@dxworks/insider 2.9.1

package/dist/config/rules/security_feature/authentication.json

@@ -0,0 +1,387 @@
+[
+  {
+    "name": "Authentication: Microsoft (Identity)",
+    "id": "AI038900",
+    "description": "Authentication using Microsoft Identity Platform (ADAL/MSAL) or similar",
+    "tags":[ "Authentication.Microsoft.Online" ],
+    "severity": "critical",
+    "patterns": [
+      {
+        "pattern": "login\\.microsoftonline(-p)*\\.com|SAS.*Token|login\\.live.com|Shared *Access *Signature",
+        "type": "regexword",
+        "scopes": [ "code", "comment" ],
+        "modifiers": [ "i" ],
+        "confidence": "high"
+      },
+      {
+        "pattern": "System\\.IdentityModel|AzureADB2C|SingleAccountPublicClientApplication|MultipleAccountPublicClientApplication",
+        "type": "regexword",
+        "scopes": [ "code", "comment" ],
+        "modifiers": [ "i" ],
+        "confidence": "high"
+      },
+      {
+        "pattern": "microsoft\\.aad|microsoft\\.adal|microsoft\\.msal|AADClient|Microsoft\\.IdentityModel|passport\\.net|ServicePrincipalCredentials",
+        "type": "regexword",
+        "scopes": [ "code", "comment" ],
+        "modifiers": [ "i" ],
+        "confidence": "high"
+      },
+      {
+        "pattern": "AuthenticationResult|MsalServiceException",
+        "type": "regexword",
+        "scopes": [ "code", "comment" ],
+        "modifiers": [ "i" ],
+        "confidence": "high"
+      }
+    ]
+  },
+  {
+    "name": "Authentication: Microsoft (Identity)",
+    "id": "AI038910",
+    "description": "Authentication using Microsoft Identity Platform (ADAL/MSAL) or similar",
+    "tags":[ "Authentication.Microsoft.Online" ],
+    "severity": "critical",
+    "patterns": [
+      {
+        "pattern": "AcquireTokenForClient|ConfidentialClientApplicationBuilder",
+        "type": "regexword",
+        "scopes": [ "code", "comment" ],
+        "confidence": "high"
+      }
+    ],
+    "conditions": [
+      {
+        "pattern": {
+          "pattern": "\\.WithClientClaims\\(.*cert.*\\)|\\.WithCertificate\\(",
+          "type": "regex",
+          "scopes": [ "code" ],
+          "_comment": "negate cases for certificate rule identifying client TLS auth"
+        },
+        "search_in": "finding-region(-10,10)",
+        "negate_finding": true
+      }
+    ]
+  },
+  {
+    "name": "Authentication: Google",
+    "id": "AI039000",
+    "description": "Authentication: Google",
+    "tags":[ "Authentication.Google" ],
+    "severity": "critical",
+    "patterns": [
+      {
+        "pattern": "using Google\\.Apis\\.Auth|GoogleCredential|AppIdentityCredential|oauth2/google|apis\\.google\\.com/js/api\\.js",
+        "type": "regexword",
+        "scopes": [ "code" ],
+        "modifiers": [ "i" ],
+        "confidence": "high"
+      },
+      {
+        "pattern": "OIDAuthorizationRequest|accounts\\.google\\.com/o/oauth2|googleapis\\.com/oauth2|GTMAppAuth",
+        "type": "regexword",
+        "scopes": [ "code" ],
+        "modifiers": [ "i" ],
+        "confidence": "high"
+      }
+    ]
+  },
+  {
+    "name": "Authentication: Oauth",
+    "id": "AI039100",
+    "description": "Authentication: Oauth",
+    "tags":[ "Authentication.Oauth" ],
+    "severity": "critical",
+    "patterns": [
+      {
+        "pattern": "oauth",
+        "type": "string",
+        "scopes": [ "code" ],
+        "modifiers": [ "i" ],
+        "confidence": "high"
+      },
+      {
+        "pattern": "auth.?token|access.?token|client.?credentials|client.?id|client.?secret|api.?key",
+        "type": "regexword",
+        "scopes": [ "code" ],
+        "modifiers": [ "i" ],
+        "confidence": "low"
+      },
+      {
+        "pattern": "Authorization: Bearer",
+        "type": "string",
+        "scopes": [ "code" ],
+        "modifiers": [ "i" ],
+        "confidence": "high"
+      },
+      {
+        "pattern": "bearer",
+        "type": "string",
+        "scopes": [ "code" ],
+        "modifiers": [ "i" ],
+        "confidence": "low"
+      }
+    ]
+  },
+  {
+    "name": "Authentication: OpenIDConnect",
+    "id": "AI039200",
+    "description": "Authentication: OpenIDConnect based Oauth",
+    "tags":[ "Authentication.OpenIDConnect" ],
+    "severity": "critical",
+    "patterns": [
+      {
+        "pattern": "OpenID",
+        "type": "string",
+        "scopes": [ "code", "comment" ],
+        "modifiers": [ "i" ],
+        "confidence": "high"
+      }
+    ]
+  },
+  {
+    "name": "Authentication: Microsoft (Active Directory)",
+    "id": "AI039300",
+    "description": "Authentication: Microsoft (Active Directory)",
+    "tags":[ "Authentication.Microsoft.Windows.ActiveDirectory" ],
+    "severity": "critical",
+    "patterns": [
+      {
+        "pattern": "active.?directory|ADFS",
+        "type": "regexword",
+        "scopes": [ "code", "comment" ],
+        "modifiers": [ "i" ],
+        "confidence": "high"
+      },
+      {
+        "pattern": "ADsOpenObject|ADObject|ADComputer|ADGroup|ADUser|ADContainer|ADDomain",
+        "type": "regexword",
+        "scopes": [ "code", "comment" ],
+        "confidence": "high"
+      },
+      {
+        "pattern": "Microsoft\\.IdentityModel\\.ActiveDirectory",
+        "type": "regexword",
+        "scopes": [ "code" ],
+        "confidence": "high"
+      },
+      {
+        "pattern": "System\\.DirectoryServices|IDirectoryObject|IDirectorySearch",
+        "type": "regexword",
+        "scopes": [ "code", "comment" ],
+        "confidence": "medium"
+      }
+    ]
+  },
+  {
+    "name": "Authentication: LDAP",
+    "id": "AI039400",
+    "description": "Authentication: LDAP",
+    "tags":[ "Authentication.LDAP" ],
+    "severity": "critical",
+    "patterns": [
+      {
+        "pattern": "LDAP|ldaps",
+        "type": "regexword",
+        "scopes": [ "code", "comment" ],
+        "modifiers": [ "i" ],
+        "confidence": "high"
+      }
+    ]
+  },
+  {
+    "name": "Authentication: Microsoft Windows (NTML)",
+    "id": "AI039500",
+    "description": "AAuthentication: Microsoft Windows (NTML)",
+    "tags":[ "Authentication.Microsoft.Windows.NTLM" ],
+    "severity": "critical",
+    "patterns": [
+      {
+        "pattern": "WWW-Authenticate: NTLM|windowsAuthentication|CredentialCache\\.DefaultCredentials|HTTPNtlmAuthHandler",
+        "type": "regexword",
+        "scopes": [ "code" ],
+        "confidence": "high"
+      },
+      {
+        "pattern": "LogonUserA|LogonUserEx|LogonUserW",
+        "type": "regexword",
+        "scopes": [ "code" ],
+        "confidence": "high"
+      },
+      {
+        "pattern": "NTLM",
+        "type": "string",
+        "scopes": [ "code" ],
+        "modifiers": [ "i" ],
+        "confidence": "medium"
+      }
+    ]
+  },
+  {
+    "name": "Authentication: Microsoft Windows (Kerberos)",
+    "id": "AI039510",
+    "description": "AAuthentication: Microsoft Windows (Kerberos)",
+    "applies_to": [
+      "c",
+      "cpp",
+      "python",
+      "java",
+      "csharp"
+    ],
+    "tags":[ "Authentication.Microsoft.Windows.Kerberos" ],
+    "severity": "critical",
+    "patterns": [
+      {
+        "pattern": "WindowsIdentity|WindowsPrincipal|Kerberos",
+        "type": "regexword",
+        "scopes": [ "code" ],
+        "modifiers": [ "i" ],
+        "confidence": "high",
+        "_comment": "possible use for NTLM but default is Kerberos"
+      }
+    ]
+  },
+  {
+    "name": "Authentication: JWT",
+    "id": "AI039600",
+    "description": "Authentication: JWT",
+    "tags":[ "Authentication.JWT" ],
+    "severity": "critical",
+    "patterns": [
+      {
+        "pattern": "jwt|RFC 7519|System\\.IdentityModel\\.Tokens\\.Jwt|JwtSecurityToken|JsonWebToken",
+        "type": "regexword",
+        "scopes": [ "code", "comment" ],
+        "modifiers": [ "i" ],
+        "confidence": "high"
+      }
+    ]
+  },
+  {
+    "name": "Authentication: HTML Form Based",
+    "id": "AI039700",
+    "description": "Authentication: HTML Form Based",
+    "tags":[ "Authentication.HTMLForm" ],
+    "severity": "critical",
+    "patterns": [
+      {
+        "pattern": " type=['\\\"]password['\\\"] ",
+        "type": "regex",
+        "scopes": [ "code" ],
+        "modifiers": [ "i" ],
+        "confidence": "high"
+      }
+    ]
+  },
+  {
+    "name": "Authentication: SAML",
+    "id": "AI039800",
+    "description": "Authentication: SAML",
+    "applies_to":[ "csharp" ],
+    "tags":[ "Authentication.SAML" ],
+    "severity": "critical",
+    "patterns": [
+      {
+        "pattern": "AuthenticationHeaderValue\\(\"SAML\"",
+        "type": "regexword",
+        "scopes": [ "code" ],
+        "modifiers": [ "i" ],
+        "confidence": "high"
+      }
+    ]
+  },
+  {
+    "name": "Authentication: SAML",
+    "id": "AI039810",
+    "description": "Authentication: SAML",
+    "tags":[ "Authentication.SAML" ],
+    "severity": "critical",
+    "patterns": [
+      {
+        "pattern": "SAML|saml2",
+        "type": "regexword",
+        "scopes": [ "code" ],
+        "modifiers": [ "i" ],
+        "confidence": "high"
+      },
+      {
+        "pattern": "federation|sso",
+        "type": "regexword",
+        "scopes": [ "code" ],
+        "modifiers": [ "i" ],
+        "confidence": "medium"
+      }
+    ]
+  },
+  {
+    "name": "Authentication: Basic-Auth",
+    "id": "AI039900",
+    "description": "Authentication: Basic-Auth",
+    "tags":[ "Authentication.General" ],
+    "severity": "critical",
+    "patterns": [
+      {
+        "pattern": "\"Authorization: Basic|WWW-Authenticate|AuthenticationHeaderValue\\(\"Basic\"",
+        "type": "regexword",
+        "scopes": [ "code" ],
+        "modifiers": [ "i" ],
+        "confidence": "high"
+      }
+    ]
+  },
+  {
+    "name": "Authentication: General",
+    "id": "AI040000",
+    "description": "Authentication: General",
+    "tags":[ "Authentication.General" ],
+    "severity": "critical",
+    "patterns": [
+      {
+        "pattern": "principal|identity|auth|authenticated|authentication|signin|sign-?in|signout|sign-?out|networkcredential",
+        "type": "regexword",
+        "scopes": [ "code" ],
+        "modifiers": [ "i" ],
+        "confidence": "high"
+      }
+    ]
+  },
+  {
+    "name": "Authentication: General",
+    "id": "AI040001",
+    "description": "Authentication: General",
+    "tags":[ "Authentication.General" ],
+    "severity": "critical",
+    "patterns": [
+      {
+        "pattern": "log(in|on)|log(off|out)",
+        "type": "regexword",
+        "scopes": [ "code" ],
+        "modifiers": [ "i" ],
+        "confidence": "low"
+      }
+    ]
+  },
+  {
+    "name": "Authentication: General",
+    "id": "AI040100",
+    "description": "Authentication: General",
+    "tags":[ "Authentication.General" ],
+    "severity": "critical",
+    "patterns": [
+      {
+        "pattern": "(username|userid|password|passphrase|multi-factor|credential|acct)s?",
+        "type": "regexword",
+        "scopes": [ "code" ],
+        "modifiers": [ "i" ],
+        "confidence": "high"
+      },
+      {
+        "pattern": "connection.?string|conn.?string|DefaultNetworkCredentials",
+        "type": "regexword",
+        "scopes": [ "code" ],
+        "modifiers": [ "i" ],
+        "confidence": "medium"
+      }
+    ]
+  }
+]

package/dist/config/rules/security_feature/authorization.json

@@ -0,0 +1,148 @@
+[
+  {
+    "name": "Authorization: Microsoft Azure SAS",
+    "id": "AI040200",
+    "description": "Authorization: Microsoft Azure SAS",
+    "applies_to": [
+    ],
+    "tags":[ "Authorization.Microsoft.Azuze.SAS" ],
+    "severity": "critical",
+    "patterns": [
+      {
+        "pattern": "sharedAccessPolicy|storageAccessKey|sharedAccessAccountPolicy|storageAccountOrConnectionString",
+        "type": "regexword",
+        "scopes": [ "code" ],
+        "confidence": "high"
+      },
+      {
+        "pattern": "SAS *Token",
+        "type": "regex",
+        "scopes": [ "code" ],
+        "modifiers": [ "i" ],
+        "confidence": "high"
+      }
+    ]
+  },
+  {
+    "name": "Authorization: Roles Based Access (RBAC)",
+    "id": "AI040300",
+    "description": "Authorization: Roles Based Access (RBAC)",
+    "applies_to": [
+    ],
+    "tags":[ "Authorization.RBAC" ],
+    "severity": "critical",
+    "patterns": [
+      {
+        "pattern": "rbac|userroles?|roles?",
+        "type": "regexword",
+        "scopes": [ "code" ],
+        "modifiers": [ "i" ],
+        "confidence": "high"
+      }
+    ]
+  },
+  {
+    "name": "Authorization: Permissions",
+    "id": "AI040400",
+    "description": "Authorization: Permissions",
+    "applies_to": [
+    ],
+    "tags":[ "Authorization.Permissions" ],
+    "severity": "critical",
+    "patterns": [
+      {
+        "pattern": "permissions*",
+        "type": "regexword",
+        "scopes": [ "code" ],
+        "modifiers": [ "i" ],
+        "confidence": "high"
+      }
+    ],
+    "conditions": [
+      {
+        "pattern": {
+          "pattern": "License|copyright|readme.md",
+          "type": "regexword",
+          "scopes": [ "code" ],
+          "modifiers": [ "i" ],
+          "_comment": "eliminate notices"
+        },
+        "search_in": "finding-region(-10,10)",
+        "negate_finding": true
+      }
+    ]
+  },
+  {
+    "name": "Authorization: Claims",
+    "id": "AI040500",
+    "description": "Authorization: Claims",
+    "applies_to": [
+    ],
+    "tags":[ "Authorization.Claims" ],
+    "severity": "critical",
+    "patterns": [
+      {
+        "pattern": "claims*",
+        "type": "regex",
+        "scopes": [ "code" ],
+        "modifiers": [ "i" ],
+        "confidence": "high"
+      }
+    ],
+    "conditions": [
+      {
+        "pattern": {
+          "pattern": "License|copyright|Permission to use|readme.md",
+          "type": "regexword",
+          "scopes": [ "code" ],
+          "modifiers": [ "i" ],
+          "_comment": "eliminate notices"
+        },
+        "search_in": "finding-region(-10,10)",
+        "negate_finding": true
+      }
+    ]
+  },
+  {
+    "name": "Authorization: General",
+    "id": "AI040600",
+    "description": "Authorization: General",
+    "applies_to": [
+    ],
+    "tags":[ "Authorization.General" ],
+    "severity": "critical",
+    "patterns": [
+      {
+        "pattern": "authorize|authorized|authorization|isauthorized",
+        "type": "regexword",
+        "scopes": [ "code" ],
+        "modifiers": [ "i" ],
+        "confidence": "high"
+      }
+    ],
+    "conditions": [
+      {
+        "pattern": {
+          "pattern": "SAS|SharedAccess",
+          "type": "regexword",
+          "scopes": [ "code" ],
+          "modifiers": [ "i" ],
+          "_comment": "since already covered by another rule if SAS related"
+        },
+        "search_in": "finding-region(-10,10)",
+        "negate_finding": true
+      },
+      {
+        "pattern": {
+          "pattern": "UnauthorizedAccessException",
+          "type": "regex",
+          "scopes": [ "code" ],
+          "modifiers": [ "i" ],
+          "_comment": "This may not indicate that actual authorization is going on."
+        },
+        "search_in": "same-line",
+        "negate_finding": true
+      }
+    ]
+  }
+]