@oculum/scanner 1.0.11 → 1.0.13

package/src/shared/intent-detector.ts

@@ -0,0 +1,318 @@
+/**
+ * Intent Detector Utility
+ * Detects the INTENT of code patterns, not just keywords
+ *
+ * This addresses false positives where:
+ * - setState() is flagged as a redirect (it's React state, not navigation)
+ * - Error codes like 'SAME_PASSWORD' are flagged as password exposure
+ * - Signed URLs are flagged as token exposure
+ * - React Hook Form's shouldValidate: false is flagged as bypass
+ */
+
+// ============================================================================
+// Redirect vs State Setter Detection
+// ============================================================================
+
+/**
+ * React state setter patterns - these are NOT redirects
+ */
+const REACT_STATE_SETTER_PATTERNS = [
+  // useState setters: setFoo(value)
+  /\bset[A-Z][a-zA-Z]*\s*\(/,
+  // Zustand/state manager: store.setFoo()
+  /\.\s*set[A-Z][a-zA-Z]*\s*\(/,
+  // Redux dispatch pattern
+  /dispatch\s*\(/,
+  // Recoil/Jotai
+  /\buseSetRecoilState\b/,
+  /\bsetAtom\b/,
+]
+
+/**
+ * Actual redirect/navigation patterns
+ */
+const REDIRECT_PATTERNS = [
+  // Framework redirect functions
+  /\bredirect\s*\(/i,
+  /\bnavigate\s*\(/i,
+  // Next.js router
+  /router\.(push|replace)\s*\(/i,
+  /useRouter\(\)\.(push|replace)/i,
+  // React Router
+  /\buseNavigate\b/i,
+  // Window location
+  /window\.location\s*(=|\.href|\.assign|\.replace)/i,
+  // Response redirect
+  /Response\.redirect\s*\(/i,
+  /NextResponse\.redirect\s*\(/i,
+  // HTTP redirect
+  /res\.(redirect|send|status\(\d{3}\))/i,
+]
+
+/**
+ * Check if a line contains a React state setter (NOT a redirect)
+ */
+export function isReactStateSetter(line: string): boolean {
+  return REACT_STATE_SETTER_PATTERNS.some(pattern => pattern.test(line))
+}
+
+/**
+ * Check if a line contains an actual redirect/navigation
+ */
+export function isActualRedirect(line: string): boolean {
+  return REDIRECT_PATTERNS.some(pattern => pattern.test(line))
+}
+
+/**
+ * Determine if user input to this function is a security concern
+ * State setters with user input are NOT redirects
+ *
+ * @param line - The line content
+ * @returns 'state_setter' | 'redirect' | 'unknown'
+ */
+export function classifyNavigationIntent(
+  line: string
+): 'state_setter' | 'redirect' | 'unknown' {
+  if (isReactStateSetter(line)) {
+    return 'state_setter'
+  }
+  if (isActualRedirect(line)) {
+    return 'redirect'
+  }
+  return 'unknown'
+}
+
+// ============================================================================
+// Error Code vs Error Value Detection
+// ============================================================================
+
+/**
+ * Check if a string in an error is a CODE (like 'SAME_PASSWORD')
+ * vs an actual VALUE that might expose data
+ */
+export function isErrorCodeString(line: string): boolean {
+  // Error codes are SCREAMING_CASE strings
+  const errorCodePatterns = [
+    // throw new Error('SAME_PASSWORD')
+    /Error\s*\(\s*['"][A-Z][A-Z_0-9]*['"]\s*\)/,
+    // throw new Error('USER_NOT_FOUND')
+    /throw\s+.*['"][A-Z][A-Z_0-9]*['"]/,
+    // ChatSDKError('unauthorized:INVALID_TOKEN')
+    /Error\s*\(\s*['"][a-z]+:[A-Z_]+['"]\s*\)/,
+  ]
+
+  return errorCodePatterns.some(pattern => pattern.test(line))
+}
+
+/**
+ * Check if an error message might contain actual password/secret value
+ */
+export function hasPasswordValueInError(line: string): boolean {
+  // Only flag if actual password variable is concatenated into error
+  const dangerousPatterns = [
+    // Error('Password is: ' + password)
+    /Error\s*\([^)]*\+\s*password[^)]*\)/i,
+    // Error(`Password is: ${password}`)
+    /Error\s*\([^)]*\$\{\s*password\s*\}[^)]*\)/i,
+    // Error(JSON.stringify({...password}))
+    /Error\s*\(\s*JSON\.stringify\s*\([^)]*password/i,
+    // Error(secret)
+    /Error\s*\(\s*(password|secret|token|apiKey)\s*\)/i,
+  ]
+
+  return dangerousPatterns.some(pattern => pattern.test(line))
+}
+
+/**
+ * Check if "password" in error message is actually an error code/type
+ */
+export function isPasswordErrorCode(line: string): boolean {
+  // These are error CODES about passwords, not password VALUES
+  const passwordCodePatterns = [
+    /['"]SAME_PASSWORD['"]/i,
+    /['"]INVALID_PASSWORD['"]/i,
+    /['"]WEAK_PASSWORD['"]/i,
+    /['"]PASSWORD_REQUIRED['"]/i,
+    /['"]PASSWORD_MISMATCH['"]/i,
+    /['"]PASSWORD_TOO_SHORT['"]/i,
+    /['"]PASSWORD_TOO_LONG['"]/i,
+    /['"]PASSWORD_EXPIRED['"]/i,
+    /['"]password:[\w_]+['"]/i,  // password:INVALID, password:MISMATCH
+  ]
+
+  return passwordCodePatterns.some(pattern => pattern.test(line))
+}
+
+// ============================================================================
+// Signed URL Detection
+// ============================================================================
+
+/**
+ * Check if a URL pattern is an intentional signed/presigned URL
+ * These are FEATURES, not vulnerabilities
+ */
+export function isSignedUrlPattern(line: string): boolean {
+  const signedUrlPatterns = [
+    // AWS S3 presigned URLs
+    /presign/i,
+    /getSignedUrl/i,
+    /presignedUrl/i,
+    /presigned/i,
+    // Azure SAS tokens
+    /sasToken/i,
+    /SharedAccessSignature/i,
+    // GCP signed URLs
+    /generateSignedUrl/i,
+    /signedUrl/i,
+    // Generic signed URL patterns
+    /signature\s*[=:]/i,
+    /signed\s*[=:]/i,
+    /token\s*=.*&expires/i,
+    /expires\s*=.*&signature/i,
+  ]
+
+  return signedUrlPatterns.some(pattern => pattern.test(line))
+}
+
+// ============================================================================
+// Form Library Context Detection
+// ============================================================================
+
+/**
+ * Check if shouldValidate: false is in a React Hook Form context
+ * In RHF, this is a PERFORMANCE optimization, not a security bypass
+ */
+export function isReactHookFormContext(content: string, lineNumber: number): boolean {
+  const lines = content.split('\n')
+  const contextStart = Math.max(0, lineNumber - 20)
+  const contextEnd = Math.min(lines.length, lineNumber + 5)
+  const context = lines.slice(contextStart, contextEnd).join('\n')
+
+  const rhfPatterns = [
+    // useForm hook
+    /useForm\s*[<(]/,
+    /useForm\(\)/,
+    // react-hook-form import
+    /from\s+['"]react-hook-form['"]/,
+    // Form methods
+    /\bform\.(setValue|watch|reset|getValues|trigger|clearErrors)\b/,
+    /\.(setValue|watch|reset|getValues|trigger|clearErrors)\s*\(/,
+    // Register pattern
+    /register\s*\(/,
+    // FormProvider
+    /FormProvider/,
+    // Control pattern
+    /control\s*=/,
+  ]
+
+  return rhfPatterns.some(pattern => pattern.test(context))
+}
+
+/**
+ * Check if validation: false / validate: false is form library optimization
+ */
+export function isFormLibraryOptimization(line: string, content: string, lineNumber: number): boolean {
+  // If in React Hook Form context, it's optimization
+  if (isReactHookFormContext(content, lineNumber)) {
+    return true
+  }
+
+  // Check for other form library contexts
+  const formLibraryPatterns = [
+    /formik/i,
+    /react-final-form/i,
+    /vee-validate/i,
+    /vuelidate/i,
+  ]
+
+  const lines = content.split('\n')
+  const contextStart = Math.max(0, lineNumber - 20)
+  const context = lines.slice(contextStart, lineNumber + 5).join('\n')
+
+  return formLibraryPatterns.some(pattern => pattern.test(context))
+}
+
+// ============================================================================
+// Combined Intent Classification
+// ============================================================================
+
+export interface IntentAnalysis {
+  /** The detected intent */
+  intent: 'security_concern' | 'safe_pattern' | 'unknown'
+  /** Reason for classification */
+  reason: string
+  /** Suggested action */
+  action: 'flag' | 'skip' | 'downgrade'
+}
+
+/**
+ * Analyze a line for security intent based on multiple heuristics
+ */
+export function analyzeSecurityIntent(
+  line: string,
+  content: string,
+  lineNumber: number,
+  patternType: 'redirect' | 'password_error' | 'token_url' | 'validation_bypass'
+): IntentAnalysis {
+  switch (patternType) {
+    case 'redirect':
+      if (isReactStateSetter(line)) {
+        return {
+          intent: 'safe_pattern',
+          reason: 'React state setter, not a redirect',
+          action: 'skip',
+        }
+      }
+      if (isActualRedirect(line)) {
+        return {
+          intent: 'security_concern',
+          reason: 'Actual redirect/navigation function',
+          action: 'flag',
+        }
+      }
+      break
+
+    case 'password_error':
+      if (isErrorCodeString(line) || isPasswordErrorCode(line)) {
+        return {
+          intent: 'safe_pattern',
+          reason: 'Error code string, not actual password value',
+          action: 'skip',
+        }
+      }
+      if (hasPasswordValueInError(line)) {
+        return {
+          intent: 'security_concern',
+          reason: 'Actual password value in error message',
+          action: 'flag',
+        }
+      }
+      break
+
+    case 'token_url':
+      if (isSignedUrlPattern(line)) {
+        return {
+          intent: 'safe_pattern',
+          reason: 'Intentional signed/presigned URL pattern',
+          action: 'skip',
+        }
+      }
+      break
+
+    case 'validation_bypass':
+      if (isFormLibraryOptimization(line, content, lineNumber)) {
+        return {
+          intent: 'safe_pattern',
+          reason: 'Form library performance optimization',
+          action: 'skip',
+        }
+      }
+      break
+  }
+
+  return {
+    intent: 'unknown',
+    reason: 'Could not determine intent',
+    action: 'flag', // Conservative: flag if unknown
+  }
+}

package/src/shared/parsed-file.ts

@@ -0,0 +1,103 @@
+/**
+ * ParsedFile - Shared file representation for all detectors
+ *
+ * Provides lazy-cached line splitting and common context-extraction
+ * operations, eliminating duplicated content.split('\n') calls across 26+ detectors.
+ */
+
+export class ParsedFile {
+  readonly content: string
+  readonly filePath: string
+  private _lines: string[] | null = null
+
+  constructor(content: string, filePath: string) {
+    this.content = content
+    this.filePath = filePath
+  }
+
+  /** Lazy-cached array of lines from content.split('\n') */
+  get lines(): string[] {
+    if (this._lines === null) {
+      this._lines = this.content.split('\n')
+    }
+    return this._lines
+  }
+
+  /** Number of lines in the file */
+  get lineCount(): number {
+    return this.lines.length
+  }
+
+  /** Get a single line by 0-based index. Returns '' for out-of-bounds. */
+  line(index: number): string {
+    if (index < 0 || index >= this.lines.length) return ''
+    return this.lines[index]
+  }
+
+  /**
+   * Get surrounding lines around a center index, clamped to file bounds.
+   * @param lineIndex 0-based center line
+   * @param windowSize number of lines before and after center
+   */
+  getSurroundingLines(lineIndex: number, windowSize: number): {
+    lines: string[]
+    startIndex: number
+    endIndex: number
+    text: string
+  } {
+    const startIndex = Math.max(0, lineIndex - windowSize)
+    const endIndex = Math.min(this.lines.length - 1, lineIndex + windowSize)
+    const slice = this.lines.slice(startIndex, endIndex + 1)
+    return {
+      lines: slice,
+      startIndex,
+      endIndex,
+      text: slice.join('\n'),
+    }
+  }
+
+  /**
+   * Get a range of lines as a joined string.
+   * @param start 0-based start (inclusive), clamped to bounds
+   * @param end 0-based end (inclusive), clamped to bounds
+   */
+  getLineRange(start: number, end: number): string {
+    const s = Math.max(0, start)
+    const e = Math.min(this.lines.length - 1, end)
+    if (s > e) return ''
+    return this.lines.slice(s, e + 1).join('\n')
+  }
+
+  /** Construct from a ScanFile-like object with content and path */
+  static from(file: { content: string; path: string }): ParsedFile {
+    return new ParsedFile(file.content, file.path)
+  }
+}
+
+/**
+ * Numeric rank for severity comparisons.
+ * Only relative ordering matters — used for keeping the higher-severity finding
+ * during deduplication and merge operations.
+ */
+export function severityRank(severity: string): number {
+  const ranks: Record<string, number> = {
+    critical: 5,
+    high: 4,
+    medium: 3,
+    low: 2,
+    info: 1,
+  }
+  return ranks[severity] || 0
+}
+
+/**
+ * Numeric rank for confidence comparisons.
+ */
+export function confidenceRank(confidence: string): number {
+  const ranks: Record<string, number> = {
+    high: 3,
+    medium: 2,
+    low: 1,
+  }
+  return ranks[confidence] || 0
+}

package/src/{rules → shared/rules}/__tests__/metadata.test.ts

@@ -53,6 +53,13 @@ const ALL_CATEGORIES: VulnerabilityCategory[] = [
   'ai_unverified_model',
   'ai_unsafe_finetuning',
   'ai_excessive_agency',
+  // Agent skill file security
+  'ai_skill_injection',
+  // OWASP Workstream 1
+  'missing_security_headers',
+  'ssrf',
+  'log_injection',
+  'xxe',
 ]
 
 describe('Rule Metadata Registry', () => {

package/src/{rules → shared/rules}/framework-fixes.ts

@@ -11,7 +11,7 @@
  */
 
 import type { VulnerabilityCategory } from '../types'
-import type { FrameworkContext, DataAccessContext } from '../utils/project-context-builder'
+import type { FrameworkContext, DataAccessContext } from '../../model/project-context'
 
 // ============================================================================
 // Types

package/src/{rules → shared/rules}/metadata.ts

@@ -806,6 +806,100 @@ export const RULE_REGISTRY: Record<VulnerabilityCategory, RuleMetadata> = {
       'https://docs.crewai.com/concepts/security',
     ],
   },
+  // ==========================================================================
+  // OWASP Workstream 1: Classic Vulnerability Detectors
+  // ==========================================================================
+  missing_security_headers: {
+    name: 'Missing Security Headers',
+    whyItMatters:
+      'Missing HTTP security headers (CSP, HSTS, X-Frame-Options) leave the application vulnerable to clickjacking, MIME sniffing, XSS, and man-in-the-middle attacks.',
+    fixSteps: [
+      'Add helmet middleware for Express apps: app.use(helmet())',
+      'Configure Content-Security-Policy to restrict resource loading',
+      'Enable HSTS (Strict-Transport-Security) for HTTPS enforcement',
+      'Set X-Frame-Options to prevent clickjacking',
+      'Add X-Content-Type-Options: nosniff to prevent MIME sniffing',
+    ],
+    evidence: 'Server configuration missing critical HTTP security headers',
+    references: [
+      'https://owasp.org/www-project-secure-headers/',
+      'https://cwe.mitre.org/data/definitions/693.html',
+    ],
+  },
+
+  ssrf: {
+    name: 'Server-Side Request Forgery (SSRF)',
+    whyItMatters:
+      'SSRF allows attackers to make the server send requests to unintended locations, potentially accessing internal services, cloud metadata endpoints, or performing port scanning from within the network.',
+    fixSteps: [
+      'Validate and sanitize all user-supplied URLs before making server-side requests',
+      'Implement an allowlist of permitted domains or IP ranges',
+      'Block requests to private IP ranges (127.0.0.1, 10.x, 192.168.x, 169.254.x)',
+      'Use a URL parser to validate the scheme, host, and port',
+      'Consider using a proxy service for user-supplied URLs',
+    ],
+    evidence: 'User-controlled input flows to server-side HTTP request without validation',
+    references: [
+      'https://owasp.org/www-community/attacks/Server_Side_Request_Forgery',
+      'https://cwe.mitre.org/data/definitions/918.html',
+    ],
+  },
+
+  log_injection: {
+    name: 'Log Injection',
+    whyItMatters:
+      'Unsanitized user input in log statements can forge log entries, inject CRLF sequences to create fake log lines, or exploit log processing tools via injection attacks.',
+    fixSteps: [
+      'Sanitize user input before including in log messages (strip newlines, control characters)',
+      'Use structured logging (JSON format) instead of string interpolation',
+      'Parameterize log fields instead of concatenating user input',
+      'Implement log output encoding appropriate to the log format',
+    ],
+    evidence: 'User-controlled request data flows directly into log statements',
+    references: [
+      'https://owasp.org/www-community/attacks/Log_Injection',
+      'https://cwe.mitre.org/data/definitions/117.html',
+    ],
+  },
+
+  xxe: {
+    name: 'XML External Entity (XXE) Injection',
+    whyItMatters:
+      'XXE vulnerabilities allow attackers to read server files, perform SSRF, execute denial-of-service attacks (billion laughs), and potentially achieve remote code execution through XML parsing.',
+    fixSteps: [
+      'Disable external entity processing in your XML parser',
+      'Use defusedxml (Python) instead of standard xml library',
+      'Set factory.setFeature("http://apache.org/xml/features/disallow-doctype-decl", true) in Java',
+      'Use JSON instead of XML where possible',
+      'Upgrade XML parsing libraries to versions with secure defaults',
+    ],
+    evidence: 'XML parser used without disabling external entity processing',
+    references: [
+      'https://owasp.org/www-community/vulnerabilities/XML_External_Entity_(XXE)_Processing',
+      'https://cwe.mitre.org/data/definitions/611.html',
+    ],
+  },
+
+  // ==========================================================================
+  // Agent Skill File Security
+  // ==========================================================================
+  ai_skill_injection: {
+    name: 'Agent Skill Injection',
+    whyItMatters:
+      'AI agent skill/configuration files define agent behavior. Prompt injection, data exfiltration commands, or hidden execution patterns in these files can compromise the agent, exfiltrate sensitive data, or execute arbitrary code on the host system.',
+    fixSteps: [
+      'Review the skill file for any instructions that override safety guidelines',
+      'Remove any shell commands that pipe remote content to execution (curl | sh)',
+      'Remove any references to sensitive files or environment variables',
+      'Check for hidden Unicode characters using a hex editor or unicode inspector',
+      'Ensure tool descriptions do not contain injection language',
+    ],
+    evidence: 'Detected prompt injection, data exfiltration, or hidden execution pattern in agent skill file',
+    references: [
+      'https://owasp.org/www-project-top-10-for-large-language-model-applications/',
+      'https://cwe.mitre.org/data/definitions/77.html',
+    ],
+  },
 }
 
 /**