\s+\/bin\/sh|python\s+-c\s+['"]import\s+socket)/i
+      },
+      {
+        id: 'curl-wget-pipe',
+        confidence: 0.70,
+        pattern: /(?:curl|wget).*\|\s*(?:bash|sh)\b/i
+      },
+      {
+        id: 'windows-cmd-injection',
+        confidence: 0.80,
+        pattern: /(?:cmd(?:\.exe)?\s+\/c|powershell(?:\.exe)?\s+-(?:enc|e))\b/i
+      },
+      {
+        id: 'powershell-iex',
+        confidence: 0.85,
+        pattern: /(?:invoke-expression|iex)\b/i
+      },
+      {
+        id: 'windows-builtins',
+        confidence: 0.70,
+        pattern: /(?:^|[;&|])\s*(?:type|dir)(?:\s+[^\s]|$)/i
+      },
+      {
+        id: 'newline-injection',
+        confidence: 0.80,
+        pattern: /(?:%0[ad]|\r|\n)\s*(?:rm|cat|wget|curl|nc|bash|sh|cmd|powershell|python|perl|ruby|node|php)\b/i
+      },
+      {
+        id: 'env-variable-exfil',
+        confidence: 0.60,
+        pattern: /(?:\$(?:PATH|HOME|USER|ENV\{)|%(?:SYSTEMROOT|APPDATA|USERPROFILE|USERNAME)%)/i
+      },
+      {
+        id: 'process-substitution',
+        confidence: 0.75,
+        pattern: /[<>]\([^\)]+\)/
+      },
+      {
+        id: 'pipe-operator-command',
+        confidence: 0.80,
+        pattern: /\|\s*(?:ls|cat|whoami|id|pwd|dir|type)\b/i
+      }
+    ];
+  }
+};

package/src/detectors/crlf.js

@@ -0,0 +1,33 @@
+'use strict';
+
+const HEADER_PATTERN = '(?:Set-Cookie|Location|Bcc|Cc|Content-Type|Content-Length|X-[A-Za-z0-9-]+|Host|Authorization)\\s*:';
+
+module.exports = {
+  name: 'crlf',
+  label: 'crlf',
+  
+  getSignals() {
+    return [
+      {
+        id: 'crlf-header-injection',
+        confidence: 0.85,
+        pattern: new RegExp(`(?:\\r\\n|\\r|\\n|%0d%0a|%0a)[ \\t]*${HEADER_PATTERN}`, 'i')
+      },
+      {
+        id: 'crlf-encoded-header-injection',
+        confidence: 0.80,
+        pattern: new RegExp(`(?:\\u560a\\u560d|%E5%98%8A%E5%98%8D|\\\\u000d\\\\u000a)[ \\t]*${HEADER_PATTERN}`, 'i')
+      },
+      {
+        id: 'crlf-log-injection',
+        confidence: 0.75,
+        pattern: /(?:\r\n|\r|\n|%0d%0a|%0a)[ \t]*(?:\[?(?:info|error|warn|debug|trace)\]?|\[?\d{4}-\d{2}-\d{2}|\[?\d{1,3}\.\d{1,3}\.\d{1,3}\.\d{1,3})/i
+      },
+      {
+        id: 'crlf-newline-alone',
+        confidence: 0.40,
+        pattern: /(?:\r\n|%0d%0a)/i
+      }
+    ];
+  }
+};

package/src/detectors/graphql.js

@@ -0,0 +1,56 @@
+'use strict';
+
+function hasDeepNesting(value) {
+  let depth = 0;
+  let maxDepth = 0;
+  for (let i = 0; i < value.length; i++) {
+    if (value[i] === '{') {
+      depth++;
+      if (depth > maxDepth) maxDepth = depth;
+    } else if (value[i] === '}') {
+      depth--;
+    }
+  }
+  return maxDepth > 10;
+}
+
+function hasAliasBatching(value) {
+  const aliasPattern = /[a-zA-Z_][a-zA-Z0-9_]*\s*:\s*[a-zA-Z_][a-zA-Z0-9_]*/g;
+  const matches = value.match(aliasPattern);
+  return matches !== null && matches.length >= 100;
+}
+
+function hasFragmentSpreadAbuse(value) {
+  const spreadPattern = /\.\.\.[a-zA-Z0-9_]+/g;
+  const matches = value.match(spreadPattern);
+  return matches !== null && matches.length >= 10;
+}
+
+module.exports = {
+  name: 'graphql',
+  label: 'graphql',
+  getSignals() {
+    return [
+      {
+        id: 'graphql-introspection',
+        confidence: 0.9,
+        pattern: /\b(__schema|__type)\b/i
+      },
+      {
+        id: 'graphql-deep-nesting',
+        confidence: 0.8,
+        test: hasDeepNesting
+      },
+      {
+        id: 'graphql-alias-batching',
+        confidence: 0.85,
+        test: hasAliasBatching
+      },
+      {
+        id: 'graphql-fragment-spread-abuse',
+        confidence: 0.7,
+        test: hasFragmentSpreadAbuse
+      }
+    ];
+  }
+};

package/src/detectors/hpp.js

@@ -0,0 +1,38 @@
+'use strict';
+
+module.exports = {
+  name: 'hpp',
+  label: 'hpp',
+
+  detectQuery(query, allowedArrayParams = []) {
+    const signals = [];
+    if (!query || typeof query !== 'object') return signals;
+    
+    for (const [key, value] of Object.entries(query)) {
+      if (Array.isArray(value) && !allowedArrayParams.includes(key)) {
+        signals.push({
+          id: 'array-param-unexpected',
+          confidence: 0.55,
+          label: 'hpp'
+        });
+        
+        signals.push({
+          id: 'duplicate-query-param',
+          confidence: 0.60,
+          label: 'hpp'
+        });
+      }
+    }
+    return signals;
+  },
+
+  getSignals() {
+    return [
+      {
+        id: 'duplicate-query-param-string',
+        confidence: 0.60,
+        pattern: /(?:\?|&)([^=&]+)=.*&\1=/
+      }
+    ];
+  }
+};

package/src/detectors/ldap.js

@@ -0,0 +1,50 @@
+'use strict';
+
+function hasUnbalancedParenthesesWithLdapKeywords(value) {
+  const ldapKeywords = /\b(cn|uid|objectclass|memberof)\b/i;
+  if (!ldapKeywords.test(value)) {
+    return false;
+  }
+  
+  let depth = 0;
+  for (let i = 0; i < value.length; i++) {
+    if (value[i] === '(') depth++;
+    if (value[i] === ')') depth--;
+    if (depth < 0) return true;
+  }
+  return depth !== 0;
+}
+
+module.exports = {
+  name: 'ldap',
+  label: 'ldap',
+  getSignals() {
+    return [
+      {
+        id: 'ldap-filter-concatenation',
+        confidence: 0.8,
+        pattern: /\)\s*\(/
+      },
+      {
+        id: 'ldap-wildcard-bypass',
+        confidence: 0.9,
+        pattern: /\*\)\s*\(\s*objectClass\s*=\s*\*/i
+      },
+      {
+        id: 'ldap-or-injection',
+        confidence: 0.85,
+        pattern: /\)\s*\(\s*\|/
+      },
+      {
+        id: 'ldap-null-byte',
+        confidence: 0.9,
+        pattern: /(?:\x00|%00|\\00)/i
+      },
+      {
+        id: 'ldap-unbalanced-parentheses',
+        confidence: 0.7,
+        test: hasUnbalancedParenthesesWithLdapKeywords
+      }
+    ];
+  }
+};

package/src/detectors/nosqli.js

@@ -0,0 +1,134 @@
+'use strict';
+
+const MONGO_OPERATORS = [
+  '\\$gt', '\\$gte', '\\$lt', '\\$lte', '\\$ne', '\\$in', '\\$nin',
+  '\\$or', '\\$and', '\\$not', '\\$nor', '\\$exists', '\\$type',
+  '\\$expr', '\\$regex', '\\$options', '\\$text', '\\$search',
+  '\\$where', '\\$all', '\\$elemMatch', '\\$size', '\\$mod',
+  '\\$jsonSchema', '\\$accumulator', '\\$function'
+].join('|');
+
+const ES_OPERATORS = [
+  'script', 'inline', 'painless', 'mvel', 'ctx\\._source'
+].join('|');
+
+const COUCH_OPERATORS = [
+  '_design', '_view', '_find', 'map', 'reduce'
+].join('|');
+
+module.exports = {
+  name: 'nosqli',
+  label: 'nosqli',
+  
+  detectObject(obj, maxDepth = 20) {
+    const signals = [];
+    if (!obj || typeof obj !== 'object') return signals;
+    
+    function walk(node, depth) {
+      if (depth > maxDepth) return;
+      if (!node || typeof node !== 'object') return;
+      
+      if (Array.isArray(node)) {
+        for (const item of node) {
+          walk(item, depth + 1);
+        }
+        return;
+      }
+      
+      for (const key of Object.keys(node)) {
+        if (key.startsWith('$')) {
+          const validOperators = [
+            '$where', '$ne', '$gt', '$lt', '$gte', '$lte', '$in', '$nin', 
+            '$regex', '$expr', '$or', '$and', '$jsonSchema', '$function', 
+            '$accumulator', '$not', '$nor', '$exists', '$type', '$all', 
+            '$elemMatch', '$size', '$mod', '$options', '$text', '$search'
+          ];
+          
+          if (validOperators.includes(key)) {
+            signals.push({
+              id: 'mongo-operator-key',
+              confidence: 0.80,
+              label: 'nosqli'
+            });
+          }
+        }
+        
+        if (key.startsWith('_design/') || key === '_view' || key === 'map' || key === 'reduce') {
+          signals.push({
+            id: 'couchdb-injection',
+            confidence: 0.70,
+            label: 'nosqli'
+          });
+        }
+        
+        if (key === 'script' && node[key] && typeof node[key] === 'object' && (node[key].inline || node[key].source)) {
+           signals.push({
+              id: 'es-script-injection',
+              confidence: 0.80,
+              label: 'nosqli'
+           });
+        }
+        
+        walk(node[key], depth + 1);
+      }
+    }
+    
+    walk(obj, 0);
+    return signals;
+  },
+
+  getSignals() {
+    return [
+      {
+        id: 'mongo-operator-value',
+        confidence: 0.85,
+        pattern: new RegExp(`[{,]\\s*["']?\\$(?:where|ne|gt|lt|gte|lte|in|nin|regex|expr|or|and|jsonSchema|function|accumulator)["']?\\s*:\\s*{\\s*["']?(?:${MONGO_OPERATORS})["']?\\s*:`, 'i')
+      },
+      {
+        id: 'mongo-operator-in-string',
+        confidence: 0.70,
+        pattern: new RegExp(`[{,]\\s*["'](?:${MONGO_OPERATORS})["']\\s*:`, 'i')
+      },
+      {
+        id: 'mongo-where-injection',
+        confidence: 0.80,
+        pattern: /(?:\$where["']?\s*:\s*["']|where\s*\(\s*["']|\$?where["']?\s*:\s*(?:function|=>))/i
+      },
+      {
+        id: 'mongo-regex-redos',
+        confidence: 0.75,
+        pattern: /\$regex["']?\s*:\s*["'].*(?:\(\.\*\)|\(\.\+\)|\(\.\*|\.\+\)|\(\?.*\)|\.\*.*(?:\.\*|\.\+)|\.\+.*(?:\.\*|\.\+)|\([a-zA-Z0-9]+\+\)\+).*["']/i
+      },
+      {
+        id: 'mongo-regex-general',
+        confidence: 0.65,
+        pattern: /\$regex["']?\s*:\s*["'].*[\+\*\{].*["']/i
+      },
+      {
+        id: 'mongo-mapreduce',
+        confidence: 0.75,
+        pattern: /(?:mapReduce|\$function|\$accumulator)["']?\s*:\s*(?:["']?function\s*\(|{)/i
+      },
+      {
+        id: 'mongo-aggregation-abuse',
+        confidence: 0.70,
+        pattern: /(?:\$lookup|\$graphLookup|\$out|\$merge|\$addFields)["']?\s*:/i
+      },
+      {
+        id: 'mongo-jsonschema',
+        confidence: 0.75,
+        pattern: /(?:\$jsonSchema)["']?\s*:\s*{/i
+      },
+      {
+        id: 'couchdb-injection',
+        confidence: 0.75,
+        pattern: /["']_design\/[^"']*["']\s*:\s*{|["']_view["']\s*:\s*["']/i
+      },
+      {
+        id: 'es-script-injection',
+        confidence: 0.75,
+        pattern: /["']script["']\s*:\s*(?:{|["'](?:painless|mvel|inline|ctx\._source))/i
+      }
+    ];
+  }
+};

package/src/detectors/open-redirect.js

@@ -0,0 +1,42 @@
+'use strict';
+
+const REDIRECT_PARAMS = [
+  'redirect', 'url', 'next', 'return', 'returnUrl', 'continue', 'dest',
+  'destination', 'goto', 'target', 'link', 'out', 'view', 'rurl', 
+  'return_url', 'callback', 'forward'
+].join('|');
+
+module.exports = {
+  name: 'open-redirect',
+  label: 'open-redirect',
+  
+  getSignals() {
+    return [
+      {
+        id: 'redirect-param-external-url',
+        confidence: 0.75,
+        pattern: new RegExp(`(?:\\?|&)(?:${REDIRECT_PARAMS})=(?:https?:)?\\/\\/[^&]+`, 'i')
+      },
+      {
+        id: 'protocol-relative-redirect',
+        confidence: 0.70,
+        pattern: new RegExp(`(?:\\?|&)(?:${REDIRECT_PARAMS})=\\/\\/[a-zA-Z0-9]`, 'i')
+      },
+      {
+        id: 'backslash-redirect',
+        confidence: 0.75,
+        pattern: new RegExp(`(?:\\?|&)(?:${REDIRECT_PARAMS})=(?:\\\\\\/|\\/\\\\)[a-zA-Z0-9]`, 'i')
+      },
+      {
+        id: 'data-uri-redirect',
+        confidence: 0.80,
+        pattern: new RegExp(`(?:\\?|&)(?:${REDIRECT_PARAMS})=data:`, 'i')
+      },
+      {
+        id: 'javascript-uri-redirect',
+        confidence: 0.85,
+        pattern: new RegExp(`(?:\\?|&)(?:${REDIRECT_PARAMS})=javascript:`, 'i')
+      }
+    ];
+  }
+};

package/src/detectors/path-traversal.js

@@ -0,0 +1,55 @@
+'use strict';
+
+module.exports = {
+  name: 'path-traversal',
+  label: 'path-traversal',
+  getSignals() {
+    return [
+      {
+        id: 'dot-dot-slash',
+        confidence: 0.75,
+        pattern: /(?:\.\.[\\\/]){2,}/
+      },
+      {
+        id: 'windows-backslash-traversal',
+        confidence: 0.75,
+        pattern: /(?:\.\.\\){2,}/
+      },
+      {
+        id: 'url-encoded-traversal',
+        confidence: 0.80,
+        pattern: /(?:%2e%2e%2f|%252e%252e%252f|%2e%2e%5c|%252e%252e%255c){2,}/i
+      },
+      {
+        id: 'overlong-utf8-traversal',
+        confidence: 0.85,
+        pattern: /(?:%c0%ae%c0%ae%c0%af|%e0%40%ae%e0%40%ae%e0%40%af){2,}/i
+      },
+      {
+        id: 'double-dot-slash',
+        confidence: 0.75,
+        pattern: /(?:\.\.\.\.\/\/)+/
+      },
+      {
+        id: 'null-byte-injection',
+        confidence: 0.85,
+        pattern: /\x00/
+      },
+      {
+        id: 'sensitive-unix-file',
+        confidence: 0.80,
+        pattern: /(?:\/etc\/passwd|\/etc\/shadow|\/proc\/self\/environ|\/proc\/self\/fd\/|\/var\/log\/)/i
+      },
+      {
+        id: 'sensitive-windows-file',
+        confidence: 0.80,
+        pattern: /(?:\\SAM|\\boot\.ini|\\win\.ini|\\system32\\config)/i
+      },
+      {
+        id: 'dotfile-access',
+        confidence: 0.65,
+        pattern: /(?:\.env|\.git\/|\.htaccess|\.DS_Store|\.ssh\/|\.aws\/credentials)/i
+      }
+    ];
+  }
+};

package/src/detectors/prototype-pollution.js

@@ -0,0 +1,65 @@
+'use strict';
+
+module.exports = {
+  name: 'prototype-pollution',
+  label: 'prototype-pollution',
+  
+  detectObject(obj, maxDepth = 20) {
+    const signals = [];
+    if (!obj || typeof obj !== 'object') return signals;
+    
+    function walk(node, depth) {
+      if (depth > maxDepth) return;
+      if (!node || typeof node !== 'object') return;
+      
+      if (Array.isArray(node)) {
+        for (const item of node) {
+          walk(item, depth + 1);
+        }
+        return;
+      }
+      
+      for (const key of Object.keys(node)) {
+        if (key === '__proto__') {
+          signals.push({ id: 'proto-key', confidence: 0.90, label: 'prototype-pollution' });
+        } else if (key === 'constructor') {
+          signals.push({ id: 'constructor-key', confidence: 0.70, label: 'prototype-pollution' });
+        }
+        walk(node[key], depth + 1);
+      }
+    }
+    
+    walk(obj, 0);
+    return signals;
+  },
+
+  getSignals() {
+    return [
+      {
+        id: 'proto-key',
+        confidence: 0.90,
+        pattern: /"__proto__"\s*:/
+      },
+      {
+        id: 'constructor-prototype',
+        confidence: 0.85,
+        pattern: /constructor\.prototype/
+      },
+      {
+        id: 'constructor-key',
+        confidence: 0.70,
+        pattern: /"constructor"\s*:/
+      },
+      {
+        id: 'proto-in-url',
+        confidence: 0.80,
+        pattern: /(?:\?|&)[^=]*__proto__/
+      },
+      {
+        id: 'prototype-in-brackets',
+        confidence: 0.80,
+        pattern: /\[(?:'|")?__proto__(?:'|")?\]|\[(?:'|")?constructor(?:'|")?\]\s*\[(?:'|")?prototype(?:'|")?\]/
+      }
+    ];
+  }
+};