@gspothq/cli 0.0.0-stage → 0.1.0

package/configurations/language/javascript/semgrep/javascript.yml

@@ -0,0 +1,84 @@
+rules:
+    - id: gspot.javascript.no-dom-html-sinks
+      pattern-either:
+          - pattern: $ELEMENT.innerHTML = $VALUE
+          - pattern: $ELEMENT.outerHTML = $VALUE
+          - pattern: $ELEMENT.insertAdjacentHTML($POSITION, $VALUE)
+          - pattern: document.write($VALUE)
+      message: DOM XSS risk. Use textContent, DOM node creation, or trusted static markup.
+      languages:
+          - javascript
+          - typescript
+      severity: ERROR
+    - id: gspot.javascript.ssrf-web-request-user-input
+      patterns:
+          - pattern-either:
+                - pattern: fetch(req.$PART.$VALUE, ...)
+                - pattern: fetch($URL.searchParams.get(...), ...)
+      message: SSRF risk - web request called with a URL from user input. Validate and
+          allowlist target hosts.
+      languages:
+          - typescript
+          - javascript
+      severity: ERROR
+      metadata:
+          cwe:
+              - CWE-918
+          category: security
+    - id: gspot.javascript.no-secret-in-log
+      patterns:
+          - pattern-either:
+                - pattern: $LOGGER.$LEVEL(process.env.$VAR)
+                - pattern: $LOGGER.$LEVEL(Deno.env.get($VAR))
+          - metavariable-regex:
+                metavariable: $LEVEL
+                regex: ^(log|trace|debug|info|warn|error|fatal)$
+          - metavariable-regex:
+                metavariable: $VAR
+                regex: .*(KEY|SECRET|PASSWORD|TOKEN|CREDENTIAL).*
+      message: Sensitive environment variable logged. Remove or mask before logging.
+      languages:
+          - typescript
+          - javascript
+      severity: ERROR
+      metadata:
+          cwe:
+              - CWE-532
+          category: security
+    - id: gspot.javascript.jwt-no-algorithm-none
+      patterns:
+          - pattern: jwt.verify($TOKEN, $SECRET)
+          - pattern-not: 'jwt.verify($TOKEN, $SECRET, {algorithms: ...})'
+      message: Require the expected JWT signing algorithms when verifying a token.
+          Pass an algorithms option that matches the signing contract.
+      languages:
+          - typescript
+          - javascript
+      severity: ERROR
+      metadata:
+          cwe:
+              - CWE-327
+          category: security
+    - id: gspot.javascript.jwt-no-decode-without-verify
+      pattern: jwt.decode(...)
+      message: jwt.decode() does not verify signatures. Use jwt.verify() instead.
+      languages:
+          - typescript
+          - javascript
+      severity: ERROR
+      metadata:
+          cwe:
+              - CWE-345
+          category: security
+    - id: gspot.javascript.no-interpolated-exec
+      pattern: execSync(`...${$VAR}...`)
+      message: Template literal interpolation in execSync() is a command injection
+          vector. Use execFileSync() with an argument array instead.
+      languages:
+          - typescript
+          - javascript
+      severity: ERROR
+      metadata:
+          cwe:
+              - CWE-78
+          category: security

package/configurations/language/markdown/manifest.toml

@@ -0,0 +1,85 @@
+allowed_words = ["Markdown", "lychee"]
+[configuration]
+title = "Markdown"
+description = "Markdown files: markdownlint, Prettier, and fenced code blocks that must parse."
+
+[files]
+extensions = [".md", ".mdx"]
+
+[[tool]]
+name = "markdownlint-cli2"
+rule_url = "https://github.com/DavidAnson/markdownlint/blob/main/doc/{rule}.md"
+suppression = { marker = "\\bmarkdownlint-disable(?:-line|-next-line|-file)?\\b", reason = " -- (?<reason>\\S(?:[\\s\\S]*?\\S)?)\\s*(?:--!?>)?$" }
+version = "0.23.3"
+npm = "markdownlint-cli2"
+mise = "npm:markdownlint-cli2"
+version_command = ["--help"]
+version_exit_code = 2
+version_pattern = "markdownlint-cli2 v(\\d+\\.\\d+\\.\\d+)"
+[[tool.replace]]
+file = ".markdownlint-cli2.jsonc"
+shared = false
+
+[[tool.replace]]
+file = ".markdownlint-cli2.yaml"
+shared = false
+
+[[tool.replace]]
+file = ".markdownlint-cli2.cjs"
+shared = false
+
+[[tool.replace]]
+file = ".markdownlint-cli2.mjs"
+shared = false
+
+[[tool.replace]]
+file = ".markdownlint.json"
+shared = false
+
+[[tool.replace]]
+file = ".markdownlint.jsonc"
+shared = false
+
+[[tool.replace]]
+file = ".markdownlint.yaml"
+shared = false
+
+[[tool.replace]]
+file = ".markdownlint.yml"
+shared = false
+
+[[tool_file]]
+target = ".gspot/config/markdownlint.jsonc"
+tool = "markdownlint-cli2"
+per_scope = true
+rule_keys = [""]
+
+[[tool_file]]
+source = "markdownlint-cli2.mjs"
+target = ".gspot/config/markdownlint-cli2.mjs"
+tool = "markdownlint-cli2"
+per_scope = true
+pointer = { path = ".markdownlint-cli2.mjs", body = "export { default } from {target_module};", when = { configuration = "javascript" } }
+
+[[check]]
+name = "markdownlint"
+example = "A heading that jumps from level one to level three reports MD001. Change the later heading to level two."
+run_in_copy = true
+level = "recommended"
+stage = "commit"
+command = ["markdownlint-cli2", "--no-globs", "--config", "{tool_file:markdownlint-cli2}", "{files}"]
+fix = ["markdownlint-cli2", "--fix", "--no-globs", "--config", "{tool_file:markdownlint-cli2}", "{files}"]
+exit_codes = [1]
+output = { format = "markdownlint" }
+summary = "Checks every Markdown file against markdownlint with the shipped rule set."
+why = "Markdown that lints the same everywhere renders the same everywhere."
+help = "Run gspot check --fix for the rules that fix themselves; read the rule name for the rest."
+
+[[check]]
+name = "fences"
+example = "A code fence labeled `bash` containing `if then` reports invalid syntax. Correct the example to valid Bash. Use a text fence only when the block represents text rather than executable code."
+level = "recommended"
+stage = "commit"
+summary = "Checks JSON, JSONC, TOML, YAML, Bash, JavaScript, JSX, TypeScript, TSX, and Python code fences in Markdown (.md) files for syntax errors."
+why = "A code block that does not parse is documentation that lies about the code."
+help = "Fix the code in the block, or tag the block text when it is not code."

package/configurations/language/markdown/markdownlint-cli2.mjs

@@ -0,0 +1,19 @@
+import { fileURLToPath } from 'node:url';
+
+export default {
+    config: { extends: fileURLToPath(new URL('markdownlint.jsonc', import.meta.url)) },
+    noBanner: true,
+    noProgress: true,
+    outputFormatters: [
+        [
+            /**
+             * Write the findings as JSON.
+             * @param {object} output the formatter input.
+             * @param {unknown} output.results the findings.
+             * @param {(message: string) => void} output.logMessage the report writer.
+             * @returns {void} nothing.
+             */
+            ({ results, logMessage }) => logMessage(JSON.stringify(results)),
+        ],
+    ],
+};