@datahogo/core 0.1.0

package/dist/rules/node-security.yaml

@@ -0,0 +1,380 @@
+rules:
+  # ID 128: Prototype pollution - deepMerge / lodash.merge without proto filter
+  - id: datahogo-prototype-pollution-merge
+    patterns:
+      - pattern-either:
+          - pattern: _.merge($OBJ, $REQ.body)
+          - pattern: _.merge($OBJ, $USER_INPUT)
+          - pattern: lodash.merge($OBJ, $REQ.body)
+          - pattern: deepmerge($OBJ, $REQ.body)
+          - pattern: merge($OBJ, $REQ.body)
+    message: "Merging user-controlled object without sanitization can cause prototype pollution - filter __proto__ and constructor keys"
+    severity: ERROR
+    languages: [typescript, javascript]
+    metadata:
+      datahogo_id: 128
+      datahogo_category: "node-security"
+      owasp_ref: "A03:2021"
+
+  - id: datahogo-prototype-pollution-bracket
+    patterns:
+      - pattern: |
+          $OBJ[$REQ.body.$KEY] = $REQ.body.$VALUE
+      - pattern-not: |
+          if ($KEY !== '__proto__' && $KEY !== 'constructor')
+    message: "Dynamic property assignment with user-controlled key can cause prototype pollution"
+    severity: ERROR
+    languages: [typescript, javascript]
+    metadata:
+      datahogo_id: 128
+      datahogo_category: "node-security"
+      owasp_ref: "A03:2021"
+
+  - id: datahogo-prototype-pollution-dynamic-key
+    patterns:
+      - pattern: |
+          function $FUNC($OBJ, $KEY, $VALUE) {
+            ...
+            $OBJ[$KEY] = $VALUE
+            ...
+          }
+      - pattern-not: |
+          if ($KEY === '__proto__' || $KEY === 'constructor' || $KEY === 'prototype')
+      - pattern-not: |
+          if (Object.prototype.hasOwnProperty.call(Object.prototype, $KEY))
+    message: "Deep assignment function missing prototype pollution protection - reject __proto__, constructor, and prototype keys"
+    severity: WARNING
+    languages: [typescript, javascript]
+    metadata:
+      datahogo_id: 128
+      datahogo_category: "node-security"
+      owasp_ref: "A03:2021"
+
+  # ID 129: ReDoS - regex with nested quantifiers
+  - id: datahogo-redos-nested-quantifiers
+    patterns:
+      - pattern-either:
+          - pattern: |
+              const $RE = /($PATTERN+)+/
+          - pattern: |
+              const $RE = /($PATTERN*)+/
+          - pattern: |
+              const $RE = /($PATTERN+)*/
+          - pattern: |
+              new RegExp("($PATTERN+)+")
+          - pattern: |
+              new RegExp("($PATTERN*)+")
+    message: "Regex with nested quantifiers (e.g. (a+)+) is vulnerable to ReDoS with crafted input - simplify or use a linear-time library"
+    severity: WARNING
+    languages: [typescript, javascript]
+    metadata:
+      datahogo_id: 129
+      datahogo_category: "node-security"
+      owasp_ref: "A05:2021"
+
+  - id: datahogo-redos-user-input-regex
+    patterns:
+      - pattern-either:
+          - pattern: new RegExp($REQ.body.$FIELD)
+          - pattern: new RegExp($REQ.query.$PARAM)
+          - pattern: new RegExp($USER_INPUT)
+      - pattern-not: |
+          safe-regex($INPUT)
+    message: "Regex constructed from user input can cause ReDoS or be abused for information disclosure - never allow user-defined regexes"
+    severity: ERROR
+    languages: [typescript, javascript]
+    metadata:
+      datahogo_id: 129
+      datahogo_category: "node-security"
+      owasp_ref: "A05:2021"
+
+  # ID 130: Insecure randomness
+  - id: datahogo-math-random-id
+    patterns:
+      - pattern-either:
+          - pattern: |
+              const $ID = Math.random().toString($BASE).slice($N)
+          - pattern: |
+              const $ID = Math.floor(Math.random() * $N)
+          - pattern: |
+              id: Math.random()
+      - metavariable-regex:
+          metavariable: $ID
+          regex: .*(id|token|key|secret|session|nonce|code).*
+    message: "Math.random() is predictable - use crypto.randomUUID() for IDs or crypto.randomBytes() for tokens"
+    severity: ERROR
+    languages: [typescript, javascript]
+    metadata:
+      datahogo_id: 130
+      datahogo_category: "node-security"
+      owasp_ref: "A02:2021"
+
+  # ID 131: Service worker without scope
+  - id: datahogo-service-worker-no-scope
+    patterns:
+      - pattern-either:
+          - pattern: |
+              navigator.serviceWorker.register($FILE)
+          - pattern: |
+              navigator.serviceWorker.register($FILE, {})
+      - pattern-not: |
+          navigator.serviceWorker.register($FILE, { scope: $SCOPE })
+    message: "Service worker registered without explicit scope - define scope to limit intercepted requests"
+    severity: WARNING
+    languages: [typescript, javascript]
+    metadata:
+      datahogo_id: 131
+      datahogo_category: "node-security"
+      owasp_ref: "A05:2021"
+
+  # ID 132: Function timeout missing
+  - id: datahogo-lambda-no-timeout
+    patterns:
+      - pattern-either:
+          - pattern: |
+              export const handler = async (event, context) => {
+                ...
+              }
+          - pattern: |
+              exports.handler = async (event) => {
+                ...
+              }
+      - pattern-not: |
+          context.callbackWaitsForEmptyEventLoop = false
+      - pattern-not: |
+          timeout: $N
+    message: "Serverless function without timeout configuration can be abused for resource exhaustion - configure a timeout"
+    severity: WARNING
+    languages: [typescript, javascript]
+    metadata:
+      datahogo_id: 132
+      datahogo_category: "serverless-cloud"
+      owasp_ref: "A05:2021"
+
+  # ID 134: console.log(process.env) - env vars in logs
+  - id: datahogo-console-log-process-env
+    patterns:
+      - pattern-either:
+          - pattern: console.log(process.env)
+          - pattern: console.log(..., process.env, ...)
+          - pattern: console.info(process.env)
+          - pattern: console.error(process.env)
+          - pattern: console.log(JSON.stringify(process.env))
+    message: "Logging process.env exposes all environment variables including secrets to logs"
+    severity: ERROR
+    languages: [typescript, javascript]
+    metadata:
+      datahogo_id: 134
+      datahogo_category: "serverless-cloud"
+      owasp_ref: "A09:2021"
+
+  - id: datahogo-console-log-env-var
+    patterns:
+      - pattern-either:
+          - pattern: console.log(..., process.env.$SECRET_VAR, ...)
+          - pattern: console.log(`...${ process.env.$SECRET_VAR }...`)
+      - metavariable-regex:
+          metavariable: $SECRET_VAR
+          regex: .*(KEY|SECRET|PASSWORD|TOKEN|PRIVATE|CREDENTIAL|PASS|PWD).*
+    message: "Logging secret environment variable exposes sensitive credentials"
+    severity: ERROR
+    languages: [typescript, javascript]
+    metadata:
+      datahogo_id: 134
+      datahogo_category: "serverless-cloud"
+      owasp_ref: "A09:2021"
+
+  # ID 135: Sensitive files in /tmp
+  - id: datahogo-sensitive-tmp-write
+    patterns:
+      - pattern-either:
+          - pattern: |
+              fs.writeFile("/tmp/$FILENAME", $DATA, ...)
+          - pattern: |
+              fs.writeFileSync("/tmp/$FILENAME", $DATA)
+          - pattern: |
+              fs.writeFile(`/tmp/${$FILENAME}`, ...)
+      - metavariable-regex:
+          metavariable: $FILENAME
+          regex: .*(password|token|key|secret|credential|auth|private).*
+    message: "Writing sensitive data to /tmp - files in /tmp may persist across Lambda invocations and be read by other functions"
+    severity: WARNING
+    languages: [typescript, javascript]
+    metadata:
+      datahogo_id: 135
+      datahogo_category: "serverless-cloud"
+      owasp_ref: "A02:2021"
+
+  # ID 136: Global variables with user data
+  - id: datahogo-global-user-data
+    patterns:
+      - pattern-either:
+          - pattern: |
+              global.$VAR = $REQ.body
+          - pattern: |
+              global.$VAR = $REQ.user
+          - pattern: |
+              global.$VAR = $USER_DATA
+      - metavariable-regex:
+          metavariable: $VAR
+          regex: .*(user|session|request|auth|current).*
+    message: "Storing user data in global variables causes data leakage between requests in serverless environments"
+    severity: WARNING
+    languages: [typescript, javascript]
+    metadata:
+      datahogo_id: 136
+      datahogo_category: "serverless-cloud"
+      owasp_ref: "A01:2021"
+
+  # ID 172: Console.log sensitive data
+  - id: datahogo-console-log-sensitive-fields
+    patterns:
+      - pattern-either:
+          - pattern: console.log($OBJ.password)
+          - pattern: console.log($OBJ.passwordHash)
+          - pattern: console.log($OBJ.creditCard)
+          - pattern: console.log($OBJ.ssn)
+          - pattern: console.log($OBJ.secret)
+          - pattern: console.log(`...${ $OBJ.password }...`)
+          - pattern: console.log(`...${ $OBJ.secret }...`)
+    message: "Logging sensitive fields (password, secret, credit card) exposes them in logs"
+    severity: WARNING
+    languages: [typescript, javascript]
+    metadata:
+      datahogo_id: 172
+      datahogo_category: "best-practices"
+      owasp_ref: "A09:2021"
+
+  - id: datahogo-console-log-credentials-object
+    patterns:
+      - pattern-either:
+          - pattern: console.log({ user: $U, password: $P })
+          - pattern: console.log({ email: $E, password: $P })
+          - pattern: console.log({ ..., password: $P, ... })
+    message: "Logging object with password field will expose credentials in logs"
+    severity: WARNING
+    languages: [typescript, javascript]
+    metadata:
+      datahogo_id: 172
+      datahogo_category: "best-practices"
+      owasp_ref: "A09:2021"
+
+  # ID 173: Stack traces to user
+  - id: datahogo-error-stack-to-user
+    patterns:
+      - pattern-either:
+          - pattern: |
+              $RESPONSE.json({ ..., stack: $ERROR.stack, ... })
+          - pattern: |
+              $RESPONSE.json({ error: $ERROR.stack })
+          - pattern: |
+              $RESPONSE.send($ERROR.stack)
+          - pattern: |
+              res.status($CODE).json({ ..., stack: err.stack })
+    message: "Stack trace returned to API caller exposes internal file paths and implementation details"
+    severity: WARNING
+    languages: [typescript, javascript]
+    metadata:
+      datahogo_id: 173
+      datahogo_category: "best-practices"
+      owasp_ref: "A05:2021"
+
+  - id: datahogo-error-message-to-user-verbose
+    patterns:
+      - pattern-either:
+          - pattern: |
+              $RESPONSE.json({ error: $ERROR.message })
+          - pattern: |
+              $RESPONSE.status($CODE).json({ message: $ERROR.message })
+      - pattern-not: |
+          if (process.env.NODE_ENV === "development")
+      - pattern-not: |
+          if (isDevelopment)
+    message: "Raw error messages sent to clients may expose internal details - use generic user-facing messages and log full errors server-side"
+    severity: INFO
+    languages: [typescript, javascript]
+    metadata:
+      datahogo_id: 173
+      datahogo_category: "best-practices"
+      owasp_ref: "A05:2021"
+
+  # ID 176: PII in logs
+  - id: datahogo-pii-in-logs-email
+    patterns:
+      - pattern-either:
+          - pattern: console.log(`...${ $USER.email }...`)
+          - pattern: console.log($USER.email)
+          - pattern: logger.info({ email: $EMAIL })
+          - pattern: logger.info(`user email: ${ $EMAIL }`)
+    message: "Logging user email addresses is PII exposure - use user IDs in logs and store emails separately"
+    severity: WARNING
+    languages: [typescript, javascript]
+    metadata:
+      datahogo_id: 176
+      datahogo_category: "best-practices"
+      owasp_ref: "A09:2021"
+
+  - id: datahogo-pii-in-logs-phone
+    patterns:
+      - pattern-either:
+          - pattern: console.log(`...${ $USER.phone }...`)
+          - pattern: console.log(`...${ $USER.phoneNumber }...`)
+          - pattern: logger.info({ phone: $PHONE })
+          - pattern: logger.info({ phoneNumber: $PHONE })
+    message: "Logging phone numbers is PII exposure - reference users by ID in logs"
+    severity: WARNING
+    languages: [typescript, javascript]
+    metadata:
+      datahogo_id: 176
+      datahogo_category: "best-practices"
+      owasp_ref: "A09:2021"
+
+  # ID 188: Payment data stored locally
+  - id: datahogo-payment-data-localstorage
+    patterns:
+      - pattern-either:
+          - pattern: localStorage.setItem($KEY, $CARD_DATA)
+          - pattern: sessionStorage.setItem($KEY, $CARD_DATA)
+      - metavariable-regex:
+          metavariable: $KEY
+          regex: .*(card|credit|payment|cvv|pan|billing|stripe).*
+    message: "Payment card data must never be stored in localStorage/sessionStorage - violates PCI-DSS compliance"
+    severity: CRITICAL
+    languages: [typescript, javascript]
+    metadata:
+      datahogo_id: 188
+      datahogo_category: "best-practices"
+      owasp_ref: "A02:2021"
+
+  - id: datahogo-payment-data-in-db
+    patterns:
+      - pattern-either:
+          - pattern: |
+              $DB.create({ ..., cardNumber: $NUM, ... })
+          - pattern: |
+              $DB.create({ ..., cvv: $CVV, ... })
+          - pattern: |
+              $DB.insert({ ..., card_number: $NUM, ... })
+    message: "Storing raw card numbers or CVV in the database violates PCI-DSS - use a payment processor token instead"
+    severity: CRITICAL
+    languages: [typescript, javascript]
+    metadata:
+      datahogo_id: 188
+      datahogo_category: "best-practices"
+      owasp_ref: "A02:2021"
+
+  # ID 130 Extended: Insecure randomness for session IDs
+  - id: datahogo-insecure-session-id
+    patterns:
+      - pattern-either:
+          - pattern: |
+              const $SID = Math.random().toString($BASE).slice($N)
+          - pattern: |
+              sessionId: Math.random().toString($BASE)
+    message: "Session IDs must be generated with cryptographically secure randomness - use crypto.randomBytes(32).toString('hex')"
+    severity: ERROR
+    languages: [typescript, javascript]
+    metadata:
+      datahogo_id: 130
+      datahogo_category: "node-security"
+      owasp_ref: "A07:2021"

package/dist/rules/rules/ai-llm-security.yaml

@@ -0,0 +1,199 @@
+rules:
+  # =============================================
+  # AI / LLM Security (IDs 200-208)
+  # =============================================
+
+  - id: datahogo-ai-prompt-injection
+    patterns:
+      - pattern-either:
+          - pattern: |
+              $MESSAGES = `...${$USER_INPUT}...`
+          - pattern: |
+              $MESSAGES.push({..., content: `...${$INPUT}...`})
+          - pattern: |
+              $CLIENT.messages.create({..., messages: [{..., content: `...${$INPUT}...`}]})
+    message: >
+      User input is interpolated directly into an LLM prompt. This enables prompt injection attacks
+      where an attacker can manipulate the AI's behavior. Sanitize or use structured prompts with
+      system/user role separation.
+    severity: WARNING
+    languages: [typescript, javascript]
+    metadata:
+      datahogo_id: 200
+      owasp: "A03:2021"
+      category: ai-llm
+
+  - id: datahogo-ai-api-key-frontend
+    patterns:
+      - pattern-either:
+          - pattern: process.env.NEXT_PUBLIC_ANTHROPIC_API_KEY
+          - pattern: process.env.NEXT_PUBLIC_OPENAI_API_KEY
+          - pattern: process.env.NEXT_PUBLIC_AI_API_KEY
+          - pattern: process.env.NEXT_PUBLIC_CLAUDE_API_KEY
+    message: >
+      AI API key is exposed via NEXT_PUBLIC_ environment variable, making it accessible in the browser.
+      AI API keys must only be used server-side.
+    severity: ERROR
+    languages: [typescript, javascript]
+    metadata:
+      datahogo_id: 203
+      owasp: "A07:2021"
+      category: ai-llm
+
+  - id: datahogo-ai-output-eval
+    patterns:
+      - pattern-either:
+          - pattern: eval($AI_RESPONSE)
+          - pattern: new Function($AI_RESPONSE)
+          - pattern: eval($COMPLETION.content)
+          - pattern: eval($RESPONSE.choices[0].message.content)
+    message: >
+      AI-generated output is passed to eval() or Function constructor. Never execute AI output as code —
+      it can be manipulated via prompt injection to run arbitrary code.
+    severity: ERROR
+    languages: [typescript, javascript]
+    metadata:
+      datahogo_id: 208
+      owasp: "A03:2021"
+      category: ai-llm
+
+  - id: datahogo-ai-no-output-sanitization
+    patterns:
+      - pattern: |
+          dangerouslySetInnerHTML={{__html: $AI_OUTPUT}}
+      - metavariable-regex:
+          metavariable: $AI_OUTPUT
+          regex: ".*(completion|response|aiOutput|generated|llm|chat|gpt|claude).*"
+    message: >
+      AI-generated content is rendered as HTML without sanitization. AI outputs can contain XSS payloads
+      via prompt injection. Always sanitize with DOMPurify before rendering.
+    severity: WARNING
+    languages: [typescript, javascript]
+    metadata:
+      datahogo_id: 204
+      category: ai-llm
+
+  # =============================================
+  # Database Connection Security (IDs 209-220)
+  # =============================================
+
+  - id: datahogo-db-connection-no-ssl
+    patterns:
+      - pattern-either:
+          - pattern: |
+              new Pool({..., ssl: false})
+          - pattern: |
+              new Client({..., ssl: false})
+          - pattern: |
+              createConnection({..., ssl: false})
+    message: >
+      Database connection has SSL explicitly disabled. Always use SSL/TLS for database connections
+      to prevent credential and data interception.
+    severity: WARNING
+    languages: [typescript, javascript]
+    metadata:
+      datahogo_id: 209
+      category: database-connection
+
+  - id: datahogo-db-ssl-reject-unauthorized-false
+    pattern: |
+      ssl: { rejectUnauthorized: false }
+    message: >
+      Database SSL certificate validation is disabled. This makes the connection vulnerable to
+      man-in-the-middle attacks. Use a proper CA certificate instead.
+    severity: WARNING
+    languages: [typescript, javascript]
+    metadata:
+      datahogo_id: 219
+      category: database-connection
+
+  - id: datahogo-db-default-credentials
+    patterns:
+      - pattern-regex: "(?:postgres|mysql|mongodb)://(?:postgres|root|admin):(?:postgres|root|admin|password|secret|test)@"
+    message: >
+      Database connection string uses default credentials. Use strong, unique passwords
+      managed via environment variables or a secrets manager.
+    severity: ERROR
+    languages: [typescript, javascript]
+    metadata:
+      datahogo_id: 211
+      category: database-connection
+
+  - id: datahogo-db-connection-string-logged
+    patterns:
+      - pattern-either:
+          - pattern: console.log(process.env.DATABASE_URL)
+          - pattern: console.log($X.connectionString)
+          - pattern: console.log(..., process.env.DATABASE_URL, ...)
+          - pattern: console.error(process.env.DATABASE_URL)
+    message: >
+      Database connection string (which may contain credentials) is logged. Remove logging of
+      connection strings to prevent credential exposure.
+    severity: WARNING
+    languages: [typescript, javascript]
+    metadata:
+      datahogo_id: 218
+      category: database-connection
+
+  - id: datahogo-db-hardcoded-host
+    patterns:
+      - pattern-regex: "host:\\s*['\"]\\w+\\.(?:rds\\.amazonaws\\.com|database\\.azure\\.com|cloudsql\\.google\\.com)['\"]"
+    message: >
+      Database host is hardcoded to a cloud provider endpoint. Use environment variables
+      to allow different configurations per environment.
+    severity: INFO
+    languages: [typescript, javascript]
+    metadata:
+      datahogo_id: 220
+      category: database-connection
+
+  # =============================================
+  # Cloud Provider Security (IDs 221-232)
+  # =============================================
+
+  - id: datahogo-cloud-metadata-ssrf
+    patterns:
+      - pattern-either:
+          - pattern: fetch("http://169.254.169.254/...")
+          - pattern: fetch(`http://169.254.169.254/...`)
+          - pattern: axios.get("http://169.254.169.254/...")
+    message: >
+      Request to cloud metadata endpoint detected. If user input can influence this URL,
+      it enables SSRF attacks to steal cloud credentials. Block metadata IPs in your HTTP client.
+    severity: ERROR
+    languages: [typescript, javascript]
+    metadata:
+      datahogo_id: 222
+      owasp: "A10:2021"
+      category: cloud
+
+  - id: datahogo-cloud-iam-star-star
+    patterns:
+      - pattern-regex: '"Action"\\s*:\\s*"\\*"[\\s\\S]{0,100}"Resource"\\s*:\\s*"\\*"'
+    message: >
+      IAM policy grants full access (Action: *, Resource: *). Follow least-privilege principle —
+      specify only the actions and resources needed.
+    severity: WARNING
+    languages: [json]
+    metadata:
+      datahogo_id: 224
+      category: cloud
+
+  - id: datahogo-cloud-s3-public
+    patterns:
+      - pattern-either:
+          - pattern: |
+              new s3.Bucket({..., publicReadAccess: true})
+          - pattern: |
+              ACL: "public-read"
+          - pattern: |
+              ACL: "public-read-write"
+    message: >
+      S3 bucket configured with public access. Unless intentionally serving public static assets,
+      buckets should be private with CloudFront or presigned URLs for access.
+    severity: ERROR
+    languages: [typescript, javascript]
+    metadata:
+      datahogo_id: 221
+      owasp: "A05:2021"
+      category: cloud