@profullstack/threatcrush 0.11.2 → 0.11.3

package/dist/index.js

@@ -9939,7 +9939,11 @@ var NODE_RULES = [
     severity: "medium",
     languages: ["javascript", "typescript"],
     pattern: /\bBuffer\s*\.\s*allocUnsafe(?:Slow)?\s*\(|\bnew\s+Buffer\s*\(\s*(?![`'"])[a-zA-Z_$0-9]/,
-    inherent: true
+    inherent: true,
+    // Filling the buffer yourself is the whole reason to call `allocUnsafe`,
+    // so reporting every call reports correct code. What is left reported is
+    // an allocation whose bytes are never written before it escapes.
+    filledBeforeUseGuard: true
   },
   {
     id: "js-oversized-request-body-limit",
@@ -10049,8 +10053,19 @@ var CODE_RULES = [
     // The tail is what distinguishes assembly from parameterisation. A bound
     // query leaves a comma after the closing quote (`"… = $1", [id]`) and
     // matches none of these.
+    //
+    // The clause alternative anchors the keyword to the *start* of the
+    // concatenated fragment, because that is where a clause being appended
+    // actually sits: `sql + "WHERE id = " + id`, `sql + " ORDER BY " + col`.
+    //
+    // Allowing it anywhere in the fragment made the rule read English. `WHERE`
+    // and `SET` are ordinary words, and without a leading `\b` they were not
+    // even required to be whole ones — "any`where`" and "sub`set`" both
+    // matched. A help string reading "lists them anywhere" was reported as
+    // critical SQL injection, which is the kind of finding that teaches a team
+    // the scanner is not worth reading.
     pattern: new RegExp(
-      `${SQL_STRING}\\s*\\+|${SQL_STRING}\\s*%\\s*[\\w(]|${SQL_STRING}\\s*\\.\\s*format\\s*\\(|\\+\\s*(?:"[^"\\n]*|'[^'\\n]*)(?:WHERE|ORDER\\s+BY|VALUES|SET)\\b`,
+      `${SQL_STRING}\\s*\\+|${SQL_STRING}\\s*%\\s*[\\w(]|${SQL_STRING}\\s*\\.\\s*format\\s*\\(|\\+\\s*(?:"|')\\s*\\b(?:WHERE|ORDER\\s+BY|VALUES|SET)\\b`,
       "i"
     )
   },
@@ -10063,7 +10078,26 @@ var CODE_RULES = [
     pattern: new RegExp(
       `\`[^\`\\n]*(?:${SQL_KEYWORDS})\\b[^\`\\n]*\\$\\{|\\bf"[^"\\n]*(?:${SQL_KEYWORDS})\\b[^"\\n]*\\{|\\bf'[^'\\n]*(?:${SQL_KEYWORDS})\\b[^'\\n]*\\{`,
       "i"
-    )
+    ),
+    /**
+     * Interpolating a column list is not interpolating a value.
+     *
+     *     const COLS = `tld, user_id, owner_email, price_usd`;
+     *     get(`SELECT ${COLS} FROM moshpit_tlds WHERE tld = ?`, [tld]);
+     *
+     * That query *is* parameterised: every value the caller supplies rides a
+     * `?`, and the only thing spliced into the text is a constant written a
+     * few lines up. Naming the column list once instead of repeating it in
+     * fourteen queries is ordinary hygiene, and it is the shape this rule met
+     * most often in practice — one repository produced eighteen findings this
+     * way and not one of them could be injected into.
+     *
+     * The guard resolves the interpolations rather than trusting the shape, so
+     * the moment a query mixes a constant with anything else —
+     * `` `SELECT ${COLS} FROM t WHERE id = ${req.query.id}` `` — it is reported
+     * again. `interpolationsAreConstant` requires *every* `${…}` to resolve.
+     */
+    constantInterpolationGuard: true
   },
   {
     id: "sql-format-call",
@@ -10113,7 +10147,22 @@ var CODE_RULES = [
     cwe: "CWE-78",
     severity: "critical",
     languages: ["go"],
-    pattern: /\bexec\.Command(?:Context)?\s*\(\s*(?:ctx\s*,\s*)?"(?:\/bin\/)?(?:sh|bash|zsh|cmd|powershell)"\s*,\s*"(?:-c|\/c)"/
+    pattern: /\bexec\.Command(?:Context)?\s*\(\s*(?:ctx\s*,\s*)?"(?:\/bin\/)?(?:sh|bash|zsh|cmd|powershell)"\s*,\s*"(?:-c|\/c)"/,
+    // A call whose whole argv is string literals cannot be injected into.
+    // `exec.Command("cmd", "/c", "ver")` reads the Windows version; there is no
+    // value in it for an attacker to reach, and the consequence above — that a
+    // shell will interpret metacharacters — describes metacharacters nobody can
+    // supply. gosec's G204 draws the line in the same place, and this was the
+    // single finding a Go project got out of a whole scan before declining the
+    // offer, which is an expensive way to report nothing.
+    //
+    // The guard has to end at the closing paren, so a literal followed by
+    // anything else still reports: `"ls " + dir` leaves a `+` before the `)`,
+    // `fmt.Sprintf(…)` leaves an identifier, and a bare variable leaves a name.
+    // `(?:[^"\\]|\\.)*` rather than `[^"]*` so an escaped quote inside a
+    // literal — `"echo \"hi\""` — does not end the literal early and drop the
+    // guard on a line it should have covered.
+    lineGuard: /\bexec\.Command(?:Context)?\s*\(\s*(?:ctx\s*,\s*)?"(?:\/bin\/)?(?:sh|bash|zsh|cmd|powershell)"\s*,\s*"(?:-c|\/c)"\s*(?:,\s*"(?:[^"\\]|\\.)*")*\s*,?\s*\)/
   },
   {
     id: "rb-backtick-interpolation",
@@ -10182,17 +10231,43 @@ var CODE_RULES = [
     cwe: "CWE-79",
     severity: "high",
     languages: ["javascript", "typescript"],
-    pattern: /\bdangerouslySetInnerHTML\s*=|\.\s*(?:innerHTML|outerHTML)\s*=\s*(?!\s*['"`]\s*['"`]\s*;?\s*$)|\bdocument\s*\.\s*write(?:ln)?\s*\(|\.\s*insertAdjacentHTML\s*\(/,
     /**
+     * The assignment alternative carries its own exemption, as a lookahead, so
+     * that it is decided per assignment rather than per line.
+     *
      * A whole-statement assignment of a string with no interpolation and no
-     * concatenation carries no data, so it cannot carry attacker data. This
-     * was the single largest source of noise: a codebase that builds its UI
-     * with innerHTML reports every static heading and spinner as XSS, and a
-     * rule that flags 40 safe lines to catch one real one gets switched off.
+     * concatenation carries no data, so it cannot carry attacker data. This was
+     * the single largest source of noise: a codebase that builds its UI with
+     * innerHTML reports every static heading and spinner as XSS, and a rule
+     * that flags 40 safe lines to catch one real one gets switched off.
+     *
+     * Two things this has to get right, and a `lineGuard` could get neither:
+     *
+     * A statement ends at its semicolon, not at the newline. Anchoring to `$`
+     * held the exemption for `el.innerHTML = '';` alone on a line and dropped
+     * it the moment anything followed:
+     *
+     *     function hide() { out.hidden = true; out.innerHTML = ''; rendered = null; }
      *
-     * Line-scoped on purpose — see `lineGuard`.
+     * — the same assignment, clearing a node, reported as high-severity XSS
+     * because two neighbours shared its line.
+     *
+     * And an exemption must not become a line-wide amnesty. A guard is tested
+     * against the whole line, so one safe clear would exonerate a real sink
+     * beside it:
+     *
+     *     a.innerHTML = ''; b.innerHTML = userInput;
+     *
+     * As a lookahead the regex decides at each `=` it reaches, so the first
+     * assignment is exempt and the second is still reported.
+     *
+     * The whitespace after `=` is matched *inside* the lookahead rather than
+     * before it. Left outside, `\s*` backtracks to zero width, the lookahead
+     * then starts on the space instead of the quote, fails to see a literal,
+     * and the negative lookahead succeeds — reinstating every finding the
+     * exemption was written to remove.
      */
-    lineGuard: /(?:innerHTML|outerHTML)\s*=\s*(?:'[^'\\]*'|"[^"\\]*"|`[^`$\\]*`)\s*;?\s*$/
+    pattern: /\bdangerouslySetInnerHTML\s*=|\.\s*(?:innerHTML|outerHTML)\s*=(?!\s*(?:'[^'\\\n]*'|"[^"\\\n]*"|`[^`$\\\n]*`)\s*(?:;|$))|\bdocument\s*\.\s*write(?:ln)?\s*\(|\.\s*insertAdjacentHTML\s*\(/
   },
   {
     id: "java-html-writer-concatenation",
@@ -11130,6 +11205,45 @@ function interpolationsAreConstant(line, fileText) {
     (expr) => /^[A-Za-z_$][\w$]*$/.test(expr) && isConstantString(expr, fileText)
   );
 }
+var FILL_LOOKAHEAD = 16;
+var NAME = String.raw`(?<![\w$])([A-Za-z_$][\w$]*)`;
+var ALLOCATION_BINDING = new RegExp(
+  `${NAME}\\s*=\\s*(?:new\\s+Buffer\\s*\\(|Buffer\\s*\\.\\s*allocUnsafe(?:Slow)?\\s*\\()`
+);
+function allocationBinding(line) {
+  return ALLOCATION_BINDING.exec(line)?.[1] ?? null;
+}
+var WRITE_SHAPES = [
+  // `src.copy(name, …)` — name is the destination.
+  /\.\s*copy\s*\(\s*([A-Za-z_$][\w$]*)\s*[,)]/g,
+  // `name.fill(…)`, `name.write*(…)`, `name.set(…)`.
+  new RegExp(`${NAME}\\s*\\.\\s*(?:fill|set|write[A-Za-z0-9]*)\\s*\\(`, "g"),
+  // `name[i] = …`, but not `name[i] === …`.
+  new RegExp(`${NAME}\\s*\\[[^\\]\\n]*\\]\\s*=(?!=)`, "g")
+];
+function writesInto(text, name) {
+  for (const shape of WRITE_SHAPES) {
+    shape.lastIndex = 0;
+    for (let found = shape.exec(text); found !== null; found = shape.exec(text)) {
+      if (found[1] === name) return true;
+    }
+  }
+  return false;
+}
+function bufferFilledBeforeUse(ctx) {
+  const line = ctx.lines[ctx.index] ?? "";
+  if (/\ballocUnsafe(?:Slow)?\s*\([^)\n]*\)\s*\.\s*fill\s*\(/.test(line)) return true;
+  const name = allocationBinding(line);
+  if (!name) return false;
+  if (writesInto(line.slice(line.indexOf("=") + 1), name)) return true;
+  const last = Math.min(ctx.lines.length - 1, ctx.index + FILL_LOOKAHEAD);
+  for (let i = ctx.index + 1; i <= last; i += 1) {
+    const next = ctx.lines[i] ?? "";
+    if (skippable(next, i, ctx.prose)) continue;
+    if (writesInto(next, name)) return true;
+  }
+  return false;
+}
 function evaluateRule(rule, ctx) {
   if (rule.languages && !rule.languages.includes(ctx.language)) return null;
   const line = ctx.lines[ctx.index] ?? "";
@@ -11148,6 +11262,7 @@ function evaluateRule(rule, ctx) {
   if (rule.constantInterpolationGuard && interpolationsAreConstant(line, fileTextOf(ctx.lines))) {
     return null;
   }
+  if (rule.filledBeforeUseGuard && bufferFilledBeforeUse(ctx)) return null;
   const guard = rule.guard === void 0 ? GENERIC_GUARD : rule.guard;
   if (guard && (guard.test(line) || guard.test(context))) return null;
   const untrusted = untrustedPatternFor(ctx.language);
@@ -11792,6 +11907,11 @@ var KNOWN_PLACEHOLDERS = [
 function isKnownPlaceholder(text) {
   return KNOWN_PLACEHOLDERS.some((pattern) => pattern.test(text));
 }
+function isPlaceholderAttribute(line, value) {
+  const at = line.lastIndexOf(value);
+  if (at === -1) return false;
+  return /(?:^|\s)(?:aria-)?placeholder\s*=\s*[{("'`]*$/i.test(line.slice(0, at));
+}
 function isVariableReference(value) {
   const trimmed = value.trim();
   const braced = /^\$\{\s*([A-Za-z_][\w.]*)\s*(?::?[-=+?]([\s\S]*))?\}$/.exec(trimmed);
@@ -11834,10 +11954,13 @@ function words(text) {
 function isTestFixtureValue(line, value) {
   const valueWords = words(value);
   if (valueWords.some((word) => FIXTURE_STEMS.some((stem) => word.startsWith(stem)))) return true;
+  return describesItsOwnKey(line, value);
+}
+function describesItsOwnKey(line, value) {
   if (value.length > 48) return false;
   const valueAt = line.lastIndexOf(value);
   const key = valueAt === -1 ? line : line.slice(0, valueAt);
-  const flattened = valueWords.join("");
+  const flattened = words(value).join("");
   return words(key).filter((word) => word.length >= 4 && !KEY_NOISE.has(word)).some((word) => flattened.includes(word));
 }
 function redactSecret(line) {
@@ -12017,9 +12140,9 @@ function languageOfShebang(firstLine) {
 }
 var SUPPRESS_NEXT = /threatcrush-disable-next-line(?:\s+([\w-]+))?/;
 var SUPPRESS_LINE = /threatcrush-disable-line(?:\s+([\w-]+))?/;
-var FOREIGN_CREDENTIAL = /\b(?:nolint:[\w,]*gosec|nosec)\b[^\n]*\bG101\b|\bG101\b[^\n]*\b(?:nolint:[\w,]*gosec|nosec)\b/;
-function foreignCredentialMark(line) {
-  return FOREIGN_CREDENTIAL.test(line);
+var FOREIGN_SECURITY = /\b(?:nolint:[\w,]*gosec|nosec)\b/;
+function foreignSecurityMark(line) {
+  return FOREIGN_SECURITY.test(line);
 }
 function collectSuppressions(lines) {
   const byLine = /* @__PURE__ */ new Map();
@@ -12045,13 +12168,42 @@ function isSuppressed(suppressions, index, ruleId) {
 }
 function isTestPath(relativePath) {
   const p = relativePath.replace(/\\/g, "/");
-  return /(?:^|\/)(?:tests?|__tests__|__mocks__|spec|specs|fixtures?|mocks?|e2e|testdata)\//i.test(p) || /(?:^|\/)(?:test|conftest)_[^/]+$/i.test(p) || /[._-](?:test|spec)\.[a-z]+$/i.test(p) || /_test\.[a-z]+$/i.test(p);
+  return /(?:^|\/)(?:tests?|__tests__|__mocks__|spec|specs|fixtures?|mocks?|e2e|testdata|testutils?|harness)\//i.test(p) || /(?:^|\/)(?:test|conftest)_[^/]+$/i.test(p) || /[._-](?:test|spec)\.[a-z]+$/i.test(p) || /_test\.[a-z]+$/i.test(p);
 }
+function isDocPath(relativePath) {
+  const p = relativePath.replace(/\\/g, "/");
+  return /(?:^|\/)(?:docs?|examples?|samples?)\//i.test(p) || /\.(?:md|mdx|markdown|rst|adoc)$/i.test(p);
+}
+var SOFTENING_ORDER = [
+  "suppressed",
+  "placeholder",
+  "self-describing",
+  "test",
+  "docs"
+];
+function softening(reasons) {
+  return SOFTENING_ORDER.find((reason) => reasons[reason]) ?? null;
+}
+var SECRET_SOFTENING = {
+  test: "in a test file \u2014 usually a fixture, still worth confirming it is not a live credential",
+  docs: "in documentation \u2014 usually an illustrative example, still worth confirming it is not a live credential",
+  suppressed: "on a line already marked as a false positive for another linter's security rule",
+  placeholder: "in example text an empty input field shows, not in data",
+  "self-describing": "in a value that repeats the name of the field holding it \u2014 usually a description of a credential rather than one"
+};
+var CODE_SOFTENING = {
+  test: "in a test file, where the construct is ordinary",
+  docs: "in documentation or example code, which nothing runs",
+  suppressed: "on a line another linter's security suppression already covers",
+  placeholder: "in example text rather than in data",
+  "self-describing": "in a value that describes itself"
+};
 function scanText(relativePath, text, language = languageOf(relativePath)) {
   const findings = [];
   const lines = text.split("\n");
   const suppressions = collectSuppressions(lines);
   const inTests = isTestPath(relativePath);
+  const inDocs = isDocPath(relativePath);
   lines.forEach((line, index) => {
     for (const rule of SECRET_RULES) {
       const match = rule.pattern.exec(line);
@@ -12061,18 +12213,23 @@ function scanText(relativePath, text, language = languageOf(relativePath)) {
       const value = match[1] ?? match[0];
       if (isVariableReference(value)) continue;
       if (inTests && rule.keywordShaped && isTestFixtureValue(line, value)) continue;
-      const marked = foreignCredentialMark(line);
+      const soft = softening({
+        test: inTests,
+        suppressed: foreignSecurityMark(line),
+        placeholder: isPlaceholderAttribute(line, value),
+        "self-describing": rule.keywordShaped === true && describesItsOwnKey(line, value)
+      });
       findings.push({
         ruleId: rule.id,
         title: rule.name,
         file: relativePath,
         line: index + 1,
-        // Reported but not blocking in tests — see isTestPath. The same goes
-        // for a line another linter's credential rule was already told about.
-        severity: inTests || marked ? "low" : rule.severity,
+        // Reported but not blocking wherever context weakens the claim — see
+        // `softening`. Never dropped: the count is the same either way.
+        severity: soft ? "low" : rule.severity,
         // A matched credential format is the finding, not a proxy for one.
         confidence: "evidence",
-        message: inTests ? `Possible ${rule.name} detected in a test file \u2014 usually a fixture, still worth confirming it is not a live credential` : marked ? `Possible ${rule.name} detected on a line already marked as a false positive for another linter's credential rule` : `Possible ${rule.name} detected`,
+        message: soft ? `Possible ${rule.name} detected ${SECRET_SOFTENING[soft]}` : `Possible ${rule.name} detected`,
         consequence: rule.consequence,
         cwe: rule.cwe,
         excerpt: redactSecret(line.trim()).slice(0, 200),
@@ -12087,14 +12244,19 @@ function scanText(relativePath, text, language = languageOf(relativePath)) {
       if (isSuppressed(suppressions, index, rule.id)) continue;
       const match = evaluateRule(rule, { lines, index, language, prose });
       if (!match) continue;
+      const soft = softening({
+        test: inTests,
+        docs: inDocs,
+        suppressed: foreignSecurityMark(lines[index] ?? "")
+      });
       findings.push({
         ruleId: rule.id,
         title: rule.title,
         file: relativePath,
         line: index + 1,
-        severity: match.severity,
+        severity: soft ? "low" : match.severity,
         confidence: match.confidence,
-        message: `${rule.title} (${rule.cwe})`,
+        message: soft ? `${rule.title} (${rule.cwe}) \u2014 ${CODE_SOFTENING[soft]}` : `${rule.title} (${rule.cwe})`,
         consequence: rule.consequence,
         cwe: rule.cwe,
         excerpt: (lines[index] ?? "").trim().slice(0, 200),
@@ -12105,14 +12267,19 @@ function scanText(relativePath, text, language = languageOf(relativePath)) {
   for (const match of evaluateTemplateRules(extensionOf(relativePath), lines)) {
     const index = match.line - 1;
     if (isSuppressed(suppressions, index, match.rule.id)) continue;
+    const soft = softening({
+      test: inTests,
+      docs: inDocs,
+      suppressed: foreignSecurityMark(lines[index] ?? "")
+    });
     findings.push({
       ruleId: match.rule.id,
       title: match.rule.title,
       file: relativePath,
       line: match.line,
-      severity: match.severity,
+      severity: soft ? "low" : match.severity,
       confidence: "pattern",
-      message: `${match.rule.title} (${match.rule.cwe})`,
+      message: soft ? `${match.rule.title} (${match.rule.cwe}) \u2014 ${CODE_SOFTENING[soft]}` : `${match.rule.title} (${match.rule.cwe})`,
       consequence: match.rule.consequence,
       cwe: match.rule.cwe,
       excerpt: (lines[index] ?? "").trim().slice(0, 200),