npm - @havoc-security/scanner - Versions diffs - 0.1.0 - Mend

@havoc-security/scanner 0.1.0

This diff represents the content of publicly available package versions that have been released to one of the supported registries. The information contained in this diff is provided for informational purposes only and reflects changes between package versions as they appear in their respective public registries.

Files changed (140) hide show

package/.turbo/turbo-build.log +4 -0
package/.turbo/turbo-test.log +22 -0
package/dist/analyzers/AuthorizationCoverageAnalyzer.d.ts +7 -0
package/dist/analyzers/AuthorizationCoverageAnalyzer.d.ts.map +1 -0
package/dist/analyzers/AuthorizationCoverageAnalyzer.js +100 -0
package/dist/analyzers/AuthorizationCoverageAnalyzer.js.map +1 -0
package/dist/analyzers/CredentialExposureAnalyzer.d.ts +11 -0
package/dist/analyzers/CredentialExposureAnalyzer.d.ts.map +1 -0
package/dist/analyzers/CredentialExposureAnalyzer.js +262 -0
package/dist/analyzers/CredentialExposureAnalyzer.js.map +1 -0
package/dist/analyzers/DependencyAuditAnalyzer.d.ts +28 -0
package/dist/analyzers/DependencyAuditAnalyzer.d.ts.map +1 -0
package/dist/analyzers/DependencyAuditAnalyzer.js +107 -0
package/dist/analyzers/DependencyAuditAnalyzer.js.map +1 -0
package/dist/analyzers/EncryptionAnalyzer.d.ts +7 -0
package/dist/analyzers/EncryptionAnalyzer.d.ts.map +1 -0
package/dist/analyzers/EncryptionAnalyzer.js +170 -0
package/dist/analyzers/EncryptionAnalyzer.js.map +1 -0
package/dist/analyzers/FileUploadAnalyzer.d.ts +8 -0
package/dist/analyzers/FileUploadAnalyzer.d.ts.map +1 -0
package/dist/analyzers/FileUploadAnalyzer.js +193 -0
package/dist/analyzers/FileUploadAnalyzer.js.map +1 -0
package/dist/analyzers/IdorAnalyzer.d.ts +7 -0
package/dist/analyzers/IdorAnalyzer.d.ts.map +1 -0
package/dist/analyzers/IdorAnalyzer.js +91 -0
package/dist/analyzers/IdorAnalyzer.js.map +1 -0
package/dist/analyzers/MassAssignmentAnalyzer.d.ts +7 -0
package/dist/analyzers/MassAssignmentAnalyzer.d.ts.map +1 -0
package/dist/analyzers/MassAssignmentAnalyzer.js +90 -0
package/dist/analyzers/MassAssignmentAnalyzer.js.map +1 -0
package/dist/analyzers/PrivilegeEscalationAnalyzer.d.ts +7 -0
package/dist/analyzers/PrivilegeEscalationAnalyzer.d.ts.map +1 -0
package/dist/analyzers/PrivilegeEscalationAnalyzer.js +217 -0
package/dist/analyzers/PrivilegeEscalationAnalyzer.js.map +1 -0
package/dist/analyzers/RateLimitAnalyzer.d.ts +7 -0
package/dist/analyzers/RateLimitAnalyzer.d.ts.map +1 -0
package/dist/analyzers/RateLimitAnalyzer.js +151 -0
package/dist/analyzers/RateLimitAnalyzer.js.map +1 -0
package/dist/analyzers/SessionSecurityAnalyzer.d.ts +10 -0
package/dist/analyzers/SessionSecurityAnalyzer.d.ts.map +1 -0
package/dist/analyzers/SessionSecurityAnalyzer.js +295 -0
package/dist/analyzers/SessionSecurityAnalyzer.js.map +1 -0
package/dist/analyzers/SqlInjectionAnalyzer.d.ts +7 -0
package/dist/analyzers/SqlInjectionAnalyzer.d.ts.map +1 -0
package/dist/analyzers/SqlInjectionAnalyzer.js +77 -0
package/dist/analyzers/SqlInjectionAnalyzer.js.map +1 -0
package/dist/analyzers/XssSurfaceAnalyzer.d.ts +7 -0
package/dist/analyzers/XssSurfaceAnalyzer.d.ts.map +1 -0
package/dist/analyzers/XssSurfaceAnalyzer.js +100 -0
package/dist/analyzers/XssSurfaceAnalyzer.js.map +1 -0
package/dist/analyzers/index.d.ts +13 -0
package/dist/analyzers/index.d.ts.map +1 -0
package/dist/analyzers/index.js +13 -0
package/dist/analyzers/index.js.map +1 -0
package/dist/index.d.ts +17 -0
package/dist/index.d.ts.map +1 -0
package/dist/index.js +139 -0
package/dist/index.js.map +1 -0
package/dist/parsers/PhpParser.d.ts +56 -0
package/dist/parsers/PhpParser.d.ts.map +1 -0
package/dist/parsers/PhpParser.js +193 -0
package/dist/parsers/PhpParser.js.map +1 -0
package/dist/parsers/RouteParser.d.ts +87 -0
package/dist/parsers/RouteParser.d.ts.map +1 -0
package/dist/parsers/RouteParser.js +327 -0
package/dist/parsers/RouteParser.js.map +1 -0
package/dist/rules/index.d.ts +14 -0
package/dist/rules/index.d.ts.map +1 -0
package/dist/rules/index.js +9 -0
package/dist/rules/index.js.map +1 -0
package/dist/types/index.d.ts +137 -0
package/dist/types/index.d.ts.map +1 -0
package/dist/types/index.js +13 -0
package/dist/types/index.js.map +1 -0
package/package.json +30 -0
package/package.json.bak +27 -0
package/src/analyzers/AuthorizationCoverageAnalyzer.ts +213 -0
package/src/analyzers/CredentialExposureAnalyzer.ts +312 -0
package/src/analyzers/DependencyAuditAnalyzer.ts +135 -0
package/src/analyzers/EncryptionAnalyzer.ts +195 -0
package/src/analyzers/FileUploadAnalyzer.ts +239 -0
package/src/analyzers/IdorAnalyzer.ts +118 -0
package/src/analyzers/InsecureDeserializationAnalyzer.ts +212 -0
package/src/analyzers/MassAssignmentAnalyzer.ts +105 -0
package/src/analyzers/OpenRedirectAnalyzer.ts +149 -0
package/src/analyzers/PrivilegeEscalationAnalyzer.ts +258 -0
package/src/analyzers/RateLimitAnalyzer.ts +195 -0
package/src/analyzers/SecurityHeaderAnalyzer.ts +263 -0
package/src/analyzers/SessionSecurityAnalyzer.ts +342 -0
package/src/analyzers/SqlInjectionAnalyzer.ts +99 -0
package/src/analyzers/XssSurfaceAnalyzer.ts +112 -0
package/src/analyzers/exclusions.ts +87 -0
package/src/analyzers/index.ts +15 -0
package/src/index.ts +226 -0
package/src/parsers/PhpParser.ts +259 -0
package/src/parsers/RouteParser.ts +384 -0
package/src/rules/index.ts +16 -0
package/src/types/index.ts +164 -0
package/tests/EncryptionAnalyzer.test.ts +137 -0
package/tests/PrivilegeEscalationAnalyzer.test.ts +141 -0
package/tests/RateLimitAnalyzer.test.ts +112 -0
package/tests/analyzers.test.ts +678 -0
package/tests/auth-coverage-route-aware.test.ts +294 -0
package/tests/credential-exposure.test.ts +142 -0
package/tests/file-upload.test.ts +141 -0
package/tests/fixtures/app/Http/Controllers/AdminController.php +19 -0
package/tests/fixtures/app/Http/Controllers/PostController.php +49 -0
package/tests/fixtures/app/Http/Controllers/PublicController.php +17 -0
package/tests/fixtures/app/Models/Comment.php +11 -0
package/tests/fixtures/app/Models/OpenModel.php +11 -0
package/tests/fixtures/app/Models/Post.php +14 -0
package/tests/fixtures/app/Models/SafeModel.php +10 -0
package/tests/fixtures/app/Models/User.php +15 -0
package/tests/fixtures/blade/mail.blade.php +8 -0
package/tests/fixtures/blade/safe.blade.php +12 -0
package/tests/fixtures/blade/vulnerable.blade.php +12 -0
package/tests/fixtures/controllers/AdminController.php +19 -0
package/tests/fixtures/controllers/PostController.php +49 -0
package/tests/fixtures/controllers/PublicController.php +17 -0
package/tests/fixtures/deserialization/safe.php +32 -0
package/tests/fixtures/deserialization/unsafe.php +60 -0
package/tests/fixtures/models/Comment.php +11 -0
package/tests/fixtures/models/OpenModel.php +11 -0
package/tests/fixtures/models/Post.php +14 -0
package/tests/fixtures/models/SafeModel.php +10 -0
package/tests/fixtures/models/User.php +15 -0
package/tests/fixtures/redirect/safe.php +38 -0
package/tests/fixtures/redirect/unsafe.php +39 -0
package/tests/fixtures/routes/api.php +9 -0
package/tests/fixtures/routes/web.php +18 -0
package/tests/fixtures/security-headers/app/Http/Middleware/SecurityHeaders.php +24 -0
package/tests/fixtures/security-headers/app/Providers/AppServiceProvider.php +16 -0
package/tests/fixtures/sql/safe_queries.php +7 -0
package/tests/fixtures/sql/vulnerable_queries.php +7 -0
package/tests/new-analyzers.test.ts +373 -0
package/tests/route-parser.test.ts +257 -0
package/tests/scanner.test.ts +82 -0
package/tests/session-security.test.ts +161 -0
package/tests/types.test.ts +29 -0
package/tsconfig.json +9 -0

package/tests/fixtures/app/Models/OpenModel.php ADDED Viewed

@@ -0,0 +1,11 @@
+<?php
+namespace App\Models;
+use Illuminate\Database\Eloquent\Model;
+// $guarded = [] — effectively unguarded — should be flagged HIGH
+class OpenModel extends Model
+{
+    protected $guarded = [];
+}

package/tests/fixtures/app/Models/Post.php ADDED Viewed

@@ -0,0 +1,14 @@
+<?php
+namespace App\Models;
+use Illuminate\Database\Eloquent\Model;
+class Post extends Model
+{
+    protected $fillable = [
+        'title',
+        'body',
+        'slug',
+    ];
+}

package/tests/fixtures/app/Models/SafeModel.php ADDED Viewed

@@ -0,0 +1,10 @@
+<?php
+namespace App\Models;
+use Illuminate\Database\Eloquent\Model;
+class SafeModel extends Model
+{
+    protected $fillable = ['name', 'description'];
+}

package/tests/fixtures/app/Models/User.php ADDED Viewed

@@ -0,0 +1,15 @@
+<?php
+namespace App\Models;
+use Illuminate\Database\Eloquent\Model;
+class User extends Model
+{
+    protected $fillable = [
+        'name',
+        'email',
+        'password',
+        'role',
+    ];
+}

package/tests/fixtures/blade/mail.blade.php ADDED Viewed

@@ -0,0 +1,8 @@
+<!DOCTYPE html>
+<html>
+<body>
+    <!-- Mail template — trusted context -->
+    <div>{!! $mailContent !!}</div>
+    <div>{!! $htmlBody !!}</div>
+</body>
+</html>

package/tests/fixtures/blade/safe.blade.php ADDED Viewed

@@ -0,0 +1,12 @@
+<!DOCTYPE html>
+<html>
+<head><title>{{ $title }}</title></head>
+<body>
+    <p>{{ $user->name }}</p>
+    <p>{{ $content }}</p>
+    <!-- Safe: using e() -->
+    <div>{!! e($userContent) !!}</div>
+    <!-- Safe: config value -->
+    <div>{!! config('app.footer_html') !!}</div>
+</body>
+</html>

package/tests/fixtures/blade/vulnerable.blade.php ADDED Viewed

@@ -0,0 +1,12 @@
+<!DOCTYPE html>
+<html>
+<body>
+    <!-- Dangerous: user-controlled content without escaping -->
+    <div>{!! $comment->body !!}</div>
+    <div>{!! $message !!}</div>
+    <!-- Unknown context -->
+    <div>{!! $someVariable !!}</div>
+    <!-- Safe usage -->
+    <div>{{ $safeVariable }}</div>
+</body>
+</html>

package/tests/fixtures/controllers/AdminController.php ADDED Viewed

@@ -0,0 +1,19 @@
+<?php
+namespace App\Http\Controllers;
+class AdminController extends Controller
+{
+    public function dashboard()
+    {
+        Gate::authorize('admin');
+        return view('admin.dashboard');
+    }
+    public function settings()
+    {
+        // Fully covered with Gate
+        Gate::allows('manage-settings');
+        return view('admin.settings');
+    }
+}

package/tests/fixtures/controllers/PostController.php ADDED Viewed

@@ -0,0 +1,49 @@
+<?php
+namespace App\Http\Controllers;
+use App\Models\Post;
+use Illuminate\Http\Request;
+class PostController extends Controller
+{
+    public function __construct()
+    {
+        // constructors are excluded
+    }
+    public function index()
+    {
+        $this->authorize('viewAny', Post::class);
+        return Post::all();
+    }
+    public function show(Post $post)
+    {
+        Gate::allows('view', $post);
+        return $post;
+    }
+    public function store(Request $request)
+    {
+        // Missing authorization — should be flagged
+        return Post::create($request->all());
+    }
+    public function update(Request $request, Post $post)
+    {
+        // Missing authorization — should be flagged
+        $post->update($request->all());
+    }
+    public function destroy(Post $post)
+    {
+        $this->authorize('delete', $post);
+        $post->delete();
+    }
+    protected function someProtectedMethod()
+    {
+        // protected — not flagged
+    }
+}

package/tests/fixtures/controllers/PublicController.php ADDED Viewed

@@ -0,0 +1,17 @@
+<?php
+namespace App\Http\Controllers;
+class PublicController extends Controller
+{
+    public function home()
+    {
+        // Public page — no auth needed, but analyzer will flag it
+        return view('home');
+    }
+    public function about()
+    {
+        return view('about');
+    }
+}

package/tests/fixtures/deserialization/safe.php ADDED Viewed

@@ -0,0 +1,32 @@
+<?php
+namespace App\Http\Controllers;
+class SafeDeserializationController extends Controller
+{
+    // SAFE: unserialize with allowed_classes => false
+    public function loadSafe($data)
+    {
+        return unserialize($data, ['allowed_classes' => false]);
+    }
+    // SAFE: json_decode instead of unserialize
+    public function loadJson($data)
+    {
+        return json_decode($data, true);
+    }
+    // SAFE: assert with boolean expression
+    public function checkBool($value)
+    {
+        assert($value > 0);
+    }
+    // SAFE: preg_replace_callback
+    public function transform($content)
+    {
+        return preg_replace_callback('/\{(\w+)\}/', function($matches) {
+            return strtoupper($matches[1]);
+        }, $content);
+    }
+}

package/tests/fixtures/deserialization/unsafe.php ADDED Viewed

@@ -0,0 +1,60 @@
+<?php
+namespace App\Http\Controllers;
+use Illuminate\Http\Request;
+class DeserializationController extends Controller
+{
+    // CRITICAL: unserialize with user input
+    public function loadSession(Request $request)
+    {
+        $data = unserialize($request->input('session_data'));
+        return response()->json($data);
+    }
+    // CRITICAL: unserialize with $_GET
+    public function legacyLoad()
+    {
+        $obj = unserialize($_GET['data']);
+        return $obj;
+    }
+    // MEDIUM: unserialize without allowed_classes
+    public function loadFromCache($cacheValue)
+    {
+        $data = unserialize($cacheValue);
+        return $data;
+    }
+    // HIGH: eval usage
+    public function executeTemplate($template)
+    {
+        eval($template);
+    }
+    // HIGH: create_function
+    public function legacyCallback()
+    {
+        $fn = create_function('$x', 'return $x * 2;');
+        return $fn(5);
+    }
+    // HIGH: preg_replace with /e
+    public function transformContent($content)
+    {
+        return preg_replace('/\{(\w+)\}/e', 'strtoupper("$1")', $content);
+    }
+    // HIGH: assert with string
+    public function checkValue()
+    {
+        assert('strlen($str) > 0');
+    }
+    // HIGH: extract with user input
+    public function processRequest(Request $request)
+    {
+        extract($request->all());
+    }
+}

package/tests/fixtures/models/Comment.php ADDED Viewed

@@ -0,0 +1,11 @@
+<?php
+namespace App\Models;
+use Illuminate\Database\Eloquent\Model;
+// No $fillable or $guarded — should be flagged MEDIUM
+class Comment extends Model
+{
+    public $timestamps = true;
+}

package/tests/fixtures/models/OpenModel.php ADDED Viewed

@@ -0,0 +1,11 @@
+<?php
+namespace App\Models;
+use Illuminate\Database\Eloquent\Model;
+// $guarded = [] — effectively unguarded — should be flagged HIGH
+class OpenModel extends Model
+{
+    protected $guarded = [];
+}

package/tests/fixtures/models/Post.php ADDED Viewed

@@ -0,0 +1,14 @@
+<?php
+namespace App\Models;
+use Illuminate\Database\Eloquent\Model;
+class Post extends Model
+{
+    protected $fillable = [
+        'title',
+        'body',
+        'slug',
+    ];
+}

package/tests/fixtures/models/SafeModel.php ADDED Viewed

@@ -0,0 +1,10 @@
+<?php
+namespace App\Models;
+use Illuminate\Database\Eloquent\Model;
+class SafeModel extends Model
+{
+    protected $fillable = ['name', 'description'];
+}

package/tests/fixtures/models/User.php ADDED Viewed

@@ -0,0 +1,15 @@
+<?php
+namespace App\Models;
+use Illuminate\Database\Eloquent\Model;
+class User extends Model
+{
+    protected $fillable = [
+        'name',
+        'email',
+        'password',
+        'role',
+    ];
+}

package/tests/fixtures/redirect/safe.php ADDED Viewed

@@ -0,0 +1,38 @@
+<?php
+namespace App\Http\Controllers;
+use Illuminate\Http\Request;
+class SafeRedirectController extends Controller
+{
+    // SAFE: redirect()->intended()
+    public function loginSafe(Request $request)
+    {
+        return redirect()->intended('/dashboard');
+    }
+    // SAFE: back()
+    public function goBack()
+    {
+        return back();
+    }
+    // SAFE: Redirect::back()
+    public function redirectBack()
+    {
+        return \Redirect::back();
+    }
+    // SAFE: redirect to explicit path
+    public function goHome()
+    {
+        return redirect('/home');
+    }
+    // SAFE: redirect to named route
+    public function goRoute()
+    {
+        return redirect(route('dashboard'));
+    }
+}

package/tests/fixtures/redirect/unsafe.php ADDED Viewed

@@ -0,0 +1,39 @@
+<?php
+namespace App\Http\Controllers;
+use Illuminate\Http\Request;
+class RedirectController extends Controller
+{
+    // HIGH: direct user input redirect
+    public function loginRedirect(Request $request)
+    {
+        return redirect($request->input('url'));
+    }
+    // HIGH: Redirect::to with user input
+    public function oauthCallback(Request $request)
+    {
+        return \Redirect::to($request->get('redirect'));
+    }
+    // HIGH: $_GET in redirect
+    public function legacyRedirect()
+    {
+        return redirect($_GET['next']);
+    }
+    // MEDIUM: redirect via named variable
+    public function afterLogin(Request $request)
+    {
+        $url = $request->input('redirect');
+        return redirect($url);
+    }
+    // MEDIUM: Redirect::to with variable
+    public function goTo($redirect)
+    {
+        return \Redirect::to($redirect);
+    }
+}

package/tests/fixtures/routes/api.php ADDED Viewed

@@ -0,0 +1,9 @@
+<?php
+use App\Http\Controllers\PostController;
+Route::middleware('auth:sanctum')->group(function () {
+    Route::apiResource('posts', PostController::class);
+    // Nested
+    Route::get('/users/{user}/comments/{comment}', [PostController::class, 'userComment']);
+});

package/tests/fixtures/routes/web.php ADDED Viewed

@@ -0,0 +1,18 @@
+<?php
+use App\Http\Controllers\PostController;
+use App\Http\Controllers\AdminController;
+Route::middleware(['auth'])->group(function () {
+    Route::resource('posts', PostController::class);
+    Route::get('/admin/dashboard', [AdminController::class, 'dashboard']);
+});
+// Nested resource — potential IDOR
+Route::get('/users/{userId}/posts/{postId}', [PostController::class, 'showUserPost']);
+Route::resource('users.posts', PostController::class);
+// Public routes
+Route::get('/', function () {
+    return view('welcome');
+});

package/tests/fixtures/security-headers/app/Http/Middleware/SecurityHeaders.php ADDED Viewed

@@ -0,0 +1,24 @@
+<?php
+namespace App\Http\Middleware;
+use Closure;
+use Illuminate\Http\Request;
+class SecurityHeaders
+{
+    public function handle(Request $request, Closure $next)
+    {
+        $response = $next($request);
+        $response->headers->set('X-Frame-Options', 'SAMEORIGIN');
+        $response->headers->set('X-Content-Type-Options', 'nosniff');
+        $response->headers->set('Strict-Transport-Security', 'max-age=31536000; includeSubDomains');
+        $response->headers->set('X-XSS-Protection', '1; mode=block');
+        $response->headers->set('Content-Security-Policy', "default-src 'self'");
+        $response->headers->set('Referrer-Policy', 'strict-origin-when-cross-origin');
+        $response->headers->set('Permissions-Policy', 'camera=(), microphone=()');
+        return $response;
+    }
+}

package/tests/fixtures/security-headers/app/Providers/AppServiceProvider.php ADDED Viewed

@@ -0,0 +1,16 @@
+<?php
+namespace App\Providers;
+use Illuminate\Support\ServiceProvider;
+use Illuminate\Support\Facades\URL;
+class AppServiceProvider extends ServiceProvider
+{
+    public function boot(): void
+    {
+        if (app()->environment('production')) {
+            URL::forceScheme('https');
+        }
+    }
+}

package/tests/fixtures/sql/safe_queries.php ADDED Viewed

@@ -0,0 +1,7 @@
+<?php
+// Safe: using parameter bindings
+$results = DB::select('SELECT * FROM users WHERE id = ?', [$id]);
+$users = User::whereRaw('age > ?', [$minAge])->get();
+$posts = Post::orderByRaw('created_at DESC')->get();
+$stats = DB::select('SELECT count(*) FROM orders WHERE status = :status', ['status' => $status]);

package/tests/fixtures/sql/vulnerable_queries.php ADDED Viewed

@@ -0,0 +1,7 @@
+<?php
+// Dangerous: string interpolation
+$results = DB::select("SELECT * FROM users WHERE name = '$name'");
+$users = User::whereRaw("age > $minAge")->get();
+$posts = Post::whereRaw('status = ' . $status)->get();
+$raw = DB::statement("DELETE FROM logs WHERE user = " . $userId);