@oculum/scanner 1.0.14 → 1.0.15

package/src/__tests__/taint/def-use.test.ts

@@ -0,0 +1,132 @@
+/**
+ * Unit tests for def-use extraction
+ */
+
+import Parser from 'tree-sitter'
+import { createHash } from 'crypto'
+// eslint-disable-next-line @typescript-eslint/no-require-imports
+const { typescript: TypeScript } = require('tree-sitter-typescript')
+import { computeDefUse } from '../../taint/def-use'
+
+const tsParser = new Parser()
+tsParser.setLanguage(TypeScript)
+
+let counter = 0
+function parseStatement(code: string): Parser.SyntaxNode {
+  const tree = tsParser.parse(code)
+  // Return the first statement in the program
+  return tree.rootNode.namedChildren[0]
+}
+
+describe('computeDefUse', () => {
+  it('simple assignment: x = y', () => {
+    const stmt = parseStatement('x = y')
+    const { defs, uses } = computeDefUse(stmt)
+    expect(defs.has('x')).toBe(true)
+    expect(uses.has('y')).toBe(true)
+  })
+
+  it('variable declaration: const a = b + c', () => {
+    const stmt = parseStatement('const a = b + c')
+    const { defs, uses } = computeDefUse(stmt)
+    expect(defs.has('a')).toBe(true)
+    expect(uses.has('b')).toBe(true)
+    expect(uses.has('c')).toBe(true)
+  })
+
+  it('destructuring: const { x, y } = obj', () => {
+    const stmt = parseStatement('const { x, y } = obj')
+    const { defs, uses } = computeDefUse(stmt)
+    expect(defs.has('x')).toBe(true)
+    expect(defs.has('y')).toBe(true)
+    expect(uses.has('obj')).toBe(true)
+  })
+
+  it('array destructuring: const [a, b] = arr', () => {
+    const stmt = parseStatement('const [a, b] = arr')
+    const { defs, uses } = computeDefUse(stmt)
+    expect(defs.has('a')).toBe(true)
+    expect(defs.has('b')).toBe(true)
+    expect(uses.has('arr')).toBe(true)
+  })
+
+  it('function call: foo(x, y)', () => {
+    const stmt = parseStatement('foo(x, y)')
+    const { defs, uses } = computeDefUse(stmt)
+    expect(defs.size).toBe(0)
+    expect(uses.has('foo')).toBe(true)
+    expect(uses.has('x')).toBe(true)
+    expect(uses.has('y')).toBe(true)
+  })
+
+  it('augmented assignment: x += y', () => {
+    const stmt = parseStatement('x += y')
+    const { defs, uses } = computeDefUse(stmt)
+    expect(defs.has('x')).toBe(true)
+    expect(uses.has('x')).toBe(true) // reads old value
+    expect(uses.has('y')).toBe(true)
+  })
+
+  it('member expression read: obj.prop', () => {
+    const stmt = parseStatement('console.log(obj.prop)')
+    const { defs, uses } = computeDefUse(stmt)
+    expect(uses.has('console')).toBe(true)
+    expect(uses.has('obj')).toBe(true)
+  })
+
+  it('for-of header variable is a def', () => {
+    const stmt = parseStatement('for (const item of items) { process(item) }')
+    // The for_in_statement node itself — we extract from the left side
+    const { defs, uses } = computeDefUse(stmt)
+    expect(defs.has('item')).toBe(true)
+    expect(uses.has('items')).toBe(true)
+  })
+
+  it('catch parameter is a def', () => {
+    const code = 'try { } catch (err) { console.log(err) }'
+    const tree = tsParser.parse(code)
+    const tryStmt = tree.rootNode.namedChildren[0]
+    const catchClause = tryStmt.childForFieldName('handler')!
+    const { defs } = computeDefUse(catchClause)
+    expect(defs.has('err')).toBe(true)
+  })
+
+  it('expression statement with no assignments has no defs', () => {
+    const stmt = parseStatement('console.log(a, b, c)')
+    const { defs, uses } = computeDefUse(stmt)
+    expect(defs.size).toBe(0)
+    expect(uses.has('console')).toBe(true)
+    expect(uses.has('a')).toBe(true)
+    expect(uses.has('b')).toBe(true)
+    expect(uses.has('c')).toBe(true)
+  })
+
+  it('await expression: await fetch(url)', () => {
+    const stmt = parseStatement('const result = await fetch(url)')
+    const { defs, uses } = computeDefUse(stmt)
+    expect(defs.has('result')).toBe(true)
+    expect(uses.has('fetch')).toBe(true)
+    expect(uses.has('url')).toBe(true)
+  })
+
+  it('return statement: return x + y', () => {
+    // Parse a full function to get a return statement
+    const code = 'function f() { return x + y }'
+    const tree = tsParser.parse(code)
+    const fn = tree.rootNode.namedChildren[0]
+    const body = fn.childForFieldName('body')!
+    const returnStmt = body.namedChildren[0]
+    const { defs, uses } = computeDefUse(returnStmt)
+    expect(defs.size).toBe(0)
+    expect(uses.has('x')).toBe(true)
+    expect(uses.has('y')).toBe(true)
+  })
+
+  it('template literal: `${a} and ${b}`', () => {
+    const stmt = parseStatement('const s = `${a} and ${b}`')
+    const { defs, uses } = computeDefUse(stmt)
+    expect(defs.has('s')).toBe(true)
+    expect(uses.has('a')).toBe(true)
+    expect(uses.has('b')).toBe(true)
+  })
+})

package/src/__tests__/taint/field-sensitive-sinks.test.ts

@@ -0,0 +1,179 @@
+/**
+ * Unit tests for field-sensitive sink checking (Phase 5b, Part 3)
+ *
+ * Tests that sink checking uses field-level taint when the sink argument
+ * is a member expression (obj.field), reducing false positives.
+ */
+
+import Parser from 'tree-sitter'
+import { createHash } from 'crypto'
+// eslint-disable-next-line @typescript-eslint/no-require-imports
+const { typescript: TypeScript } = require('tree-sitter-typescript')
+import type { ParsedAST } from '../../parse/ast'
+import type { TaintFinding } from '../../taint/propagation-types'
+import { analyzeTaintsForFile } from '../../taint/taint-analyzer'
+
+const tsParser = new Parser()
+tsParser.setLanguage(TypeScript)
+
+let counter = 0
+function analyze(code: string): TaintFinding[] {
+  const fp = `field-sensitive-sinks-test-${++counter}.ts`
+  const tree = tsParser.parse(code)
+  const hash = createHash('sha1').update(code + counter).digest('hex')
+  const ast: ParsedAST = { tree, language: 'typescript', filePath: fp, hash }
+  return analyzeTaintsForFile(ast, fp)
+}
+
+function hasKind(finding: TaintFinding, kind: string): boolean {
+  return finding.matchingKinds.has(kind as any)
+}
+
+// ============================================================================
+// Field-Sensitive Sink Checking
+// ============================================================================
+describe('Field-Sensitive Sink Checking', () => {
+  it('direct field access in SQL sink → finding', () => {
+    const findings = analyze(`
+      function handler(req: Request) {
+        const data = req.body
+        const email = data.email
+        db.query(\`SELECT * FROM users WHERE email = '\${email}'\`)
+      }
+    `)
+    expect(findings.length).toBeGreaterThanOrEqual(1)
+    expect(findings.some(f => hasKind(f, 'sql'))).toBe(true)
+  })
+
+  it('tainted variable in eval → finding', () => {
+    const findings = analyze(`
+      function handler(req: Request) {
+        const input = req.body
+        eval(input)
+      }
+    `)
+    expect(findings.length).toBeGreaterThanOrEqual(1)
+    expect(findings.some(f => hasKind(f, 'command'))).toBe(true)
+  })
+
+  it('plain identifier in sink still works', () => {
+    const findings = analyze(`
+      function handler(req: Request) {
+        const userInput = req.body
+        eval(userInput)
+      }
+    `)
+    expect(findings.length).toBeGreaterThanOrEqual(1)
+    expect(findings.some(f => hasKind(f, 'command'))).toBe(true)
+  })
+
+  it('tainted field through template literal in SQL', () => {
+    const findings = analyze(`
+      function handler(req: Request) {
+        const { name } = req.body
+        db.query(\`SELECT * FROM users WHERE name = '\${name}'\`)
+      }
+    `)
+    expect(findings.length).toBeGreaterThanOrEqual(1)
+    expect(findings.some(f => hasKind(f, 'sql'))).toBe(true)
+  })
+
+  it('field access preserves taint through assignment', () => {
+    const findings = analyze(`
+      function handler(req: Request) {
+        const body = req.body
+        const name = body.name
+        const query = \`SELECT * FROM users WHERE name = '\${name}'\`
+        db.query(query)
+      }
+    `)
+    expect(findings.length).toBeGreaterThanOrEqual(1)
+  })
+
+  it('multiple fields used in different sinks', () => {
+    const findings = analyze(`
+      function handler(req: Request) {
+        const { email, cmd } = req.body
+        db.query(\`SELECT * FROM users WHERE email = '\${email}'\`)
+        eval(cmd)
+      }
+    `)
+    expect(findings.length).toBeGreaterThanOrEqual(2)
+  })
+
+  it('XSS sink with tainted field', () => {
+    const findings = analyze(`
+      function handler(req: Request, res: Response) {
+        const input = req.body
+        res.send(input.html)
+      }
+    `)
+    expect(findings.length).toBeGreaterThanOrEqual(1)
+    expect(findings.some(f => hasKind(f, 'xss'))).toBe(true)
+  })
+})
+
+// ============================================================================
+// Field Sensitivity with Object Construction
+// ============================================================================
+describe('Object Construction Taint', () => {
+  it('spread of tainted object carries taint to sink', () => {
+    const findings = analyze(`
+      function handler(req: Request) {
+        const data = req.body
+        const copy = { ...data }
+        eval(copy)
+      }
+    `)
+    expect(findings.length).toBeGreaterThanOrEqual(1)
+  })
+
+  it('shorthand property from tainted variable carries taint', () => {
+    const findings = analyze(`
+      function handler(req: Request) {
+        const input = req.body
+        const obj = { input }
+        eval(obj)
+      }
+    `)
+    expect(findings.length).toBeGreaterThanOrEqual(1)
+  })
+})
+
+// ============================================================================
+// Field Sensitivity Does Not Break Existing Patterns
+// ============================================================================
+describe('Backward Compatibility with Sinks', () => {
+  it('no finding from literal-only expressions', () => {
+    const findings = analyze(`
+      function handler() {
+        const safe = "hello"
+        eval(safe)
+      }
+    `)
+    expect(findings.length).toBe(0)
+  })
+
+  it('unknown function call propagates taint through', () => {
+    const findings = analyze(`
+      function handler(req: Request) {
+        const input = req.body
+        const transformed = myCustomTransform(input)
+        eval(transformed)
+      }
+    `)
+    // myCustomTransform is not a known sanitizer, so taint flows through
+    expect(findings.length).toBeGreaterThanOrEqual(1)
+  })
+
+  it('multiple sources converge at single sink', () => {
+    const findings = analyze(`
+      function handler(req: Request) {
+        const a = req.body
+        const b = req.query
+        eval(a + b)
+      }
+    `)
+    expect(findings.length).toBeGreaterThanOrEqual(1)
+  })
+})

package/src/__tests__/taint/field-sensitivity.test.ts

@@ -0,0 +1,342 @@
+/**
+ * Unit tests for field-sensitive taint tracking (Phase 5b, Part 2)
+ *
+ * Tests that one-level field sensitivity correctly propagates taint
+ * per-field, reducing false positives when only specific fields reach sinks.
+ */
+
+import Parser from 'tree-sitter'
+import { createHash } from 'crypto'
+// eslint-disable-next-line @typescript-eslint/no-require-imports
+const { typescript: TypeScript } = require('tree-sitter-typescript')
+import type { ParsedAST } from '../../parse/ast'
+import type { TaintFinding } from '../../taint/propagation-types'
+import { analyzeTaintsForFile } from '../../taint/taint-analyzer'
+import {
+  getTaint, setTaint, deleteTaint, hasTaint,
+  getFieldTaint, setFieldTaint, WHOLE_OBJECT,
+} from '../../taint/propagation-types'
+import type { TaintState, FieldKey } from '../../taint/propagation-types'
+import type { TaintKind } from '../../taint/types'
+
+const tsParser = new Parser()
+tsParser.setLanguage(TypeScript)
+
+let counter = 0
+function analyze(code: string): TaintFinding[] {
+  const fp = `field-sensitivity-test-${++counter}.ts`
+  const tree = tsParser.parse(code)
+  const hash = createHash('sha1').update(code + counter).digest('hex')
+  const ast: ParsedAST = { tree, language: 'typescript', filePath: fp, hash }
+  return analyzeTaintsForFile(ast, fp)
+}
+
+function hasKind(finding: TaintFinding, kind: string): boolean {
+  return finding.matchingKinds.has(kind as any)
+}
+
+// ============================================================================
+// Accessor Unit Tests
+// ============================================================================
+describe('TaintState Accessors', () => {
+  it('getTaint returns undefined for unknown variable', () => {
+    const state: TaintState = new Map()
+    expect(getTaint(state, 'x')).toBeUndefined()
+  })
+
+  it('setTaint + getTaint round-trips', () => {
+    const state: TaintState = new Map()
+    setTaint(state, 'x', new Set(['sql'] as TaintKind[]))
+    const result = getTaint(state, 'x')
+    expect(result).toBeDefined()
+    expect(result!.has('sql' as TaintKind)).toBe(true)
+  })
+
+  it('setTaint replaces existing taint (sets * key)', () => {
+    const state: TaintState = new Map()
+    setTaint(state, 'x', new Set(['sql'] as TaintKind[]))
+    setTaint(state, 'x', new Set(['xss'] as TaintKind[]))
+    const result = getTaint(state, 'x')
+    expect(result!.has('sql' as TaintKind)).toBe(false)
+    expect(result!.has('xss' as TaintKind)).toBe(true)
+  })
+
+  it('deleteTaint removes variable', () => {
+    const state: TaintState = new Map()
+    setTaint(state, 'x', new Set(['sql'] as TaintKind[]))
+    deleteTaint(state, 'x')
+    expect(hasTaint(state, 'x')).toBe(false)
+    expect(getTaint(state, 'x')).toBeUndefined()
+  })
+
+  it('hasTaint returns false for empty field map', () => {
+    const state: TaintState = new Map()
+    state.set('x', new Map())
+    expect(hasTaint(state, 'x')).toBe(false)
+  })
+
+  it('hasTaint returns false for empty kind sets', () => {
+    const state: TaintState = new Map()
+    const fieldMap = new Map<FieldKey, Set<TaintKind>>()
+    fieldMap.set(WHOLE_OBJECT, new Set())
+    state.set('x', fieldMap)
+    expect(hasTaint(state, 'x')).toBe(false)
+  })
+
+  it('setFieldTaint sets per-field taint without touching *', () => {
+    const state: TaintState = new Map()
+    setTaint(state, 'obj', new Set(['sql'] as TaintKind[]))
+    setFieldTaint(state, 'obj', 'email', new Set(['xss'] as TaintKind[]))
+    // email field: xss (field) + sql (* fallback)
+    const emailTaint = getFieldTaint(state, 'obj', 'email')
+    expect(emailTaint!.has('xss' as TaintKind)).toBe(true)
+    expect(emailTaint!.has('sql' as TaintKind)).toBe(true)
+    // whole object still has sql
+    const wholeTaint = getFieldTaint(state, 'obj', WHOLE_OBJECT)
+    expect(wholeTaint!.has('sql' as TaintKind)).toBe(true)
+  })
+
+  it('getFieldTaint falls back to * when field not set', () => {
+    const state: TaintState = new Map()
+    setTaint(state, 'obj', new Set(['sql'] as TaintKind[]))
+    const fieldTaint = getFieldTaint(state, 'obj', 'anyField')
+    expect(fieldTaint!.has('sql' as TaintKind)).toBe(true)
+  })
+
+  it('getFieldTaint returns undefined when no taint at all', () => {
+    const state: TaintState = new Map()
+    expect(getFieldTaint(state, 'obj', 'email')).toBeUndefined()
+  })
+
+  it('setFieldTaint on new variable creates field map', () => {
+    const state: TaintState = new Map()
+    setFieldTaint(state, 'obj', 'email', new Set(['sql'] as TaintKind[]))
+    const emailTaint = getFieldTaint(state, 'obj', 'email')
+    expect(emailTaint!.has('sql' as TaintKind)).toBe(true)
+    // No * key, so other fields return undefined
+    expect(getFieldTaint(state, 'obj', 'other')).toBeUndefined()
+  })
+
+  it('getTaint returns union of all fields + *', () => {
+    const state: TaintState = new Map()
+    setTaint(state, 'obj', new Set(['sql'] as TaintKind[]))
+    setFieldTaint(state, 'obj', 'email', new Set(['xss'] as TaintKind[]))
+    const all = getTaint(state, 'obj')
+    expect(all!.has('sql' as TaintKind)).toBe(true)
+    expect(all!.has('xss' as TaintKind)).toBe(true)
+  })
+
+  it('setTaint clears field-specific entries', () => {
+    const state: TaintState = new Map()
+    setFieldTaint(state, 'obj', 'email', new Set(['xss'] as TaintKind[]))
+    setFieldTaint(state, 'obj', 'name', new Set(['sql'] as TaintKind[]))
+    // Now set whole-object taint — should clear field entries
+    setTaint(state, 'obj', new Set(['command'] as TaintKind[]))
+    const all = getTaint(state, 'obj')
+    expect(all!.has('command' as TaintKind)).toBe(true)
+    expect(all!.has('xss' as TaintKind)).toBe(false)
+    expect(all!.has('sql' as TaintKind)).toBe(false)
+  })
+})
+
+// ============================================================================
+// Member Expression Field Taint
+// ============================================================================
+describe('Member Expression Field Taint', () => {
+  it('obj.field in sink → finding when obj is tainted', () => {
+    const findings = analyze(`
+      function handler(req: Request) {
+        const obj = req.body
+        db.query(obj.email)
+      }
+    `)
+    expect(findings.length).toBeGreaterThanOrEqual(1)
+    expect(findings.some(f => hasKind(f, 'sql'))).toBe(true)
+  })
+
+  it('detects taint flowing through member expression chain', () => {
+    const findings = analyze(`
+      function handler(req: Request) {
+        const input = req.body
+        const email = input.email
+        db.query(\`SELECT * FROM users WHERE email = '\${email}'\`)
+      }
+    `)
+    expect(findings.length).toBeGreaterThanOrEqual(1)
+    expect(findings.some(f => hasKind(f, 'sql'))).toBe(true)
+  })
+
+  it('direct req.body.field access still detected', () => {
+    const findings = analyze(`
+      function handler(req: Request) {
+        db.query(\`SELECT * FROM users WHERE email = '\${req.body.email}'\`)
+      }
+    `)
+    expect(findings.length).toBeGreaterThanOrEqual(1)
+  })
+})
+
+// ============================================================================
+// Destructuring Field Taint
+// ============================================================================
+describe('Destructuring Field Taint', () => {
+  it('destructured field reaches sink → finding', () => {
+    const findings = analyze(`
+      function handler(req: Request) {
+        const { email } = req.body
+        db.query(\`SELECT * FROM users WHERE email = '\${email}'\`)
+      }
+    `)
+    expect(findings.length).toBeGreaterThanOrEqual(1)
+    expect(findings.some(f => hasKind(f, 'sql'))).toBe(true)
+  })
+
+  it('rest element in destructuring carries taint', () => {
+    const findings = analyze(`
+      function handler(req: Request) {
+        const { safe, ...rest } = req.body
+        eval(JSON.stringify(rest))
+      }
+    `)
+    expect(findings.length).toBeGreaterThanOrEqual(1)
+  })
+
+  it('renamed destructuring propagates taint', () => {
+    const findings = analyze(`
+      function handler(req: Request) {
+        const { email: userEmail } = req.body
+        db.query(\`SELECT * FROM users WHERE email = '\${userEmail}'\`)
+      }
+    `)
+    expect(findings.length).toBeGreaterThanOrEqual(1)
+  })
+})
+
+// ============================================================================
+// Field Assignment
+// ============================================================================
+describe('Field Assignment', () => {
+  it('obj.field = tainted → that field carries taint to sink', () => {
+    const findings = analyze(`
+      function handler(req: Request) {
+        const input = req.body
+        const obj = {}
+        obj.email = input
+        db.query(obj.email)
+      }
+    `)
+    expect(findings.length).toBeGreaterThanOrEqual(1)
+  })
+
+  it('whole object assignment taints all fields', () => {
+    const findings = analyze(`
+      function handler(req: Request) {
+        let data = req.body
+        db.query(data.anything)
+      }
+    `)
+    expect(findings.length).toBeGreaterThanOrEqual(1)
+  })
+})
+
+// ============================================================================
+// Dynamic Access (Conservative Fallback)
+// ============================================================================
+describe('Dynamic Access', () => {
+  it('obj[dynamicKey] falls back to whole-object taint', () => {
+    const findings = analyze(`
+      function handler(req: Request) {
+        const data = req.body
+        const key = "email"
+        db.query(data[key])
+      }
+    `)
+    expect(findings.length).toBeGreaterThanOrEqual(1)
+  })
+})
+
+// ============================================================================
+// Backward Compatibility
+// ============================================================================
+describe('Backward Compatibility', () => {
+  it('plain variable taint works (no field access)', () => {
+    const findings = analyze(`
+      function handler(req: Request) {
+        const x = req.body
+        eval(x)
+      }
+    `)
+    expect(findings.length).toBeGreaterThanOrEqual(1)
+    expect(findings.some(f => hasKind(f, 'command'))).toBe(true)
+  })
+
+  it('source seeding with req.body/req.query works', () => {
+    const findings = analyze(`
+      function handler(req: Request) {
+        const q = req.query.search
+        db.query(\`SELECT * FROM items WHERE name = '\${q}'\`)
+      }
+    `)
+    expect(findings.length).toBeGreaterThanOrEqual(1)
+  })
+
+  it('two-step propagation still works', () => {
+    const findings = analyze(`
+      function handler(req: Request) {
+        const x = req.body
+        const y = x
+        eval(y)
+      }
+    `)
+    expect(findings.length).toBeGreaterThanOrEqual(1)
+  })
+
+  it('sanitizer still clears taint', () => {
+    const findings = analyze(`
+      function handler(req: Request) {
+        const x = req.body.email
+        const safe = validator.escape(x)
+        res.send(safe)
+      }
+    `)
+    // Sanitizer should clear XSS taint
+    const xssFindings = findings.filter(f => hasKind(f, 'xss'))
+    expect(xssFindings.length).toBe(0)
+  })
+
+  it('template literal with tainted substitution detected', () => {
+    const findings = analyze(`
+      function handler(req: Request) {
+        const name = req.body.name
+        db.query(\`SELECT * FROM users WHERE name = '\${name}'\`)
+      }
+    `)
+    expect(findings.length).toBeGreaterThanOrEqual(1)
+    expect(findings.some(f => hasKind(f, 'sql'))).toBe(true)
+  })
+
+  it('binary concatenation with tainted data detected', () => {
+    const findings = analyze(`
+      function handler(req: Request) {
+        const id = req.params.id
+        const q = "SELECT * FROM users WHERE id = " + id
+        db.query(q)
+      }
+    `)
+    expect(findings.length).toBeGreaterThanOrEqual(1)
+    expect(findings.some(f => hasKind(f, 'sql'))).toBe(true)
+  })
+
+  it('augmented assignment propagates taint', () => {
+    const findings = analyze(`
+      function handler(req: Request) {
+        const input = req.body
+        let q = ""
+        q += input
+        eval(q)
+      }
+    `)
+    expect(findings.length).toBeGreaterThanOrEqual(1)
+    expect(findings.some(f => hasKind(f, 'command'))).toBe(true)
+  })
+})