@dxworks/insider 2.9.1

package/insider/config/rules/data_handling/deserialization.json

@@ -0,0 +1,296 @@
+[
+  {
+    "name": "Data: Serialization",
+    "id": "AI012100",
+    "description": "Data: Serialization",
+    "applies_to": [
+      "python",
+      "rust"
+    ],
+    "tags":[ "Data.Serialization" ],
+    "severity": "critical",
+    "patterns": [
+      {
+        "pattern": "Serialize",
+        "type": "regex",
+        "scopes": [ "code" ],
+        "modifiers": [ "i" ],
+        "confidence": "medium"
+      }
+    ]
+  },
+  {
+    "name": "Data: Serialization",
+    "id": "AI012200",
+    "description": "Data: Serialization",
+    "applies_to":[ "python" ],
+    "tags":[ "Data.Serialization" ],
+    "severity": "critical",
+    "patterns": [
+      {
+        "pattern": "import .*c?pickle",
+        "type": "regex",
+        "scopes": [ "code" ],
+        "confidence": "high"
+      }
+    ]
+  },
+  {
+    "name": "Data: Serialization",
+    "id": "AI012300",
+    "description": "Data: Serialization",
+    "applies_to":[ "python" ],
+    "tags":[ "Data.Serialization" ],
+    "severity": "critical",
+    "patterns": [
+      {
+        "pattern": "c?pickle\\.dump",
+        "type": "regex",
+        "scopes": [ "code" ],
+        "confidence": "high"
+      }
+    ]
+  },
+  {
+    "name": "Data: Deserialization",
+    "id": "AI012400",
+    "description": "Data: Deserialization",
+    "applies_to":[ "python" ],
+    "tags":[ "Data.Deserialization" ],
+    "severity": "critical",
+    "patterns": [
+      {
+        "pattern": "c?pickle\\.load",
+        "type": "regex",
+        "scopes": [ "code" ],
+        "confidence": "high"
+      }
+    ]
+  },
+  {
+    "name": "Data: Deserialization",
+    "id": "AI012500",
+    "description": "Data: Deserialization",
+    "applies_to":[ "java" ],
+    "tags":[ "Data.Deserialization" ],
+    "severity": "critical",
+    "patterns": [
+      {
+        "pattern": ".readObject",
+        "type": "substring",
+        "scopes": [ "code" ],
+        "confidence": "high"
+      }
+    ]
+  },
+  {
+    "name": "Data: Deserialization",
+    "id": "AI012600",
+    "description": "Data: Deserialization",
+    "applies_to":[ "php" ],
+    "tags":[ "Data.Deserialization" ],
+    "severity": "critical",
+    "patterns": [
+      {
+        "pattern": "unserialize\\(",
+        "type": "substring",
+        "scopes": [ "code" ],
+        "confidence": "high"
+      }
+    ]
+  },
+  {
+    "name": "Data: Deserialization",
+    "id": "AI012700",
+    "description": "Data: Deserialization",
+    "applies_to":[ "ruby" ],
+    "tags":[ "Data.Deserialization" ],
+    "severity": "critical",
+    "patterns": [
+      {
+        "pattern": "(YAML|Syck|Marshal)\\.load",
+        "type": "regex",
+        "scopes": [ "code" ],
+        "confidence": "high"
+      }
+    ]
+  },
+  {
+    "name": "Data: Serialization",
+    "id": "AI012800",
+    "description": "Data: Serialization",
+    "applies_to":[ "csharp" ],
+    "tags":[ "Data.Serialization" ],
+    "severity": "critical",
+    "patterns": [
+      {
+        "pattern": "SerializeObject|JavaScriptSerializer|Newtonsoft|json\\.net|Utf8Json|MessagePack",
+        "type": "regexword",
+        "scopes": [ "code" ],
+        "confidence": "high"
+      }
+    ]
+  },
+  {
+    "name": "Data: Deserialization",
+    "id": "AI012900",
+    "description": "Data: Deserialization",
+    "applies_to":[ "csharp" ],
+    "tags":[ "Data.Deserialization" ],
+    "severity": "critical",
+    "patterns": [
+      {
+        "pattern": "DeserializeObject",
+        "type": "string",
+        "scopes": [ "code" ],
+        "confidence": "high"
+      },
+      {
+        "pattern": "PopulateObject",
+        "type": "string",
+        "scopes": [ "code" ],
+        "confidence": "high"
+      },
+      {
+        "pattern": "TypeNameHandling",
+        "type": "string",
+        "scopes": [ "code" ],
+        "confidence": "high"
+      },
+      {
+        "pattern": "(De)?[Ss]erialize",
+        "type": "string",
+        "scopes": [ "code" ],
+        "confidence": "high"
+      }
+    ]
+  },
+  {
+    "name": "Data: Deserialization",
+    "id": "AI013000",
+    "description": "Data: Deserialization",
+    "applies_to":[ "csharp" ],
+    "tags":[ "Data.Deserialization" ],
+    "severity": "critical",
+    "patterns": [
+      {
+        "pattern": "System.Runtime.Serialization",
+        "type": "string",
+        "scopes": [ "code" ],
+        "confidence": "high"
+      },
+      {
+        "pattern": "BinaryFormatter",
+        "type": "string",
+        "scopes": [ "code" ],
+        "confidence": "high"
+      },
+      {
+        "pattern": "TypeNameHandling",
+        "type": "string",
+        "scopes": [ "code" ],
+        "confidence": "high"
+      }
+    ]
+  },
+  {
+    "name": "Data: Deserialization",
+    "id": "AI013010",
+    "description": "Data: Deserialization",
+    "applies_to": [
+      "python",
+      "rust"
+    ],
+    "tags":[ "Data.Deserialization" ],
+    "severity": "critical",
+    "patterns": [
+      {
+        "pattern": "Deserialize",
+        "type": "regex",
+        "scopes": [ "code" ],
+        "modifiers": [ "i" ],
+        "confidence": "medium"
+      }
+    ]
+  },
+  {
+    "name": "Data: Bluetooth Serialization",
+    "id": "AI013100",
+    "description": "Data: Bluetooth Serialization",
+    "tags":[ "Data.Deserialization.Signal.Bluetooth" ],
+    "severity": "critical",
+    "patterns": [
+      {
+        "pattern": "Bluetooth",
+        "type": "string",
+        "modifiers": [ "i" ],
+        "scopes": [ "code" ],
+        "confidence": "high"
+      }
+    ]
+  },
+  {
+    "name": "Data: Cellular Serialization",
+    "id": "AI013200",
+    "description": "Data: Cellular Serialization",
+    "tags":[ "Data.Deserialization.Signal.Cellular" ],
+    "severity": "critical",
+    "patterns": [
+      {
+        "pattern": "Cellular",
+        "type": "string",
+        "modifiers": [ "i" ],
+        "scopes": [ "code" ],
+        "confidence": "high"
+      }
+    ]
+  },
+  {
+    "name": "Data: USB",
+    "id": "AI013300",
+    "description": "Data: USB Serialization",
+    "tags":[ "Data.Deserialization.Signal.USB" ],
+    "severity": "critical",
+    "patterns": [
+      {
+        "pattern": "USB",
+        "type": "string",
+        "modifiers": [ "i" ],
+        "scopes": [ "code" ],
+        "confidence": "high"
+      }
+    ]
+  },
+  {
+    "name": "Data: Ethernet",
+    "id": "AI013400",
+    "description": "Data: Ethernet Serialization",
+    "tags":[ "Data.Deserialization.Signal.Ethernet" ],
+    "severity": "critical",
+    "patterns": [
+      {
+        "pattern": "Ethernet",
+        "type": "string",
+        "modifiers": [ "i" ],
+        "scopes": [ "code" ],
+        "confidence": "high"
+      }
+    ]
+  },
+  {
+    "name": "Data: Modem",
+    "id": "AI013500",
+    "description": "Data: Modem Serialization",
+    "tags":[ "Data.Deserialization.Signal.Modem" ],
+    "severity": "critical",
+    "patterns": [
+      {
+        "pattern": "Modem",
+        "type": "string",
+        "modifiers": [ "i" ],
+        "scopes": [ "code" ],
+        "confidence": "high"
+      }
+    ]
+  }
+]

package/insider/config/rules/data_handling/json_parsing.json

@@ -0,0 +1,49 @@
+[
+  {
+    "name": "Data: Parses JSON",
+    "id": "AI013600",
+    "description": "Data: Parses JSON",
+    "applies_to": [ "javascript", "typescript" ],
+    "tags":[ "Data.Parsing.JSON" ],
+    "severity": "moderate",
+    "patterns": [
+      {
+        "pattern": "JSON.Parse",
+        "confidence": "high",
+        "type": "string",
+        "scopes": [ "code" ]
+      }
+    ]
+  },
+  {
+    "name": "Data: Parses JSON",
+    "id": "AI013700",
+    "description": "Data: Parses JSON",
+    "applies_to": [ "csharp" ],
+    "tags":[ "Data.Parsing.JSON" ],
+    "severity": "moderate",
+    "patterns": [
+      {
+        "pattern": "JSON\\.createParser|JObject\\.Parse|JsonConvert|JsonSerializer",
+        "confidence": "high",
+        "type": "regexword",
+        "scopes": [ "code" ]
+      }
+    ]
+  },
+  {
+    "name": "Data: Parses JSON",
+    "id": "AI013800",
+    "description": "Data: Parses JSON",
+    "tags":[ "Data.Parsing.JSON" ],
+    "severity": "moderate",
+    "patterns": [
+      {
+        "pattern": "json.{0,5}parser",
+        "confidence": "high",
+        "type": "regexword",
+        "scopes": [ "code" ]
+      }
+    ]
+  }
+]

package/insider/config/rules/data_handling/media_parsing.json

@@ -0,0 +1,33 @@
+[
+  {
+    "name": "Audio Video Media Codec",
+    "id": "AI013900",
+    "description": "Audio Video Media Codec",
+    "tags":[ "Data.Parsing.Media" ],
+    "severity": "critical",
+    "patterns": [
+      {
+        "pattern": "ffmpeg|libraw|webp|DivX|XviDH.263|H.264|HEVC|MPEG4|Theora|3GP|Windows Media|JPEG 2000",
+        "type": "regexword",
+        "scopes": [ "code", "comment" ],
+        "modifiers": [ "i" ],
+        "confidence": "high"
+      },
+      {
+        "pattern": "Quicktime|MPEG-4|VP8|VP6|MPEG1|MPEG2|MPEG-TS|MPEG-4|DNXHD|XDCAM|DVCPRO|IMX|XDCAM",
+        "type": "regexword",
+        "scopes": [ "code", "comment" ],
+        "modifiers": [ "i" ],
+        "confidence": "high"
+      },
+      {
+        "pattern": "mux",
+        "type": "string",
+        "scopes": [ "code", "comment" ],
+        "modifiers": [ "i" ],
+        "confidence": "high"
+      }
+      
+    ]
+  }
+]

package/insider/config/rules/data_handling/pastebin.json

@@ -0,0 +1,18 @@
+[
+  {
+    "name": "CloudServices: DataStorage (PasteBin or Similar)",
+    "id": "AI014000",
+    "description": "CloudServices: DataStorage (PasteBin or Similar)",
+    "tags":[ "CloudServices.DataStorage.PasteBin" ],
+    "severity": "moderate",
+    "patterns": [
+      {
+        "pattern": "pastebin|zerobin|ghostbin|hastebin",
+        "type": "regex",
+        "scopes": [ "code", "comment" ],
+        "modifiers": [ "i" ],
+        "confidence": "high"
+      }
+    ]
+  }
+]

package/insider/config/rules/data_handling/xml_parsing.json

@@ -0,0 +1,168 @@
+[
+  {
+    "name": "Data: Parses XML",
+    "id": "AI014100",
+    "description": "Data: Parses XML",
+    "tags":[ "Data.Parsing.XML" ],
+    "severity": "critical",
+    "patterns": [
+      {
+        "pattern": "sax|xpath|xmldom|xelement|xmldocument",
+        "type": "regexword",
+        "confidence": "high",
+        "scopes": [ "code" ]
+      }
+    ]
+  },
+  {
+    "name": "Data: Parses XML",
+    "id": "AI014200",
+    "description": "Data: Parses XML",
+    "applies_to": [ "python" ],
+    "tags":[ "Data.Parsing.XML" ],
+    "severity": "critical",
+    "patterns": [
+      {
+        "pattern": "lxml|etree|ElementTree|minidom|pulldom|xmlrpc",
+        "type": "regexword",
+        "confidence": "high",
+        "scopes": [ "code" ]
+      }
+    ]
+  },
+  {
+    "name": "Data: Parses XML",
+    "id": "AI014300",
+    "description": "Data: Parses XML",
+    "applies_to": [ "javascript", "typescript" ],
+    "tags":[ "Data.Parsing.XML" ],
+    "severity": "critical",
+    "patterns": [
+      {
+        "pattern": "parseFromString\\(.*,\"text\/xml\"\\)|xhttp\\.responseXML",
+        "type": "regexword",
+        "confidence": "high",
+        "scopes": [ "code" ]
+      }
+    ]
+  },
+  {
+    "name": "Data: Parses XML",
+    "id": "AI014400",
+    "description": "Data: Parses XML",
+    "applies_to": [ "java" ],
+    "tags":[ "Data.Parsing.XML" ],
+    "severity": "critical",
+    "patterns": [
+      {
+        "pattern": "jdom2|SAXBuilder",
+        "type": "regexword",
+        "confidence": "high",
+        "scopes": [ "code" ]
+      }
+    ]
+  },
+  {
+    "name": "Data: XSLT Transformations",
+    "id": "AI014500",
+    "description": "Data: XSLT Transformations",
+    "applies_to": [ "csharp" ],
+    "tags":[ "Data.Parsing.XSLT" ],
+    "severity": "critical",
+    "patterns": [
+      {
+        "pattern": "XslTransform|System\\.Xml\\.Xsl|XslCompiledTransform|transformNode",
+        "type": "regexword",
+        "confidence": "high",
+        "scopes": [ "code" ]
+      }
+    ]
+  },
+  {
+    "name": "Data: XSLT Transformations",
+    "id": "AI014600",
+    "description": "Data: XSLT Transformations",
+    "applies_to": [ "java" ],
+    "tags":[ "Data.Parsing.XSLT" ],
+    "severity": "critical",
+    "patterns": [
+      {
+        "pattern": "TransformerFactory|XSLDocument|javax\\.xml\\.transform",
+        "type": "regexword",
+        "confidence": "high",
+        "scopes": [ "code" ]
+      }
+    ]
+  },
+  {
+    "name": "Data: XSLT Transformations",
+    "id": "AI014700",
+    "description": "Data: XSLT Transformations",
+    "applies_to": [ "javascript", "typescript" ],
+    "tags":[ "Data.Parsing.XSLT" ],
+    "severity": "critical",
+    "patterns": [
+      {
+        "pattern": "XSLTProcessor",
+        "type": "regexword",
+        "confidence": "high",
+        "scopes": [ "code" ]
+      }
+    ]
+  },
+  {
+    "name": "Data: XSLT Transformations",
+    "id": "AI014800",
+    "description": "Data: XSLT Transformations",
+    "tags":[ "Data.Parsing.XSLT" ],
+    "severity": "critical",
+    "patterns": [
+      {
+        "pattern": ".xslt",
+        "type": "string",
+        "confidence": "high",
+        "scopes": [ "code" ]
+      }
+    ],
+    "conditions": [
+      {
+        "pattern": {
+          "pattern": "exclude",
+          "type": "regex",
+          "scopes": [ "code" ],
+          "modifiers": [ "i" ]
+        },
+        "search_in": "same-line",
+        "negate_finding": true
+      }
+    ]
+  },
+  {
+    "name": "Data: XSLT Transformations",
+    "id": "AI014900",
+    "description": "Data: XSLT Transformations",
+    "tags":[ "Data.Parsing.XSLT" ],
+    "severity": "critical",
+    "patterns": [
+      {
+        "pattern": "xslt|xsl:stylesheet",
+        "type": "regexword",
+        "modifiers": [ "i" ],
+        "confidence": "high",
+        "scopes": [ "code" ]
+      }
+    ],
+    "conditions": [
+      {
+        "pattern": {
+          "pattern": "exclude",
+          "type": "regexword",
+          "scopes": [ "code" ],
+          "modifiers": [ "i" ]
+        },
+        "search_in": "same-line",
+        "negate_finding": true
+      }
+    ]
+  }
+]

package/insider/config/rules/data_types/financial.json

@@ -0,0 +1,106 @@
+[
+  {
+    "name": "Data: Financial (Account)",
+    "id": "AI015000",
+    "description": "Data: Financial (Account)",
+    "tags":[ "Data.Sensitive.Financial.BankAccount" ],
+    "severity": "critical",
+    "patterns": [
+      {
+        "pattern": "bank\\s*(acct|account)",
+        "type": "regexword",
+        "scopes": [ "code", "comment" ],
+        "modifiers": [ "i" ],
+        "confidence": "high"
+      },
+      {
+        "pattern": "(checking|savings|chk|401k|roth)\\s*(account|acct)",
+        "type": "regexword",
+        "scopes": [ "code" ],
+        "modifiers": [ "i" ],
+        "confidence": "high"
+      }
+    ]
+  },
+  {
+    "name": "Data: Financial (Income)",
+    "id": "AI015100",
+    "description": "Data: Financial (Income)",
+    "tags":[ "Data.Sensitive.Financial.General" ],
+    "severity": "critical",
+    "patterns": [
+      {
+        "pattern": "finances*|financial",
+        "type": "regex",
+        "scopes": [ "code" ],
+        "modifiers": [ "i" ],
+        "confidence": "low"
+      }
+    ]
+  },
+  {
+    "name": "Data: Financial (Currency)",
+    "id": "AI015200",
+    "description": "Data: Financial (Currency)",
+    "tags":[ "Data.Sensitive.Financial.Currency" ],
+    "patterns": [
+      {
+        "pattern": "currency|usd|money|dollar|coins|euro|peso|deutsche-mark|dinar|franc|krone|pound|rupee|shekel|yen",
+        "type": "regexword",
+        "scopes": [ "code" ],
+        "modifiers": [ "i" ],
+        "confidence": "medium",
+        "_comment": "Currencies"
+      }
+    ]
+  },
+  {
+    "name": "Data: Financial (Credit Card)",
+    "id": "AI015300",
+    "description": "Data: Financial (Credit Card)",
+    "tags":[ "Data.Sensitive.Financial.CreditCard" ],
+    "severity": "critical",
+    "patterns": [
+      {
+        "pattern": "visa|americanexpress|amex|(master|discover|credit|debit)\\s*card",
+        "type": "regexword",
+        "scopes": [ "code" ],
+        "modifiers": [ "i" ],
+        "confidence": "high"
+      }
+    ]
+  },
+  {
+    "name": "Data: Financial (Payroll)",
+    "id": "AI015400",
+    "description": "Data: Financial (Payroll)",
+    "tags":[ "Data.Sensitive.Financial.Payroll" ],
+    "severity": "important",
+    "patterns": [
+      {
+        "pattern": "pay-*roll|salary|salaries|stock",
+        "type": "regexword",
+        "scopes": [ "code" ],
+        "modifiers": [ "i" ],
+        "confidence": "high"
+      }
+    ]
+  },
+  {
+    "name": "Data: Financial (Salesdata)",
+    "id": "AI015500",
+    "description": "Data: Financial (Salesdata)",
+    "tags":[ "Data.Sensitive.Financial.Salesdata" ],
+    "severity": "critical",
+    "patterns": [
+      {
+        "pattern": "sales",
+        "type": "string",
+        "scopes": [ "code" ],
+        "modifiers": [ "i" ],
+        "confidence": "low",
+        "_comment": "sales data or forecast"
+      }
+    ]
+  }
+]