@nockdev/awf 6.2.0

package/.agent/skills/core/security/data/language-specific/cpp-security.yaml

@@ -0,0 +1,295 @@
+metadata:
+  skill: security
+  domain: cpp_security
+  version: 6.2.0
+  updated: '2026-02-05'
+  migrated_from: cpp-security.csv
+  patterns_count: 25
+  columns:
+  - id
+  - name
+  - severity
+  - category
+  - description
+  - detection_pattern
+  - fix_pattern
+  - cwe
+  - cve_reference
+  - example_vuln
+  - example_fix
+patterns:
+- id: CPP-01
+  name: Vector Out of Bounds
+  severity: HIGH
+  category: Memory
+  description: std::vector accessed without bounds check
+  detection_pattern: \\[.*\\](?!.*at\\(|check|bound)
+  fix_pattern: Use .at() for bounds checking or validate index first
+  cwe: CWE-125
+  cve_reference: n/a
+  example_vuln: return vec[user_index];
+  example_fix: return vec.at(user_index); // throws if OOB
+- id: CPP-02
+  name: Use After Move
+  severity: HIGH
+  category: Memory
+  description: Object used after std::move leaving it in unspecified state
+  detection_pattern: std::move\\(.*\\).*\\n.*\\1(?!.*=)
+  fix_pattern: Don't use object after move assign new value first
+  cwe: CWE-416
+  cve_reference: n/a
+  example_vuln: std::move(obj); obj.method();
+  example_fix: auto tmp = std::move(obj); // Don't use obj anymore
+- id: CPP-03
+  name: Smart Pointer Misuse
+  severity: HIGH
+  category: Memory
+  description: unique_ptr released or raw pointer from shared_ptr mismanaged
+  detection_pattern: (release|get)\\(\\)(?!.*delete|\\.use_count)
+  fix_pattern: Avoid raw pointers from smart pointers maintain ownership
+  cwe: CWE-416
+  cve_reference: n/a
+  example_vuln: int *raw = unique.release(); // Must manually delete
+  example_fix: auto raw = unique.get(); // Still managed by unique_ptr
+- id: CPP-04
+  name: Exception in Destructor
+  severity: CRITICAL
+  category: Error
+  description: Exception thrown in destructor can cause std::terminate
+  detection_pattern: ~\\w+.*throw(?!.*noexcept)
+  fix_pattern: Mark destructors noexcept or catch all exceptions
+  cwe: CWE-248
+  cve_reference: n/a
+  example_vuln: ~MyClass() { throw Error(); }
+  example_fix: ~MyClass() noexcept { try { cleanup(); } catch (...) {} }
+- id: CPP-05
+  name: Virtual Destructor Missing
+  severity: HIGH
+  category: Memory
+  description: Base class without virtual destructor causes memory leak
+  detection_pattern: class.*public.*\\{(?!.*virtual.*~)
+  fix_pattern: Add virtual destructor to polymorphic base classes
+  cwe: CWE-401
+  cve_reference: n/a
+  example_vuln: 'class Base { public: ~Base() {} };'
+  example_fix: 'class Base { public: virtual ~Base() = default; };'
+- id: CPP-06
+  name: Buffer Overflow memcpy
+  severity: CRITICAL
+  category: Memory
+  description: memcpy without size validation from destination
+  detection_pattern: memcpy\\(.*,.*,.*\\)(?!.*sizeof.*dest)
+  fix_pattern: Validate copy size against destination buffer size
+  cwe: CWE-120
+  cve_reference: CVE-2024-9400
+  example_vuln: memcpy(dest, src, src_len);
+  example_fix: if (src_len > sizeof(dest)) return; memcpy(dest, src, src_len);
+- id: CPP-07
+  name: Integer Conversion
+  severity: HIGH
+  category: Math
+  description: Implicit narrowing conversion loses data
+  detection_pattern: (int|short).*=.*(size_t|long long)(?!.*check)
+  fix_pattern: Use explicit cast with range check or same-size types
+  cwe: CWE-681
+  cve_reference: n/a
+  example_vuln: int size = container.size();
+  example_fix: if (container.size() > INT_MAX) throw; int size = static_cast<int>(container.size());
+- id: CPP-08
+  name: RTTI Exploitation
+  severity: HIGH
+  category: Memory
+  description: dynamic_cast or typeid on invalid object causes UB
+  detection_pattern: (dynamic_cast|typeid)\\(.*\\*(?!.*nullptr)
+  fix_pattern: Check pointer validity before RTTI operations
+  cwe: CWE-476
+  cve_reference: n/a
+  example_vuln: return typeid(*ptr).name();
+  example_fix: if (ptr == nullptr) throw; return typeid(*ptr).name();
+- id: CPP-09
+  name: Thread Data Race
+  severity: CRITICAL
+  category: Concurrency
+  description: Shared data accessed from threads without synchronization
+  detection_pattern: std::thread.*\\[\\&\\].*shared(?!.*mutex|atomic)
+  fix_pattern: Use mutex lock_guard or atomic for shared data
+  cwe: CWE-362
+  cve_reference: n/a
+  example_vuln: int shared = 0; std::thread([&]{ shared++; });
+  example_fix: std::atomic<int> shared{0}; std::thread([&]{ shared++; });
+- id: CPP-10
+  name: String View Dangling
+  severity: HIGH
+  category: Memory
+  description: string_view outlives source string causing dangling reference
+  detection_pattern: string_view.*=.*std::string\\((?!.*static|const)
+  fix_pattern: Ensure source string outlives string_view
+  cwe: CWE-416
+  cve_reference: n/a
+  example_vuln: string_view sv = std::string(\temp\");"
+  example_fix: std::string str = \persistent\"; string_view sv = str;"
+- id: CPP-11
+  name: Lambda Capture Reference
+  severity: HIGH
+  category: Memory
+  description: Lambda captures reference to local that goes out of scope
+  detection_pattern: \\[\\&.*\\].*return.*lambda|async.*\\[\\&\\]
+  fix_pattern: Capture by value or ensure lifetime extends beyond lambda use
+  cwe: CWE-416
+  cve_reference: n/a
+  example_vuln: auto f = [&local]{ return local; }; return f;
+  example_fix: auto f = [local]{ return local; }; return f; // Copy
+- id: CPP-12
+  name: Unordered Container Invalidation
+  severity: HIGH
+  category: Memory
+  description: Iterator used after container modification invalidates it
+  detection_pattern: (insert|erase).*\\n.*\\+\\+?it(?!.*=)
+  fix_pattern: Reassign iterator after modifying operation or use returned iterator
+  cwe: CWE-416
+  cve_reference: n/a
+  example_vuln: map.erase(it); ++it;
+  example_fix: it = map.erase(it); // erase returns next valid iterator
+- id: CPP-13
+  name: Regex Catastrophic Backtracking
+  severity: HIGH
+  category: DoS
+  description: User regex causes exponential time complexity ReDoS
+  detection_pattern: std::regex\\(.*input(?!.*timeout)
+  fix_pattern: Validate regex complexity or use bounded RE2 library
+  cwe: CWE-1333
+  cve_reference: n/a
+  example_vuln: std::regex re(user_pattern);
+  example_fix: // Use RE2 with complexity limits\nRE2::Options opts; opts.set_max_mem(1024);
+- id: CPP-14
+  name: Placement New Alignment
+  severity: CRITICAL
+  category: Memory
+  description: Placement new on misaligned memory causes UB
+  detection_pattern: new\\s*\\(.*\\)(?!.*alignas|alignof)
+  fix_pattern: Use alignas or std::aligned_storage for placement new
+  cwe: CWE-119
+  cve_reference: n/a
+  example_vuln: char buf[sizeof(T)]; new(buf) T();
+  example_fix: alignas(T) char buf[sizeof(T)]; new(buf) T();
+- id: CPP-15
+  name: Optional Unchecked Access
+  severity: HIGH
+  category: Memory
+  description: std::optional value accessed without checking has_value
+  detection_pattern: optional.*\\.value\\(\\)(?!.*has_value|if)
+  fix_pattern: Check has_value() or use value_or() before accessing
+  cwe: CWE-476
+  cve_reference: n/a
+  example_vuln: return opt.value();
+  example_fix: return opt.value_or(default_val); // Or check has_value()
+- id: CPP-16
+  name: Shared Ptr Race
+  severity: CRITICAL
+  category: Concurrency
+  description: Non-atomic shared_ptr operations across threads
+  detection_pattern: shared_ptr.*=.*(?!.*atomic|mutex).*thread
+  fix_pattern: Use atomic operations on shared_ptr across threads
+  cwe: CWE-362
+  cve_reference: n/a
+  example_vuln: std::thread([&]{ ptr = other_ptr; });
+  example_fix: std::atomic_store(&ptr, other_ptr);
+- id: CPP-17
+  name: VTable Corruption
+  severity: CRITICAL
+  category: Memory
+  description: Object memory overwritten before virtual call corrupts vtable
+  detection_pattern: memset\\(.*this|memcpy.*obj(?!.*POD)
+  fix_pattern: Never use memset/memcpy on objects with virtual functions
+  cwe: CWE-843
+  cve_reference: n/a
+  example_vuln: memset(this, 0, sizeof(*this)); method();
+  example_fix: // Use constructor initialization instead of memset
+- id: CPP-18
+  name: Throwing operator new
+  severity: HIGH
+  category: Error
+  description: Custom operator new throws but code expects nullptr
+  detection_pattern: new\\s*\\(std::nothrow\\)(?!.*nullptr_check)
+  fix_pattern: Use std::nothrow and check for nullptr or catch bad_alloc
+  cwe: CWE-252
+  cve_reference: n/a
+  example_vuln: int *p = new int[huge]; *p = 0;
+  example_fix: int *p = new(std::nothrow) int[huge]; if (!p) return;
+- id: CPP-19
+  name: Static Initialization Fiasco
+  severity: HIGH
+  category: Concurrency
+  description: Static object depends on another static in different TU
+  detection_pattern: static.*=.*other_static(?!.*Meyers)
+  fix_pattern: Use Meyers singleton or function-local static
+  cwe: CWE-362
+  cve_reference: n/a
+  example_vuln: static Foo foo(bar); // bar may not exist yet
+  example_fix: static Foo& getFoo() { static Foo foo; return foo; }
+- id: CPP-20
+  name: const_cast UB
+  severity: CRITICAL
+  category: Memory
+  description: const_cast used to modify const object causes UB
+  detection_pattern: const_cast.*=(?!.*mutable)
+  fix_pattern: Avoid modifying originally const data use mutable members
+  cwe: CWE-704
+  cve_reference: n/a
+  example_vuln: const_cast<int&>(const_val) = 42;
+  example_fix: // Use mutable member or redesign
+- id: CPP-21
+  name: Nullptr Arithmetic
+  severity: HIGH
+  category: Memory
+  description: Pointer arithmetic on nullptr causes UB
+  detection_pattern: nullptr.*\\+|\\+.*nullptr
+  fix_pattern: Check for nullptr before any pointer arithmetic
+  cwe: CWE-476
+  cve_reference: n/a
+  example_vuln: int *p = nullptr; int *q = p + 5;
+  example_fix: if (p == nullptr) return; int *q = p + 5;
+- id: CPP-22
+  name: Aliasing Violation Strict
+  severity: CRITICAL
+  category: Memory
+  description: Strict aliasing violated via pointer cast causing UB
+  detection_pattern: reinterpret_cast.*\\*(?!.*char|byte)
+  fix_pattern: Use memcpy for type punning or char* for aliasing
+  cwe: CWE-704
+  cve_reference: n/a
+  example_vuln: float f = *reinterpret_cast<float*>(&i);
+  example_fix: float f; memcpy(&f, &i, sizeof(f));
+- id: CPP-23
+  name: ODR Violation Inline
+  severity: HIGH
+  category: Link
+  description: Different definitions of inline function across TUs
+  detection_pattern: inline.*\\{.*#ifdef(?!.*same_def)
+  fix_pattern: Ensure inline functions have identical definitions in all TUs
+  cwe: CWE-704
+  cve_reference: n/a
+  example_vuln: // header.h has different inline body per TU
+  example_fix: // Move inline definition to single header
+- id: CPP-24
+  name: Dangling Span
+  severity: HIGH
+  category: Memory
+  description: std::span outlives underlying container
+  detection_pattern: span.*=.*vector\\{.*\\}|span.*temporary
+  fix_pattern: Ensure container outlives span make span const if temporary
+  cwe: CWE-416
+  cve_reference: n/a
+  example_vuln: std::span<int> s = std::vector<int>{1,2,3};
+  example_fix: std::vector<int> v{1,2,3}; std::span<int> s = v;
+- id: CPP-25
+  name: Exception Safety Guarantee
+  severity: HIGH
+  category: Error
+  description: Code lacks basic or strong exception safety guarantee
+  detection_pattern: throw.*(?!.*RAII|unique_ptr|lock_guard)
+  fix_pattern: Use RAII wrappers for exception safety
+  cwe: CWE-460
+  cve_reference: n/a
+  example_vuln: void f() { p = new T; throw E; }
+  example_fix: void f() { auto p = std::make_unique<T>(); throw E; }

package/.agent/skills/core/security/data/language-specific/csharp-security.yaml

@@ -0,0 +1,219 @@
+metadata:
+  skill: security
+  domain: csharp_security
+  version: 6.2.0
+  updated: '2026-02-05'
+  migrated_from: csharp-security.csv
+  patterns_count: 20
+  columns:
+  - id
+  - name
+  - severity
+  - category
+  - description
+  - detection_pattern
+  - fix_pattern
+  - cwe
+  - example_vuln
+  - example_fix
+patterns:
+- id: CS-01
+  name: SQL Injection
+  severity: CRITICAL
+  category: Injection
+  description: String concatenation in SQL queries
+  detection_pattern: (SqlCommand|ExecuteReader|ExecuteNonQuery).*\\+.*Request
+  fix_pattern: Use parameterized queries with SqlParameter
+  cwe: CWE-89
+  example_vuln: cmd.CommandText = 'SELECT * FROM Users WHERE id = ' + userId;
+  example_fix: cmd.CommandText = 'SELECT * FROM Users WHERE id = @id';\ncmd.Parameters.AddWithValue('@id', userId);
+- id: CS-02
+  name: XSS Via Response Write
+  severity: HIGH
+  category: XSS
+  description: User input written to response without encoding
+  detection_pattern: Response\\.Write.*Request(?!.*Encode|HtmlEncode)
+  fix_pattern: Use HttpUtility.HtmlEncode for all user output
+  cwe: CWE-79
+  example_vuln: Response.Write(Request['name']);
+  example_fix: Response.Write(HttpUtility.HtmlEncode(Request['name']));
+- id: CS-03
+  name: Insecure Deserialization
+  severity: CRITICAL
+  category: Deserialization
+  description: BinaryFormatter used for untrusted data
+  detection_pattern: BinaryFormatter|SoapFormatter|ObjectStateFormatter
+  fix_pattern: Use JSON or XML with type constraints avoid TypeNameHandling
+  cwe: CWE-502
+  example_vuln: var bf = new BinaryFormatter();\nbf.Deserialize(stream);
+  example_fix: var settings = new JsonSerializerSettings { TypeNameHandling = TypeNameHandling.None };
+- id: CS-04
+  name: Path Traversal
+  severity: HIGH
+  category: File
+  description: User input in file path without validation
+  detection_pattern: (File\\.Open|ReadAllText|WriteAllText).*Request
+  fix_pattern: Use Path.GetFullPath and validate against base directory
+  cwe: CWE-22
+  example_vuln: File.ReadAllText(basePath + Request['file']);
+  example_fix: var full = Path.GetFullPath(Path.Combine(basePath, file));\nif (!full.StartsWith(basePath)) throw new SecurityException();
+- id: CS-05
+  name: Command Injection
+  severity: CRITICAL
+  category: Injection
+  description: User input in Process.Start without sanitization
+  detection_pattern: Process\\.Start.*Request.*(?!.*AllowedCommands)
+  fix_pattern: Use argument arrays validate against allowlist
+  cwe: CWE-78
+  example_vuln: Process.Start('cmd', '/c ' + userCommand);
+  example_fix: // Only allow specific commands\nif (!AllowedCommands.Contains(cmd)) throw new SecurityException();
+- id: CS-06
+  name: Missing CSRF Token
+  severity: HIGH
+  category: CSRF
+  description: Form without AntiForgeryToken validation
+  detection_pattern: \\[HttpPost\\](?!.*ValidateAntiForgeryToken)
+  fix_pattern: Add [ValidateAntiForgeryToken] to all POST actions
+  cwe: CWE-352
+  example_vuln: '[HttpPost]\npublic IActionResult Transfer()'
+  example_fix: '[HttpPost]\n[ValidateAntiForgeryToken]\npublic IActionResult Transfer()'
+- id: CS-07
+  name: Weak Password Hashing
+  severity: HIGH
+  category: Crypto
+  description: Using MD5 SHA1 or custom hashing for passwords
+  detection_pattern: (MD5|SHA1)\\.Create|GetHashCode.*password
+  fix_pattern: Use Argon2 or PBKDF2 with sufficient iterations
+  cwe: CWE-327
+  example_vuln: var hash = MD5.Create().ComputeHash(password);
+  example_fix: var hash = Rfc2898DeriveBytes.Pbkdf2(password, salt, 100000, HashAlgorithmName.SHA256, 32);
+- id: CS-08
+  name: Hardcoded Connection String
+  severity: HIGH
+  category: Secrets
+  description: Database connection string in source code
+  detection_pattern: (Server=|Data Source=|Password=).*['\]"
+  fix_pattern: Use IConfiguration and secrets management
+  cwe: CWE-798
+  example_vuln: var conn = 'Server=db;Password=secret123';
+  example_fix: var conn = _configuration.GetConnectionString('Default');
+- id: CS-09
+  name: Missing Authorization
+  severity: HIGH
+  category: AuthZ
+  description: Controller action without authorization check
+  detection_pattern: \\[HttpGet\\](?!.*\\[Authorize\\]).*public.*IActionResult
+  fix_pattern: Add [Authorize] or policy-based authorization
+  cwe: CWE-284
+  example_vuln: '[HttpGet]\npublic IActionResult AdminPanel()'
+  example_fix: '[Authorize(Roles = ''Admin'')]\n[HttpGet]\npublic IActionResult AdminPanel()'
+- id: CS-10
+  name: Insecure Cookie
+  severity: HIGH
+  category: Session
+  description: Cookie without Secure HttpOnly SameSite flags
+  detection_pattern: new Cookie|Response\\.Cookies(?!.*Secure|HttpOnly)
+  fix_pattern: Set Secure HttpOnly SameSite=Strict on cookies
+  cwe: CWE-614
+  example_vuln: Response.Cookies.Append('session', token);
+  example_fix: Response.Cookies.Append('session', token, new CookieOptions { Secure = true, HttpOnly = true, SameSite = SameSiteMode.Strict });
+- id: CS-11
+  name: Regex DoS
+  severity: HIGH
+  category: DoS
+  description: Vulnerable regex pattern causing catastrophic backtracking
+  detection_pattern: new Regex\\(.*\\*\\+|\\+\\+|\\*\\?
+  fix_pattern: Use timeout on regex or simplify patterns
+  cwe: CWE-400
+  example_vuln: var regex = new Regex('(a+)+$');
+  example_fix: var regex = new Regex('a+$', RegexOptions.None, TimeSpan.FromSeconds(1));
+- id: CS-12
+  name: XML External Entity
+  severity: CRITICAL
+  category: Injection
+  description: XXE processing enabled in XML parser
+  detection_pattern: XmlReader\\.Create(?!.*DtdProcessing.*Prohibit)
+  fix_pattern: Disable DTD processing and external entities
+  cwe: CWE-611
+  example_vuln: var reader = XmlReader.Create(stream);
+  example_fix: var settings = new XmlReaderSettings { DtdProcessing = DtdProcessing.Prohibit, XmlResolver = null };
+- id: CS-13
+  name: LDAP Injection
+  severity: HIGH
+  category: Injection
+  description: User input in LDAP query without escaping
+  detection_pattern: DirectorySearcher.*Filter.*\\+.*Request
+  fix_pattern: Escape special LDAP characters in user input
+  cwe: CWE-90
+  example_vuln: searcher.Filter = '(uid=' + username + ')';
+  example_fix: searcher.Filter = '(uid=' + EscapeLdap(username) + ')';
+- id: CS-14
+  name: Open Redirect
+  severity: MEDIUM
+  category: Redirect
+  description: User input in redirect without validation
+  detection_pattern: Redirect(Request\\[|RedirectToAction.*Request
+  fix_pattern: Validate URLs against allowlist use LocalRedirect
+  cwe: CWE-601
+  example_vuln: return Redirect(Request['returnUrl']);
+  example_fix: if (!Url.IsLocalUrl(returnUrl)) returnUrl = '/';\nreturn LocalRedirect(returnUrl);
+- id: CS-15
+  name: Mass Assignment
+  severity: HIGH
+  category: Binding
+  description: Model binding without property whitelist
+  detection_pattern: \\[Bind\\](?!.*Include).*public.*IActionResult
+  fix_pattern: Use [Bind(Include = 'prop1,prop2')] or DTOs
+  cwe: CWE-915
+  example_vuln: public IActionResult Update(User user)
+  example_fix: public IActionResult Update([Bind(Include = 'Name,Email')] UserDto dto)
+- id: CS-16
+  name: Nullable Deref
+  severity: MEDIUM
+  category: NullRef
+  description: Nullable reference used without null check
+  detection_pattern: (\\?|null).*\\.(?!\\?)
+  fix_pattern: Use null-conditional operator or explicit checks
+  cwe: CWE-476
+  example_vuln: string name = user.Profile.Name;
+  example_fix: string? name = user?.Profile?.Name;
+- id: CS-17
+  name: Weak Random
+  severity: HIGH
+  category: Crypto
+  description: Using System.Random for security tokens
+  detection_pattern: new\\s+Random\\(\\)(?!.*crypto)
+  fix_pattern: Use RandomNumberGenerator for security values
+  cwe: CWE-338
+  example_vuln: var token = new Random().Next().ToString();
+  example_fix: var token = RandomNumberGenerator.GetBytes(32);
+- id: CS-18
+  name: Exposed Error Details
+  severity: MEDIUM
+  category: Info
+  description: Detailed errors exposed in production
+  detection_pattern: UseDeveloperExceptionPage(?!.*IsDevelopment)
+  fix_pattern: Only show detailed errors in development
+  cwe: CWE-209
+  example_vuln: app.UseDeveloperExceptionPage();
+  example_fix: if (env.IsDevelopment()) app.UseDeveloperExceptionPage();
+- id: CS-19
+  name: Unvalidated File Upload
+  severity: HIGH
+  category: Upload
+  description: File upload without type and size validation
+  detection_pattern: IFormFile(?!.*ContentType|Length.*check)
+  fix_pattern: Validate file type size and scan for malware
+  cwe: CWE-434
+  example_vuln: await file.CopyToAsync(stream);
+  example_fix: if (file.Length > 10_000_000 || !AllowedTypes.Contains(file.ContentType)) throw new ValidationException();
+- id: CS-20
+  name: Logging Sensitive Data
+  severity: MEDIUM
+  category: Privacy
+  description: Passwords or tokens in log output
+  detection_pattern: _logger\\.(Log|Information|Debug).*password|token|secret
+  fix_pattern: Never log sensitive data use structured logging
+  cwe: CWE-532
+  example_vuln: '_logger.LogInformation($''User {email} token: {token}'');'
+  example_fix: _logger.LogInformation('User {Email} logged in', email); // No token