@oculum/scanner 1.0.0

package/src/__tests__/benchmark/fixtures/layer2/dangerous-functions.ts

@@ -0,0 +1,246 @@
+/**
+ * Dangerous Functions Test Fixtures
+ * Tests for detecting eval, exec, SQL injection, XSS, and other dangerous function usage
+ */
+
+import type { TestGroup } from '../../types'
+
+export const dangerousFunctionsTests: TestGroup = {
+  name: 'Dangerous Functions',
+  tier: 'A',
+  layer: 2,
+  description: 'Detection of dangerous function calls that can lead to code injection, SQL injection, and XSS',
+  
+  truePositives: [
+    {
+      name: 'Dangerous Functions - True Positives',
+      expectFindings: true,
+      expectedCategories: ['dangerous_function'],
+      description: 'Dangerous function patterns that MUST be detected',
+      file: {
+        path: 'src/api/execute.ts',
+        content: `
+import { exec, execSync, spawn } from 'child_process'
+
+// eval() with user input (Critical)
+export function executeUserCode(userCode: string) {
+  return eval(userCode)
+}
+
+// Function constructor (Critical)
+export function createDynamicFunction(code: string) {
+  return new Function('input', code)
+}
+
+// exec() with user input (Critical - Command Injection)
+export function runCommand(userCommand: string) {
+  exec(userCommand, (error, stdout) => {
+    console.log(stdout)
+  })
+}
+
+// execSync with template literal (Critical)
+export function runUserScript(filename: string) {
+  return execSync(\`node \${filename}\`)
+}
+
+// spawn with user-controlled args (High)
+export function spawnProcess(program: string, args: string[]) {
+  return spawn(program, args)
+}
+
+// SQL injection via string concatenation (Critical)
+export async function getUser(userId: string) {
+  const query = "SELECT * FROM users WHERE id = '" + userId + "'"
+  return db.query(query)
+}
+
+// SQL injection via template literal (Critical)
+export async function searchUsers(searchTerm: string) {
+  return db.query(\`SELECT * FROM users WHERE name LIKE '%\${searchTerm}%'\`)
+}
+
+// innerHTML with user data (High - XSS)
+export function renderUserContent(userHtml: string) {
+  document.getElementById('content').innerHTML = userHtml
+}
+
+// dangerouslySetInnerHTML with user data (High - XSS in React)
+export function UserContent({ html }: { html: string }) {
+  return <div dangerouslySetInnerHTML={{ __html: html }} />
+}
+
+// Unvalidated redirect (Medium - Open Redirect)
+export function redirect(url: string) {
+  window.location.href = url
+}
+
+// setTimeout with string (Medium)
+export function delayedExec(code: string) {
+  setTimeout(code, 1000)
+}
+
+// setInterval with string (Medium)
+export function repeatedExec(code: string) {
+  setInterval(code, 1000)
+}
+`,
+        language: 'typescript',
+        size: 1800,
+      },
+    },
+    {
+      name: 'Dangerous Functions - SQL Injection Variants',
+      expectFindings: true,
+      expectedCategories: ['dangerous_function'],
+      description: 'Various SQL injection patterns',
+      file: {
+        path: 'src/api/queries.ts',
+        content: `
+// String concatenation SQL injection
+export async function getUserByEmail(email: string) {
+  return db.query("SELECT * FROM users WHERE email = '" + email + "'")
+}
+
+// Template literal SQL injection
+export async function searchProducts(term: string) {
+  return db.query(\`SELECT * FROM products WHERE name LIKE '%\${term}%'\`)
+}
+
+// Multi-line SQL with injection
+export async function getOrders(userId: string, status: string) {
+  const query = \`
+    SELECT * FROM orders 
+    WHERE user_id = '\${userId}'
+    AND status = '\${status}'
+  \`
+  return db.query(query)
+}
+
+// UPDATE statement injection
+export async function updateUser(userId: string, name: string) {
+  return db.query(\`UPDATE users SET name = '\${name}' WHERE id = '\${userId}'\`)
+}
+
+// DELETE statement injection
+export async function deleteUser(userId: string) {
+  return db.query("DELETE FROM users WHERE id = '" + userId + "'")
+}
+`,
+        language: 'typescript',
+        size: 900,
+      },
+    },
+  ],
+  
+  falseNegatives: [
+    {
+      name: 'Dangerous Functions - False Negatives',
+      expectFindings: false,
+      description: 'Safe function patterns that should NOT be flagged',
+      allowedInfoFindings: [
+        {
+          category: 'dangerous_function',
+          maxCount: 6,
+          reason: 'Static eval, hardcoded exec, and JSON.parse with safe sources generate info-level findings',
+        },
+      ],
+      file: {
+        path: 'src/api/safe-execute.ts',
+        content: `
+import { execSync } from 'child_process'
+
+// Static eval (no user input) - SAFE
+const config = eval('({ mode: "production" })')
+
+// exec with hardcoded command - SAFE
+function checkVersion() {
+  return execSync('node --version').toString()
+}
+
+// Parameterized SQL queries - SAFE
+async function getUser(userId: string) {
+  return db.query('SELECT * FROM users WHERE id = $1', [userId])
+}
+
+// ORM queries - SAFE
+async function findUser(userId: string) {
+  return prisma.user.findUnique({ where: { id: userId } })
+}
+
+// innerHTML with static content - SAFE
+function setStaticContent() {
+  document.getElementById('footer').innerHTML = '<p>Copyright 2024</p>'
+}
+
+// React JSX (auto-escaped) - SAFE
+function UserName({ name }: { name: string }) {
+  return <div>{name}</div>
+}
+
+// dangerouslySetInnerHTML with sanitized content - SAFE
+import DOMPurify from 'dompurify'
+function SafeUserContent({ html }: { html: string }) {
+  const clean = DOMPurify.sanitize(html)
+  return <div dangerouslySetInnerHTML={{ __html: clean }} />
+}
+
+// JSON.parse from own database - SAFE
+async function getConfig() {
+  const row = await db.query('SELECT config FROM settings WHERE id = 1')
+  return JSON.parse(row.config)
+}
+
+// JSON.parse with try-catch - SAFE
+function parseConfig(data: string) {
+  try {
+    return JSON.parse(data)
+  } catch {
+    return {}
+  }
+}
+`,
+        language: 'typescript',
+        size: 1400,
+      },
+    },
+    {
+      name: 'Dangerous Functions - Parameterized Queries',
+      expectFindings: false,
+      description: 'Properly parameterized SQL that should not be flagged',
+      file: {
+        path: 'src/api/safe-queries.ts',
+        content: `
+// Parameterized queries - SAFE
+async function getUserById(id: string) {
+  return db.query('SELECT * FROM users WHERE id = $1', [id])
+}
+
+// Named parameters - SAFE
+async function findByEmail(email: string) {
+  return db.query('SELECT * FROM users WHERE email = :email', { email })
+}
+
+// Prisma ORM - SAFE
+async function getOrders(userId: string) {
+  return prisma.order.findMany({
+    where: { userId }
+  })
+}
+
+// Drizzle ORM - SAFE
+async function getProducts(category: string) {
+  return db.select().from(products).where(eq(products.category, category))
+}
+
+// Knex query builder - SAFE
+async function searchUsers(name: string) {
+  return knex('users').where('name', 'like', \`%\${name}%\`)
+}
+`,
+        language: 'typescript',
+        size: 700,
+      },
+    },
+  ],
+}

package/src/__tests__/benchmark/fixtures/layer2/data-exposure.ts

@@ -0,0 +1,168 @@
+/**
+ * Data Exposure Test Fixtures
+ * Tests for detecting sensitive data exposure in logs, responses, and error handling
+ */
+
+import type { TestGroup } from '../../types'
+
+export const dataExposureTests: TestGroup = {
+  name: 'Data Exposure',
+  tier: 'B',
+  layer: 2,
+  description: 'Detection of sensitive data exposure in logs, responses, and error handling',
+  
+  truePositives: [
+    {
+      name: 'Data Exposure - True Positives',
+      expectFindings: true,
+      expectedCategories: ['data_exposure'],
+      description: 'Data exposure patterns that MUST be detected',
+      file: {
+        path: 'src/api/users/route.ts',
+        content: `
+import { NextResponse } from 'next/server'
+
+// Full error stack in response - HIGH
+export async function GET() {
+  try {
+    const users = await db.user.findMany()
+    return NextResponse.json(users)
+  } catch (error) {
+    return NextResponse.json({
+      error: error.stack,  // Stack trace exposed!
+      details: error
+    }, { status: 500 })
+  }
+}
+
+// Logging passwords - CRITICAL
+export async function POST(request: Request) {
+  const { email, password } = await request.json()
+  console.log('Login attempt:', email, password)  // Password logged!
+
+  return authenticate(email, password)
+}
+
+// Logging API keys - HIGH
+export async function useKey(apiKey: string) {
+  console.log('Using API key:', apiKey)  // Secret logged!
+  return callAPI(apiKey)
+}
+
+// Returning full user object with sensitive fields - MEDIUM
+export async function getUser(userId: string) {
+  const user = await db.user.findUnique({
+    where: { id: userId },
+    include: {
+      apiKeys: true,    // API keys exposed!
+      sessions: true,   // Sessions exposed!
+    }
+  })
+  return NextResponse.json(user)  // No field filtering!
+}
+
+// Debug endpoint in production - HIGH
+export async function DEBUG() {
+  return NextResponse.json({
+    env: process.env,  // All env vars exposed!
+    config: serverConfig,
+  })
+}
+
+// Verbose internal error details - MEDIUM
+export async function handleError(error: any) {
+  return NextResponse.json({
+    error: error.message,
+    internalCode: error.code,
+    query: error.query,  // SQL query exposed!
+    trace: error.trace,
+  })
+}
+`,
+        language: 'typescript',
+        size: 1400,
+      },
+    },
+  ],
+  
+  falseNegatives: [
+    {
+      name: 'Data Exposure - False Negatives',
+      expectFindings: false,
+      description: 'Safe error handling patterns that should NOT be flagged',
+      allowedInfoFindings: [
+        {
+          category: 'ai_pattern',
+          maxCount: 2,
+          reason: 'AI boilerplate error messages are info-level findings',
+        },
+        {
+          category: 'data_exposure',
+          maxCount: 2,
+          reason: 'Exposing filtered user object is low/info-level, not a security issue',
+        },
+      ],
+      file: {
+        path: 'src/api/safe-handlers.ts',
+        content: `
+import { NextResponse } from 'next/server'
+
+// error.message only - SAFE (recommended pattern)
+export async function GET() {
+  try {
+    const data = await fetchData()
+    return NextResponse.json(data)
+  } catch (error) {
+    console.error('Error:', error)  // Logged for debugging - SAFE
+    return NextResponse.json({
+      error: error.message  // Only message, not stack - SAFE
+    }, { status: 500 })
+  }
+}
+
+// Static error message - SAFE
+export async function POST() {
+  try {
+    await doSomething()
+  } catch {
+    return NextResponse.json({
+      error: 'An error occurred'  // Generic message - SAFE
+    }, { status: 500 })
+  }
+}
+
+// Logging non-sensitive data - SAFE
+export async function logRequest(request: Request) {
+  const { method, url } = request
+  console.log(\`\${method} \${url}\`)  // No secrets - SAFE
+}
+
+// Filtered user response - SAFE
+export async function getUser(userId: string) {
+  const user = await db.user.findUnique({
+    where: { id: userId },
+    select: {
+      id: true,
+      name: true,
+      email: true,
+      // No sensitive fields selected
+    }
+  })
+  return NextResponse.json(user)
+}
+
+// Config check message - SAFE
+export async function checkConfig() {
+  if (!process.env.OPENAI_API_KEY) {
+    return NextResponse.json({
+      error: 'OpenAI API key not configured'  // Operational info - SAFE
+    }, { status: 500 })
+  }
+}
+`,
+        language: 'typescript',
+        size: 1200,
+      },
+    },
+  ],
+}