@oculum/scanner 1.0.0

package/src/__tests__/benchmark/fixtures/layer1/weak-crypto.ts

@@ -0,0 +1,197 @@
+/**
+ * Weak Cryptography Test Fixtures
+ * Tests for detecting insecure cryptographic algorithms and practices
+ */
+
+import type { TestGroup } from '../../types'
+
+export const weakCryptoTests: TestGroup = {
+  name: 'Weak Cryptography',
+  tier: 'A',
+  layer: 1,
+  description: 'Detection of weak hash algorithms, insecure ciphers, and poor cryptographic practices',
+  
+  truePositives: [
+    {
+      name: 'Weak Crypto - True Positives',
+      expectFindings: true,
+      expectedCategories: ['weak_crypto'],
+      description: 'Weak cryptographic patterns that MUST be detected',
+      file: {
+        path: 'src/utils/crypto.ts',
+        content: `
+import crypto from 'crypto'
+
+// MD5 for passwords (Critical)
+function hashPassword(password: string) {
+  return crypto.createHash('md5').update(password).digest('hex')
+}
+
+// SHA1 for security tokens (High)
+function generateToken(data: string) {
+  return crypto.createHash('sha1').update(data).digest('hex')
+}
+
+// Weak ciphers (High)
+function encryptData(data: string, key: string) {
+  const cipher = crypto.createCipher('des', key)
+  return cipher.update(data, 'utf8', 'hex') + cipher.final('hex')
+}
+
+// ECB mode (High - vulnerable to pattern analysis)
+function encryptECB(data: string, key: Buffer) {
+  const cipher = crypto.createCipheriv('aes-128-ecb', key, null)
+  return cipher.update(data, 'utf8', 'hex') + cipher.final('hex')
+}
+
+// RC4 (Critical - broken)
+function encryptRC4(data: string, key: string) {
+  const cipher = crypto.createCipher('rc4', key)
+  return cipher.update(data, 'utf8', 'hex')
+}
+
+// Math.random for security tokens (High)
+function generateSecureToken() {
+  return Math.random().toString(36).substring(2)
+}
+
+// Low PBKDF2 iterations (Medium)
+function deriveKey(password: string, salt: Buffer) {
+  return crypto.pbkdf2Sync(password, salt, 100, 32, 'sha256')
+}
+
+// Hardcoded IV (High)
+const STATIC_IV = Buffer.from('1234567890123456')
+function encryptWithStaticIV(data: string, key: Buffer) {
+  const cipher = crypto.createCipheriv('aes-256-cbc', key, STATIC_IV)
+  return cipher.update(data, 'utf8', 'hex') + cipher.final('hex')
+}
+`,
+        language: 'typescript',
+        size: 1500,
+      },
+    },
+    {
+      name: 'Weak Crypto - Insecure Password Hashing',
+      expectFindings: true,
+      expectedCategories: ['weak_crypto'],
+      description: 'Weak password hashing implementations',
+      file: {
+        path: 'src/auth/password.ts',
+        content: `
+import crypto from 'crypto'
+import bcrypt from 'bcrypt'
+
+// MD5 password hash (Critical)
+export function hashPasswordMD5(password: string): string {
+  return crypto.createHash('md5').update(password).digest('hex')
+}
+
+// SHA1 password hash (High)
+export function hashPasswordSHA1(password: string): string {
+  return crypto.createHash('sha1').update(password).digest('hex')
+}
+
+// Bcrypt with low rounds (Medium)
+export async function hashPasswordWeakBcrypt(password: string): Promise<string> {
+  return bcrypt.hash(password, 4) // Should be at least 10
+}
+
+// Unsalted hash (High)
+export function hashPasswordUnsalted(password: string): string {
+  return crypto.createHash('sha256').update(password).digest('hex')
+}
+`,
+        language: 'typescript',
+        size: 700,
+      },
+    },
+  ],
+  
+  falseNegatives: [
+    {
+      name: 'Weak Crypto - False Negatives',
+      expectFindings: false,
+      description: 'Secure cryptographic patterns that should NOT be flagged',
+      file: {
+        path: 'src/utils/secure-crypto.ts',
+        content: `
+import crypto from 'crypto'
+
+// MD5 for checksums (not security) - SAFE
+function generateChecksum(data: Buffer) {
+  return crypto.createHash('md5').update(data).digest('hex')
+}
+
+// SHA256 for passwords - SAFE
+function hashPasswordSecurely(password: string, salt: string) {
+  return crypto.createHash('sha256').update(password + salt).digest('hex')
+}
+
+// AES-256-GCM - SAFE
+function encryptSecurely(data: string, key: Buffer) {
+  const iv = crypto.randomBytes(16)
+  const cipher = crypto.createCipheriv('aes-256-gcm', key, iv)
+  const encrypted = cipher.update(data, 'utf8', 'hex') + cipher.final('hex')
+  const tag = cipher.getAuthTag()
+  return { encrypted, iv, tag }
+}
+
+// crypto.randomBytes for tokens - SAFE
+function generateSecureToken() {
+  return crypto.randomBytes(32).toString('hex')
+}
+
+// High PBKDF2 iterations - SAFE
+function deriveKeySecurely(password: string, salt: Buffer) {
+  return crypto.pbkdf2Sync(password, salt, 100000, 32, 'sha256')
+}
+
+// Random IV per encryption - SAFE
+function encryptWithRandomIV(data: string, key: Buffer) {
+  const iv = crypto.randomBytes(16)
+  const cipher = crypto.createCipheriv('aes-256-cbc', key, iv)
+  return { encrypted: cipher.update(data, 'utf8', 'hex') + cipher.final('hex'), iv }
+}
+`,
+        language: 'typescript',
+        size: 1200,
+      },
+    },
+    {
+      name: 'Weak Crypto - MD5 for Checksums',
+      expectFindings: false,
+      description: 'MD5 used for non-security checksums should not be flagged',
+      file: {
+        path: 'src/utils/checksum.ts',
+        content: `
+import crypto from 'crypto'
+import fs from 'fs'
+
+// MD5 checksum for file integrity (not security) - SAFE
+export function getFileChecksum(filePath: string): string {
+  const content = fs.readFileSync(filePath)
+  return crypto.createHash('md5').update(content).digest('hex')
+}
+
+// MD5 for etag generation - SAFE
+export function generateEtag(content: string): string {
+  return crypto.createHash('md5').update(content).digest('hex')
+}
+
+// MD5 for content fingerprint - SAFE
+export function contentFingerprint(data: Buffer): string {
+  return crypto.createHash('md5').update(data).digest('hex')
+}
+
+// MD5 for cache key - SAFE
+export function cacheKey(input: string): string {
+  return 'cache_' + crypto.createHash('md5').update(input).digest('hex')
+}
+`,
+        language: 'typescript',
+        size: 600,
+      },
+    },
+  ],
+}

package/src/__tests__/benchmark/fixtures/layer2/ai-agent-tools.ts

@@ -0,0 +1,170 @@
+/**
+ * AI Agent Tools Test Fixtures
+ * Tests for detecting overly permissive AI agent tool definitions
+ */
+
+import type { TestGroup } from '../../types'
+
+export const aiAgentToolsTests: TestGroup = {
+  name: 'AI Agent Tools',
+  tier: 'A',
+  layer: 2,
+  description: 'Detection of overly permissive AI agent tool definitions that could be abused',
+  
+  truePositives: [
+    {
+      name: 'AI Agent Tools - True Positives',
+      expectFindings: true,
+      expectedCategories: ['ai_overpermissive_tool'],
+      description: 'Overly permissive agent tool patterns that MUST be detected',
+      file: {
+        path: 'src/agents/overpermissive-tools.ts',
+        content: `
+import { z } from 'zod'
+import { exec } from 'child_process'
+import fs from 'fs'
+
+// Over-permissive file system tool - HIGH
+const fileSystemTool = {
+  name: 'file_system',
+  description: 'Read, write, or delete any file on the system',
+  schema: z.object({
+    operation: z.enum(['read', 'write', 'delete']),
+    path: z.string(),  // No path restrictions!
+    content: z.string().optional(),
+  }),
+  execute: async ({ operation, path, content }) => {
+    switch (operation) {
+      case 'read': return fs.readFileSync(path, 'utf-8')
+      case 'write': return fs.writeFileSync(path, content!)
+      case 'delete': return fs.unlinkSync(path)
+    }
+  }
+}
+
+// Unrestricted shell execution tool - CRITICAL
+const shellTool = {
+  name: 'shell',
+  description: 'Execute any shell command',
+  schema: z.object({
+    command: z.string(),  // No command restrictions!
+  }),
+  execute: async ({ command }) => {
+    return new Promise((resolve) => {
+      exec(command, (err, stdout, stderr) => {
+        resolve({ stdout, stderr })
+      })
+    })
+  }
+}
+
+// Network access without restrictions - HIGH
+const networkTool = {
+  name: 'http_request',
+  description: 'Make HTTP requests to any URL',
+  schema: z.object({
+    url: z.string(),  // No URL restrictions - SSRF risk!
+    method: z.string(),
+    body: z.any().optional(),
+  }),
+  execute: async ({ url, method, body }) => {
+    return fetch(url, { method, body: JSON.stringify(body) })
+  }
+}
+
+// Database access without user context - HIGH
+const databaseTool = {
+  name: 'database',
+  description: 'Execute SQL queries',
+  schema: z.object({
+    query: z.string(),  // Raw SQL - injection risk!
+  }),
+  execute: async ({ query }) => {
+    return db.query(query)  // No user_id scoping!
+  }
+}
+
+// Tool without proper authorization - MEDIUM
+const userDataTool = {
+  name: 'get_user_data',
+  description: 'Get any user data',
+  schema: z.object({
+    userId: z.string(),  // Can access ANY user!
+  }),
+  execute: async ({ userId }) => {
+    // No check that agent's user can access this userId
+    return db.user.findUnique({ where: { id: userId } })
+  }
+}
+`,
+        language: 'typescript',
+        size: 1800,
+      },
+    },
+  ],
+  
+  falseNegatives: [
+    {
+      name: 'AI Agent Tools - False Negatives',
+      expectFindings: false,
+      description: 'Properly scoped agent tool patterns that should NOT be flagged',
+      file: {
+        path: 'src/agents/safe-tools.ts',
+        content: `
+import { z } from 'zod'
+import fs from 'fs'
+
+// File system with path restrictions - SAFE
+const safeFileSystemTool = {
+  name: 'file_system',
+  description: 'Read files from the allowed directory',
+  schema: z.object({
+    filename: z.string().regex(/^[a-zA-Z0-9_-]+\\.(txt|json|md)$/),
+  }),
+  execute: async ({ filename }, { userId }) => {
+    // Scoped to user's directory
+    const safePath = \`/data/users/\${userId}/\${filename}\`
+    // No path traversal possible due to regex
+    return fs.readFileSync(safePath, 'utf-8')
+  }
+}
+
+// HTTP with URL allowlist - SAFE
+const safeNetworkTool = {
+  name: 'http_request',
+  description: 'Make HTTP requests to allowed APIs',
+  schema: z.object({
+    api: z.enum(['weather', 'news', 'stocks']),
+    params: z.record(z.string()),
+  }),
+  execute: async ({ api, params }) => {
+    const allowedUrls = {
+      weather: 'https://api.weather.gov',
+      news: 'https://newsapi.org',
+      stocks: 'https://api.stocks.com',
+    }
+    const url = new URL(allowedUrls[api])
+    Object.entries(params).forEach(([k, v]) => url.searchParams.set(k, v))
+    return fetch(url.toString())
+  }
+}
+
+// Database with user scoping - SAFE
+const safeDatabaseTool = {
+  name: 'get_my_data',
+  description: 'Get data belonging to the current user',
+  schema: z.object({
+    dataType: z.enum(['orders', 'settings', 'preferences']),
+  }),
+  execute: async ({ dataType }, { userId }) => {
+    // Always scoped to current user
+    return db[dataType].findMany({ where: { userId } })
+  }
+}
+`,
+        language: 'typescript',
+        size: 1400,
+      },
+    },
+  ],
+}