@nahisaho/musubix-security 2.0.1 → 2.1.1

package/dist/rules/cwe/cwe-22-path-traversal.js

@@ -0,0 +1,306 @@
+/**
+ * @fileoverview CWE-22: Improper Limitation of a Pathname to a Restricted Directory (Path Traversal)
+ * @module @nahisaho/musubix-security/rules/cwe/cwe-22-path-traversal
+ * @trace TSK-RULE-005
+ *
+ * Detects:
+ * - Path concatenation with user input
+ * - Missing path normalization
+ * - Directory escape attempts
+ * - Symlink attacks
+ *
+ * CWE-22 is #8 in CWE Top 25 2023.
+ */
+/**
+ * CWE-22 - Path Traversal
+ */
+export const cwe22PathTraversal = {
+    id: 'cwe-22-path-traversal',
+    name: 'CWE-22: Path Traversal',
+    description: 'Detects path traversal vulnerabilities from unsafe path construction',
+    defaultSeverity: 'high',
+    category: 'file-system',
+    tags: ['cwe', 'path', 'traversal', 'lfi', 'security'],
+    cwe: ['22'],
+    references: [
+        {
+            title: 'CWE-22: Path Traversal',
+            url: 'https://cwe.mitre.org/data/definitions/22.html',
+        },
+        {
+            title: 'OWASP Path Traversal',
+            url: 'https://owasp.org/www-community/attacks/Path_Traversal',
+        },
+    ],
+    async analyze(context) {
+        const findings = [];
+        const sourceCode = context.sourceCode;
+        checkPathConcatenation(context, sourceCode, findings);
+        checkFileOperations(context, sourceCode, findings);
+        checkPathNormalization(context, sourceCode, findings);
+        return findings;
+    },
+};
+/**
+ * Check for path concatenation with user input
+ */
+function checkPathConcatenation(context, sourceCode, findings) {
+    const lines = sourceCode.split('\n');
+    const pathPatterns = [
+        {
+            pattern: /path\.join\s*\([^)]*(?:req\.|params\.|query\.|body\.)/gi,
+            type: 'path.join with user input',
+            message: 'path.join with user input allows path traversal',
+            severity: 'high',
+        },
+        {
+            pattern: /path\.resolve\s*\([^)]*(?:req\.|params\.|query\.|body\.)/gi,
+            type: 'path.resolve with user input',
+            message: 'path.resolve with user input allows path traversal',
+            severity: 'high',
+        },
+        {
+            pattern: /['"`]\/.*['"`]\s*\+\s*(?:req\.|params\.|query\.|body\.)/gi,
+            type: 'String path concatenation',
+            message: 'Path string concatenation with user input is vulnerable',
+            severity: 'critical',
+        },
+        {
+            pattern: /`[^`]*\/[^`]*\$\{(?:req\.|params\.|query\.|body\.)/gi,
+            type: 'Template path with user input',
+            message: 'Template literal path with user input is vulnerable',
+            severity: 'critical',
+        },
+        {
+            pattern: /__dirname\s*\+\s*(?:req\.|params\.|query\.|body\.)/gi,
+            type: '__dirname concatenation',
+            message: '__dirname + user input allows path traversal',
+            severity: 'high',
+        },
+        {
+            pattern: /process\.cwd\(\)\s*\+\s*(?:req\.|params\.|query\.|body\.)/gi,
+            type: 'process.cwd concatenation',
+            message: 'process.cwd() + user input allows path traversal',
+            severity: 'high',
+        },
+    ];
+    for (let lineNum = 0; lineNum < lines.length; lineNum++) {
+        const line = lines[lineNum];
+        for (const { pattern, type, message, severity } of pathPatterns) {
+            pattern.lastIndex = 0;
+            if (pattern.test(line)) {
+                findings.push({
+                    id: `cwe-22-concat-${findings.length + 1}`,
+                    ruleId: 'cwe-22-path-traversal',
+                    severity,
+                    message: `Path Traversal - ${type}: ${message}`,
+                    location: {
+                        file: context.filePath,
+                        startLine: lineNum + 1,
+                        endLine: lineNum + 1,
+                        startColumn: 0,
+                        endColumn: line.length,
+                    },
+                    cwe: ['22'],
+                    suggestion: {
+                        description: 'Validate and normalize path, check it stays within allowed directory',
+                        example: `const path = require('path');
+const allowedDir = '/safe/uploads';
+
+function getSafePath(userPath) {
+  // Normalize and resolve
+  const resolved = path.resolve(allowedDir, userPath);
+  
+  // Verify it's still within allowed directory
+  if (!resolved.startsWith(allowedDir + path.sep)) {
+    throw new Error('Path traversal detected');
+  }
+  
+  return resolved;
+}`,
+                    },
+                });
+            }
+        }
+    }
+}
+/**
+ * Check for unsafe file operations
+ */
+function checkFileOperations(context, sourceCode, findings) {
+    const lines = sourceCode.split('\n');
+    const filePatterns = [
+        {
+            pattern: /fs\.(?:readFile|readFileSync)\s*\([^)]*(?:req\.|params\.|query\.|body\.)/gi,
+            type: 'readFile with user input',
+            message: 'Reading file with user-controlled path allows LFI',
+            severity: 'critical',
+        },
+        {
+            pattern: /fs\.(?:writeFile|writeFileSync)\s*\([^)]*(?:req\.|params\.|query\.|body\.)/gi,
+            type: 'writeFile with user input',
+            message: 'Writing file with user-controlled path is dangerous',
+            severity: 'critical',
+        },
+        {
+            pattern: /fs\.(?:unlink|unlinkSync|rm|rmSync)\s*\([^)]*(?:req\.|params\.|query\.|body\.)/gi,
+            type: 'unlink with user input',
+            message: 'Deleting file with user-controlled path is very dangerous',
+            severity: 'critical',
+        },
+        {
+            pattern: /fs\.(?:createReadStream|createWriteStream)\s*\([^)]*(?:req\.|params\.|query\.|body\.)/gi,
+            type: 'createStream with user input',
+            message: 'Stream creation with user path allows traversal',
+            severity: 'high',
+        },
+        {
+            pattern: /fs\.(?:access|stat|lstat)\s*\([^)]*(?:req\.|params\.|query\.|body\.)/gi,
+            type: 'stat with user input',
+            message: 'File stat with user path leaks file existence',
+            severity: 'medium',
+        },
+        {
+            pattern: /fs\.(?:mkdir|mkdirSync)\s*\([^)]*(?:req\.|params\.|query\.|body\.)/gi,
+            type: 'mkdir with user input',
+            message: 'Creating directories with user input path',
+            severity: 'medium',
+        },
+        {
+            pattern: /require\s*\(\s*(?:req\.|params\.|query\.|body\.)/gi,
+            type: 'require with user input',
+            message: 'Dynamic require with user input allows code execution',
+            severity: 'critical',
+        },
+        {
+            pattern: /import\s*\(\s*(?:req\.|params\.|query\.|body\.)/gi,
+            type: 'dynamic import with user input',
+            message: 'Dynamic import with user input allows code execution',
+            severity: 'critical',
+        },
+    ];
+    for (let lineNum = 0; lineNum < lines.length; lineNum++) {
+        const line = lines[lineNum];
+        for (const { pattern, type, message, severity } of filePatterns) {
+            pattern.lastIndex = 0;
+            if (pattern.test(line)) {
+                findings.push({
+                    id: `cwe-22-file-${findings.length + 1}`,
+                    ruleId: 'cwe-22-path-traversal',
+                    severity,
+                    message: `Path Traversal - ${type}: ${message}`,
+                    location: {
+                        file: context.filePath,
+                        startLine: lineNum + 1,
+                        endLine: lineNum + 1,
+                        startColumn: 0,
+                        endColumn: line.length,
+                    },
+                    cwe: ['22'],
+                    suggestion: {
+                        description: 'Validate path before file operations',
+                        example: `const path = require('path');
+const fs = require('fs').promises;
+
+async function safeReadFile(baseDir, userFilename) {
+  // Remove any path components
+  const basename = path.basename(userFilename);
+  
+  // Construct safe path
+  const safePath = path.join(baseDir, basename);
+  
+  // Verify within allowed directory
+  const realPath = await fs.realpath(safePath);
+  if (!realPath.startsWith(await fs.realpath(baseDir))) {
+    throw new Error('Access denied');
+  }
+  
+  return fs.readFile(safePath);
+}`,
+                    },
+                });
+            }
+        }
+    }
+}
+/**
+ * Check for path normalization issues
+ */
+function checkPathNormalization(context, sourceCode, findings) {
+    const lines = sourceCode.split('\n');
+    const normPatterns = [
+        {
+            pattern: /\.\.\/|\.\.\\|\.\.\%2f|\.\.\%5c/gi,
+            type: 'Path traversal sequence',
+            message: 'Literal path traversal sequence detected',
+            severity: 'info',
+        },
+        {
+            pattern: /decodeURIComponent\s*\([^)]*\)[^;]*(?:fs\.|path\.)/gi,
+            type: 'URL decode before path operation',
+            message: 'URL decoding before path operation may bypass filters',
+            severity: 'medium',
+        },
+        {
+            pattern: /\.replace\s*\(\s*['"`]\.\.['"`]\s*,/gi,
+            type: 'Simple .. replacement',
+            message: 'Simple string replacement for .. can be bypassed',
+            severity: 'medium',
+        },
+        {
+            pattern: /\.includes\s*\(\s*['"`]\.\.['"`]\s*\)/gi,
+            type: 'Simple .. check',
+            message: 'Simple includes check for .. can be bypassed',
+            severity: 'medium',
+        },
+    ];
+    for (let lineNum = 0; lineNum < lines.length; lineNum++) {
+        const line = lines[lineNum];
+        for (const { pattern, type, message, severity } of normPatterns) {
+            pattern.lastIndex = 0;
+            if (pattern.test(line)) {
+                findings.push({
+                    id: `cwe-22-norm-${findings.length + 1}`,
+                    ruleId: 'cwe-22-path-traversal',
+                    severity,
+                    message: `Path Normalization - ${type}: ${message}`,
+                    location: {
+                        file: context.filePath,
+                        startLine: lineNum + 1,
+                        endLine: lineNum + 1,
+                        startColumn: 0,
+                        endColumn: line.length,
+                    },
+                    cwe: ['22'],
+                    suggestion: {
+                        description: 'Use path.normalize and realpath for proper validation',
+                        example: `const path = require('path');
+const fs = require('fs').promises;
+
+async function validatePath(baseDir, userPath) {
+  // Normalize path
+  const normalized = path.normalize(userPath);
+  const fullPath = path.join(baseDir, normalized);
+  
+  // Resolve symlinks and get real path
+  try {
+    const realPath = await fs.realpath(fullPath);
+    const realBase = await fs.realpath(baseDir);
+    
+    // Ensure resolved path is within base
+    if (!realPath.startsWith(realBase + path.sep)) {
+      throw new Error('Path traversal attempt');
+    }
+    return realPath;
+  } catch (err) {
+    throw new Error('Invalid path');
+  }
+}`,
+                    },
+                });
+            }
+        }
+    }
+}
+export default cwe22PathTraversal;
+//# sourceMappingURL=cwe-22-path-traversal.js.map

package/dist/rules/cwe/cwe-22-path-traversal.js.map

@@ -0,0 +1 @@
+{"version":3,"file":"cwe-22-path-traversal.js","sourceRoot":"","sources":["../../../src/rules/cwe/cwe-22-path-traversal.ts"],"names":[],"mappings":"AAAA;;;;;;;;;;;;GAYG;AAIH;;GAEG;AACH,MAAM,CAAC,MAAM,kBAAkB,GAAiB;IAC9C,EAAE,EAAE,uBAAuB;IAC3B,IAAI,EAAE,wBAAwB;IAC9B,WAAW,EACT,sEAAsE;IACxE,eAAe,EAAE,MAAM;IACvB,QAAQ,EAAE,aAAa;IACvB,IAAI,EAAE,CAAC,KAAK,EAAE,MAAM,EAAE,WAAW,EAAE,KAAK,EAAE,UAAU,CAAC;IACrD,GAAG,EAAE,CAAC,IAAI,CAAC;IACX,UAAU,EAAE;QACV;YACE,KAAK,EAAE,wBAAwB;YAC/B,GAAG,EAAE,gDAAgD;SACtD;QACD;YACE,KAAK,EAAE,sBAAsB;YAC7B,GAAG,EAAE,wDAAwD;SAC9D;KACF;IAED,KAAK,CAAC,OAAO,CAAC,OAAoB;QAChC,MAAM,QAAQ,GAAkB,EAAE,CAAC;QACnC,MAAM,UAAU,GAAG,OAAO,CAAC,UAAU,CAAC;QAEtC,sBAAsB,CAAC,OAAO,EAAE,UAAU,EAAE,QAAQ,CAAC,CAAC;QACtD,mBAAmB,CAAC,OAAO,EAAE,UAAU,EAAE,QAAQ,CAAC,CAAC;QACnD,sBAAsB,CAAC,OAAO,EAAE,UAAU,EAAE,QAAQ,CAAC,CAAC;QAEtD,OAAO,QAAQ,CAAC;IAClB,CAAC;CACF,CAAC;AAEF;;GAEG;AACH,SAAS,sBAAsB,CAC7B,OAAoB,EACpB,UAAkB,EAClB,QAAuB;IAEvB,MAAM,KAAK,GAAG,UAAU,CAAC,KAAK,CAAC,IAAI,CAAC,CAAC;IAErC,MAAM,YAAY,GAAG;QACnB;YACE,OAAO,EAAE,yDAAyD;YAClE,IAAI,EAAE,2BAA2B;YACjC,OAAO,EAAE,iDAAiD;YAC1D,QAAQ,EAAE,MAAe;SAC1B;QACD;YACE,OAAO,EAAE,4DAA4D;YACrE,IAAI,EAAE,8BAA8B;YACpC,OAAO,EAAE,oDAAoD;YAC7D,QAAQ,EAAE,MAAe;SAC1B;QACD;YACE,OAAO,EAAE,2DAA2D;YACpE,IAAI,EAAE,2BAA2B;YACjC,OAAO,EAAE,yDAAyD;YAClE,QAAQ,EAAE,UAAmB;SAC9B;QACD;YACE,OAAO,EAAE,sDAAsD;YAC/D,IAAI,EAAE,+BAA+B;YACrC,OAAO,EAAE,qDAAqD;YAC9D,QAAQ,EAAE,UAAmB;SAC9B;QACD;YACE,OAAO,EAAE,sDAAsD;YAC/D,IAAI,EAAE,yBAAyB;YAC/B,OAAO,EAAE,8CAA8C;YACvD,QAAQ,EAAE,MAAe;SAC1B;QACD;YACE,OAAO,EAAE,6DAA6D;YACtE,IAAI,EAAE,2BAA2B;YACjC,OAAO,EAAE,kDAAkD;YAC3D,QAAQ,EAAE,MAAe;SAC1B;KACF,CAAC;IAEF,KAAK,IAAI,OAAO,GAAG,CAAC,EAAE,OAAO,GAAG,KAAK,CAAC,MAAM,EAAE,OAAO,EAAE,EAAE,CAAC;QACxD,MAAM,IAAI,GAAG,KAAK,CAAC,OAAO,CAAC,CAAC;QAE5B,KAAK,MAAM,EAAE,OAAO,EAAE,IAAI,EAAE,OAAO,EAAE,QAAQ,EAAE,IAAI,YAAY,EAAE,CAAC;YAChE,OAAO,CAAC,SAAS,GAAG,CAAC,CAAC;YACtB,IAAI,OAAO,CAAC,IAAI,CAAC,IAAI,CAAC,EAAE,CAAC;gBACvB,QAAQ,CAAC,IAAI,CAAC;oBACZ,EAAE,EAAE,iBAAiB,QAAQ,CAAC,MAAM,GAAG,CAAC,EAAE;oBAC1C,MAAM,EAAE,uBAAuB;oBAC/B,QAAQ;oBACR,OAAO,EAAE,oBAAoB,IAAI,KAAK,OAAO,EAAE;oBAC/C,QAAQ,EAAE;wBACR,IAAI,EAAE,OAAO,CAAC,QAAQ;wBACtB,SAAS,EAAE,OAAO,GAAG,CAAC;wBACtB,OAAO,EAAE,OAAO,GAAG,CAAC;wBACpB,WAAW,EAAE,CAAC;wBACd,SAAS,EAAE,IAAI,CAAC,MAAM;qBACvB;oBACD,GAAG,EAAE,CAAC,IAAI,CAAC;oBACX,UAAU,EAAE;wBACV,WAAW,EAAE,sEAAsE;wBACnF,OAAO,EAAE;;;;;;;;;;;;;EAanB;qBACS;iBACF,CAAC,CAAC;YACL,CAAC;QACH,CAAC;IACH,CAAC;AACH,CAAC;AAED;;GAEG;AACH,SAAS,mBAAmB,CAC1B,OAAoB,EACpB,UAAkB,EAClB,QAAuB;IAEvB,MAAM,KAAK,GAAG,UAAU,CAAC,KAAK,CAAC,IAAI,CAAC,CAAC;IAErC,MAAM,YAAY,GAAG;QACnB;YACE,OAAO,EAAE,4EAA4E;YACrF,IAAI,EAAE,0BAA0B;YAChC,OAAO,EAAE,mDAAmD;YAC5D,QAAQ,EAAE,UAAmB;SAC9B;QACD;YACE,OAAO,EAAE,8EAA8E;YACvF,IAAI,EAAE,2BAA2B;YACjC,OAAO,EAAE,qDAAqD;YAC9D,QAAQ,EAAE,UAAmB;SAC9B;QACD;YACE,OAAO,EAAE,kFAAkF;YAC3F,IAAI,EAAE,wBAAwB;YAC9B,OAAO,EAAE,2DAA2D;YACpE,QAAQ,EAAE,UAAmB;SAC9B;QACD;YACE,OAAO,EAAE,yFAAyF;YAClG,IAAI,EAAE,8BAA8B;YACpC,OAAO,EAAE,iDAAiD;YAC1D,QAAQ,EAAE,MAAe;SAC1B;QACD;YACE,OAAO,EAAE,wEAAwE;YACjF,IAAI,EAAE,sBAAsB;YAC5B,OAAO,EAAE,+CAA+C;YACxD,QAAQ,EAAE,QAAiB;SAC5B;QACD;YACE,OAAO,EAAE,sEAAsE;YAC/E,IAAI,EAAE,uBAAuB;YAC7B,OAAO,EAAE,2CAA2C;YACpD,QAAQ,EAAE,QAAiB;SAC5B;QACD;YACE,OAAO,EAAE,oDAAoD;YAC7D,IAAI,EAAE,yBAAyB;YAC/B,OAAO,EAAE,uDAAuD;YAChE,QAAQ,EAAE,UAAmB;SAC9B;QACD;YACE,OAAO,EAAE,mDAAmD;YAC5D,IAAI,EAAE,gCAAgC;YACtC,OAAO,EAAE,sDAAsD;YAC/D,QAAQ,EAAE,UAAmB;SAC9B;KACF,CAAC;IAEF,KAAK,IAAI,OAAO,GAAG,CAAC,EAAE,OAAO,GAAG,KAAK,CAAC,MAAM,EAAE,OAAO,EAAE,EAAE,CAAC;QACxD,MAAM,IAAI,GAAG,KAAK,CAAC,OAAO,CAAC,CAAC;QAE5B,KAAK,MAAM,EAAE,OAAO,EAAE,IAAI,EAAE,OAAO,EAAE,QAAQ,EAAE,IAAI,YAAY,EAAE,CAAC;YAChE,OAAO,CAAC,SAAS,GAAG,CAAC,CAAC;YACtB,IAAI,OAAO,CAAC,IAAI,CAAC,IAAI,CAAC,EAAE,CAAC;gBACvB,QAAQ,CAAC,IAAI,CAAC;oBACZ,EAAE,EAAE,eAAe,QAAQ,CAAC,MAAM,GAAG,CAAC,EAAE;oBACxC,MAAM,EAAE,uBAAuB;oBAC/B,QAAQ;oBACR,OAAO,EAAE,oBAAoB,IAAI,KAAK,OAAO,EAAE;oBAC/C,QAAQ,EAAE;wBACR,IAAI,EAAE,OAAO,CAAC,QAAQ;wBACtB,SAAS,EAAE,OAAO,GAAG,CAAC;wBACtB,OAAO,EAAE,OAAO,GAAG,CAAC;wBACpB,WAAW,EAAE,CAAC;wBACd,SAAS,EAAE,IAAI,CAAC,MAAM;qBACvB;oBACD,GAAG,EAAE,CAAC,IAAI,CAAC;oBACX,UAAU,EAAE;wBACV,WAAW,EAAE,sCAAsC;wBACnD,OAAO,EAAE;;;;;;;;;;;;;;;;;EAiBnB;qBACS;iBACF,CAAC,CAAC;YACL,CAAC;QACH,CAAC;IACH,CAAC;AACH,CAAC;AAED;;GAEG;AACH,SAAS,sBAAsB,CAC7B,OAAoB,EACpB,UAAkB,EAClB,QAAuB;IAEvB,MAAM,KAAK,GAAG,UAAU,CAAC,KAAK,CAAC,IAAI,CAAC,CAAC;IAErC,MAAM,YAAY,GAAG;QACnB;YACE,OAAO,EAAE,mCAAmC;YAC5C,IAAI,EAAE,yBAAyB;YAC/B,OAAO,EAAE,0CAA0C;YACnD,QAAQ,EAAE,MAAe;SAC1B;QACD;YACE,OAAO,EAAE,sDAAsD;YAC/D,IAAI,EAAE,kCAAkC;YACxC,OAAO,EAAE,uDAAuD;YAChE,QAAQ,EAAE,QAAiB;SAC5B;QACD;YACE,OAAO,EAAE,uCAAuC;YAChD,IAAI,EAAE,uBAAuB;YAC7B,OAAO,EAAE,kDAAkD;YAC3D,QAAQ,EAAE,QAAiB;SAC5B;QACD;YACE,OAAO,EAAE,yCAAyC;YAClD,IAAI,EAAE,iBAAiB;YACvB,OAAO,EAAE,8CAA8C;YACvD,QAAQ,EAAE,QAAiB;SAC5B;KACF,CAAC;IAEF,KAAK,IAAI,OAAO,GAAG,CAAC,EAAE,OAAO,GAAG,KAAK,CAAC,MAAM,EAAE,OAAO,EAAE,EAAE,CAAC;QACxD,MAAM,IAAI,GAAG,KAAK,CAAC,OAAO,CAAC,CAAC;QAE5B,KAAK,MAAM,EAAE,OAAO,EAAE,IAAI,EAAE,OAAO,EAAE,QAAQ,EAAE,IAAI,YAAY,EAAE,CAAC;YAChE,OAAO,CAAC,SAAS,GAAG,CAAC,CAAC;YACtB,IAAI,OAAO,CAAC,IAAI,CAAC,IAAI,CAAC,EAAE,CAAC;gBACvB,QAAQ,CAAC,IAAI,CAAC;oBACZ,EAAE,EAAE,eAAe,QAAQ,CAAC,MAAM,GAAG,CAAC,EAAE;oBACxC,MAAM,EAAE,uBAAuB;oBAC/B,QAAQ;oBACR,OAAO,EAAE,wBAAwB,IAAI,KAAK,OAAO,EAAE;oBACnD,QAAQ,EAAE;wBACR,IAAI,EAAE,OAAO,CAAC,QAAQ;wBACtB,SAAS,EAAE,OAAO,GAAG,CAAC;wBACtB,OAAO,EAAE,OAAO,GAAG,CAAC;wBACpB,WAAW,EAAE,CAAC;wBACd,SAAS,EAAE,IAAI,CAAC,MAAM;qBACvB;oBACD,GAAG,EAAE,CAAC,IAAI,CAAC;oBACX,UAAU,EAAE;wBACV,WAAW,EAAE,uDAAuD;wBACpE,OAAO,EAAE;;;;;;;;;;;;;;;;;;;;;EAqBnB;qBACS;iBACF,CAAC,CAAC;YACL,CAAC;QACH,CAAC;IACH,CAAC;AACH,CAAC;AAED,eAAe,kBAAkB,CAAC"}

package/dist/rules/cwe/cwe-269-improper-privilege.d.ts

@@ -0,0 +1,9 @@
+/**
+ * @fileoverview CWE-269: Improper Privilege Management
+ * @module @nahisaho/musubix-security/rules/cwe/cwe-269-improper-privilege
+ * @trace TSK-RULE-006
+ */
+import type { SecurityRule } from '../types.js';
+export declare const cwe269ImproperPrivilege: SecurityRule;
+export default cwe269ImproperPrivilege;
+//# sourceMappingURL=cwe-269-improper-privilege.d.ts.map

package/dist/rules/cwe/cwe-269-improper-privilege.d.ts.map

@@ -0,0 +1 @@
+{"version":3,"file":"cwe-269-improper-privilege.d.ts","sourceRoot":"","sources":["../../../src/rules/cwe/cwe-269-improper-privilege.ts"],"names":[],"mappings":"AAAA;;;;GAIG;AAEH,OAAO,KAAK,EAAE,YAAY,EAA4B,MAAM,aAAa,CAAC;AAE1E,eAAO,MAAM,uBAAuB,EAAE,YAqDrC,CAAC;AAEF,eAAe,uBAAuB,CAAC"}

package/dist/rules/cwe/cwe-269-improper-privilege.js

@@ -0,0 +1,58 @@
+/**
+ * @fileoverview CWE-269: Improper Privilege Management
+ * @module @nahisaho/musubix-security/rules/cwe/cwe-269-improper-privilege
+ * @trace TSK-RULE-006
+ */
+export const cwe269ImproperPrivilege = {
+    id: 'cwe-269-improper-privilege',
+    name: 'CWE-269: Improper Privilege Management',
+    description: 'Detects improper privilege assignment and escalation risks',
+    defaultSeverity: 'high',
+    category: 'authorization',
+    tags: ['cwe', 'privilege', 'escalation', 'security'],
+    cwe: ['269'],
+    owasp: ['A01:2021'],
+    references: [
+        { title: 'CWE-269', url: 'https://cwe.mitre.org/data/definitions/269.html' },
+    ],
+    async analyze(context) {
+        const findings = [];
+        const lines = context.sourceCode.split('\n');
+        const patterns = [
+            { pattern: /role\s*[:=]\s*['"`]admin['"`]/gi, type: 'Direct admin role assignment', severity: 'high' },
+            { pattern: /isAdmin\s*[:=]\s*true/gi, type: 'Direct admin flag set', severity: 'high' },
+            { pattern: /setuid|setgid|seteuid/gi, type: 'Privilege elevation function', severity: 'critical' },
+            { pattern: /sudo|runas/gi, type: 'Privilege escalation command', severity: 'critical' },
+            { pattern: /chmod\s*\(\s*['"`]?0?7/gi, type: 'Overly permissive chmod', severity: 'high' },
+            { pattern: /user\.role\s*=\s*req\./gi, type: 'Role from user input', severity: 'critical' },
+            { pattern: /\.grant\s*\(\s*['"`]\*/gi, type: 'Wildcard permission grant', severity: 'high' },
+        ];
+        for (let i = 0; i < lines.length; i++) {
+            for (const { pattern, type, severity } of patterns) {
+                pattern.lastIndex = 0;
+                if (pattern.test(lines[i])) {
+                    findings.push({
+                        id: `cwe-269-${findings.length + 1}`,
+                        ruleId: 'cwe-269-improper-privilege',
+                        severity,
+                        message: `Privilege Management - ${type}: Follow least privilege principle`,
+                        location: { file: context.filePath, startLine: i + 1, endLine: i + 1 },
+                        cwe: ['269'],
+                        owasp: ['A01:2021'],
+                        suggestion: {
+                            description: 'Apply least privilege principle',
+                            example: `// Use role-based access control
+const permissions = rbac.getPermissions(user.role);
+if (!permissions.includes('admin:write')) {
+  throw new ForbiddenError();
+}`,
+                        },
+                    });
+                }
+            }
+        }
+        return findings;
+    },
+};
+export default cwe269ImproperPrivilege;
+//# sourceMappingURL=cwe-269-improper-privilege.js.map

package/dist/rules/cwe/cwe-269-improper-privilege.js.map

@@ -0,0 +1 @@
+{"version":3,"file":"cwe-269-improper-privilege.js","sourceRoot":"","sources":["../../../src/rules/cwe/cwe-269-improper-privilege.ts"],"names":[],"mappings":"AAAA;;;;GAIG;AAIH,MAAM,CAAC,MAAM,uBAAuB,GAAiB;IACnD,EAAE,EAAE,4BAA4B;IAChC,IAAI,EAAE,wCAAwC;IAC9C,WAAW,EAAE,4DAA4D;IACzE,eAAe,EAAE,MAAM;IACvB,QAAQ,EAAE,eAAe;IACzB,IAAI,EAAE,CAAC,KAAK,EAAE,WAAW,EAAE,YAAY,EAAE,UAAU,CAAC;IACpD,GAAG,EAAE,CAAC,KAAK,CAAC;IACZ,KAAK,EAAE,CAAC,UAAU,CAAC;IACnB,UAAU,EAAE;QACV,EAAE,KAAK,EAAE,SAAS,EAAE,GAAG,EAAE,iDAAiD,EAAE;KAC7E;IAED,KAAK,CAAC,OAAO,CAAC,OAAoB;QAChC,MAAM,QAAQ,GAAkB,EAAE,CAAC;QACnC,MAAM,KAAK,GAAG,OAAO,CAAC,UAAU,CAAC,KAAK,CAAC,IAAI,CAAC,CAAC;QAE7C,MAAM,QAAQ,GAAG;YACf,EAAE,OAAO,EAAE,iCAAiC,EAAE,IAAI,EAAE,8BAA8B,EAAE,QAAQ,EAAE,MAAe,EAAE;YAC/G,EAAE,OAAO,EAAE,yBAAyB,EAAE,IAAI,EAAE,uBAAuB,EAAE,QAAQ,EAAE,MAAe,EAAE;YAChG,EAAE,OAAO,EAAE,yBAAyB,EAAE,IAAI,EAAE,8BAA8B,EAAE,QAAQ,EAAE,UAAmB,EAAE;YAC3G,EAAE,OAAO,EAAE,cAAc,EAAE,IAAI,EAAE,8BAA8B,EAAE,QAAQ,EAAE,UAAmB,EAAE;YAChG,EAAE,OAAO,EAAE,0BAA0B,EAAE,IAAI,EAAE,yBAAyB,EAAE,QAAQ,EAAE,MAAe,EAAE;YACnG,EAAE,OAAO,EAAE,0BAA0B,EAAE,IAAI,EAAE,sBAAsB,EAAE,QAAQ,EAAE,UAAmB,EAAE;YACpG,EAAE,OAAO,EAAE,0BAA0B,EAAE,IAAI,EAAE,2BAA2B,EAAE,QAAQ,EAAE,MAAe,EAAE;SACtG,CAAC;QAEF,KAAK,IAAI,CAAC,GAAG,CAAC,EAAE,CAAC,GAAG,KAAK,CAAC,MAAM,EAAE,CAAC,EAAE,EAAE,CAAC;YACtC,KAAK,MAAM,EAAE,OAAO,EAAE,IAAI,EAAE,QAAQ,EAAE,IAAI,QAAQ,EAAE,CAAC;gBACnD,OAAO,CAAC,SAAS,GAAG,CAAC,CAAC;gBACtB,IAAI,OAAO,CAAC,IAAI,CAAC,KAAK,CAAC,CAAC,CAAC,CAAC,EAAE,CAAC;oBAC3B,QAAQ,CAAC,IAAI,CAAC;wBACZ,EAAE,EAAE,WAAW,QAAQ,CAAC,MAAM,GAAG,CAAC,EAAE;wBACpC,MAAM,EAAE,4BAA4B;wBACpC,QAAQ;wBACR,OAAO,EAAE,0BAA0B,IAAI,oCAAoC;wBAC3E,QAAQ,EAAE,EAAE,IAAI,EAAE,OAAO,CAAC,QAAQ,EAAE,SAAS,EAAE,CAAC,GAAG,CAAC,EAAE,OAAO,EAAE,CAAC,GAAG,CAAC,EAAE;wBACtE,GAAG,EAAE,CAAC,KAAK,CAAC;wBACZ,KAAK,EAAE,CAAC,UAAU,CAAC;wBACnB,UAAU,EAAE;4BACV,WAAW,EAAE,iCAAiC;4BAC9C,OAAO,EAAE;;;;EAIrB;yBACW;qBACF,CAAC,CAAC;gBACL,CAAC;YACH,CAAC;QACH,CAAC;QACD,OAAO,QAAQ,CAAC;IAClB,CAAC;CACF,CAAC;AAEF,eAAe,uBAAuB,CAAC"}

package/dist/rules/cwe/cwe-276-default-permissions.d.ts

@@ -0,0 +1,9 @@
+/**
+ * @fileoverview CWE-276: Incorrect Default Permissions
+ * @module @nahisaho/musubix-security/rules/cwe/cwe-276-default-permissions
+ * @trace TSK-RULE-006
+ */
+import type { SecurityRule } from '../types.js';
+export declare const cwe276DefaultPermissions: SecurityRule;
+export default cwe276DefaultPermissions;
+//# sourceMappingURL=cwe-276-default-permissions.d.ts.map

package/dist/rules/cwe/cwe-276-default-permissions.d.ts.map

@@ -0,0 +1 @@
+{"version":3,"file":"cwe-276-default-permissions.d.ts","sourceRoot":"","sources":["../../../src/rules/cwe/cwe-276-default-permissions.ts"],"names":[],"mappings":"AAAA;;;;GAIG;AAEH,OAAO,KAAK,EAAE,YAAY,EAA4B,MAAM,aAAa,CAAC;AAE1E,eAAO,MAAM,wBAAwB,EAAE,YAiDtC,CAAC;AAEF,eAAe,wBAAwB,CAAC"}

package/dist/rules/cwe/cwe-276-default-permissions.js

@@ -0,0 +1,54 @@
+/**
+ * @fileoverview CWE-276: Incorrect Default Permissions
+ * @module @nahisaho/musubix-security/rules/cwe/cwe-276-default-permissions
+ * @trace TSK-RULE-006
+ */
+export const cwe276DefaultPermissions = {
+    id: 'cwe-276-default-permissions',
+    name: 'CWE-276: Incorrect Default Permissions',
+    description: 'Detects overly permissive default file/resource permissions',
+    defaultSeverity: 'medium',
+    category: 'configuration',
+    tags: ['cwe', 'permissions', 'configuration', 'security'],
+    cwe: ['276'],
+    references: [
+        { title: 'CWE-276', url: 'https://cwe.mitre.org/data/definitions/276.html' },
+    ],
+    async analyze(context) {
+        const findings = [];
+        const lines = context.sourceCode.split('\n');
+        const patterns = [
+            { pattern: /chmod\s*\(\s*['"`]?0?777/gi, type: 'World-writable permissions', severity: 'critical' },
+            { pattern: /chmod\s*\(\s*['"`]?0?666/gi, type: 'World-readable/writable file', severity: 'high' },
+            { pattern: /umask\s*\(\s*0*0*0\s*\)/gi, type: 'No umask restriction', severity: 'high' },
+            { pattern: /mode\s*:\s*0o?777/gi, type: 'Mode 777 in options', severity: 'critical' },
+            { pattern: /fs\.chmod.*0o?7[0-7][0-7]/gi, type: 'fs.chmod with execute for all', severity: 'high' },
+            { pattern: /writeFile.*\{\s*mode\s*:\s*0o?[67]/gi, type: 'writeFile with permissive mode', severity: 'medium' },
+            { pattern: /mkdir.*\{\s*mode\s*:\s*0o?777/gi, type: 'mkdir with 777', severity: 'critical' },
+        ];
+        for (let i = 0; i < lines.length; i++) {
+            for (const { pattern, type, severity } of patterns) {
+                pattern.lastIndex = 0;
+                if (pattern.test(lines[i])) {
+                    findings.push({
+                        id: `cwe-276-${findings.length + 1}`,
+                        ruleId: 'cwe-276-default-permissions',
+                        severity,
+                        message: `Default Permissions - ${type}: Use restrictive permissions`,
+                        location: { file: context.filePath, startLine: i + 1, endLine: i + 1 },
+                        cwe: ['276'],
+                        suggestion: {
+                            description: 'Use least privilege permissions',
+                            example: `// Use restrictive permissions
+fs.writeFileSync(path, data, { mode: 0o600 }); // Owner only
+fs.mkdirSync(dir, { mode: 0o700 }); // Owner only`,
+                        },
+                    });
+                }
+            }
+        }
+        return findings;
+    },
+};
+export default cwe276DefaultPermissions;
+//# sourceMappingURL=cwe-276-default-permissions.js.map

package/dist/rules/cwe/cwe-276-default-permissions.js.map

@@ -0,0 +1 @@
+{"version":3,"file":"cwe-276-default-permissions.js","sourceRoot":"","sources":["../../../src/rules/cwe/cwe-276-default-permissions.ts"],"names":[],"mappings":"AAAA;;;;GAIG;AAIH,MAAM,CAAC,MAAM,wBAAwB,GAAiB;IACpD,EAAE,EAAE,6BAA6B;IACjC,IAAI,EAAE,wCAAwC;IAC9C,WAAW,EAAE,6DAA6D;IAC1E,eAAe,EAAE,QAAQ;IACzB,QAAQ,EAAE,eAAe;IACzB,IAAI,EAAE,CAAC,KAAK,EAAE,aAAa,EAAE,eAAe,EAAE,UAAU,CAAC;IACzD,GAAG,EAAE,CAAC,KAAK,CAAC;IACZ,UAAU,EAAE;QACV,EAAE,KAAK,EAAE,SAAS,EAAE,GAAG,EAAE,iDAAiD,EAAE;KAC7E;IAED,KAAK,CAAC,OAAO,CAAC,OAAoB;QAChC,MAAM,QAAQ,GAAkB,EAAE,CAAC;QACnC,MAAM,KAAK,GAAG,OAAO,CAAC,UAAU,CAAC,KAAK,CAAC,IAAI,CAAC,CAAC;QAE7C,MAAM,QAAQ,GAAG;YACf,EAAE,OAAO,EAAE,4BAA4B,EAAE,IAAI,EAAE,4BAA4B,EAAE,QAAQ,EAAE,UAAmB,EAAE;YAC5G,EAAE,OAAO,EAAE,4BAA4B,EAAE,IAAI,EAAE,8BAA8B,EAAE,QAAQ,EAAE,MAAe,EAAE;YAC1G,EAAE,OAAO,EAAE,2BAA2B,EAAE,IAAI,EAAE,sBAAsB,EAAE,QAAQ,EAAE,MAAe,EAAE;YACjG,EAAE,OAAO,EAAE,qBAAqB,EAAE,IAAI,EAAE,qBAAqB,EAAE,QAAQ,EAAE,UAAmB,EAAE;YAC9F,EAAE,OAAO,EAAE,6BAA6B,EAAE,IAAI,EAAE,+BAA+B,EAAE,QAAQ,EAAE,MAAe,EAAE;YAC5G,EAAE,OAAO,EAAE,sCAAsC,EAAE,IAAI,EAAE,gCAAgC,EAAE,QAAQ,EAAE,QAAiB,EAAE;YACxH,EAAE,OAAO,EAAE,iCAAiC,EAAE,IAAI,EAAE,gBAAgB,EAAE,QAAQ,EAAE,UAAmB,EAAE;SACtG,CAAC;QAEF,KAAK,IAAI,CAAC,GAAG,CAAC,EAAE,CAAC,GAAG,KAAK,CAAC,MAAM,EAAE,CAAC,EAAE,EAAE,CAAC;YACtC,KAAK,MAAM,EAAE,OAAO,EAAE,IAAI,EAAE,QAAQ,EAAE,IAAI,QAAQ,EAAE,CAAC;gBACnD,OAAO,CAAC,SAAS,GAAG,CAAC,CAAC;gBACtB,IAAI,OAAO,CAAC,IAAI,CAAC,KAAK,CAAC,CAAC,CAAC,CAAC,EAAE,CAAC;oBAC3B,QAAQ,CAAC,IAAI,CAAC;wBACZ,EAAE,EAAE,WAAW,QAAQ,CAAC,MAAM,GAAG,CAAC,EAAE;wBACpC,MAAM,EAAE,6BAA6B;wBACrC,QAAQ;wBACR,OAAO,EAAE,yBAAyB,IAAI,+BAA+B;wBACrE,QAAQ,EAAE,EAAE,IAAI,EAAE,OAAO,CAAC,QAAQ,EAAE,SAAS,EAAE,CAAC,GAAG,CAAC,EAAE,OAAO,EAAE,CAAC,GAAG,CAAC,EAAE;wBACtE,GAAG,EAAE,CAAC,KAAK,CAAC;wBACZ,UAAU,EAAE;4BACV,WAAW,EAAE,iCAAiC;4BAC9C,OAAO,EAAE;;kDAE2B;yBACrC;qBACF,CAAC,CAAC;gBACL,CAAC;YACH,CAAC;QACH,CAAC;QACD,OAAO,QAAQ,CAAC;IAClB,CAAC;CACF,CAAC;AAEF,eAAe,wBAAwB,CAAC"}

package/dist/rules/cwe/cwe-287-improper-auth.d.ts

@@ -0,0 +1,9 @@
+/**
+ * @fileoverview CWE-287: Improper Authentication
+ * @module @nahisaho/musubix-security/rules/cwe/cwe-287-improper-auth
+ * @trace TSK-RULE-005
+ */
+import type { SecurityRule } from '../types.js';
+export declare const cwe287ImproperAuth: SecurityRule;
+export default cwe287ImproperAuth;
+//# sourceMappingURL=cwe-287-improper-auth.d.ts.map

package/dist/rules/cwe/cwe-287-improper-auth.d.ts.map

@@ -0,0 +1 @@
+{"version":3,"file":"cwe-287-improper-auth.d.ts","sourceRoot":"","sources":["../../../src/rules/cwe/cwe-287-improper-auth.ts"],"names":[],"mappings":"AAAA;;;;GAIG;AAEH,OAAO,KAAK,EAAE,YAAY,EAA4B,MAAM,aAAa,CAAC;AAE1E,eAAO,MAAM,kBAAkB,EAAE,YAoDhC,CAAC;AAEF,eAAe,kBAAkB,CAAC"}

package/dist/rules/cwe/cwe-287-improper-auth.js

@@ -0,0 +1,57 @@
+/**
+ * @fileoverview CWE-287: Improper Authentication
+ * @module @nahisaho/musubix-security/rules/cwe/cwe-287-improper-auth
+ * @trace TSK-RULE-005
+ */
+export const cwe287ImproperAuth = {
+    id: 'cwe-287-improper-auth',
+    name: 'CWE-287: Improper Authentication',
+    description: 'Detects weak or improper authentication patterns',
+    defaultSeverity: 'high',
+    category: 'authentication',
+    tags: ['cwe', 'authentication', 'security'],
+    owasp: ['A07:2021'],
+    cwe: ['287'],
+    references: [
+        { title: 'CWE-287', url: 'https://cwe.mitre.org/data/definitions/287.html' },
+    ],
+    async analyze(context) {
+        const findings = [];
+        const lines = context.sourceCode.split('\n');
+        const patterns = [
+            { pattern: /password\s*===?\s*['"`]\w+['"`]/gi, type: 'Hardcoded password check', severity: 'critical' },
+            { pattern: /if\s*\(\s*req\.headers\.authorization\s*\)/gi, type: 'Simple auth header check', severity: 'medium' },
+            { pattern: /\.compare\s*\(\s*password\s*,\s*password/gi, type: 'Password compared to itself', severity: 'high' },
+            { pattern: /jwt\.verify\s*\([^)]*\{\s*\}\s*\)/gi, type: 'JWT verify without options', severity: 'high' },
+            { pattern: /algorithms\s*:\s*\[\s*['"`]none['"`]/gi, type: 'JWT none algorithm', severity: 'critical' },
+            { pattern: /session\.cookie\.secure\s*=\s*false/gi, type: 'Insecure session cookie', severity: 'high' },
+        ];
+        for (let i = 0; i < lines.length; i++) {
+            for (const { pattern, type, severity } of patterns) {
+                pattern.lastIndex = 0;
+                if (pattern.test(lines[i])) {
+                    findings.push({
+                        id: `cwe-287-${findings.length + 1}`,
+                        ruleId: 'cwe-287-improper-auth',
+                        severity,
+                        message: `Authentication - ${type}: Use secure authentication`,
+                        location: { file: context.filePath, startLine: i + 1, endLine: i + 1 },
+                        cwe: ['287'],
+                        owasp: ['A07:2021'],
+                        suggestion: {
+                            description: 'Use proper authentication libraries',
+                            example: `// Use bcrypt for password comparison
+const isValid = await bcrypt.compare(inputPassword, hashedPassword);
+
+// JWT with proper options
+jwt.verify(token, secret, { algorithms: ['HS256'] });`,
+                        },
+                    });
+                }
+            }
+        }
+        return findings;
+    },
+};
+export default cwe287ImproperAuth;
+//# sourceMappingURL=cwe-287-improper-auth.js.map

package/dist/rules/cwe/cwe-287-improper-auth.js.map

@@ -0,0 +1 @@
+{"version":3,"file":"cwe-287-improper-auth.js","sourceRoot":"","sources":["../../../src/rules/cwe/cwe-287-improper-auth.ts"],"names":[],"mappings":"AAAA;;;;GAIG;AAIH,MAAM,CAAC,MAAM,kBAAkB,GAAiB;IAC9C,EAAE,EAAE,uBAAuB;IAC3B,IAAI,EAAE,kCAAkC;IACxC,WAAW,EAAE,kDAAkD;IAC/D,eAAe,EAAE,MAAM;IACvB,QAAQ,EAAE,gBAAgB;IAC1B,IAAI,EAAE,CAAC,KAAK,EAAE,gBAAgB,EAAE,UAAU,CAAC;IAC3C,KAAK,EAAE,CAAC,UAAU,CAAC;IACnB,GAAG,EAAE,CAAC,KAAK,CAAC;IACZ,UAAU,EAAE;QACV,EAAE,KAAK,EAAE,SAAS,EAAE,GAAG,EAAE,iDAAiD,EAAE;KAC7E;IAED,KAAK,CAAC,OAAO,CAAC,OAAoB;QAChC,MAAM,QAAQ,GAAkB,EAAE,CAAC;QACnC,MAAM,KAAK,GAAG,OAAO,CAAC,UAAU,CAAC,KAAK,CAAC,IAAI,CAAC,CAAC;QAE7C,MAAM,QAAQ,GAAG;YACf,EAAE,OAAO,EAAE,mCAAmC,EAAE,IAAI,EAAE,0BAA0B,EAAE,QAAQ,EAAE,UAAmB,EAAE;YACjH,EAAE,OAAO,EAAE,8CAA8C,EAAE,IAAI,EAAE,0BAA0B,EAAE,QAAQ,EAAE,QAAiB,EAAE;YAC1H,EAAE,OAAO,EAAE,4CAA4C,EAAE,IAAI,EAAE,6BAA6B,EAAE,QAAQ,EAAE,MAAe,EAAE;YACzH,EAAE,OAAO,EAAE,qCAAqC,EAAE,IAAI,EAAE,4BAA4B,EAAE,QAAQ,EAAE,MAAe,EAAE;YACjH,EAAE,OAAO,EAAE,wCAAwC,EAAE,IAAI,EAAE,oBAAoB,EAAE,QAAQ,EAAE,UAAmB,EAAE;YAChH,EAAE,OAAO,EAAE,uCAAuC,EAAE,IAAI,EAAE,yBAAyB,EAAE,QAAQ,EAAE,MAAe,EAAE;SACjH,CAAC;QAEF,KAAK,IAAI,CAAC,GAAG,CAAC,EAAE,CAAC,GAAG,KAAK,CAAC,MAAM,EAAE,CAAC,EAAE,EAAE,CAAC;YACtC,KAAK,MAAM,EAAE,OAAO,EAAE,IAAI,EAAE,QAAQ,EAAE,IAAI,QAAQ,EAAE,CAAC;gBACnD,OAAO,CAAC,SAAS,GAAG,CAAC,CAAC;gBACtB,IAAI,OAAO,CAAC,IAAI,CAAC,KAAK,CAAC,CAAC,CAAC,CAAC,EAAE,CAAC;oBAC3B,QAAQ,CAAC,IAAI,CAAC;wBACZ,EAAE,EAAE,WAAW,QAAQ,CAAC,MAAM,GAAG,CAAC,EAAE;wBACpC,MAAM,EAAE,uBAAuB;wBAC/B,QAAQ;wBACR,OAAO,EAAE,oBAAoB,IAAI,6BAA6B;wBAC9D,QAAQ,EAAE,EAAE,IAAI,EAAE,OAAO,CAAC,QAAQ,EAAE,SAAS,EAAE,CAAC,GAAG,CAAC,EAAE,OAAO,EAAE,CAAC,GAAG,CAAC,EAAE;wBACtE,GAAG,EAAE,CAAC,KAAK,CAAC;wBACZ,KAAK,EAAE,CAAC,UAAU,CAAC;wBACnB,UAAU,EAAE;4BACV,WAAW,EAAE,qCAAqC;4BAClD,OAAO,EAAE;;;;sDAI+B;yBACzC;qBACF,CAAC,CAAC;gBACL,CAAC;YACH,CAAC;QACH,CAAC;QACD,OAAO,QAAQ,CAAC;IAClB,CAAC;CACF,CAAC;AAEF,eAAe,kBAAkB,CAAC"}

package/dist/rules/cwe/cwe-306-missing-auth-critical.d.ts

@@ -0,0 +1,9 @@
+/**
+ * @fileoverview CWE-306: Missing Authentication for Critical Function
+ * @module @nahisaho/musubix-security/rules/cwe/cwe-306-missing-auth-critical
+ * @trace TSK-RULE-006
+ */
+import type { SecurityRule } from '../types.js';
+export declare const cwe306MissingAuthCritical: SecurityRule;
+export default cwe306MissingAuthCritical;
+//# sourceMappingURL=cwe-306-missing-auth-critical.d.ts.map

package/dist/rules/cwe/cwe-306-missing-auth-critical.d.ts.map

@@ -0,0 +1 @@
+{"version":3,"file":"cwe-306-missing-auth-critical.d.ts","sourceRoot":"","sources":["../../../src/rules/cwe/cwe-306-missing-auth-critical.ts"],"names":[],"mappings":"AAAA;;;;GAIG;AAEH,OAAO,KAAK,EAAE,YAAY,EAA4B,MAAM,aAAa,CAAC;AAE1E,eAAO,MAAM,yBAAyB,EAAE,YAgDvC,CAAC;AAEF,eAAe,yBAAyB,CAAC"}

package/dist/rules/cwe/cwe-306-missing-auth-critical.js

@@ -0,0 +1,53 @@
+/**
+ * @fileoverview CWE-306: Missing Authentication for Critical Function
+ * @module @nahisaho/musubix-security/rules/cwe/cwe-306-missing-auth-critical
+ * @trace TSK-RULE-006
+ */
+export const cwe306MissingAuthCritical = {
+    id: 'cwe-306-missing-auth-critical',
+    name: 'CWE-306: Missing Authentication for Critical Function',
+    description: 'Detects critical functions without authentication',
+    defaultSeverity: 'critical',
+    category: 'authentication',
+    tags: ['cwe', 'authentication', 'critical', 'security'],
+    cwe: ['306'],
+    owasp: ['A07:2021'],
+    references: [
+        { title: 'CWE-306', url: 'https://cwe.mitre.org/data/definitions/306.html' },
+    ],
+    async analyze(context) {
+        const findings = [];
+        const lines = context.sourceCode.split('\n');
+        const patterns = [
+            { pattern: /app\.(post|put|delete)\s*\(\s*['"`]\/admin/gi, type: 'Admin route without auth middleware', severity: 'critical' },
+            { pattern: /app\.(post|put|delete)\s*\(\s*['"`]\/api\/.*(?:delete|update|create)/gi, type: 'Critical API without auth', severity: 'high' },
+            { pattern: /router\.(post|put|delete)\s*\(\s*['"`]\//gi, type: 'State-changing route', severity: 'medium' },
+            { pattern: /\.destroy\s*\(\s*\)|\bdelete\s*\(/gi, type: 'Destructive operation', severity: 'medium' },
+            { pattern: /password.*reset|reset.*password/gi, type: 'Password reset function', severity: 'high' },
+        ];
+        for (let i = 0; i < lines.length; i++) {
+            for (const { pattern, type, severity } of patterns) {
+                pattern.lastIndex = 0;
+                if (pattern.test(lines[i])) {
+                    findings.push({
+                        id: `cwe-306-${findings.length + 1}`,
+                        ruleId: 'cwe-306-missing-auth-critical',
+                        severity,
+                        message: `Missing Auth - ${type}: Add authentication middleware`,
+                        location: { file: context.filePath, startLine: i + 1, endLine: i + 1 },
+                        cwe: ['306'],
+                        owasp: ['A07:2021'],
+                        suggestion: {
+                            description: 'Add authentication middleware',
+                            example: `// Add auth middleware
+app.delete('/admin/user/:id', authMiddleware, adminOnly, handler);`,
+                        },
+                    });
+                }
+            }
+        }
+        return findings;
+    },
+};
+export default cwe306MissingAuthCritical;
+//# sourceMappingURL=cwe-306-missing-auth-critical.js.map

package/dist/rules/cwe/cwe-306-missing-auth-critical.js.map

@@ -0,0 +1 @@
+{"version":3,"file":"cwe-306-missing-auth-critical.js","sourceRoot":"","sources":["../../../src/rules/cwe/cwe-306-missing-auth-critical.ts"],"names":[],"mappings":"AAAA;;;;GAIG;AAIH,MAAM,CAAC,MAAM,yBAAyB,GAAiB;IACrD,EAAE,EAAE,+BAA+B;IACnC,IAAI,EAAE,uDAAuD;IAC7D,WAAW,EAAE,mDAAmD;IAChE,eAAe,EAAE,UAAU;IAC3B,QAAQ,EAAE,gBAAgB;IAC1B,IAAI,EAAE,CAAC,KAAK,EAAE,gBAAgB,EAAE,UAAU,EAAE,UAAU,CAAC;IACvD,GAAG,EAAE,CAAC,KAAK,CAAC;IACZ,KAAK,EAAE,CAAC,UAAU,CAAC;IACnB,UAAU,EAAE;QACV,EAAE,KAAK,EAAE,SAAS,EAAE,GAAG,EAAE,iDAAiD,EAAE;KAC7E;IAED,KAAK,CAAC,OAAO,CAAC,OAAoB;QAChC,MAAM,QAAQ,GAAkB,EAAE,CAAC;QACnC,MAAM,KAAK,GAAG,OAAO,CAAC,UAAU,CAAC,KAAK,CAAC,IAAI,CAAC,CAAC;QAE7C,MAAM,QAAQ,GAAG;YACf,EAAE,OAAO,EAAE,8CAA8C,EAAE,IAAI,EAAE,qCAAqC,EAAE,QAAQ,EAAE,UAAmB,EAAE;YACvI,EAAE,OAAO,EAAE,wEAAwE,EAAE,IAAI,EAAE,2BAA2B,EAAE,QAAQ,EAAE,MAAe,EAAE;YACnJ,EAAE,OAAO,EAAE,4CAA4C,EAAE,IAAI,EAAE,sBAAsB,EAAE,QAAQ,EAAE,QAAiB,EAAE;YACpH,EAAE,OAAO,EAAE,qCAAqC,EAAE,IAAI,EAAE,uBAAuB,EAAE,QAAQ,EAAE,QAAiB,EAAE;YAC9G,EAAE,OAAO,EAAE,mCAAmC,EAAE,IAAI,EAAE,yBAAyB,EAAE,QAAQ,EAAE,MAAe,EAAE;SAC7G,CAAC;QAEF,KAAK,IAAI,CAAC,GAAG,CAAC,EAAE,CAAC,GAAG,KAAK,CAAC,MAAM,EAAE,CAAC,EAAE,EAAE,CAAC;YACtC,KAAK,MAAM,EAAE,OAAO,EAAE,IAAI,EAAE,QAAQ,EAAE,IAAI,QAAQ,EAAE,CAAC;gBACnD,OAAO,CAAC,SAAS,GAAG,CAAC,CAAC;gBACtB,IAAI,OAAO,CAAC,IAAI,CAAC,KAAK,CAAC,CAAC,CAAC,CAAC,EAAE,CAAC;oBAC3B,QAAQ,CAAC,IAAI,CAAC;wBACZ,EAAE,EAAE,WAAW,QAAQ,CAAC,MAAM,GAAG,CAAC,EAAE;wBACpC,MAAM,EAAE,+BAA+B;wBACvC,QAAQ;wBACR,OAAO,EAAE,kBAAkB,IAAI,iCAAiC;wBAChE,QAAQ,EAAE,EAAE,IAAI,EAAE,OAAO,CAAC,QAAQ,EAAE,SAAS,EAAE,CAAC,GAAG,CAAC,EAAE,OAAO,EAAE,CAAC,GAAG,CAAC,EAAE;wBACtE,GAAG,EAAE,CAAC,KAAK,CAAC;wBACZ,KAAK,EAAE,CAAC,UAAU,CAAC;wBACnB,UAAU,EAAE;4BACV,WAAW,EAAE,+BAA+B;4BAC5C,OAAO,EAAE;mEAC4C;yBACtD;qBACF,CAAC,CAAC;gBACL,CAAC;YACH,CAAC;QACH,CAAC;QACD,OAAO,QAAQ,CAAC;IAClB,CAAC;CACF,CAAC;AAEF,eAAe,yBAAyB,CAAC"}

package/dist/rules/cwe/cwe-352-csrf.d.ts

@@ -0,0 +1,9 @@
+/**
+ * @fileoverview CWE-352: Cross-Site Request Forgery (CSRF)
+ * @module @nahisaho/musubix-security/rules/cwe/cwe-352-csrf
+ * @trace TSK-RULE-005
+ */
+import type { SecurityRule } from '../types.js';
+export declare const cwe352CSRF: SecurityRule;
+export default cwe352CSRF;
+//# sourceMappingURL=cwe-352-csrf.d.ts.map

package/dist/rules/cwe/cwe-352-csrf.d.ts.map

@@ -0,0 +1 @@
+{"version":3,"file":"cwe-352-csrf.d.ts","sourceRoot":"","sources":["../../../src/rules/cwe/cwe-352-csrf.ts"],"names":[],"mappings":"AAAA;;;;GAIG;AAEH,OAAO,KAAK,EAAE,YAAY,EAA4B,MAAM,aAAa,CAAC;AAE1E,eAAO,MAAM,UAAU,EAAE,YA8CxB,CAAC;AAEF,eAAe,UAAU,CAAC"}