@oculum/scanner 1.0.14 → 1.0.15

package/src/__tests__/taint/taint-smoke.test.ts

@@ -0,0 +1,400 @@
+/**
+ * Smoke tests: Run actual scans through the full pipeline and verify
+ * taint findings are produced and behave correctly in ScanResult output.
+ *
+ * IMPORTANT: The pipeline deduplicates findings by `filePath:lineNumber:category`.
+ * When both a pattern-based AST rule and the taint-flow rule fire on the same
+ * line with the same category, dedup keeps the higher-severity one. This means:
+ *
+ * - Taint findings are VISIBLE when they cover categories no pattern rule covers
+ *   (e.g., SSRF from fetch, XSS from innerHTML)
+ * - Taint findings are MERGED when pattern rules already flag the same line+category
+ *   (e.g., sql-injection-ast + taint-flow-sql → dedup keeps one)
+ *
+ * The debug tests (`taint-debug.test.ts`) verify the engine itself works for
+ * every scenario. These tests verify pipeline-level behavior.
+ */
+
+import { runScan } from '../../pipeline'
+import type { ScanFile, ScanResult, Vulnerability } from '../../shared/types'
+import { parseFile, clearASTCache } from '../../parse/ast'
+import { analyzeTaintsForFile } from '../../taint/taint-analyzer'
+import { clearTaintFlowCache } from '../../detect/ast-rules/taint-flow-ast'
+
+// ============================================================================
+// Helpers
+// ============================================================================
+
+function makeScanFile(path: string, content: string): ScanFile {
+  const lang = path.endsWith('.py') ? 'python'
+    : path.endsWith('.js') ? 'javascript'
+    : 'typescript'
+  return { path, content, language: lang, size: content.length }
+}
+
+async function scan(files: ScanFile[]): Promise<ScanResult> {
+  return runScan(
+    files,
+    { name: 'taint-smoke-test', url: '', branch: 'main' },
+    { quiet: true, scanDepth: 'local', enableAI: false },
+  )
+}
+
+function taintFindings(result: ScanResult): Vulnerability[] {
+  return result.vulnerabilities.filter(v => v.id.includes('ast-taint-flow'))
+}
+
+function findingsByCategory(result: ScanResult, category: string): Vulnerability[] {
+  return result.vulnerabilities.filter(v => v.category === category)
+}
+
+let rawTaintCounter = 0
+/** Run taint engine directly (bypassing pipeline dedup) to verify engine output */
+function rawTaintFindings(code: string, filePath: string) {
+  rawTaintCounter++
+  const fp = `raw-taint-smoke-${rawTaintCounter}-${filePath}`
+  const ast = parseFile(code, fp)
+  if (!ast) return []
+  return analyzeTaintsForFile(ast, fp)
+}
+
+// ============================================================================
+// Scenario Group 1: Taint-only findings (no pattern overlap)
+// These scenarios produce findings ONLY from the taint engine.
+// ============================================================================
+
+describe('Smoke: Taint-only findings (no pattern overlap)', () => {
+  jest.setTimeout(30_000)
+
+  beforeEach(() => {
+    clearASTCache()
+    clearTaintFlowCache()
+  })
+
+  it('S1: SSRF via user-controlled fetch URL', async () => {
+    const code = `
+      function proxyRequest(req, res) {
+        const target = req.query
+        fetch(target)
+      }
+    `
+    const result = await scan([makeScanFile('src/api/proxy.ts', code)])
+
+    console.log('\n=== S1: SSRF via fetch ===')
+    for (const v of result.vulnerabilities) {
+      console.log(`  [${v.severity}] ${v.category} | ${v.id} | L${v.lineNumber}`)
+    }
+
+    const ssrfTaint = taintFindings(result).filter(v => v.category === 'ssrf')
+    expect(ssrfTaint.length).toBeGreaterThanOrEqual(1)
+    expect(ssrfTaint[0].severity).toBe('high')
+    expect(ssrfTaint[0].description).toContain('User input from')
+  })
+
+  it('S2: XSS via unsanitized innerHTML', async () => {
+    const code = `
+      function renderUserContent(req, res) {
+        const input = req.body
+        document.getElementById('output').innerHTML = input
+      }
+    `
+    const result = await scan([makeScanFile('src/components/unsafe-render.ts', code)])
+
+    console.log('\n=== S2: Unsanitized XSS ===')
+    for (const v of result.vulnerabilities) {
+      console.log(`  [${v.severity}] ${v.category} | ${v.id} | L${v.lineNumber}`)
+    }
+
+    const xssTaint = taintFindings(result).filter(v => v.category === 'xss')
+    expect(xssTaint.length).toBeGreaterThanOrEqual(1)
+  })
+
+  it('S3: Command injection via eval (taint category: command_injection)', async () => {
+    // eval is caught by dangerous-eval-ast as "dangerous_function", but
+    // taint-flow emits "command_injection" — different categories.
+    // With evidence-based scoring (Phase 7), taint findings are 'proven' (base 0.90)
+    // and surface in local mode. Pattern-based 'dangerous_function' is 'partial' (base 0.60)
+    // and gets suppressed in local mode (below 0.70 threshold, no AI available).
+    const code = `
+      function processUserInput(req, res) {
+        const payload = req.body
+        eval(payload)
+      }
+    `
+    const result = await scan([makeScanFile('src/api/process.ts', code)])
+
+    console.log('\n=== S3: Command injection via eval ===')
+    for (const v of result.vulnerabilities) {
+      console.log(`  [${v.severity}] ${v.category} | ${v.id} | L${v.lineNumber}`)
+    }
+
+    // Taint engine emits proven command_injection — surfaces in local mode
+    const cmdTaint = taintFindings(result).filter(v => v.category === 'command_injection')
+    expect(cmdTaint.length).toBeGreaterThanOrEqual(1)
+    // Pattern-based dangerous_function is partial evidence — suppressed in local mode
+    // (This is correct: the proven taint finding provides stronger evidence)
+  })
+
+  it('S4: Two-step propagation (source → intermediate → sink)', async () => {
+    const code = `
+      function processRequest(req, res) {
+        const raw = req.body
+        const processed = raw
+        eval(processed)
+      }
+    `
+    const result = await scan([makeScanFile('src/api/indirect.ts', code)])
+
+    console.log('\n=== S4: Two-step propagation ===')
+    for (const v of result.vulnerabilities) {
+      console.log(`  [${v.severity}] ${v.category} | ${v.id} | L${v.lineNumber}`)
+    }
+
+    const cmdTaint = taintFindings(result).filter(v => v.category === 'command_injection')
+    expect(cmdTaint.length).toBeGreaterThanOrEqual(1)
+  })
+})
+
+// ============================================================================
+// Scenario Group 2: Sanitizer effectiveness
+// ============================================================================
+
+describe('Smoke: Sanitizer effectiveness', () => {
+  jest.setTimeout(30_000)
+
+  beforeEach(() => {
+    clearASTCache()
+    clearTaintFlowCache()
+  })
+
+  it('S5: DOMPurify sanitized flow → no XSS taint finding', async () => {
+    const code = `
+      import DOMPurify from 'dompurify'
+
+      function renderContent(req, res) {
+        const raw = req.body
+        const clean = DOMPurify.sanitize(raw)
+        document.getElementById('content').innerHTML = clean
+      }
+    `
+    const result = await scan([makeScanFile('src/components/render.ts', code)])
+
+    console.log('\n=== S5: Sanitized XSS ===')
+    for (const v of result.vulnerabilities) {
+      console.log(`  [${v.severity}] ${v.category} | ${v.id} | L${v.lineNumber}`)
+    }
+
+    const xssTaint = taintFindings(result).filter(v => v.category === 'xss')
+    expect(xssTaint.length).toBe(0)
+  })
+
+  it('S6: No user input sources → zero taint findings', async () => {
+    const code = `
+      function computeStats() {
+        const data = [1, 2, 3, 4, 5]
+        const sum = data.reduce((a, b) => a + b, 0)
+        const avg = sum / data.length
+        console.log('Average:', avg)
+        return { sum, avg }
+      }
+    `
+    const result = await scan([makeScanFile('src/utils/stats.ts', code)])
+
+    const taint = taintFindings(result)
+    expect(taint.length).toBe(0)
+  })
+})
+
+// ============================================================================
+// Scenario Group 3: Deduplication behavior
+// ============================================================================
+
+describe('Smoke: Deduplication with pattern-based rules', () => {
+  jest.setTimeout(30_000)
+
+  beforeEach(() => {
+    clearASTCache()
+    clearTaintFlowCache()
+  })
+
+  it('S7: SQL injection — taint engine fires but dedup merges with pattern rule', async () => {
+    const code = `
+      function handleSearch(req, res) {
+        const term = req.query
+        const result = db.query("SELECT * FROM items WHERE name = " + term)
+        res.json(result)
+      }
+    `
+    // First, verify the taint engine DOES find it
+    const rawFindings = rawTaintFindings(code, 'search.ts')
+    expect(rawFindings.length).toBeGreaterThanOrEqual(1)
+    expect(rawFindings[0].matchingKinds.has('sql')).toBe(true)
+
+    // In the full pipeline, it gets deduped with the pattern-based sql_injection rule
+    const result = await scan([makeScanFile('src/routes/search.ts', code)])
+
+    console.log('\n=== S7: SQL injection dedup ===')
+    for (const v of result.vulnerabilities) {
+      console.log(`  [${v.severity}] ${v.category} | ${v.id} | L${v.lineNumber}`)
+    }
+
+    // SQL injection IS detected (by either taint or pattern rule)
+    const sqlFindings = findingsByCategory(result, 'sql_injection')
+    expect(sqlFindings.length).toBeGreaterThanOrEqual(1)
+
+    // After dedup, at most one sql_injection per line
+    const lineNumbers = sqlFindings.map(v => v.lineNumber)
+    expect(new Set(lineNumbers).size).toBe(lineNumbers.length)
+  })
+
+  it('S8: child_process.exec — taint fires but dedup merges with pattern rule', async () => {
+    const code = `
+      import { exec } from 'child_process'
+
+      function runCommand(req, res) {
+        const cmd = req.body
+        exec(cmd, (err, stdout) => {
+          res.json({ output: stdout })
+        })
+      }
+    `
+    // Taint engine finds it
+    const rawFindings = rawTaintFindings(code, 'exec.ts')
+    expect(rawFindings.length).toBeGreaterThanOrEqual(1)
+    expect(rawFindings[0].matchingKinds.has('command')).toBe(true)
+
+    // Pipeline deduplicates
+    const result = await scan([makeScanFile('src/api/exec.ts', code)])
+
+    console.log('\n=== S8: child_process.exec dedup ===')
+    for (const v of result.vulnerabilities) {
+      console.log(`  [${v.severity}] ${v.category} | ${v.id} | L${v.lineNumber}`)
+    }
+
+    // command_injection IS detected (by one or the other)
+    const cmdFindings = findingsByCategory(result, 'command_injection')
+    expect(cmdFindings.length).toBeGreaterThanOrEqual(1)
+  })
+
+  it('S9: Dedup keeps no duplicates at same line:category', async () => {
+    const code = `
+      function handler(req, res) {
+        const x = req.body
+        eval(x)
+      }
+    `
+    const result = await scan([makeScanFile('src/api/dedup-test.ts', code)])
+
+    // Verify no duplicate lineNumber:category pairs
+    const keys = result.vulnerabilities.map(v => `${v.lineNumber}:${v.category}`)
+    expect(new Set(keys).size).toBe(keys.length)
+  })
+})
+
+// ============================================================================
+// Scenario Group 4: Multi-file and complex patterns
+// ============================================================================
+
+describe('Smoke: Multi-file and complex patterns', () => {
+  jest.setTimeout(30_000)
+
+  beforeEach(() => {
+    clearASTCache()
+    clearTaintFlowCache()
+  })
+
+  it('S10: Multi-file: taint only from vulnerable file', async () => {
+    const vulnerableFile = `
+      function handleLogin(req, res) {
+        const user = req.body
+        eval(user)
+        return res.json({ ok: true })
+      }
+    `
+    const safeFile = `
+      function getHealth(req, res) {
+        return res.json({ status: 'ok', uptime: process.uptime() })
+      }
+    `
+    const files = [
+      makeScanFile('src/routes/login.ts', vulnerableFile),
+      makeScanFile('src/routes/health.ts', safeFile),
+    ]
+
+    const result = await scan(files)
+
+    console.log('\n=== S10: Multi-file scan ===')
+    for (const v of result.vulnerabilities) {
+      console.log(`  [${v.severity}] ${v.category} | ${v.id} | ${v.filePath}:${v.lineNumber}`)
+    }
+
+    // Taint findings only from login.ts (eval + command_injection)
+    const taint = taintFindings(result)
+    const taintFromLogin = taint.filter(v => v.filePath.includes('login'))
+    const taintFromHealth = taint.filter(v => v.filePath.includes('health'))
+
+    expect(taintFromLogin.length).toBeGreaterThanOrEqual(1)
+    expect(taintFromHealth.length).toBe(0)
+  })
+
+  it('S11: Multiple sinks from single source → multiple categories', async () => {
+    const code = `
+      function dangerousHandler(req, res) {
+        const input = req.body
+        eval(input)
+        document.getElementById('x').innerHTML = input
+        fetch(input)
+      }
+    `
+    const result = await scan([makeScanFile('src/api/multi-sink.ts', code)])
+
+    console.log('\n=== S11: Multiple sinks ===')
+    for (const v of result.vulnerabilities) {
+      console.log(`  [${v.severity}] ${v.category} | ${v.id} | L${v.lineNumber}`)
+    }
+
+    const taint = taintFindings(result)
+    const categories = new Set(taint.map(v => v.category))
+    console.log(`Taint categories: ${[...categories].join(', ')}`)
+
+    // Should have at least 2 different categories from taint
+    // (command_injection from eval, xss from innerHTML, ssrf from fetch)
+    expect(categories.size).toBeGreaterThanOrEqual(2)
+  })
+
+  it('S12: Realistic app with auth middleware + vulnerable route', async () => {
+    const middleware = `
+      import { auth } from '@clerk/nextjs'
+      export function authMiddleware(req, res, next) {
+        const session = auth()
+        if (!session.userId) {
+          return res.status(401).json({ error: 'Unauthorized' })
+        }
+        next()
+      }
+    `
+    const route = `
+      function createPost(req, res) {
+        const content = req.body
+        eval(content)
+        return res.json({ ok: true })
+      }
+    `
+    const files = [
+      makeScanFile('src/middleware/auth.ts', middleware),
+      makeScanFile('src/routes/posts.ts', route),
+    ]
+
+    const result = await scan(files)
+
+    console.log('\n=== S12: Realistic app ===')
+    for (const v of result.vulnerabilities) {
+      console.log(`  [${v.severity}] ${v.category} | ${v.id} | ${v.filePath}:${v.lineNumber}`)
+    }
+
+    // Taint detects the command injection in routes/posts.ts
+    const cmdTaint = taintFindings(result).filter(v => v.category === 'command_injection')
+    expect(cmdTaint.length).toBeGreaterThanOrEqual(1)
+    expect(cmdTaint[0].filePath).toContain('posts')
+  })
+})