@dxworks/insider 2.9.1

package/insider/config/rules/tools/pipeline.json

@@ -0,0 +1,195 @@
+[
+  {
+    "name": "Pipeline Tool (AntiMalware)",
+    "id": "AI053300",
+    "description": "General AntiMalware",
+    "tags":[ "Pipeline.StaticAnalysis.AntiMalware" ],
+    "severity": "critical",
+    "patterns": [
+      {
+        "pattern": "AntiMalware",
+        "type": "string",
+        "scopes": [ "code"],
+        "modifiers": [ "i" ],
+        "confidence": "high"
+      }
+    ]
+  },
+  {
+    "name": "Pipeline Tool (Bandit)",
+    "id": "AI053400",
+    "description": "Finds vulnerabilities in Python code.",
+    "tags":[ "Pipeline.StaticAnalysis.Bandit" ],
+    "severity": "critical",
+    "patterns": [
+      {
+        "pattern": "Bandit",
+        "type": "string",
+        "scopes": [ "code"],
+        "modifiers": [ "i" ],
+        "confidence": "high"
+      }
+    ]
+  },
+  {
+    "name": "Pipeline Tool (BinSkim)",
+    "id": "AI053500",
+    "description": "Validates compiler and linker security settings.",
+    "tags":[ "Pipeline.CompilerSettings.BinSkim" ],
+    "severity": "critical",
+    "patterns": [
+      {
+        "pattern": "BinSkim",
+        "type": "string",
+        "scopes": [ "code"],
+        "modifiers": [ "i" ],
+        "confidence": "high"
+      }
+    ]
+  },
+  {
+    "name": "Pipeline Tool (CodeSigning)",
+    "id": "AI053600",
+    "description": "General code signing.",
+    "tags":[ "Pipeline.Packaging.CodeSigning" ],
+    "severity": "critical",
+    "patterns": [
+      {
+        "pattern": "CodeSign",
+        "type": "string",
+        "scopes": [ "code"],
+        "modifiers": [ "i" ],
+        "confidence": "high",
+        "_comment": "uses regex to support 'codesigning' or other variations"
+      }
+    ]
+  },
+  {
+    "name": "Pipeline Tool (CodeQL)",
+    "id": "AI053700",
+    "description": "Identifies patterns in code.",
+    "tags":[ "Pipeline.StaticAnalysis.CodeQL" ],
+    "severity": "critical",
+    "patterns": [
+      {
+        "pattern": "CodeQL",
+        "type": "string",
+        "scopes": [ "code"],
+        "modifiers": [ "i" ],
+        "confidence": "high"
+      }
+    ]
+  },
+  {
+    "name": "Pipeline Tool (ESLint)",
+    "id": "AI053800",
+    "description": "Identifies problematic coding patterns in JavaScript.",
+    "tags":[ "Pipeline.Linter.ESLint" ],
+    "severity": "critical",
+    "patterns": [
+      {
+        "pattern": "ESLint",
+        "type": "string",
+        "scopes": [ "code"],
+        "modifiers": [ "i" ],
+        "confidence": "high"
+      }
+    ]
+  },
+  {
+    "name": "Pipeline Tool (FxCop)",
+    "id": "AI053900",
+    "description": "Analyzer that checks conformance to Microsoft .NET Design Guidelines.",
+    "tags":[ "Pipeline.StaticAnalysis.FxCop" ],
+    "severity": "critical",
+    "patterns": [
+      {
+        "pattern": "FxCop",
+        "type": "string",
+        "scopes": [ "code"],
+        "modifiers": [ "i" ],
+        "confidence": "high"
+      }
+    ]
+  },
+  {
+    "name": "Pipeline Tool (ModernCop)",
+    "id": "AI054000",
+    "description": "Analyzer that checks for security vulnerabilities in .NET code.",
+    "tags":[ "Pipeline.StaticAnalysis.ModernCop" ],
+    "severity": "critical",
+    "patterns": [
+      {
+        "pattern": "ModernCop",
+        "type": "string",
+        "scopes": [ "code"],
+        "modifiers": [ "i" ],
+        "confidence": "high"
+      }
+    ]
+  },
+  {
+    "name": "Pipeline Tool (NuGetCommand)",
+    "id": "AI054100",
+    "description": "Identifies package manager commands for NuGet.",
+    "tags":[ "Pipeline.Packaging.NuGetCommand" ],
+    "severity": "critical",
+    "patterns": [
+      {
+        "pattern": "NuGetCommand",
+        "type": "string",
+        "scopes": [ "code"],
+        "modifiers": [ "i" ],
+        "confidence": "high"
+      }
+    ]
+  },
+  {
+    "name": "Pipeline Tool (RoslynAnalyzers)",
+    "id": "AI054200",
+    "description": "Identifies style, quality, design and other code characteristics.",
+    "tags":[ "Pipeline.StaticAnalysis.RoslynAnalyzers" ],
+    "severity": "critical",
+    "patterns": [
+      {
+        "pattern": "RoslynAnalyzers",
+        "type": "string",
+        "scopes": [ "code"],
+        "modifiers": [ "i" ],
+        "confidence": "high"
+      }
+    ]
+  },
+  {
+    "name": "Pipeline Tool (SpotBugs)",
+    "id": "AI054300",
+    "description": "Vulnerability detection for Java code.",
+    "tags":[ "Pipeline.StaticAnalysis.SpotBugs" ],
+    "severity": "critical",
+    "patterns": [
+      {
+        "pattern": "SpotBugs",
+        "type": "string",
+        "scopes": [ "code"],
+        "modifiers": [ "i" ],
+        "confidence": "high"
+      }
+    ]
+  },
+  {
+    "name": "Pipeline Tool (TSLint)",
+    "id": "AI054400",
+    "description": "Checks TypeScript for readability and functionality errors.",
+    "tags":[ "Pipeline.Linter.TSLint" ],
+    "severity": "critical",
+    "patterns": [
+      {
+        "pattern": "TSLint",
+        "type": "string",
+        "scopes": [ "code"],
+        "modifiers": [ "i" ],
+        "confidence": "high"
+      }
+    ]
+  }
+]

package/insider/config/rules/webapp/comms.json

@@ -0,0 +1,89 @@
+[
+  {
+    "name": "Web App Communications Post Message",
+    "id": "AI054500",
+    "description": "Web App Communications Post Message",
+    "tags":[ "WebApp.Communications.PostMessage" ],
+    "applies_to": [
+      "javascript",
+      "csharp",
+      "python",
+      "vb",
+      "html",
+      "javascriptreact",
+      "typescript",
+      "coffeescript",
+      "java",
+      "perl",
+      "ruby"
+    ],
+    "severity": "critical",
+    "patterns": [
+      {
+        "pattern": "window\\.parent\\.postMessage|contentWindow\\.postMessage",
+        "type": "regexword",
+        "scopes": [ "code" ],
+        "modifiers": [ "i" ],
+        "confidence": "high"
+      }
+    ]
+  },
+  {
+    "name": "Web App Communications Sockets",
+    "id": "AI054600",
+    "description": "Web App Communications Sockets",
+    "tags":[ "WebApp.Communications.Sockets" ],
+    "applies_to": [
+      "javascript",
+      "csharp",
+      "python",
+      "vb",
+      "html",
+      "javascriptreact",
+      "typescript",
+      "coffeescript",
+      "java",
+      "perl",
+      "ruby"
+    ],
+    "severity": "critical",
+    "patterns": [
+      {
+        "pattern": "WebSocket",
+        "type": "string",
+        "scopes": [ "code" ],
+        "modifiers": [ "i" ],
+        "confidence": "high"
+      }
+    ]
+  },
+  {
+    "name": "Web App Communications Server Events",
+    "id": "AI054700",
+    "description": "Web App Communications Server Events",
+    "tags":[ "WebApp.Communications.ServerEvent" ],
+    "applies_to": [
+      "javascript",
+      "csharp",
+      "python",
+      "vb",
+      "html",
+      "javascriptreact",
+      "typescript",
+      "coffeescript",
+      "java",
+      "perl",
+      "ruby"
+    ],
+    "severity": "critical",
+    "patterns": [
+      {
+        "pattern": "EventSource",
+        "type": "string",
+        "scopes": [ "code" ],
+        "confidence": "high",
+        "modifiers": [ "i" ]
+      }
+    ]
+  }
+]

package/insider/config/rules/webapp/headers.json

@@ -0,0 +1,178 @@
+[
+  {
+    "name": "Web App Headers HSTS",
+    "id": "AI054800",
+    "description": "Web App Headers Strict-Transport Security (HSTS)",
+    "tags":[ "WebApp.Headers.HSTS" ],
+    "severity": "critical",
+    "patterns": [
+      {
+        "pattern": "Strict-Transport-Security",
+        "type": "string",
+        "scopes": [ "code" ],
+        "modifiers": [ "i" ],
+        "confidence": "high"
+      }
+    ]
+  },
+  {
+    "name": "Web App Headers CSP",
+    "id": "AI054900",
+    "description": "Web App Headers Content Security Policy (CSP)",
+    "tags":[ "WebApp.Headers.CSP" ],
+    "severity": "critical",
+    "patterns": [
+      {
+        "pattern": "Content-Security-Policy",
+        "type": "string",
+        "scopes": [ "code" ],
+        "modifiers": [ "i" ],
+        "confidence": "high"
+      }
+    ]
+  },
+  {
+    "name": "Web App Headers X-Frame",
+    "id": "AI055000",
+    "description": "Web App Headers X-Frame",
+    "tags":[ "WebApp.Headers.X-Frame" ],
+    "severity": "critical",
+    "patterns": [
+      {
+        "pattern": "X-Frame-Options",
+        "type": "string",
+        "scopes": [ "code" ],
+        "modifiers": [ "i" ],
+        "confidence": "high"
+      }
+    ]
+  },
+  {
+    "name": "Deprecated Web App Headers X-XSS",
+    "id": "AI055100",
+    "description": "Web App Headers Cross Site Scripting Protection (X-XSS)",
+    "tags":[ "WebApp.Headers.XSS" ],
+    "severity": "critical",
+    "patterns": [
+      {
+        "pattern": "X-XSS-Protection",
+        "type": "string",
+        "scopes": [ "code" ],
+        "modifiers": [ "i" ],
+        "confidence": "high"
+      }
+    ]
+  },
+  {
+    "name": "Deprecated Web App Headers HPKP",
+    "id": "AI055200",
+    "description": "Web App Headers Publick Key Pin (HPKP)",
+    "tags":[ "WebApp.Headers.HPKP" ],
+    "severity": "critical",
+    "patterns": [
+      {
+        "pattern": "Public-Key-Pins",
+        "type": "string",
+        "scopes": [ "code" ],
+        "modifiers": [ "i" ],
+        "confidence": "high"
+      }
+    ]
+  },
+  {
+    "name": "Web App Headers Expect-CT",
+    "id": "AI055300",
+    "description": "Web App Headers Certificate Transparency Expect-CT",
+    "tags":[ "WebApp.Headers.Expect-CT" ],
+    "severity": "important",
+    "patterns": [
+      {
+        "pattern": "Expect-CT",
+        "type": "string",
+        "scopes": [ "code" ],
+        "modifiers": [ "i" ],
+        "confidence": "high"
+      }
+    ]
+  },
+  {
+    "name": "Web App Headers X-Content-Type-Options",
+    "id": "AI055400",
+    "description": "Web App Headers X-Content-Type-Options",
+    "tags":[ "WebApp.Headers.X-Content-Type-Options" ],
+    "severity": "important",
+    "patterns": [
+      {
+        "pattern": "X-Content-Type-Options",
+        "type": "string",
+        "scopes": [ "code" ],
+        "modifiers": [ "i" ],
+        "confidence": "high"
+      }
+    ]
+  },
+  {
+    "name": "Web App Headers Referrer-Policy",
+    "id": "AI055500",
+    "description": "Web App Headers Referrer-Policy",
+    "tags":[ "WebApp.Headers.Referrer-Policy" ],
+    "severity": "important",
+    "patterns": [
+      {
+        "pattern": "Referrer-Policy",
+        "type": "string",
+        "scopes": [ "code" ],
+        "modifiers": [ "i" ],
+        "confidence": "high"
+      }
+    ]
+  },
+  {
+    "name": "Web App Headers Cache-Control",
+    "id": "AI055600",
+    "description": "Web App Headers Cache-Control",
+    "tags":[ "WebApp.Headers.Cache-Control" ],
+    "severity": "important",
+    "patterns": [
+      {
+        "pattern": "Cache-Control",
+        "type": "string",
+        "scopes": [ "code" ],
+        "modifiers": [ "i" ],
+        "confidence": "high"
+      }
+    ]
+  },
+  {
+    "name": "Web App Headers Clear-Site-Data",
+    "id": "AI055700",
+    "description": "Web App Headers Clear-Site-Data",
+    "tags":[ "WebApp.Headers.Clear-Site-Data" ],
+    "severity": "critical",
+    "patterns": [
+      {
+        "pattern": "Clear-Site-Data",
+        "type": "string",
+        "scopes": [ "code" ],
+        "modifiers": [ "i" ],
+        "confidence": "high"
+      }
+    ]
+  },
+  {
+    "name": "Web App Headers Feature-Policy",
+    "id": "AI055800",
+    "description": "Web App Headers",
+    "tags":[ "WebApp.Headers.Feature-Policy" ],
+    "severity": "critical",
+    "patterns": [
+      {
+        "pattern": "Feature-Policy",
+        "type": "string",
+        "scopes": [ "code" ],
+        "modifiers": [ "i" ],
+        "confidence": "high"
+      }
+    ]
+  }
+]

package/insider/config/rules/webapp/media.json

@@ -0,0 +1,56 @@
+[
+  {
+    "name": "Web App Media Audio",
+    "id": "AI055900",
+    "description": "Web App Media Audio",
+    "tags":[ "WebApp.Media.Audio" ],
+    "applies_to": [
+      "javascript",
+      "python",
+      "vb",
+      "html",
+      "javascriptreact",
+      "typescript",
+      "coffeescript",
+      "java",
+      "perl",
+      "ruby"
+    ],
+    "severity": "critical",
+    "patterns": [
+      {
+        "pattern": "new AudioContext",
+        "type": "string",
+        "scopes": [ "code" ],
+        "confidence": "high"
+      }
+    ]
+  },
+  {
+    "name": "Web App Media GetUserMedia",
+    "id": "AI056000",
+    "description": "Web App Media GetUserMedia",
+    "tags":[ "WebApp.Media.GetUserMedia" ],
+    "applies_to": [
+      "javascript",
+      "python",
+      "vb",
+      "html",
+      "javascriptreact",
+      "typescript",
+      "coffeescript",
+      "java",
+      "perl",
+      "ruby"
+    ],
+    "severity": "critical",
+    "patterns": [
+      {
+        "pattern": "getUserMedia|webkitGetUserMedia|mozGetUserMedia|msGetUserMedia",
+        "type": "regexword",
+        "scopes": [ "code" ],
+        "confidence": "high"
+      }
+    ]
+  }
+]