@oculum/scanner 1.0.14 → 1.0.15

package/src/detect/config/package-check.ts

@@ -17,6 +17,7 @@ import {
   fetchPyPIMetadata,
   extractNpmDependencies,
   extractPythonRequirements,
+  extractPyprojectDependencies,
   calculatePackageAgeDays,
   rateLimitDelay,
   getPackageFileType,
@@ -525,7 +526,11 @@ export async function checkPackages(
   if (fileType === 'npm' && filePath.endsWith('package.json')) {
     dependencies = extractNpmDependencies(content)
   } else if (fileType === 'python') {
-    dependencies = extractPythonRequirements(content)
+    if (filePath.endsWith('pyproject.toml')) {
+      dependencies = extractPyprojectDependencies(content)
+    } else {
+      dependencies = extractPythonRequirements(content)
+    }
   }
 
   if (dependencies.length === 0) {

package/src/detect/config/rules-file-backdoor.ts

@@ -0,0 +1,438 @@
+/**
+ * Layer 1: Rules File Backdoor Detection
+ *
+ * Detects the "Rules File Backdoor" attack (Pillar Security, March 2025)
+ * targeting AI coding assistant config files (.cursorrules, CLAUDE.md,
+ * .github/copilot-instructions.md, etc.) via:
+ *
+ * A) Invisible Unicode characters (zero-width, bidi overrides, tag blocks)
+ * B) Stealth behavior manipulation instructions
+ * C) File inventory (info-level) for security surface awareness
+ *
+ * @see https://www.pillar.security/blog/new-vulnerability-in-github-copilot-and-cursor
+ */
+
+import type { Vulnerability, VulnerabilitySeverity } from '../../shared/types'
+import type { ParsedFile } from '../../shared/parsed-file'
+import {
+  isAIRulesFile,
+  isTestOrMockFile,
+  isScannerOrFixtureFile,
+} from '../../parse/file-classifier'
+
+// ============================================================================
+// Unicode Character Classes
+// ============================================================================
+
+/** Zero-width characters — U+200B through U+200F, U+2060, U+2063, U+FEFF */
+const ZERO_WIDTH_RE = /[\u200B-\u200F\u2060\u2063\uFEFF]/g
+
+/** Bidirectional override characters — U+202A-U+202E, U+2066-U+2069, U+061C */
+const BIDI_RE = /[\u202A-\u202E\u2066-\u2069\u061C]/g
+
+/** Other invisible characters — U+00AD (soft hyphen), U+180E, U+034F */
+const OTHER_INVISIBLE_RE = /[\u00AD\u180E\u034F]/g
+
+/**
+ * Unicode Tag Block characters — U+E0001 through U+E007F
+ * These encode full ASCII and can hide entire payloads invisibly.
+ * Note: These are astral plane characters and require surrogate pair matching in JS.
+ */
+const TAG_BLOCK_RE = /[\uDB40][\uDC01-\uDC7F]/g
+// Alternative using code point regex for environments supporting it:
+const TAG_BLOCK_CODEPOINT_RE = /[\u{E0001}-\u{E007F}]/gu
+
+// ============================================================================
+// Payload Decoders (exported for unit testing)
+// ============================================================================
+
+/**
+ * Decode zero-width binary encoding: U+200B=0, U+200C=1, 8-bit groups → ASCII
+ */
+export function decodeZeroWidthBinary(content: string): string {
+  // Extract only U+200B and U+200C characters
+  const bits = content.replace(/[^\u200B\u200C]/g, '')
+  if (bits.length < 8) return ''
+
+  const chars: string[] = []
+  for (let i = 0; i + 7 < bits.length; i += 8) {
+    let byte = 0
+    for (let b = 0; b < 8; b++) {
+      if (bits[i + b] === '\u200C') {
+        byte |= 1 << (7 - b)
+      }
+    }
+    if (byte >= 32 && byte <= 126) {
+      chars.push(String.fromCharCode(byte))
+    }
+  }
+  return chars.join('')
+}
+
+/**
+ * Decode Unicode Tag Block encoding: U+E00XX → ASCII character XX
+ */
+export function decodeTagBlock(content: string): string {
+  const chars: string[] = []
+  for (const ch of content) {
+    const cp = ch.codePointAt(0)
+    if (cp !== undefined && cp >= 0xE0001 && cp <= 0xE007F) {
+      const ascii = cp - 0xE0000
+      if (ascii >= 32 && ascii <= 126) {
+        chars.push(String.fromCharCode(ascii))
+      }
+    }
+  }
+  return chars.join('')
+}
+
+// ============================================================================
+// Stealth Instruction Patterns
+// ============================================================================
+
+interface StealthPattern {
+  pattern: RegExp
+  title: string
+  description: string
+  severity: VulnerabilitySeverity
+  group: 'security_weakening' | 'self_concealment' | 'forced_inclusion' | 'credential_insertion' | 'auth_bypass'
+}
+
+const STEALTH_PATTERNS: StealthPattern[] = [
+  // Security weakening
+  {
+    pattern: /\b(?:never|don['']?t|do\s+not|always\s+skip)\s+(?:sanitize|validate|escape|filter)\b/i,
+    title: 'Stealth instruction: security weakening',
+    description: 'AI rules file instructs the assistant to skip input sanitization or validation.',
+    severity: 'high',
+    group: 'security_weakening',
+  },
+  {
+    pattern: /\b(?:disable|turn\s+off|remove|skip)\s+(?:CORS|CSP|CSRF|HSTS|XSS\s+protect|security\s+head)/i,
+    title: 'Stealth instruction: disable security controls',
+    description: 'AI rules file instructs the assistant to disable security controls (CORS, CSP, CSRF, etc.).',
+    severity: 'high',
+    group: 'security_weakening',
+  },
+  {
+    pattern: /\balways\s+use\s+eval\b/i,
+    title: 'Stealth instruction: force eval usage',
+    description: 'AI rules file instructs the assistant to always use eval(), enabling code injection.',
+    severity: 'high',
+    group: 'security_weakening',
+  },
+  // Self-concealment
+  {
+    pattern: /\b(?:do\s+not|don['']?t|never)\s+(?:mention|reveal|disclose|show|display)\s+(?:these|this|the)\s+(?:instruction|rule|directive|config)/i,
+    title: 'Stealth instruction: self-concealment',
+    description: 'AI rules file contains instructions to hide its own directives from the user.',
+    severity: 'critical',
+    group: 'self_concealment',
+  },
+  {
+    pattern: /\bkeep\s+(?:this|these)\s+(?:secret|hidden|private|confidential)\b/i,
+    title: 'Stealth instruction: secrecy directive',
+    description: 'AI rules file instructs the assistant to keep instructions secret from the user.',
+    severity: 'critical',
+    group: 'self_concealment',
+  },
+  // Forced inclusion
+  {
+    pattern: /\b(?:always|must)\s+(?:include|install|add|use)\s+(?:the\s+)?(?:package|dependency|module|library)\s+/i,
+    title: 'Stealth instruction: forced package inclusion',
+    description: 'AI rules file forces the assistant to always include specific packages, potentially introducing supply chain risks.',
+    severity: 'high',
+    group: 'forced_inclusion',
+  },
+  // Credential insertion
+  {
+    pattern: /\b(?:use|set|always\s+use)\s+(?:this|the\s+following)\s+(?:API\s+key|token|secret|password|credential)\b/i,
+    title: 'Stealth instruction: credential insertion',
+    description: 'AI rules file attempts to inject specific credentials into generated code.',
+    severity: 'critical',
+    group: 'credential_insertion',
+  },
+  // Auth bypass
+  {
+    pattern: /\b(?:never|don['']?t|do\s+not|always\s+skip)\s+(?:check|verify|require)\s+(?:auth\w*|token|permission|credential|session|user)/i,
+    title: 'Stealth instruction: authentication bypass',
+    description: 'AI rules file instructs the assistant to skip authentication or authorization checks.',
+    severity: 'high',
+    group: 'auth_bypass',
+  },
+]
+
+// Educational context detection (reused from agent-skill-injection.ts pattern)
+const EDUCATIONAL_PATTERNS = [
+  /example\s+of/i,
+  /vulnerability/i,
+  /never\s+do\s+this/i,
+  /malicious\s+example/i,
+  /don['']t\s+do/i,
+  /avoid\s+this/i,
+  /anti[- ]?pattern/i,
+  /insecure\s+example/i,
+]
+
+function isEducationalContext(line: string): boolean {
+  return EDUCATIONAL_PATTERNS.some(p => p.test(line))
+}
+
+// ============================================================================
+// Sub-detector A: Invisible Unicode Scanner
+// ============================================================================
+
+function detectInvisibleUnicode(content: string, filePath: string): Vulnerability[] {
+  const findings: Vulnerability[] = []
+  const lines = content.split('\n')
+
+  // Track character classes found
+  let zeroWidthCount = 0
+  let bidiCount = 0
+  let tagBlockCount = 0
+  let otherInvisibleCount = 0
+  const zeroWidthLines: number[] = []
+  const bidiLines: number[] = []
+  const tagBlockLines: number[] = []
+  const otherLines: number[] = []
+
+  for (let i = 0; i < lines.length; i++) {
+    const line = lines[i]
+    const lineNum = i + 1
+
+    // Zero-width characters
+    const zwMatches = line.match(ZERO_WIDTH_RE)
+    if (zwMatches) {
+      // Skip BOM at start of file (byte 0)
+      if (lineNum === 1) {
+        const nonBomMatches = zwMatches.filter((ch, idx) => {
+          // Only skip FEFF if it's at the very start of the line (byte 0)
+          if (ch === '\uFEFF' && line.indexOf(ch) === 0 && idx === 0) return false
+          return true
+        })
+        if (nonBomMatches.length > 0) {
+          zeroWidthCount += nonBomMatches.length
+          zeroWidthLines.push(lineNum)
+        }
+      } else {
+        zeroWidthCount += zwMatches.length
+        zeroWidthLines.push(lineNum)
+      }
+    }
+
+    // Bidi override characters
+    const bidiMatches = line.match(BIDI_RE)
+    if (bidiMatches) {
+      bidiCount += bidiMatches.length
+      bidiLines.push(lineNum)
+    }
+
+    // Tag block characters
+    const tagMatches = line.match(TAG_BLOCK_CODEPOINT_RE)
+    if (tagMatches) {
+      tagBlockCount += tagMatches.length
+      tagBlockLines.push(lineNum)
+    }
+
+    // Other invisible characters
+    const otherMatches = line.match(OTHER_INVISIBLE_RE)
+    if (otherMatches) {
+      otherInvisibleCount += otherMatches.length
+      otherLines.push(lineNum)
+    }
+  }
+
+  // Emit findings per character class
+
+  // Tag Block — always critical (full ASCII encoding capability)
+  if (tagBlockCount > 0) {
+    const decoded = decodeTagBlock(content)
+    const decodedSnippet = decoded.length > 200 ? decoded.slice(0, 200) + '...' : decoded
+    const line = tagBlockLines[0]
+    findings.push({
+      id: `rfb-tag-${filePath}:${line}`,
+      filePath,
+      lineNumber: line,
+      lineContent: lines[line - 1]?.slice(0, 200) || '',
+      severity: 'critical',
+      category: 'ai_rules_file_backdoor',
+      title: 'Unicode Tag Block characters detected in AI rules file',
+      description: `Found ${tagBlockCount} Unicode Tag Block characters (U+E0001-E007F) that encode hidden ASCII text invisible to human reviewers.${decoded ? ` Decoded payload: "${decodedSnippet}"` : ''}`,
+      confidence: 'high',
+      layer: 1,
+      source: 'config',
+      requiresAIValidation: false,
+    })
+  }
+
+  // Bidi overrides — always high
+  if (bidiCount > 0) {
+    const line = bidiLines[0]
+    findings.push({
+      id: `rfb-bidi-${filePath}:${line}`,
+      filePath,
+      lineNumber: line,
+      lineContent: lines[line - 1]?.slice(0, 200) || '',
+      severity: 'high',
+      category: 'ai_rules_file_backdoor',
+      title: 'Bidirectional override characters in AI rules file',
+      description: `Found ${bidiCount} bidirectional text override characters (U+202A-202E, U+2066-2069) that can visually reorder text to hide malicious instructions from human reviewers.`,
+      confidence: 'high',
+      layer: 1,
+      source: 'config',
+      requiresAIValidation: false,
+    })
+  }
+
+  // Zero-width characters — severity by concentration
+  if (zeroWidthCount > 0) {
+    let severity: VulnerabilitySeverity
+    if (zeroWidthCount >= 16) {
+      severity = 'critical'
+    } else if (zeroWidthCount >= 8) {
+      severity = 'high'
+    } else {
+      severity = 'medium'
+    }
+
+    const decoded = decodeZeroWidthBinary(content)
+    const decodedSnippet = decoded.length > 200 ? decoded.slice(0, 200) + '...' : decoded
+    const line = zeroWidthLines[0]
+    findings.push({
+      id: `rfb-zw-${filePath}:${line}`,
+      filePath,
+      lineNumber: line,
+      lineContent: lines[line - 1]?.slice(0, 200) || '',
+      severity,
+      category: 'ai_rules_file_backdoor',
+      title: 'Zero-width Unicode characters in AI rules file',
+      description: `Found ${zeroWidthCount} zero-width characters (U+200B-200F, U+2060, U+FEFF) that are invisible to human reviewers but interpreted by AI models.${decoded ? ` Decoded payload: "${decodedSnippet}"` : ''}`,
+      confidence: 'high',
+      layer: 1,
+      source: 'config',
+      requiresAIValidation: false,
+    })
+  }
+
+  // Other invisible — medium
+  if (otherInvisibleCount > 0) {
+    const line = otherLines[0]
+    findings.push({
+      id: `rfb-inv-${filePath}:${line}`,
+      filePath,
+      lineNumber: line,
+      lineContent: lines[line - 1]?.slice(0, 200) || '',
+      severity: 'medium',
+      category: 'ai_rules_file_backdoor',
+      title: 'Invisible Unicode characters in AI rules file',
+      description: `Found ${otherInvisibleCount} invisible characters (soft hyphen U+00AD, U+180E, U+034F) that may hide content from human reviewers.`,
+      confidence: 'medium',
+      layer: 1,
+      source: 'config',
+      requiresAIValidation: false,
+    })
+  }
+
+  return findings
+}
+
+// ============================================================================
+// Sub-detector B: Stealth Instruction Scanner
+// ============================================================================
+
+function detectStealthInstructions(content: string, filePath: string): Vulnerability[] {
+  const findings: Vulnerability[] = []
+  const lines = content.split('\n')
+
+  for (let i = 0; i < lines.length; i++) {
+    const line = lines[i]
+    const lineNum = i + 1
+
+    // Skip educational context
+    if (isEducationalContext(line)) continue
+
+    for (const def of STEALTH_PATTERNS) {
+      if (def.pattern.test(line)) {
+        findings.push({
+          id: `rfb-stealth-${def.group}-${filePath}:${lineNum}`,
+          filePath,
+          lineNumber: lineNum,
+          lineContent: line.trim().slice(0, 200),
+          severity: def.severity,
+          category: 'ai_rules_file_backdoor',
+          title: def.title,
+          description: def.description,
+          confidence: 'high',
+          layer: 1,
+          source: 'config',
+          requiresAIValidation: false,
+        })
+        break // One finding per line max (avoid duplicates from overlapping patterns)
+      }
+    }
+  }
+
+  return findings
+}
+
+// ============================================================================
+// Sub-detector C: File Inventory
+// ============================================================================
+
+function createInventoryFinding(filePath: string): Vulnerability {
+  return {
+    id: `rfb-inventory-${filePath}`,
+    filePath,
+    lineNumber: 0,
+    lineContent: '',
+    severity: 'info',
+    category: 'ai_rules_file_backdoor',
+    title: 'AI rules file detected',
+    description: `AI coding assistant configuration file detected. These files define AI assistant behavior and are potential targets for the "Rules File Backdoor" attack.`,
+    confidence: 'high',
+    layer: 1,
+    source: 'config',
+    requiresAIValidation: false,
+  }
+}
+
+// ============================================================================
+// Main Entry Point
+// ============================================================================
+
+export interface RulesFileBackdoorOptions {
+  parsed?: ParsedFile
+}
+
+/**
+ * Detect Rules File Backdoor attacks in AI config files.
+ *
+ * Scans for:
+ * - Invisible Unicode characters (zero-width, bidi, tag blocks)
+ * - Stealth behavior manipulation instructions
+ * - File inventory (info-level awareness)
+ */
+export function detectRulesFileBackdoor(
+  content: string,
+  filePath: string,
+  options?: RulesFileBackdoorOptions,
+): Vulnerability[] {
+  // Gate: only scan AI rules files
+  if (!isAIRulesFile(filePath)) return []
+
+  // Skip test/fixture files
+  if (isTestOrMockFile(filePath) || isScannerOrFixtureFile(filePath)) return []
+
+  const findings: Vulnerability[] = []
+
+  // Sub-detector A: Invisible Unicode
+  findings.push(...detectInvisibleUnicode(content, filePath))
+
+  // Sub-detector B: Stealth Instructions
+  findings.push(...detectStealthInstructions(content, filePath))
+
+  // Sub-detector C: File Inventory (always emit info for every AI rules file)
+  findings.push(createInventoryFinding(filePath))
+
+  return findings
+}