@profullstack/threatcrush 0.11.3 → 0.11.4

package/dist/daemon.js

@@ -2150,6 +2150,9 @@ bus.setMaxListeners(50);
 var import_better_sqlite3 = __toESM(require("better-sqlite3"));
 var db = null;
 var dbUnavailable = false;
+function isStateDbAvailable() {
+  return db !== null;
+}
 function initStateDB(dbPath = "/var/lib/threatcrush/state.db") {
   if (db) return db;
   if (dbUnavailable) {
@@ -2427,7 +2430,8 @@ var IpcServer = class {
             socket: PATHS.socket
           },
           modules: this.moduleHost.summary(),
-          counters: { ...this.counters }
+          counters: { ...this.counters },
+          stateDb: isStateDbAvailable()
         };
         return this.send(client, { id: req.id, ok: true, result: status });
       }
@@ -4979,7 +4983,12 @@ var CODE_RULES = [
     severity: "critical",
     languages: ["javascript", "typescript"],
     pattern: /\b(?:exec|execSync|spawn|spawnSync)\s*\(\s*(?:`[^`]*\$\{|['"][^'"]*['"]\s*\+|[a-zA-Z_$][\w$]*\s*\+)/,
-    constantInterpolationGuard: true
+    constantInterpolationGuard: true,
+    // Interpolation is common in locally run CLI and installer code. Report
+    // command execution as an injection vulnerability only when the nearby
+    // code shows a caller-controlled source, rather than treating every
+    // internally assembled command as attacker input.
+    needsContext: true
   },
   {
     id: "py-shell-command-string",
@@ -5117,7 +5126,8 @@ var CODE_RULES = [
      * and the negative lookahead succeeds — reinstating every finding the
      * exemption was written to remove.
      */
-    pattern: /\bdangerouslySetInnerHTML\s*=|\.\s*(?:innerHTML|outerHTML)\s*=(?!\s*(?:'[^'\\\n]*'|"[^"\\\n]*"|`[^`$\\\n]*`)\s*(?:;|$))|\bdocument\s*\.\s*write(?:ln)?\s*\(|\.\s*insertAdjacentHTML\s*\(/
+    pattern: /\bdangerouslySetInnerHTML\s*=|\.\s*(?:innerHTML|outerHTML)\s*=(?!\s*(?:'[^'\\\n]*'|"[^"\\\n]*"|`[^`$\\\n]*`)\s*(?:;|$))|\bdocument\s*\.\s*write(?:ln)?\s*\(|\.\s*insertAdjacentHTML\s*\(/,
+    sanitizedHtmlGuard: true
   },
   {
     id: "java-html-writer-concatenation",
@@ -5196,7 +5206,8 @@ var CODE_RULES = [
     severity: "medium",
     languages: ["javascript", "typescript"],
     pattern: /\b(?:res|response)\s*\.\s*redirect\s*\(\s*[a-zA-Z_$][\w$]*\s*\)|\bwindow\s*\.\s*location(?:\s*\.\s*(?:href|replace))?\s*(?:=\s*[a-zA-Z_$]|\(\s*[a-zA-Z_$][\w$]*\s*\))/,
-    needsContext: true
+    needsContext: true,
+    safeRedirectGuard: true
   },
   // ── Deserialisation ──────────────────────────────────────────────────────
   {
@@ -5396,7 +5407,7 @@ var CODE_RULES = [
     // the pattern is written. `other` also covers C++, Rust and Zig, which
     // share the cast-then-deref spelling.
     languages: ["javascript", "typescript", "python", "ruby", "go", "java", "php"],
-    pattern: /\([^)\n]*[+*]\s*\)\s*[+*]|\([^)\n]*\{\d+,\}\s*\)\s*[+*{]/
+    pattern: /(?:^|[=(:,]\s*)\/(?:\\.|[^/\\\n])*\([^()\n]*[+*][^()\n]*\)\s*(?:[+*]|\{\d+,\})|\b(?:new\s+RegExp|RegExp|re\.compile|regexp\.(?:Compile|MustCompile)|Pattern\.compile)\s*\(\s*(?:r)?["'][^"'\n]*\([^()\n]*[+*][^()\n]*\)\s*(?:[+*]|\{\d+,\})/
   },
   // ── Temporary files ──────────────────────────────────────────────────────
   {
@@ -5405,10 +5416,13 @@ var CODE_RULES = [
     consequence: "A predictable name in a world-writable directory is a symlink attack: an attacker pre-creates the path and your process writes through it.",
     cwe: "CWE-377",
     severity: "medium",
-    // A hardcoded path under /tmp is the finding whether or not it is
-    // formatted: `"/tmp/application.log.tmp"` is worse than the PID-based one,
-    // because every process on the host can predict it exactly.
-    pattern: /\btempfile\.mktemp\s*\(|\bos\.tmpnam\s*\(|['"]\/tmp\/[^'"\n]+['"]|['"]\/tmp\/[^'"\n]*\{|\bFile\.createTempFile\s*\(/
+    // `File.createTempFile` is specifically the safe Java API, and a string
+    // containing `/tmp/` is not necessarily a write. Detect unsafe name
+    // generators and actual writes to a literal temp path instead. Shell
+    // redirections are handled by the shell-specific rule below.
+    pattern: new RegExp(
+      String.raw`\btempfile\.mktemp\s*\(|\bos\.tmpnam\s*\(|\b(?:writeFile(?:Sync)?|appendFile(?:Sync)?|createWriteStream|FileOutputStream|FileWriter|os\.OpenFile|open)\s*\([^\n)]*['"]\/tmp\/[^'"\n]+['"]`
+    )
   },
   // ── Information exposure ─────────────────────────────────────────────────
   {
@@ -5461,7 +5475,6 @@ var CODE_RULES = [
   // of privileged work actually happens, and they run as whoever invoked them.
   {
     id: "sh-remote-script-execution",
-    inherent: true,
     title: "network output piped into a shell",
     consequence: "Whatever that URL serves at the moment this runs is executed as the invoking user. There is no version, no signature, and no review \u2014 a compromise of the host, or anyone able to answer for it, is a compromise of every machine that runs the script.",
     cwe: "CWE-494",
@@ -5470,9 +5483,13 @@ var CODE_RULES = [
     // The pipe must be the *next* thing: `curl -o f url && sh f` is a different
     // (and checkable) shape, and `curl url | jq` is not an execution at all.
     pattern: /\b(?:curl|wget)\b[^|\n]*\|\s*(?:sudo\s+(?:-\S+\s+)*)?(?:\/bin\/|\/usr\/bin\/)?(?:ba|da|k|z|a)?sh\b/,
-    // Nothing on this line can exonerate it. Integrity checking happens in a
-    // separate step by construction, so a window guard would only mislead.
-    guard: false
+    // This is a supply-chain review item, not proof that the repository is
+    // compromised. A literal HTTPS installer URL is capped at medium; it only
+    // escalates when nearby evidence shows that input can choose the download.
+    guard: false,
+    // Installer instructions printed by the script do not execute.  Matching
+    // them made a script report its own documentation as a network pipeline.
+    lineGuard: /^\s*(?:echo|printf|say|info|warn|error)\s+["'][^"'\n]*\b(?:curl|wget)\b/
   },
   {
     id: "sh-eval-expansion",
@@ -6048,6 +6065,57 @@ function isConstantString(name, fileText) {
     `\\bconst\\s+${escaped}\\s*(?::[^=\\n]+)?=\\s*(?:'[^'\\n]*'|"[^"\\n]*"|\`[^\`$\\n]*\`)`
   ).test(fileText);
 }
+function hasSanitizedHtmlValue(line, fileText) {
+  const direct = /\b__html\s*:\s*(?:[A-Za-z_$][\w$]*\s*\.\s*)?(?:sanitize\w*|escape\w*|serializeJsonForHtml|renderSanitizedMarkdown)\s*\(/i;
+  if (direct.test(line)) return true;
+  const value = /\b__html\s*:\s*([A-Za-z_$][\w$]*)\b/.exec(line)?.[1];
+  if (!value) return false;
+  const escaped = value.replace(/[.*+?^${}()|[\]\\]/g, "\\$&");
+  return new RegExp(
+    `\\bconst\\s+${escaped}\\s*=[^\\n;]*(?:[A-Za-z_$][\\w$]*\\s*\\.\\s*)?(?:sanitize\\w*|escape\\w*|serializeJsonForHtml|renderSanitizedMarkdown)\\s*\\(`,
+    "i"
+  ).test(fileText);
+}
+function isIdentifierStart(char) {
+  if (!char) return false;
+  const code = char.charCodeAt(0);
+  return char === "$" || char === "_" || code >= 65 && code <= 90 || code >= 97 && code <= 122;
+}
+function isIdentifierPart(char) {
+  if (isIdentifierStart(char)) return true;
+  if (!char) return false;
+  const code = char.charCodeAt(0);
+  return code >= 48 && code <= 57;
+}
+function identifierAfter(text, start) {
+  let index = start;
+  while (text[index] === " " || text[index] === "	") index += 1;
+  if (!isIdentifierStart(text[index])) return null;
+  const from = index;
+  while (isIdentifierPart(text[index])) index += 1;
+  return text.slice(from, index);
+}
+function hasSafeRedirectValue(line, fileText) {
+  const location = line.indexOf("window.location");
+  const redirect = line.indexOf(".redirect");
+  const valueStart = location >= 0 ? line.indexOf("=", location) + 1 : redirect >= 0 ? line.indexOf("(", redirect) + 1 : 0;
+  if (valueStart === 0) return false;
+  const value = identifierAfter(line, valueStart);
+  if (!value) return false;
+  const declaration = `const ${value}`;
+  for (const candidate of fileText.split("\n")) {
+    const at = candidate.indexOf(declaration);
+    if (at === -1 || isIdentifierPart(candidate[at - 1]) || isIdentifierPart(candidate[at + declaration.length])) {
+      continue;
+    }
+    const equals = candidate.indexOf("=", at + declaration.length);
+    const initializer = candidate.slice(equals + 1);
+    if (equals !== -1 && ["safeRedirectPath(", "safeRedirectUrl(", "safeRedirectURL("].some((call) => initializer.includes(call))) {
+      return true;
+    }
+  }
+  return false;
+}
 function interpolationsAreConstant(line, fileText) {
   const found = interpolations(line);
   if (!found) return false;
@@ -6112,6 +6180,12 @@ function evaluateRule(rule, ctx) {
   if (rule.constantInterpolationGuard && interpolationsAreConstant(line, fileTextOf(ctx.lines))) {
     return null;
   }
+  if (rule.sanitizedHtmlGuard && hasSanitizedHtmlValue(line, fileTextOf(ctx.lines))) {
+    return null;
+  }
+  if (rule.safeRedirectGuard && hasSafeRedirectValue(line, fileTextOf(ctx.lines))) {
+    return null;
+  }
   if (rule.filledBeforeUseGuard && bufferFilledBeforeUse(ctx)) return null;
   const guard = rule.guard === void 0 ? GENERIC_GUARD : rule.guard;
   if (guard && (guard.test(line) || guard.test(context))) return null;
@@ -6477,6 +6551,10 @@ function detectTyposquat(name, ecosystem) {
   return null;
 }
 var LIFECYCLE_SCRIPTS = ["preinstall", "install", "postinstall", "prepare", "prepublish"];
+function isRiskyLifecycleScript(body) {
+  if (typeof body !== "string") return false;
+  return /\b(?:curl|wget)\b[^\n|]*\|\s*(?:\w*sh|bash|node|python)\b|\b(?:curl|wget)\b[^\n]*(?:https?:|--upload-file)|\b(?:node|python|ruby|perl)\s+-e\b|\b(?:base64|openssl)\b[^\n]*(?:-d|--decode)|\beval\s+|\bchmod\s+(?:\S+\s+)*(?:777|a\+rwx)\b/i.test(body);
+}
 function scanPackageJson(text) {
   const findings = [];
   const lines = text.split("\n");
@@ -6528,13 +6606,14 @@ function scanPackageJson(text) {
   if (scripts && typeof scripts === "object") {
     for (const [name, body] of Object.entries(scripts)) {
       if (!LIFECYCLE_SCRIPTS.includes(name)) continue;
+      if (!isRiskyLifecycleScript(body)) continue;
       findings.push({
-        ruleId: "manifest-install-lifecycle-script",
-        title: "install-time lifecycle script",
+        ruleId: "manifest-risky-install-lifecycle-script",
+        title: "risky install-time lifecycle script",
         line: lineOf(name),
         severity: "medium",
         cwe: "CWE-506",
-        message: `"${name}" runs automatically on install: ${String(body).slice(0, 120)}`,
+        message: `"${name}" runs automatically on install and contains a network or code-execution primitive: ${String(body).slice(0, 120)}`,
         consequence: "Lifecycle scripts run with the installing user\u2019s privileges and network access, before any code is reviewed. It is the execution vector every notable npm compromise has used.",
         excerpt: (lines[lineOf(name) - 1] ?? "").trim()
       });