@nockdev/awf 6.2.0

package/.agent/skills/core/security/data/api-security.yaml

@@ -0,0 +1,230 @@
+metadata:
+  skill: security
+  domain: api_security
+  version: 6.2.0
+  updated: '2026-02-05'
+  migrated_from: api-security.csv
+  patterns_count: 20
+  columns:
+  - id
+  - name
+  - severity
+  - category
+  - description
+  - detection_pattern
+  - fix_pattern
+  - languages
+  - owasp_api_id
+  - example_vuln
+  - example_fix
+patterns:
+- id: API-01
+  name: Broken Object Level Authorization
+  severity: CRITICAL
+  category: AuthZ
+  description: 'Accessing objects by ID without ownership verification - BOLA #1 API vuln'
+  detection_pattern: (findById|getById|params\\.id)(?!.*owner|authorize)
+  fix_pattern: Always verify object ownership not just authentication
+  languages: all
+  owasp_api_id: API1:2023
+  example_vuln: User.findById(req.params.id)
+  example_fix: const user = await User.findById(req.params.id)\nif (user.ownerId !== req.user.id) throw 403
+- id: API-02
+  name: Broken Authentication
+  severity: CRITICAL
+  category: AuthN
+  description: Weak authentication mechanisms or missing validation
+  detection_pattern: (jwt\\.decode|verify.*none|algorithm.*HS256)(?!.*RS)
+  fix_pattern: Use strong authentication with proper JWT validation
+  languages: all
+  owasp_api_id: API2:2023
+  example_vuln: jwt.decode(token) // No verification
+  example_fix: 'jwt.verify(token, publicKey, { algorithms: [''RS256''] })'
+- id: API-03
+  name: Broken Object Property Authorization
+  severity: HIGH
+  category: AuthZ
+  description: Mass assignment allowing modification of protected fields
+  detection_pattern: (Object\\.assign|spread.*req\\.body|update.*req\\.body)
+  fix_pattern: Use allowlist for updatable fields block sensitive
+  languages: all
+  owasp_api_id: API3:2023
+  example_vuln: User.update(req.body) // All fields
+  example_fix: const allowed = pick(req.body, ['name', 'email'])\nUser.update(allowed)
+- id: API-04
+  name: Unrestricted Resource Consumption
+  severity: HIGH
+  category: DoS
+  description: No limits on requests data size or computation
+  detection_pattern: (express|fastify|gin)(?!.*rateLimit|limit)
+  fix_pattern: Implement rate limiting pagination and size limits
+  languages: all
+  owasp_api_id: API4:2023
+  example_vuln: app.post('/search', handler)
+  example_fix: 'app.post(''/search'', rateLimit({ max: 100 }), paginate({ max: 50 }), handler)'
+- id: API-05
+  name: Broken Function Level Authorization
+  severity: CRITICAL
+  category: AuthZ
+  description: Admin functions accessible without proper role checks
+  detection_pattern: (admin|delete|update)(?!.*role|permission|isAdmin)
+  fix_pattern: Verify role permissions for each function
+  languages: all
+  owasp_api_id: API5:2023
+  example_vuln: app.delete('/users/:id', deleteUser)
+  example_fix: app.delete('/users/:id', requireRole('admin'), deleteUser)
+- id: API-06
+  name: Unrestricted Access to Sensitive Flows
+  severity: HIGH
+  category: Business
+  description: No protection against automation of critical flows
+  detection_pattern: (transfer|purchase|vote)(?!.*captcha|rateLimit)
+  fix_pattern: Add bot protection rate limiting for sensitive flows
+  languages: all
+  owasp_api_id: API6:2023
+  example_vuln: app.post('/transfer', transferFunds)
+  example_fix: 'app.post(''/transfer'', captcha(), rateLimit({ max: 5 }), transferFunds)'
+- id: API-07
+  name: Server Side Request Forgery
+  severity: CRITICAL
+  category: SSRF
+  description: User-controlled URLs fetched by server without validation
+  detection_pattern: (fetch|axios|http\\.get|urllib)\\(.*req\\.
+  fix_pattern: Validate URLs against allowlist block internal IPs
+  languages: all
+  owasp_api_id: API7:2023
+  example_vuln: fetch(req.body.webhookUrl)
+  example_fix: const url = new URL(req.body.webhookUrl)\nif (!ALLOWED_HOSTS.includes(url.host)) throw 400
+- id: API-08
+  name: Security Misconfiguration
+  severity: MEDIUM
+  category: Config
+  description: Insecure default configs exposed endpoints or verbose errors
+  detection_pattern: (debug.*true|stackTrace|X-Powered-By)
+  fix_pattern: Harden configuration disable debug in production
+  languages: all
+  owasp_api_id: API8:2023
+  example_vuln: 'app.use(errorHandler({ stack: true }))'
+  example_fix: 'app.use(errorHandler({ stack: false, log: true }))'
+- id: API-09
+  name: Improper Inventory Management
+  severity: MEDIUM
+  category: Ops
+  description: Undocumented or shadow APIs without proper tracking
+  detection_pattern: (/api/v1|/api/v2|/internal)(?!.*documented)
+  fix_pattern: Maintain API inventory deprecate old versions
+  languages: all
+  owasp_api_id: API9:2023
+  example_vuln: // Multiple undocumented endpoints
+  example_fix: // Document all APIs in OpenAPI spec\n// Deprecate old versions with sunset headers
+- id: API-10
+  name: Unsafe Consumption of APIs
+  severity: HIGH
+  category: Integration
+  description: Blindly trusting third-party API responses
+  detection_pattern: (axios|fetch).*then.*res\\.data(?!.*validat)
+  fix_pattern: Validate and sanitize all third-party responses
+  languages: all
+  owasp_api_id: API10:2023
+  example_vuln: const data = await thirdParty.getData()\nprocess(data)
+  example_fix: const data = await thirdParty.getData()\nconst validated = schema.parse(data)\nprocess(validated)
+- id: API-11
+  name: JWT Algorithm Confusion
+  severity: CRITICAL
+  category: AuthN
+  description: JWT accepts none or symmetric when expecting asymmetric
+  detection_pattern: (algorithm.*none|HS256.*RS256|algorithms.*\\[)
+  fix_pattern: Explicitly specify allowed algorithms as RS256 only
+  languages: all
+  example_vuln: jwt.verify(token, key) // Any algorithm
+  example_fix: 'jwt.verify(token, publicKey, { algorithms: [''RS256''] })'
+- id: API-12
+  name: JWT Secret Weakness
+  severity: CRITICAL
+  category: AuthN
+  description: Weak or default JWT signing secret
+  detection_pattern: (jwt.*secret.*=.*['\]|process\\.env\\.JWT(?!.*256bit))"
+  fix_pattern: Use cryptographically strong secrets minimum 256 bits
+  languages: all
+  example_vuln: const secret = 'mysecret'
+  example_fix: const secret = crypto.randomBytes(32).toString('hex')
+- id: API-13
+  name: Missing Rate Limit Headers
+  severity: LOW
+  category: UX
+  description: API does not return rate limit status headers
+  detection_pattern: response(?!.*X-RateLimit|rateLimit)
+  fix_pattern: Return X-RateLimit-Limit Remaining Reset headers
+  languages: all
+  example_vuln: res.json(data)
+  example_fix: res.set('X-RateLimit-Limit', 100)\nres.set('X-RateLimit-Remaining', remaining)\nres.json(data)
+- id: API-14
+  name: Overly Permissive CORS
+  severity: HIGH
+  category: AuthZ
+  description: CORS allows any origin or credentials with wildcard
+  detection_pattern: Access-Control-Allow-Origin.*\\*.*credentials|reflect.*origin
+  fix_pattern: Use specific origin allowlist not wildcard with credentials
+  languages: all
+  example_vuln: res.header('Access-Control-Allow-Origin', '*')
+  example_fix: const allowed = ['https://app.example.com']\nif (allowed.includes(origin)) res.header('ACAO', origin)
+- id: API-15
+  name: Missing Pagination
+  severity: MEDIUM
+  category: DoS
+  description: Endpoints return unbounded result sets
+  detection_pattern: (find|list|getAll)(?!.*limit|paginate)
+  fix_pattern: Implement mandatory pagination with max limit
+  languages: all
+  example_vuln: return User.find({})
+  example_fix: return User.find({}).limit(Math.min(req.query.limit, 100))
+- id: API-16
+  name: Verbose Error Messages
+  severity: MEDIUM
+  category: Info
+  description: Errors expose internal details stack traces or queries
+  detection_pattern: (error.*stack|SQLException|throw.*new Error)
+  fix_pattern: Return generic errors log details server-side
+  languages: all
+  example_vuln: 'res.status(500).json({ error: err.stack })'
+  example_fix: 'logger.error(err)\nres.status(500).json({ error: ''Internal server error'' })'
+- id: API-17
+  name: Missing Request Validation
+  severity: HIGH
+  category: Input
+  description: API accepts unvalidated request bodies
+  detection_pattern: (req\\.body|req\\.query)(?!.*valid|parse|schema)
+  fix_pattern: Validate all inputs with schema validation Zod or Joi
+  languages: all
+  example_vuln: const data = req.body
+  example_fix: const data = requestSchema.parse(req.body)
+- id: API-18
+  name: Insecure Direct Object Reference
+  severity: HIGH
+  category: AuthZ
+  description: Object references exposed without access control - IDOR
+  detection_pattern: (id|uuid|ref).*=.*req\\.(params|query)(?!.*authorize)
+  fix_pattern: Verify authorization for each object access
+  languages: all
+  example_vuln: const doc = await Doc.findById(req.params.id)
+  example_fix: 'const doc = await Doc.findOne({ _id: req.params.id, userId: req.user.id })'
+- id: API-19
+  name: Missing API Versioning
+  severity: LOW
+  category: Ops
+  description: API lacks versioning strategy for breaking changes
+  detection_pattern: (/api/)(?!.*v\\d|version)
+  fix_pattern: Implement versioning via URL path or headers
+  languages: all
+  example_vuln: app.use('/api', router)
+  example_fix: app.use('/api/v1', routerV1)\napp.use('/api/v2', routerV2)
+- id: API-20
+  name: Excessive Data Exposure
+  severity: HIGH
+  category: Privacy
+  description: API returns more data than client needs
+  detection_pattern: (select.*\\*|find\\(\\)|JSON\\.stringify.*user)
+  fix_pattern: Return only required fields use DTOs
+  languages: all
+  example_vuln: res.json(user) // All fields including password hash
+  example_fix: res.json(pick(user, ['id', 'name', 'email']))

package/.agent/skills/core/security/data/auth-patterns.yaml

@@ -0,0 +1,195 @@
+metadata:
+  skill: security
+  domain: auth_patterns
+  version: 6.2.0
+  updated: '2026-02-05'
+  migrated_from: auth-patterns.csv
+  patterns_count: 15
+  columns:
+  - pattern
+  - category
+  - description
+  - languages
+  - use_case
+  - example_code
+  - anti_pattern
+patterns:
+- id: item_001
+  pattern: JWT_VERIFICATION
+  category: AuthN
+  description: Verify JWT signature and claims before trusting payload
+  languages:
+  - typescript
+  - go
+  - python
+  - java
+  use_case: API authentication, stateless sessions
+  example_code: '// TypeScript (jose)
+
+    import { jwtVerify } from ''jose'';
+
+    const { payload } = await jwtVerify(token, secretKey);'
+  anti_pattern: '// NEVER: Skip verification
+
+    const payload = JSON.parse(atob(token.split(''.'')[1]))'
+- id: item_002
+  pattern: JWT_EXPIRY
+  category: AuthN
+  description: Always set and check token expiration (exp claim)
+  languages: all
+  use_case: Short-lived access tokens, refresh token rotation
+  example_code: '// Issue with expiry
+
+    jwt.sign({ userId }, secret, { expiresIn: ''15m'' })
+
+    // Verify checks exp automatically'
+  anti_pattern: '// NEVER: No expiry
+
+    jwt.sign({ userId }, secret) // Token valid forever'
+- id: item_003
+  pattern: PASSWORD_BCRYPT
+  category: AuthN
+  description: Hash passwords with bcrypt cost factor 12+ or argon2id
+  languages: all
+  use_case: User registration, password storage
+  example_code: '// bcrypt
+
+    const hash = await bcrypt.hash(password, 12);
+
+    const valid = await bcrypt.compare(input, hash);'
+  anti_pattern: '// NEVER: MD5/SHA1/plaintext
+
+    const hash = crypto.createHash(''md5'').update(password)'
+- id: item_004
+  pattern: OAUTH2_PKCE
+  category: AuthN
+  description: Use PKCE for public clients (SPA, mobile)
+  languages:
+  - typescript
+  - swift
+  - kotlin
+  use_case: OAuth2 authorization code flow
+  example_code: '// Generate code verifier + challenge
+
+    const verifier = generateCodeVerifier();
+
+    const challenge = sha256(verifier);'
+  anti_pattern: '// NEVER: Implicit flow for new apps
+
+    response_type=token // Deprecated'
+- id: item_005
+  pattern: MFA_TOTP
+  category: AuthN
+  description: Implement TOTP-based MFA with backup codes
+  languages: all
+  use_case: Two-factor authentication
+  example_code: '// Verify TOTP
+
+    import { authenticator } from ''otplib'';
+
+    const isValid = authenticator.verify({ token, secret });'
+  anti_pattern: '// NEVER: SMS-only MFA (SIM swap vulnerable)'
+- id: item_006
+  pattern: SESSION_HTTPONLY
+  category: Session
+  description: Set HttpOnly, Secure, SameSite on session cookies
+  languages: all
+  use_case: Web session management
+  example_code: 'Set-Cookie: sessionId=xxx; HttpOnly; Secure; SameSite=Strict; Path=/'
+  anti_pattern: '// NEVER: Accessible to JS
+
+    Set-Cookie: sessionId=xxx'
+- id: item_007
+  pattern: SESSION_ROTATION
+  category: Session
+  description: Regenerate session ID after login to prevent fixation
+  languages: all
+  use_case: Login flow
+  example_code: '// After successful auth
+
+    req.session.regenerate(() => { /* assign user */ });'
+  anti_pattern: '// NEVER: Keep same session ID'
+- id: item_008
+  pattern: RATE_LIMITING
+  category: AuthN
+  description: Implement rate limiting on auth endpoints
+  languages: all
+  use_case: Login, password reset, API
+  example_code: '// express-rate-limit
+
+    const limiter = rateLimit({ windowMs: 15*60*1000, max: 5 });
+
+    app.use(''/login'', limiter);'
+  anti_pattern: '// NEVER: Unlimited attempts'
+- id: item_009
+  pattern: API_KEY_ROTATION
+  category: AuthZ
+  description: Support API key rotation without downtime
+  languages: all
+  use_case: API authentication
+  example_code: '// Accept multiple keys during rotation
+
+    const validKeys = [currentKey, previousKey];
+
+    if (!validKeys.includes(providedKey)) throw 401;'
+  anti_pattern: '// NEVER: Single key, no rotation plan'
+- id: item_010
+  pattern: RBAC_MIDDLEWARE
+  category: AuthZ
+  description: Check permissions at middleware level, not in handlers
+  languages: all
+  use_case: Role-based access control
+  example_code: "// Middleware pattern\nconst requireRole = (role) => (req, res, next) => {\n  if (!req.user.roles.includes(role)) return res.status(403);\n  next();\n};"
+  anti_pattern: '// NEVER: Check roles in each handler manually'
+- id: item_011
+  pattern: CORS_ALLOWLIST
+  category: AuthZ
+  description: Whitelist specific origins, not wildcard
+  languages: all
+  use_case: Cross-origin API access
+  example_code: '// Specific origins
+
+    cors({ origin: [''https://app.example.com''] })'
+  anti_pattern: '// NEVER: Allow all
+
+    cors({ origin: ''*'', credentials: true }) // Dangerous combo'
+- id: item_012
+  pattern: INPUT_SANITIZATION
+  category: Validation
+  description: Sanitize all user input before use
+  languages: all
+  use_case: XSS prevention, injection prevention
+  example_code: '// DOMPurify for HTML
+
+    const clean = DOMPurify.sanitize(userHtml);
+
+    // Zod for data
+
+    const data = schema.parse(req.body);'
+  anti_pattern: '// NEVER: Trust user input directly'
+- id: item_013
+  pattern: CSP_HEADER
+  category: Headers
+  description: Content-Security-Policy to prevent XSS
+  languages: all
+  use_case: Web applications
+  example_code: 'Content-Security-Policy: default-src ''self''; script-src ''self''; style-src ''self'''
+  anti_pattern: '// NEVER: No CSP or unsafe-inline everywhere'
+- id: item_014
+  pattern: HSTS_HEADER
+  category: Headers
+  description: Strict-Transport-Security for HTTPS enforcement
+  languages: all
+  use_case: All production sites
+  example_code: 'Strict-Transport-Security: max-age=31536000; includeSubDomains; preload'
+  anti_pattern: '// NEVER: Allow HTTP in production'
+- id: item_015
+  pattern: X_FRAME_OPTIONS
+  category: Headers
+  description: Prevent clickjacking with frame-ancestors
+  languages: all
+  use_case: Web applications
+  example_code: 'X-Frame-Options: DENY
+
+    // or CSP: frame-ancestors ''none'''
+  anti_pattern: '// NEVER: Allow any framing'