@dxworks/insider 2.9.1

package/config/rules/webapp/sessions.json

@@ -0,0 +1,228 @@
+[
+  {
+    "name": "Web App Cookie HttpOnly",
+    "id": "AI056100",
+    "description": "Web App Cookie Attributes HttpOnly",
+    "tags":[ "WebApp.Cookies.Attr.HttpOnly" ],
+    "severity": "critical",
+    "patterns": [
+      {
+        "pattern": "httpOnly",
+        "type": "string",
+        "modifiers": [ "i" ],
+        "scopes": [ "code" ],
+        "confidence": "high"
+      }
+    ],
+    "conditions": [
+      {
+        "pattern": {
+          "pattern": "cookie",
+          "type": "string",
+          "scopes": [ "code" ],
+          "modifiers": [ "i" ]
+        },
+        "search_in": "finding-region(-1,1)",
+        "negate_finding": false
+      }
+    ]
+  },
+  {
+    "name": "Web App Cookie Secure",
+    "id": "AI056200",
+    "description": "Web App Cookie Attributes Secure",
+    "tags":[ "WebApp.Cookies.Attr.Secure" ],
+    "severity": "critical",
+    "patterns": [
+      {
+        "pattern": "secure",
+        "type": "string",
+        "modifiers": [ "i" ],
+        "scopes": [ "code" ],
+        "confidence": "high"
+      }
+    ],
+    "conditions": [
+      {
+        "pattern": {
+          "pattern": "cookie",
+          "type": "string",
+          "scopes": [ "code" ],
+          "modifiers": [ "i" ]
+        },
+        "search_in": "finding-region(-1,1)",
+        "negate_finding": false
+      }
+    ]
+  },
+  {
+    "name": "Web App Cookie Attributes Lifetime",
+    "id": "AI056300",
+    "description": "Web App Cookie Attributes Lifetime",
+    "tags":[ "WebApp.Cookies.Attr.Lifetime" ],
+    "severity": "critical",
+    "patterns": [
+      {
+        "pattern": "lifetime",
+        "type": "string",
+        "scopes": [ "code" ],
+        "modifiers": [ "i" ],
+        "confidence": "high"
+      }
+    ],
+    "conditions": [
+      {
+        "pattern": {
+          "pattern": "cookie",
+          "type": "string",
+          "scopes": [ "code" ],
+          "modifiers": [ "i" ]
+        },
+        "search_in": "finding-region(-1,1)",
+        "negate_finding": false
+      }
+    ]
+  },
+  {
+    "name": "Web App Cookie Attributes Strict",
+    "id": "AI056400",
+    "description": "Web App Cookie Attributes Strict",
+    "tags":[ "WebApp.Cookies.Attr.Strict" ],
+    "severity": "critical",
+    "patterns": [
+      {
+        "pattern": "strict",
+        "type": "string",
+        "scopes": [ "code" ],
+        "modifiers": [ "i" ],
+        "confidence": "high"
+      }
+    ],
+    "conditions": [
+      {
+        "pattern": {
+          "pattern": "cookie",
+          "type": "string",
+          "scopes": [ "code" ],
+          "modifiers": [ "i" ]
+        },
+        "search_in": "finding-region(-1,1)",
+        "negate_finding": false
+      }
+    ]
+  },
+  {
+    "name": "Web App Cookie Attributes SameSite",
+    "id": "AI056500",
+    "description": "Web App Cookie Attributes SameSite",
+    "tags":[ "WebApp.Cookies.Attr.SameSite" ],
+    "severity": "critical",
+    "patterns": [
+      {
+        "pattern": "samesite",
+        "type": "string",
+        "scopes": [ "code" ],
+        "modifiers": [ "i" ],
+        "confidence": "high"
+      }
+    ],
+    "conditions": [
+      {
+        "pattern": {
+          "pattern": "cookie",
+          "type": "string",
+          "scopes": [ "code" ],
+          "modifiers": [ "i" ]
+        },
+        "search_in": "finding-region(-1,1)",
+        "negate_finding": false
+      }
+    ]
+  },
+  {
+    "name": "Web App Cookie Attributes Expires",
+    "id": "AI056600",
+    "description": "Web App Cookie Attributes Expires",
+    "tags":[ "WebApp.Cookies.Attr.Expires" ],
+    "severity": "critical",
+    "patterns": [
+      {
+        "pattern": "expires",
+        "type": "string",
+        "scopes": [ "code" ],
+        "modifiers": [ "i" ],
+        "confidence": "high"
+      }
+    ],
+    "conditions": [
+      {
+        "pattern": {
+          "pattern": "cookie",
+          "type": "string",
+          "scopes": [ "code" ],
+          "modifiers": [ "i" ]
+        },
+        "search_in": "finding-region(-1,1)",
+        "negate_finding": false
+      }
+    ]
+  },
+  {
+    "name": "Web App Cookie Attributes Domain",
+    "id": "AI056700",
+    "description": "Web App Cookie Attributes Domain",
+    "tags":[ "WebApp.Cookies.Attr.Domain" ],
+    "severity": "critical",
+    "patterns": [
+      {
+        "pattern": "domain",
+        "type": "string",
+        "scopes": [ "code" ],
+        "modifiers": [ "i" ],
+        "confidence": "high"
+      }
+    ],
+    "conditions": [
+      {
+        "pattern": {
+          "pattern": "cookie",
+          "type": "string",
+          "scopes": [ "code" ],
+          "modifiers": [ "i" ]
+        },
+        "search_in": "finding-region(-1,1)",
+        "negate_finding": false
+      }
+    ]
+  },
+  {
+    "name": "Web App Session History Update",
+    "id": "AI056800",
+    "description": "Web App Session History Update",
+    "tags":[ "WebApp.History.Update" ],
+    "severity": "critical",
+    "patterns": [
+      {
+        "pattern": "history\\.(pushState|replaceState)",
+        "type": "regex",
+        "scopes": [ "code" ],
+        "confidence": "high"
+      }
+    ]
+  },
+  {
+    "name": "Web App Session Worker",
+    "id": "AI056900",
+    "description": "Web App Session Worker Used",
+    "tags":[ "WebApp.Worker" ],
+    "severity": "critical",
+    "patterns": [
+      {
+        "pattern": "new Worker",
+        "type": "string",
+        "scopes": [ "code" ],
+        "confidence": "high"
+      }
+    ]
+  }
+]

package/config/rules/webapp/storage.json

@@ -0,0 +1,215 @@
+[
+  {
+    "name": "Web App Local Storage Write",
+    "id": "AI057000",
+    "description": "Web App Local Storage Write",
+    "tags":[ "WebApp.Storage.Local.Write" ],
+    "applies_to": [
+      "javascript",
+      "python",
+      "vb",
+      "html",
+      "javascriptreact",
+      "typescript",
+      "coffeescript",
+      "java",
+      "perl",
+      "ruby"
+    ],
+    "severity": "critical",
+    "patterns": [
+      {
+        "pattern": "localstorage.setItem",
+        "type": "string",
+        "scopes": [ "code" ],
+        "confidence": "high"
+      }
+    ]
+  },
+  {
+    "name": "Web App Session Storage Write",
+    "id": "AI057100",
+    "description": "Web App Session Storage Write",
+    "tags":[ "WebApp.Storage.Session.Write" ],
+    "applies_to": [
+      "javascript",
+      "python",
+      "vb",
+      "html",
+      "javascriptreact",
+      "typescript",
+      "coffeescript",
+      "java",
+      "perl",
+      "ruby"
+    ],
+    "severity": "critical",
+    "patterns": [
+      {
+        "pattern": "sessionstorage.setItem",
+        "type": "string",
+        "scopes": [ "code" ],
+        "confidence": "high"
+      }
+    ]
+  },
+  {
+    "name": "Web App Storage Cookie Write",
+    "id": "AI057200",
+    "description": "Web App Storage Cookie Write",
+    "tags":[ "WebApp.Storage.Cookie.Write" ],
+    "applies_to": [
+      "javascript",
+      "python",
+      "vb",
+      "html",
+      "javascriptreact",
+      "typescript",
+      "coffeescript",
+      "java",
+      "perl",
+      "ruby"
+    ],
+    "severity": "critical",
+    "patterns": [
+      {
+        "pattern": ".cookie =",
+        "type": "string",
+        "scopes": [ "code" ],
+        "modifiers": [ "i" ],
+        "confidence": "high"
+      }
+    ]
+  },
+  {
+    "name": "Web App Storage Indexed DB Use",
+    "id": "AI057300",
+    "description": "Web App Storage Indexed DB",
+    "tags":[ "WebApp.Storage.IndexedDB" ],
+    "applies_to": [
+      "javascript",
+      "python",
+      "vb",
+      "html",
+      "javascriptreact",
+      "typescript",
+      "coffeescript",
+      "java",
+      "perl",
+      "ruby"
+    ],
+    "severity": "critical",
+    "patterns": [
+      {
+        "pattern": "indexedDB|mozIndexedDB|webkitIndexedDB|msIndexedDB",
+        "type": "regexword",
+        "scopes": [ "code" ],
+        "confidence": "high"
+      }
+    ]
+  },
+  {
+    "name": "Web App Storage FileReader",
+    "id": "AI057400",
+    "description": "Web App Storage FileReader",
+    "tags":[ "WebApp.Storage.FileReader" ],
+    "applies_to": [
+      "javascript",
+      "python",
+      "vb",
+      "html",
+      "javascriptreact",
+      "typescript",
+      "coffeescript",
+      "java",
+      "perl",
+      "ruby"
+    ],
+    "severity": "critical",
+    "patterns": [
+      {
+        "pattern": "new FileReader",
+        "type": "string",
+        "scopes": [ "code" ],
+        "confidence": "high"
+      }
+    ]
+  },
+  {
+    "name": "Web App Storage ReadFileAsURL",
+    "id": "AI057500",
+    "description": "Web App Storage ReadFileAsURL",
+    "tags":[ "WebApp.Storage.ReadFileAsURL" ],
+    "applies_to": [
+      "javascript",
+      "python",
+      "vb",
+      "html",
+      "javascriptreact",
+      "typescript",
+      "coffeescript",
+      "java",
+      "perl",
+      "ruby"
+    ],
+    "severity": "critical",
+    "patterns": [
+      {
+        "pattern": "readAsDataURL",
+        "type": "string",
+        "scopes": [ "code" ],
+        "confidence": "high"
+      }
+    ],
+    "conditions": [
+      {
+        "pattern": {
+          "pattern": "FileReader",
+          "type": "regexword",
+          "scopes": [ "code" ]
+        },
+        "search_in": "finding-region(-5,5)",
+        "negate_finding": false
+      }
+    ]
+  },
+  {
+    "name": "Web App Storage FileUpload",
+    "id": "AI057600",
+    "description": "Web App Storage FileUpload",
+    "tags":[ "WebApp.Storage.FileUpload" ],
+    "applies_to": [
+      "javascript",
+      "python",
+      "vb",
+      "html",
+      "javascriptreact",
+      "typescript",
+      "coffeescript",
+      "java",
+      "perl",
+      "ruby"
+    ],
+    "severity": "critical",
+    "patterns": [
+      {
+        "pattern": "fetch",
+        "type": "string",
+        "scopes": [ "code" ],
+        "confidence": "high"
+      }
+    ],
+    "conditions": [
+      {
+        "pattern": {
+          "pattern": "PUT",
+          "type": "string",
+          "scopes": [ "code" ],
+          "modifiers": [ "i" ]
+        },
+        "search_in": "finding-region(-5,5)",
+        "negate_finding": false
+      }
+    ]
+  }
+]

package/dist/config/.ignore

@@ -0,0 +1,4 @@
+**/.idea/**
+**/.git/**
+**/*.iml
+**/node_modules/**

package/dist/config/comments.json

@@ -0,0 +1,71 @@
+[
+  {
+    "languages": [
+      "c",
+      "cpp",
+      "csharp",
+      "coffeescript",
+      "fsharp",
+      "go",
+      "groovy",
+      "jade",
+      "oc",
+      "rust",
+      "swift",
+      "javascript",
+      "java",
+      "typescript",
+      "php"
+    ],
+    "inline": "//",
+    "preffix": "/*",
+    "suffix": "*/"
+  },
+  {
+    "languages": [
+      "perl",
+      "perl6",
+      "r",
+      "shellscript",
+      "ruby",
+      "yaml",
+      "powershell",
+      "python"
+    ],
+    "inline": "#"
+  },
+  {
+    "languages": [
+      "lua",
+      "sql"
+    ],
+    "inline": "--"
+  },
+  {
+    "languages": [
+      "clojure"
+    ],
+    "inline": ";;"
+  },
+  {
+    "languages": [
+      "vb"
+    ],
+    "inline": "'"
+  },
+  {
+    "languages": [
+      "COBOL"
+    ],
+    "inlinePatterns": [
+      {
+        "pattern": "^.{6}[*/](.*)$",
+        "modifiers": ["g", "m"]
+      },
+      {
+        "pattern": "(\\*>)(.*)$",
+        "modifiers": ["g", "m"]
+      }
+    ]
+  }
+]

package/dist/config/fingerprints/_anomalies-full.json

@@ -0,0 +1,116 @@
+{
+  "useProjectPrefix": true,
+  "technologies": [
+    {
+      "category": "Excessive Complexity",
+      "name": "Autogenerated Javadoc",
+      "languages": [
+        "java"
+      ],
+      "extensions": [],
+      "fingerprints": [
+        "(?i)Auto-generated\\s+Javadoc"
+      ],
+      "wrapAsImports": false
+    },
+    {
+      "category": "Abnormal Hierarchy Relations",
+      "name": "Instanceof Abuser",
+      "languages": [
+        "java"
+      ],
+      "extensions": [],
+      "fingerprints": [
+        "instanceof"
+      ],
+      "wrapAsImports": false
+    },
+    {
+      "category": "Abnormal Hierarchy Relations",
+      "name": "Stub Implementer",
+      "languages": [
+        "java"
+      ],
+      "extensions": [],
+      "fingerprints": [
+        "(?i)Auto-generated method stub",
+        "\\{\\s*\\/\\/Overridden Notification Method\\s*\\}",
+        "\\{\\s*return null;\\s*\\}"
+      ],
+      "wrapAsImports": false
+    },
+    {
+      "category": "Traceability Issues",
+      "name": "Console Writing",
+      "languages": [
+        "java"
+      ],
+      "extensions": [],
+      "fingerprints": [
+        "System\\.out\\.print",
+        "System\\.err\\.print"
+      ],
+      "wrapAsImports": false
+    },
+    {
+      "category": "Traceability Issues",
+      "name": "Stacktrace Dump",
+      "languages": [
+        "java"
+      ],
+      "extensions": [],
+      "fingerprints": [
+        "printStackTrace\\("
+      ],
+      "wrapAsImports": false
+    },
+    {
+      "category": "Traceability Issues",
+      "name": "Catch Top-Level Exception",
+      "languages": [
+        "java"
+      ],
+      "extensions": [],
+      "fingerprints": [
+        "catch\\s*\\(\\s*Exception ",
+        "catch\\s*\\(\\s*Error ",
+        "catch\\s*\\(\\s*Throwable "
+      ],
+      "wrapAsImports": false
+    },
+    {
+      "category": "Unit Testing",
+      "name": "Unit Test Files",
+      "languages": [
+        "java"
+      ],
+      "extensions": [],
+      "fingerprints": [
+        "org.junit",
+        "junit.framework",
+        "org.hamcrest"
+      ],
+      "wrapAsImports": true
+    },
+    {
+      "category": "Hardly Portable Technologies",
+      "name": "Embedded SQL Queries",
+      "languages": [
+        "java"
+      ],
+      "extensions": [],
+      "fingerprints": [
+        "PreparedStatement",
+        "java.sql",
+        "javax.sql",
+        "oracle.jdbc",
+        "oracle.security.o3logon",
+        "oracle.sql",
+        "oracle.net",
+        "oracle.jpub",
+        "org.skife.jdbi"
+      ],
+      "wrapAsImports": true
+    }
+  ]
+}