@oculum/scanner 1.0.10 → 1.0.12

package/src/layer2/auth-antipatterns.ts

@@ -9,11 +9,16 @@
  */
 
 import type { Vulnerability, VulnerabilitySeverity } from '../types'
+import type { ParsedFile } from '../utils/parsed-file'
 import type { MiddlewareAuthConfig } from '../utils/middleware-detector'
 import { isRouteProtectedByMiddleware, getRoutePathFromFile } from '../utils/middleware-detector'
 import type { AuthHelper, AuthHelperContext } from '../utils/auth-helper-detector'
 import { hasAuthHelperCallBefore, isUserIdAlreadyValidated } from '../utils/auth-helper-detector'
 import type { FileAuthImports } from '../utils/imported-auth-detector'
+import { isScannerOrFixtureFile } from '../utils/context-helpers'
+import { getRouteProtectionContext, isAuthenticatedOnlyComponent } from '../utils/route-hierarchy'
+import { is2FAOrValidation } from '../utils/schema-semantics'
+import { isPasswordErrorCode, hasPasswordValueInError } from '../utils/intent-detector'
 
 interface AuthAntiPattern {
   name: string
@@ -78,13 +83,10 @@ const AUTH_ANTIPATTERNS: AuthAntiPattern[] = [
     description: 'Session configuration may lack secure flag',
     suggestedFix: 'Set secure: true for cookies in production',
   },
-  {
-    name: 'Cookie without httpOnly',
-    pattern: /cookie\s*\(\s*['"][^'"]+['"]\s*,[^)]*(?!httpOnly)[^)]*\)|setCookie\s*\([^)]*(?!httpOnly)/gi,
-    severity: 'medium',
-    description: 'Cookie set without httpOnly flag',
-    suggestedFix: 'Add httpOnly: true to prevent XSS access to cookies',
-  },
+  // NOTE: Cookie httpOnly detection removed - causes false positives
+  // Client-side code (document.cookie) cannot set httpOnly - it's a server-only flag
+  // Server-side cookie libraries have proper defaults
+  // The pattern was triggering on client-side cookie access which is conceptually wrong
   
   // Authorization issues
   // NOTE: We intentionally do NOT flag "if (!user)" or "if (!userId)" patterns as issues
@@ -122,12 +124,17 @@ const AUTH_ANTIPATTERNS: AuthAntiPattern[] = [
   },
   
   // OAuth/Social auth issues
+  // NOTE: OAuth detection narrowed significantly to reduce false positives.
+  // Previously matched any line containing "oauth" which flagged variable names, imports, etc.
+  // Now only matches actual OAuth authorization URL construction.
   {
     name: 'OAuth state parameter missing',
-    pattern: /oauth|authorize\?.*(?!state=)/gi,
+    // Only match actual OAuth authorization URL construction without state parameter
+    // Must have: authorize endpoint + client_id/redirect_uri but missing state
+    pattern: /['"`]https?:\/\/[^'"]*\/(?:oauth|authorize|auth)[^'"]*client_id=[^'"]*(?!.*state=)/gi,
     severity: 'medium',
-    description: 'OAuth flow may lack state parameter for CSRF protection',
-    suggestedFix: 'Include a random state parameter in OAuth requests',
+    description: 'OAuth authorization URL may lack state parameter for CSRF protection',
+    suggestedFix: 'Include a random state parameter in OAuth authorization requests',
   },
   
   // Password handling issues
@@ -138,13 +145,10 @@ const AUTH_ANTIPATTERNS: AuthAntiPattern[] = [
     description: 'Password may be logged to console',
     suggestedFix: 'Never log passwords or sensitive credentials',
   },
-  {
-    name: 'Password in error message',
-    pattern: /throw\s+new\s+Error\s*\([^)]*password|Error\s*\([^)]*password/gi,
-    severity: 'high',
-    description: 'Password may be included in error message',
-    suggestedFix: 'Never include passwords in error messages',
-  },
+  // NOTE: 'Password in error message' pattern now uses smart intent detection
+  // Error CODES like 'SAME_PASSWORD' are not flagged (they're codes, not values)
+  // Only actual password values concatenated into errors are flagged
+  // This is handled specially in detectAuthAntipatterns() below
   
   // Rate limiting
   {
@@ -183,6 +187,37 @@ function isAuthRelatedFile(filePath: string): boolean {
   return authKeywords.some(keyword => lowerPath.includes(keyword))
 }
 
+/**
+ * Check if file is an auth implementation/library file
+ * These files ARE the auth system - flagging them for "missing auth" is wrong
+ *
+ * Examples:
+ * - packages/auth/src/handlers.ts
+ * - lib/auth/middleware.ts
+ * - services/authentication/index.ts
+ */
+function isAuthImplementationFile(filePath: string): boolean {
+  const authImplPatterns = [
+    /\/packages\/auth\//i,
+    /\/lib\/auth\//i,
+    /\/utils\/auth\//i,
+    /\/services\/auth/i,
+    /\/authentication\//i,
+    /\/auth-provider/i,
+    /\/auth-helpers/i,
+    /\/auth-utils/i,
+    /\/passport-/i,              // Passport.js strategy files
+    /\/next-auth\//i,            // NextAuth config
+    /\/lucia\//i,                // Lucia auth
+    /\/better-auth\//i,          // Better Auth
+    /\/supabase\/auth/i,         // Supabase auth
+    /\/clerk\//i,                // Clerk auth
+    /\/auth0\//i,                // Auth0
+    /\/keycloak\//i,             // Keycloak
+  ]
+  return authImplPatterns.some(p => p.test(filePath))
+}
+
 // Check if endpoint is a known public endpoint (health checks, webhooks, cron)
 function isKnownPublicEndpoint(lineContent: string, filePath: string): boolean {
   const PUBLIC_ENDPOINTS = [
@@ -193,20 +228,60 @@ function isKnownPublicEndpoint(lineContent: string, filePath: string): boolean {
     /\/live\b/i,
     /\/ping\b/i,
     /\/status\b/i,
+    /\/_health/i,
 
     // Webhooks (receive external calls)
     /\/webhook\b/i,
     /\/webhooks\//i,
     /\/callback\b/i,
+    /\/stripe\/webhook/i,
+    /\/clerk\/webhook/i,
+    /\/svix\//i,
 
     // Cron/scheduled tasks
     /\/cron\//i,
     /\/scheduled\//i,
     /\/tasks\//i,
+    /\/jobs?\//i,
 
-    // Public APIs
+    // Public APIs - intentionally unauthenticated
     /\/public\//i,
+    /\/openpage/i,        // OpenPage API pattern (intentionally public)
+    /\/open-api\//i,
+    /\/api\/public\//i,
+    /\/api\/v\d+\/public\//i,
     /\bGET\b.*\/api\/\w+\/\[id\]/i,  // Public resource reads with ID param
+
+    // Auth endpoints (must be public for users to authenticate)
+    /\/api\/auth\//i,
+    /\/auth\//i,
+    /\/login\b/i,
+    /\/signup\b/i,
+    /\/register\b/i,
+    /\/forgot-password/i,
+    /\/reset-password/i,
+    /\/verify-email/i,
+    /\/magic-link/i,
+    /\/oauth\//i,
+
+    // RSS/Atom feeds (typically public)
+    /\/feed\b/i,
+    /\/rss\b/i,
+    /\/atom\b/i,
+
+    // Sitemap/robots (always public)
+    /\/sitemap/i,
+    /\/robots/i,
+
+    // OpenGraph/meta endpoints
+    /\/og\//i,
+    /\/opengraph/i,
+    /\/meta\//i,
+
+    // Share/embed endpoints
+    /\/share\//i,
+    /\/embed\//i,
+    /\/widget\//i,
   ]
 
   return PUBLIC_ENDPOINTS.some(pattern =>
@@ -243,6 +318,47 @@ function hasAuthCheckNearby(lines: string[], lineIndex: number): boolean {
     /userApiKey|user_api_key|clientApiKey/i,
     /req\.body\.(?:apiKey|api_key|openaiKey|anthropicKey)/i,
     /headers\[['"`]x-(?:openai|api|anthropic)-key['"`]\]/i,
+
+    // Next.js / React auth patterns (expanded)
+    /const\s+session\s*=\s*await\s+auth\s*\(\)/,          // const session = await auth()
+    /const\s+\{\s*session\s*\}\s*=\s*await\s+auth\s*\(\)/, // const { session } = await auth()
+    /if\s*\(\s*!session\?\.user/,                          // if (!session?.user)
+    /if\s*\(\s*!session\s*\)/,                             // if (!session)
+    /session\s*\?\.\s*user/,                               // session?.user
+    /getServerSession\s*\(\s*authOptions/,                 // getServerSession(authOptions)
+    /getServerSession\s*\(\s*req\s*,\s*res/,              // getServerSession(req, res, ...)
+    /useSession\s*\(\)/,                                   // useSession()
+    /signIn\s*\(/,                                         // signIn()
+    /signOut\s*\(/,                                        // signOut()
+
+    // Clerk auth patterns
+    /currentUser\s*\(\)/,                                  // currentUser()
+    /auth\s*\(\)\s*\.\s*protect/,                         // auth().protect
+    /auth\s*\(\)\s*\.\s*userId/,                          // auth().userId
+    /clerkClient/i,
+    /getAuth\s*\(/,
+    /ClerkProvider/,
+
+    // Supabase auth patterns
+    /supabase\s*\.\s*auth\s*\.\s*getUser/,               // supabase.auth.getUser()
+    /supabase\s*\.\s*auth\s*\.\s*getSession/,            // supabase.auth.getSession()
+    /createServerClient/,                                  // Supabase server client
+    /createRouteHandlerClient/,
+
+    // Lucia auth patterns
+    /lucia\s*\.\s*validateSession/,
+    /validateRequest/,
+
+    // Better Auth patterns
+    /betterAuth/,
+    /auth\.api\./,
+
+    // Throwing auth helpers (if these are called, route is authenticated)
+    /throw\s+new\s+Error\s*\(\s*['"]unauthorized/i,
+    /throw\s+new\s+Error\s*\(\s*['"]unauthenticated/i,
+    /ChatSDKError\s*\(\s*['"]unauthorized/i,
+    /return\s+new\s+Response\s*\(\s*.*401/,
+    /return\s+NextResponse\s*\.\s*json\s*\(\s*.*401/,
   ]
 
   return searchWindow.some(line =>
@@ -254,6 +370,7 @@ export interface AuthAntipatternOptions {
   middlewareConfig?: MiddlewareAuthConfig
   authHelpers?: AuthHelperContext
   fileAuthImports?: Map<string, FileAuthImports>
+  parsed?: ParsedFile
 }
 
 export function detectAuthAntipatterns(
@@ -261,10 +378,18 @@ export function detectAuthAntipatterns(
   filePath: string,
   options: AuthAntipatternOptions = {}
 ): Vulnerability[] {
-  const { middlewareConfig, authHelpers, fileAuthImports } = options
+  const { middlewareConfig, authHelpers, fileAuthImports, parsed } = options
   const vulnerabilities: Vulnerability[] = []
-  const lines = content.split('\n')
+
+  // Skip scanner/fixture files to avoid self-detection
+  if (isScannerOrFixtureFile(filePath)) return vulnerabilities
+
+  const lines = parsed?.lines ?? content.split('\n')
   const isAuthFile = isAuthRelatedFile(filePath)
+  const isAuthImpl = isAuthImplementationFile(filePath)
+
+  // Check framework route hierarchy protection (Remix, Next.js route groups)
+  const routeHierarchy = getRouteProtectionContext(filePath)
 
   // Check if this route is protected by global middleware
   const routePath = getRoutePathFromFile(filePath)
@@ -279,6 +404,9 @@ export function detectAuthAntipatterns(
   // Check if file uses throwing auth helpers
   const helpersList = authHelpers?.helpers || []
 
+  // Check if this is a component only used in authenticated contexts
+  const isAuthOnlyComponent = isAuthenticatedOnlyComponent(filePath)
+
   lines.forEach((line, index) => {
     // Skip comment lines
     if (isComment(line)) return
@@ -291,6 +419,12 @@ export function detectAuthAntipatterns(
         if (pattern.name === 'Unprotected API route' ||
             pattern.name === 'Express route without auth middleware') {
 
+          // PRIORITY -1: Skip auth implementation files entirely
+          // These files ARE the auth system - flagging them for "missing auth" is conceptually wrong
+          if (isAuthImpl) {
+            break // Skip this pattern
+          }
+
           // PRIORITY 0: Check if this is actually a route file
           // In Next.js, routes must be in `route.ts/js` files. Files like `handlers.ts`,
           // `safe-handlers.ts`, `utils.ts` etc. are NOT actual API routes even if they
@@ -308,6 +442,32 @@ export function detectAuthAntipatterns(
             break
           }
 
+          // PRIORITY 0.5: Check if route is in a protected route hierarchy
+          // Framework route conventions (Remix _authenticated+, Next.js route groups)
+          if (routeHierarchy.isInProtectedHierarchy) {
+            // Route is in a protected hierarchy - cap severity at info
+            vulnerabilities.push({
+              id: `auth-antipattern-${filePath}-${index + 1}-${pattern.name}`,
+              filePath,
+              lineNumber: index + 1,
+              lineContent: line.trim(),
+              severity: 'info',
+              category: 'missing_auth',
+              title: pattern.name + ' (in protected route hierarchy)',
+              description: `This route is within a protected route hierarchy (${routeHierarchy.protectionSource.join(', ')}). Authentication is likely handled by parent layout/middleware.`,
+              suggestedFix: 'Verify parent layout enforces authentication. If not, add auth check here.',
+              confidence: 'low',
+              layer: 2,
+            })
+            break // Only report once per line
+          }
+
+          // PRIORITY 0.75: Check if this is a component only used in authenticated contexts
+          if (isAuthOnlyComponent) {
+            // Component is in admin/dashboard/etc - skip entirely
+            break
+          }
+
           // PRIORITY 1: Check if route is protected by global middleware
           // This is the STRONGEST signal - if middleware protects the route, suppress entirely
           if (middlewareProtection.isProtected) {
@@ -390,5 +550,60 @@ export function detectAuthAntipatterns(
     }
   })
 
+  // Special handling: Password in error message with smart intent detection
+  // Only flag actual password VALUES, not error CODES like 'SAME_PASSWORD'
+  const passwordErrorPattern = /throw\s+new\s+Error\s*\([^)]*password|Error\s*\([^)]*password/gi
+  lines.forEach((line, index) => {
+    if (isComment(line)) return
+
+    if (passwordErrorPattern.test(line)) {
+      // Reset regex state
+      passwordErrorPattern.lastIndex = 0
+
+      // Skip if this is an error CODE, not a VALUE
+      if (isPasswordErrorCode(line)) {
+        return // This is fine - 'SAME_PASSWORD' is a code, not a value
+      }
+
+      // Only flag if actual password value is in the error
+      if (hasPasswordValueInError(line)) {
+        vulnerabilities.push({
+          id: `auth-antipattern-${filePath}-${index + 1}-password-in-error`,
+          filePath,
+          lineNumber: index + 1,
+          lineContent: line.trim(),
+          severity: 'high',
+          category: 'missing_auth',
+          title: 'Password value in error message',
+          description: 'Actual password value may be included in error message, exposing sensitive data.',
+          suggestedFix: 'Never include actual password values in error messages. Use error codes instead.',
+          confidence: 'high',
+          layer: 2,
+        })
+      }
+    }
+  })
+
+  // Special handling: 2FA optional fields with OR validation
+  // Don't flag .optional() on 2FA fields if there's .refine() enforcing OR logic
+  const twoFAOptionalPattern = /\.(totp|otp|backupCode|recoveryCode|twoFactor|2fa|mfa).*\.optional\s*\(\)/gi
+  lines.forEach((line, index) => {
+    if (isComment(line)) return
+
+    if (twoFAOptionalPattern.test(line)) {
+      // Reset regex state
+      twoFAOptionalPattern.lastIndex = 0
+
+      // Check if this is legitimate OR validation (either TOTP or backup code required)
+      if (is2FAOrValidation(content, index)) {
+        // This is legitimate OR validation - skip or report as info
+        return
+      }
+
+      // Only flag if this truly allows bypassing 2FA
+      // Most cases with .refine() are fine - this is handled by schema-semantics.ts
+    }
+  })
+
   return vulnerabilities
 }

package/src/layer2/byok-patterns.ts

@@ -5,8 +5,9 @@
  */
 
 import type { Vulnerability, VulnerabilitySeverity } from '../types'
+import type { ParsedFile } from '../utils/parsed-file'
 import type { MiddlewareAuthConfig } from '../utils/middleware-detector'
-import { isComment, isTestOrMockFile, isExampleFile, isPlaceholderValue } from '../utils/context-helpers'
+import { isComment, isTestOrMockFile, isExampleFile, isPlaceholderValue, isScannerOrFixtureFile } from '../utils/context-helpers'
 import { isRouteProtectedByMiddleware, getRoutePathFromFile, detectUserScopingPatterns } from '../utils/middleware-detector'
 
 /**
@@ -221,10 +222,15 @@ function isKeyLogged(content: string, lineNumber: number): boolean {
 export function detectBYOKPatterns(
   content: string,
   filePath: string,
-  middlewareConfig?: MiddlewareAuthConfig
+  middlewareConfig?: MiddlewareAuthConfig,
+  options?: { parsed?: ParsedFile }
 ): Vulnerability[] {
   const vulnerabilities: Vulnerability[] = []
-  const lines = content.split('\n')
+
+  // Skip scanner/fixture files to avoid self-detection
+  if (isScannerOrFixtureFile(filePath)) return vulnerabilities
+
+  const lines = options?.parsed?.lines ?? content.split('\n')
   const isTestFile = isTestOrMockFile(filePath)
 
   // Skip example/demo files entirely - they contain placeholder credentials by design

package/src/layer2/dangerous-functions/child-process.ts

@@ -0,0 +1,98 @@
+/**
+ * Child Process Detection
+ *
+ * Detection logic for child_process functions (exec, spawn, execFile, etc.)
+ * that can lead to command injection vulnerabilities.
+ */
+
+/**
+ * Check if exec() call is from child_process (dangerous) vs RegExp.exec (safe)
+ * Returns true if this is a child_process exec call that should be flagged
+ */
+export function isChildProcessExec(content: string, lineContent: string): boolean {
+  // Check for child_process import
+  const hasChildProcessImport =
+    /require\s*\(\s*['"]child_process['"]\s*\)/.test(content) ||
+    /from\s+['"]child_process['"]/.test(content) ||
+    /import\s+.*child_process/.test(content) ||
+    /require\s*\(\s*['"]node:child_process['"]\s*\)/.test(content) ||
+    /from\s+['"]node:child_process['"]/.test(content)
+
+  // If no child_process import, this is likely RegExp.exec or similar
+  if (!hasChildProcessImport) {
+    return false
+  }
+
+  // Check if this specific line is RegExp.exec pattern
+  // RegExp.exec is called as: regex.exec(string) or /pattern/.exec(string)
+  const isRegExpExec =
+    /\.\s*exec\s*\(/.test(lineContent) && // Method call on an object
+    !/\bexec\s*\(/.test(lineContent.replace(/\.\s*exec\s*\(/, '')) // Not a standalone exec()
+
+  // Also check for common RegExp patterns
+  const isRegExpPattern =
+    /\/[^/]+\/[gimsuy]*\.exec\s*\(/.test(lineContent) || // /pattern/.exec()
+    /new\s+RegExp\s*\([^)]+\)\.exec\s*\(/.test(lineContent) || // new RegExp().exec()
+    /regex\.exec\s*\(/i.test(lineContent) || // regex.exec()
+    /pattern\.exec\s*\(/i.test(lineContent) || // pattern.exec()
+    /match\.exec\s*\(/i.test(lineContent) || // match.exec()
+    /re\.exec\s*\(/i.test(lineContent) // re.exec()
+
+  if (isRegExpExec || isRegExpPattern) {
+    return false
+  }
+
+  // Check if exec is imported/destructured from child_process
+  const execImported =
+    /\{\s*[^}]*\bexec\b[^}]*\}\s*=\s*require\s*\(\s*['"]child_process['"]/.test(
+      content
+    ) ||
+    /\{\s*[^}]*\bexec\b[^}]*\}\s*=\s*require\s*\(\s*['"]node:child_process['"]/.test(
+      content
+    ) ||
+    /import\s+\{\s*[^}]*\bexec\b[^}]*\}\s+from\s+['"]child_process['"]/.test(
+      content
+    ) ||
+    /import\s+\{\s*[^}]*\bexec\b[^}]*\}\s+from\s+['"]node:child_process['"]/.test(
+      content
+    )
+
+  // If exec is directly imported from child_process, standalone exec() is dangerous
+  if (execImported && /\bexec\s*\(/.test(lineContent)) {
+    return true
+  }
+
+  // Check for child_process.exec() pattern
+  if (
+    /child_process\.exec\s*\(/.test(lineContent) ||
+    /cp\.exec\s*\(/.test(lineContent) ||
+    /childProcess\.exec\s*\(/.test(lineContent)
+  ) {
+    return true
+  }
+
+  // If we have child_process import but can't determine usage, be conservative
+  // Only flag if it looks like a standalone exec() call
+  return /\bexec\s*\(/.test(lineContent) && !/\.\s*exec\s*\(/.test(lineContent)
+}
+
+/**
+ * Check if spawn/execFile/execSync is from child_process
+ */
+export function isChildProcessSpawn(content: string, lineContent: string): boolean {
+  // Check for child_process import
+  const hasChildProcessImport =
+    /require\s*\(\s*['"]child_process['"]\s*\)/.test(content) ||
+    /from\s+['"]child_process['"]/.test(content) ||
+    /require\s*\(\s*['"]node:child_process['"]\s*\)/.test(content) ||
+    /from\s+['"]node:child_process['"]/.test(content)
+
+  if (!hasChildProcessImport) {
+    return false
+  }
+
+  // These functions are always from child_process when that module is imported
+  return /\b(spawn|spawnSync|execSync|execFile|execFileSync)\s*\(/.test(
+    lineContent
+  )
+}