@dxworks/insider 2.9.1

package/config/rules/cryptography/random.json

@@ -0,0 +1,97 @@
+[
+  {
+    "name": "Cryptography: PRNG",
+    "id": "AI010000",
+    "description": "Cryptography: PRNG",
+    "tags":[ "Cryptography.Randomness.PRNG" ],
+    "applies_to": [
+      "c",
+      "cpp"
+    ],
+    "severity": "critical",
+    "patterns": [
+      {
+        "pattern": "DUAL_EC_DRBG",
+        "type": "string",
+        "scopes": [ "code" ],
+        "confidence": "high"
+      },
+      {
+        "pattern": "pseudoRandomBytes",
+        "type": "string",
+        "scopes": [ "code" ],
+        "confidence": "high"
+      },
+      {
+        "pattern": "rand|srand",
+        "type": "regexword",
+        "scopes": [ "code" ],
+        "confidence": "low"
+      }
+    ]
+  },
+  {
+    "name": "Cryptography: PRNG",
+    "id": "AI010100",
+    "description": "Cryptography: PRNG",
+    "tags":[ "Cryptography.Randomness.PRNG" ],
+    "applies_to":[ "javascript","typescript" ],
+    "severity": "critical",
+    "patterns": [
+      {
+        "pattern": "(pseudo)?randombytes",
+        "type": "string",
+        "scopes": [ "code" ],
+        "modifiers": [ "i" ],
+        "confidence": "high"
+      }
+    ]
+  },
+  {
+    "name": "Cryptography: PRNG",
+    "id": "AI010200",
+    "description": "Cryptography: PRNG",
+    "tags":[ "Cryptography.Randomness.PRNG" ],
+    "applies_to":[ "java" ],
+    "severity": "critical",
+    "patterns": [
+      {
+        "pattern": "SecureRandom",
+        "type": "string",
+        "scopes": [ "code" ],
+        "confidence": "high"
+      }
+    ]
+  },
+  {
+    "name": "Cryptography: PRNG",
+    "id": "AI010300",
+    "description": "Cryptography: PRNG",
+    "tags":[ "Cryptography.Randomness.PRNG" ],
+    "applies_to":[ "csharp" ],
+    "severity": "critical",
+    "patterns": [
+      {
+        "pattern": "RandomNumberGenerator",
+        "type": "string",
+        "scopes": [ "code" ],
+        "confidence": "high"
+      }
+    ]
+  },
+  {
+    "name": "Cryptography: PRNG",
+    "id": "AI010400",
+    "description": "Cryptography: PRNG",
+    "tags":[ "Cryptography.Randomness.PRNG" ],
+    "severity": "critical",
+    "patterns": [
+      {
+        "pattern": "random",
+        "type": "string",
+        "scopes": [ "code" ],
+        "confidence": "low"
+      }
+    ]
+  }
+]

package/config/rules/cryptography/weakssl.json

@@ -0,0 +1,206 @@
+[
+  {
+    "name": "Detect Weak Cryptography",
+    "id": "AI010500",
+    "description": "Detect use of cryptography",
+    "recommendation": "",
+    "applies_to": [
+      "c",
+      "cpp",
+      "csharp"
+    ],
+    "tags":[ "Cryptography.Protocol.TLS.WeakSSL" ],
+    "severity": "critical",
+    "rule_info": "",
+    "patterns": [
+      {
+        "pattern": "^iv.*=| +iv.*=",
+        "type": "regex",
+        "scopes": [ "code" ],
+        "confidence": "high"
+      },
+      {
+        "pattern": "SECURITY_FLAG_IGNORE_",
+        "type": "regex",
+        "scopes": [ "code" ],
+        "confidence": "high",
+        "_comment": "handles multiple ignore flag options for WinHttp"
+      },
+      {
+        "pattern": "SP_PROT_PCT1_",
+        "type": "regex",
+        "scopes": [ "code" ],
+        "confidence": "high"
+      },
+      {
+        "pattern": "kSSLProtocol",
+        "type": "regex",
+        "scopes": [ "code" ],
+        "confidence": "high"
+      },
+      {
+        "pattern": "CryptUnprotectData",
+        "type": "regex",
+        "scopes": [ "code" ],
+        "confidence": "high"
+      },
+      {
+        "pattern": "mwc1616",
+        "type": "regex",
+        "scopes": [ "code" ],
+        "confidence": "high"
+      },
+      {
+        "pattern": "32969|18273",
+        "type": "regex",
+        "scopes": [ "code" ],
+        "confidence": "high"
+      },
+      {
+        "pattern": "StoreName.Root",
+        "type": "substring",
+        "scopes": [ "code" ],
+        "confidence": "high"
+      },
+      {
+        "pattern": "OAUTHLIB_INSECURE_TRANSPORT",
+        "type": "regex",
+        "scopes": [ "code" ],
+        "confidence": "high"
+      },
+      {
+        "pattern": ".trustAllCerts()",
+        "type": "substring",
+        "scopes": [ "code" ],
+        "confidence": "high"
+      },
+      {
+        "pattern": ".trustAllHosts()",
+        "type": "substring",
+        "scopes": [ "code" ],
+        "confidence": "high"
+      },
+      {
+        "pattern": "NXOAuth2TrustModeAnyCertificate",
+        "type": "regex",
+        "scopes": [ "code" ],
+        "confidence": "high"
+      },
+      {
+        "pattern": "--no-check-certificate",
+        "type": "substring",
+        "scopes": [ "code" ],
+        "confidence": "high"
+      },
+      {
+        "pattern": "--insecure",
+        "type": "substring",
+        "scopes": [ "code" ],
+        "confidence": "high"
+      },
+      {
+        "pattern": "encrypt=false",
+        "type": "regex",
+        "scopes": [ "code" ],
+        "confidence": "high"
+      },
+      {
+        "pattern": "encryption=false",
+        "type": "regex",
+        "scopes": [ "code" ],
+        "confidence": "high"
+      },
+      {
+        "pattern": "OpenSSL::SSL::VERIFY_NONE",
+        "type": "regex",
+        "scopes": [ "code" ],
+        "confidence": "high"
+      },
+      {
+        "pattern": "RelaxSSLCertificateValidation",
+        "type": "regex",
+        "scopes": [ "code" ],
+        "confidence": "high"
+      },
+      {
+        "pattern": "setAllowsAnyHTTPSCertificate",
+        "type": "regex",
+        "scopes": [ "code" ],
+        "confidence": "high"
+      },
+      {
+        "pattern": "continueWithoutCredentialForAuthenticationChallenge",
+        "type": "regex",
+        "scopes": [ "code" ],
+        "confidence": "high"
+      },
+      {
+        "pattern": "disable_ssl_certificate_validation",
+        "type": "regex",
+        "scopes": [ "code" ],
+        "confidence": "high"
+      },
+      {
+        "pattern": "CERT_NONE",
+        "type": "regex",
+        "scopes": [ "code" ],
+        "confidence": "high"
+      },
+      {
+        "pattern": ".ServerCertificateValidationCallback",
+        "type": "substring",
+        "scopes": [ "code" ],
+        "confidence": "high"
+      },
+      {
+        "pattern": "IgnorableServerCertificateErrors",
+        "type": "regex",
+        "scopes": [ "code" ],
+        "confidence": "high"
+      },
+      {
+        "pattern": "certificateValidationMode",
+        "type": "regex",
+        "scopes": [ "code" ],
+        "confidence": "high"
+      },
+      {
+        "pattern": "CERT_CHAIN_POLICY_IGNORE_",
+        "type": "regex",
+        "scopes": [ "code" ],
+        "confidence": "high"
+      },
+      {
+        "pattern": "WINHTTP_ENABLE_SSL_REVOCATION",
+        "type": "regex",
+        "scopes": [ "code" ],
+        "confidence": "high"
+      },
+      {
+        "pattern": "CERT_CHAIN_REVOCATION_ACCUMULATIVE_TIMEOUT",
+        "type": "regex",
+        "scopes": [ "code" ],
+        "confidence": "high"
+      },
+      {
+        "pattern": "ISC_REQ_MANUAL_CRED_VALIDATION",
+        "type": "regex",
+        "scopes": [ "code" ],
+        "confidence": "high"
+      },
+      {
+        "pattern": "SECPKG_ATTR_REMOTE_CERT_CONTEXT",
+        "type": "regex",
+        "scopes": [ "code" ],
+        "confidence": "high"
+      },
+      {
+        "pattern": "disable_ssl_certificate_validation",
+        "type": "regex",
+        "scopes": [ "code" ],
+        "confidence": "high",
+        "modifiers": [ "i" ]
+      }
+    ]
+  }
+]

package/config/rules/data_handling/compressed_files.json

@@ -0,0 +1,18 @@
+[
+  {
+    "name": "Data: Compressed File (Zip,Tgz)",
+    "id": "AI010600",
+    "description": "Data: Compressed File Handling",
+    "tags":[ "Data.Zipfile" ],
+    "severity": "moderate",
+    "patterns": [
+      {
+        "pattern": "\\.(zip|gz|gzip|gem|tar|tgz|tar\\.gz|xz|7z)",
+        "type": "regexword",
+        "scopes": [ "code" ],
+        "modifiers": [ "i" ],
+        "confidence": "high"
+      }
+    ]
+  }
+]

package/config/rules/data_handling/database.json

@@ -0,0 +1,361 @@
+[
+  {
+    "name": "Data: ORM (SQL Alchemy)",
+    "id": "AI010700",
+    "description": "Data: ORM (SQL Alchemy)",
+    "applies_to": [ "python" ],
+    "tags":[ "Data.DBMS.ORM.SQLAlchemy" ],
+    "severity": "moderate",
+    "patterns": [
+      {
+        "pattern": "sqlalchemy",
+        "type": "string",
+        "scopes": [ "code", "comment" ],
+        "modifiers": [ "i" ],
+        "confidence": "high"
+      }
+    ]
+  },
+  {
+    "name": "Data: ORM (Django)",
+    "id": "AI010800",
+    "description": "Data: ORM (Django)",
+    "applies_to": [ "python" ],
+    "tags":[ "Data.DBMS.ORM.Django" ],
+    "severity": "moderate",
+    "patterns": [
+      {
+        "pattern": "django",
+        "type": "string",
+        "scopes": [ "code", "comment" ],
+        "modifiers": [ "i" ]
+      }
+    ]
+  },
+  {
+    "name": "Data: DBMS (SQLite)",
+    "id": "AI010900",
+    "description": "Data: DBMS (SQLite)",
+    "applies_to": [ "python" ],
+    "tags":[ "Data.DBMS.SQLite" ],
+    "severity": "moderate",
+    "patterns": [
+      {
+        "pattern": "sqlite|python3-apsw",
+        "type": "regex",
+        "scopes": [ "code" ],
+        "confidence": "high",
+        "modifiers": [ "i" ]
+      },
+      {
+        "pattern": "apsw",
+        "type": "string",
+        "scopes": [ "code" ],
+        "confidence": "medium",
+        "modifiers": [ "i" ]
+      }
+    ]
+  },
+  {
+    "name": "Data: DBMS (SQLite)",
+    "id": "AI010910",
+    "description": "Data: DBMS (SQLite)",
+    "applies_to": [ "csharp" ],
+    "tags":[ "Data.DBMS.SQLite" ],
+    "severity": "moderate",
+    "patterns": [
+      {
+        "pattern": "SqliteCommand|SqliteConnection|System\\.Data\\.SQLite|Microsoft\\.Data\\.SQLite",
+        "type": "regex",
+        "scopes": [ "code" ],
+        "confidence": "high"
+      }
+    ]
+  },
+  {
+    "name": "Data: DBMS (SQLite)",
+    "id": "AI010920",
+    "description": "Data: DBMS (SQLite)",
+    "applies_to": [
+      "java",
+      "objective-c",
+      "php",
+      "c",
+      "cpp"
+    ],
+    "tags":[ "Data.DBMS.SQLite" ],
+    "severity": "moderate",
+    "patterns": [
+      {
+        "pattern": "sqlite",
+        "type": "regex",
+        "scopes": [ "code" ],
+        "confidence": "high",
+        "modifiers": [ "i" ]
+      }
+    ]
+  },
+  {
+    "name": "Data: DBMS (PostgreSQL)",
+    "id": "AI011000",
+    "description": "Data: DBMS (PostgreSQL)",
+    "applies_to": [ "javascript", "typescript" ],
+    "tags":[ "Data.DBMS.PostgreSQL" ],
+    "severity": "moderate",
+    "patterns": [
+      {
+        "pattern": "(pgsql|PG)\\.connect|PG::Connection",
+        "type": "regex",
+        "scopes": [ "code" ],
+        "modifiers": [ "i" ],
+        "confidence": "high"
+      },
+      {
+        "pattern": "require(['\"]pg['\"]);",
+        "type": "regexword",
+        "scopes": [ "code" ],
+        "confidence": "high"
+      }
+    ]
+  },
+  {
+    "name": "Data: DBMS (PostgreSQL)",
+    "id": "AI011010",
+    "description": "Data: DBMS (PostgreSQL)",
+    "applies_to": [ "ruby" ],
+    "tags":[ "Data.DBMS.PostgreSQL" ],
+    "severity": "moderate",
+    "patterns": [
+      {
+        "pattern": "require 'pg'|(pgsql|PG)\\.connect|PG::Connection",
+        "type": "regex",
+        "scopes": [ "code" ],
+        "modifiers": [ "i" ],
+        "confidence": "high"
+      }
+    ]
+  },
+  {
+    "name": "Data: DBMS (PostgreSQL)",
+    "id": "AI011100",
+    "description": "Data: DBMS (PostgreSQL)",
+    "applies_to": [ "python" ],
+    "tags":[ "Data.DBMS.PostgreSQL" ],
+    "severity": "moderate",
+    "patterns": [
+      {
+        "pattern": "psycopg2",
+        "type": "string",
+        "scopes": [ "code" ],
+        "modifiers": [ "i" ],
+        "confidence": "high"
+      }
+    ]
+  },
+  {
+    "name": "Data: DBMS (PostgreSQL)",
+    "id": "AI011200",
+    "description": "Data: DBMS (PostgreSQL)",
+    "applies_to": [ "csharp" ],
+    "tags":[ "Data.DBMS.PostgreSQL" ],
+    "severity": "moderate",
+    "patterns": [
+      {
+        "pattern": "npgsql",
+        "type": "string",
+        "scopes": [ "code" ],
+        "modifiers": [ "i" ],
+        "confidence": "high"
+      }
+    ]
+  },
+  {
+    "name": "Data: DBMS (NoSQL)",
+    "id": "AI011300",
+    "description": "Data: DBMS (NoSQL)",
+    "tags":[ "Data.DBMS.NoSQL" ],
+    "severity": "moderate",
+    "patterns": [
+      {
+        "pattern": "mongodb|mongoose|mongoclient|pymongo|redis|hbase|neo4j|cassandra|couchbase|memcached|couchdb|litedb|LiteDatabase|tinydb",
+        "type": "regexword",
+        "scopes": [ "code" ],
+        "modifiers": [ "i" ],
+        "confidence": "high"
+      }
+    ]
+  },
+  {
+    "name": "Data: DBMS (SQL)",
+    "id": "AI011400",
+    "description": "Data: DBMS SQL",
+    "applies_to": [ "java" ],
+    "tags":[ "Data.DBMS.SQL" ],
+    "severity": "moderate",
+    "patterns": [
+      {
+        "pattern": "import java.sql",
+        "type": "string",
+        "scopes": [ "code" ],
+        "confidence": "high"
+      }
+    ]
+  },
+  {
+    "name": "Data: DBMS (SQL)",
+    "id": "AI011500",
+    "description": "Data: DBMS (SQL)",
+    "applies_to": [ "csharp" ],
+    "tags":[ "Data.DBMS.SQL" ],
+    "severity": "moderate",
+    "patterns": [
+      {
+        "pattern": "using system.data.sqlclient",
+        "type": "string",
+        "scopes": [ "code" ],
+        "confidence": "high"
+      }
+    ]
+  },
+  {
+    "name": "Data: DBMS (SQL)",
+    "id": "AI011600",
+    "description": "Data: DBMS (SQL)",
+    "applies_to": [],
+    "tags":[ "Data.DBMS.SQL" ],
+    "severity": "moderate",
+    "patterns": [
+      {
+        "pattern": "['\\\"](select|insert|delete|update)\\s.*",
+        "type": "regex",
+        "scopes": [ "code" ],
+        "modifiers": [ "i" ],
+        "confidence": "high"
+      }
+    ],
+    "conditions": [
+      {
+        "pattern": {
+          "pattern": "from|where",
+          "type": "regexword",
+          "scopes": [ "code" ],
+          "modifiers": [ "i" ]
+        },
+        "search_in": "finding-region(-5,5)",
+        "negate_finding": false
+      }
+    ]
+  },
+  {
+    "name": "Data: DBMS (SQL)",
+    "id": "AI011610",
+    "description": "Data: DBMS (SQL)",
+    "applies_to": [],
+    "tags":[ "Data.DBMS.SQL" ],
+    "severity": "moderate",
+    "patterns": [
+      {
+        "pattern": "mysql",
+        "type": "string",
+        "scopes": [ "code" ],
+        "modifiers": [ "i" ],
+        "confidence": "high"
+      }
+    ]
+  },
+  {
+    "name": "Data: DBMS (Oracle)",
+    "id": "AI011700",
+    "description": "Data: DBMS (Oracle)",
+    "applies_to": [ "java", "pom.xml" ],
+    "tags":[ "Data.DBMS.SQL.Oracle" ],
+    "severity": "moderate",
+    "patterns": [
+      {
+        "pattern": "oracle\\.jdbc|oracledriver|com.oracle",
+        "type": "regex",
+        "scopes": [ "code" ],
+        "confidence": "high"
+      },
+      {
+        "pattern": "oracle",
+        "type": "string",
+        "scopes": [ "code" ],
+        "modifiers": [ "i" ],
+        "confidence": "medium"
+      }
+    ]
+  },
+  {
+    "name": "Data: DBMS (Oracle)",
+    "id": "AI011800",
+    "description": "Data: DBMS (Oracle)",
+    "applies_to": [ "python" ],
+    "tags":[ "Data.DBMS.SQL.Oracle" ],
+    "severity": "moderate",
+    "patterns": [
+      {
+        "pattern": "import cx_Oracle",
+        "type": "regex",
+        "scopes": [ "code" ],
+        "modifiers": [ "i" ],
+        "confidence": "high"
+      },
+      {
+        "pattern": "oracle",
+        "type": "string",
+        "scopes": [ "code" ],
+        "modifiers": [ "i" ],
+        "confidence": "low"
+      }
+    ]
+  },
+  {
+    "name": "Data: DBMS (General)",
+    "id": "AI011900",
+    "description": "Data: DBMS (General)",
+    "applies_to": [ "csharp", "cpp", "java", "python", "objective-c", "go" ],
+    "tags":[ "Data.DBMS.General" ],
+    "severity": "moderate",
+    "patterns": [
+      {
+        "pattern": "database",
+        "type": "string",
+        "scopes": [ "code", "comment" ],
+        "confidence": "high"
+      }
+    ]
+  },
+  {
+    "name": "Data: ODBC",
+    "id": "AI012000",
+    "description": "Data: ODBC",
+    "applies_to": [ "csharp" ],
+    "tags":[ "Data.DBMS.Connection.ODBC" ],
+    "severity": "moderate",
+    "patterns": [
+      {
+        "pattern": "OdbcConnection|OdbcCommand|OdbcDataReader",
+        "type": "regexword",
+        "scopes": [ "code" ],
+        "confidence": "high"
+      }
+    ]
+  },
+  {
+    "name": "Data: ODBC",
+    "id": "AI012010",
+    "description": "Data: ODBC",
+    "applies_to": [ "csharp", "cpp", "java", "python", "objective-c", "go" ],
+    "tags":[ "Data.DBMS.Connection.ODBC" ],
+    "severity": "moderate",
+    "patterns": [
+      {
+        "pattern": "Odbc",
+        "type": "string",
+        "scopes": [ "code" ],
+        "confidence": "high"
+      }
+    ]
+  }
+]