@oculum/scanner 1.0.11 → 1.0.13

package/src/{layer1 → detect/secrets}/weak-crypto.ts

@@ -3,7 +3,11 @@
  * Detects usage of deprecated or weak cryptographic algorithms
  */
 
-import type { Vulnerability } from '../types'
+import type { Vulnerability } from '../../shared/types'
+import type { ParsedFile } from '../../shared/parsed-file'
+
+// Base confidence for weak cryptography findings
+const BASE_CONFIDENCE = 0.45
 
 // Weak/deprecated cryptographic patterns
 const WEAK_CRYPTO_PATTERNS = [
@@ -16,13 +20,34 @@ const WEAK_CRYPTO_PATTERNS = [
     fix: 'Use SHA-256 or SHA-3 for hashing. For passwords, use bcrypt, scrypt, or Argon2.',
     contextCheck: (line: string) => {
       // Only flag as high if used in security context (passwords, tokens, etc.)
-      // Checksum/etag usage is acceptable for non-security purposes
-      const securityContexts = [/password/i, /token/i, /secret/i, /credential/i, /auth/i, /session/i, /key/i]
-      const checksumContexts = [/checksum/i, /hash.*file/i, /file.*hash/i, /etag/i, /content.*hash/i, /integrity/i, /digest/i, /fingerprint/i]
-      
+      // Checksum/etag/cache usage is acceptable for non-security purposes
+      const securityContexts = [/password/i, /token/i, /secret/i, /credential/i, /auth/i, /session/i, /key/i, /verify.*user/i, /sign/i]
+      const checksumContexts = [
+        /checksum/i,
+        /hash.*file/i,
+        /file.*hash/i,
+        /etag/i,
+        /content.*hash/i,
+        /integrity/i,
+        /digest/i,
+        /fingerprint/i,
+        /cache.*key/i,
+        /dedup/i,
+        /uniqueId/i,
+        /contentId/i,
+        /gravatar/i,        // Gravatar uses MD5 for email hashing
+        /avatar/i,          // Avatar URLs often use MD5
+        /blob/i,            // Blob hashing
+        /asset/i,           // Asset fingerprinting
+        /sprite/i,          // Sprite sheet hashing
+        /bundle/i,          // Bundle hashing
+        /chunk/i,           // Webpack chunk hashing
+        /manifest/i,        // Manifest hashing
+      ]
+
       const isSecurityContext = securityContexts.some(p => p.test(line))
       const isChecksumContext = checksumContexts.some(p => p.test(line))
-      
+
       // If it's clearly a checksum context, don't flag
       if (isChecksumContext && !isSecurityContext) {
         return false
@@ -38,14 +63,32 @@ const WEAK_CRYPTO_PATTERNS = [
     fix: 'Use createHash(\'sha256\') or createHash(\'sha3-256\') instead.',
     contextCheck: (line: string, _match: RegExpMatchArray, funcName?: string) => {
       // Check function name and line context for checksum indicators
-      const checksumIndicators = [/checksum/i, /etag/i, /content.*hash/i, /file.*hash/i, /integrity/i, /digest/i, /fingerprint/i, /verify.*file/i]
-      const securityIndicators = [/password/i, /token/i, /secret/i, /credential/i, /auth/i, /session/i]
-      
+      const checksumIndicators = [
+        /checksum/i,
+        /etag/i,
+        /content.*hash/i,
+        /file.*hash/i,
+        /integrity/i,
+        /digest/i,
+        /fingerprint/i,
+        /verify.*file/i,
+        /cache/i,
+        /dedup/i,
+        /gravatar/i,
+        /avatar/i,
+        /asset/i,
+        /bundle/i,
+        /chunk/i,
+        /manifest/i,
+        /sprite/i,
+      ]
+      const securityIndicators = [/password/i, /token/i, /secret/i, /credential/i, /auth/i, /session/i, /verify.*user/i, /sign/i]
+
       const lineAndFunc = funcName ? `${funcName} ${line}` : line
-      
+
       const isChecksum = checksumIndicators.some(p => p.test(lineAndFunc))
       const isSecurity = securityIndicators.some(p => p.test(lineAndFunc))
-      
+
       // Checksum use without security context = acceptable, don't flag
       if (isChecksum && !isSecurity) {
         return false
@@ -75,6 +118,23 @@ const WEAK_CRYPTO_PATTERNS = [
     severity: 'high' as const,
     description: 'DES is obsolete and easily broken. Use AES instead.',
     fix: 'Use AES-256-GCM for symmetric encryption.',
+    contextCheck: (line: string) => {
+      // DES must appear in crypto-related context, not natural language
+      // Common French/Spanish word "des" should not trigger this
+      const cryptoContexts = [
+        /cipher/i,
+        /encrypt/i,
+        /decrypt/i,
+        /crypto/i,
+        /algorithm/i,
+        /createCipher/i,
+        /\bDES\s*[.(]/i,        // DES function call like DES() or DES.encrypt()
+        /['"]DES['"]/i,         // DES as string literal
+        /DES[-_]/i,             // DES-CBC, DES_KEY, etc.
+        /[-_]DES/i,             // 3DES, etc.
+      ]
+      return cryptoContexts.some(ctx => ctx.test(line))
+    },
   },
   {
     pattern: /createCipher(?:iv)?\s*\(\s*['"]des['"]/gi,
@@ -113,6 +173,39 @@ const WEAK_CRYPTO_PATTERNS = [
     description: 'Math.random() is not cryptographically secure and should not be used for security purposes',
     fix: 'Use crypto.randomBytes() or crypto.getRandomValues() for cryptographic operations.',
     contextCheck: (line: string) => {
+      // Exclude load balancing/array selection patterns (not security-critical)
+      // Pattern: Math.random() * array.length or Math.random() * count
+      const loadBalancingPatterns = [
+        /Math\.random\s*\(\s*\)\s*\*\s*\w+\.length/i,        // * array.length
+        /Math\.random\s*\(\s*\)\s*\*\s*\w+\.keyLen/i,        // * store.keyLen (API key manager)
+        /Math\.random\s*\(\s*\)\s*\*\s*\w+\.size/i,          // * collection.size
+        /Math\.random\s*\(\s*\)\s*\*\s*\d+\s*\)/,            // * literal number in expression
+        /Math\.floor\s*\(\s*Math\.random\s*\(\s*\)\s*\*\s*\w+\.length/i,  // Math.floor(Math.random() * arr.length)
+        /Math\.floor\s*\(\s*Math\.random\s*\(\s*\)\s*\*\s*\w+\.keyLen/i,  // Math.floor(Math.random() * store.keyLen)
+        /\[\s*Math\.floor\s*\(\s*Math\.random/i,             // array[Math.floor(Math.random...)]
+        /index\s*=\s*Math\.floor\s*\(\s*Math\.random/i,      // index = Math.floor(Math.random...)
+        /pick|select|choose|shuffle|sample/i,                 // Load balancing keywords
+      ]
+
+      if (loadBalancingPatterns.some(p => p.test(line))) {
+        return false  // Don't flag - this is load balancing, not security
+      }
+
+      // Exclude fallback patterns where crypto is the primary method
+      // Pattern: crypto.randomUUID() ?? Math.random() or crypto.getRandomValues() || Math.random()
+      const fallbackPatterns = [
+        /crypto\??\.\s*randomUUID\s*\(\s*\)\s*\?\?/i,     // crypto.randomUUID() ??
+        /crypto\??\.\s*getRandomValues\s*\([^)]*\)\s*\?\?/i, // crypto.getRandomValues() ??
+        /globalThis\.crypto\??\.\s*randomUUID/i,          // globalThis.crypto.randomUUID
+        /window\.crypto\??\.\s*randomUUID/i,              // window.crypto.randomUUID
+        /\?\.\s*randomUUID\s*\(\s*\)\s*\?\?/i,            // ?.randomUUID() ??
+        /randomUUID\s*\(\s*\)\s*\?\?.*Math\.random/i,     // randomUUID() ?? ...Math.random
+      ]
+
+      if (fallbackPatterns.some(p => p.test(line))) {
+        return false  // Don't flag - Math.random is only a fallback for missing crypto API
+      }
+
       // Only flag if it looks like it's being used for security
       const securityContexts = [
         /token/i, /secret/i, /key/i, /password/i, /salt/i,
@@ -196,6 +289,20 @@ function isComment(lineContent: string): boolean {
   )
 }
 
+// Check if this is a Python file
+function isPythonFile(filePath: string): boolean {
+  return /\.py$/i.test(filePath)
+}
+
+/**
+ * Check if Python's usedforsecurity=False flag is present
+ * Python 3.9+ allows explicitly marking hash usage as non-security
+ * Example: hashlib.md5(data, usedforsecurity=False)
+ */
+function hasUsedForSecurityFalse(line: string): boolean {
+  return /usedforsecurity\s*=\s*False/i.test(line)
+}
+
 // Check if line is a pattern definition (regex or string literal in detector code)
 function isPatternDefinition(lineContent: string): boolean {
   const trimmed = lineContent.trim()
@@ -244,6 +351,22 @@ function isTestOrFixtureFile(filePath: string): boolean {
   )
 }
 
+// Check if file is a locale/translation file
+function isLocaleFile(filePath: string): boolean {
+  const lowerPath = filePath.toLowerCase()
+  return (
+    lowerPath.includes('/locales/') ||
+    lowerPath.includes('/locale/') ||
+    lowerPath.includes('/translations/') ||
+    lowerPath.includes('/i18n/') ||
+    lowerPath.includes('/lang/') ||
+    lowerPath.includes('/languages/') ||
+    // Common locale file patterns
+    /\/(en|fr|de|es|it|pt|ja|ko|zh|ru|ar|nl|pl|tr|vi|th|id|ms|fil|hi|bn|ta|te|ml|kn|gu|mr|pa|ur|sw|am|or|si|ne|km|my|lo|ka|mk|sr|hr|sl|sk|cs|hu|ro|bg|uk|el|he|fa|ps|ku|ug|yi|mn|bo|dz|dv)[-_][a-z]{2,}\.json$/i.test(lowerPath) ||
+    /locale.*\.json$/i.test(lowerPath)
+  )
+}
+
 /**
  * Find the enclosing function name for a given line
  */
@@ -267,10 +390,11 @@ function findEnclosingFunctionName(lines: string[], lineIndex: number): string |
 
 export function detectWeakCrypto(
   content: string,
-  filePath: string
+  filePath: string,
+  options?: { parsed?: ParsedFile }
 ): Vulnerability[] {
   const vulnerabilities: Vulnerability[] = []
-  const lines = content.split('\n')
+  const lines = options?.parsed?.lines ?? content.split('\n')
   
   // Skip scanner's own detector files to avoid self-detection
   if (isScannerDetectorFile(filePath)) {
@@ -282,23 +406,54 @@ export function detectWeakCrypto(
     return vulnerabilities
   }
 
+  // Skip locale/translation files (natural language text, not crypto code)
+  if (isLocaleFile(filePath)) {
+    return vulnerabilities
+  }
+
+  const isPython = isPythonFile(filePath)
+
   for (let i = 0; i < lines.length; i++) {
     const line = lines[i]
-    
+
     // Skip comments
     if (isComment(line)) continue
-    
+
     // Skip pattern definitions (detector rule definitions)
     if (isPatternDefinition(line)) continue
 
+    // Skip Python code with usedforsecurity=False flag
+    // Python 3.9+ allows explicitly marking non-security hash usage
+    if (isPython && hasUsedForSecurityFalse(line)) {
+      continue
+    }
+
     for (const cryptoPattern of WEAK_CRYPTO_PATTERNS) {
       const { pattern, name, severity, description, fix, contextCheck } = cryptoPattern
-      
+
       // Reset regex state
       const regex = new RegExp(pattern.source, pattern.flags)
       const match = regex.exec(line)
-      
+
       if (match) {
+        // Special handling for Math.random - check multi-line fallback patterns
+        if (name === 'Math.random() for Security') {
+          // Check previous 2 lines for crypto.randomUUID fallback pattern
+          // Pattern: crypto?.randomUUID?.() ?? `...${Math.random()}...`
+          const prevLines = lines.slice(Math.max(0, i - 2), i + 1).join(' ')
+          const multiLineFallbackPatterns = [
+            /crypto\??\.?\s*randomUUID\??\s*\(\s*\)\s*\?\?/i,         // crypto.randomUUID() ??
+            /globalThis\.crypto\??\.?\s*randomUUID\??\.?\s*\(/i,      // globalThis.crypto?.randomUUID?.()
+            /window\.crypto\??\.?\s*randomUUID\??\.?\s*\(/i,          // window.crypto?.randomUUID?.()
+            /\?\.\s*randomUUID\??\.?\s*\(\s*\)\s*\?\?/i,              // ?.randomUUID?.() ??
+            /crypto\??\.?\s*getRandomValues\s*\(/i,                    // crypto.getRandomValues()
+            /randomUUID\??\.?\s*\(\s*\)\s*\?\?/i,                      // randomUUID?.() ?? (generic)
+          ]
+          if (multiLineFallbackPatterns.some(p => p.test(prevLines))) {
+            continue  // Skip - Math.random is only a fallback for missing crypto API
+          }
+        }
+
         // If there's a context check, apply it
         // Pass function name for additional context
         const funcName = findEnclosingFunctionName(lines, i)
@@ -317,7 +472,9 @@ export function detectWeakCrypto(
           description,
           suggestedFix: fix,
           confidence: 'high',
+          baseConfidence: BASE_CONFIDENCE,
           layer: 1,
+        source: 'secrets' as const,
         })
         break // Only report one crypto issue per line
       }