@datahogo/core 0.1.0

package/dist/rules/rules/auth-patterns.yaml

@@ -0,0 +1,406 @@
+rules:
+  # ID 77: Session Fixation - no session regeneration after login
+  - id: datahogo-session-fixation
+    patterns:
+      - pattern-either:
+          - pattern: |
+              async function login(...) {
+                ...
+              }
+          - pattern: |
+              async function signin(...) {
+                ...
+              }
+      - pattern-not: |
+          async function $FUNC(...) {
+            ...
+            $SESSION.regenerate(...)
+            ...
+          }
+      - pattern-not: |
+          async function $FUNC(...) {
+            ...
+            regenerateSession(...)
+            ...
+          }
+    message: "Login function should regenerate session ID to prevent session fixation attacks"
+    severity: ERROR
+    languages: [typescript, javascript]
+    metadata:
+      datahogo_id: 77
+      datahogo_category: "auth-sessions"
+      owasp_ref: "A07:2021"
+
+  # ID 79: Weak password policy - no length check
+  - id: datahogo-no-password-length-check
+    patterns:
+      - pattern-either:
+          - pattern: |
+              const password = $INPUT
+              ...
+              $DB.$METHOD({ password: $HASH })
+          - pattern: |
+              function $FUNC($PASSWORD, ...) {
+                ...
+                bcrypt.hash($PASSWORD, ...)
+                ...
+              }
+      - pattern-not: |
+          $PASSWORD.length >= $NUM
+      - pattern-not: |
+          $PASSWORD.length > $NUM
+      - pattern-not: |
+          if ($PASSWORD.length $OP $NUM)
+    message: "Password validation missing length requirement (minimum 8-12 characters recommended)"
+    severity: WARNING
+    languages: [typescript, javascript]
+    metadata:
+      datahogo_id: 79
+      datahogo_category: "auth-sessions"
+      owasp_ref: "A07:2021"
+
+  # ID 80: OAuth state missing
+  - id: datahogo-oauth-missing-state
+    patterns:
+      - pattern-either:
+          - pattern: |
+              const authUrl = `$OAUTH_ENDPOINT?client_id=$CLIENT_ID&redirect_uri=$REDIRECT`
+          - pattern: |
+              new URL($OAUTH_URL)
+              ...
+              $URL.searchParams.append('client_id', ...)
+              $URL.searchParams.append('redirect_uri', ...)
+      - pattern-not: |
+          $URL.searchParams.append('state', ...)
+      - pattern-not: |
+          state=$STATE
+    message: "OAuth redirect missing state parameter - vulnerable to CSRF attacks"
+    severity: ERROR
+    languages: [typescript, javascript]
+    metadata:
+      datahogo_id: 80
+      datahogo_category: "auth-sessions"
+      owasp_ref: "A07:2021"
+
+  # ID 81: Token not invalidated on logout
+  - id: datahogo-logout-no-invalidation
+    patterns:
+      - pattern-either:
+          - pattern: |
+              async function logout(...) {
+                ...
+                $RESPONSE.redirect(...)
+              }
+          - pattern: |
+              async function signout(...) {
+                ...
+              }
+      - pattern-not: |
+          async function $FUNC(...) {
+            ...
+            $DB.$METHOD({ token: ... })
+            ...
+          }
+      - pattern-not: |
+          async function $FUNC(...) {
+            ...
+            $SESSION.destroy(...)
+            ...
+          }
+      - pattern-not: |
+          async function $FUNC(...) {
+            ...
+            blacklist.add(...)
+            ...
+          }
+    message: "Logout function should invalidate tokens or destroy sessions"
+    severity: WARNING
+    languages: [typescript, javascript]
+    metadata:
+      datahogo_id: 81
+      datahogo_category: "auth-sessions"
+      owasp_ref: "A07:2021"
+
+  # ID 82: No session invalidation on password change
+  - id: datahogo-password-change-no-session-invalidation
+    patterns:
+      - pattern-either:
+          - pattern: |
+              async function changePassword(...) {
+                ...
+                $DB.update({ password: ... })
+                ...
+              }
+          - pattern: |
+              async function updatePassword(...) {
+                ...
+              }
+      - pattern-not: |
+          async function $FUNC(...) {
+            ...
+            $SESSION.destroy(...)
+            ...
+          }
+      - pattern-not: |
+          async function $FUNC(...) {
+            ...
+            invalidateAllSessions(...)
+            ...
+          }
+    message: "Password change should invalidate all active sessions for security"
+    severity: WARNING
+    languages: [typescript, javascript]
+    metadata:
+      datahogo_id: 82
+      datahogo_category: "auth-sessions"
+      owasp_ref: "A07:2021"
+
+  # ID 84: Insecure password reset - no TTL
+  - id: datahogo-password-reset-no-expiry
+    patterns:
+      - pattern-either:
+          - pattern: |
+              const resetToken = $RANDOM
+              ...
+              $DB.save({ resetToken: $TOKEN })
+          - pattern: |
+              function createPasswordResetToken(...) {
+                ...
+                return $TOKEN
+              }
+      - pattern-not: |
+          expiresAt: ...
+      - pattern-not: |
+          expires_at: ...
+      - pattern-not: |
+          expiry: ...
+      - pattern-not: |
+          ttl: ...
+    message: "Password reset token should have an expiration time (15-60 minutes recommended)"
+    severity: ERROR
+    languages: [typescript, javascript]
+    metadata:
+      datahogo_id: 84
+      datahogo_category: "auth-sessions"
+      owasp_ref: "A07:2021"
+
+  # ID 85: User enumeration - different error messages
+  - id: datahogo-user-enumeration
+    patterns:
+      - pattern-either:
+          - pattern: |
+              if (!$USER) {
+                throw new Error("User not found")
+              }
+          - pattern: |
+              if (!$USER) {
+                return { error: "User does not exist" }
+              }
+          - pattern: |
+              if (!$USER) {
+                $RESPONSE.status(404).json({ error: "User not found" })
+              }
+    message: "Login error messages should be generic to prevent user enumeration (use 'Invalid credentials')"
+    severity: INFO
+    languages: [typescript, javascript]
+    metadata:
+      datahogo_id: 85
+      datahogo_category: "auth-sessions"
+      owasp_ref: "A07:2021"
+
+  # ID 156: No password policy enforcement
+  - id: datahogo-no-password-policy
+    patterns:
+      - pattern-either:
+          - pattern: |
+              async function register(..., password: $TYPE, ...) {
+                ...
+                bcrypt.hash(password, ...)
+                ...
+              }
+          - pattern: |
+              async function signup(...) {
+                ...
+                const hashedPassword = await $HASH(password, ...)
+                ...
+              }
+      - pattern-not: |
+          if (password.length $OP $NUM && $REGEX.test(password))
+      - pattern-not: |
+          validatePassword(password)
+      - pattern-not: |
+          passwordSchema.parse(...)
+    message: "Password registration missing policy enforcement (length, complexity, common passwords)"
+    severity: WARNING
+    languages: [typescript, javascript]
+    metadata:
+      datahogo_id: 156
+      datahogo_category: "best-practices"
+      owasp_ref: "A07:2021"
+
+  # ID 159: No email verification
+  - id: datahogo-no-email-verification
+    patterns:
+      - pattern: |
+          async function register(...) {
+            ...
+            $DB.create({ email: $EMAIL, ... })
+            ...
+          }
+      - pattern-not: |
+          async function register(...) {
+            ...
+            sendVerificationEmail(...)
+            ...
+          }
+      - pattern-not: |
+          async function register(...) {
+            ...
+            emailVerified: false
+            ...
+          }
+    message: "User registration should require email verification to prevent fake accounts"
+    severity: WARNING
+    languages: [typescript, javascript]
+    metadata:
+      datahogo_id: 159
+      datahogo_category: "best-practices"
+      owasp_ref: "A07:2021"
+
+  # ID 164: No confirmation for critical actions
+  - id: datahogo-no-delete-confirmation
+    patterns:
+      - pattern-either:
+          - pattern: |
+              async function deleteAccount(...) {
+                ...
+                $DB.delete(...)
+              }
+          - pattern: |
+              async function DELETE(...) {
+                ...
+                $DB.users.delete(...)
+                ...
+              }
+      - pattern-not: |
+          if ($CONFIRM === $PASSWORD)
+      - pattern-not: |
+          if (confirmed)
+      - pattern-not: |
+          requirePasswordConfirmation(...)
+    message: "Critical actions like account deletion should require password confirmation"
+    severity: WARNING
+    languages: [typescript, javascript]
+    metadata:
+      datahogo_id: 164
+      datahogo_category: "best-practices"
+      owasp_ref: "A07:2021"
+
+  # ID 77 Extended: Session token reuse after privilege escalation
+  - id: datahogo-session-reuse-privilege-change
+    patterns:
+      - pattern: |
+          async function $FUNC(...) {
+            ...
+            $DB.update({ role: $NEW_ROLE })
+            ...
+          }
+      - pattern-not: |
+          async function $FUNC(...) {
+            ...
+            $SESSION.regenerate(...)
+            ...
+          }
+    message: "Session should be regenerated after privilege changes to prevent session adoption attacks"
+    severity: WARNING
+    languages: [typescript, javascript]
+    metadata:
+      datahogo_id: 77
+      datahogo_category: "auth-sessions"
+      owasp_ref: "A07:2021"
+
+  # ID 80 Extended: OAuth redirect_uri not validated
+  - id: datahogo-oauth-open-redirect
+    patterns:
+      - pattern-either:
+          - pattern: |
+              const redirect_uri = $REQ.query.redirect_uri
+              ...
+              $OAUTH.$METHOD({ redirect_uri })
+          - pattern: |
+              const callbackUrl = $REQ.body.callback
+              ...
+              redirect(callbackUrl)
+      - pattern-not: |
+          if (allowedUrls.includes($URL))
+      - pattern-not: |
+          if ($URL.startsWith($DOMAIN))
+    message: "OAuth redirect_uri should be validated against allowlist to prevent open redirects"
+    severity: ERROR
+    languages: [typescript, javascript]
+    metadata:
+      datahogo_id: 80
+      datahogo_category: "auth-sessions"
+      owasp_ref: "A07:2021"
+
+  # JWT without expiration
+  - id: datahogo-jwt-no-expiration
+    patterns:
+      - pattern-either:
+          - pattern: |
+              jwt.sign($PAYLOAD, $SECRET)
+          - pattern: |
+              jwt.sign($PAYLOAD, $SECRET, { algorithm: $ALG })
+      - pattern-not: |
+          jwt.sign($PAYLOAD, $SECRET, { ..., expiresIn: ... })
+      - pattern-not: |
+          jwt.sign($PAYLOAD, $SECRET, { ..., exp: ... })
+    message: "JWT tokens should have an expiration time (expiresIn or exp claim)"
+    severity: ERROR
+    languages: [typescript, javascript]
+    metadata:
+      datahogo_id: 56
+      datahogo_category: "vibecoding"
+      owasp_ref: "A07:2021"
+
+  # Tokens in localStorage
+  - id: datahogo-token-in-localstorage
+    patterns:
+      - pattern-either:
+          - pattern: localStorage.setItem($KEY, $TOKEN)
+          - pattern: sessionStorage.setItem($KEY, $TOKEN)
+      - metavariable-regex:
+          metavariable: $KEY
+          regex: .*(token|jwt|auth|session|access|refresh).*
+    message: "Authentication tokens in localStorage/sessionStorage are vulnerable to XSS. Use httpOnly cookies"
+    severity: ERROR
+    languages: [typescript, javascript]
+    metadata:
+      datahogo_id: 47
+      datahogo_category: "react-nextjs"
+      owasp_ref: "A07:2021"
+
+  # ID 156 Extended: Common passwords not checked
+  - id: datahogo-no-common-password-check
+    patterns:
+      - pattern: |
+          async function $FUNC(..., password: string, ...) {
+            ...
+            if (password.length >= $NUM) {
+              ...
+            }
+            ...
+          }
+      - pattern-not: |
+          commonPasswords.includes(password)
+      - pattern-not: |
+          isCommonPassword(password)
+      - pattern-not: |
+          hibp.check(password)
+    message: "Password validation should check against common/breached passwords list"
+    severity: INFO
+    languages: [typescript, javascript]
+    metadata:
+      datahogo_id: 156
+      datahogo_category: "best-practices"
+      owasp_ref: "A07:2021"

package/dist/rules/rules/crypto-patterns.yaml

@@ -0,0 +1,227 @@
+rules:
+  # ID 121: ECB mode in cipher
+  - id: datahogo-ecb-mode-cipher
+    patterns:
+      - pattern-either:
+          - pattern: crypto.createCipheriv("aes-$BITS-ecb", ...)
+          - pattern: crypto.createDecipheriv("aes-$BITS-ecb", ...)
+          - pattern: crypto.createCipheriv('aes-$BITS-ecb', ...)
+          - pattern: crypto.createDecipheriv('aes-$BITS-ecb', ...)
+    message: "ECB cipher mode does not use an IV and reveals patterns in plaintext - use CBC or GCM mode instead"
+    severity: WARNING
+    languages: [typescript, javascript]
+    metadata:
+      datahogo_id: 121
+      datahogo_category: "cryptography"
+      owasp_ref: "A02:2021"
+
+  # ID 122: Static IV / Nonce
+  - id: datahogo-static-iv-buffer
+    patterns:
+      - pattern-either:
+          - pattern: |
+              const iv = Buffer.alloc($SIZE, 0)
+          - pattern: |
+              const iv = Buffer.alloc($SIZE)
+          - pattern: |
+              const nonce = Buffer.alloc($SIZE, 0)
+          - pattern: |
+              const iv = Buffer.from("$STATIC_STRING")
+    message: "Static or zero-filled IV/nonce makes encryption deterministic - use crypto.randomBytes() for each encryption"
+    severity: ERROR
+    languages: [typescript, javascript]
+    metadata:
+      datahogo_id: 122
+      datahogo_category: "cryptography"
+      owasp_ref: "A02:2021"
+
+  - id: datahogo-static-iv-hardcoded
+    patterns:
+      - pattern-either:
+          - pattern: |
+              const $IV = "$STRING"
+              ...
+              crypto.createCipheriv($ALGO, $KEY, $IV)
+          - pattern: |
+              const $IV = '$STRING'
+              ...
+              crypto.createCipheriv($ALGO, $KEY, $IV)
+    message: "Hardcoded IV/nonce in cipher - generate a unique random IV for every encryption operation"
+    severity: ERROR
+    languages: [typescript, javascript]
+    metadata:
+      datahogo_id: 122
+      datahogo_category: "cryptography"
+      owasp_ref: "A02:2021"
+
+  # ID 123: Weak key size
+  - id: datahogo-weak-rsa-key-size
+    patterns:
+      - pattern-either:
+          - pattern: |
+              crypto.generateKeyPair("rsa", { modulusLength: $SIZE, ... }, ...)
+          - pattern: |
+              crypto.generateKeyPairSync("rsa", { modulusLength: $SIZE, ... })
+      - metavariable-regex:
+          metavariable: $SIZE
+          regex: ^(512|1024)$
+    message: "RSA key size below 2048 bits is cryptographically weak - use at least 2048 bits (4096 recommended)"
+    severity: WARNING
+    languages: [typescript, javascript]
+    metadata:
+      datahogo_id: 123
+      datahogo_category: "cryptography"
+      owasp_ref: "A02:2021"
+
+  - id: datahogo-weak-aes-key-size
+    patterns:
+      - pattern-either:
+          - pattern: crypto.createCipheriv("aes-64-$MODE", ...)
+          - pattern: crypto.createCipheriv('aes-64-$MODE', ...)
+    message: "AES key size below 128 bits is insufficient - use AES-128, AES-192, or AES-256"
+    severity: WARNING
+    languages: [typescript, javascript]
+    metadata:
+      datahogo_id: 123
+      datahogo_category: "cryptography"
+      owasp_ref: "A02:2021"
+
+  # ID 124: Certificate validation disabled
+  - id: datahogo-tls-reject-unauthorized-env
+    patterns:
+      - pattern-either:
+          - pattern: process.env.NODE_TLS_REJECT_UNAUTHORIZED = "0"
+          - pattern: process.env.NODE_TLS_REJECT_UNAUTHORIZED = '0'
+          - pattern: process.env["NODE_TLS_REJECT_UNAUTHORIZED"] = "0"
+    message: "Disabling TLS certificate validation exposes all HTTPS connections to man-in-the-middle attacks"
+    severity: CRITICAL
+    languages: [typescript, javascript]
+    metadata:
+      datahogo_id: 124
+      datahogo_category: "cryptography"
+      owasp_ref: "A02:2021"
+
+  - id: datahogo-tls-reject-unauthorized-agent
+    patterns:
+      - pattern-either:
+          - pattern: |
+              new https.Agent({ rejectUnauthorized: false })
+          - pattern: |
+              https.request({ ..., rejectUnauthorized: false, ... })
+          - pattern: |
+              axios.create({ ..., httpsAgent: new https.Agent({ rejectUnauthorized: false }) })
+    message: "TLS certificate validation disabled in HTTPS agent - remove rejectUnauthorized: false before deploying to production"
+    severity: CRITICAL
+    languages: [typescript, javascript]
+    metadata:
+      datahogo_id: 124
+      datahogo_category: "cryptography"
+      owasp_ref: "A02:2021"
+
+  # ID 125: Weak PRNG for security tokens
+  - id: datahogo-math-random-token
+    patterns:
+      - pattern-either:
+          - pattern: |
+              const $TOKEN = Math.random()
+          - pattern: |
+              const $ID = Math.random().toString(...)
+          - pattern: |
+              token = Math.random().toString($BASE).slice($N)
+          - pattern: |
+              id = Math.random().toString($BASE).substr($N)
+    message: "Math.random() is not cryptographically secure - use crypto.randomBytes() or crypto.randomUUID() for tokens and IDs"
+    severity: ERROR
+    languages: [typescript, javascript]
+    metadata:
+      datahogo_id: 125
+      datahogo_category: "cryptography"
+      owasp_ref: "A02:2021"
+
+  - id: datahogo-date-now-token
+    patterns:
+      - pattern-either:
+          - pattern: |
+              const $TOKEN = Date.now().toString()
+          - pattern: |
+              const $TOKEN = String(Date.now())
+          - pattern: |
+              token: Date.now()
+      - metavariable-regex:
+          metavariable: $TOKEN
+          regex: .*(token|secret|key|reset|nonce|csrf|session).*
+    message: "Date.now() is predictable and should not be used for security tokens - use crypto.randomBytes()"
+    severity: ERROR
+    languages: [typescript, javascript]
+    metadata:
+      datahogo_id: 125
+      datahogo_category: "cryptography"
+      owasp_ref: "A02:2021"
+
+  # ID 126: JWT algorithm none
+  - id: datahogo-jwt-algorithm-none
+    patterns:
+      - pattern-either:
+          - pattern: jwt.verify($TOKEN, $SECRET, { algorithms: [..., "none", ...] })
+          - pattern: jwt.verify($TOKEN, $SECRET, { algorithms: ["none"] })
+          - pattern: jwt.sign($PAYLOAD, $SECRET, { algorithm: "none" })
+          - pattern: jwt.sign($PAYLOAD, "", ...)
+    message: "JWT 'none' algorithm allows forged tokens with no signature verification - always use a strong algorithm (RS256, ES256)"
+    severity: CRITICAL
+    languages: [typescript, javascript]
+    metadata:
+      datahogo_id: 126
+      datahogo_category: "cryptography"
+      owasp_ref: "A02:2021"
+
+  - id: datahogo-jwt-empty-secret
+    patterns:
+      - pattern-either:
+          - pattern: jwt.verify($TOKEN, "")
+          - pattern: jwt.verify($TOKEN, '')
+          - pattern: jwt.verify($TOKEN, null)
+          - pattern: jwt.verify($TOKEN, undefined)
+    message: "JWT verification with empty or null secret disables signature validation - always use a strong secret"
+    severity: CRITICAL
+    languages: [typescript, javascript]
+    metadata:
+      datahogo_id: 126
+      datahogo_category: "cryptography"
+      owasp_ref: "A02:2021"
+
+  # ID 127: Hardcoded encryption key
+  - id: datahogo-hardcoded-encryption-key-string
+    patterns:
+      - pattern-either:
+          - pattern: |
+              const $KEY = "$LITERAL_KEY"
+              ...
+              crypto.createCipheriv($ALGO, $KEY, ...)
+          - pattern: |
+              const $KEY = '$LITERAL_KEY'
+              ...
+              crypto.createCipheriv($ALGO, $KEY, ...)
+          - pattern: |
+              crypto.createCipheriv($ALGO, "$LITERAL_KEY", ...)
+          - pattern: |
+              crypto.createCipheriv($ALGO, '$LITERAL_KEY', ...)
+    message: "Hardcoded encryption key in source code - load from environment variables or secrets manager"
+    severity: ERROR
+    languages: [typescript, javascript]
+    metadata:
+      datahogo_id: 127
+      datahogo_category: "cryptography"
+      owasp_ref: "A02:2021"
+
+  - id: datahogo-hardcoded-hmac-key
+    patterns:
+      - pattern-either:
+          - pattern: crypto.createHmac($ALGO, "$LITERAL_KEY")
+          - pattern: crypto.createHmac($ALGO, '$LITERAL_KEY')
+    message: "Hardcoded HMAC key in source code - load secret from environment variables"
+    severity: ERROR
+    languages: [typescript, javascript]
+    metadata:
+      datahogo_id: 127
+      datahogo_category: "cryptography"
+      owasp_ref: "A02:2021"