@oculum/scanner 1.0.9 → 1.0.11

package/src/layer2/dangerous-functions/json-parse.ts

@@ -0,0 +1,385 @@
+/**
+ * JSON.parse Detection
+ *
+ * Source-aware detection of JSON.parse usage with severity classification
+ * based on the data source and error handling context.
+ */
+
+import type { Vulnerability, VulnerabilitySeverity } from '../../types'
+import { isComment, isTestOrMockFile } from '../../utils/context-helpers'
+import { isInsideTryCatch, hasTryCatchNearby } from './utils/control-flow'
+import { hasSchemaValidationNearby } from './utils/schema-validation'
+
+/**
+ * JSON.parse source classification
+ * Determines if the input is user-controlled or internal data
+ */
+export type JSONParseSource =
+  | 'user_input'
+  | 'local_storage'
+  | 'database'
+  | 'config'
+  | 'migration'
+  | 'internal'
+  | 'test_fixture'
+  | 'ui_state'
+  | 'unknown'
+
+/**
+ * Check if file path indicates a low-risk context for JSON.parse
+ */
+export function isLowRiskJSONParseFile(filePath: string): JSONParseSource | null {
+  // Test/mock files - skip or info only
+  if (isTestOrMockFile(filePath)) {
+    return 'test_fixture'
+  }
+
+  // Settings/preferences components - internal UI state
+  if (/\/(components|pages)\/(settings|preferences|config)/i.test(filePath)) {
+    return 'ui_state'
+  }
+
+  // Provider/context files - typically storing state in localStorage
+  if (/Provider\.(ts|tsx|js|jsx)$/i.test(filePath)) {
+    return 'ui_state'
+  }
+
+  // Modal/Dialog components - typically internal state
+  if (/(Modal|Dialog|Settings|Preferences)\.(ts|tsx|js|jsx)$/i.test(filePath)) {
+    return 'ui_state'
+  }
+
+  // __mocks__ directory
+  if (/__mocks__/i.test(filePath)) {
+    return 'test_fixture'
+  }
+
+  // fixtures directory
+  if (/\/(fixtures?|stubs?|mocks?)\//i.test(filePath)) {
+    return 'test_fixture'
+  }
+
+  // scripts/tools directories (internal tooling)
+  if (/\/(scripts?|tools?|cli)\//i.test(filePath)) {
+    return 'internal'
+  }
+
+  // Migration files
+  if (/migration/i.test(filePath)) {
+    return 'migration'
+  }
+
+  // Config files
+  if (/\/(config|settings|constants)\.(ts|js)/i.test(filePath)) {
+    return 'config'
+  }
+
+  return null
+}
+
+/**
+ * Check if JSON.parse is parsing a trusted SDK response
+ * These are well-defined responses from known APIs and are safe to parse
+ */
+export function isTrustedSDKResponse(lineContent: string, content: string): boolean {
+  const trustedPatterns = [
+    // OpenAI SDK responses
+    /JSON\.parse\s*\(\s*(?:response|completion|result|message)\.(?:content|text|data)/i,
+    /JSON\.parse\s*\(\s*(?:openai|anthropic|client)\./i,
+    // Fetch response.json() result (already parsed by fetch)
+    /JSON\.parse\s*\(\s*await\s+.*\.json\s*\(\s*\)\s*\)/i,
+    // SDK method results
+    /JSON\.parse\s*\(\s*(?:result|response)\.(?:choices|content|data|body)\[/i,
+    // AI SDK streaming results
+    /JSON\.parse\s*\(\s*(?:chunk|delta|part)\.(?:content|text)/i,
+  ]
+
+  if (trustedPatterns.some(p => p.test(lineContent))) {
+    return true
+  }
+
+  // Check surrounding context for SDK usage
+  const sdkContextPatterns = [
+    /openai\..*\.create/i,
+    /anthropic\..*\.create/i,
+    /\.chat\.completions/i,
+    /\.messages\.create/i,
+  ]
+
+  return sdkContextPatterns.some(p => p.test(content))
+}
+
+/**
+ * Classify the source of data being passed to JSON.parse
+ */
+export function classifyJSONParseSource(
+  lineContent: string,
+  filePath: string
+): JSONParseSource {
+  // First check file path for low-risk contexts
+  const fileBasedSource = isLowRiskJSONParseFile(filePath)
+  if (fileBasedSource) {
+    return fileBasedSource
+  }
+
+  // User input - potentially dangerous
+  const userInputPatterns = [
+    /JSON\.parse\s*\(\s*(req|request)\.(body|query|params)/i,
+    /JSON\.parse\s*\(\s*event\.(body|queryStringParameters)/i, // AWS Lambda
+    /JSON\.parse\s*\(\s*ctx\.(request|body|query)/i, // Koa
+    /JSON\.parse\s*\(\s*(input|userInput|rawInput|payload)/i,
+    /JSON\.parse\s*\(\s*body\b/i, // Generic 'body' often means request body
+  ]
+  if (userInputPatterns.some(p => p.test(lineContent))) {
+    return 'user_input'
+  }
+
+  // localStorage/sessionStorage - client-side storage
+  const storagePatterns = [
+    /JSON\.parse\s*\(\s*localStorage\.getItem/i,
+    /JSON\.parse\s*\(\s*sessionStorage\.getItem/i,
+    /JSON\.parse\s*\(\s*window\.localStorage/i,
+    /JSON\.parse\s*\(\s*storage\.get/i,
+    /JSON\.parse\s*\(\s*saved\b/i, // Common pattern: const saved = localStorage.getItem(...); JSON.parse(saved)
+    /JSON\.parse\s*\(\s*stored\b/i,
+  ]
+  if (storagePatterns.some(p => p.test(lineContent))) {
+    return 'local_storage'
+  }
+
+  // Database results - internal data
+  const databasePatterns = [
+    /JSON\.parse\s*\(\s*(row|result|record|doc|document)\./i,
+    /JSON\.parse\s*\(\s*\w+\.(data|json|metadata|embedding)\)/i,
+    /JSON\.parse\s*\(\s*\w+\[['"]?\w+['"]?\]\.(data|json|embedding)/i,
+    /JSON\.parse\s*\(\s*item\.\w+\)/i, // ORM iteration: items.map(item => JSON.parse(item.field))
+    /JSON\.parse\s*\(\s*\w+\.content\)/i, // Parsing content field from DB
+  ]
+  if (databasePatterns.some(p => p.test(lineContent))) {
+    return 'database'
+  }
+
+  // Editor state, internal caches, UI state
+  const internalPatterns = [
+    /JSON\.parse\s*\(\s*(state|cache|stored|saved|cached)/i,
+    /JSON\.parse\s*\(\s*this\.(state|cache|data)/i,
+    /JSON\.parse\s*\(\s*\w+State\)/i,
+    /JSON\.parse\s*\(\s*editorState/i,
+    /JSON\.parse\s*\(\s*parsed\b/i, // JSON.parse(parsed) - likely already validated
+    /JSON\.parse\s*\(\s*settings\b/i, // Settings data
+    /JSON\.parse\s*\(\s*preferences\b/i,
+  ]
+  if (internalPatterns.some(p => p.test(lineContent))) {
+    return 'internal'
+  }
+
+  // Node content in editor apps (e.g., noda-os nodes have JSON content)
+  if (
+    /JSON\.parse\s*\(\s*(node|note|document|entry)\.(content|body|data)\)/i.test(
+      lineContent
+    )
+  ) {
+    return 'database'
+  }
+
+  return 'unknown'
+}
+
+/**
+ * Detect JSON.parse usage with source-aware severity
+ * Much smarter than simple pattern matching - considers try/catch and data source
+ */
+export function detectJSONParseSafe(
+  content: string,
+  filePath: string,
+  isTestFile: boolean,
+  vulnerabilities: Vulnerability[]
+): void {
+  const lines = content.split('\n')
+  const jsonParsePattern = /JSON\.parse\s*\(/gi
+
+  // Track instances per file to aggregate noisy patterns
+  const instances: {
+    lineNumber: number
+    lineContent: string
+    source: JSONParseSource
+  }[] = []
+
+  lines.forEach((line, index) => {
+    if (isComment(line)) return
+
+    jsonParsePattern.lastIndex = 0
+    if (!jsonParsePattern.test(line)) return
+
+    const jsonSource = classifyJSONParseSource(line, filePath)
+
+    // Skip migration files entirely - they're internal tooling
+    if (jsonSource === 'migration') return
+
+    // Skip test fixtures entirely - they're intentionally parsing test data
+    if (jsonSource === 'test_fixture') return
+
+    // Skip trusted SDK responses - these are well-defined and safe to parse
+    if (isTrustedSDKResponse(line, content)) return
+
+    // Check if JSON.parse is inside a try-catch block
+    const insideTryCatch =
+      isInsideTryCatch(content, index) || hasTryCatchNearby(content, index)
+
+    // Check if schema validation is applied after JSON.parse
+    const hasSchemaValidation = hasSchemaValidationNearby(content, index)
+
+    // If inside try-catch with safe source, suppress entirely - this is perfectly fine
+    if (
+      insideTryCatch &&
+      ['local_storage', 'database', 'config', 'internal', 'ui_state'].includes(
+        jsonSource
+      )
+    ) {
+      return
+    }
+
+    // If schema validation is present, this is properly handled
+    if (hasSchemaValidation) {
+      return
+    }
+
+    // UI state (settings, providers, modals) - very low risk, aggregate or skip
+    if (jsonSource === 'ui_state') {
+      // Only track for aggregation, don't report individually
+      instances.push({
+        lineNumber: index + 1,
+        lineContent: line.trim(),
+        source: jsonSource,
+      })
+      return
+    }
+
+    // Determine severity based on source and error handling
+    let severity: VulnerabilitySeverity
+    let description: string
+    let suggestedFix: string
+    let confidence: 'high' | 'medium' | 'low' = 'medium'
+
+    if (insideTryCatch) {
+      // Already has error handling
+      switch (jsonSource) {
+        case 'user_input':
+          severity = 'low'
+          description =
+            'JSON.parse on user input is wrapped in try-catch. Consider adding schema validation (zod/yup) to validate the parsed structure.'
+          suggestedFix =
+            'Add schema validation after parsing: const validated = schema.parse(JSON.parse(input))'
+          confidence = 'low'
+          break
+        default:
+          // With try-catch and non-user source, this is fine - don't report
+          return
+      }
+    } else {
+      // No try-catch
+      switch (jsonSource) {
+        case 'user_input':
+          severity = 'medium'
+          description =
+            'JSON.parse on user input without schema validation. Malformed input will crash; malicious input may have unexpected shape.'
+          suggestedFix =
+            'Use a schema validation library (zod, yup, joi): try { const data = schema.parse(JSON.parse(body)) } catch (e) { return 400 }'
+          confidence = 'high'
+          break
+        case 'local_storage':
+          severity = 'info'
+          description =
+            'JSON.parse on localStorage data. Consider adding try-catch for robustness against corrupted data.'
+          suggestedFix =
+            'Wrap in try-catch to handle corrupted localStorage gracefully.'
+          confidence = 'low'
+          break
+        case 'database':
+          // Database content parsing is very common and low-risk
+          instances.push({
+            lineNumber: index + 1,
+            lineContent: line.trim(),
+            source: jsonSource,
+          })
+          return // Will be aggregated below
+        case 'config':
+        case 'internal':
+          severity = 'info'
+          description = `JSON.parse on ${jsonSource.replace('_', ' ')} data without error handling. Low risk but consider defensive coding.`
+          suggestedFix = 'Consider adding try-catch for robustness.'
+          confidence = 'low'
+          break
+        default:
+          // Unknown source - track for potential aggregation
+          instances.push({
+            lineNumber: index + 1,
+            lineContent: line.trim(),
+            source: jsonSource,
+          })
+          return // Will be evaluated below based on aggregation
+      }
+    }
+
+    // Downgrade test files
+    if (isTestFile) {
+      severity = 'info'
+      confidence = 'low'
+      description += ' (in test file)'
+    }
+
+    vulnerabilities.push({
+      id: `json-parse-${filePath}-${index + 1}`,
+      filePath,
+      lineNumber: index + 1,
+      lineContent: line.trim(),
+      severity,
+      category: 'dangerous_function',
+      title: 'JSON.parse usage',
+      description,
+      suggestedFix,
+      confidence,
+      layer: 2,
+    })
+  })
+
+  // Aggregate low-risk JSON.parse instances if there are many
+  if (instances.length >= 3) {
+    // Create single aggregated finding instead of N individual findings
+    const lineNumbers = instances.map(i => i.lineNumber).slice(0, 5)
+    const moreText =
+      instances.length > 5 ? `... (${instances.length} total)` : ''
+
+    vulnerabilities.push({
+      id: `json-parse-aggregated-${filePath}`,
+      filePath,
+      lineNumber: instances[0].lineNumber,
+      lineContent: `${instances.length} instances across this file`,
+      severity: 'info',
+      category: 'dangerous_function',
+      title: `JSON.parse usage (${instances.length} instances)`,
+      description: `JSON.parse detected. Consider adding error handling and schema validation if parsing user input.${isTestFile ? ' (in test file)' : ''}\n\nFound ${instances.length} occurrences at lines: ${lineNumbers.join(', ')}${moreText}`,
+      suggestedFix:
+        'Add try-catch for error handling. If parsing user input, add schema validation.',
+      confidence: 'low',
+      layer: 2,
+    })
+  } else if (instances.length > 0 && instances.length < 3) {
+    // Report individually for small counts
+    for (const instance of instances) {
+      vulnerabilities.push({
+        id: `json-parse-${filePath}-${instance.lineNumber}`,
+        filePath,
+        lineNumber: instance.lineNumber,
+        lineContent: instance.lineContent,
+        severity: 'info',
+        category: 'dangerous_function',
+        title: 'JSON.parse usage',
+        description: `JSON.parse on ${instance.source.replace('_', ' ')} data without error handling. Low risk but consider defensive coding.${isTestFile ? ' (in test file)' : ''}`,
+        suggestedFix: 'Consider adding try-catch for robustness.',
+        confidence: 'low',
+        layer: 2,
+      })
+    }
+  }
+}