@oculum/scanner 1.0.0

package/src/layer2/risky-imports.ts

@@ -0,0 +1,186 @@
+/**
+ * Layer 2: Risky Import/Package Analysis
+ * Detects imports of packages known to have security concerns or deprecated
+ */
+
+import type { Vulnerability, VulnerabilitySeverity } from '../types'
+
+interface RiskyPackage {
+  name: string
+  pattern: RegExp
+  severity: VulnerabilitySeverity
+  description: string
+  suggestedFix: string
+}
+
+const RISKY_PACKAGES: RiskyPackage[] = [
+  // Known vulnerable or deprecated packages
+  {
+    name: 'request (deprecated)',
+    pattern: /require\s*\(\s*['"]request['"]\s*\)|from\s+['"]request['"]/gi,
+    severity: 'medium',
+    description: 'The "request" package is deprecated and no longer maintained',
+    suggestedFix: 'Migrate to fetch, axios, or node-fetch',
+  },
+  {
+    name: 'node-uuid (deprecated)',
+    pattern: /require\s*\(\s*['"]node-uuid['"]\s*\)|from\s+['"]node-uuid['"]/gi,
+    severity: 'low',
+    description: 'node-uuid is deprecated in favor of uuid package',
+    suggestedFix: 'Use the "uuid" package instead',
+  },
+  
+  // Packages with known security issues
+  {
+    name: 'lodash (full import)',
+    pattern: /require\s*\(\s*['"]lodash['"]\s*\)|import\s+\*?\s*(?:as\s+)?\w+\s+from\s+['"]lodash['"]/gi,
+    severity: 'low',
+    description: 'Full lodash import increases bundle size and attack surface',
+    suggestedFix: 'Import specific functions: import get from "lodash/get"',
+  },
+  {
+    name: 'moment.js (deprecated)',
+    pattern: /require\s*\(\s*['"]moment['"]\s*\)|from\s+['"]moment['"]/gi,
+    severity: 'low',
+    description: 'Moment.js is in maintenance mode, consider alternatives',
+    suggestedFix: 'Use date-fns, dayjs, or native Intl APIs',
+  },
+  
+  // Security-focused sandbox packages - info only (these are used for security, not risky)
+  {
+    name: 'vm2 (sandbox)',
+    pattern: /require\s*\(\s*['"]vm2['"]\s*\)|from\s+['"]vm2['"]/gi,
+    severity: 'info',
+    description: 'vm2 is a sandboxing library. While it has had sandbox escape vulnerabilities historically, using it is generally safer than running untrusted code directly. Keep vm2 updated.',
+    suggestedFix: 'Keep vm2 updated to the latest version. For maximum isolation, consider isolated-vm or running in a separate process.',
+  },
+  {
+    name: 'serialize-javascript (RCE risk)',
+    pattern: /require\s*\(\s*['"]serialize-javascript['"]\s*\)|from\s+['"]serialize-javascript['"]/gi,
+    severity: 'medium',
+    description: 'serialize-javascript can be dangerous if output is not properly handled',
+    suggestedFix: 'Ensure serialized output is not directly executed or use JSON.stringify',
+  },
+  
+  // Crypto-related risky imports
+  {
+    name: 'crypto-js (outdated patterns)',
+    pattern: /require\s*\(\s*['"]crypto-js['"]\s*\)|from\s+['"]crypto-js['"]/gi,
+    severity: 'low',
+    description: 'crypto-js may use outdated crypto patterns',
+    suggestedFix: 'Prefer Node.js built-in crypto module or Web Crypto API',
+  },
+  {
+    name: 'bcrypt-nodejs (deprecated)',
+    pattern: /require\s*\(\s*['"]bcrypt-nodejs['"]\s*\)|from\s+['"]bcrypt-nodejs['"]/gi,
+    severity: 'medium',
+    description: 'bcrypt-nodejs is deprecated and unmaintained',
+    suggestedFix: 'Use bcrypt or bcryptjs instead',
+  },
+  
+  // SQL/Database risky patterns
+  {
+    name: 'mysql (prefer mysql2)',
+    pattern: /require\s*\(\s*['"]mysql['"]\s*\)|from\s+['"]mysql['"]/gi,
+    severity: 'low',
+    description: 'mysql package is less maintained than mysql2',
+    suggestedFix: 'Consider using mysql2 for better security and performance',
+  },
+  
+  // Python risky imports
+  {
+    name: 'pickle (unsafe deserialization)',
+    pattern: /^import\s+pickle|^from\s+pickle\s+import/gim,
+    severity: 'high',
+    description: 'pickle can execute arbitrary code during deserialization',
+    suggestedFix: 'Use JSON or other safe serialization formats for untrusted data',
+  },
+  {
+    name: 'yaml unsafe load',
+    pattern: /yaml\.load\s*\([^)]*\)(?!.*Loader)/gi,
+    severity: 'high',
+    description: 'yaml.load without Loader parameter can execute arbitrary code',
+    suggestedFix: 'Use yaml.safe_load() or specify Loader=yaml.SafeLoader',
+  },
+  {
+    name: 'subprocess shell=True',
+    pattern: /subprocess\.(call|run|Popen|check_output)\s*\([^)]*shell\s*=\s*True/gi,
+    severity: 'high',
+    description: 'subprocess with shell=True is vulnerable to shell injection',
+    suggestedFix: 'Use shell=False and pass arguments as a list',
+  },
+  
+  // Telemetry/tracking packages (privacy concern)
+  {
+    name: 'Analytics package',
+    pattern: /require\s*\(\s*['"](analytics|segment|mixpanel|amplitude)['"]\s*\)|from\s+['"](analytics|segment|mixpanel|amplitude)['"]/gi,
+    severity: 'low',
+    description: 'Analytics package detected - ensure user consent is obtained',
+    suggestedFix: 'Implement proper consent mechanisms for user tracking',
+  },
+  
+  // Outdated/vulnerable web frameworks
+  {
+    name: 'express-jwt (CVE history)',
+    pattern: /require\s*\(\s*['"]express-jwt['"]\s*\)|from\s+['"]express-jwt['"]/gi,
+    severity: 'medium',
+    description: 'express-jwt has had security vulnerabilities - ensure latest version',
+    suggestedFix: 'Update to latest version and consider jose or jsonwebtoken directly',
+  },
+  
+  // Dangerous native modules
+  {
+    name: 'node-gyp native module',
+    pattern: /require\s*\(\s*['"]node-gyp['"]\s*\)|from\s+['"]node-gyp['"]/gi,
+    severity: 'low',
+    description: 'Native modules can introduce platform-specific vulnerabilities',
+    suggestedFix: 'Audit native dependencies and keep them updated',
+  },
+]
+
+// Check if line is a comment
+function isComment(line: string): boolean {
+  const trimmed = line.trim()
+  return (
+    trimmed.startsWith('//') ||
+    trimmed.startsWith('#') ||
+    trimmed.startsWith('*') ||
+    trimmed.startsWith('/*')
+  )
+}
+
+export function detectRiskyImports(
+  content: string,
+  filePath: string
+): Vulnerability[] {
+  const vulnerabilities: Vulnerability[] = []
+  const lines = content.split('\n')
+
+  lines.forEach((line, index) => {
+    // Skip comment lines
+    if (isComment(line)) return
+
+    for (const pkg of RISKY_PACKAGES) {
+      const regex = new RegExp(pkg.pattern.source, pkg.pattern.flags)
+      
+      if (regex.test(line)) {
+        vulnerabilities.push({
+          id: `risky-import-${filePath}-${index + 1}-${pkg.name}`,
+          filePath,
+          lineNumber: index + 1,
+          lineContent: line.trim(),
+          severity: pkg.severity,
+          category: 'suspicious_package',
+          title: `Risky package: ${pkg.name}`,
+          description: pkg.description,
+          suggestedFix: pkg.suggestedFix,
+          confidence: 'high',
+          layer: 2,
+        })
+        break // Only report once per line
+      }
+    }
+  })
+
+  return vulnerabilities
+}

package/src/layer2/variables.ts

@@ -0,0 +1,166 @@
+/**
+ * Layer 2: Variable Heuristics
+ * Identifies variable names associated with sensitive data
+ */
+
+import type { Vulnerability, SensitiveVariablePattern } from '../types'
+
+// Patterns for sensitive variable names
+export const SENSITIVE_VARIABLE_PATTERNS: SensitiveVariablePattern[] = [
+  // Password-related
+  {
+    pattern: /\b(password|passwd|pwd|pass)\s*[=:]/gi,
+    severity: 'high',
+    description: 'Variable name suggests password storage',
+  },
+  {
+    pattern: /\b(user_?password|admin_?password|db_?password|database_?password)\s*[=:]/gi,
+    severity: 'critical',
+    description: 'Variable name suggests database/admin password',
+  },
+  // Token-related
+  {
+    pattern: /\b(auth_?token|access_?token|refresh_?token|bearer_?token)\s*[=:]/gi,
+    severity: 'high',
+    description: 'Variable name suggests authentication token',
+  },
+  {
+    pattern: /\b(api_?token|api_?key|apikey)\s*[=:]/gi,
+    severity: 'high',
+    description: 'Variable name suggests API key/token',
+  },
+  // Secret-related
+  {
+    pattern: /\b(secret|secret_?key|private_?key|signing_?key)\s*[=:]/gi,
+    severity: 'high',
+    description: 'Variable name suggests secret/private key',
+  },
+  {
+    pattern: /\b(client_?secret|app_?secret|jwt_?secret)\s*[=:]/gi,
+    severity: 'critical',
+    description: 'Variable name suggests application secret',
+  },
+  // Credential-related
+  {
+    pattern: /\b(credential|credentials|creds)\s*[=:]/gi,
+    severity: 'high',
+    description: 'Variable name suggests credentials',
+  },
+  // Connection strings
+  {
+    pattern: /\b(connection_?string|conn_?string|database_?url|db_?url)\s*[=:]/gi,
+    severity: 'high',
+    description: 'Variable name suggests database connection string',
+  },
+  // Encryption keys
+  {
+    pattern: /\b(encryption_?key|decrypt_?key|cipher_?key|aes_?key)\s*[=:]/gi,
+    severity: 'critical',
+    description: 'Variable name suggests encryption key',
+  },
+  // SSH/Certificate
+  {
+    pattern: /\b(ssh_?key|private_?key|cert_?key|ssl_?key)\s*[=:]/gi,
+    severity: 'critical',
+    description: 'Variable name suggests SSH/SSL key',
+  },
+]
+
+// Check if the value looks like a placeholder or env var reference
+function isPlaceholderOrEnvRef(line: string): boolean {
+  const safePatterns = [
+    /[=:]\s*['"]?\s*$/,                    // Empty value
+    /[=:]\s*['"]?xxx/i,                    // xxx placeholder
+    /[=:]\s*['"]?your[-_]/i,               // your-xxx placeholder
+    /[=:]\s*['"]?<[^>]+>/,                 // <placeholder>
+    /[=:]\s*['"]?\$\{/,                    // ${VAR} template
+    /[=:]\s*['"]?process\.env/,            // process.env reference
+    /[=:]\s*['"]?env\(/,                   // env() function
+    /[=:]\s*['"]?getenv/i,                 // getenv function
+    /[=:]\s*['"]?os\.environ/,             // Python os.environ
+    /[=:]\s*['"]?ENV\[/,                   // Ruby ENV
+    /[=:]\s*null\b/i,                      // null value
+    /[=:]\s*undefined\b/,                  // undefined value
+    /[=:]\s*None\b/,                       // Python None
+    /[=:]\s*['"]?TODO/i,                   // TODO placeholder
+    /[=:]\s*['"]?CHANGEME/i,               // CHANGEME placeholder
+    /[=:]\s*['"]?REPLACE/i,                // REPLACE placeholder
+    /\?\s*.*\s*:\s*/,                      // Ternary operator (conditional assignment)
+    /\|\|/,                                // OR fallback (e.g., ENV_VAR || '')
+    /\?\?/,                                // Nullish coalescing
+    /[A-Z_]{3,}_(?:KEY|TOKEN|SECRET)/,     // References to env var constants
+  ]
+
+  return safePatterns.some(pattern => pattern.test(line))
+}
+
+// Check if line is a comment
+function isComment(line: string): boolean {
+  const trimmed = line.trim()
+  return (
+    trimmed.startsWith('//') ||
+    trimmed.startsWith('#') ||
+    trimmed.startsWith('*') ||
+    trimmed.startsWith('/*') ||
+    trimmed.startsWith('"""') ||
+    trimmed.startsWith("'''") ||
+    trimmed.startsWith('<!--')
+  )
+}
+
+// Check if it's a type definition or interface
+function isTypeDefinition(line: string): boolean {
+  return (
+    /^\s*(type|interface|class)\s/.test(line) ||
+    /:\s*(string|number|boolean|any)\s*[;,}]/.test(line) ||
+    /\?\s*:\s*\w+/.test(line)
+  )
+}
+
+export function detectSensitiveVariables(
+  content: string,
+  filePath: string
+): Vulnerability[] {
+  const vulnerabilities: Vulnerability[] = []
+  const lines = content.split('\n')
+
+  lines.forEach((line, index) => {
+    // Skip comments
+    if (isComment(line)) return
+
+    // Skip type definitions
+    if (isTypeDefinition(line)) return
+
+    // Skip if it's a placeholder/env reference
+    if (isPlaceholderOrEnvRef(line)) return
+
+    for (const pattern of SENSITIVE_VARIABLE_PATTERNS) {
+      const regex = new RegExp(pattern.pattern.source, pattern.pattern.flags)
+      
+      if (regex.test(line)) {
+        // Extract the actual value to check if it's hardcoded
+        const valueMatch = line.match(/[=:]\s*['"]([^'"]+)['"]/i)
+        
+        if (valueMatch && valueMatch[1].length > 3) {
+          // Has a non-trivial hardcoded value
+          vulnerabilities.push({
+            id: `var-${filePath}-${index + 1}`,
+            filePath,
+            lineNumber: index + 1,
+            lineContent: line.trim(),
+            severity: pattern.severity,
+            category: 'sensitive_variable',
+            title: 'Sensitive variable with hardcoded value',
+            description: pattern.description + '. The value appears to be hardcoded rather than loaded from environment.',
+            suggestedFix: 'Move this sensitive value to an environment variable or secure secrets manager.',
+            confidence: 'medium',
+            layer: 2,
+          })
+        }
+        break // Only report once per line
+      }
+    }
+  })
+
+  return vulnerabilities
+}