@dragonflymcp/plugin 1.0.0

package/templates/skills/security-vulnerability-scanning.md.template

@@ -0,0 +1,663 @@
+---
+name: Security Vulnerability Scanning
+description: Detect common security vulnerabilities in generated code during quality review
+version: 1.0.0
+trigger_keywords: [security, vulnerability, CVE, injection, XSS, CSRF, scan, audit]
+author: Zen Architecture
+applies_to: [quality-concept]
+priority: P0
+impact: critical
+---
+
+# Security Vulnerability Scanning - Expert Skill
+
+Detect common security vulnerabilities in generated code before they reach production.
+
+## Purpose
+
+Security vulnerability scanning provides:
+- **Early detection**: Catch vulnerabilities at review time, not in production
+- **Automated checks**: Consistent security review across all code
+- **OWASP coverage**: Check for industry-standard vulnerability patterns
+- **Actionable feedback**: Specific remediation guidance for each issue
+
+## When to Use
+
+Use security scanning during quality review when code involves:
+- ✅ User input handling
+- ✅ Database queries
+- ✅ Authentication/authorization
+- ✅ File operations
+- ✅ External API calls
+- ✅ HTML/template rendering
+- ✅ Cryptographic operations
+- ✅ Session management
+
+## Vulnerability Detection Patterns
+
+### 1. SQL Injection (CWE-89)
+
+**Detection Patterns**:
+```javascript
+// VULNERABLE: String concatenation in query
+const query = `SELECT * FROM users WHERE id = ${userId}`;
+const query = "SELECT * FROM users WHERE id = " + userId;
+const query = `SELECT * FROM users WHERE name = '${name}'`;
+
+// SAFE: Parameterized queries
+const query = 'SELECT * FROM users WHERE id = $1';
+await db.query(query, [userId]);
+```
+
+**Scan Rules**:
+```yaml
+sql_injection:
+  patterns:
+    - regex: 'SELECT.*FROM.*WHERE.*\$\{.*\}'
+      severity: critical
+      message: "Potential SQL injection: String interpolation in query"
+      
+    - regex: '"SELECT.*".*\+.*[a-zA-Z]+'
+      severity: critical
+      message: "Potential SQL injection: String concatenation in query"
+      
+    - regex: "query\\(['\"].*\\$\\{"
+      severity: critical
+      message: "Potential SQL injection: Template literal in query"
+      
+  safe_patterns:
+    - 'query($1, $2)'
+    - 'query(?, ?)'
+    - 'where({ id: })'
+    - 'findById('
+```
+
+### 2. Cross-Site Scripting (XSS) (CWE-79)
+
+**Detection Patterns**:
+```javascript
+// VULNERABLE: Unescaped user input in HTML
+element.innerHTML = userInput;
+document.write(userInput);
+`<div>${userInput}</div>`;
+
+// SAFE: Escaped output
+element.textContent = userInput;
+escapeHtml(userInput);
+DOMPurify.sanitize(userInput);
+```
+
+**Scan Rules**:
+```yaml
+xss:
+  patterns:
+    - regex: 'innerHTML\s*=\s*[a-zA-Z]+'
+      severity: high
+      message: "Potential XSS: Unescaped assignment to innerHTML"
+      
+    - regex: 'document\.write\('
+      severity: high
+      message: "Potential XSS: document.write with user input"
+      
+    - regex: 'dangerouslySetInnerHTML'
+      severity: medium
+      message: "React dangerouslySetInnerHTML - ensure input is sanitized"
+      
+    - regex: '\{\{\{.*\}\}\}'
+      severity: medium
+      message: "Handlebars unescaped output - ensure input is sanitized"
+      
+  safe_patterns:
+    - 'textContent'
+    - 'escapeHtml('
+    - 'DOMPurify.sanitize('
+    - 'sanitizeHtml('
+```
+
+### 3. Command Injection (CWE-78)
+
+**Detection Patterns**:
+```javascript
+// VULNERABLE: User input in shell commands
+exec(`ls ${userInput}`);
+spawn('bash', ['-c', userInput]);
+system(userInput);
+
+// SAFE: Validated input, no shell
+execFile('ls', [validatedPath]);
+spawn('ls', ['-la', validatedPath], { shell: false });
+```
+
+**Scan Rules**:
+```yaml
+command_injection:
+  patterns:
+    - regex: 'exec\([`"\'].*\$\{'
+      severity: critical
+      message: "Potential command injection: User input in exec()"
+      
+    - regex: 'spawn\([^,]+,.*shell:\s*true'
+      severity: high
+      message: "Potential command injection: spawn with shell: true"
+      
+    - regex: 'child_process.*\+.*[a-zA-Z]+'
+      severity: critical
+      message: "Potential command injection: String concatenation in command"
+      
+  safe_patterns:
+    - 'execFile('
+    - 'shell: false'
+    - 'spawnSync(cmd, args)'
+```
+
+### 4. Path Traversal (CWE-22)
+
+**Detection Patterns**:
+```javascript
+// VULNERABLE: User input in file paths
+fs.readFile(userInput);
+path.join(baseDir, userInput);  // if userInput contains ../
+
+// SAFE: Validated and normalized paths
+const safePath = path.resolve(baseDir, userInput);
+if (!safePath.startsWith(baseDir)) throw new Error('Invalid path');
+```
+
+**Scan Rules**:
+```yaml
+path_traversal:
+  patterns:
+    - regex: 'readFile\([a-zA-Z]+\)'
+      severity: high
+      message: "Potential path traversal: Unvalidated path in readFile"
+      
+    - regex: 'path\.join\(.*,\s*req\.'
+      severity: high
+      message: "Potential path traversal: Request input in path.join"
+      
+    - regex: '__dirname.*\+.*req\.'
+      severity: high
+      message: "Potential path traversal: Request input concatenated to path"
+      
+  safe_patterns:
+    - 'path.resolve('
+    - 'startsWith(baseDir)'
+    - 'path.normalize('
+```
+
+### 5. Insecure Deserialization (CWE-502)
+
+**Detection Patterns**:
+```javascript
+// VULNERABLE: Deserializing untrusted data
+eval(userInput);
+new Function(userInput);
+JSON.parse(userInput);  // Only dangerous if result is used unsafely
+
+// SAFE: Validated deserialization
+const data = JSON.parse(userInput);
+const validated = schema.validate(data);
+```
+
+**Scan Rules**:
+```yaml
+insecure_deserialization:
+  patterns:
+    - regex: 'eval\('
+      severity: critical
+      message: "Critical: eval() with potential user input"
+      
+    - regex: 'new Function\('
+      severity: critical
+      message: "Critical: new Function() with potential user input"
+      
+    - regex: 'serialize-javascript.*uneval'
+      severity: high
+      message: "Potential insecure deserialization"
+      
+  safe_patterns:
+    - 'JSON.parse'  # With validation
+    - 'schema.validate'
+```
+
+### 6. Hardcoded Secrets (CWE-798)
+
+**Detection Patterns**:
+```javascript
+// VULNERABLE: Hardcoded credentials
+const password = "secretpassword123";
+const apiKey = "sk-1234567890abcdef";
+const token = "eyJhbGciOiJIUzI1NiIs...";
+
+// SAFE: Environment variables
+const password = process.env.DB_PASSWORD;
+const apiKey = process.env.API_KEY;
+```
+
+**Scan Rules**:
+```yaml
+hardcoded_secrets:
+  patterns:
+    - regex: '(password|passwd|pwd)\s*[=:]\s*["\'][^"\']{8,}'
+      severity: critical
+      message: "Hardcoded password detected"
+      
+    - regex: '(api[_-]?key|apikey)\s*[=:]\s*["\'][a-zA-Z0-9]{16,}'
+      severity: critical
+      message: "Hardcoded API key detected"
+      
+    - regex: '(secret|token)\s*[=:]\s*["\'][a-zA-Z0-9+/=]{20,}'
+      severity: critical
+      message: "Hardcoded secret/token detected"
+      
+    - regex: 'Bearer\s+[a-zA-Z0-9._-]{20,}'
+      severity: high
+      message: "Hardcoded bearer token detected"
+      
+    - regex: '-----BEGIN (RSA |EC )?PRIVATE KEY-----'
+      severity: critical
+      message: "Private key in source code"
+      
+  safe_patterns:
+    - 'process.env.'
+    - 'config.get('
+    - 'secrets.get('
+```
+
+### 7. Insecure Random (CWE-330)
+
+**Detection Patterns**:
+```javascript
+// VULNERABLE: Weak randomness for security
+const token = Math.random().toString(36);
+const id = Math.floor(Math.random() * 1000000);
+
+// SAFE: Cryptographically secure random
+const token = crypto.randomBytes(32).toString('hex');
+const id = crypto.randomUUID();
+```
+
+**Scan Rules**:
+```yaml
+insecure_random:
+  patterns:
+    - regex: 'Math\.random\(\).*token'
+      severity: high
+      message: "Insecure random for token generation"
+      
+    - regex: 'Math\.random\(\).*password'
+      severity: critical
+      message: "Insecure random for password generation"
+      
+    - regex: 'Math\.random\(\).*secret'
+      severity: critical
+      message: "Insecure random for secret generation"
+      
+  safe_patterns:
+    - 'crypto.randomBytes'
+    - 'crypto.randomUUID'
+    - 'crypto.getRandomValues'
+    - 'uuid.v4()'
+```
+
+### 8. Missing Authentication (CWE-306)
+
+**Detection Patterns**:
+```javascript
+// VULNERABLE: Unprotected routes
+app.post('/api/admin/users', createUser);
+router.delete('/api/items/:id', deleteItem);
+
+// SAFE: Authentication middleware
+app.post('/api/admin/users', authMiddleware, createUser);
+router.delete('/api/items/:id', authenticate, authorize, deleteItem);
+```
+
+**Scan Rules**:
+```yaml
+missing_authentication:
+  patterns:
+    - regex: 'app\.(post|put|delete|patch)\([^,]+,\s*[a-zA-Z]+\)'
+      context: "Check if route needs authentication"
+      severity: medium
+      message: "Route may be missing authentication middleware"
+      
+    - regex: '/api/(admin|user|account)'
+      context: "Sensitive routes"
+      severity: medium
+      message: "Sensitive route - verify authentication is in place"
+      
+  safe_patterns:
+    - 'authMiddleware'
+    - 'authenticate'
+    - 'requireAuth'
+    - 'isAuthenticated'
+    - 'passport.authenticate'
+```
+
+### 9. CSRF Vulnerabilities (CWE-352)
+
+**Detection Patterns**:
+```javascript
+// VULNERABLE: State-changing without CSRF protection
+app.post('/api/transfer', handleTransfer);
+
+// SAFE: CSRF token validation
+app.post('/api/transfer', csrfProtection, handleTransfer);
+```
+
+**Scan Rules**:
+```yaml
+csrf:
+  patterns:
+    - regex: 'app\.post\([^,]+,\s*(?!.*csrf)'
+      severity: medium
+      message: "POST route may need CSRF protection"
+      
+  safe_patterns:
+    - 'csrf'
+    - 'csurf'
+    - 'csrfProtection'
+    - 'verifyCsrfToken'
+```
+
+### 10. Insecure Cookie Settings (CWE-614)
+
+**Detection Patterns**:
+```javascript
+// VULNERABLE: Insecure cookie
+res.cookie('session', value);
+res.cookie('token', value, { httpOnly: false });
+
+// SAFE: Secure cookie settings
+res.cookie('session', value, {
+  httpOnly: true,
+  secure: true,
+  sameSite: 'strict'
+});
+```
+
+**Scan Rules**:
+```yaml
+insecure_cookies:
+  patterns:
+    - regex: 'cookie\([^)]+\)(?!.*httpOnly)'
+      severity: medium
+      message: "Cookie missing httpOnly flag"
+      
+    - regex: 'cookie\([^)]+\)(?!.*secure)'
+      severity: medium
+      message: "Cookie missing secure flag"
+      
+    - regex: 'httpOnly:\s*false'
+      severity: high
+      message: "Cookie explicitly set httpOnly: false"
+      
+  safe_patterns:
+    - 'httpOnly: true'
+    - 'secure: true'
+    - "sameSite: 'strict'"
+```
+
+## Scan Process
+
+### 1. Pre-Scan Setup
+
+```yaml
+scan_configuration:
+  enabled_checks:
+    - sql_injection
+    - xss
+    - command_injection
+    - path_traversal
+    - hardcoded_secrets
+    - insecure_random
+    - missing_authentication
+    - csrf
+    - insecure_cookies
+    
+  severity_threshold: medium  # Report medium and above
+  
+  file_patterns:
+    include:
+      - "**/*.js"
+      - "**/*.ts"
+      - "**/*.jsx"
+      - "**/*.tsx"
+      - "**/*.py"
+      - "**/*.java"
+    exclude:
+      - "node_modules/**"
+      - "**/*.test.*"
+      - "**/*.spec.*"
+```
+
+### 2. Scan Execution
+
+```python
+def scan_for_vulnerabilities(files, rules):
+    """
+    Scan files for security vulnerabilities.
+    
+    Args:
+        files: List of file paths to scan
+        rules: Security scan rules
+        
+    Returns:
+        List of findings with severity and remediation
+    """
+    findings = []
+    
+    for file_path in files:
+        content = read_file(file_path)
+        
+        for rule_category, rule_config in rules.items():
+            for pattern in rule_config['patterns']:
+                matches = re.findall(pattern['regex'], content)
+                
+                for match in matches:
+                    # Check if safe pattern present
+                    is_safe = any(
+                        safe in content[match.start-100:match.end+100]
+                        for safe in rule_config.get('safe_patterns', [])
+                    )
+                    
+                    if not is_safe:
+                        findings.append({
+                            'file': file_path,
+                            'line': get_line_number(content, match),
+                            'category': rule_category,
+                            'severity': pattern['severity'],
+                            'message': pattern['message'],
+                            'code': get_code_snippet(content, match),
+                            'remediation': get_remediation(rule_category)
+                        })
+    
+    return sorted(findings, key=lambda x: severity_order[x['severity']])
+```
+
+### 3. Report Generation
+
+```yaml
+# koan/reviews/security-scan-{id}.yaml
+
+scan_id: "security-scan-001"
+timestamp: "2025-11-11T10:00:00Z"
+implementation_id: "impl-001"
+status: "findings_detected"
+
+summary:
+  total_findings: 5
+  critical: 1
+  high: 2
+  medium: 2
+  low: 0
+
+findings:
+  - id: "finding-001"
+    severity: critical
+    category: "sql_injection"
+    file: "src/services/user.service.ts"
+    line: 45
+    message: "Potential SQL injection: String interpolation in query"
+    code: |
+      const query = `SELECT * FROM users WHERE id = ${userId}`;
+    remediation: |
+      Use parameterized queries:
+      const query = 'SELECT * FROM users WHERE id = $1';
+      await db.query(query, [userId]);
+    
+  - id: "finding-002"
+    severity: high
+    category: "hardcoded_secrets"
+    file: "src/config/database.ts"
+    line: 12
+    message: "Hardcoded password detected"
+    code: |
+      const password = "db_password_123";
+    remediation: |
+      Use environment variables:
+      const password = process.env.DB_PASSWORD;
+
+blocked: true  # Critical findings block merge
+```
+
+## Integration with Quality Concept
+
+### In Quality Review Action
+
+```yaml
+# Add to quality.review process
+
+quality_review:
+  steps:
+    - name: "Code Style Check"
+      tool: "eslint"
+      
+    - name: "Security Vulnerability Scan"
+      tool: "security-scanner"
+      config:
+        severity_threshold: "medium"
+        block_on_critical: true
+        block_on_high: true
+        
+    - name: "Type Check"
+      tool: "tsc"
+      
+  blocking_conditions:
+    - "security.critical > 0"
+    - "security.high > 0"
+```
+
+### Scan Output in Review
+
+```yaml
+# koan/reviews/review-{id}.yaml
+
+review_id: "review-001"
+implementation_id: "impl-001"
+status: "needs_changes"  # Blocked by security findings
+
+security_scan:
+  status: "failed"
+  critical: 1
+  high: 2
+  findings:
+    - "SQL injection in user.service.ts:45"
+    - "Hardcoded password in database.ts:12"
+    - "Missing CSRF protection on /api/transfer"
+    
+  remediation_required:
+    - file: "src/services/user.service.ts"
+      action: "Use parameterized queries"
+      
+    - file: "src/config/database.ts"
+      action: "Move password to environment variable"
+      
+    - file: "src/routes/transfer.ts"
+      action: "Add CSRF middleware"
+
+code_review:
+  status: "approved"
+  # Security issues override code approval
+```
+
+## Remediation Guidance
+
+### For Each Vulnerability Type
+
+```yaml
+remediation_guides:
+  sql_injection:
+    title: "Fix SQL Injection"
+    steps:
+      - "Replace string concatenation with parameterized queries"
+      - "Use ORM methods instead of raw SQL where possible"
+      - "Validate input types before query construction"
+    examples:
+      before: |
+        const query = `SELECT * FROM users WHERE id = ${userId}`;
+      after: |
+        const query = 'SELECT * FROM users WHERE id = $1';
+        await db.query(query, [userId]);
+        
+  xss:
+    title: "Fix Cross-Site Scripting"
+    steps:
+      - "Use textContent instead of innerHTML for plain text"
+      - "Sanitize HTML with DOMPurify before rendering"
+      - "Use framework's built-in escaping (React, Vue, etc.)"
+    examples:
+      before: |
+        element.innerHTML = userInput;
+      after: |
+        element.textContent = userInput;
+        // Or if HTML is needed:
+        element.innerHTML = DOMPurify.sanitize(userInput);
+        
+  hardcoded_secrets:
+    title: "Fix Hardcoded Secrets"
+    steps:
+      - "Move secrets to environment variables"
+      - "Use a secret manager (Vault, AWS Secrets Manager)"
+      - "Add secret patterns to .gitignore"
+    examples:
+      before: |
+        const apiKey = "sk-1234567890";
+      after: |
+        const apiKey = process.env.API_KEY;
+        // In .env (not committed):
+        // API_KEY=sk-1234567890
+```
+
+## SLO Expectations
+
+```yaml
+security_scan_slo:
+  expected_duration_ms: 5000
+  max_duration_ms: 30000
+  
+  blocking_policy:
+    critical: "always_block"
+    high: "always_block"
+    medium: "warn_and_continue"
+    low: "log_only"
+    
+  metrics:
+    target_false_positive_rate: "< 10%"
+    target_coverage: "> 95% of OWASP Top 10"
+```
+
+## Best Practices
+
+1. ✅ **Run on every code change** - Security scan in CI/CD pipeline
+2. ✅ **Block critical/high findings** - Don't merge vulnerable code
+3. ✅ **Provide clear remediation** - Actionable fix guidance
+4. ✅ **Track metrics** - False positive rate, time to remediate
+5. ✅ **Update rules regularly** - New vulnerability patterns emerge
+6. ✅ **Context-aware scanning** - Reduce false positives with context
+7. ✅ **Developer education** - Help developers understand why
+
+---
+
+**Use this skill when**: Reviewing any code that handles user input, authentication, data storage, or external communication. Security scanning should be automatic in the quality review phase.